Professional Cloud Network Engineer Free Practice Questions — Page 10
Question 88
You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket. You are using the USE_ORIGIN_HEADERS cache mode. You receive an HTTP 403 error when opening the file in your browser, and you see that the HTTP response has a Cache-Control: private, max-age=0 header. How should you correct this issue?
A. Enable negative caching for the backend bucket.
B. Change the cache mode to Force cache all content. C Configure a Cloud Storage bucket permission that gives allUsers the Storage Legacy Object Reader role.
D. Increase the default time-to-live (TTL) for the backend service.
Show Answer
Correct Answer: B
Explanation: The 403 response includes a Cache-Control: private, max-age=0 header from the origin. In USE_ORIGIN_HEADERS mode, Cloud CDN honors these headers and will not cache or serve content marked private, leading to access issues. Switching the cache mode to Force cache all content makes Cloud CDN ignore restrictive cache headers from the origin, allowing the object to be cached and served without changing bucket permissions. The issue is not negative caching, TTL, or public bucket permissions.
Question 89
You have the networking configuration shown in the diagram. A pair of redundant Dedicated Interconnect connections (int-Iga1 and int-Iga2) terminate on the same Cloud Router. The Interconnect connections terminate on two separate on-premises routers. You are advertising the same prefixes from the Border Gateway Protocol (BGP) sessions associated with the Dedicated Interconnect connections. You need to configure one connection as Active for both ingress and egress traffic. If the active Interconnect connection falls, you want the passive Interconnect connection to automatically begin routing all traffic. Which two actions should you take to meet this requirement? (Choose two.)
A. Configure the advertised route priority as 200 for the BGP session associated with the active interconnect connection.
B. Configure the advertised route priority > 10,200 on the active Interconnect connection.
C. Advertise a lower MED on the active Interconnect connection from the on-premises router.
D. Advertise a lower MED on the passive Interconnect connection from the on-premises router.
E. Configure the advertised route priority as 200 for the BGP session associated with the passive Interconnect connection.
Show Answer
Correct Answer: C, E
Explanation: To achieve active/passive behavior for both ingress and egress traffic on redundant Dedicated Interconnects, you must influence routing decisions in both directions.
For ingress traffic (from on‑premises into Google Cloud), BGP MED is used. Advertising a lower MED from the on‑premises router on the active Interconnect makes Google Cloud prefer that path. This is done by advertising a lower MED on the active Interconnect (C).
For egress traffic (from Google Cloud to on‑premises), Cloud Router uses route priority, where a lower numeric value is preferred and the default is 100. To make one connection passive, you increase the advertised route priority on the passive Interconnect (for example, to 200), so it is only used if the active link fails. This corresponds to configuring the advertised route priority as 200 for the BGP session associated with the passive Interconnect (E).
Together, these settings ensure the desired active/passive behavior with automatic failover.
Question 90
Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node. Which Pod per node CIDR range should you use?
A. /24
B. /25
C. /26
D. /28
Show Answer
Correct Answer: A
Explanation: GKE allocates one IP per Pod from the node’s Pod CIDR. To support up to 100 Pods per node, the CIDR must provide at least 100 usable IP addresses. A /25 provides 128 IPs, which is insufficient in GKE because IPs are also reserved, so Google’s documented mapping requires /24 for 65–128 Pods per node. A /24 provides 256 IP addresses and satisfies both the minimum of 60 and maximum of 100 Pods per node.
Question 91
Your company recently migrated to Google Cloud in a single region. You configured separate Virtual Private Cloud (VPC) networks for two departments: Department A and Department B. Department A has requested access to resources that are part of Department B's VPC. You need to configure the traffic from private IP addresses to flow between the VPCs using multi-NIC virtual machines (VMs) to meet security requirements. Your configuration also must:
• Support both TCP and UDP protocols
• Provide fully automated failover
• Include health-checks
• Require minimal manual intervention in the client VMs
Which approach should you take?
