6.4 Configuring Self-Managed Network Virtual Appliance and Packet Mirroring. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   In a Packet Mirroring configuration, what is the role of the collector?

   • ATo route traffic to the internet
   • BTo generate the mirrored traffic
   • CTo filter traffic before it is mirrored
   • DTo receive and analyze the mirrored traffic
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   You have a multi-NIC NGFW deployment with an internal load balancer (ILB) as the next hop for traffic from a production VPC to a database VPC. You now need to send only traffic from a specific subnet in the production VPC through the NGFW, while all other traffic from the production VPC should go directly to the database VPC via peering. What should you do?

   • AModify the existing route in the production VPC to use the ILB as next hop for all traffic to the database VPC.
   • BCreate a new VPC peering connection between the specific subnet and the database VPC.
   • CCreate a policy-based route in the production VPC that matches traffic from the specific subnet to the database VPC and sets next hop to the ILB.
   • DAdd a firewall rule in the production VPC to allow traffic from the specific subnet to the database VPC.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   Your security team wants to deploy an intrusion detection system (IDS) that analyzes traffic between your on-premises network and your VPC. The IDS must not affect the latency or availability of the production traffic. You have a Cloud VPN tunnel between on-premises and the VPC. What is the best way to provide the IDS with visibility into the traffic?

   • ARoute all traffic from the VPN tunnel through the IDS VM by adding a static route.
   • BUse a Cloud NAT gateway to send traffic to the IDS VM.
   • CCreate a VPC peering connection between the on-premises network and the VPC and use the IDS as a next hop.
   • DConfigure Packet Mirroring on the VMs in the VPC that receive traffic from the VPN tunnel and send the mirrored traffic to the IDS VM.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   Your company has a hub-and-spoke VPC architecture with a multi-NIC NGFW VM in the hub VPC. Spoke VPCs are peered to the hub. You need to inspect all traffic between spoke VPCs. You have configured routes in the spoke VPCs to send traffic to the hub VPC. What else must you configure to ensure the NGFW VM can forward traffic between the spoke VPCs?

   • AConfigure the NGFW VM to use a single NIC for all traffic.
   • BCreate a firewall rule in the hub VPC to allow traffic from the spoke VPCs.
   • CAdd a route in the hub VPC with destination 0.0.0.0/0 and next hop the NGFW VM.
   • DEnable IP forwarding on the NGFW VM.
   Reveal Solution Discussion Select an answer first