2024 Valid Professional-Cloud-Network-Engineer FREE EXAM DUMPS QUESTIONS & ANSWERS [Q81-Q105]

Share

2024 Valid Professional-Cloud-Network-Engineer FREE EXAM DUMPS QUESTIONS & ANSWERS

Free Professional-Cloud-Network-Engineer Exam Braindumps Google  Pratice Exam


Google Professional-Cloud-Network-Engineer exam is a certification offered by Google Cloud that validates the skills and knowledge of individuals in designing, implementing, and managing network solutions on the Google Cloud Platform. Google Cloud Certified - Professional Cloud Network Engineer certification is ideal for network engineers, system administrators, and other IT professionals who want to demonstrate their proficiency in networking technologies and their ability to work with Google Cloud.


Google Professional-Cloud-Network-Engineer certification is an essential certification for network engineers who want to validate their knowledge and skills in network engineering on the Google Cloud Platform. Professional-Cloud-Network-Engineer exam covers various network services and technologies and is designed to test the candidate's ability to design, implement, and manage complex network solutions. Passing Professional-Cloud-Network-Engineer exam demonstrates that the candidate has the knowledge and skills required to design and implement network solutions on the Google Cloud Platform.

 

NEW QUESTION # 81
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE

  • A. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone
  • B. MANAGED_ZONE
    gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
  • C. MANAGED_ZONE
  • D. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone

Answer: A

Explanation:
Once you have the exported file from your other provider, you can use the gcloud dns record-sets import command to import it into your managed zone.
To import record-sets, you use the dns record-sets import command. The --zone-file-format flag tells importto expect a BIND zone formatted file. If you omit this flag, import expects a YAML-formatted records file.
Reference: https://medium.com/@prashantapaudel/gcp-certification-series-2-4-planning-and-configuring- network-resources-8045ac2cc2ac


NEW QUESTION # 82
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?

  • A. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET_NAME].
  • B. Remove the -m flag from the gsutil command to enable single-threaded transfers.
  • C. Compress files using utilities like tar to reduce the size of data being sent.
  • D. Tune TCP parameters on the on-premises servers.

Answer: D


NEW QUESTION # 83
You are configuring your Google Cloud environment to connect to your on-premises network. Your configuration must be able to reach Cloud Storage APIs and your Google Kubernetes Engine nodes across your private Cloud Interconnect network. You have already configured a Cloud Router with your Interconnect VLAN attachments. You now need to set up the appropriate router advertisement configuration on the Cloud Router. What should you do?

  • A. Configure the route advertisement to the custom setting, and manually add prefix 199.36.153.8/30 to the list of advertisements. Leave all other options as their default settings.
  • B. Configure the route advertisement to the default setting.
  • C. On the on-premises router, configure a static route for the storage API virtual IP address which points to the Cloud Router's link-local IP address.
  • D. Configure the route advertisement to the custom setting, and manually add prefix 199.36.153.8/30 to the list of advertisements. Advertise all visible subnets to the Cloud Router.

Answer: A


NEW QUESTION # 84
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby.
Which BGP attribute should you use on your on-premises router?

  • A. AS-Path
  • B. Community
  • C. Multi-exit Discriminator
  • D. Local Preference

Answer: C

Explanation:
https://cloud.google.com/router/docs/concepts/overview


NEW QUESTION # 85
In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet.
What should you do?

  • A. Delete the system-generated subnet route and create a specific route to instance-B with a tag applied to instance-A.
  • B. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag.
  • C. Move instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-A's network. Configure the appropriate routes to force traffic through to instance-A.
  • D. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A.

Answer: D


NEW QUESTION # 86
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?

  • A. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
  • B. Add a second on-premises VPN gateway with a different public IP address.
    Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
  • C. Add a second Cloud VPN gateway in a different region than the existing VPN gateway.
    Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
  • D. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.

Answer: D

Explanation:
https://cloud.google.com/vpn/docs/concepts/classic-topologies


NEW QUESTION # 87
You want to use Cloud Interconnect to connect your on-premises network to a GCP VPC. You cannot meet Google at one of its point-of-presence (POP) locations, and your on-premises router cannot run a Border Gateway Protocol (BGP) configuration.
Which connectivity model should you use?

