Google Professional-Cloud-Network-Engineer Value Pack (Frequently Bought Together)

Your organization relies on a critical Dedicated Interconnect connection for its hybrid cloud strategy. You need to proactively monitor this connection's health and network connectivity to ensure its reliability. You want to be alerted if the light level for an optical transceiver drops below the recommended operational power, or if traffic through the connection suddenly stops. What should you do?

• A. Create an alerting policy in Cloud Monitoring that triggers if the total byte count sent over the VLAN attachment drops to zero.
• B. Configure a periodic connectivity test in the Network Intelligence Center to ping an on-premises host and alert based on its success rate.
• C. Create alerting policies in Cloud Monitoring based on the metrics for both the optical power level of the physical link and the BGP session state of the VLAN attachment.
• D. Build a log-based alert in Cloud Logging that parses Cloud Router logs to detect when BGP keepalive messages are no longer received.

You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on- premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access. What configuration changes should you make to enable Private Google Access while adhering to your security team's requirements?

• A. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record painting to Google's private AP address range.
  Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
• B. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
  Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
• C. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
  Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
• D. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range.
  Create a custom route that points Google's private API address range to the default internet gateway as the next hop.

You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem.
What should you do?

• A. Explicitly reference the custom mode networks in the Cloud Armor whitelist.
• B. Apply an additional IAM role to the Google API's service account to allow custom mode networks.
• C. Update the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.
• D. Explicitly reference the custom mode networks in the Deployment Manager templates.

Your company uses a multi-VPC architecture to isolate its production, development, and testing environments. Following a recent security mandate, you need to ensure that all Compute Engine VMs across multiple production VPCs can access Google APIs, such as Cloud Storage and Cloud SQL, without having any route pointing to the internet gateway to comply with security policies. Your solution must also be scalable and easy to manage across all VPCs. What should you do?

• A. Deploy a Cloud NAT gateway in each VPC region to provide a secure egress point for traffic destined for Google APIs.
• B. Configure VPC Service Controls, and create a service perimeter that includes all relevant projects and the required Google services on each VPC.
• C. Create a Private Service Connect endpoint for Google APIs in each of the VPCs. Create a private zone in Cloud DNS for googleapis.com, with an A record pointing to the PSC endpoint created.
• D. Enable Private Google Access on all subnets where the VMs are located. Create a private zone in Cloud DNS for googleapis.com, with an A record pointing to 199.36.153.8/30.

Your company recently migrated to Google Cloud. You configured separate Virtual Private Cloud (VPC) networks for Department A and Department B. You need to configure both VPC networks to have access to the same on-premises location through separate links with full isolation between the VPC networks. Your design must also query on-premises DNS servers from workloads in Google Cloud using conditional forwarding. You want to minimize operational overhead. What should you do?

• A. Keep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
• B. Peer Department A's and Department B's VPC networks to have all on-premises connectivity via a single VPC network. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
• C. Customize the operating system DNS configuration files to target the on-premises DNS servers.
• D. Configure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network.