Professional Cloud Network Engineer Free Practice Questions — Page 3
Question 18
You are configuring HA VPN for your organization to connect your on-premises environment to your Google Cloud network. Your on-premises environment is closest to the us-west1 Google Cloud region. You have Google Cloud resources in us-west2, which requires a throughput of 300,000 packets per second (PPS) and an approximate bandwidth of 4 Gbps. You need to have predictable bandwidth management and maintain an SLA of 99.99% with minimal costs. What should you do?
A. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 200. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
B. Create two HA VPN gateways, each with two tunnels. Configure BGP on each of the gateways' tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the same corresponding multi-exit discriminator (MED) value.
C. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
D. Create an HA VPN gateway with four tunnels. Configure BGP on four tunnels with tunnel 0 configured with a base routing priority metric of 100, tunnel 1 with a base routing priority metric of 200, tunnel 2 with a base routing priority of 300, and tunnel 3 with a base routing priority of 400. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
Show Answer
Correct Answer: C
Explanation: Each HA VPN gateway provides two tunnels and achieves a 99.99% SLA when both tunnels are up. Each tunnel supports up to ~250,000 PPS and ~3 Gbps, so using both tunnels in active/active mode meets the 300,000 PPS and ~4 Gbps requirement with predictable bandwidth. Setting equal base routing priority metrics enables ECMP load balancing across the tunnels, providing required throughput at minimal cost without unnecessary additional gateways or tunnels.
Question 19
You are implementing a Shared VPC network for your organization, which has distributed teams. One of the application developers works across several teams and notices that they can deploy applications in subnets that are reserved for another application's service projects. You want to ensure that developers can only deploy resources in the subnets that are reserved for their respective service project. What should you do?
A. Specify which Shared VPC subnets each application's service projects can access by using the constraints/compute.restrictSharedVpcSubnetworks organizational constraint.
B. Grant the compute.NetworkViewer role to the developer in the Shared VPC host project.
C. Restrict another application's project from accessing specific subnets in the host project by using the constraints/compute.restrictSharedVpcHostProject organizational constraint.
D. Grant the compute.NetworkUser role to the developer in the specific Shared VPC service project.
Show Answer
Correct Answer: A
Explanation: To ensure developers can deploy resources only in subnets reserved for their own service projects, you must enforce subnet-level access control for Shared VPC. The organizational constraint constraints/compute.restrictSharedVpcSubnetworks lets you explicitly define which Shared VPC subnets each service project is allowed to use, preventing cross-project subnet usage. The other options either only grant visibility or usage permissions broadly, or apply the wrong type of constraint, and do not provide the required fine-grained subnet restriction.
Question 20
Your organization has a highly available application that is not HTTP-based. The application runs on multiple TCP ports and is hosted in multiple regions. You need to design a solution to load balance the application in the same Shared VPC where the service will be accessed. The IP address header must contain the client's true source IP address. No public internet access is required. What should you do?
A. Configure multiple regional internal proxy Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
B. Configure multiple regional internal Application Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
C. Configure a single cross region internal proxy Network Load Balancer.
D. Configure multiple regional internal passthrough Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
Show Answer
Correct Answer: D
Explanation: The application is non-HTTP, uses multiple TCP ports, must preserve the client’s true source IP, and is accessed only within a Shared VPC without public internet exposure. Internal passthrough Network Load Balancers operate at Layer 4, support TCP/UDP on multiple ports, and preserve the original client IP. Because the service is deployed in multiple regions, you need regional internal passthrough NLBs combined with DNS routing policies to distribute traffic across regions. Proxy-based or application load balancers would not preserve the client source IP or are HTTP-based, making them unsuitable.
Question 21
You plan to deploy Google Cloud Armor web application firewall (WAF) policies that use the preconfigured WAF rules. You want all Google Cloud Armor logs to be sent to Cloud Logging with the highest level of detail possible. You have enabled Cloud Load Balancing logs for all the backend services where Cloud Armor WAF policies are applied. What should you do?
A. Set the sample rate of the Cloud Load Balancing logs to 0.5.
B. Set the Google Cloud Armor logging option to VERBOSE.
C. Enable Google Cloud Armor logging for all the backend services where Cloud Armor WAF policies are applied. Set the Google Cloud Armor logging option to VERBOSE.
D. Set the sample rate of the Cloud Load Balancing logs to 1.0.
Show Answer
Correct Answer: B
Explanation: Cloud Armor request logs are emitted as part of Cloud Load Balancing logs once logging is enabled on the backend services, which the scenario already states is done. To get the highest level of detail for preconfigured WAF rules, you must set the Cloud Armor logging option to VERBOSE. Changing the load balancer log sample rate affects traffic sampling, not the verbosity of Cloud Armor WAF logs.
Question 22
As part of your organization's modernization efforts, the application teams are migrating services to GKE on Google Cloud (GKE). The GKE clusters will live in service projects. The teams have validated the applications and configurations in their sandbox projects. When moving to production, you noticed that GKE nodes were not being created. Users were able to create Compute Engine instances, but the operation failed when they tried to create a GKE cluster. You need to enable the application teams so they can create said GKE clusters. What should you do?
A. Ensure that the service project's GKE service account has the compute.securityAdmin, container.hostServiceAgentUser and compute.networkUser IAM permissions in the host project.
B. Ensure that the service project's GKE service account has the compute.securityAdmin, container.hostserviceAgentUser and compute.networkUser IAM permissions in the service project.
C. Ensure that the service project's GKE service account has the compute.networkUser IAM permission in the service project.
