Professional Cloud Network Engineer Free Practice Questions — Page 13
Question 119
You are configuring an HA VPN connection between your Virtual Private Cloud (VPC) and on-premises network. The VPN gateway is named VPN_GATEWAY_1. You need to restrict VPN tunnels created in the project to only connect to your on-premises VPN public IP address: 203.0.113.1/32. What should you do?
A. Configure a firewall rule accepting 203.0.113.1/32, and set a target tag equal to VPN_GATEWAY_1.
B. Configure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs to use an allowList consisting of only the 203.0.113.1/32 address.
C. Configure a Google Cloud Armor security policy, and create a policy rule to allow 203.0.113.1/32.
D. Configure an access control list on the peer VPN gateway to deny all traffic except 203.0.113.1/32, and attach it to the primary external interface.
Show Answer
Correct Answer: B
Explanation: To restrict which public IP addresses can be used as VPN peers when creating Cloud VPN (including HA VPN) tunnels, you must use an Organization Policy. The constraint constraints/compute.restrictVpnPeerIPs allows you to define an allow list of permitted peer IPv4 addresses. Setting this constraint to allow only 203.0.113.1/32 ensures that VPN tunnels in the project can connect only to that on‑premises VPN public IP. Firewall rules, Cloud Armor, or peer-side ACLs do not control which peer IPs can be configured for Cloud VPN tunnels.
Question 120
Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments. What should you do?
A. Create a VPC firewall rule in each VPC to block traffic from any source, with priority 0.
B. Create a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.
C. Create two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.
D. Create two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.
Show Answer
Correct Answer: D
Explanation: Hierarchical firewall policies are required to enforce isolation across folders and VPCs. To both block all inter-VPC traffic and delegate intra-VPC control to departments, you must use the goto_next action. A high-priority rule with goto_next for the VPC’s own CIDRs delegates evaluation to lower-level (VPC) firewall rules managed by the department, while a lower-priority deny-all rule blocks any other traffic. Using allow instead (option C) would bypass VPC-level rules and would not delegate control.
Question 121
You have the following private Google Kubernetes Engine (GKE) cluster deployment:
You have a virtual machine (VM) deployed in the same VPC in the subnetwork kubernetes-management with internal IP address 192.168.40 2/24 and no external IP address assigned. You need to communicate with the cluster master using kubectl. What should you do?
A. Add the network 192.168.40.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2.
B. Add the network 192.168.38.0/28 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
C. Add the network 192.168.36.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
D. Add an external IP address to the VM, and add this IP address in the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 35.224.37.17.
Show Answer
Correct Answer: A
Explanation: In a private GKE cluster, the Kubernetes master has a private endpoint that is reachable only from authorized source IP ranges. The VM has no external IP and resides in the subnet 192.168.40.0/24, so this subnet must be added to masterAuthorizedNetworksConfig. kubectl must then target the master’s private endpoint (192.168.38.2). Using other CIDR ranges or an external IP is unnecessary and incorrect for private cluster access.
Question 122
You have configured a service on Google Cloud that connects to an on-premises service via a Dedicated Interconnect. Users are reporting recent connectivity issues. You need to determine whether the traffic is being dropped because of firewall rules or a routing decision. What should you do?
A. Use the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.
B. Use Network Intelligence Center Network Topology to check the traffic flow, and replay the traffic from the time period when the connectivity issue occurred.
C. Configure VPC Flow Logs. Review the logs by filtering on the source and destination.
D. Configure a Compute Engine instance on the same VPC as the service running on Google Cloud to run a traceroute targeted at the on-premises service.
Show Answer
Correct Answer: A
Explanation: Network Intelligence Center Connectivity Tests are designed to diagnose end-to-end connectivity issues across GCP and hybrid connections like Dedicated Interconnect. They simulate traffic and explicitly report whether traffic is dropped due to firewall rules, routing, or other network configuration problems, which directly addresses the need to distinguish firewall drops from routing decisions.
Question 123
Your company has recently installed a Cloud VPN tunnel between your on-premises data center and your Google Cloud Virtual Private Cloud (VPC). You need to configure access to the Cloud Functions API for your on-premises servers. The configuration must meet the following requirements:
• Certain data must stay in the project where it is stored and not be exfiltrated to other projects.