  • A. Partner Interconnect with a layer 2 partner
  • B. Dedicated Interconnect
  • C. Partner Interconnect with a layer 3 partner
  • D. Direct Peering

Answer: B

Explanation:
Reference:
https://cloud.google.com/interconnect/docs/support/faq


NEW QUESTION # 88
Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node Which Pod per node CIDR range should you use?

  • A. /24
  • B. /28
  • C. /26
  • D. /25

Answer: D

Explanation:
The correct answer is B. /25.
This answer is based on the following facts:
The Pod per node CIDR range determines the size of the IP address range that is assigned to each node for Pods1. The Pods that run on a node are allocated IP addresses from the node's assigned CIDR range1.
The size of the CIDR range corresponds to the maximum number of Pods per node. For example, a /24 CIDR range allows up to 256 IP addresses, but the default maximum number of Pods per node for Standard clusters is 1102. A /25 CIDR range allows up to 128 IP addresses, which is enough for 100 Pods per node.
The other options are not correct because:
Option A is too large. A /24 CIDR range allows more IP addresses than needed for 100 Pods per node. This could result in inefficient use of the IP address space and limit the number of nodes that can be created in the cluster.
Option C is too small. A /26 CIDR range allows only 64 IP addresses, which is not enough for 60 Pods per node. This could result in insufficient capacity to schedule Pods on the nodes.
Option D is also too small. A /28 CIDR range allows only 16 IP addresses, which is far below the minimum requirement of 60 Pods per node. This could result in Pod scheduling failures and poor performance.


NEW QUESTION # 89
You need to create the technical architecture for hybrid connectivity from your data center to Google Cloud This will be managed by a partner. You want to follow Google-recommended practices for production-level applications. What should you do?

  • A. Configure two Partner Interconnect connections in one metro and two connections in another metro Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure global dynamic routing on the VPC
  • B. Configure two Partner Interconnect connections in one metropolitan area (metro). Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in a single region, and configure regional dynamic routing on the VPC
  • C. Configure two Partner Interconnect connections in one metro and two connections in another metro. Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure regional dynamic routing on the VPC.
  • D. Ask the partner to install two security appliances in the data center. Configure one VPN connection from each of these devices to Google Cloud, and ensure that the VPN devices on-premises are in separate racks on separate power and cooling systems.

Answer: C

Explanation:
"Google's recommended practices for production-level applications" and then see overview of these 2 pages- https://cloud.google.com/network-connectivity/docs/interconnect/tutorials/production-level-overview and https://cloud.google.com/network-connectivity/docs/interconnect/tutorials/non-critical-overview .


NEW QUESTION # 90
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?

  • A. Create unique DNS records for each service that sends traffic to the desired IP address.
  • B. Configure global load balancing to point 172.16.45.0/24 to the correct instance.
  • C. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.
  • D. Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.

Answer: A

Explanation:
Explanation/Reference:


NEW QUESTION # 91
You have the networking configuration shown in the diagram. A pair of redundant Dedicated Interconnect connections (int-Igal and int-Iga2) terminate on the same Cloud Router. The Interconnect connections terminate on two separate on-premises routers. You are advertising the same prefixes from the Border Gateway Protocol (BGP) sessions associated with the Dedicated Interconnect connections. You need to configure one connection as Active for both ingress and egress traffic. If the active Interconnect connection fails, you want the passive Interconnect connection to automatically begin routing all traffic Which two actions should you take to meet this requirement? (Choose Two)

  • A. Advertise a lower MED on the passive Interconnect connection from the on-premises router
  • B. Advertise a lower MED on the active Interconnect connection from the on-premises router
  • C. Configure the advertised route priority as 200 for the BGP session associated with the active Interconnect connection.
  • D. Configure the advertised route priority as 200 for the BGP session associated with the passive Interconnect connection.
  • E. Configure the advertised route priority > 10,200 on the active Interconnect connection.

