Professional Cloud Network Engineer Free Practice Questions — Page 2
Question 5
You have the following private Google Kubernetes Engine (GKE) cluster deployment:
You have a virtual machine (VM) deployed in the same VPC in the subnetwork kubernetes-management with internal IP address 192.168.40 2/24 and no external IP address assigned. You need to communicate with the cluster master using kubectl. What should you do?
A. Add the network 192.168.40.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2.
B. Add the network 192.168.38.0/28 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
C. Add the network 192.168.36.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
D. Add an external IP address to the VM, and add this IP address in the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 35.224.37.17.
Show Answer
Correct Answer: A
Explanation: The VM’s internal IP is 192.168.40.2, within the 192.168.40.0/24 subnet. Add that subnet to the master authorized networks, then use the private control-plane endpoint 192.168.38.2 from the VM.
Question 5
Your organization has two applications running in separate Google Cloud VPC networks (vpc-a and vpc-b) in different projects. You need to establish a secure, private, and encrypted connection between these two VPCs to allow for inter-VPC communication. You must ensure the solution provides high availability and uses dynamic routing. What should you do?
A. Configure VPC Network Peering between the two networks, and adjust firewall rules on both sides to allow the required traffic flow between specific subnets.
B. In vpc-a, deploy an internal Application Load Balancer for your application. Use Private Service Connect to publish this service in vpc-a and create a PSC consumer endpoint in vpc-b.
C. In each VPdeploy a Classic VPN gateway and use a pre-shared key for authentication. Configure static routes to direct traffic to the other VP
D. In each VPC. deploy an HA VPN gateway and a Cloud Router. Create two VPN tunnels on each gateway, and configure BGP sessions for dynamic routing.
Show Answer
Correct Answer: A
Explanation: VPC Network Peering provides private connectivity between VPCs across projects. Traffic between VMs in peered VPCs on Google's production network is encrypted in transit, and firewall rules control allowed communication. HA VPN with Cloud Router is appropriate when connecting external networks or when VPN is specifically required, but it is unnecessary for two Google Cloud VPCs connected by peering under these requirements.
Question 6
You have the following routing design. You discover that Compute Engine instances in Subnet-2 in the asia-southeast1 region cannot communicate with compute resources on-premises. What should you do?
A. Configure a custom route advertisement on the Cloud Router.
B. Enable IP forwarding in the asia-southeast1 region.
C. Change the VPC dynamic routing mode to Global.
D. Add a second Border Gateway Protocol (BGP) session to the Cloud Router.
Show Answer
Correct Answer: C
Explanation: With regional dynamic routing, routes learned by the Cloud Router in europe-west1 are available only in that region. Change the VPC’s dynamic routing mode to Global so the on-premises routes are available to instances in asia-southeast1 as well.
Question 7
Your company is implementing new rules for outbound internet traffic in your Google Cloud environment. You need to design a configuration that enables all outbound internet traffic from virtual machines tagged with production-critical to route through a Secure Web Proxy (SWP) for inspection while allowing all other virtual machines to egress directly to the internet. What should you do?
A. Deploy a Cloud NAT gateway configured to translate and forward traffic from production-critical VMs to the internet.
B. Configure a custom static route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP address as a next hop.
C. Configure a policy-based route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP as a next hop.
D. Configure a policy-based route with a source set as the subnets of the production-critical VMs and a destination of 0.0.0.0/0 with the SWP IP as the next hop.
Show Answer
Correct Answer: B
Explanation: A tagged custom static route with destination 0.0.0.0/0 and the Secure Web Proxy as the next hop applies only to VMs with the specified network tag, causing only production-critical instances to send outbound traffic through the proxy while other VMs continue using the default internet route. Policy-based routes are matched on packet attributes such as source/destination ranges rather than network tags.
Question 8
Your organization is migrating workloads from AWS to Google Cloud. Because a particularly critical workload will take longer to migrate, you need to set up Google Cloud CDN and point it to the existing application at AWS. What should you do?
A. • Create an internet NEG that points to the existing FQDN of the application. • Map the NEG to an Application Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
B. • Create a hybrid NEG that points to the existing IP of the application. • Map the NEG to a passthrough Network Load Balancer as a target pool. • Enable Cloud CDN on the target pool.
C. • Create an internet NEG that points to the existing FQDN of the application. • Map the NEG to a passthrough Network Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
D. • Create a hybrid NEG that points to the existing IP of the application. • Map the NEG to an Application Load Balancer as a backend service. • Enable Cloud CDN on the backend service.
Show Answer
Correct Answer: A
Explanation: Cloud CDN is supported with the external Application Load Balancer, not passthrough Network Load Balancers. For origins hosted outside Google Cloud (such as AWS), you use an internet network endpoint group (NEG) that references the origin by FQDN or public endpoint, attach it as a backend service to the Application Load Balancer, and enable Cloud CDN on that backend service.
Question 9
You are setting up a Dedicated Interconnect connection from your organization’s on-premises data center in Frankfurt, Germany, towards the europe-west3 region, which is also in the Frankfurt metropolitan area. The AI team lead expressed their concern regarding connectivity to the europe-west4 region because their team wants to use Google Cloud TPUs for their workloads. You need to ensure that low latency network connectivity is established for this team’s workloads. You want to minimize costs and operational overhead. What should you do?
