support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD NETWORK ENGINEER

Free PROFESSIONAL CLOUD NETWORK ENGINEER Exam Braindumps
Professional Cloud Network Engineer Questions 91–95 (page: 20)

Updated On: 10-Feb-2026
Page 20 of 51
PDF with 316 Questions

You recently noticed a recurring daily spike in network usage in your Google Cloud project. You need to identify the virtual machine (VM) instances and type of traffic causing the spike in traffic utilization while minimizing the cost and management overhead required.
What should you do?

  1. Enable VPC Flow Logs and send the output to BigQuery for analysis.
  2. Enable Firewall Rules Logging for all allowed traffic and send the output to BigQuery for analysis.
  3. Configure Packet Mirroring to send all traffic to a VM. Use Wireshark on the VM to identity traffic utilization for each VM in the VP
  4. Deploy a third-party network appliance and configure it as the default gateway. Use the third-party network appliance to identify users with high network traffic.

Answer(s): A



You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on- premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access.
What configuration changes should you make to enable Private Google Access while adhering to your security team's requirements?

  1. 1. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
    2. Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
  2. 1. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
    2. Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
  3. 1. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record painting to Google's private AP address range.
    2. Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
  4. 1. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range.
    2. Create a custom route that points Google's private API address range to the default internet gateway as the next hop.

Answer(s): A



You have deployed an HTTP(s) load balancer, but health checks to port 80 on the Compute Engine virtual machine instance are failing, and no traffic is sent to your instances. You want to resolve the problem.
Which commands should you run?

  1. gcloud compute instances add-access-config instance-1
  2. gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --destination-ranges 130.211.0.0/22,35.191.0.0/16 --direction EGRESS
  3. gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --source-ranges 130.211.0.0/22,35.191.0.0/16 --direction INGRESS
  4. gcloud compute health-checks update http health-check --unhealthy-threshold 10

Answer(s): C



You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed.
When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects.
What should you do?

  1. Add a firewall rule that allows port 443 from the other spoke projects.
  2. Enable Private Google Access on the subnet where the GKE nodes are deployed.
  3. Configure the authorized networks to be the subnet ranges of the other spoke projects.
  4. Deploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.

Answer(s): D



You recently deployed your application in Google Cloud. You need to verify your Google Cloud network configuration before deploying your on-premises workloads. You want to confirm that your Google Cloud network configuration allows traffic to flow from your cloud resources to your on- premises network. This validation should also analyze and diagnose potential failure points in your Google Cloud network configurations without sending any data plane test traffic.
What should you do?

  1. Use Network Intelligence Center's Connectivity Tests.
  2. Enable Packet Mirroring on your application and send test traffic.
  3. Use Network Intelligence Center's Network Topology visualizations.
  4. Enable VPC Flow Logs and send test traffic.

Answer(s): C



  PDF
Viewing page 20 of 51
Viewing questions 96 - 100 out of 316 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD NETWORK ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!