Professional Cloud Network Engineer Free Practice Questions — Page 12
Question 113
You recently deployed two network virtual appliances in us-central1. Your network appliances provide connectivity to your on-premises network, 10.0.0.0/8. You need to configure the routing for your Virtual Private Cloud (VPC). Your design must meet the following requirements:
• All access to your on-premises network must go through the network virtual appliances.
• Allow on-premises access in the event of a single network virtual appliance failure.
• Both network virtual appliances must be used simultaneously.
Which method should you use to accomplish this?
A. Configure two routes for 10.0.0.0/8 with different priorities, each pointing to separate network virtual appliances.
B. Configure an internal HTTP(S) load balancer with the two network virtual appliances as backends. Configure a route for 10.0.0.0/8 with the internal HTTP(S) load balancer as the next hop.
C. Configure a network load balancer for the two network virtual appliances. Configure a route for 10.0.0.0/8 with the network load balancer as the next hop.
D. Configure an internal TCP/UDP load balancer with the two network virtual appliances as backends. Configure a route for 10.0.0.0/8 with the internal load balancer as the next hop.
Show Answer
Correct Answer: C
Explanation: To satisfy active/active use of both network virtual appliances with automatic failover, configure an internal passthrough Network Load Balancer as the next hop for the route to 10.0.0.0/8. Option C refers to a network load balancer; in Google Cloud architecture guidance this is the internal passthrough Network Load Balancer used as a next hop. Option A is active/passive only, B is an L7 HTTP(S) load balancer and cannot be used as a route next hop, and D describes the same product using older terminology, but the current documented guidance names it an internal passthrough Network Load Balancer.
Sources:
https://cloud.google.com/architecture/landing-zones/implement-network-design
Question 114
You have an HA VPN connection with two tunnels running in active/passive mode between your Virtual Private Cloud (VPC) and on-premises network. Traffic over the connection has recently increased from 1 gigabit per second (Gbps) to 4 Gbps, and you notice that packets are being dropped. You need to configure your VPN connection to Google Cloud to support 4 Gbps. What should you do?
A. Configure the remote autonomous system number (ASN) to 4096.
B. Configure a second Cloud Router to scale bandwidth in and out of the VPC.
C. Configure the maximum transmission unit (MTU) to its highest supported value.
D. Configure a second set of active/passive VPN tunnels.
Show Answer
Correct Answer: D
Explanation: Each HA VPN tunnel supports up to about 3 Gbps aggregate throughput. An active/passive pair uses only one tunnel at a time, so increasing traffic to 4 Gbps can exceed the active tunnel's capacity and cause drops. Adding a second active/passive HA VPN connection (another set of tunnels) increases available capacity. Changing ASN, adding another Cloud Router, or increasing MTU does not increase VPN tunnel throughput.
Question 115
You built a web application with several containerized microservices. You want to run those microservices on Cloud Run. You must also ensure that the services are highly available to your customers with low latency. What should you do?
A. Deploy the Cloud Run services to multiple availability zones. Create a global TCP load balancer. Add the Cloud Run endpoints to its backend service.
B. Deploy the Cloud Run services to multiple regions. Create serverless network endpoint groups (NEGs) that point to the services. Create a global HTTPS load balancer, and attach the serverless NEGs as backend services of the load balancer.
C. Deploy the Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTPS load balancer, and attach the Cloud Endpoints to its backend
D. Deploy the Cloud Run services to multiple regions. Configure a round-robin A record in Cloud DNS.
Show Answer
Correct Answer: B
Explanation: Cloud Run is a regional service. For high availability and low latency, deploy services in multiple regions and use a global external HTTPS Load Balancer with serverless Network Endpoint Groups (NEGs) as backends. This provides global traffic routing to the nearest healthy regional Cloud Run service. Cloud Run is not deployed across availability zones directly, TCP load balancing is not the appropriate integration for Cloud Run, Cloud Endpoints is an API management solution rather than a global traffic-routing mechanism, and DNS round-robin does not provide health-aware global load balancing.
