QUESTION: 93

You have deployed an HTTP(s) load balancer, but health checks to port 80 on the Compute Engine virtual machine instance are failing, and no traffic is sent to your instances. You want to resolve the problem.
Which commands should you run?

gcloud compute instances add-access-config instance-1
gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --destination- ranges 130.211.0.0/22,35.191.0.0/16 --direction EGRESS
gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --source-ranges 130.211.0.0/22,35.191.0.0/16 --direction INGRESS
gcloud compute health-checks update http health-check --unhealthy-threshold 10

Answer(s): A

Reveal Solution Next Question

QUESTION: 94

You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed.
When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects.
What should you do?

Add a firewall rule that allows port 443 from the other spoke projects.
Enable Private Google Access on the subnet where the GKE nodes are deployed.
Configure the authorized networks to be the subnet ranges of the other spoke projects.
Deploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.

Answer(s): C

Reveal Solution Next Question

QUESTION: 95

You recently deployed your application in Google Cloud. You need to verify your Google Cloud network configuration before deploying your on-premises workloads. You want to confirm that your Google Cloud network configuration allows traffic to flow from your cloud resources to your on- premises network. This validation should also analyze and diagnose potential failure points in your Google Cloud network configurations without sending any data plane test traffic.
What should you do?

Use Network Intelligence Center's Connectivity Tests.
Enable Packet Mirroring on your application and send test traffic.
Use Network Intelligence Center's Network Topology visualizations.
Enable VPC Flow Logs and send test traffic.

Answer(s): C

Reveal Solution Next Question

QUESTION: 96

In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost:
Port 8080 should always be open for VMs in the projects in the Dev folder. Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder.
What should you do?

Create and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
Create a Shared VPC for the Dev projects and a Shared VPC for the Prod projects. Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall rule to deny traffic to port 8080 in the Shared VPC for Prod. Deploy VMs to those Shared VPCs.
In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.
Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev VMs and deny traffic to port 8080 on the Prod VMs.

Answer(s): A

Reveal Solution Next Question

Free Professional Cloud Network Engineer Exam Braindumps (page: 25)

QUESTION: 93

QUESTION: 94

QUESTION: 95

QUESTION: 96

Professional Cloud Network Engineer Discussions & Posts