Professional Cloud Network Engineer Free Practice Questions — Page 11
Question 99
You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters. Due to IP address exhaustion of the RFC 1918 address space in your enterprise, you plan to use privately used public IP space for the new clusters. You want to follow Google-recommended practices. What should you do after designing your IP scheme?
A. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters. Re-use the secondary address range for the pods across multiple private GKE clusters.
B. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters, Re-use the secondary address range for the services across multiple private GKE clusters.
C. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --enable-ip-alias and --enable-private-nodes.
D. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --disable-default-snat, --enable-ip-alias, and --enable-private-nodes.
Show Answer
Correct Answer: D
Explanation: When using privately used public IP (PUPI) space for GKE Pod and Service ranges, Google recommends creating primary and secondary subnet ranges with the PUPI addresses and using a private GKE cluster with IP aliasing and private nodes. Because GKE's default SNAT masquerades traffic destined for public IPs, Pods using PUPI ranges can be incorrectly SNATed unless default SNAT is disabled (or ip-masq-agent is configured). Among the options given, only D includes the recommended cluster configuration with --disable-default-snat, --enable-ip-alias, and --enable-private-nodes.
Question 100
Your product team has web servers running on both us-east1 and us-west1 regions in the prod-servers project. Your security team plans to install an intrusion detection system (IDS) in their own Google Cloud project to inspect the incoming network traffic. What should you do?
A. Create a new project and a VPC for the security team. Peer the new VPC with the web servers’ VPC in the prod-servers project. Create an internal load balancer and the IDS system in both us-east1 and us-west1. Enable Packet Mirroring, and create packet mirroring policies inside the new project.
C. Create a host project and a Sharad VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Enable IP forwarding on all the web servers. Create the IDS system in a non-shared subnet of us-east1 or us-west1. Configure the web servers to forward the packets to the IDS system. Create a new project and a VPC for the security team. Peer the new VPC with the web servers’ VPC in the prod-servers project. Enable IP forwarding on all the web servers. Install the IDS system in both us-east1 and us-west1. Configure the web servers to forward the packets to the IDS system.
D. Create a host project and a Shared VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Create an internal load balancer and the IDS system in a subnet in either us-east1 or us-west1. Enable Packet Mirroring, and create a packet mirroring policy inside the host project.
Show Answer
Correct Answer: A
Explanation: Use Packet Mirroring rather than configuring the web servers to forward traffic. The IDS can run in a separate security project, connected via VPC Network Peering, with collectors deployed in each region because packet mirroring collectors must be regional. The options using IP forwarding are not how Packet Mirroring works, and Shared VPC is not required for this architecture. No web search results were provided, so there are no source URLs.
Question 101
Your company's logo is published as an image file across multiple websites that are hosted by your company. You have implemented Cloud CDN; however, you want to improve the performance of the cache hit ratio associated with this image file. What should you do?
A. Configure custom cache keys for the backend service that holds the image file, and clear the Host and Protocol checkboxes.
B. Configure the default time to live (TTL) as 0 for the image file.
C. Configure versioned URLs for each domain to serve users the image file before the cache entry expires.
D. Configure Cloud Storage as a custom origin backend to host the image file, and select multi-region as the location type.
Show Answer
Correct Answer: A
Explanation: Cloud CDN cache keys include the full request URL by default, including the host. When the same image is served from multiple company-hosted domains, separate hostnames create separate cache entries, reducing the cache hit ratio. Configuring custom cache keys and clearing the Host (and Protocol) components allows the shared image to use the same cache entry across domains and protocols where appropriate, improving cache efficiency. Setting TTL to 0 disables effective caching, versioned URLs are for cache invalidation rather than improving cross-domain cache reuse, and moving to Cloud Storage multi-region does not address cache key fragmentation.
Question 102
You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer. You must ensure that your application meets the following requirements:
• Maps multiple existing reserved external IP addresses to the instance
• Processes IP Encapsulating Security Payload (ESP) traffic
What should you do?
A. Configure a target pool, and create protocol forwarding rules for each external IP address.
B. Configure a backend service, and create an external network load balancer for each external IP address.
C. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
D. Configure the Compute Engine instances’ network interface external IP address from None to Ephemeral. Add as many external IP addresses as required.
Show Answer
Correct Answer: C
Explanation: Protocol forwarding to a single Compute Engine VM that must preserve the destination IP and support protocols such as ESP uses a target instance. You create a protocol forwarding rule for each reserved external IP address and point each rule at the target instance. Target pools are used with external passthrough Network Load Balancers and are not the correct construct for directly mapping multiple reserved external IPs with protocol forwarding to a single instance. A VM NIC cannot have multiple external IP addresses assigned directly.
Question 103
You are in the process of deploying an internal HTTP(S) load balancer for your web server virtual machine (VM) instances. What two prerequisite tasks must be completed before creating the load balancer? (Choose two.)
