Professional Cloud Network Engineer Free Practice Questions — Page 10
Question 92
You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements:
• Each Google Cloud project must represent an internal project that your team will work on.
• After an internal project is finished, the infrastructure must be deleted.
• Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources.
• You have 10-100 projects deployed at a time.
While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable with centralized management.
What should you do?
A. Create a single project and single VPC for each internal project.
B. Create a single Shared VPC and attach each Google Cloud project as a service project.
C. Create a single project and additional VPCs for each internal project. D.O Create a Shared VPC and service project for each internal project.
Show Answer
Correct Answer: B
Explanation: Using a single Shared VPC host project with each internal project attached as a service project provides centralized network management while allowing each internal project to have its own Google Cloud project owner. This design scales well for dozens of projects, supports reusable Terraform modules, and allows service projects to be created and deleted as internal projects start and finish. Option D implies creating a separate Shared VPC for each internal project, which defeats centralized management.
Question 93
You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network. Currently, there is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability. What should you do?
A. Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
B. Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
C. Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VP
D. Use HA VPN. Configure one tunnel from each interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.
Show Answer
Correct Answer: D
Explanation: A single Dedicated Interconnect connection does not meet 99.99% SLA. Two Dedicated Interconnect connections in a single metro are also insufficient for a 99.99% end-to-end availability SLA; Dedicated Interconnect requires a more redundant topology (multiple connections across metros/edge domains). Direct Peering is not appropriate for private VPC connectivity. An HA VPN configured with one tunnel from each interface of the HA VPN gateway to the corresponding peer gateway interfaces, together with Cloud Router for dynamic routing, matches the documented 99.99% SLA for HA VPN to a properly redundant peer.
Question 94
You have the networking configuration shown in the diagram. Two VLAN attachments associated with two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BGP) sessions associated with each of the VLAN attachments.
You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow?
A. From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results.
B. From the Cloud CLI, run gcloud compute –-project PROJECT_ID routers get-status mycloudrouter –-region REGION and review the results.
C. From the Google Cloud console, navigate to the Hybrid Connectivity, select the Cloud Router, and view BGP sessions.
D. From the Cloud CLI, run gcloud compute routers describe mycloudrouter –-region REGION and review the results.
Show Answer
Correct Answer: B
Explanation: To troubleshoot asymmetric routing across Dedicated Interconnect VLAN attachments on the same Cloud Router, you need the Cloud Router's operational status, including learned and advertised routes, BGP peer status, and next hops. The `gcloud compute routers get-status` command provides this runtime information. Although the option shows minor syntax issues, it clearly refers to the correct command. The `describe` command shows configuration rather than operational status, the console BGP session view is less comprehensive for route analysis, and VPC Flow Logs are not the primary tool for diagnosing BGP route selection asymmetry.
Sources:
https://cloud.google.com/network-connectivity/docs/router/how-to/configuring-bgp
Question 96
You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket. You are using the USE_ORIGIN_HEADERS cache mode. You receive an HTTP 403 error when opening the file in your browser, and you see that the HTTP response has a Cache-Control: private, max-age=0 header. How should you correct this issue?
A. Enable negative caching for the backend bucket.
B. Change the cache mode to Force cache all content. C Configure a Cloud Storage bucket permission that gives allUsers the Storage Legacy Object Reader role.
D. Increase the default time-to-live (TTL) for the backend service.
Show Answer
Correct Answer: B
Explanation: With Cloud CDN in USE_ORIGIN_HEADERS mode, the origin's Cache-Control headers determine cacheability. A response with `Cache-Control: private, max-age=0` is not cacheable by shared caches, so Cloud CDN will not cache it. Changing the cache mode to `Force cache all content` instructs Cloud CDN to ignore restrictive origin cache headers such as `private` and cache the content. Negative caching is unrelated, increasing the default TTL does not override origin headers in USE_ORIGIN_HEADERS mode, and making the bucket public changes permissions rather than addressing the cache-header behavior.
Question 97
Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node. Which Pod per node CIDR range should you use?
A. /24
B. /25
C. /26
D. /28
Show Answer
Correct Answer: A
Explanation: In GKE, the per-node Pod CIDR must provide at least twice as many IP addresses as the maximum number of Pods per node. For a maximum of 100 Pods, at least 200 IP addresses are needed. A /25 provides 128 addresses, which is insufficient, while a /24 provides 256 addresses and supports the 65–128 Pods-per-node range.
Question 98
Your company recently migrated to Google Cloud in a single region. You configured separate Virtual Private Cloud (VPC) networks for two departments: Department A and Department B. Department A has requested access to resources that are part of Department B's VPC. You need to configure the traffic from private IP addresses to flow between the VPCs using multi-NIC virtual machines (VMs) to meet security requirements. Your configuration also must:
• Support both TCP and UDP protocols
• Provide fully automated failover
• Include health-checks
• Require minimal manual intervention in the client VMs
Which approach should you take?
A. Create the VMs in the same zone, and configure static routes with IP addresses as next hops.
B. Create the VMs in different zones, and configure static routes with instance names as next hops.
C. Create an instance template and a managed instance group. Configure a single internal load balancer, and define a custom static route with the internal TCP/UDP load balancer as the next hop.
