Professional Cloud Network Engineer Free Practice Questions — Page 2
Question 8
Your company’s web application was just deployed on Compute Engine VMS in multiple Google Cloud regions. You have created multiple instance groups and you need to distribute traffic between these VMs. You want your users to automatically connect to the backend that is located in the closest region while following Google-recommended practices. What should you do?
A. Create one global external Application Load Balancer and multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
B. Create one global external Application Load Balancer and one backend service with multiple backends. Point each backend to a different instance group.
C. Create two global external Application Load Balancers with one backend service and one backend. Point each back end to a different instance group.
D. Create two global external Application Load Balancers with multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
Show Answer
Correct Answer: B
Explanation: To route users to the closest regional backend using Google‑recommended practices, you should use a single global external Application Load Balancer with one backend service that contains multiple backends, each pointing to a regional instance group. A global ALB provides global anycast IPs and performs latency‑based routing automatically. A backend service is designed to aggregate multiple backends (such as instance groups in different regions), so creating multiple backend services or multiple load balancers is unnecessary and not recommended.
Question 9
Your company uses Network Connectivity Center to connect its VPCs in Google Cloud. They plan to connect their on-premises data center to one of these VPCs by using HA VPN. The CIDR range of your on-premises network overlaps with the IP addresses in Google Cloud. You want your VMs in Google Cloud to connect directly to the IP address of the on-premises hosts. What should you do?
A. Configure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud application load balancer.
C. Configure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud TCP proxy load balancer.
D. Configure a subnet of purpose PRIVATE_NAT and use Private NAT for the Network Connectivity Center spokes.
E. Configure a subnet of purpose PRIVATE_NAT and use Hybrid NAT.
Show Answer
Correct Answer: E
Explanation: The on‑premises CIDR overlaps with Google Cloud IP ranges, so direct routing is not possible without address translation. Network Connectivity Center provides Hybrid NAT specifically to handle overlapping IP ranges between on‑premises networks and VPCs over HA VPN or Interconnect. Hybrid NAT allows VMs in Google Cloud to connect to on‑premises hosts using translated addresses while preserving end‑to‑end connectivity. Private NAT is for VPC‑to‑VPC scenarios within Google Cloud, and proxy load balancers are not designed to solve overlapping CIDR connectivity.
Question 10
Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two VLAN attachments. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?
A. Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Use the existing Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
B. Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
C. Enable MACsec on the VLAN attachments.
D. Enable MACsec on Partner Cloud Interconnect.
Show Answer
Correct Answer: B
Explanation: HA VPN over Cloud Interconnect uses a two-tier architecture. The Cloud Interconnect tier (VLAN attachments) requires its own Cloud Router, and the HA VPN tier (HA VPN gateways and tunnels) requires a separate Cloud Router. You cannot reuse the existing Cloud Router from the Interconnect tier for HA VPN, so you must create a new Cloud Router when creating the HA VPN gateway and tunnels.
Question 11
Your organization wants to deploy an internal application named app-1 in VPC-1. The application will consume services from another internal application named app-2 in VPC-2. VPC Network Peering will connect both applications. You need to apply microsegmentation between these two applications and VPCs. What should you do?
A. Assign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
B. Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
C. Assign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure an ingress VPC firewall rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
D. Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a network firewall policy that is attached to VPC-2 with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
Show Answer
Correct Answer: D
Explanation: Microsegmentation across VPC Network Peering requires Firewall 3.0 capabilities. Legacy network tags and VPC firewall rules do not work across peered VPCs. Secure tags are IAM-governed and can be referenced across peered networks, which is required here. With the default allow egress rule left in place on VPC-1, only ingress into VPC-2 must be explicitly allowed. Attaching a network firewall policy to VPC-2 with an ingress rule allowing traffic from secure-tag-app-1 to secure-tag-app-2 correctly enforces least privilege without needing org- or folder-wide hierarchical policies.
Question 12
You are designing the architecture for your organization so that clients can connect to certain Google APIs. Your plan must include a way to connect to Cloud Storage and BigQuery. You also need to ensure the traffic does not traverse the internet. You want your solution to be cloud-first and require the least amount of configuration steps. What should you do?
A. Configure Private Google Access on the VPC resource. Create a default route to the internet.
B. Configure Private Google Access on the subnet resource. Create a default route to the internet.
C. Configure Cloud NAT, and remove the default route to the internet.
D. Configure a global Secure Web Proxy, and remove the default route to the internet.
Show Answer
Correct Answer: B
Explanation: To access Google APIs such as Cloud Storage and BigQuery without traffic traversing the public internet, you should use Private Google Access. Private Google Access is configured at the subnet level, not the VPC level. It requires a default route (0.0.0.0/0) pointing to the default internet gateway; despite the name, traffic to Google APIs stays on Google’s private network. This is the cloud-first approach with the fewest configuration steps. Cloud NAT or Secure Web Proxy are unnecessary and add complexity.
Question 13
You are configuring the final elements of a migration effort where resources have been moved from on-premises to Google Cloud. While reviewing the deployed architecture, you noticed that DNS resolution is failing when queries are being sent to the on-premises environment. You login to a Compute Engine instance, try to resolve an on-premises hostname, and the query fails. DNS queries are not arriving at the on-premises DNS server. You need to use managed services to reconfigure Cloud DNS to resolve the DNS error. What should you do?
A. Ensure that the operating systems of the Compute Engine instances are configured to send DNS queries to the on-premises DNS servers directly.
