Professional Cloud Network Engineer Free Practice Questions — Page 12
Question 109
You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
A. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. 2. Configure your on-premises firewall to accept traffic from 10.204.0.0/24. 3. Set a custom route advertisement on the Cloud Router for 10.204.0.0/24
B. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168 20.88. 2. Configure your on-premises firewall to accept traffic from 35.199.192.0/19 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
C. 1. Create a private forwarding zone in Cloud DNS for ‘corp .altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. 2. Configure your on-premises firewall to accept traffic from 10.204.0.0/24. 3. Modify the /etc/resolv conf file on your Compute Engine instances to point to 192.168.20 88
D. 1. Create a private zone in Cloud DNS for ‘corp altostrat.com’ called corp-altostrat-com. 2. Configure DNS Server Policies and create a policy with Alternate DNS servers to 192.168.20.88. 3. Configure your on-premises firewall to accept traffic from 35.199.192.0/19. 4. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
Show Answer
Correct Answer: B
Explanation: Use a Cloud DNS private forwarding zone for the on‑premises domain so Google‑recommended managed DNS handles split‑horizon resolution. Forwarding queries originate from Cloud DNS, which uses the well‑known source range 35.199.192.0/19, so the on‑premises firewall must allow that range and it must be advertised over HA VPN via Cloud Router. This preserves Google Cloud hostname resolution while forwarding only corp.altostrat.com to the on‑prem DNS.
Question 110
Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access only from resources in your corporate public networks. What should you do?
A. Create an access context policy that allows your VPC and corporate public network IP ranges, and then attach the policy to Cloud Storage and BigQuery.
B. Create a VPC Service Controls perimeter for your project with an access context policy that allows your corporate public network IP ranges.
C. Create a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized networks.
D. Create a VPC Service Controls perimeter for each VPC with an access context policy that allows your corporate public network IP ranges.
Show Answer
Correct Answer: B
Explanation: VPC Service Controls are designed to restrict access to Google managed services like Cloud Storage and BigQuery based on service perimeters and access context (such as source IP ranges). Creating a single service perimeter at the project level applies consistently across all VPCs in the project and allows you to permit access only from your corporate public IP ranges. Firewall rules cannot control managed service APIs, and per‑VPC perimeters are unnecessary and less efficient.
Question 111
You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC):
You need to update the firewall rule to add the following rule to the ruleset:
You are using a new user account. You must assign the appropriate identity and Access Management (IAM) user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs. What should you do?
A. Assign the compute.securityAdmin and logging.viewer rule to the new user account. Apply the new firewall rule with a priority of 50.
B. Assign the compute.securityAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
C. Assign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account. Apply the new firewall rule with a priority of 50.
D. Assign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
Show Answer
Correct Answer: A
Explanation: To update VPC firewall rules, the user needs Compute Engine security administration permissions; the least-privilege role for this is compute.securityAdmin. To view firewall logs, the logging.viewer role is sufficient—log writing roles are not required. Org-level security policy roles (compute.orgSecurityPolicyAdmin) are unnecessary unless managing organization-wide policies. The new rule must have a higher priority (lower number) than existing broader rules to take effect, so priority 50 is appropriate. Therefore, option A is correct.
Question 112
You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on-premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
A. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC. 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Configure VPC peering in the spoke VPCs to peer with the hub VPC.
B. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. 2. Associate the zone with the hub VPC. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke PCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
C. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VP 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Create a hub-and-spoke VPN deployment in each spoke VPC to connect back to the on-premises network directly.
D. 1. Create a private forwarding zone in Cloud DNS for ‘corp altostrat.com’ called corp-altostrat-com that points to 192. 168.20.88. Associate the zone with the hub VPC. 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Sat a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Create a hub and spoke VPN deployment in each spoke VPC to connect back to the hub VPC.