A. Create the VMs in the same zone, and configure static routes with IP addresses as next hops.
B. Create the VMs in different zones, and configure static routes with instance names as next hops.
C. Create an instance template and a managed instance group. Configure a single internal load balancer, and define a custom static route with the internal TCP/UDP load balancer as the next hop.
D. Create an instance template and a managed instance group. Configure two separate internal TCP/UDP load balancers for each protocol (TCP/UDP), and configure the client VMs to use the internal load balancers’ virtual IP addresses.
Show Answer
Correct Answer: C
Explanation: Option C best meets all stated requirements. Using an instance template with a managed instance group (MIG) provides automated failover and self-healing. An internal TCP/UDP load balancer supports both TCP and UDP traffic and includes built-in health checks. By configuring a custom static route that points to the internal load balancer as the next hop, traffic between the two VPCs can flow using private IPs with minimal changes required on the client VMs. Options A and B lack automated failover and health checks, while option D adds unnecessary complexity by requiring separate load balancers and explicit client-side configuration.
Question 92
You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters. Due to IP address exhaustion of the RFC 1918 address space in your enterprise, you plan to use privately used public IP space for the new clusters. You want to follow Google-recommended practices. What should you do after designing your IP scheme?
A. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters. Re-use the secondary address range for the pods across multiple private GKE clusters.
B. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters, Re-use the secondary address range for the services across multiple private GKE clusters.
C. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --enable-ip-alias and --enable-private-nodes.
D. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --disable-default-snat, --enable-ip-alias, and --enable-private-nodes.
Show Answer
Correct Answer: D
Explanation: When using privately used public IP (PUPI) ranges with private GKE clusters, Google recommends using VPC-native (IP alias) clusters and private nodes. Additionally, because pod and service CIDRs are non-RFC1918, GKE’s default SNAT would incorrectly masquerade pod-to-pod traffic unless it is disabled or carefully reconfigured. The recommended practice is to disable default SNAT at cluster creation and use IP aliasing with private nodes. Therefore, creating PUPI primary and secondary subnets and enabling --enable-ip-alias, --enable-private-nodes, and --disable-default-snat is the correct approach.
Question 93
Your product team has web servers running on both us-east1 and us-west1 regions in the prod-servers project. Your security team plans to install an intrusion detection system (IDS) in their own Google Cloud project to inspect the incoming network traffic. What should you do?
A. Create a new project and a VPC for the security team. Peer the new VPC with the web servers’ VPC in the prod-servers project. Create an internal load balancer and the IDS system in both us-east1 and us-west1. Enable Packet Mirroring, and create packet mirroring policies inside the new project.
C. Create a host project and a Sharad VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Enable IP forwarding on all the web servers. Create the IDS system in a non-shared subnet of us-east1 or us-west1. Configure the web servers to forward the packets to the IDS system. Create a new project and a VPC for the security team. Peer the new VPC with the web servers’ VPC in the prod-servers project. Enable IP forwarding on all the web servers. Install the IDS system in both us-east1 and us-west1. Configure the web servers to forward the packets to the IDS system.
D. Create a host project and a Shared VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Create an internal load balancer and the IDS system in a subnet in either us-east1 or us-west1. Enable Packet Mirroring, and create a packet mirroring policy inside the host project.
Show Answer
Correct Answer: A
Explanation: The requirement is to inspect traffic using an IDS deployed in the security team’s own Google Cloud project without modifying the web servers. The correct approach is to use VPC Network Peering and Packet Mirroring, which allows mirroring traffic across projects and regions as long as the collector is regional. Option A satisfies this: it keeps the IDS in the security team’s project, avoids IP forwarding or application changes, and deploys regional IDS collectors in both us-east1 and us-west1 as required by Packet Mirroring. Options involving IP forwarding or Shared VPC relocation are unnecessary and more intrusive.
Question 94
Your company's logo is published as an image file across multiple websites that are hosted by your company. You have implemented Cloud CDN; however, you want to improve the performance of the cache hit ratio associated with this image file. What should you do?
