Free Access Google.Professional-Cloud-Network-Engineer.v2026-06-03.q145 Practice Test (Page 28)

Question 131

Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from your on-premises network using Cloud Interconnect. You must configure access only to Google APIs and services that are supported by VPC Service Controls through hybrid connectivity with a service level agreement (SLA) in place. What should you do?

A.Add Direct Peering links, and use them for connectivity to Google APIs that use public virtual IP addresses.

B.Use Private Google Access for on-premises hosts with restricted.googleapis.com virtual IP addresses.

C.Configure the existing Cloud Routers to advertise a default route, and use Cloud NAT to translate traffic from your on-premises network.

D.Configure the existing Cloud Routers to advertise the Google API's public virtual IP addresses.

Question 132

You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?

A.Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.

B.Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.

C.Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.

D.Enable VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.

Question 133

You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?

A.Manually patch some of the instances, and then perform a rolling restart on the instance group.

B.Using the new instance template, perform a rolling update across all instances in the instance group.
Verify the new feature once the rollout completes.

C.Deploy a new instance group and canary the updated template in that group.
Verify the new feature in the new canary instance group, and then update the original instance group.

D.Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template.
Verify the new feature on the canary instances, and then roll forward to the rest of the instances.

Question 134

(You are deploying an application to Google Kubernetes Engine (GKE). The application needs to make API calls to a private Cloud Storage bucket. You need to configure your application Pods to authenticate to the Cloud Storage API, but your organization policy prevents the usage of service account keys. You want to follow Google-recommended practices. What should you do?)

A.Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 8 hours.

B.Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 24 hours.

C.Create the GKE cluster with Workload Identity Federation. Configure the default node service account to access the bucket. Deploy the application into the cluster so the application can use the node service account permissions. Use Identity and Access Management (IAM) to grant the service account access to the bucket.

D.Create the GKE cluster with Workload Identity Federation. Create a Google service account and a Kubernetes ServiceAccount, and configure both service accounts to use Workload Identity Federation.Attach the Kubernetes ServiceAccount to the application Pods and configure the Google service account to access the bucket with Identity and Access Management (IAM).

Correct Answer: D

Create a Google Service Account: You create a dedicated Google service account specifically for your application's interaction with the private Cloud Storage bucket. This allows you to grant precise IAM permissions to this service account on the bucket (e.g., roles/storage.objectViewer or roles/storage.
objectCreator).
* Create a Kubernetes ServiceAccount: You create a Kubernetes ServiceAccount within your GKE cluster. This is the identity that your application Pods will assume within the cluster.
* Configure Workload Identity Federation: You establish a trust relationship between the Kubernetes ServiceAccount and the Google service account using Workload Identity Federation. This involves configuring IAM policies that allow the Kubernetes ServiceAccount to impersonate the Google service account.
* Annotate Pods with the Kubernetes ServiceAccount: You associate the created Kubernetes ServiceAccount with your application Pods. When the application in these Pods makes a call to the Cloud Storage API, the Workload Identity agent running on the GKE nodes automatically exchanges the Kubernetes ServiceAccount token for a short-lived Google Cloud access token for the associated Google service account.
This approach offers several security advantages and aligns with Google's recommended practices:
* Principle of Least Privilege: The Google service account is granted only the necessary permissions to access the specific Cloud Storage bucket.
* No Service Account Keys to Manage: You avoid the security risks associated with creating, storing, and rotating service account keys.
* Auditable Authentication: All API calls are attributed to the specific Google service account, providing better auditability.
* Simplified Management: Workload Identity Federation automates the credential management process for your application.
Google Cloud Documentation References:
* Workload Identity: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity 1 - This is the primary documentation explaining how to use Workload Identity to allow applications in GKE to access Google Cloud services securely without using service account keys.

Question 135

(You are developing an internet of things (IoT) application that captures sensor data from multiple devices that have already been set up. You need to identify the global data storage product your company should use to store this data. You must ensure that the storage solution you choose meets your requirements of sub- millisecond latency. What should you do?)

