Professional Cloud Network Engineer Free Practice Questions — Page 2
Question 11
You are designing a Google Kubernetes Engine cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 Services. Because of the migration of new Services over the next two years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 Services. You want to use VPC-native clusters with alias IP address ranges, while minimizing address consumption. How should you design this topology?
A. Create a subnet of size /28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the Services are ready to be deployed, resize the subnets.
B. Use gcloud container clusters create [CLUSTER_NAME]--enable-ip-alias to create a VPC-native Cluster.
C. Create a subnet of size /25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
D. Use gcloud container clusters create [CLUSTER_NAME] to create a VPC-native Cluster.
Show Answer
Correct Answer: C
Explanation: A VPC-native GKE cluster needs a primary subnet for nodes and two secondary ranges for Pods and Services sized for future growth. A /25 primary subnet supports up to 128 node IPs, sufficient for 100 nodes. A /21 service range provides 2048 addresses, enough for 1500 Services. The Pod secondary range must accommodate per-node Pod CIDR allocation; the /17 range is sufficient for the planned scale. Options B and D do not address the required IP range design, and A is undersized and relies on resizing that does not solve the fixed Service range sizing.
Question 12
You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. The connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?
A. Create a Connectivity Test. Review the results for configuration issues in the VPC routing table.
B. Enable and review Cloud Logging for Cloud Armor. Look for logs with errors that match the destination IP address of the public SaaS provider.
C. Enable and review Cloud Logging on your Cloud NAT Gateway. Look for logs with errors that match the destination IP address of the public SaaS provider.
D. Enable the Firewall Insights API. Set the Deny rule insights observation period to one day. Review Insight results to assure there are no firewall rules denying traffic.
Show Answer
Correct Answer: C
Explanation: Intermittent TCP failures while ICMP remains successful suggest a transport-layer issue rather than basic IP reachability. When traffic to a public SaaS traverses Cloud NAT, recurring failures at the same time each day are consistent with NAT port exhaustion or translation issues during peak usage. Enabling and reviewing Cloud NAT logging can reveal dropped or failed translations associated with the SaaS destination. Connectivity Tests and Firewall Insights focus on configuration and policy, which are less likely given the intermittent, time-based symptoms, and Cloud Armor is only relevant if it is deployed to protect applicable HTTP(S) workloads.
Question 13
You have configured a single IPSec Cloud VPN tunnel for your organization to one of your customers. The VPN Tunnel Status is showing as Established; however the BGP Session Status is showing as BGP not configured. Your customer’s BGP settings are:
• Customer BGP address: 169.254.11.1/30
• Customer ASN: 64515
• Google Cloud BGP address: 169.254.11.2
• Google Cloud ASN: 64517
• MD5 Authentication: Disabled
You need to configure your local BGP session for this tunnel based on the settings provided by the third party customer. You have already associated the Cloud Router with the Cloud VPN Tunnel. What should you do?
A. Create a BGP session with these settings: • Peer ASN: 64517 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Disabled.
B. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.1 • Peer BGP IP: 169.254.11.2 • MD5 Authentication: Disabled.
C. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 100 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Disabled.
D. Create a BGP session with these settings: • Peer ASN: 64515 • Advertise Route Priority (MED): 1000 • Local BGP IP: 169.254.11.2 • Peer BGP IP: 169.254.11.1 • MD5 Authentication: Enabled.
Show Answer
Correct Answer: C
Explanation: Configure the Cloud Router BGP session using the customer's ASN as the peer ASN (64515), your local BGP IP as the Google Cloud BGP address (169.254.11.2), and the peer BGP IP as the customer's BGP address (169.254.11.1). MD5 authentication should remain disabled because the customer has it disabled. The default/typical advertised route priority of 100 is appropriate; the other options either swap the ASN, swap the IP addresses, or incorrectly enable MD5 and change the MED.
Question 14
Your company uses VPC firewall rules and denies all egress traffic. You need to allow some VMs to contact external websites based on their fully qualified domain name (FQDN). You apply the new configuration, but the traffic is still denied. You need to adjust your setup to apply the new configuration. What would you do?
A. Raise the priority of the network firewall policy rules.
B. Lower the priority of the network firewall policy rules.
C. Update the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL.
D. Update the default policy and rule evaluation order to AFTER_CLASSIC_FIREWALL.
Show Answer
Correct Answer: C
Explanation: FQDN-based egress filtering is implemented with network firewall policies. If classic VPC firewall rules include a deny-all egress rule, the network firewall policy must be evaluated before the classic firewall rules for the FQDN allow rule to take effect. Setting the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL ensures the FQDN allow is considered before the VPC deny-all egress rule.
Question 15
Your organization has an on-premises data center. You need to provide connectivity from the on-premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?
