Google Cloud Certified Network Design and Security 2

Question 1

What is the primary purpose of Cloud Identity-Aware Proxy (IAP)?

Accepted Answer

Controlling access to web applications based on user identity

Answer

Encrypting data at rest

Answer

Providing DDoS mitigation

Answer

Managing SSL certificates

Question 2

A Professional Cloud Architect must ensure traffic between microservices in GKE is encrypted in transit. Which solution is best?

Accepted Answer

Use Anthos Service Mesh or Istio mTLS

Answer

Enable Cloud Armor

Answer

Configure VPC firewall rules

Answer

Use Cloud KMS

Question 3

Which type of Cloud VPN is recommended for high-availability production workloads?

Accepted Answer

HA VPN

Answer

Classic VPN

Answer

Dedicated VPN

Answer

Direct VPN

Question 4

Your organization requires that only users from specific geographic regions can access a public-facing GCP application. Which service enforces this?

Accepted Answer

Cloud Armor geo-restriction policies

Answer

Cloud DNS

Answer

Cloud IAP

Answer

VPC Firewall Rules

Question 5

An architect needs to enable private Google API access for VMs that lack external IP addresses. What should be configured?

Accepted Answer

Private Google Access on the subnet

Answer

Cloud NAT

Answer

Cloud Interconnect

Answer

VPC Peering

Question 6

Which layer does a Google Cloud External HTTP(S) Load Balancer operate at?

Accepted Answer

Layer 7 (Application)

Answer

Layer 3 (Network)

Answer

Layer 4 (Transport)

Answer

Layer 2 (Data Link)