A. Set up the Dedicated Interconnect connection towards the europe-west4 region instead of the europe-west3 region.
B. Set up an additional Partner Interconnect connection between your data center and the europe-west4 region.
C. Set up a remote VLAN attachment to the europe-west4 region on the Dedicated Interconnect connection.
D. Use Cloud VPN instead of Dedicated Interconnect to send traffic over the internet.
Show Answer
Correct Answer: C
Explanation: A remote VLAN attachment allows a Dedicated Interconnect in one metro to connect to supported remote Google Cloud regions over Google's backbone. Since europe-west3 (Frankfurt) and europe-west4 are connected this way, it provides low-latency connectivity while reusing the existing Dedicated Interconnect, minimizing both cost and operational overhead compared with deploying another Interconnect. Cloud VPN does not meet the low-latency private connectivity requirement, and moving the physical Interconnect to another region is unnecessary.
Question 10
Your VPC is configured with regional dynamic routing mode. You have deployed VMs and VLAN attachments in the europe-west2 region, and regional internal Application Load Balancers in us-east1. You need to ensure the VMs in the europe-west2 region have connectivity to the regional internal Application Load Balancers in the us-east1 region. What should you do?
A. Create the backend in us-east1, create multiple forwarding rules in each region, and then enable regional access.
B. Create the backend service in europe-west2, create the forwarding rule in us-east1, and then enable regional access.
C. Create the backend service in us-east1, create the forwarding rule in europe-west2, and then enable global access.
D. Create the backend service in us-east1, create the forwarding rule in us-east1, and then enable global access.
Show Answer
Correct Answer: D
Explanation: A regional internal Application Load Balancer requires its backend service and forwarding rule to be in the same region. To allow clients from other regions to access the regional internal ALB, you enable global access on the forwarding rule. Therefore, the backend service and forwarding rule should both be in us-east1, with global access enabled. Note that in practice, if the VPC uses regional dynamic routing mode and connectivity depends on learned dynamic routes across regions, changing the VPC to global dynamic routing mode may also be required, but that is not offered as an answer choice.
Question 11
You are designing a Google Kubernetes Engine cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 Services. Because of the migration of new Services over the next two years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 Services. You want to use VPC-native clusters with alias IP address ranges, while minimizing address consumption. How should you design this topology?
A. Create a subnet of size /28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the Services are ready to be deployed, resize the subnets.
B. Use gcloud container clusters create [CLUSTER_NAME]--enable-ip-alias to create a VPC-native Cluster.
C. Create a subnet of size /25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
D. Use gcloud container clusters create [CLUSTER_NAME] to create a VPC-native Cluster.
Show Answer
Correct Answer: C
Explanation: A VPC-native GKE cluster needs a primary subnet for nodes and two secondary ranges for Pods and Services sized for future growth. A /25 primary subnet supports up to 128 node IPs, sufficient for 100 nodes. A /21 service range provides 2048 addresses, enough for 1500 Services. The Pod secondary range must accommodate per-node Pod CIDR allocation; the /17 range is sufficient for the planned scale. Options B and D do not address the required IP range design, and A is undersized and relies on resizing that does not solve the fixed Service range sizing.
Question 12
You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. The connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?
A. Create a Connectivity Test. Review the results for configuration issues in the VPC routing table.
B. Enable and review Cloud Logging for Cloud Armor. Look for logs with errors that match the destination IP address of the public SaaS provider.
C. Enable and review Cloud Logging on your Cloud NAT Gateway. Look for logs with errors that match the destination IP address of the public SaaS provider.
D. Enable the Firewall Insights API. Set the Deny rule insights observation period to one day. Review Insight results to assure there are no firewall rules denying traffic.
Show Answer
Correct Answer: C
Explanation: Intermittent TCP failures while ICMP remains successful suggest a transport-layer issue rather than basic IP reachability. When traffic to a public SaaS traverses Cloud NAT, recurring failures at the same time each day are consistent with NAT port exhaustion or translation issues during peak usage. Enabling and reviewing Cloud NAT logging can reveal dropped or failed translations associated with the SaaS destination. Connectivity Tests and Firewall Insights focus on configuration and policy, which are less likely given the intermittent, time-based symptoms, and Cloud Armor is only relevant if it is deployed to protect applicable HTTP(S) workloads.
Question 13
You have configured a single IPSec Cloud VPN tunnel for your organization to one of your customers. The VPN Tunnel Status is showing as Established; however the BGP Session Status is showing as BGP not configured. Your customer’s BGP settings are:
• Customer BGP address: 169.254.11.1/30
• Customer ASN: 64515
• Google Cloud BGP address: 169.254.11.2
• Google Cloud ASN: 64517
• MD5 Authentication: Disabled
You need to configure your local BGP session for this tunnel based on the settings provided by the third party customer. You have already associated the Cloud Router with the Cloud VPN Tunnel. What should you do?
A. Create a BGP session with these settings: • Peer ASN: 64517 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Disabled.
B. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.1 • Peer BGP IP: 169.254.11.2 • MD5 Authentication: Disabled.
C. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Disabled.
D. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 1000 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Enabled.
Show Answer
Correct Answer: C
Explanation: Configure the Cloud Router BGP session using the customer's ASN as the peer ASN (64515), your local BGP IP as the Google Cloud BGP address (169.254.11.2), and the peer BGP IP as the customer's BGP address (169.254.11.1). MD5 authentication should remain disabled because the customer has it disabled. The default/typical advertised route priority of 100 is appropriate; the other options either swap the ASN, swap the IP addresses, or incorrectly enable MD5 and change the MED.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
