Professional Cloud Network Engineer Free Practice Questions — Page 13
Question 123
You are configuring a new application that will be exposed behind an external load balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest possible latency while ensuring high availability and autoscaling. Which configuration should you use?
A. Use global SSL Proxy Load Balancing with backends in both regions.
B. Use global TCP Proxy Load Balancing with backends in both regions.
C. Use global external HTTP(S) Load Balancing with backends in both regions.
D. Use Network Load Balancing in both regions, and use DNS-based load balancing to direct traffic to the closest region.
Show Answer
Correct Answer: D
Explanation: The key requirement is TCP pass-through. Global SSL Proxy, TCP Proxy, and HTTP(S) load balancers are proxy-based and terminate client connections rather than providing pass-through. A passthrough Network Load Balancer is regional, so to serve two regions you would deploy one in each region and use DNS-based routing to direct clients to the nearest healthy region. This preserves end-to-end TCP connections while providing regional redundancy.
Question 124
You just finished your company’s migration to Google Cloud and configured an architecture with 3 Virtual Private Cloud (VPC) networks: one for Sales, one for Finance, and one for Engineering. Every VPC contains over 100 Compute Engine instances, and now developers using instances in the Sales VPC and the Finance VPC require private connectivity between each other. You need to allow communication between Sales and Finance without compromising performance or security. What should you do?
A. Configure an HA VPN gateway between the Finance VPC and the Sales VPC.
B. Configure the instances that require communication between each other with an external IP address.
C. Create a VPC Network Peering connection between the Finance VPC and the Sales VP
D. Configure Cloud NAT and a Cloud Router in the Sales and Finance VPCs.
Show Answer
Correct Answer: C
Explanation: VPC Network Peering provides private, low-latency connectivity between VPC networks over Google's backbone without requiring external IP addresses. It is the recommended solution for enabling communication between resources in separate VPCs while maintaining performance and security. HA VPN is intended for encrypted connectivity (often hybrid or between networks when peering is unsuitable) but adds unnecessary overhead here. Cloud NAT provides outbound internet access, not private VPC-to-VPC communication, and external IPs would reduce security.
Question 125
You have several microservices running in a private subnet in an existing Virtual Private Cloud (VPC). You need to create additional serverless services that use Cloud Run and Cloud Functions to access the microservices. The network traffic volume between your serverless services and private microservices is low. However, each serverless service must be able to communicate with any of your microservices. You want to implement a solution that minimizes cost. What should you do?
A. Deploy your serverless services to the serverless VPC. Peer the serverless service VPC to the existing VPC. Configure firewall rules to allow traffic between the serverless services and your existing microservices.
B. Create a serverless VPC access connector for each serverless service. Configure the connectors to allow traffic between the serverless services and your existing microservices.
C. Deploy your serverless services to the existing VPConfigure firewall rules to allow traffic between the serverless services and your existing microservices.
D. Create a serverless VPC access connector. Configure the serverless service to use the connector for communication to the microservices.
Show Answer
Correct Answer: D
Explanation: A single Serverless VPC Access connector can be attached to the existing VPC and shared by multiple Cloud Run and Cloud Functions services in the same region. This enables private connectivity from serverless services to microservices in the VPC while minimizing cost. Creating a connector per service is unnecessary and more expensive. The other options either rely on nonexistent deployment models or incorrect networking approaches.
Question 126
You are configuring an HA VPN connection between your Virtual Private Cloud (VPC) and on-premises network. The VPN gateway is named VPN_GATEWAY_1. You need to restrict VPN tunnels created in the project to only connect to your on-premises VPN public IP address: 203.0.113.1/32. What should you do?
A. Configure a firewall rule accepting 203.0.113.1/32, and set a target tag equal to VPN_GATEWAY_1.
B. Configure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs to use an allowList consisting of only the 203.0.113.1/32 address.
C. Configure a Google Cloud Armor security policy, and create a policy rule to allow 203.0.113.1/32.
D. Configure an access control list on the peer VPN gateway to deny all traffic except 203.0.113.1/32, and attach it to the primary external interface.
Show Answer
Correct Answer: B
Explanation: Use the Organization Policy constraint `constraints/compute.restrictVpnPeerIPs` with an allow list containing only `203.0.113.1/32`. This constraint restricts which peer public IP addresses can be configured for Cloud VPN tunnels. Firewall rules do not control VPN peer configuration, Cloud Armor does not protect Cloud VPN gateways, and an ACL on the peer device does not enforce Google Cloud project-wide tunnel creation restrictions.
Question 127
Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments. What should you do?
A. Create a VPC firewall rule in each VPC to block traffic from any source, with priority 0.
B. Create a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.
C. Create two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.
D. Create two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.
Show Answer
Correct Answer: D
Explanation: Hierarchical firewall policies are the correct control point because enforcement must occur at the folder level while allowing departments to manage only intra-VPC rules. Using a high-priority rule with the action `goto_next` for traffic originating from the department's own VPC CIDR delegates evaluation to lower-level VPC firewall rules, allowing the department to define its internal firewall behavior. A subsequent lower-priority deny rule blocks all other sources, including other VPCs. Using `allow` in the hierarchical policy would bypass lower-level VPC firewall rules rather than delegate control.
Question 128
You have the following private Google Kubernetes Engine (GKE) cluster deployment:
You have a virtual machine (VM) deployed in the same VPC in the subnetwork kubernetes-management with internal IP address 192.168.40 2/24 and no external IP address assigned. You need to communicate with the cluster master using kubectl. What should you do?