A.Store the IoT data in Spanner. Use caches to speed up the process and avoid latencies.

B.Store the IoT data in Bigtable.

C.Capture IoT data in BigQuery datasets.

D.Store the IoT data in Cloud Storage. Implement caching by using Cloud CDN.

Correct Answer: B

Comprehensive and Detailed In Depth Explanation:
Let's evaluate each option based on the requirement of sub-millisecond latency for globally stored IoT data:
A). Spanner with Caching: While Spanner offers strong consistency and global scalability, the base latency might not consistently be sub-millisecond for all read/write operations globally. Introducing caching adds complexity and doesn't guarantee sub-millisecond latency for all initial reads or cache misses.
B). Bigtable: Bigtable is a highly scalable NoSQL database service designed for low-latency, high-throughput workloads. It excels at storing and retrieving large volumes of time-series data, which is typical for IoT sensor data. Its architecture is optimized for single-key lookups and scans, providing consistent sub-millisecond latency, making it a strong candidate for this use case.
C). BigQuery: BigQuery is a fully managed, serverless data warehouse designed for analytical queries on large datasets. While it's excellent for analyzing IoT data in batch, it's not optimized for the low-latency, high- throughput ingestion and retrieval required for real-time IoT applications with sub-millisecond latency needs.
D). Cloud Storage with Cloud CDN: Cloud Storage is object storage and is not designed for low-latency transactional workloads. Cloud CDN is a content delivery network that caches content closer to users for faster delivery, but it's not suitable for the primary storage of rapidly incoming IoT sensor data requiring sub- millisecond write latency.
Google Cloud Documentation References:
Cloud Bigtable Overview: https://cloud.google.com/bigtable/docs/overview - This document highlights Bigtable's suitability for low-latency and high-throughput applications, including IoT. It mentions its ability to handle massive amounts of data with consistent performance.
Spanner Overview: https://cloud.google.com/spanner/docs/overview - While Spanner offers low latency, Bigtable is generally preferred for extremely high-throughput, low-latency use cases like raw sensor data ingestion due to its optimized architecture for such workloads.
BigQuery Overview: https://cloud.google.com/bigquery/docs/introduction - This emphasizes BigQuery's analytical capabilities rather than low-latency operational workloads.
Cloud Storage Overview: https://cloud.google.com/storage/docs/overview - This describes Cloud Storage as object storage, not ideal for sub-millisecond latency reads and writes required for real-time IoT data.

Other Version: 2391Google.Professional-Cloud-Network-Engineer.v2025-09-09.q179; 1942Google.Professional-Cloud-Network-Engineer.v2025-05-14.q111; 2130Google.Professional-Cloud-Network-Engineer.v2024-10-28.q109; 2966Google.Professional-Cloud-Network-Engineer.v2023-04-24.q111; 1939Google.Professional-Cloud-Network-Engineer.v2023-01-24.q52; 3022Google.Professional-Cloud-Network-Engineer.v2022-03-12.q83; 102Google.Ipassleader.Professional-Cloud-Network-Engineer.v2021-10-07.by.stephanie.79q.pdf

Latest Upload: 131Databricks.Databricks-Generative-AI-Engineer-Associate.v2026-08-18.q40; 137SAP.C_CR125_2601.v2026-08-17.q28; 179Salesforce.Field-Service-Consultant.v2026-08-17.q134; 150Oracle.1Z0-1170.v2026-08-16.q64; 157Oracle.1Z1-1170.v2026-08-16.q64; 193Juniper.JN0-336.v2026-08-13.q60; 327EMC.NCP-AII.v2026-08-13.q200; 205CIRO.RSE.v2026-08-12.q41; 175CrowdStrike.CCSE-204.v2026-08-12.q50; 162ISQI.CT-GenAI.v2026-08-11.q14

Question 131

Question 132

Question 133

Question 134

Question 135

Download PDF File