Professional Cloud Network Engineer Free Practice Questions
This is the free Google Professional Cloud Network Engineer practice question bank —
130 of 248 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
You are setting up a Dedicated Interconnect connection from your organization’s on-premises data center in Frankfurt, Germany, towards the europe-west3 region, which is also in the Frankfurt metropolitan area. The AI team lead expressed their concern regarding connectivity to the europe-west4 region because their team wants to use Google Cloud TPUs for their workloads. You need to ensure that low latency network connectivity is established for this team’s workloads. You want to minimize costs and operational overhead. What should you do?
A. Set up the Dedicated Interconnect connection towards the europe-west4 region instead of the europe-west3 region.
B. Set up an additional Partner Interconnect connection between your data center and the europe-west4 region.
C. Set up a remote VLAN attachment to the europe-west4 region on the Dedicated Interconnect connection.
D. Use Cloud VPN instead of Dedicated Interconnect to send traffic over the internet.
Show Answer
Correct Answer: C
Explanation: A Dedicated Interconnect already terminates in europe-west3 (Frankfurt). To reach TPUs in europe-west4 with low latency while minimizing cost and operational overhead, you should create a remote VLAN attachment to europe-west4 on the existing Dedicated Interconnect. This leverages Google’s backbone for cross-region traffic, avoids provisioning another interconnect, provides lower latency and cost than VPN, and avoids the extra expense and complexity of a separate Partner or Dedicated Interconnect to europe-west4.
Question 1
You manage your company's network security and have noticed unusual outbound traffic from a Compute Engine VM that is part of a production subnet. You suspect the VM may be compromised, because it is attempting to communicate with a malicious external IP address. You want to capture detailed metadata for every IP connection to and from this specific VM. including source/destination IP, port, protocol, and the amount of data transferred. What should you do?
A. • Enable VPC Flow Logs on the subnet containing the VM. • Set the sampling rate to 1.0 for maximum detail, and filter the logs in Cloud Logging for the VM's IP address.
B. • Navigate to Network Intelligence Center, and run a new connectivity test for the VM. • Analyze the report to see which configurations are allowing the traffic.
C. • Use Packet Mirroring to create a real-time copy of all network packets from the suspected VM. • Forward the copies to a collector VM for analysis.
D. • Create a new egress firewall rule with a priority of 65535 that allows all outbound traffic. • Enable Firewall Rules Logging on this new rule to capture all connection details.
Show Answer
Correct Answer: A
Explanation: VPC Flow Logs provide per-connection metadata such as source/destination IP, ports, protocol, bytes sent/received, and direction for traffic to and from a VM. Enabling them on the subnet with a 100% sampling rate (1.0) captures all flows, and logs can be filtered by the VM’s IP in Cloud Logging. The other options either analyze reachability (B), capture full packet payloads which is unnecessary and costly for metadata only (C), or do not reliably log all traffic metadata via firewall rules (D).
Question 2
Your VPC is configured with regional dynamic routing mode. You have deployed VMs and VLAN attachments in the europe-west2 region, and regional internal Application Load Balancers in us-east1. You need to ensure the VMs in the europe-west2 region have connectivity to the regional internal Application Load Balancers in the us-east1 region. What should you do?
A. Create the backend in us-east1, create multiple forwarding rules in each region, and then enable regional access.
B. Create the backend service in europe-west2, create the forwarding rule in us-east1, and then enable regional access.
C. Create the backend service in us-east1, create the forwarding rule in europe-west2, and then enable global access.
D. Create the backend service in us-east1, create the forwarding rule in us-east1, and then enable global access.
Show Answer
Correct Answer: D
Explanation: For connectivity to a regional internal Application Load Balancer from VMs in another region, all ALB components (backend service and forwarding rule) must be in the same region (us-east1). Enabling **global access** on the forwarding rule allows traffic from other regions. Options A–C are invalid because regional internal ALB resources cannot be split across regions or use multiple regional forwarding rules for this purpose.
Question 2
Your company is implementing new rules for outbound internet traffic in your Google Cloud environment. You need to design a configuration that enables all outbound internet traffic from virtual machines tagged with production-critical to route through a Secure Web Proxy (SWP) for inspection while allowing all other virtual machines to egress directly to the internet. What should you do?
A. Deploy a Cloud NAT gateway configured to translate and forward traffic from production-critical VMs to the internet.
B. Configure a custom static route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP address as a next hop.
C. Configure a policy-based route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP as a next hop.
D. Configure a policy-based route with a source set as the subnets of the production-critical VMs and a destination of 0.0.0.0/0 with the SWP IP as the next hop.
Show Answer
Correct Answer: C
Explanation: Secure Web Proxy in Google Cloud requires traffic redirection using policy-based routes, not custom static routes. A policy-based route can match specific workloads (such as instances identified by a network tag) and send all egress traffic (0.0.0.0/0) to the Secure Web Proxy as the next hop. This ensures only production-critical VMs are inspected, while all other VMs continue to use the default internet gateway.
Question 3
You are designing a Google Kubernetes Engine cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 Services. Because of the migration of new Services over the next two years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 Services. You want to use VPC-native clusters with alias IP address ranges, while minimizing address consumption. How should you design this topology?
A. Create a subnet of size /28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the Services are ready to be deployed, resize the subnets.
