Professional Cloud Network Engineer Free Practice Questions — Page 10
Question 86
Your company recently migrated to Google Cloud. You configured separate Virtual Private Cloud (VPC) networks for Department A and Department B. You need to configure both VPC networks to have access to the same on-premises location through separate links with full isolation between the VPC networks. Your design must also query on-premises DNS servers from workloads in Google Cloud using conditional forwarding. You want to minimize operational overhead. What should you do?
A. Customize the operating system DNS configuration files to target the on-premises DNS servers.
B. Keep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
C. Peer Department A's and Department B's VPC networks to have all on-premises connectivity via a single VPC network. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
D. Configure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network.
Show Answer
Correct Answer: D
Explanation: The requirements combine network isolation, separate on-premises connectivity for each VPC, conditional forwarding to on-premises DNS, and low operational overhead. Using outbound forwarding independently from multiple VPCs is discouraged because Cloud DNS forwarding queries originate from the same source range, which can create return-path ambiguity. A Cloud DNS peering zone allows one VPC to use the other's outbound forwarding configuration while keeping separate network connectivity. Option C breaks the isolation requirement, A has high operational overhead, and B conflicts with Cloud DNS best practices for multiple outbound forwarders.
Question 87
You are designing a packet mirroring policy as part of your network security architecture for your gaming workload. Your infrastructure is located in the us-west2 region and deployed across several zones: us-west2-a, us-west2-b, and us-west2-c. The infrastructure is running a web-based application on TCP ports 80 and 443 with other game servers that utilize the UDP protocol. You need to deploy packet mirroring policies and collector instances to monitor web application traffic while minimizing inter-zonal network egress costs.
Following Google-recommended practices, how should you deploy the packet mirroring policies and collector instances?
A. Crate three packet mirroring policies: one for each zone. Create one group of collector instances for the us-west2 region. Configure each packet mirroring policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
B. Create one packet mirroring policy for the us-west2 region. Create one group of collector instances for the us-west2 region. Configure the packet mirroring policy to match traffic for web server instances based on instance-tags, and create a filter for TCP traffic.
C. Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
D. Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on subnets, and create a filter for TCP traffic.
Show Answer
Correct Answer: C
Explanation: To minimize inter-zonal egress costs, deploy collector instance groups in each zone so mirrored traffic stays within the same zone. Use separate packet mirroring policies aligned to each zone and match the web server instances using instance tags, filtering only TCP traffic (ports 80/443 are TCP, while UDP game traffic is excluded by the protocol filter). Using a single regional collector group can cause cross-zone mirrored traffic, and subnet-based matching is less appropriate than instance tags for targeting the web servers.
Question 88
You are designing a new network infrastructure for your customer in Google Cloud. Your customer requires a connection between two Google Cloud VPCs that must include a VPN tunnel. You want to follow Google-recommended practices while ensuring maximum availability of the connection. Which VPN configuration should you choose?
A. Policy-based VPN using Classic VPN between the two Google Cloud VPCs
B. Border Gateway Protocol (BGP)-based VPN using Classic VPN between the two Google Cloud VPCs
C. Route-based VPN using Classic VPN between the two Google Cloud VPCs
D. Border Gateway Protocol (BGP)-based VPN using HA VPN between the two Google Cloud VPCs
Show Answer
Correct Answer: D
Explanation: Google recommends HA VPN for new VPN deployments because it provides a highly available architecture with two interfaces and supports dynamic routing using BGP via Cloud Router. Between two Google Cloud VPCs, an HA VPN with BGP offers the highest availability and is the recommended configuration. Classic VPN is a legacy option and does not match the recommended practice for maximum availability.
Question 89
You are configuring your organization's Google Cloud environment to connect to your on-premises network, which does not support Border Gateway Protocol (BGP). Your on-premises network has 30 CIDR ranges that must be reachable from Google Cloud. Your VPN gateway creates a unique child security association (SA) per CIDR. You must ensure that the 30 CIDR ranges in your on-premises network are reachable from Google Cloud.
Following Google-recommended practices, which two methods can you use to accomplish this? (Choose two.)
A. Create a single Cloud VPN tunnel that uses route-based VPN.
B. Create a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors.
C. Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to unique peer IP addresses.
D. Create multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the remote traffic selectors.
E. Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to the same peer IP address.
Show Answer
Correct Answer: A, C
Explanation: Google recommends either using a route-based VPN (traffic selectors 0.0.0.0/0 with static routes when BGP is unavailable) or, for policy-based VPNs with many CIDRs and peers that create a separate child SA per CIDR, creating one tunnel per local/remote CIDR pair. For Classic VPN, those tunnels must connect to unique peer gateway IP addresses. A single policy-based tunnel with 30 remote traffic selectors is not the recommended design for peers that require a unique child SA per CIDR, and splitting into arbitrary groups of 10 CIDRs is not the documented recommendation.
Question 90
You have two VPCs: VPC A in Project A and VPC B in Project B. The VPCs are peered, and each VPC has VM instances in four zones. You are using the Network Intelligence Center Performance Dashboard to investigate the packet loss for traffic flows that start in VPC A and terminate in VPC B. You need the reported packet loss metric to have at least a 90% confidence level. What should you do?
A. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project A for the reported metric.
B. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project B for the reported metric.
C. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project A for the reported metric.
D. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project B for the reported metric.
Show Answer
Correct Answer: D
Explanation: For Network Intelligence Center Performance Dashboard, a 90% confidence level for packet loss requires at least 2.5 VMs multiplied by the number of zones in the project, per zone. With four zones, that is 2.5 × 4 = 10 VMs in each zone. For VPC peering across different projects, packet loss for flows is visible in the destination project. Since traffic starts in VPC A and terminates in VPC B, you should view the metric in Project B.
Question 92
You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements:
• Each Google Cloud project must represent an internal project that your team will work on.
• After an internal project is finished, the infrastructure must be deleted.
• Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources.
• You have 10-100 projects deployed at a time.
While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable with centralized management.
What should you do?
A. Create a single project and single VPC for each internal project.
B. Create a single Shared VPC and attach each Google Cloud project as a service project.
C. Create a single project and additional VPCs for each internal project. D.O Create a Shared VPC and service project for each internal project.
Show Answer
Correct Answer: B
Explanation: Using a single Shared VPC host project with each internal project attached as a service project provides centralized network management while allowing each internal project to have its own Google Cloud project owner. This design scales well for dozens of projects, supports reusable Terraform modules, and allows service projects to be created and deleted as internal projects start and finish. Option D implies creating a separate Shared VPC for each internal project, which defeats centralized management.
Question 93
You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network. Currently, there is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability. What should you do?
A. Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
B. Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
C. Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VP
D. Use HA VPN. Configure one tunnel from each interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.
Show Answer
Correct Answer: D
Explanation: A single Dedicated Interconnect connection does not meet 99.99% SLA. Two Dedicated Interconnect connections in a single metro are also insufficient for a 99.99% end-to-end availability SLA; Dedicated Interconnect requires a more redundant topology (multiple connections across metros/edge domains). Direct Peering is not appropriate for private VPC connectivity. An HA VPN configured with one tunnel from each interface of the HA VPN gateway to the corresponding peer gateway interfaces, together with Cloud Router for dynamic routing, matches the documented 99.99% SLA for HA VPN to a properly redundant peer.
Question 96
You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket. You are using the USE_ORIGIN_HEADERS cache mode. You receive an HTTP 403 error when opening the file in your browser, and you see that the HTTP response has a Cache-Control: private, max-age=0 header. How should you correct this issue?
A. Enable negative caching for the backend bucket.
B. Change the cache mode to Force cache all content. C Configure a Cloud Storage bucket permission that gives allUsers the Storage Legacy Object Reader role.
D. Increase the default time-to-live (TTL) for the backend service.
Show Answer
Correct Answer: B
Explanation: With Cloud CDN in USE_ORIGIN_HEADERS mode, the origin's Cache-Control headers determine cacheability. A response with `Cache-Control: private, max-age=0` is not cacheable by shared caches, so Cloud CDN will not cache it. Changing the cache mode to `Force cache all content` instructs Cloud CDN to ignore restrictive origin cache headers such as `private` and cache the content. Negative caching is unrelated, increasing the default TTL does not override origin headers in USE_ORIGIN_HEADERS mode, and making the bucket public changes permissions rather than addressing the cache-header behavior.
Question 97
Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node. Which Pod per node CIDR range should you use?
A. /24
B. /25
C. /26
D. /28
Show Answer
Correct Answer: A
Explanation: In GKE, the per-node Pod CIDR must provide at least twice as many IP addresses as the maximum number of Pods per node. For a maximum of 100 Pods, at least 200 IP addresses are needed. A /25 provides 128 addresses, which is insufficient, while a /24 provides 256 addresses and supports the 65–128 Pods-per-node range.
Question 98
Your company recently migrated to Google Cloud in a single region. You configured separate Virtual Private Cloud (VPC) networks for two departments: Department A and Department B. Department A has requested access to resources that are part of Department B's VPC. You need to configure the traffic from private IP addresses to flow between the VPCs using multi-NIC virtual machines (VMs) to meet security requirements. Your configuration also must:
• Support both TCP and UDP protocols
• Provide fully automated failover
• Include health-checks
• Require minimal manual intervention in the client VMs
Which approach should you take?
A. Create the VMs in the same zone, and configure static routes with IP addresses as next hops.
B. Create the VMs in different zones, and configure static routes with instance names as next hops.
C. Create an instance template and a managed instance group. Configure a single internal load balancer, and define a custom static route with the internal TCP/UDP load balancer as the next hop.
D. Create an instance template and a managed instance group. Configure two separate internal TCP/UDP load balancers for each protocol (TCP/UDP), and configure the client VMs to use the internal load balancers’ virtual IP addresses.
Show Answer
Correct Answer: C
Explanation: The recommended design for highly available multi-NIC routing between VPCs is to place the router/appliance VMs in a managed instance group behind an internal passthrough Network Load Balancer (internal TCP/UDP load balancer) and use a custom static route whose next hop is the internal load balancer. This provides health checks, automated failover, supports TCP and UDP, and avoids client VM reconfiguration beyond routing. Static next-hop IPs or instances do not provide automated failover. Configuring clients to target load balancer VIPs directly is not the routed appliance pattern described.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.