Professional Cloud Network Engineer Free Practice Questions
This is the free Google Professional Cloud Network Engineer practice question bank —
130 of 251 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-06.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
You are designing a highly resilient and secure connection between an on-premises data center and Google Cloud for a financial services company. The company requires 10 Gbps of bandwidth and mandates that all traffic be encrypted end-to-end between their on-premises network and their Google Cloud VPC. You have already provisioned two 10 Gbps Dedicated Interconnect connections. You need to determine an encryption strategy that meets these requirements and provides redundancy.
What should you do?
A. Deploy four HA VPN gateways on each Dedicated Interconnect connection.
B. Deploy two HA VPN gateways on each Dedicated Interconnect connection.
C. Configure MACsec on each of the Dedicated Interconnect connections.
D. Use one Dedicated Interconnect for traffic and an HA VPN over the internet for backup.
Show Answer
Correct Answer: A
Explanation: MACsec encrypts only the physical Interconnect link and does not provide end-to-end encryption into the VPC. An internet HA VPN backup does not satisfy the requirement to use both Dedicated Interconnects for resilient 10 Gbps connectivity. HA VPN over Dedicated Interconnect provides end-to-end IPsec encryption, and to scale to a 10 Gbps attachment while maintaining redundancy, multiple HA VPN gateways/tunnels are required; deploying four HA VPN gateways on each Dedicated Interconnect connection provides the needed tunnel capacity and resilience.
Question 2
You are managing a containerized application environment on Google Kubernetes Engine (GKE). You deployed a microservice with a Kubernetes service manifest that defines a named port, http-api, for its main endpoint. You are now configuring an external http(s) load balancer to expose this microservice. You need to ensure the configuration is independent of the actual port number and follows best practices.
What should you do?
A. Create a backend service that uses the GKE node instance group as its backend, and configure the named port http-api in the backend service.
B. Reference the GCE_VM_IP_PORT network endpoint group (NEG) in the backend configuration that was automatically created for your Kubernetes service, and specify http-api named port for traffic.
C. Add an annotation to your Kubernetes service manifest to create a GCE_VM_IP network endpoint group (NEG), and configure the backend service to use this NEG.
D. Add an annotation in your Kubernetes ingress manifest to specify the http-api port number directly, and configure the backend service to use this hardcoded port number.
Show Answer
Correct Answer: B
Explanation: For GKE HTTP(S) load balancing, container-native load balancing uses Network Endpoint Groups (NEGs) that target Pod IPs and ports directly. The backend service can reference the automatically created GCE_VM_IP_PORT NEG, allowing traffic to be directed using the Kubernetes Service's named port rather than depending on a hardcoded port number. This keeps the configuration decoupled from the actual numeric port and follows GKE best practices.
Question 3
Your company utilizes Network Connectivity Center (NCC) to facilitate communication between numerous spoke VPCs. A development team reports that their application instances in app-dev-spoke-vpc are unable to connect to a new database service located in db-dev-spoke-vpc. You need to diagnose this issue using an observability tool and determine the root cause. What should you do?
A. Use Firewall Insights to analyze the firewall rule configuration and modify the appropriate rule.
B. Check each firewall rule in both the app-dev-spoke-vpc and db-dev-spokevpc.
C. Verify that the application instances in app-dev-spoke-vpc connected to Network Connectivity Center are assigned external IP addresses to reach the database service.
D. Use Network Intelligence Center’s Connectivity Tests to perform a reachability analysis between an instance in app-dev-spoke-vpc and the database service in db-dev-spoke-vpc.
Show Answer
Correct Answer: D
Explanation: Connectivity Tests in Network Intelligence Center is the observability tool designed to perform end-to-end reachability analysis across Google Cloud networking, including Network Connectivity Center, routes, firewall rules, and other dependencies. It identifies the point of failure and helps determine the root cause. Firewall Insights focuses specifically on firewall configuration, while manually inspecting firewall rules is not the recommended observability approach, and external IP addresses are not required for communication between spoke VPCs connected through NCC.
Question 4
You manage your company's network security and have noticed unusual outbound traffic from a Compute Engine VM that is part of a production subnet. You suspect the VM may be compromised, because it is attempting to communicate with a malicious external IP address. You want to capture detailed metadata for every IP connection to and from this specific VM. including source/destination IP, port, protocol, and the amount of data transferred. What should you do?