Answer: B,C

Explanation:
This answer meets the requirement of configuring one connection as Active for both ingress and egress traffic, and enabling automatic failover to the passive connection in case of failure. The reason is:
The advertised route priority is a value that Cloud Router uses to set the route priority when advertising routes to your on-premises router. The lower the value, the higher the priority1. By setting the advertised route priority as 200 for the active connection, you ensure that it has a higher priority than the passive connection, which has the default value of 1001. This way, your on-premises router will prefer the routes from the active connection over the passive one for ingress traffic.
The MED (Multi-Exit Discriminator) is a value that your on-premises router uses to indicate its preference for receiving traffic from Cloud Router. The lower the value, the higher the preference2. By advertising a lower MED on the active connection from your on-premises router, you ensure that Cloud Router will prefer sending traffic to the active connection over the passive one for egress traffic.
If the active connection fails, Cloud Router will stop receiving routes from it and will start using the routes from the passive connection for egress traffic. Similarly, your on-premises router will stop receiving routes with priority 200 from the active connection and will start using the routes with priority 100 from the passive connection for ingress traffic. This achieves automatic failover without any manual intervention.
Option A is incorrect because setting the advertised route priority > 10,200 on the active connection would deprioritize it globally in your VPC network, which is not what you want1. Option B is incorrect because advertising a lower MED on the passive connection would make Cloud Router prefer sending traffic to it over the active one, which is not what you want2. Option D is incorrect because setting the advertised route priority as 200 for both connections would make them equally preferred by your on-premises router, which is not what you want1.
Reference:
Update the base route priority | Cloud Router | Google Cloud
Configuring BGP sessions | Cloud Router | Google Cloud


NEW QUESTION # 92
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?

  • A. Create a custom Google Compute Engine image with your public ssh key embedded.
  • B. Use gcloud compute ssh to automatically copy your public ssh key to the instance.
  • C. Upload your public ssh key to each instance Metadata.
  • D. Upload your public ssh key to the project Metadata.

Answer: D

Explanation:
Overview By creating and managing SSH keys, you can let users access a Linux instance through third-party tools. An SSH key consists of the following files: A public SSH key file that is applied to instance-level metadata or project-wide metadata. A private SSH key file that the user stores on their local devices. If a user presents their private SSH key, they can use a third-party tool to connect to any instance that is configured with the matching public SSH key file, even if they aren't a member of your Google Cloud project. Therefore, you can control which instances a user can access by changing the public SSH key metadata for one or more instances. https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#addkey


NEW QUESTION # 93
Your company recently migrated to Google Cloud in a Single region. You configured separate Virtual Private Cloud (VPC) networks for two departments. Department A and Department B. Department A has requested access to resources that are part Of Department Bis VPC. You need to configure the traffic from private IP addresses to flow between the VPCs using multi-NIC virtual machines (VMS) to meet security requirements Your configuration also must
* Support both TCP and UDP protocols
* Provide fully automated failover
* Include health-checks
Require minimal manual Intervention In the client VMS
Which approach should you take?

  • A. Create the VMS In the same zone, and configure static routes With IP addresses as next hops.
  • B. Create an instance template and a managed instance group. Configure two separate internal TCP/IJDP load balancers for each protocol (TCP!UDP), and configure the client VIVIS to use the internal load balancers' virtual IP addresses
  • C. Create the VMS in different zones, and configure static routes with instance names as next hops
  • D. Create an Instance template and a managed instance group. Configure a Single internal load balancer, and define a custom static route with the Internal TCP/UDP load balancer as the next hop

Answer: B

Explanation:
The correct answer is D. Create an instance template and a managed instance group. Configure two separate internal TCP/UDP load balancers for each protocol (TCP/UDP), and configure the client VMs to use the internal load balancers' virtual IP addresses.
This answer is based on the following facts:
Using multi-NIC VMs as network virtual appliances (NVAs) allows you to route traffic between different VPC networks1. You can use NVAs to implement custom network policies and security requirements.
Using an instance template and a managed instance group allows you to create and manage multiple identical NVAs2. You can also use health checks and autoscaling policies to ensure high availability and reliability of your NVAs.
Using internal TCP/UDP load balancers allows you to distribute traffic from client VMs to NVAs based on the protocol and port3. You can also use health checks and failover policies to ensure that only healthy NVAs receive traffic.
Configuring the client VMs to use the internal load balancers' virtual IP addresses allows you to simplify the routing configuration and avoid manual intervention4. You do not need to create static routes or update them when NVAs are added or removed.
The other options are not correct because:
Option A is not suitable. Creating the VMs in the same zone does not provide high availability or failover. Using static routes with IP addresses as next hops requires manual intervention when NVAs are added or removed.
Option B is not optimal. Creating the VMs in different zones provides high availability, but not failover. Using static routes with instance names as next hops requires manual intervention when NVAs are added or removed.
Option C is not feasible. Creating an instance template and a managed instance group provides high availability and reliability, but using a single internal load balancer does not support both TCP and UDP protocols. You cannot define a custom static route with an internal load balancer as the next hop.