Question 116
You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
A. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. 2. Configure your on-premises firewall to accept traffic from 10.204.0.0/24. 3. Set a custom route advertisement on the Cloud Router for 10.204.0.0/24
B. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168 20.88. 2. Configure your on-premises firewall to accept traffic from 35.199.192.0/19 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
C. 1. Create a private forwarding zone in Cloud DNS for ‘corp .altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. 2. Configure your on-premises firewall to accept traffic from 10.204.0.0/24. 3. Modify the /etc/resolv conf file on your Compute Engine instances to point to 192.168.20 88
D. 1. Create a private zone in Cloud DNS for ‘corp altostrat.com’ called corp-altostrat-com. 2. Configure DNS Server Policies and create a policy with Alternate DNS servers to 192.168.20.88. 3. Configure your on-premises firewall to accept traffic from 35.199.192.0/19. 4. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
Show Answer
Correct Answer: B
Explanation: Use a Cloud DNS private forwarding zone for the on-premises domain so only queries for corp.altostrat.com are forwarded while other DNS queries (including Google Cloud hostnames) continue to resolve normally. Cloud DNS forwarding queries originate from the reserved source range 35.199.192.0/19, so the on-premises firewall must allow that range, and because Cloud Router uses default advertisements, you must add a custom advertisement for 35.199.192.0/19 so the on-premises network has a route back to the forwarding resolvers.
Question 117
Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access only from resources in your corporate public networks. What should you do?
A. Create an access context policy that allows your VPC and corporate public network IP ranges, and then attach the policy to Cloud Storage and BigQuery.
B. Create a VPC Service Controls perimeter for your project with an access context policy that allows your corporate public network IP ranges.
C. Create a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized networks.
D. Create a VPC Service Controls perimeter for each VPC with an access context policy that allows your corporate public network IP ranges.
Show Answer
Correct Answer: B
Explanation: VPC Service Controls is the Google Cloud feature designed to restrict access to supported Google APIs (including Cloud Storage and BigQuery) based on service perimeters and Access Context Manager access levels such as allowed source IP ranges. Service perimeters are applied at the project level, not per VPC, so a single perimeter around the project with an access context policy allowing the corporate public IP ranges satisfies the requirement across all VPCs. Firewall rules cannot restrict access to Google-managed APIs, and Access Context Manager policies alone are ineffective unless used with VPC Service Controls or other supported features.
Question 118
You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC):
You need to update the firewall rule to add the following rule to the ruleset:
You are using a new user account. You must assign the appropriate identity and Access Management (IAM) user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs. What should you do?
A. Assign the compute.securityAdmin and logging.viewer rule to the new user account. Apply the new firewall rule with a priority of 50.
B. Assign the compute.securityAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
C. Assign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account. Apply the new firewall rule with a priority of 50.
D. Assign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
Show Answer
Correct Answer: A
Explanation: To update VPC firewall rules, the least-privilege IAM role is compute.securityAdmin, which grants firewall management permissions. To view firewall logs, the appropriate role is logging.viewer; logging.bucketWriter is for writing logs, not viewing them. The new firewall rule should have a higher precedence (lower numeric priority), so priority 50 ensures it is evaluated before a broader rule at a lower precedence such as 150 or higher-numbered rules.
Question 119
You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on-premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
A. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC. 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Configure VPC peering in the spoke VPCs to peer with the hub VPC.
B. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. 2. Associate the zone with the hub VPC. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke PCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
C. 1. Create a private forwarding zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VP 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Create a hub-and-spoke VPN deployment in each spoke VPC to connect back to the on-premises network directly.
D. 1. Create a private forwarding zone in Cloud DNS for ‘corp altostrat.com’ called corp-altostrat-com that points to 192. 168.20.88. Associate the zone with the hub VPC. 2. Create a private peering zone in Cloud DNS for ‘corp.altostrat.com’ called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target. 3. Sat a custom route advertisement on the Cloud Router for 35.199.192.0/19. 4. Create a hub and spoke VPN deployment in each spoke VPC to connect back to the hub VPC.