A. • Enable VPC Flow Logs on the subnet containing the VM. • Set the sampling rate to 1.0 for maximum detail, and filter the logs in Cloud Logging for the VM's IP address.
B. • Navigate to Network Intelligence Center, and run a new connectivity test for the VM. • Analyze the report to see which configurations are allowing the traffic.
C. • Use Packet Mirroring to create a real-time copy of all network packets from the suspected VM. • Forward the copies to a collector VM for analysis.
D. • Create a new egress firewall rule with a priority of 65535 that allows all outbound traffic. • Enable Firewall Rules Logging on this new rule to capture all connection details.
Show Answer
Correct Answer: A
Explanation: VPC Flow Logs are designed to capture network flow metadata such as source/destination IP addresses, ports, protocol, bytes transferred, and other connection details. Enabling them on the subnet and setting the sampling rate to 1.0 maximizes visibility, after which logs can be filtered for the specific VM. Connectivity Tests analyze reachability rather than recording traffic, Packet Mirroring captures full packet payloads and is intended for deep packet inspection rather than metadata collection, and Firewall Rules Logging only logs firewall rule matches rather than every IP connection.
Question 5
Your organization has two applications running in separate Google Cloud VPC networks (vpc-a and vpc-b) in different projects. You need to establish a secure, private, and encrypted connection between these two VPCs to allow for inter-VPC communication. You must ensure the solution provides high availability and uses dynamic routing. What should you do?
A. Configure VPC Network Peering between the two networks, and adjust firewall rules on both sides to allow the required traffic flow between specific subnets.
B. In vpc-a, deploy an internal Application Load Balancer for your application. Use Private Service Connect to publish this service in vpc-a and create a PSC consumer endpoint in vpc-b.
C. In each VPdeploy a Classic VPN gateway and use a pre-shared key for authentication. Configure static routes to direct traffic to the other VP
D. In each VPC. deploy an HA VPN gateway and a Cloud Router. Create two VPN tunnels on each gateway, and configure BGP sessions for dynamic routing.
Show Answer
Correct Answer: A
Explanation: VPC Network Peering provides private connectivity between VPCs across projects. Traffic between VMs in peered VPCs on Google's production network is encrypted in transit, and firewall rules control allowed communication. HA VPN with Cloud Router is appropriate when connecting external networks or when VPN is specifically required, but it is unnecessary for two Google Cloud VPCs connected by peering under these requirements.
Question 6
Your company acquired a new division. The new division's network team requires complete control over their networking infrastructure. You need to extend your existing Google Cloud network infrastructure, that consists of a single VPC, to allow workloads from all divisions to communicate with each other. You want to avoid incurring extra costs and granting unnecessary permissions to the new division's networking team. What should you do?
A. • Create a new project for the new division's network team. • Create a new VPC within the new project. • Establish a VPC peering between your existing VPC and the new division’s VPC. • Create a new subnet dedicated to the new division's workloads. • Grant roles/compute.networkUser on the new project to the new division’s network team group.
B. • Create a new project for the new division's network team. • Create a new VPC within the new project. • Establish a VPC peering between your existing VPC and the new division’s VPC. • Grant roles/compute.networkAdmin on the newly created project to the new division's network team group.
C. • Ensure that the project hosting the existing network infrastructure is enabled as a host project. • Create a new subnet dedicated to the new division's workloads in the existing VP • Grant roles/compute.networkUser on the newly created subnet to the new division’s network team group.
D. • Create a new project for the new division's network team. • Create a new VPC within the new project. • Establish a VPN connection between your existing VPC and the new division's VPC. • Grant roles/compute.networkAdmin on the newly created project to the new division's network team group.
Show Answer
Correct Answer: B
Explanation: The new division requires full administrative control over its own networking while avoiding unnecessary permissions in the existing environment. Creating a separate project with its own VPC and granting roles/compute.networkAdmin on that new project gives them autonomy over subnets, firewall rules, and routes without granting access to the existing VPC. VPC Network Peering enables communication between the VPCs and does not incur the additional costs associated with Cloud VPN. Options using networkUser do not provide administrative control, and VPN is unnecessary for Google Cloud VPC-to-VPC connectivity in this scenario.
Question 7
Your company is implementing new rules for outbound internet traffic in your Google Cloud environment. You need to design a configuration that enables all outbound internet traffic from virtual machines tagged with production-critical to route through a Secure Web Proxy (SWP) for inspection while allowing all other virtual machines to egress directly to the internet. What should you do?