Show Answer
Correct Answer: A
Explanation: Google-recommended hybrid DNS architecture uses a hub VPC with Cloud DNS forwarding to on‑premises and DNS peering to spoke VPCs. You create a private forwarding zone in the hub VPC pointing to the on‑prem DNS server, then private DNS peering zones in the spoke VPCs targeting the hub. DNS peering is designed to run alongside VPC Network Peering between hub and spokes. Advertising 35.199.192.0/19 from Cloud Router is required so on‑premises DNS can reach Google’s internal DNS resolvers. Other options either omit required VPC peering or introduce unnecessary VPN complexity.
Question 113
In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers in subnet-a. You will also deploy the application servers and web servers in subnet-b. You want to configure firewall rules that only allow database traffic from the application servers to the database servers. What should you do?
A. Create network tag app-server and service account [email protected] . Add the tag to the application servers, and associate the service account with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-rule \ --action allow \ --direction ingress \ --rules top:3306 \ --source-tags app-server \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
B. Create service accounts [email protected] and [email protected] . Associate service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-ru --allow TCP:3306 \ --source-service-accounts sa-app@democloud-idp- demo.iam.gserviceaccount.com \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
C. Create service accounts [email protected] and [email protected] . Associate the service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-ru --allow TCP:3306 \ --source-ranges 10.128.0.0/20 \ --source-service-accounts sa-app@my- project.iam.gserviceaccount.com \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
D. Create network tags app-server and db-server. Add the app-server tag to the application servers, and add the db-server tag to the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-rule \ --action allow \ --direction ingress \ --rules tcp:3306 \ --source-ranges 10.128.0.0/20 \ --source-tags app-server \ --target-tags db-server
Show Answer
Correct Answer: B
Explanation: To allow database traffic only from application servers to database servers, the firewall rule must precisely identify both the source and target. In Google Cloud VPC firewall rules, network tags and service accounts are mutually exclusive within a single rule. Options A and D incorrectly mix tags with service accounts or use the wrong source ranges. Options C and D also specify the wrong source subnet (they use subnet‑a instead of subnet‑b, where the application servers reside). Option B correctly uses only service accounts—assigning one to application servers and another to database servers—and creates an ingress rule allowing TCP:3306 from the app service account to the db service account, which is valid and meets the requirement.
Question 114
You are planning a large application deployment in Google Cloud that includes on-premises connectivity. The application requires direct connectivity between workloads in all regions and on-premises locations without address translation, but all RFC 1918 ranges are already in use in the on-premises locations. What should you do?
A. Use multiple VPC networks with a transit network using VPC Network Peering.
B. Use overlapping RFC 1918 ranges with multiple isolated VPC networks.
C. Use overlapping RFC 1918 ranges with multiple isolated VPC networks and Cloud NAT.
D. Use non-RFC 1918 ranges with a single global VPC.
Show Answer
Correct Answer: D
Explanation: The requirement is direct connectivity between all Google Cloud regions and on‑premises locations without address translation, while all RFC 1918 ranges are already used on‑premises. This rules out any solution that relies on overlapping private IP ranges or NAT. Google Cloud VPCs can use non‑RFC 1918 (public) IP address ranges internally, which avoids overlap with on‑premises networks and allows end‑to‑end routing without NAT. A single global VPC provides native global connectivity across regions and supports hybrid connectivity (VPN or Interconnect) without address translation. Therefore, using non‑RFC 1918 ranges with a single global VPC is the correct solution.
Question 115
Your company's security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web servers within your Virtual Private Cloud (VPC) to handle HTTP and HTTPS web traffic for TCP only. What should you do?
A. Create an allow on match ingress firewall rule with the target tag “web-server” to allow all IP addresses for TCP port 80.
B. Create an allow on match egress firewall rule with the target tag “web-server” to allow all IP addresses for TCP port 80.
C. Create an allow on match ingress firewall rule with the target tag “web-server” to allow all IP addresses for TCP ports 80 and 443.
D. Create an allow on match egress firewall rule with the target tag “web-server" to allow web server IP addresses for TCP ports 80 and 443.
