Google Professional-Cloud-Network-Engineer Quiz 2 Topic 3 Questions 6-10

Question: 1

You are migrating a three-tier application architecture from on-premises to Google Cloud. As a first step in the migration, you want to create a new Virtual Private Cloud (VPC) with an external HTTP(S) load balancer. This load balancer will forward traffic back to the on-premises compute resources that run the presentation tier. You need to stop malicious traffic from entering your VPC and consuming resources at the edge, so you must configure this policy to filter IP addresses and stop cross-site scripting (XSS) attacks. What should you do?

ACreate a Google Cloud Armor policy, and apply it to a backend service that uses an unmanaged instance group backend.

BCreate a hierarchical firewall ruleset, and apply it to the VPC's parent organization resource node.

CCreate a Google Cloud Armor policy, and apply it to a backend service that uses an internet network endpoint group (NEG) backend.

DCreate a VPC firewall ruleset, and apply it to all instances in unmanaged instance groups.

Show Answer

Question: 2

You are migrating to Cloud DNS and want to import your BIND zone file.

Which command should you use?

Agcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE

Bgcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE

Cgcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE

Dgcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE

Show Answer

Question: 3

You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider.

Which connection type should you choose?

ACarrier Peering

BDirect Peering

CDedicated Interconnect

DPartner Interconnect

Show Answer

Question: 4

Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.

How should you set up permissions for the networking team?

AAssign members of the networking team the compute.networkUser role.

BAssign members of the networking team the compute.networkAdmin role.

CAssign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.

DAssign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.

Show Answer

Question: 5

You are migrating a three-tier application architecture from on-premises to Google Cloud. As a first step in the migration, you want to create a new Virtual Private Cloud (VPC) with an external HTTP(S) load balancer. This load balancer will forward traffic back to the on-premises compute resources that run the presentation tier. You need to stop malicious traffic from entering your VPC and consuming resources at the edge, so you must configure this policy to filter IP addresses and stop cross-site scripting (XSS) attacks. What should you do?

ACreate a Google Cloud Armor policy, and apply it to a backend service that uses an unmanaged instance group backend.

BCreate a hierarchical firewall ruleset, and apply it to the VPC's parent organization resource node.

CCreate a Google Cloud Armor policy, and apply it to a backend service that uses an internet network endpoint group (NEG) backend.

DCreate a VPC firewall ruleset, and apply it to all instances in unmanaged instance groups.

Show Answer

Google Professional-Cloud-Network-Engineer Quiz:2 Topic:3 Questions:6-10