A. Configure custom cache keys for the backend service that holds the image file, and clear the Host and Protocol checkboxes.
B. Configure the default time to live (TTL) as 0 for the image file.
C. Configure versioned URLs for each domain to serve users the image file before the cache entry expires.
D. Configure Cloud Storage as a custom origin backend to host the image file, and select multi-region as the location type.
Show Answer
Correct Answer: A
Explanation: Cloud CDN builds its cache key from the full request URL by default, including host and protocol. Because the same logo image is served across multiple company-owned websites (different hostnames), this causes unnecessary cache fragmentation and lowers the cache hit ratio. Configuring custom cache keys and clearing the Host and Protocol fields allows all domains to share the same cached object, improving cache hit ratio. The other options either reduce caching effectiveness (TTL 0), do not address cross-domain cache fragmentation (versioned URLs), or are unnecessary for improving CDN cache efficiency (changing to Cloud Storage multi-region).
Question 95
You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer. You must ensure that your application meets the following requirements:
• Maps multiple existing reserved external IP addresses to the instance
• Processes IP Encapsulating Security Payload (ESP) traffic
What should you do?
A. Configure a target pool, and create protocol forwarding rules for each external IP address.
B. Configure a backend service, and create an external network load balancer for each external IP address.
C. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
D. Configure the Compute Engine instances’ network interface external IP address from None to Ephemeral. Add as many external IP addresses as required.
Show Answer
Correct Answer: C
Explanation: The requirements are to map multiple reserved external IP addresses to a single Compute Engine instance and to process ESP (IP protocol 50) traffic. This is done with protocol forwarding, which preserves the destination IP and supports non-TCP/UDP protocols like ESP. Protocol forwarding uses a target instance, not a backend service or target pool, and requires a separate forwarding rule for each external IP address. Therefore, configuring a target instance with protocol forwarding rules for each external IP address is correct.
Question 96
You are in the process of deploying an internal HTTP(S) load balancer for your web server virtual machine (VM) instances. What two prerequisite tasks must be completed before creating the load balancer? (Choose two.)
A. Choose a region.
B. Create firewall rules for health checks.
C. Reserve a static IP address for the load balancer.
D. Determine the subnet mask for a proxy-only subnet.
E. Determine the subnet mask for Serverless VPC Access.
Show Answer
Correct Answer: B, D
Explanation: For an internal HTTP(S) load balancer on Google Cloud, you must prepare the network before creating the load balancer. Firewall rules are required to allow Google health check and proxy traffic to reach the backend VMs. In addition, an internal HTTP(S) load balancer requires a proxy-only subnet in each region where it is deployed, which means determining and reserving an appropriate subnet mask for that proxy-only subnet. Choosing a region is implicit based on existing backends, reserving a static IP is optional, and Serverless VPC Access is unrelated.
Question 98
You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules.
• Always allow Secure Shell (SSH) from your corporate IP address.
• Restrict SSH access from all other IP addresses.
There are multiple projects and VPCs in your Google Cloud organization. You need to ensure that other VPC firewall rules cannot bypass the security team’s requirements. What should you do?
A. 1. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 0. 2. Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 1.
B. 1. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0. 2. Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 1.
C. 1. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1. 2. Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 0.
D. 1. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 1 2. Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 0.
Show Answer
Correct Answer: A
Explanation: The requirements must be enforced across multiple projects and VPCs so that no lower-level firewall rules can bypass them. This requires a hierarchical firewall policy applied at the organization node. To meet the security intent, SSH from the corporate IP must be explicitly allowed, and all other SSH traffic must be denied. Hierarchical firewall rules are evaluated by priority, where lower numbers have higher precedence. Therefore, the allow rule for the corporate IP must have a higher priority (priority 0) than the deny-all SSH rule (priority 1). This guarantees corporate access while blocking all other SSH consistently across the organization.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.