A. Deploy a Cloud NAT gateway configured to translate and forward traffic from production-critical VMs to the internet.
B. Configure a custom static route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP address as a next hop.
C. Configure a policy-based route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP as a next hop.
D. Configure a policy-based route with a source set as the subnets of the production-critical VMs and a destination of 0.0.0.0/0 with the SWP IP as the next hop.
Show Answer
Correct Answer: B
Explanation: A tagged custom static route with destination 0.0.0.0/0 and the Secure Web Proxy as the next hop applies only to VMs with the specified network tag, causing only production-critical instances to send outbound traffic through the proxy while other VMs continue using the default internet route. Policy-based routes are matched on packet attributes such as source/destination ranges rather than network tags.
Question 8
Your organization is migrating workloads from AWS to Google Cloud. Because a particularly critical workload will take longer to migrate, you need to set up Google Cloud CDN and point it to the existing application at AWS. What should you do?
A. • Create an internet NEG that points to the existing FQDN of the application. • Map the NEG to an Application Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
B. • Create a hybrid NEG that points to the existing IP of the application. • Map the NEG to a passthrough Network Load Balancer as a target pool. • Enable Cloud CDN on the target pool.
C. • Create an internet NEG that points to the existing FQDN of the application. • Map the NEG to a passthrough Network Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
D. • Create a hybrid NEG that points to the existing IP of the application. • Map the NEG to an Application Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
Show Answer
Correct Answer: A
Explanation: Cloud CDN is supported with the external Application Load Balancer, not passthrough Network Load Balancers. For origins hosted outside Google Cloud (such as AWS), you use an internet network endpoint group (NEG) that references the origin by FQDN or public endpoint, attach it as a backend service to the Application Load Balancer, and enable Cloud CDN on that backend service.
Question 9
You are setting up a Dedicated Interconnect connection from your organization’s on-premises data center in Frankfurt, Germany, towards the europe-west3 region, which is also in the Frankfurt metropolitan area. The AI team lead expressed their concern regarding connectivity to the europe-west4 region because their team wants to use Google Cloud TPUs for their workloads. You need to ensure that low latency network connectivity is established for this team’s workloads. You want to minimize costs and operational overhead. What should you do?
A. Set up the Dedicated Interconnect connection towards the europe-west4 region instead of the europe-west3 region.
B. Set up an additional Partner Interconnect connection between your data center and the europe-west4 region.
C. Set up a remote VLAN attachment to the europe-west4 region on the Dedicated Interconnect connection.
D. Use Cloud VPN instead of Dedicated Interconnect to send traffic over the internet.
Show Answer
Correct Answer: C
Explanation: A remote VLAN attachment allows a Dedicated Interconnect in one metro to connect to supported remote Google Cloud regions over Google's backbone. Since europe-west3 (Frankfurt) and europe-west4 are connected this way, it provides low-latency connectivity while reusing the existing Dedicated Interconnect, minimizing both cost and operational overhead compared with deploying another Interconnect. Cloud VPN does not meet the low-latency private connectivity requirement, and moving the physical Interconnect to another region is unnecessary.
Question 10
Your VPC is configured with regional dynamic routing mode. You have deployed VMs and VLAN attachments in the europe-west2 region, and regional internal Application Load Balancers in us-east1. You need to ensure the VMs in the europe-west2 region have connectivity to the regional internal Application Load Balancers in the us-east1 region. What should you do?
A. Create the backend in us-east1, create multiple forwarding rules in each region, and then enable regional access.
B. Create the backend service in europe-west2, create the forwarding rule in us-east1, and then enable regional access.
C. Create the backend service in us-east1, create the forwarding rule in europe-west2, and then enable global access.
D. Create the backend service in us-east1, create the forwarding rule in us-east1, and then enable global access.
Show Answer
Correct Answer: D
Explanation: A regional internal Application Load Balancer requires its backend service and forwarding rule to be in the same region. To allow clients from other regions to access the regional internal ALB, you enable global access on the forwarding rule. Therefore, the backend service and forwarding rule should both be in us-east1, with global access enabled. Note that in practice, if the VPC uses regional dynamic routing mode and connectivity depends on learned dynamic routes across regions, changing the VPC to global dynamic routing mode may also be required, but that is not offered as an answer choice.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.