Professional Cloud Network Engineer Free Practice Questions — Page 11
Question 103
You are in the process of deploying an internal HTTP(S) load balancer for your web server virtual machine (VM) instances. What two prerequisite tasks must be completed before creating the load balancer? (Choose two.)
A. Choose a region.
B. Create firewall rules for health checks.
C. Reserve a static IP address for the load balancer.
D. Determine the subnet mask for a proxy-only subnet.
E. Determine the subnet mask for Serverless VPC Access.
Show Answer
Correct Answer: B, D
Explanation: For a Google Cloud internal HTTP(S) load balancer, you must configure a proxy-only subnet in the target region before deployment, including determining its subnet size/mask. You also need firewall rules that allow Google Cloud health check probes to reach the backend instances. Reserving a static IP is optional, choosing a region is part of the deployment configuration rather than a prerequisite task, and Serverless VPC Access is unrelated.
Question 104
Your team is developing an application that will be used by consumers all over the world. Currently, the application sits behind a global external application load balancer. You need to protect the application from potential application-level attacks. What should you do?
A. Enable Cloud CDN on the backend service.
B. Create multiple firewall deny rules to block malicious users, and apply them to the global external application load balancer.
C. Create a Google Cloud Armor security policy with web application firewall rules, and apply the security policy to the backend service
D. Create a VPC Service Controls perimeter with the global external application load balancer as the protected service, and apply it to the backend service.
Show Answer
Correct Answer: C
Explanation: Google Cloud Armor is Google Cloud's managed web application firewall (WAF) for protecting applications behind external Application Load Balancers from application-layer attacks such as OWASP Top 10 threats and L7 DDoS. You attach a Cloud Armor security policy to the backend service. Cloud CDN is for caching, firewall rules do not apply directly to the load balancer for WAF protection, and VPC Service Controls protect data exfiltration for supported Google APIs, not internet-facing web applications.
Question 105
You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules.
• Always allow Secure Shell (SSH) from your corporate IP address.
• Restrict SSH access from all other IP addresses.
There are multiple projects and VPCs in your Google Cloud organization. You need to ensure that other VPC firewall rules cannot bypass the security team’s requirements. What should you do?
A. 1. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 0. 2. Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 1.
B. 1. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0. 2. Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 1.
C. 1. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1. 2. Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 0.
D. 1. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 1 2. Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 0.
Show Answer
Correct Answer: A
Explanation: Hierarchical firewall policies applied at the organization level enforce security consistently across all projects and VPCs and cannot be overridden by lower-level VPC firewall rules. Google Cloud firewall priorities use lower numbers as higher precedence, so an allow rule for the corporate IP at priority 0 must come before a deny-all SSH rule at priority 1. This permits SSH only from the corporate IP while denying it from all other sources across the organization.
Question 106
You are designing a new application that has backends internally exposed on port 800. The application will be exposed externally using both IPv4 and IPv6 via TCP on port 700. You want to ensure high availability for this application. What should you do?
A. Create a network load balancer that used backend services containing one instance group with two instances.
B. Create a network load balancer that uses a target pool backend with two instances.
C. Create a TCP proxy that uses a zonal network endpoint group containing one instance.
D. Create a TCP proxy that uses backend services containing an instance group with two instances.
Show Answer
Correct Answer: D
Explanation: The requirement includes exposing the service externally over both IPv4 and IPv6, providing high availability, and listening on external TCP port 700 while the backend application listens on port 800. A pass-through network load balancer preserves the destination port and cannot translate 700 to 800. An external TCP proxy load balancer can proxy connections and forward them to a different backend port via a backend service. Using an instance group with two instances satisfies the high-availability requirement. A single zonal NEG with one instance is not highly available.
Question 107
You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?
A. Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.
B. Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.
C. Enable VPC Flow Logs for the VPAnalyze the logs and get the source IP addresses from the src_location field.
D. Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.
Show Answer
Correct Answer: B
Explanation: VPC Flow Logs are the correct feature for analyzing network traffic to and from VM instances. Flow Logs are enabled at the subnet level, and each log record includes a connection field (IpConnection) containing the source and destination IP addresses, ports, and protocol. Data Access audit logs record API access, not packet flows, and src_location contains only geographic metadata rather than the actual source IP address.
Question 108
You are responsible for designing a new connectivity solution for your organization's enterprise network to access and use Google Workspace. You have an existing Shared VPC with Compute Engine instances in us-west1. Currently, you access Google Workspace via your service provider's internet access. You want to set up a direct connection between your network and Google. What should you do?
A. Order a Dedicated Interconnect connection in the same metropolitan area. Create a VLAN attachment, a Cloud Router in us-west1, and a Border Gateway Protocol (BGP) session between your Cloud Router and your router.
B. Order a Direct Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.
C. Configure HA VPN in us-west1. Configure a Border Gateway Protocol (BGP) session between your Cloud Router and your on-premises data center.