D. Create an instance template and a managed instance group. Configure two separate internal TCP/UDP load balancers for each protocol (TCP/UDP), and configure the client VMs to use the internal load balancers’ virtual IP addresses.
Show Answer
Correct Answer: C
Explanation: The recommended design for highly available multi-NIC routing between VPCs is to place the router/appliance VMs in a managed instance group behind an internal passthrough Network Load Balancer (internal TCP/UDP load balancer) and use a custom static route whose next hop is the internal load balancer. This provides health checks, automated failover, supports TCP and UDP, and avoids client VM reconfiguration beyond routing. Static next-hop IPs or instances do not provide automated failover. Configuring clients to target load balancer VIPs directly is not the routed appliance pattern described.
Question 99
You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters. Due to IP address exhaustion of the RFC 1918 address space in your enterprise, you plan to use privately used public IP space for the new clusters. You want to follow Google-recommended practices. What should you do after designing your IP scheme?
A. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters. Re-use the secondary address range for the pods across multiple private GKE clusters.
B. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters, Re-use the secondary address range for the services across multiple private GKE clusters.
C. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --enable-ip-alias and --enable-private-nodes.
D. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --disable-default-snat, --enable-ip-alias, and --enable-private-nodes.
Show Answer
Correct Answer: D
Explanation: When using privately used public IP (PUPI) space for GKE Pod and Service ranges, Google recommends creating primary and secondary subnet ranges with the PUPI addresses and using a private GKE cluster with IP aliasing and private nodes. Because GKE's default SNAT masquerades traffic destined for public IPs, Pods using PUPI ranges can be incorrectly SNATed unless default SNAT is disabled (or ip-masq-agent is configured). Among the options given, only D includes the recommended cluster configuration with --disable-default-snat, --enable-ip-alias, and --enable-private-nodes.
Question 100
Your product team has web servers running on both us-east1 and us-west1 regions in the prod-servers project. Your security team plans to install an intrusion detection system (IDS) in their own Google Cloud project to inspect the incoming network traffic. What should you do?
A. Create a new project and a VPC for the security team. Peer the new VPC with the web servers’ VPC in the prod-servers project. Create an internal load balancer and the IDS system in both us-east1 and us-west1. Enable Packet Mirroring, and create packet mirroring policies inside the new project.
C. Create a host project and a Sharad VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Enable IP forwarding on all the web servers. Create the IDS system in a non-shared subnet of us-east1 or us-west1. Configure the web servers to forward the packets to the IDS system. Create a new project and a VPC for the security team. Peer the new VPC with the web servers’ VPC in the prod-servers project. Enable IP forwarding on all the web servers. Install the IDS system in both us-east1 and us-west1. Configure the web servers to forward the packets to the IDS system.
D. Create a host project and a Shared VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Create an internal load balancer and the IDS system in a subnet in either us-east1 or us-west1. Enable Packet Mirroring, and create a packet mirroring policy inside the host project.
Show Answer
Correct Answer: A
Explanation: Use Packet Mirroring rather than configuring the web servers to forward traffic. The IDS can run in a separate security project, connected via VPC Network Peering, with collectors deployed in each region because packet mirroring collectors must be regional. The options using IP forwarding are not how Packet Mirroring works, and Shared VPC is not required for this architecture. No web search results were provided, so there are no source URLs.
Question 101
Your company's logo is published as an image file across multiple websites that are hosted by your company. You have implemented Cloud CDN; however, you want to improve the performance of the cache hit ratio associated with this image file. What should you do?
A. Configure custom cache keys for the backend service that holds the image file, and clear the Host and Protocol checkboxes.
B. Configure the default time to live (TTL) as 0 for the image file.
C. Configure versioned URLs for each domain to serve users the image file before the cache entry expires.
D. Configure Cloud Storage as a custom origin backend to host the image file, and select multi-region as the location type.
Show Answer
Correct Answer: A
Explanation: Cloud CDN cache keys include the full request URL by default, including the host. When the same image is served from multiple company-hosted domains, separate hostnames create separate cache entries, reducing the cache hit ratio. Configuring custom cache keys and clearing the Host (and Protocol) components allows the shared image to use the same cache entry across domains and protocols where appropriate, improving cache efficiency. Setting TTL to 0 disables effective caching, versioned URLs are for cache invalidation rather than improving cross-domain cache reuse, and moving to Cloud Storage multi-region does not address cache key fragmentation.
Question 102
You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer. You must ensure that your application meets the following requirements:
• Maps multiple existing reserved external IP addresses to the instance
• Processes IP Encapsulating Security Payload (ESP) traffic
What should you do?
A. Configure a target pool, and create protocol forwarding rules for each external IP address.
B. Configure a backend service, and create an external network load balancer for each external IP address.
C. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
D. Configure the Compute Engine instances’ network interface external IP address from None to Ephemeral. Add as many external IP addresses as required.
Show Answer
Correct Answer: C
Explanation: Protocol forwarding to a single Compute Engine VM that must preserve the destination IP and support protocols such as ESP uses a target instance. You create a protocol forwarding rule for each reserved external IP address and point each rule at the target instance. Target pools are used with external passthrough Network Load Balancers and are not the correct construct for directly mapping multiple reserved external IPs with protocol forwarding to a single instance. A VM NIC cannot have multiple external IP addresses assigned directly.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.