A. Choose a region.
B. Create firewall rules for health checks.
C. Reserve a static IP address for the load balancer.
D. Determine the subnet mask for a proxy-only subnet.
E. Determine the subnet mask for Serverless VPC Access.
Show Answer
Correct Answer: B, D
Explanation: For a Google Cloud internal HTTP(S) load balancer, you must configure a proxy-only subnet in the target region before deployment, including determining its subnet size/mask. You also need firewall rules that allow Google Cloud health check probes to reach the backend instances. Reserving a static IP is optional, choosing a region is part of the deployment configuration rather than a prerequisite task, and Serverless VPC Access is unrelated.
Question 104
Your team is developing an application that will be used by consumers all over the world. Currently, the application sits behind a global external application load balancer. You need to protect the application from potential application-level attacks. What should you do?
A. Enable Cloud CDN on the backend service.
B. Create multiple firewall deny rules to block malicious users, and apply them to the global external application load balancer.
C. Create a Google Cloud Armor security policy with web application firewall rules, and apply the security policy to the backend service
D. Create a VPC Service Controls perimeter with the global external application load balancer as the protected service, and apply it to the backend service.
Show Answer
Correct Answer: C
Explanation: Google Cloud Armor is Google Cloud's managed web application firewall (WAF) for protecting applications behind external Application Load Balancers from application-layer attacks such as OWASP Top 10 threats and L7 DDoS. You attach a Cloud Armor security policy to the backend service. Cloud CDN is for caching, firewall rules do not apply directly to the load balancer for WAF protection, and VPC Service Controls protect data exfiltration for supported Google APIs, not internet-facing web applications.
Question 105
You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules.
• Always allow Secure Shell (SSH) from your corporate IP address.
• Restrict SSH access from all other IP addresses.
There are multiple projects and VPCs in your Google Cloud organization. You need to ensure that other VPC firewall rules cannot bypass the security team’s requirements. What should you do?
A. 1. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 0. 2. Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 1.
B. 1. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0. 2. Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 1.
C. 1. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1. 2. Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 0.
D. 1. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 1 2. Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 0.
Show Answer
Correct Answer: A
Explanation: Hierarchical firewall policies applied at the organization level enforce security consistently across all projects and VPCs and cannot be overridden by lower-level VPC firewall rules. Google Cloud firewall priorities use lower numbers as higher precedence, so an allow rule for the corporate IP at priority 0 must come before a deny-all SSH rule at priority 1. This permits SSH only from the corporate IP while denying it from all other sources across the organization.
Question 106
You are designing a new application that has backends internally exposed on port 800. The application will be exposed externally using both IPv4 and IPv6 via TCP on port 700. You want to ensure high availability for this application. What should you do?
A. Create a network load balancer that used backend services containing one instance group with two instances.
B. Create a network load balancer that uses a target pool backend with two instances.
C. Create a TCP proxy that uses a zonal network endpoint group containing one instance.
D. Create a TCP proxy that uses backend services containing an instance group with two instances.
Show Answer
Correct Answer: D
Explanation: The requirement includes exposing the service externally over both IPv4 and IPv6, providing high availability, and listening on external TCP port 700 while the backend application listens on port 800. A pass-through network load balancer preserves the destination port and cannot translate 700 to 800. An external TCP proxy load balancer can proxy connections and forward them to a different backend port via a backend service. Using an instance group with two instances satisfies the high-availability requirement. A single zonal NEG with one instance is not highly available.
Question 107
You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?
A. Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.
B. Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.
C. Enable VPC Flow Logs for the VPAnalyze the logs and get the source IP addresses from the src_location field.
D. Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.
Show Answer
Correct Answer: B
Explanation: VPC Flow Logs are the correct feature for analyzing network traffic to and from VM instances. Flow Logs are enabled at the subnet level, and each log record includes a connection field (IpConnection) containing the source and destination IP addresses, ports, and protocol. Data Access audit logs record API access, not packet flows, and src_location contains only geographic metadata rather than the actual source IP address.
Question 108
You are responsible for designing a new connectivity solution for your organization's enterprise network to access and use Google Workspace. You have an existing Shared VPC with Compute Engine instances in us-west1. Currently, you access Google Workspace via your service provider's internet access. You want to set up a direct connection between your network and Google. What should you do?
A. Order a Dedicated Interconnect connection in the same metropolitan area. Create a VLAN attachment, a Cloud Router in us-west1, and a Border Gateway Protocol (BGP) session between your Cloud Router and your router.
B. Order a Direct Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.
C. Configure HA VPN in us-west1. Configure a Border Gateway Protocol (BGP) session between your Cloud Router and your on-premises data center.
D. Order a Carrier Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.
Show Answer
Correct Answer: B
Explanation: Direct Peering is the appropriate option when the goal is a direct connection to Google's public services such as Google Workspace. Dedicated Interconnect is intended for private connectivity to Google Cloud VPC resources, not Google Workspace. HA VPN uses the public internet, and Carrier Peering is for connectivity through a supported service provider rather than a direct connection.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.