Discuss Google Professional Cloud Network Engineer Exam Topic 4 Question 86

You are maintaining a Shared VPC in a host project. Several departments within your company have infrastructure in different service projects attached to the Shared VPC and use Identity and Access Management (IAM) permissions to manage the cloud resources in those projects. VPC Network Peering is also set up between the Shared VPC and a common services VPC that is not in a service project. Several users are experiencing failed connectivity between certain instances in different Shared VPC service projects and between certain instances and the internet. You need to validate the network configuration to identify whether a misconfiguration is the root cause of the problem. What should you do?

AReview the VPC audit logs in Cloud Logging for the affected instances.

BUse Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.

CRun Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the internet.

DEnable VPC Flow Logs for all VPCs, and review the logs in Cloud Logging for the affected instances.

Suggested Answer: D

The correct answer is D because it meets the following requirements:

It matches the hub-and-spoke model of the on-premises network, where each spoke is a separate VPC network that is connected to a central hub VPC network.

It minimizes management overhead and cost, because VPC Network Peering is a simple and low-cost way to connect VPC networks without using any external IP addresses or VPN gateways1.

It uses default networking quotas and limits, because VPC Network Peering does not consume any quota or limit for VPN tunnels, external IP addresses, or forwarding rules2.

It prevents connectivity between the spokes, because VPC Network Peering is non-transitive by default, meaning that a spoke can only communicate with the hub, not with other spokes1.To enforce this restriction, a third-party network appliance can be used as a default gateway in each spoke VPC network, which can filter out any traffic destined for other spokes3.

Option A is incorrect because it does not minimize cost, as Cloud VPN charges for egress traffic and requires external IP addresses for the VPN gateways4.Option B is incorrect because it does not prevent connectivity between the spokes, as VPC Network Peering allows direct communication between peered VPC networks by default1. Option C is incorrect because it does not minimize cost or use default quotas and limits, for the same reasons as option A.

VPC Network Peering overview | VPC

Quotas and limits | VPC

Hub-and-spoke network architecture | Cloud Architecture Center

Cloud VPN overview | Google Cloud

Get Premium Professional Cloud Network Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

39 comments · newest first

Leoma 11 months ago

Wait, can we really trust those logs to pinpoint the issue?

Margart 11 months ago

D sounds like a solid choice, but enabling flow logs can be a hassle.

Cathrine 11 months ago

B seems too manual, why not use automated tools?

Victor 11 months ago

A is a good start, but it might not show the whole picture.

Shalon 12 months ago

I’d go with option C, Connectivity Tests are super useful!

Chanel 12 months ago

I vaguely recall something about reviewing audit logs, but I can't remember if that's really useful for troubleshooting connectivity problems.

Jutta 1 year ago

The Connectivity Tests from the Network Intelligence Center sound familiar; I feel like we practiced that in a lab. It might be the most efficient way to check the connections.

Felicidad 1 year ago

I think running PING tests from the instances could help, but I wonder if that would really show the whole picture of the connectivity issues.

Flo 1 year ago

I remember we talked about using VPC Flow Logs in class, but I'm not sure if that's the best first step here.

Ruby 1 year ago

Okay, I've got a plan. I'll run the Connectivity Tests to check the connectivity between the affected endpoints and the internet. That should give me a good overview of where the issues are.

Robt 1 year ago

Hmm, I'm a bit unsure about this one. Should I try pinging the affected instances and the 8.8.8.8 IP address to test the connectivity? Or would the Connectivity Tests from Network Intelligence Center be a better approach?

Lajuana 1 year ago

This looks like a tricky networking question. I think I'll start by reviewing the VPC audit logs to see if there are any clues about the connectivity issues.

Paz 1 year ago

I'm feeling pretty confident about this one. Enabling VPC Flow Logs and reviewing the logs in Cloud Logging seems like the best way to identify the root cause of the connectivity problems.

Stefania 1 year ago

Okay, I've got this. Client-side scripts are responsible for managing the forms and form fields on a web page, so A is the right answer. The other options don't really fit with the role of client-side scripting.

Ellsworth 1 year ago

I think this has to do with social engineering, right? They try to manipulate you into giving up info.

Artie 1 year ago

Right, that makes sense. I'll go with turning off IGMP snooping and enabling multicast-direct as my two actions.

Thaddeus 1 year ago

The risk management metrics seem like they would provide the most complete view of the security landscape. I'll focus on analyzing that option in more detail.

Pok 1 year ago

This question feels familiar; I remember a practice problem that had a similar structure. Maybe it's A, but I'm hesitant.

Benton 1 year ago

I remember that the STEP model is focused on validating requirements through testing, but was it during or after development?

Barbra 1 year ago

Wait, we're troubleshooting a network issue and you're not suggesting I try turning it off and on again? Clearly, I'm in the wrong exam.

Ngoc 1 year ago

↳ replying to Barbra

A) Review the VPC audit logs in Cloud Logging for the affected instances.

Tijuana 1 year ago

↳ replying to Barbra

C) Run Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the internet.

Chaya 1 year ago

↳ replying to Barbra

B) Use Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.

Reid 1 year ago

Enabling VPC Flow Logs is a good idea, but it's like trying to find a needle in a haystack. The Connectivity Tests will give you a much more targeted and actionable view of the problem.

Murray 1 year ago

↳ replying to Reid

B) Use Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.

Stephaine 1 year ago

↳ replying to Reid

A) Review the VPC audit logs in Cloud Logging for the affected instances.

Frederick 1 year ago

↳ replying to Reid

C) Run Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the internet.

Catherin 1 year ago

↳ replying to Reid

B) Use Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.

Blair 2 years ago

Absolutely, the Connectivity Tests in the Network Intelligence Center are the way to go. They'll give you a clear understanding of where the connectivity issues are, and you can use that information to identify and fix the root cause.

Hermila 1 year ago

↳ replying to Blair

B) Use Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.

Iola 1 year ago

↳ replying to Blair

C) Run Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the internet.

Ronald 2 years ago

Using SSH to run PING tests is a standard troubleshooting technique, but it's limited to the instances you can directly access. Leveraging the Network Intelligence Center's Connectivity Tests would be a more efficient way to test connectivity across the entire network.

Patrick 2 years ago

Reviewing the VPC audit logs is a good starting point, but it may not provide a complete picture of the connectivity issues. I would also run Connectivity Tests to get a more comprehensive view of the network configuration.

Tien 2 years ago

I also think running Connectivity Tests from Network Intelligence Center could be helpful in checking connectivity to the internet.

Robt 2 years ago

I agree with Selma. That could help us identify any misconfigurations causing the connectivity issues.

Selma 2 years ago

I think we should review the VPC audit logs in Cloud Logging for the affected instances.

Merilyn 2 years ago

I believe running Connectivity Tests from Network Intelligence Center would also help in validating the network configuration.

Corinne 2 years ago

I agree with Glory. It's important to check the logs to identify any misconfigurations.

Glory 2 years ago

I think we should review the VPC audit logs in Cloud Logging for the affected instances.

Google Professional Cloud Network Engineer Exam - Topic 4 Question 86 Discussion