B. Use gcloud container clusters create [CLUSTER_NAME]--enable-ip-alias to create a VPC-native Cluster.
C. Create a subnet of size /25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
D. Use gcloud container clusters create [CLUSTER_NAME] to create a VPC-native Cluster.
Show Answer
Correct Answer: C
Explanation: A VPC‑native GKE cluster requires one primary subnet range for nodes and two secondary ranges: one for Pods and one for Services. Planning for growth to 100 nodes means the primary range must support at least 100 IPs, so a /25 (128 IPs) is appropriate. For Pods, although there will be up to 200 Pods per node, GKE allocates a /24 Pod range per node by default; with up to 100 nodes this requires a large secondary range, and a /17 comfortably satisfies this requirement while remaining valid. For Services, up to 1500 ClusterIP addresses are needed, and a /21 (2048 IPs) is sufficient; this range cannot be resized later, so it must be sized correctly up front. Therefore, option C correctly designs the topology while minimizing address consumption and supporting future growth.
Question 3
Your organization is migrating workloads from AWS to Google Cloud. Because a particularly critical workload will take longer to migrate, you need to set up Google Cloud CDN and point it to the existing application at AWS. What should you do?
A. • Create an internet NEG that points to the existing FQDN of the application. • Map the NEG to an Application Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
B. • Create a hybrid NEG that points to the existing IP of the application. • Map the NEG to a passthrough Network Load Balancer as a target pool. • Enable Cloud CDN on the target pool.
C. • Create an internet NEG that points to the existing FQDN of the application. • Map the NEG to a passthrough Network Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
D. • Create a hybrid NEG that points to the existing IP of the application. • Map the NEG to an Application Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
Show Answer
Correct Answer: A
Explanation: To front an application that still runs on AWS with Google Cloud CDN, you must use an External Application Load Balancer with Cloud CDN enabled. For backends that are reachable over the public internet, Google Cloud requires an Internet Network Endpoint Group (NEG), which can reference the application's public FQDN. Cloud CDN is not supported with passthrough Network Load Balancers or target pools, and hybrid NEGs are intended for private connectivity (VPN/Interconnect), not public AWS endpoints. Therefore, option A is the correct configuration.
Question 4
You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. The connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?
A. Create a Connectivity Test. Review the results for configuration issues in the VPC routing table.
B. Enable and review Cloud Logging for Cloud Armor. Look for logs with errors that match the destination IP address of the public SaaS provider.
C. Enable and review Cloud Logging on your Cloud NAT Gateway. Look for logs with errors that match the destination IP address of the public SaaS provider.
D. Enable the Firewall Insights API. Set the Deny rule insights observation period to one day. Review Insight results to assure there are no firewall rules denying traffic.
Show Answer
Correct Answer: C
Explanation: ICMP succeeding while TCP intermittently fails—especially at the same time each day—strongly suggests Cloud NAT port exhaustion or NAT-related drops during peak usage. Cloud NAT logging provides visibility into dropped connections and port allocation errors for outbound internet traffic, which is the most relevant Google Cloud signal for this scenario. Other options do not directly reveal NAT or ephemeral port exhaustion issues.
Question 5
You have configured a single IPSec Cloud VPN tunnel for your organization to one of your customers. The VPN Tunnel Status is showing as Established; however the BGP Session Status is showing as BGP not configured. Your customer’s BGP settings are:
• Customer BGP address: 169.254.11.1/30
• Customer ASN: 64515
• Google Cloud BGP address: 169.254.11.2
• Google Cloud ASN: 64517
• MD5 Authentication: Disabled
You need to configure your local BGP session for this tunnel based on the settings provided by the third party customer. You have already associated the Cloud Router with the Cloud VPN Tunnel. What should you do?
A. Create a BGP session with these settings: • Peer ASN: 64517 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Disabled.
B. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.1 • Peer BGP IP: 169.254.11.2 • MD5 Authentication: Disabled.
C. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Disabled.
D. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 1000 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Enabled.
Show Answer
Correct Answer: C
Explanation: On the Google Cloud side, the BGP session must use the customer's ASN as the peer ASN (64515). The local BGP IP must be the Google Cloud BGP address (169.254.11.2), and the peer BGP IP must be the customer BGP address (169.254.11.1). MD5 authentication is disabled per the customer's settings. Option C matches all these requirements; the other options swap ASNs, swap IPs, or enable MD5 incorrectly.
Question 6
Your company uses VPC firewall rules and denies all egress traffic. You need to allow some VMs to contact external websites based on their fully qualified domain name (FQDN). You apply the new configuration, but the traffic is still denied. You need to adjust your setup to apply the new configuration. What would you do?
A. Raise the priority of the network firewall policy rules.
B. Lower the priority of the network firewall policy rules.
C. Update the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL.
D. Update the default policy and rule evaluation order to AFTER_CLASSIC_FIREWALL.
Show Answer
Correct Answer: C
Explanation: The egress deny is coming from classic VPC firewall rules, which are evaluated after network firewall policies only when the enforcement order is set to BEFORE_CLASSIC_FIREWALL. By switching the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL, the FQDN-based allow rule in the network firewall policy is evaluated before the VPC deny-all egress rule, allowing the traffic.
Question 7
Your organization has an on-premises data center. You need to provide connectivity from the on-premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?
A. Configure HA VPN by using high availability gateways and tunnels.
B. Configure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.
C. Configure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.
D. Configure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.
Show Answer
Correct Answer: D
Explanation: The requirement is private connectivity that does not traverse the public internet with at least 1 Gbps bandwidth. HA VPN uses the public internet, so it does not meet the requirement. Cross-Cloud Interconnect is intended for connectivity between Google Cloud and another public cloud, not an on‑premises data center. Dedicated Interconnect provides private connectivity but has a minimum capacity of 10 Gbps per link, which exceeds the stated requirement. Partner Interconnect provides private connectivity through a service provider, supports bandwidth options starting at 1 Gbps, and requires submitting a pairing key to the provider, making it the correct choice.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.