Discuss Google Professional Cloud Network Engineer Exam Topic 4 Question 91

You are designing a packet mirroring policy as pan of your network security architecture for your gaming workload. Your Infrastructure is located in the us-west2 region and deployed across several zones: us-west2-

a. us-west2-b. and us-west2-c The Infrastructure Is running a web-based application on TCP ports 80 and 443 with other game servers that utilize the UDP protocol. You need to deploy packet mirroring policies and collector instances to monitor web application traffic while minimizing inter-zonal network egress costs.

Following Google-recommended practices, how should you deploy the packet mirroring policies and collector instances?

ACreate three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for Its zone based on instance-tags, and create a filter for TCP traffic.

BCreate three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure
each policy to match traffic for its zone based on subnets, and create a filter for TCP traffic

CCreate one packet mirroring policy for the us-west2 region. Create one group of collector instances for the us-west2 region Configure the
packet mirroring policy to match traffic for web server instances based on instance-tags, and create a filter for TCP traffic.

DCreate three packet mirroring policies: one for each zone. Create one group of collector instances for the us-west2 region. Configure each packet mirroring policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic

Suggested Answer: D

Create Packet Mirroring Policies:

You need to create three packet mirroring policies, one for each zone (us-west2-a, us-west2-b, and us-west2-c). This ensures that each zone's traffic is mirrored appropriately without unnecessary cross-zone traffic.

Create Collector Instances:

Set up one group of collector instances for the us-west2 region. Having a single group of collector instances for the entire region minimizes the number of instances required and simplifies the management while keeping egress costs low since the collectors are within the same region.

Configuration of Policies:

Each packet mirroring policy should be configured to match traffic for its specific zone. Use instance-tags to identify and match the relevant instances within each zone. This helps in correctly capturing the traffic from the appropriate sources.

Filter for TCP Traffic:

Create a filter for TCP traffic (ports 80 and 443). This step ensures that only the relevant web application traffic is mirrored, reducing the amount of data processed and improving efficiency.

Cost Efficiency:

By having packet mirroring policies specific to each zone and a regional collector group, you reduce inter-zonal network egress costs. The data remains within the same region, avoiding extra charges associated with cross-zone traffic.

Google Cloud Packet Mirroring Documentation

Best Practices for Packet Mirroring

Cost Management in Google Cloud

This solution aligns with Google-recommended practices by ensuring efficient traffic capture, minimal inter-zonal costs, and streamlined management of the packet mirroring setup.

Get Premium Professional Cloud Network Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

34 comments · newest first

Willow 11 months ago

C simplifies things, but not sure if it covers all zones properly.

Stephanie 11 months ago

Wait, why would you create three policies? Isn't that overkill?

Sabrina 11 months ago

D looks good too, but why only one collector group?

Jean 11 months ago

I think B is better, subnets are more reliable for traffic matching.

Lashonda 12 months ago

Option A seems solid, matching by instance-tags is smart.

Nan 12 months ago

I’m leaning towards option B, but I’m not entirely confident. I remember something about using subnets, but I’m not sure if that’s the best way to go for this scenario.

Ivette 1 year ago

I think option D sounds right because it mentions creating separate policies for each zone, which seems to align with best practices we covered.

Nadine 1 year ago

I'm a bit unsure about whether to use instance-tags or subnets for matching traffic. I feel like we practiced something similar, but I can't recall the details.

Elinore 1 year ago

I remember we discussed the importance of minimizing egress costs, so I think using one group of collector instances for the entire region might not be the best approach.

Melvin 1 year ago

This is a good test of my understanding of packet mirroring and network security best practices. I'm confident that option D is the way to go - it aligns with the requirements and the Google-recommended practices.

Arlene 1 year ago

Hmm, I'm a bit confused about the subnet-based approach in option B. Wouldn't that be more complex to manage than the instance-tag approach? I'm leaning towards option A or C.

Jesus 1 year ago

Okay, I think I've got this. The key is to create separate policies for each zone to minimize inter-zonal network egress costs, and use instance-tags to filter the traffic. I'm going with option A.

Walton 1 year ago

This question seems straightforward, but I want to make sure I understand the requirements correctly. I'll need to review the Google-recommended practices to determine the best approach.

Ty 1 year ago

Implementing standard setup and teardown functions at the test case level could be a good solution. It would help reduce duplication and make the test suite more maintainable.

Emiko 1 year ago

This is a good question to test our knowledge of the login process. I think the key is to focus on the definition of identification - it's about verifying the user's identity, not their authorization or authentication. I'll go with option B.

Van 2 years ago

Hmm, maybe I should reconsider my choice then.

Gwenn 2 years ago

I agree with Gilbert, A seems to be the most logical choice.

Olene 2 years ago

Option B seems a bit overkill with the separate policies and collectors for each zone. Unless there are specific requirements to segregate the traffic, I'd lean towards Option C.

Gilbert 2 years ago

But A seems to be following Google-recommended practices.

Margarita 2 years ago

Hah, these cloud networking questions can really make your head spin sometimes. I'd probably go with Option C - keep it simple, stupid, right?

Elke 2 years ago

↳ replying to Margarita

Definitely. Option C minimizes complexity and still gets the job done.

Wade 2 years ago

↳ replying to Margarita

I think Option C makes sense too. Less room for error that way.

Cordelia 2 years ago

↳ replying to Margarita

Yeah, I agree. Keeping it simple is usually the best approach.

Reuben 2 years ago

↳ replying to Margarita

Option C seems like the most straightforward choice.

Stephanie 2 years ago

Hmm, Option D looks good. Separating the policies by zone will give more visibility, and having a single collector group is a smart way to keep costs down.

Dino 2 years ago

I like the efficiency of Option C, but I'm concerned about the ability to differentiate between the zones. Perhaps Option D would provide more granular control while still keeping the collector instances centralized.

Loren 2 years ago

↳ replying to Dino

That's true, Option D might be a better choice for granular control while still keeping collector instances centralized.

Stacey 2 years ago

↳ replying to Dino

I agree, but Option D could offer more control over traffic in each specific zone.

Angelyn 2 years ago

↳ replying to Dino

Option C seems like a good choice for centralized monitoring of web server traffic.

Kent 2 years ago

Option C seems the most straightforward. One policy and one group of collector instances for the whole region should be sufficient to monitor the web traffic while minimizing costs.

Taryn 2 years ago

↳ replying to Kent

I agree, having one policy for the entire region simplifies management and reduces complexity.

Melvin 2 years ago

↳ replying to Kent

Option C seems the most straightforward. One policy and one group of collector instances for the whole region should be sufficient to monitor the web traffic while minimizing costs.

Van 2 years ago

I disagree, I believe the answer is C.

Gilbert 2 years ago

I think the answer is A.

Google Professional Cloud Network Engineer Exam - Topic 4 Question 91 Discussion