NEW QUESTION # 94
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security?
(Choose two.)

  • A. Shared VPC
  • B. Cloud VPN
  • C. Dedicated Interconnect
  • D. Cloud NAT
  • E. VPC peering

Answer: B,C

Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/vpc


NEW QUESTION # 95
You have the following Shared VPC design VPC Flow Logs is configured for Subnet-1 In the host VPC. You also want to monitor flow logs for Subnet-2. What should you do?

  • A. Configure a VPC Flow Logs filter for Subnet-2 in the host project VPC.
  • B. Configure Packet Mirroring in both the host and service project VPCs.
  • C. Configure VPC Flow Logs in the service project VPC for Subnet-2.
  • D. Configure a firewall rule to permit Subnet-2 IP addresses outbound in the host protect VPC.

Answer: C

Explanation:
Understanding VPC Flow Logs:
VPC Flow Logs is a feature that captures information about the IP traffic going to and from network interfaces in a VPC. It helps in monitoring and analyzing network traffic, ensuring security, and optimizing network performance.
Current Configuration:
According to the diagram, VPC Flow Logs is already configured for Subnet-1 in the host VPC. This means that traffic information for Subnet-1 is being captured and logged.
Requirement for Subnet-2:
The goal is to monitor flow logs for Subnet-2, which is in the service project VPC.
Correct Configuration for Subnet-2:
To monitor the flow logs for Subnet-2, you need to configure VPC Flow Logs within the service project VPC where Subnet-2 resides. This is because VPC Flow Logs must be configured in the same project and VPC where the subnet is located.
Implementation Steps:
Go to the Google Cloud Console.
Navigate to the service project where Subnet-2 is located.
Select the VPC network containing Subnet-2.
Enable VPC Flow Logs for Subnet-2 by editing the subnet settings and enabling the flow logs option.
Cost and Performance Considerations:
Enabling VPC Flow Logs may incur additional costs based on the volume of data logged. Ensure to review and understand the pricing implications.
Analyze and manage the data collected to avoid unnecessary logging and costs.
Reference:
Google Cloud VPC Flow Logs Documentation
Configuring VPC Flow Logs
Shared VPC Overview
By configuring VPC Flow Logs in the service project VPC for Subnet-2, you ensure that traffic data is correctly captured and monitored, adhering to Google Cloud's best practices.


NEW QUESTION # 96
You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements:
* IP ranges for pods and services must be as small as possible.
* The nodes and the master must not be reachable from the internet.
* You must be able to use kubectl commands from on-premises subnets to manage the cluster.
How should you create the GKE cluster?

  • A. * Create a VPC-native GKE cluster using GKE-managed IP ranges.
    * Set the pod IP range as /21 and service IP range as /24.
    * Set up a network proxy to access the master.
  • B. * Create a private cluster that uses VPC advanced routes.
    * Set the pod and service ranges as /24.
    * Set up a network proxy to access the master.
  • C. * Create a VPC-native GKE cluster using user-managed IP ranges.
    * Enable privateEndpoint on the cluster master.
    * Set the pod and service ranges as /24.
    * Set up a network proxy to access the master.
    * Enable master authorized networks.
  • D. * Create a VPC-native GKE cluster using user-managed IP ranges.
    * Enable a GKE cluster network policy, set the pod and service ranges as /24.
    * Set up a network proxy to access the master.
    * Enable master authorized networks.

Answer: D

Explanation:
Reference:
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips


NEW QUESTION # 97
You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer You must ensure that your application meets the following requirements
* Maps multiple existing reserved external IP addresses to the Instance
* Processes IP Encapsulating Security Payload (ESP) traffic
What should you do?

  • A. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
  • B. Configure a target pool, and create protocol forwarding rules for each external IP address.
  • C. Configure the Compute Engine Instances' network Interface external IP address from None to Ephemeral Add as many external IP addresses as required
  • D. Configure a backend service, and create an external network load balancer for each external IP address