• Traffic from servers in your data center with RFC 1918 addresses do not use the internet to access Google Cloud APIs.
• All DNS resolution must be done on-premises.
• The solution should only provide access to APIs that are compatible with VPC Service Controls.
What should you do?
A. 1. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
B. 1. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Configure your on-premises firewalls to allow traffic to the restricted.googleapis.com addresses.
C. 1. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
D. 1. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Configure your on-premises firewalls to allow traffic to the private.googleapis.com addresses.
Show Answer
Correct Answer: B
Explanation: To meet the requirements, access must use Private Google Access over the VPN, keep traffic off the public internet, rely on on‑premises DNS, and restrict APIs to those compatible with VPC Service Controls. Using **restricted.googleapis.com** (199.36.153.4/30) ensures only VPC Service Controls–supported APIs are reachable. Creating on‑prem DNS A/CNAME records for *.googleapis.com pointing to restricted.googleapis.com and routing those IPs over the Cloud VPN keeps traffic private. Allowing these IPs on the on‑prem firewall is required; removing a VPC internet gateway is unnecessary for on‑prem access.
Question 124
Your organization is implementing a new security policy to control how firewall rules are applied to control flows between virtual machines (VMs). Using Google-recommended practices, you need to set up a firewall rule to enforce strict control of traffic between VM A and VM B. You must ensure that communications flow only from VM A to VM B within the VPC, and no other communication paths are allowed. No other firewall rules exist in the VPC. Which firewall rule should you configure to allow only this communication path?
A. Firewall rule direction: ingress Action: allow - Target: VM B service account - Source ranges: VM A service account Priority: 1000
B. Firewall rule direction: ingress Action: allow - Target: specific VM B tag - Source ranges: VM A tag and VM A source IP address Priority: 1000
C. Firewall rule direction: ingress Action: allow - Target: VM A service account - Source ranges: VM B service account and VM B source IP address Priority: 100
D. Firewall rule direction: ingress Action: allow - Target: specific VM A tag - Source ranges: VM B tag and VM B source IP address Priority: 100
Show Answer
Correct Answer: A
Explanation: To allow only traffic from VM A to VM B with strict control and no other paths, the firewall rule must be an ingress allow rule targeting VM B and limiting the source strictly to VM A. Google recommends using source and target service accounts rather than network tags for precise, non-reusable identity-based control. Option A correctly uses an ingress rule, targets VM B’s service account, and allows traffic only from VM A’s service account, ensuring the intended one-way communication path and aligning with Google best practices.
Question 125
Your organization has Compute Engine instances in us-east1, us-west2, and us-central1. Your organization also has an existing Cloud Interconnect physical connection in the East Coast of the United States with a single VLAN attachment and Cloud Router in us-east1. You need to provide a design with high availability and ensure that if a region goes down, you still have access to all your other Virtual Private Cloud (VPC) subnets. You need to accomplish this in the most cost-effective manner possible. What should you do?
A. 1. Configure your VPC routing in regional mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-east1 region, and configure a Cloud Router in us-east1.
B. 1. Configure your VPC routing in global mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-east1 region, and configure a Cloud Router in us-east1.
C. 1. Configure your VPC routing in global mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-west2 region, and configure a Cloud Router in us-west2.
D. 1. Configure your VPC routing in regional mode. 2. Add additional Cloud Interconnect VLAN attachments in the us-west2 and us-central1 regions, and configure Cloud Routers in us-west2 and us-central1.
Show Answer
Correct Answer: C
Explanation: To maintain connectivity to all VPC subnets even if a region fails, dynamic routing must be set to global so routes learned via Cloud Router are available across all regions. High availability also requires a second Cloud Interconnect VLAN attachment in a different region from the existing us-east1 attachment; placing it in us-west2 provides regional redundancy. This meets the HA requirement while adding only one additional attachment and router, making it the most cost-effective option.
