Professional Cloud Network Engineer Free Practice Questions — Page 11
Question 99
You are designing a new application that has backends internally exposed on port 800. The application will be exposed externally using both IPv4 and IPv6 via TCP on port 700. You want to ensure high availability for this application. What should you do?
A. Create a network load balancer that used backend services containing one instance group with two instances.
B. Create a network load balancer that uses a target pool backend with two instances.
C. Create a TCP proxy that uses a zonal network endpoint group containing one instance.
D. Create a TCP proxy that uses backend services containing an instance group with two instances.
Show Answer
Correct Answer: D
Explanation: The requirements are: external exposure over TCP with both IPv4 and IPv6, high availability, and forwarding traffic from port 700 on the frontend to port 800 on the backends.
Network load balancers (A and B) are pass-through and cannot translate ports; the frontend and backend ports must be the same. Additionally, target pool–based network load balancers (B) do not support IPv6.
Option C does not meet the high-availability requirement because it uses only one instance.
An external TCP Proxy load balancer supports IPv4 and IPv6, provides port forwarding (700 → 800), and when backed by a backend service with an instance group of two instances, ensures high availability. Therefore, option D satisfies all requirements.
Question 100
You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?
A. Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.
B. Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.
C. Enable VPC Flow Logs for the VPAnalyze the logs and get the source IP addresses from the src_location field.
D. Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.
Show Answer
Correct Answer: B
Explanation: To analyze incoming traffic and identify source IP addresses for a suspected DoS attack on a VM, you should use VPC Flow Logs. Enabling Flow Logs on the subnet captures metadata about network flows to and from VM instances in that subnet. The logs include the connection field, which contains the source and destination IP addresses, ports, protocol, and connection details. Audit logs do not capture packet-level or flow-level traffic data, and fields like src_location provide only geographic metadata, not the actual source IPs.
Question 101
You are responsible for designing a new connectivity solution for your organization's enterprise network to access and use Google Workspace. You have an existing Shared VPC with Compute Engine instances in us-west1. Currently, you access Google Workspace via your service provider's internet access. You want to set up a direct connection between your network and Google. What should you do?
A. Order a Dedicated Interconnect connection in the same metropolitan area. Create a VLAN attachment, a Cloud Router in us-west1, and a Border Gateway Protocol (BGP) session between your Cloud Router and your router.
B. Order a Direct Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.
C. Configure HA VPN in us-west1. Configure a Border Gateway Protocol (BGP) session between your Cloud Router and your on-premises data center.
D. Order a Carrier Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.
Show Answer
Correct Answer: B
Explanation: The goal is a direct connection from the enterprise network to Google Workspace (a Google SaaS), not private access to VPC resources. Direct Peering is designed for accessing Google public services such as Google Workspace over a private, high‑capacity link using BGP. Dedicated Interconnect, HA VPN, and Carrier Peering are for private access to Google Cloud VPCs or partner-mediated connectivity, which is not required here.
Question 102
You are configuring a new HTTP application that will be exposed externally behind both IPv4 and IPv6 virtual IP addresses, using ports 80, 8080, and 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest-possible latency while ensuring high availability and autoscaling, and create native content-based rules using the HTTP hostname and request path. The IP addresses of the clients that connect to the load balancer need to be visible to the backends. Which configuration should you use?
A. Use Network Load Balancing
B. Use TCP Proxy Load Balancing with PROXY protocol enabled
C. Use External HTTP(S) Load Balancing with URL Maps and custom headers
D. Use External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header
Show Answer
Correct Answer: D
Explanation: External HTTP(S) Load Balancing is required to provide global anycast IPv4/IPv6 VIPs, lowest-latency routing across regions, autoscaling, and high availability. URL Maps enable native content-based routing using hostnames and paths. Client source IP visibility to backends is achieved via the standard X-Forwarded-For header added by the HTTP(S) load balancer. Network or TCP proxy load balancers do not support HTTP-level routing features needed here.
Question 103
Your organization has a Google Cloud Virtual Private Cloud (VPC) with subnets in us-east1, us-west4, and europe-west4 that use the default VPC configuration. Employees in a branch office in Europe need to access the resources in the VPC using HA VPN. You configured the HA VPN associated with the Google Cloud VPC for your organization with a Cloud Router deployed in europe-west4. You need to ensure that the users in the branch office can quickly and easily access all resources in the VPC. What should you do?
A. Create custom advertised routes for each subnet.
B. Configure each subnet’s VPN connections to use Cloud VPN to connect to the branch office.
C. Configure the VPC dynamic routing mode to Global.
D. Set the advertised routes to Global for the Cloud Router.
Show Answer
Correct Answer: C
Explanation: By default, a VPC uses regional dynamic routing, which means routes learned via Cloud Router (used by HA VPN) are only advertised within the same region. Since the VPC subnets span multiple regions (us-east1, us-west4, and europe-west4), users connecting via HA VPN in europe-west4 would not automatically learn routes to subnets in other regions. Setting the VPC dynamic routing mode to Global allows Cloud Router to advertise and learn routes across all regions, enabling seamless access to all VPC resources.
Question 104
You configured Cloud VPN with dynamic routing via Border Gateway Protocol (BGP). You added a custom route to advertise a network that is reachable over the VPN tunnel. However, the on-premises clients still cannot reach the network over the VPN tunnel. You need to examine the logs in Cloud Logging to confirm that the appropriate routers are being advertised over the VPN tunnel. Which filter should you use in Cloud Logging to examine the logs?