Answer: A

Explanation:
The correct answer is C. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
This answer is based on the following facts:
A target instance is a Compute Engine instance that handles traffic from one or more forwarding rules1. You can use target instances to forward traffic to a single VM instance from one or more external IP addresses2.
A protocol forwarding rule specifies the IP protocol and port range for the traffic that you want to forward3. You can use protocol forwarding rules to forward traffic of any IP protocol, including ESP4.
The other options are not correct because:
Option A is not possible. You cannot create protocol forwarding rules for a target pool. A target pool is a group of instances that receives traffic from a network load balancer5.
Option B is not suitable. You do not need to create an external network load balancer for each external IP address. An external network load balancer distributes traffic among multiple backend instances based on the destination IP address and port. You can use a single load balancer with multiple forwarding rules to map multiple external IP addresses to the same backend service.
Option D is not feasible. You cannot add multiple external IP addresses to a single network interface of a Compute Engine instance. Each network interface can have only one external IP address that is either ephemeral or static. You can use alias IP ranges to assign multiple internal IP addresses to a single network interface, but not external IP addresses.


NEW QUESTION # 98
You want to configure a NAT to perform address translation between your on-premises network blocks and GCP.
Which NAT solution should you use?

  • A. An instance configured with iptables DNAT rules
  • B. Cloud NAT
  • C. An instance with IP forwarding enabled
  • D. An instance configured with iptables SNAT rules

Answer: B

Explanation:
https://cloud.google.com/nat/docs/overview


NEW QUESTION # 99
You need to give each member of your network operations team least-privilege access to create, modify, and delete Cloud Interconnect VLAN attachments.
What should you do?

  • A. Assign each user the compute.networkAdmin role.
  • B. Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get.
  • C. Assign each user the editor role.
  • D. Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get, compute.routers.create, compute.routers.get, compute.routers.update.

Answer: B

Explanation:
Explanation/Reference:


NEW QUESTION # 100
Your organization is implementing a new security policy to control how firewall rules are applied to control flows between virtual machines (VMs). Using Google-recommended practices, you need to set up a firewall rule to enforce strict control of traffic between VM A and VM B. You must ensure that communications flow only from VM A to VM B within the VPC, and no other communication paths are allowed. No other firewall rules exist in the VPC. Which firewall rule should you configure to allow only this communication path?

  • A. Firewall rule direction: ingress
    Action: allow
    Target: specific VM B tag
    Source ranges: VM A tag and VM A source IP address
    Priority: 1000
  • B. Firewall rule direction: ingress
    Action: allow
    Target: VM A service account
    Source ranges: VM B service account and VM B source IP address
    Priority: 100
  • C. Firewall rule direction: ingress
    Action: allow
    Target: specific VM A tag
    Source ranges: VM B tag and VM B source IP address
    Priority: 100
  • D. Firewall rule direction: ingress
    Action: allow
    Target: VM B service account
    Source ranges: VM A service account
    Priority: 1000

Answer: C


NEW QUESTION # 101
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?

  • A. GKE Ingress
  • B. GKE Cluster
  • C. GKE Pod
  • D. GKE Node

Answer: C

Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig


NEW QUESTION # 102
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)

  • A. Shared VPC
  • B. Cloud VPN
  • C. Dedicated Interconnect
  • D. Cloud NAT
  • E. VPC peering

Answer: B,C


NEW QUESTION # 103
You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner.
What should you first?

  • A. Ask your Interconnect partner to provision a physical connection to Google.
  • B. Create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.
  • C. Run gcloud compute interconnect attachments partner update <attachment> / -- region <region> --admin-enabled.
  • D. Log in to your partner's portal and request the VLAN attachment there.

Answer: A

Explanation:
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview?hl=En#provisioning "To provision a Partner Interconnect connection with a service provider, you start by connecting your on-premises network to a supported service provider. Work with the service provider to establish connectivity.


NEW QUESTION # 104
Your company is running out of network capacity to run a critical application in the on-premises data center.
You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances.
Which two products should you incorporate into the solution? (Choose two.)

  • A. Stackdriver Trace
  • B. VPC flow logs
  • C. Compute Engine instance system logs
  • D. Cloud Audit logs
  • E. Firewall logs

Answer: A,D

Explanation:
Explanation/Reference: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations


NEW QUESTION # 105
......

Prepare For Realistic Professional-Cloud-Network-Engineer Dumps PDF - 100% Passing Guarantee: https://www.lead2passexam.com/Google/valid-Professional-Cloud-Network-Engineer-exam-dumps.html

Practice Test for Professional-Cloud-Network-Engineer Certification Real 2024 Mock Exam: https://drive.google.com/open?id=1fQvUBRA5u_W2eKLA8iu4KScR1f4Hn29d