D. Order a Carrier Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.
Show Answer
Correct Answer: B
Explanation: Direct Peering is the appropriate option when the goal is a direct connection to Google's public services such as Google Workspace. Dedicated Interconnect is intended for private connectivity to Google Cloud VPC resources, not Google Workspace. HA VPN uses the public internet, and Carrier Peering is for connectivity through a supported service provider rather than a direct connection.
Question 109
You are configuring a new HTTP application that will be exposed externally behind both IPv4 and IPv6 virtual IP addresses, using ports 80, 8080, and 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest-possible latency while ensuring high availability and autoscaling, and create native content-based rules using the HTTP hostname and request path. The IP addresses of the clients that connect to the load balancer need to be visible to the backends. Which configuration should you use?
A. Use Network Load Balancing
B. Use TCP Proxy Load Balancing with PROXY protocol enabled
C. Use External HTTP(S) Load Balancing with URL Maps and custom headers
D. Use External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header
Show Answer
Correct Answer: D
Explanation: External HTTP(S) Load Balancing provides global anycast IPv4/IPv6 addresses, cross-region load balancing, autoscaling integration, and URL Maps for host/path-based routing. Backend services receive the original client IP in the standard X-Forwarded-For header, satisfying the requirement to see client IPs. Network Load Balancing and TCP Proxy Load Balancing do not provide native HTTP host/path routing; PROXY protocol applies to TCP proxying rather than HTTP(S) URL map routing. Custom headers are unnecessary because X-Forwarded-For is the standard mechanism.
Question 110
Your organization has a Google Cloud Virtual Private Cloud (VPC) with subnets in us-east1, us-west4, and europe-west4 that use the default VPC configuration. Employees in a branch office in Europe need to access the resources in the VPC using HA VPN. You configured the HA VPN associated with the Google Cloud VPC for your organization with a Cloud Router deployed in europe-west4. You need to ensure that the users in the branch office can quickly and easily access all resources in the VPC. What should you do?
A. Create custom advertised routes for each subnet.
B. Configure each subnet’s VPN connections to use Cloud VPN to connect to the branch office.
C. Configure the VPC dynamic routing mode to Global.
D. Set the advertised routes to Global for the Cloud Router.
Show Answer
Correct Answer: C
Explanation: HA VPN uses Cloud Router to exchange dynamic routes. With the VPC in the default configuration, the dynamic routing mode is Regional, so a Cloud Router in europe-west4 only learns/advertises routes for that region. Changing the VPC dynamic routing mode to Global allows the Cloud Router to advertise and learn routes for all subnets across regions (us-east1, us-west4, and europe-west4), enabling branch-office users to reach all VPC resources through the single HA VPN. Custom advertisements and additional VPNs are unnecessary, and Cloud Router advertisement scope is governed by the VPC dynamic routing mode.
Question 111
You configured Cloud VPN with dynamic routing via Border Gateway Protocol (BGP). You added a custom route to advertise a network that is reachable over the VPN tunnel. However, the on-premises clients still cannot reach the network over the VPN tunnel. You need to examine the logs in Cloud Logging to confirm that the appropriate routers are being advertised over the VPN tunnel. Which filter should you use in Cloud Logging to examine the logs?
A. resource.type= “gce_router”
B. resource.type= “gce_network_region”
C. resource.type= “vpn_tunnel”
D. resource.type= “vpn_gateway”
Show Answer
Correct Answer: A
Explanation: For Cloud VPN using dynamic routing with BGP, Cloud Router is responsible for BGP sessions and route advertisements. To verify advertised routes in Cloud Logging, filter on the Cloud Router resource type: resource.type="gce_router". VPN tunnel/gateway logs focus on tunnel status and VPN events rather than BGP route advertisement details.
Question 112
You are designing a hub-and-spoke network architecture for your company’s cloud-based environment. You need to make sure that all spokes are peered with the hub. The spokes must use the hub's virtual appliance for internet access. The virtual appliance is configured in high-availability mode with two instances using an internal load balancer with IP address 10.0.0.5. What should you do?
A. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. 4. Import the custom routes in the spokes.
B. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes. 4. Delete the default internet gateway route of the spokes.
C. 1. Create two default routes in the hub VPC that point to the next hop instances of the virtual appliances. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes.
D. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Create a new route in the spoke VPC that points to IP address 10.0.0.5.
Show Answer
Correct Answer: B
Explanation: In a hub-and-spoke VPC Network Peering design using a highly available virtual appliance behind an internal load balancer, the hub should advertise a custom default route (0.0.0.0/0) pointing to the ILB IP. The appliance instances need tagged routes to reach the internet directly. The hub must export custom routes and the spokes must import them. The spokes' default internet gateway route should be removed so internet-bound traffic follows the imported default route through the hub appliance rather than using their own local internet gateway.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.