Google Cloud Certified Network Design and Security 2

Question 1

What is the primary purpose of Cloud Identity-Aware Proxy (IAP)?

Accepted Answer

Controlling access to web applications based on user identity

Answer

Cloud IAP enables context-aware access to web applications hosted on GCP by verifying user identity and device context.

Question 2

A Professional Cloud Architect must ensure traffic between microservices in GKE is encrypted in transit. Which solution is best?

Accepted Answer

Use Anthos Service Mesh or Istio mTLS

Answer

Anthos Service Mesh (based on Istio) provides mutual TLS (mTLS) to encrypt and authenticate traffic between services in GKE.

Question 3

Which type of Cloud VPN is recommended for high-availability production workloads?

Accepted Answer

HA VPN

Answer

HA VPN provides a 99.99% SLA by using two VPN gateways with redundant tunnels, making it suitable for production environments.

Question 4

Your organization requires that only users from specific geographic regions can access a public-facing GCP application. Which service enforces this?

Accepted Answer

Cloud Armor geo-restriction policies

Answer

Cloud Armor supports geo-based access control policies that allow or deny traffic based on the request's origin country.

Question 5

An architect needs to enable private Google API access for VMs that lack external IP addresses. What should be configured?

Accepted Answer

Private Google Access on the subnet

Answer

Enabling Private Google Access on a subnet allows VMs without external IPs to reach Google APIs and services using internal IPs.

Google Cloud Certified - Professional Cloud Architect Practice Test