B. Validate that there is network connectivity to the on-premises environment and that the Compute Engine instances can reach other on-premises resources. If errors persist, remove the VPC Network Peerings and recreate the peerings after validating the routes.
C. Validate that the Compute Engine instances are using the Metadata Service IP address as their resolver. Configure an outbound forwarding zone for the on-premises domain pointing to the on-premises DNS server. Configure Cloud Router to advertise the Cloud DNS proxy range to the on-premises network.
D. Review the existing Cloud DNS zones, and validate that there is a route in the VPC directing traffic destined to the IP address of the DNS servers. Recreate the existing DNS forwarding zones for . to forward all queries to the on-premises DNS servers.
Show Answer
Correct Answer: C
Explanation: In Google Cloud, Compute Engine instances should use the metadata server (169.254.169.254) as their DNS resolver so Cloud DNS can act as a proxy. To resolve on‑premises names using managed services, you must configure a Cloud DNS outbound forwarding zone for the on‑premises domain that forwards queries to the on‑premises DNS servers. Additionally, Cloud Router must advertise the Cloud DNS proxy IP range to the on‑premises network so return traffic is routed correctly. This is the supported and correct managed Cloud DNS configuration.
Question 14
Your organization's security team recently discovered that there is a high risk of malicious activities originating from some of your VMs connected to the internet. These malicious activities are currently undetected when TLS communication is used. You must ensure that encrypted traffic to the internet is inspected. What should you do?
A. Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.
B. Use Cloud NGFW Essentials. Create a firewall rule for egress traffic, and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.
C. Configure a TLS agent on every VM to intercept TLS traffic before it reaches the internet. Configure Sensitive Data Protection to analyze and allow/deny the content.
D. Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the --tls-inspect flag, and associate the firewall rules with the VMs.
Show Answer
Correct Answer: D
Explanation: To inspect encrypted (TLS) egress traffic from VMs, you need a native Google Cloud service that supports TLS decryption and inspection on outbound traffic. Cloud NGFW Enterprise provides TLS inspection for egress traffic via firewall rules using the --tls-inspect capability. Cloud Armor only protects ingress HTTP(S) at load balancers, Cloud NGFW Essentials does not support TLS inspection, and installing agents on every VM is not scalable or a supported managed approach.
Question 15
Your organization is launching a new video game that will be available to all users globally through Cloud CDN. During the earl y release phase, you discovered that the wrong binary version was uploaded from Cloud Storage and cached in Cloud CDN. Thousands of users have downloaded the wrong version. Your marketing department has notified users that this was the wrong version of the game and asked all users to download the updated version using the same URL. You need to ensure users are downloading the updated version of the game. What should you do?
A. Create a security policy to block all Cloud CON requests, review the logs, and filter which users are attempting to download the wrong game binary.
B. Create a new URL path for the updated game binary. Allow the cache to expire automatically through HTTP headers.
C. Upload the updated game binary to Cloud Storage. Invalidate the wrong game binary from the Cloud CDN cache.
D. Disable Cloud CDN. Reconfigure the load balancer with the updated game binary. Enable Cloud CDN.
Show Answer
Correct Answer: C
Explanation: Cloud CDN caches content at edge locations, so simply uploading a corrected binary is not sufficient if the wrong version is already cached. By uploading the updated game binary to Cloud Storage and issuing a Cloud CDN cache invalidation for that object, you force the CDN to discard the cached copy and fetch the updated version on the next request, while keeping the same URL as communicated to users.
Question 16
Your organization has implemented Vertex AI online prediction in your Google Cloud environment, which is in the us-central1 region. Online prediction is available through private services access by using the IP CIDR range of 172.16.53.0/24. You need to configure access to Vertex AI without affecting the existing routes. You want to use the VLAN attachments that are located in the us-west1 region as primary. The interconnect VLAN attachments in the us-west2 region can only be used as a backup. What should you do?
A. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24.
B. Create a custom learned route on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
C. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
D. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 200.
Show Answer
Correct Answer: D
Explanation: To make us-west1 the primary path and us-west2 the backup without affecting existing routes, you must influence BGP path selection for the advertised Vertex AI private services prefix only. In Google Cloud, BGP session route priority applies to learned routes, not to advertised routes, so option C is incorrect. The correct method is to advertise the prefix 172.16.53.0/24 on both VLAN attachments and use a BGP route policy to set a lower MED (100) on us-west1 and a higher MED (200) on us-west2, making us-west1 preferred and us-west2 a backup.
Question 17
Your organization mandates that all internal IP addresses used by all database VMs must be statically allocated. While analyzing your VPC IP address allocations, you observed that the database VMs do not have static IP addresses. You need to configure the VPC to follow your organization's mandate without causing any disruption to current operations. What should you do?
A. Promote the internal IP addresses to static assignments for all database VMs.
B. Create a firewall rule to allow only traffic to the IP addresses allocated to your database VMs.
C. Define a maintenance window to shut down the database VMs one at a time, promote the internal IP address to a static assignment, and restart the VM.
D. Define an organization policy to allow only statically allocated IP addresses for VMs. Ensure the prefix matches your database VMs.
Show Answer
Correct Answer: A
Explanation: In Google Cloud VPCs, an existing ephemeral internal IP can be promoted to a static internal IP without stopping or restarting the VM. This satisfies the requirement that database VMs use statically allocated internal IPs and avoids any disruption. Other options either do not enforce static IP usage or would require unnecessary downtime.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.