A. resource.type= “gce_router”
B. resource.type= “gce_network_region”
C. resource.type= “vpn_tunnel”
D. resource.type= “vpn_gateway”
Show Answer
Correct Answer: A
Explanation: With Cloud VPN using dynamic routing (BGP), route advertisement and BGP session details are handled by Cloud Router. Logs that show which routes are being advertised or learned over the VPN tunnel are emitted by the Cloud Router resource. Therefore, filtering Cloud Logging with resource.type="gce_router" allows you to examine BGP route advertisements and confirm the correct networks are being advertised.
Question 105
You are designing a hub-and-spoke network architecture for your company’s cloud-based environment. You need to make sure that all spokes are peered with the hub. The spokes must use the hub's virtual appliance for internet access. The virtual appliance is configured in high-availability mode with two instances using an internal load balancer with IP address 10.0.0.5. What should you do?
A. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. 4. Import the custom routes in the spokes.
B. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes. 4. Delete the default internet gateway route of the spokes.
C. 1. Create two default routes in the hub VPC that point to the next hop instances of the virtual appliances. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Export the custom routes in the hub. Import the custom routes in the spokes.
D. 1. Create a default route in the hub VPC that points to IP address 10.0.0.5. 2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway. 3. Create a new route in the spoke VPC that points to IP address 10.0.0.5.
Show Answer
Correct Answer: B
Explanation: This is a Google Cloud hub-and-spoke design using VPC Network Peering and an internal load balancer as the next hop for a highly available virtual appliance. To force all spoke internet-bound traffic through the hub appliance: (1) the hub must have a default route pointing to the ILB IP (10.0.0.5); (2) the hub’s appliances themselves must still reach the internet, so the default internet gateway route is replaced with a higher-priority, tag-based route for the appliances; (3) the hub’s custom routes must be exported and imported into the spokes via VPC peering; and critically (4) the spokes’ own default internet gateway routes must be deleted so they cannot bypass the hub. Option B includes all required steps, while A leaves the spoke default route in place, allowing direct internet access.
Question 106
You recently deployed two network virtual appliances in us-central1. Your network appliances provide connectivity to your on-premises network, 10.0.0.0/8. You need to configure the routing for your Virtual Private Cloud (VPC). Your design must meet the following requirements:
• All access to your on-premises network must go through the network virtual appliances.
• Allow on-premises access in the event of a single network virtual appliance failure.
• Both network virtual appliances must be used simultaneously.
Which method should you use to accomplish this?
A. Configure two routes for 10.0.0.0/8 with different priorities, each pointing to separate network virtual appliances.
B. Configure an internal HTTP(S) load balancer with the two network virtual appliances as backends. Configure a route for 10.0.0.0/8 with the internal HTTP(S) load balancer as the next hop.
C. Configure a network load balancer for the two network virtual appliances. Configure a route for 10.0.0.0/8 with the network load balancer as the next hop.
D. Configure an internal TCP/UDP load balancer with the two network virtual appliances as backends. Configure a route for 10.0.0.0/8 with the internal load balancer as the next hop.
Show Answer
Correct Answer: D
Explanation: To force all VPC traffic for 10.0.0.0/8 through the appliances while using both simultaneously and surviving a single appliance failure, you must use a load balancer that can be a route next hop and distribute traffic across healthy backends. In Google Cloud, this is done with an internal passthrough Network Load Balancer, which is the internal TCP/UDP load balancer. You configure a route for 10.0.0.0/8 with the internal TCP/UDP load balancer as the next hop. Option C is ambiguous because "network load balancer" can be external or internal; only the internal TCP/UDP (passthrough) load balancer is valid and supported for this design.
Question 107
You have an HA VPN connection with two tunnels running in active/passive mode between your Virtual Private Cloud (VPC) and on-premises network. Traffic over the connection has recently increased from 1 gigabit per second (Gbps) to 4 Gbps, and you notice that packets are being dropped. You need to configure your VPN connection to Google Cloud to support 4 Gbps. What should you do?
A. Configure the remote autonomous system number (ASN) to 4096.
B. Configure a second Cloud Router to scale bandwidth in and out of the VPC.
C. Configure the maximum transmission unit (MTU) to its highest supported value.
D. Configure a second set of active/passive VPN tunnels.
Show Answer
Correct Answer: D
Explanation: An HA VPN tunnel supports up to ~3 Gbps (combined ingress and egress). With traffic increasing to 4 Gbps, a single active tunnel becomes a bottleneck and drops packets. To scale bandwidth, you must add additional VPN tunnels so traffic can be distributed across them. Configuring a second set of active/passive VPN tunnels increases total available throughput to meet the 4 Gbps requirement.
Question 108
You built a web application with several containerized microservices. You want to run those microservices on Cloud Run. You must also ensure that the services are highly available to your customers with low latency. What should you do?
A. Deploy the Cloud Run services to multiple availability zones. Create a global TCP load balancer. Add the Cloud Run endpoints to its backend service.
B. Deploy the Cloud Run services to multiple regions. Create serverless network endpoint groups (NEGs) that point to the services. Create a global HTTPS load balancer, and attach the serverless NEGs as backend services of the load balancer.
C. Deploy the Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTPS load balancer, and attach the Cloud Endpoints to its backend
D. Deploy the Cloud Run services to multiple regions. Configure a round-robin A record in Cloud DNS.
Show Answer
Correct Answer: B
Explanation: Cloud Run services are regional. To achieve high availability and low latency globally, you deploy the services in multiple regions and front them with a global HTTP(S) load balancer. Serverless network endpoint groups (NEGs) are the supported way to attach Cloud Run services to the load balancer, enabling global routing, health checks, and automatic failover.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.