A. Configure HA VPN by using high availability gateways and tunnels.
B. Configure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.
C. Configure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.
D. Configure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.
Show Answer
Correct Answer: D
Explanation: Partner Interconnect provides private connectivity that does not traverse the public internet and supports bandwidth options including 50 Mbps, 100 Mbps, 200 Mbps, 300 Mbps, 400 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, and 10 Gbps through a supported service provider. HA VPN uses the internet. Cross-Cloud Interconnect is for connecting from other cloud providers. Dedicated Interconnect requires dedicated 10 Gbps or 100 Gbps physical connections rather than a 1 Gbps partner-delivered connection.
Question 16
Your company’s web application was just deployed on Compute Engine VMS in multiple Google Cloud regions. You have created multiple instance groups and you need to distribute traffic between these VMs. You want your users to automatically connect to the backend that is located in the closest region while following Google-recommended practices. What should you do?
A. Create one global external Application Load Balancer and multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
B. Create one global external Application Load Balancer and one backend service with multiple backends. Point each backend to a different instance group.
C. Create two global external Application Load Balancers with one backend service and one backend. Point each back end to a different instance group.
D. Create two global external Application Load Balancers with multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
Show Answer
Correct Answer: B
Explanation: A global external Application Load Balancer supports a single backend service with multiple backends, where each backend can be a regional managed instance group. The global load balancer uses Google's global anycast network and routes users to the closest healthy backend based on proximity and capacity. Creating multiple backend services is unnecessary for this use case, and creating multiple global load balancers is not recommended.
Question 17
Your company uses Network Connectivity Center to connect its VPCs in Google Cloud. They plan to connect their on-premises data center to one of these VPCs by using HA VPN. The CIDR range of your on-premises network overlaps with the IP addresses in Google Cloud. You want your VMs in Google Cloud to connect directly to the IP address of the on-premises hosts. What should you do?
A. Configure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud application load balancer.
C. Configure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud TCP proxy load balancer.
D. Configure a subnet of purpose PRIVATE_NAT and use Private NAT for the Network Connectivity Center spokes.
E. Configure a subnet of purpose PRIVATE_NAT and use Hybrid NAT.
Show Answer
Correct Answer: D
Explanation: When using Network Connectivity Center with overlapping IP address ranges between Google Cloud VPCs and on-premises networks connected via HA VPN, the supported solution is Private NAT for Network Connectivity Center spokes. This requires a subnet with purpose PRIVATE_NAT and enables NAT between VPC spokes and hybrid spokes (such as HA VPN-connected on-premises networks). REGIONAL_MANAGED_PROXY subnets are for proxy load balancers, and Hybrid NAT is not the feature used in this NCC spoke scenario.
Sources:
https://www.certimaan.com/post/google-cloud-network-engineer-sample-questions
Question 18
Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two VLAN attachments. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?
A. Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Use the existing Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
B. Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
C. Enable MACsec on the VLAN attachments.
D. Enable MACsec on Partner Cloud Interconnect.
Show Answer
Correct Answer: B
Explanation: HA VPN over Cloud Interconnect uses two separate operational tiers. The Cloud Interconnect tier uses a Cloud Router for the VLAN attachments, while the HA VPN tier requires its own Cloud Router for the HA VPN BGP sessions. After creating the HA VPN gateway associated with the VLAN attachments, you create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
Question 19
Your organization wants to deploy an internal application named app-1 in VPC-1. The application will consume services from another internal application named app-2 in VPC-2. VPC Network Peering will connect both applications. You need to apply microsegmentation between these two applications and VPCs. What should you do?
A. Assign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
B. Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
C. Assign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure an ingress VPC firewall rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
D. Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a network firewall policy that is attached to VPC-2 with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
Show Answer
Correct Answer: D
Explanation: Microsegmentation across VPC Network Peering requires secure tags rather than legacy network tags, because secure tags can be referenced by network firewall policies across peered VPCs. Since the default implied allow egress remains in place, only an ingress allow rule is needed on the destination VPC. Attaching a network firewall policy to VPC-2 with an ingress rule allowing traffic from the secure tag on app-1 to the secure tag on app-2 satisfies the requirement.
Question 20
You are designing the architecture for your organization so that clients can connect to certain Google APIs. Your plan must include a way to connect to Cloud Storage and BigQuery. You also need to ensure the traffic does not traverse the internet. You want your solution to be cloud-first and require the least amount of configuration steps. What should you do?
A. Configure Private Google Access on the VPC resource. Create a default route to the internet.
B. Configure Private Google Access on the subnet resource. Create a default route to the internet.
C. Configure Cloud NAT, and remove the default route to the internet.
D. Configure a global Secure Web Proxy, and remove the default route to the internet.
Show Answer
Correct Answer: B
Explanation: Private Google Access is configured at the subnet level, not the VPC level. It allows VMs without external IP addresses to privately reach supported Google APIs such as Cloud Storage and BigQuery. A default route to the default internet gateway is still required; traffic to Google APIs remains on Google's network and does not traverse the public internet despite using that route.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.