support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD NETWORK ENGINEER

Free PROFESSIONAL CLOUD NETWORK ENGINEER Exam Braindumps
Professional Cloud Network Engineer Questions 121–125 (page: 26)

Updated On: 10-Feb-2026
Page 26 of 51
PDF with 316 Questions

In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers in subnet-a. You will also deploy the application servers and web servers in subnet-b. You want to configure firewall rules that only allow database traffic from the application servers to the database servers.
What should you do?

  1. Create network tag app-server and service account sa-db@my-
    project.iam.gserviceaccount.com. Add the tag to the application servers, and associate the service account with the database servers. Run the following command:
    gcloud compute firewall-rules create app-db-firewall-rule \
    --action allow \
    --direction ingress \
    --rules top:3306 \
    --source-tags app-server \
    --target-service-accounts sa-db@my-
    project.iam.gserviceaccount.com
  2. Create service accounts sa-app@my-project.iam.gserviceaccount.com and sa-db@my- project.iam.gserviceaccount.com. Associate service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command:
    gcloud compute firewall-rules create app-db-firewall-ru
    --allow TCP:3306 \
    --source-service-accounts sa-app@democloud-idp-
    demo.iam.gserviceaccount.com \
    --target-service-accounts sa-db@my-
    project.iam.gserviceaccount.com
  3. Create service accounts sa-app@my-project.iam.gserviceaccount.com and sa-db@my- project.iam.gserviceaccount.com. Associate the service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command:
    gcloud compute firewall-rules create app-db-firewall-ru
    --allow TCP:3306 \
    --source-ranges 10.128.0.0/20 \
    --source-service-accounts sa-app@my-
    project.iam.gserviceaccount.com \
    --target-service-accounts sa-db@my-
    project.iam.gserviceaccount.com
  4. Create network tags app-server and db-server. Add the app-server tag to the application servers, and add the db-server tag to the database servers. Run the following command:
    gcloud compute firewall-rules create app-db-firewall-rule \
    --action allow \
    --direction ingress \
    --rules tcp:3306 \
    --source-ranges 10.128.0.0/20 \
    --source-tags app-server \
    --target-tags db-server

Answer(s): B



You are planning a large application deployment in Google Cloud that includes on-premises connectivity. The application requires direct connectivity between workloads in all regions and on-premises locations without address translation, but all RFC 1918 ranges are already in use in the on-premises locations.
What should you do?

  1. Use multiple VPC networks with a transit network using VPC Network Peering.
  2. Use overlapping RFC 1918 ranges with multiple isolated VPC networks.
  3. Use overlapping RFC 1918 ranges with multiple isolated VPC networks and Cloud NAT.
  4. Use non-RFC 1918 ranges with a single global VPC.

Answer(s): D



Your company's security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web servers within your Virtual Private Cloud (VPC) to handle HTTP and HTTPS web traffic for TCP only.
What should you do?

  1. Create an allow on match ingress firewall rule with the target tag "web-server" to allow all IP addresses for TCP port 80.
  2. Create an allow on match egress firewall rule with the target tag "web-server" to allow all IP addresses for TCP port 80.
  3. Create an allow on match ingress firewall rule with the target tag "web-server" to allow all IP addresses for TCP ports 80 and 443.
  4. Create an allow on match egress firewall rule with the target tag "web-server" to allow web server IP addresses for TCP ports 80 and 443.

Answer(s): C


Reference:

https://cloud.google.com/load-balancing/docs/https



You successfully provisioned a single Dedicated Interconnect. The physical connection is at a colocation facility closest to us-west2. Seventy-five percent of your workloads are in us-east4, and the remaining twenty-five percent of your workloads are in us-central1. All workloads have the same network traffic profile. You need to minimize data transfer costs when deploying VLAN attachments.
What should you do?

  1. Keep the existing Dedicated interconnect. Deploy a VLAN attachment to a Cloud Router in us-west2, and use VPC global routing to access workloads in us-east4 and us-central1.
  2. Keep the existing Dedicated Interconnect. Deploy a VLAN attachment to a Cloud Router in us-east4, and deploy another VLAN attachment to a Cloud Router in us-central1.
  3. Order a new Dedicated Interconnect for a colocation facility closest to us-east4, and use VPC global routing to access workloads in us-central1.
  4. Order a new Dedicated Interconnect for a colocation facility closest to us-central1, and use VPC global routing to access workloads in us-east4.

Answer(s): B



You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on- premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices.
What should you do?

  1. 1. Create a private forwarding zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC.
    2. Create a private peering zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
    3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
    4. Configure VPC peering in the spoke VPCs to peer with the hub VPC.
  2. 1. Create a private forwarding zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
    2. Associate the zone with the hub VPC. Create a private peering zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com associated with the spoke PCs, with the hub VPC as the target.
    3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
  3. 1. Create a private forwarding zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VP
    2. Create a private peering zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
    3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
    4. Create a hub-and-spoke VPN deployment in each spoke VPC to connect back to the on-premises network directly.
  4. 1. Create a private forwarding zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com that points to 192. 168.20.88. Associate the zone with the hub VPC.
    2. Create a private peering zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
    3. Sat a custom route advertisement on the Cloud Router for 35.199.192.0/19.
    4. Create a hub and spoke VPN deployment in each spoke VPC to connect back to the hub VPC.

Answer(s): A



  PDF
Viewing page 26 of 51
Viewing questions 126 - 130 out of 316 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD NETWORK ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!