Show Answer
Correct Answer: C
Explanation: To restrict inbound traffic to only HTTP and HTTPS over TCP, you must configure an ingress firewall rule. Web servers need to accept incoming connections on TCP ports 80 (HTTP) and 443 (HTTPS). Using an ingress rule with a target tag like "web-server" ensures only those instances are affected, and allowing ports 80 and 443 from all IP addresses enables standard public web access. Egress rules control outbound traffic and are not appropriate for this requirement.
Question 116
You are configuring a new application that will be exposed behind an external load balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest possible latency while ensuring high availability and autoscaling. Which configuration should you use?
A. Use global SSL Proxy Load Balancing with backends in both regions.
B. Use global TCP Proxy Load Balancing with backends in both regions.
C. Use global external HTTP(S) Load Balancing with backends in both regions.
D. Use Network Load Balancing in both regions, and use DNS-based load balancing to direct traffic to the closest region.
Show Answer
Correct Answer: D
Explanation: The requirement explicitly calls for TCP pass-through on port 443. Global TCP Proxy and SSL Proxy load balancers are proxy-based and terminate connections at Google Front Ends, so they are not pass-through. Global HTTP(S) is also proxy-based and not suitable. In Google Cloud, TCP pass-through is provided only by external passthrough Network Load Balancers, which are regional. To achieve lowest latency and high availability across us-west1 and us-east1, you must deploy regional Network Load Balancers in each region and use DNS-based routing to direct clients to the closest healthy region. This satisfies pass-through, IPv4/IPv6, autoscaling, and availability requirements.
Question 117
You just finished your company’s migration to Google Cloud and configured an architecture with 3 Virtual Private Cloud (VPC) networks: one for Sales, one for Finance, and one for Engineering. Every VPC contains over 100 Compute Engine instances, and now developers using instances in the Sales VPC and the Finance VPC require private connectivity between each other. You need to allow communication between Sales and Finance without compromising performance or security. What should you do?
A. Configure an HA VPN gateway between the Finance VPC and the Sales VPC.
B. Configure the instances that require communication between each other with an external IP address.
C. Create a VPC Network Peering connection between the Finance VPC and the Sales VP
D. Configure Cloud NAT and a Cloud Router in the Sales and Finance VPCs.
Show Answer
Correct Answer: C
Explanation: VPC Network Peering provides private, high‑performance, low‑latency connectivity between VPC networks using Google’s internal network. It allows instances in Sales and Finance to communicate without external IPs, without transitive routing, and without the overhead of VPN, meeting both security and performance requirements.
Question 118
You have several microservices running in a private subnet in an existing Virtual Private Cloud (VPC). You need to create additional serverless services that use Cloud Run and Cloud Functions to access the microservices. The network traffic volume between your serverless services and private microservices is low. However, each serverless service must be able to communicate with any of your microservices. You want to implement a solution that minimizes cost. What should you do?
A. Deploy your serverless services to the serverless VPC. Peer the serverless service VPC to the existing VPC. Configure firewall rules to allow traffic between the serverless services and your existing microservices.
B. Create a serverless VPC access connector for each serverless service. Configure the connectors to allow traffic between the serverless services and your existing microservices.
C. Deploy your serverless services to the existing VPConfigure firewall rules to allow traffic between the serverless services and your existing microservices.
D. Create a serverless VPC access connector. Configure the serverless service to use the connector for communication to the microservices.
Show Answer
Correct Answer: D
Explanation: Cloud Run and Cloud Functions cannot be deployed directly into an existing VPC, nor do they require separate connectors per service. To access private resources in a VPC, serverless workloads use Serverless VPC Access. A single Serverless VPC Access connector can be shared by multiple serverless services (Cloud Run and Cloud Functions) in the same region and project. Given the low traffic volume and the requirement that all serverless services reach all microservices, using one connector minimizes cost and complexity. Options A and C are invalid because serverless services do not live inside VPCs, and option B is more expensive because it unnecessarily creates multiple connectors.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.