A. Add the network 192.168.40.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2.
B. Add the network 192.168.38.0/28 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
C. Add the network 192.168.36.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
D. Add an external IP address to the VM, and add this IP address in the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 35.224.37.17.
Show Answer
Correct Answer: A
Explanation: For a private GKE cluster, a VM in the same VPC without an external IP should access the control plane via its private endpoint. Master Authorized Networks must include the source network of the client VM (192.168.40.0/24), and kubectl should target the private control plane endpoint (192.168.38.2).
Question 129
You have configured a service on Google Cloud that connects to an on-premises service via a Dedicated Interconnect. Users are reporting recent connectivity issues. You need to determine whether the traffic is being dropped because of firewall rules or a routing decision. What should you do?
A. Use the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.
B. Use Network Intelligence Center Network Topology to check the traffic flow, and replay the traffic from the time period when the connectivity issue occurred.
C. Configure VPC Flow Logs. Review the logs by filtering on the source and destination.
D. Configure a Compute Engine instance on the same VPC as the service running on Google Cloud to run a traceroute targeted at the on-premises service.
Show Answer
Correct Answer: A
Explanation: Network Intelligence Center Connectivity Tests is designed to analyze end-to-end connectivity between Google Cloud and on-premises networks, including hybrid connectivity over Dedicated Interconnect. It identifies whether connectivity is blocked by firewall rules, routing, or other configuration issues. Network Topology visualizes the network but does not replay historical traffic. VPC Flow Logs help inspect observed traffic but are not the primary tool to distinguish routing versus firewall decisions end-to-end. Traceroute provides limited diagnostic value across hybrid networks and cannot reliably identify Google Cloud firewall or routing decisions.
Question 130
Your company has recently installed a Cloud VPN tunnel between your on-premises data center and your Google Cloud Virtual Private Cloud (VPC). You need to configure access to the Cloud Functions API for your on-premises servers. The configuration must meet the following requirements:
• Certain data must stay in the project where it is stored and not be exfiltrated to other projects.
• Traffic from servers in your data center with RFC 1918 addresses do not use the internet to access Google Cloud APIs.
• All DNS resolution must be done on-premises.
• The solution should only provide access to APIs that are compatible with VPC Service Controls.
What should you do?
A. 1. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
B. 1. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Configure your on-premises firewalls to allow traffic to the restricted.googleapis.com addresses.
C. 1. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
D. 1. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Configure your on-premises firewalls to allow traffic to the private.googleapis.com addresses.
Show Answer
Correct Answer: B
Explanation: The requirements match configuring private connectivity to Google APIs using restricted.googleapis.com, which only exposes APIs supported by VPC Service Controls. Because DNS resolution must remain on-premises, create on-prem DNS records mapping *.googleapis.com to restricted.googleapis.com (199.36.153.4/30), route that address range over the Cloud VPN, and allow the traffic through the on-premises firewall. Removing the default internet gateway from the VPC is unnecessary and would not satisfy the stated requirements.
Question 131
Your organization is implementing a new security policy to control how firewall rules are applied to control flows between virtual machines (VMs). Using Google-recommended practices, you need to set up a firewall rule to enforce strict control of traffic between VM A and VM B. You must ensure that communications flow only from VM A to VM B within the VPC, and no other communication paths are allowed. No other firewall rules exist in the VPC. Which firewall rule should you configure to allow only this communication path?
A. Firewall rule direction: ingress Action: allow - Target: VM B service account - Source ranges: VM A service account Priority: 1000
B. Firewall rule direction: ingress Action: allow - Target: specific VM B tag - Source ranges: VM A tag and VM A source IP address Priority: 1000
C. Firewall rule direction: ingress Action: allow - Target: VM A service account - Source ranges: VM B service account and VM B source IP address Priority: 100
D. Firewall rule direction: ingress Action: allow - Target: specific VM A tag - Source ranges: VM B tag and VM B source IP address Priority: 100
Show Answer
Correct Answer: A
Explanation: Google recommends using target and source service accounts rather than network tags when you need strict control over firewall rule application. An ingress allow rule targeting VM B's service account with VM A's service account as the source permits only traffic from VM A to VM B (assuming distinct service accounts). Options B, C, and D either rely on tags, incorrectly specify the target, or misuse source filters.
Question 132
Your organization has Compute Engine instances in us-east1, us-west2, and us-central1. Your organization also has an existing Cloud Interconnect physical connection in the East Coast of the United States with a single VLAN attachment and Cloud Router in us-east1. You need to provide a design with high availability and ensure that if a region goes down, you still have access to all your other Virtual Private Cloud (VPC) subnets. You need to accomplish this in the most cost-effective manner possible. What should you do?
A. 1. Configure your VPC routing in regional mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-east1 region, and configure a Cloud Router in us-east1.
B. 1. Configure your VPC routing in global mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-east1 region, and configure a Cloud Router in us-east1.
C. 1. Configure your VPC routing in global mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-west2 region, and configure a Cloud Router in us-west2.
D. 1. Configure your VPC routing in regional mode. 2. Add additional Cloud Interconnect VLAN attachments in the us-west2 and us-central1 regions, and configure Cloud Routers in us-west2 and us-central1.
Show Answer
Correct Answer: C
Explanation: Use global dynamic routing so learned routes are available across all VPC regions. For regional failure resilience, add a second VLAN attachment and Cloud Router in a different region (us-west2). This provides connectivity if us-east1 is unavailable while avoiding the higher cost of deploying attachments in every region. Adding both attachments in us-east1 would not protect against a regional outage.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.