Question 126
You are designing a Partner Interconnect hybrid cloud connectivity solution with geo-redundancy across two metropolitan areas. You want to follow Google-recommended practices to set up the following region/metro pairs:
• (region 1/metro 1)
• (region 2/metro 2)
What should you do?
A. Create a Cloud Router in region 1 with two VLAN attachments connected to metro1-zone1-x. Create a Cloud Router in region 2 with two VLAN attachments connected to metro1-zone2-x.
B. Create a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone1-x. Create a Cloud Router in region 2 with two VLAN attachments connected to metro2-zone2-x.
C. Create a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone2-x. Create a Cloud Router in region 2 with one VLAN attachment connected to metro2-zone2-x.
D. Create a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone1-x and one VLAN attachment connected to metro1-zone2-x. Create a Cloud Router in region 2 with one VLAN attachment connected to metro2-zone1-x and one VLAN attachment to metro2-zone2-x.
Show Answer
Correct Answer: D
Explanation: Google-recommended 99.99% availability for Partner Interconnect requires four VLAN attachments across two metropolitan areas, with one VLAN attachment in each metro availability zone, and two Cloud Routers (one per region). Option D correctly creates a Cloud Router in each region and connects each router to two VLAN attachments spread across the two zones of its respective metro, providing both regional and metro-level redundancy.
Question 127
You recently configured Google Cloud Armor security policies to manage traffic to your application. You discover that Google Cloud Armor is incorrectly blocking some traffic to your application. You need to identity the web application firewall (WAF) rule that is incorrectly blocking traffic. What should you do?
A. Enable firewall logs, and view the logs in Firewall Insights.
B. Enable HTTP(S) Load Balancing logging with sampling rate equal to 1, and view the logs in Cloud Logging.
C. Enable VPC Flow Logs, and view the logs in Cloud Logging.
D. Enable Google Cloud Armor audit logs, and view the logs on the Activity page in the Google Cloud Console.
Show Answer
Correct Answer: B
Explanation: Google Cloud Armor WAF decisions are logged as part of HTTP(S) Load Balancing request logs. Enabling HTTP(S) Load Balancing logging with a sampling rate of 1 (100%) ensures all requests are logged, including those blocked by Cloud Armor, and the logs in Cloud Logging show which security policy and specific WAF rule matched. Firewall logs, VPC Flow Logs, and audit logs do not provide per-request WAF rule match details.
Question 128
Your company has 10 separate Virtual Private Cloud (VPC) networks, with one VPC per project in a single region in Google Cloud. Your security team requires each VPC network to have private connectivity to the main on-premises location via a Partner Interconnect connection in the same region. To optimize cost and operations, the same connectivity must be shared with all projects. You must ensure that all traffic between different projects, on-premises locations, and the internet can be inspected using the same third-party appliances. What should you do?
A. Configure the third-party appliances with multiple interfaces and specific Partner Interconnect VLAN attachments per project. Create the relevant routes on the third-party appliances and VPC networks.
B. Configure the third-party appliances with multiple interfaces, with each interface connected to a separate VPC network. Create separate VPC networks for on-premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks.
C. Consolidate all existing projects’ subnetworks into a single VPCreate separate VPC networks for on-premises and internet connectivity. Configure the third-party appliances with multiple interfaces, with each interface connected to a separate VPC network. Create the relevant routes on the third-party appliances and VPC networks.
D. Configure the third-party appliances with multiple interfaces. Create a hub VPC network for all projects, and create separate VPC networks for on-premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks. Use VPC Network Peering to connect all projects’ VPC networks to the hub VPC. Export custom routes from the hub VPC and import on all projects’ VPC networks.
Show Answer
Correct Answer: D
Explanation: The requirement is to share a single Partner Interconnect across multiple projects, centralize traffic inspection with the same third‑party appliances, and optimize cost and operations. A hub‑and‑spoke design is the recommended Google Cloud pattern for this. By creating a hub VPC that hosts the third‑party appliances and the Partner Interconnect, and peering all project VPCs to the hub with custom route export/import, all east‑west (project‑to‑project), north‑south (on‑premises), and internet traffic can be forced through the same inspection point. This avoids per‑project Interconnects, respects NIC limits on appliances, and provides centralized routing and security control.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.