Google Cloud Certified Network Design and Security 2 — Questions and Answers
Question 1: What is the primary purpose of Cloud Identity-Aware Proxy (IAP)?
- Encrypting data at rest
- Controlling access to web applications based on user identity (Correct answer)
- Providing DDoS mitigation
- Managing SSL certificates
Correct answer: Controlling access to web applications based on user identity
Cloud IAP enables context-aware access to web applications hosted on GCP by verifying user identity and device context.
Question 2: A Professional Cloud Architect must ensure traffic between microservices in GKE is encrypted in transit. Which solution is best?
- Enable Cloud Armor
- Use Anthos Service Mesh or Istio mTLS (Correct answer)
- Configure VPC firewall rules
- Use Cloud KMS
Correct answer: Use Anthos Service Mesh or Istio mTLS
Anthos Service Mesh (based on Istio) provides mutual TLS (mTLS) to encrypt and authenticate traffic between services in GKE.
Question 3: Which type of Cloud VPN is recommended for high-availability production workloads?
- Classic VPN
- HA VPN (Correct answer)
- Dedicated VPN
- Direct VPN
Correct answer: HA VPN
HA VPN provides a 99.99% SLA by using two VPN gateways with redundant tunnels, making it suitable for production environments.
Question 4: Your organization requires that only users from specific geographic regions can access a public-facing GCP application. Which service enforces this?
- Cloud DNS
- Cloud Armor geo-restriction policies (Correct answer)
- Cloud IAP
- VPC Firewall Rules
Correct answer: Cloud Armor geo-restriction policies
Cloud Armor supports geo-based access control policies that allow or deny traffic based on the request's origin country.
Question 5: An architect needs to enable private Google API access for VMs that lack external IP addresses. What should be configured?
- Cloud NAT
- Private Google Access on the subnet (Correct answer)
- Cloud Interconnect
- VPC Peering
Correct answer: Private Google Access on the subnet
Enabling Private Google Access on a subnet allows VMs without external IPs to reach Google APIs and services using internal IPs.
Question 6: Which layer does a Google Cloud External HTTP(S) Load Balancer operate at?
- Layer 3 (Network)
- Layer 4 (Transport)
- Layer 7 (Application) (Correct answer)
- Layer 2 (Data Link)
Correct answer: Layer 7 (Application)
External HTTP(S) Load Balancer is a Layer 7 load balancer that routes traffic based on URL maps, headers, and other HTTP attributes.
Google Cloud Certified Network Design and Security 2
What is the primary purpose of Cloud Identity-Aware Proxy (IAP)?