Show Answer
Correct Answer: A
Explanation: A matches Google's recommended hybrid DNS architecture: create a Cloud DNS private forwarding zone in the hub VPC that forwards corp.altostrat.com to the on-prem DNS server, expose it to spoke VPCs through a private peering zone, advertise 35.199.192.0/19 so on-prem DNS can reach the Cloud DNS forwarding proxies, and use VPC peering between hub and spokes as described in the hub-and-spoke DNS best-practice architecture.
Sources:
https://cloud.google.com/hybrid-connectivity
Question 120
In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers in subnet-a. You will also deploy the application servers and web servers in subnet-b. You want to configure firewall rules that only allow database traffic from the application servers to the database servers. What should you do?
A. Create network tag app-server and service account [email protected] . Add the tag to the application servers, and associate the service account with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-rule \ --action allow \ --direction ingress \ --rules top:3306 \ --source-tags app-server \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
B. Create service accounts [email protected] and [email protected] . Associate service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-ru --allow TCP:3306 \ --source-service-accounts sa-app@democloud-idp- demo.iam.gserviceaccount.com \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
C. Create service accounts [email protected] and [email protected] . Associate the service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-ru --allow TCP:3306 \ --source-ranges 10.128.0.0/20 \ --source-service-accounts sa-app@my- project.iam.gserviceaccount.com \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com
D. Create network tags app-server and db-server. Add the app-server tag to the application servers, and add the db-server tag to the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-rule \ --action allow \ --direction ingress \ --rules tcp:3306 \ --source-ranges 10.128.0.0/20 \ --source-tags app-server \ --target-tags db-server
Show Answer
Correct Answer: B
Explanation: Service-account-based firewall rules are the correct mechanism to restrict traffic from application instances to database instances. Options C and D use the wrong source subnet (the application servers are in 172.16.0.0/24, not 10.128.0.0/20). Option A incorrectly mixes network tags with service accounts in the same firewall rule, which is not allowed. Although option B contains minor typographical inconsistencies in the example (project/email formatting), its intended configuration is the only valid design.
Question 121
You are planning a large application deployment in Google Cloud that includes on-premises connectivity. The application requires direct connectivity between workloads in all regions and on-premises locations without address translation, but all RFC 1918 ranges are already in use in the on-premises locations. What should you do?
A. Use multiple VPC networks with a transit network using VPC Network Peering.
B. Use overlapping RFC 1918 ranges with multiple isolated VPC networks.
C. Use overlapping RFC 1918 ranges with multiple isolated VPC networks and Cloud NAT.
D. Use non-RFC 1918 ranges with a single global VPC.
Show Answer
Correct Answer: D
Explanation: A single global VPC using non-RFC 1918 address space avoids overlap with on-premises RFC 1918 networks while preserving direct, end-to-end connectivity without address translation. VPC Network Peering is not a transit solution, overlapping RFC 1918 ranges prevent direct hybrid routing, and Cloud NAT is for internet egress rather than resolving overlapping private address spaces for hybrid connectivity.
Question 122
Your company's security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web servers within your Virtual Private Cloud (VPC) to handle HTTP and HTTPS web traffic for TCP only. What should you do?
A. Create an allow on match ingress firewall rule with the target tag “web-server” to allow all IP addresses for TCP port 80.
B. Create an allow on match egress firewall rule with the target tag “web-server” to allow all IP addresses for TCP port 80.
C. Create an allow on match ingress firewall rule with the target tag “web-server” to allow all IP addresses for TCP ports 80 and 443.
D. Create an allow on match egress firewall rule with the target tag “web-server" to allow web server IP addresses for TCP ports 80 and 443.
Show Answer
Correct Answer: C
Explanation: To allow inbound web traffic to web servers, you need an ingress firewall rule. HTTP uses TCP port 80 and HTTPS uses TCP port 443. Applying the rule to instances with the target tag "web-server" and allowing traffic from all IP addresses on TCP ports 80 and 443 satisfies the requirement. Egress rules control outbound traffic and are not appropriate for permitting inbound client access.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.