What is the purpose of Packet Mirroring in Google Cloud?

To load balance traffic across multiple VMs

To copy VPC traffic to a collector for monitoring and analysis

To block malicious traffic before it reaches the VM

You are deploying a pair of multi-NIC NGFW VMs in a management VPC to inspect traffic between two peered VPCs. You want to ensure that if one NGFW VM fails, traffic is automatically sent to the remaining healthy VM. You also want to avoid manual route changes. What should you configure?

Create a static route with next hop set to the primary NGFW VM's IP and a backup route with next hop set to the secondary NGFW VM's IP.

Create an internal load balancer in the management VPC with the NGFW VMs as backends, and set the load balancer's forwarding rule IP as the next hop in the peered VPCs' routes.

Configure the NGFW VMs with a floating IP address and use that as the next hop.

Use a managed instance group with autoscaling and set the instance group's IP as the next hop.

An organization wants to integrate a network security appliance without placing it inline in the traffic path. Which strategy is commonly used to achieve this?

Configuring the appliance as a VPN gateway

Placing the appliance in the same subnet as the workloads

Using VPC peering or dedicated connections to connect the appliance to the network

Deploying the appliance in a peered VPC and using it as a next hop

Your organization has a hub-and-spoke VPC architecture with a multi-NIC NGFW VM in the hub VPC. You need to inspect traffic from the spoke VPCs to the internet, but you do not want to inspect traffic between spoke VPCs. You have configured a default route in each spoke VPC with next hop to the NGFW VM. What additional configuration is required to ensure inter-spoke traffic bypasses the NGFW?

Create a firewall rule in the spoke VPCs to allow inter-spoke traffic without inspection.

Configure a policy-based route in the spoke VPCs that matches traffic to the other spoke VPCs and sets next hop to the NGFW VM.

Remove the default route from the spoke VPCs and rely on peering routes for all traffic.

Add a more specific route in each spoke VPC for the other spoke VPCs' CIDRs with next hop set to the peering connection.

A network engineer wants to use an internal load balancer as the next hop for traffic destined to a pair of NGFW VMs. What is the main benefit of this configuration?

It provides high availability by distributing traffic across healthy NGFW VMs

It reduces the number of routes needed in the VPC

It encrypts traffic between the VMs and the load balancer

It automatically scales the NGFW VMs based on traffic load

Google CloudProfessional Cloud Network Engineer

Domain 6Objective 4

6.4 Configuring Self-Managed Network Virtual Appliance and Packet Mirroring. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 1)

Part of the Section 6: Configuring, implementing and managing a cloud network security solution (~13% of the exam) domain, which accounts for ~13% of the PROFESSIONAL-CLOUD-NETWORK-ENGINEER exam.

19questions here

4free pages

5concepts

~13%of the exam

Questions 1–5

1foundation · easy
What is the purpose of Packet Mirroring in Google Cloud?
Select an answer first
2application · medium
You are deploying a pair of multi-NIC NGFW VMs in a management VPC to inspect traffic between two peered VPCs. You want to ensure that if one NGFW VM fails, traffic is automatically sent to the remaining healthy VM. You also want to avoid manual route changes. What should you configure?
Select an answer first
3foundation · easy
An organization wants to integrate a network security appliance without placing it inline in the traffic path. Which strategy is commonly used to achieve this?
Select an answer first
4application · medium
Your organization has a hub-and-spoke VPC architecture with a multi-NIC NGFW VM in the hub VPC. You need to inspect traffic from the spoke VPCs to the internet, but you do not want to inspect traffic between spoke VPCs. You have configured a default route in each spoke VPC with next hop to the NGFW VM. What additional configuration is required to ensure inter-spoke traffic bypasses the NGFW?
Select an answer first
5foundation · easy
A network engineer wants to use an internal load balancer as the next hop for traffic destined to a pair of NGFW VMs. What is the main benefit of this configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-NETWORK-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-NETWORK-ENGINEER” is a trademark of its owner, used for identification only.