D. Review the firewall rules configuration in the VPC. Identify what rule is blocking node creation.
Show Answer
Correct Answer: A
Explanation: This is a Shared VPC scenario where GKE clusters are created in service projects but use networking from a host project. While users can create standalone Compute Engine VMs, GKE node creation fails because GKE requires additional permissions to manage networking and firewall resources in the host project. The GKE service account from the service project must be granted compute.networkUser, container.hostServiceAgentUser, and compute.securityAdmin roles in the host project. These permissions allow GKE to attach nodes to the Shared VPC, configure firewall rules, and manage required network resources. Granting these roles in the service project or checking firewall rules alone does not resolve the root cause.
Question 23
You recently reviewed the user behavior for your main application, which uses an external global Application Load Balancer, and found that the backend servers were overloaded due to erratic spikes in the rate of client requests. You need to limit the concurrent sessions and return an HTTP 429 Too Many Requests response back to the client while following Google-recommended practices. What should you do?
A. Create a Cloud Armor security policy, and associate the policy with the load balancer. Configure the security policy's settings as follows: action: throttle; conform action: allow; exceed action: deny-429.
B. Configure the load balancer to accept only the defined amount of requests per client IP address, increase the backend servers to support more traffic, and redirect traffic to a different backend to burst traffic.
C. Create a Cloud Armor security policy, and apply the predefined Open Worldwide Security Application Project (OWASP) rules to automatically implement the rate limit per client IP address.
D. Configure a VM with Linux, implement the rate limit through iptables, and use a firewall rule to send an HTTP 429 response to the client application.
Show Answer
Correct Answer: A
Explanation: Google-recommended practice for limiting request rates and concurrent sessions on a global external Application Load Balancer is to use Cloud Armor rate limiting. A Cloud Armor security policy with action set to throttle allows compliant traffic and applies an exceed_action of deny-429 when limits are exceeded, returning HTTP 429 Too Many Requests. This natively integrates with the load balancer, handles erratic spikes, and avoids custom backends or VM-level controls.
Question 24
You are troubleshooting an application in your organization's Google Cloud network that is not functioning as expected. You suspect that packets are getting lost somewhere. The application sends packets intermittently at a low volume from a Compute Engine VM to a destination on your on-premises network through a pair of Cloud Interconnect VLAN attachments. You validated that the Cloud Next Generation Firewall (Cloud NGFW) rules do not have any deny statements blocking egress traffic, and you do not have any explicit allow rules. Following Google-recommended practices, you need to analyze the flow to see if packets are being sent correctly out of the VM to isolate the issue. What should you do?
A. Create a packet mirroring policy that is configured with your VM as the source and destined to a collector. Analyze the packet captures.
B. Enable VPC Flow Logs on the subnet that the VM is deployed in with SAMPLE_RATE = 1.0, and run a query in Logs Explorer to analyze the packet flow.
C. Verify the network/attachment/egress_dropped_packets_count Cloud Interconnect VLAN attachment metric.
D. Enable Firewall Rules Logging on your firewall rules and review the logs.
Show Answer
Correct Answer: A
Explanation: The goal is to verify whether packets are actually leaving the VM and to analyze them in detail for an intermittent, low-volume flow. Packet Mirroring captures full packets directly from the VM’s network interface, making it ideal for deep inspection (headers, ports, correctness) and for low-volume traffic that might be missed by sampled telemetry. VPC Flow Logs are sampled and provide only metadata, not full packet contents, and are not guaranteed to capture very low-volume or intermittent flows even with a high sample rate. Interconnect metrics and firewall logging do not confirm packet correctness at the VM level. Therefore, packet mirroring is the Google-recommended approach for this scenario.
Question 25
Your organization's current architecture has one Shared VPC host project (SH_HOST_PRJ) that contains a single VPC (SH_VPC) and two Shared VPC service projects (SP_ONE_PRJ and SP_TWO_PRJ) that do not contain any VPCs. Each Shared VPC service project belongs to a different team: TEAM_ONE manages SP_ONE_PRJ and TEAM_TWO manages SP_TWO_PRJ.
You must design a solution that allows each team to create their own DNS private zones and DNS records only in their respective Shared VPC service projects. Workloads in SP_ONE_PRJ must be able to resolve all the DNS private zones defined in SP_TWO_PRJ and conversely. Your design must have the least amount of set up effort. What should you do?
A. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO creates Cloud DNS private zones and DNS records in SP_TWO_PRJ, and uses cross-project binding to connect the zones to the Shared VPC host project (SH_HOST_PRJ).
B. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO creates DNS private zones and DNS records in SP_TWO_PRJ and uses cross-project binding to connect the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).
C. 1. TEAM_ONE creates a new VPC (SP_ONE_VPC) in the Shared VPC service projects (SP_ONE_PRJ). TEAM_ONE creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the new VPC (SP_ONE_VPC). TEAM_ONE creates a Cloud DNS peering relationship between SP_ONE_VPC and the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO completes the same actions for the SP_TWO_PRJ project.
D. 1. TEAM_ONE creates a new VPC (SP_ONE_VPC) in the Shared VPC service projects (SP_ONE_PRJ). TEAM_ONE creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the new VPC (SP_ONE_VPC). TEAM_ONE creates a VPC Network Peering relationship between SP_ONE_VPC and the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO completes the same actions for the SP_TWO_PRJ project.
Show Answer
Correct Answer: B
Explanation: Cloud DNS private zones are visible based on VPC network attachments, not at the project level. Using cross-project binding, each team can create and manage private zones in its own service project while binding those zones directly to the Shared VPC network (SH_VPC) in the host project. Because both service projects use the same Shared VPC, workloads in SP_ONE_PRJ and SP_TWO_PRJ can resolve all private zones. This approach requires no additional VPCs, peering, or extra infrastructure, making it the least setup effort. Option A is incorrect because binding to a project (rather than the VPC network) is not how private DNS visibility works.
Question 26
You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. Connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?
A. Enable and review Cloud Logging for Cloud Armor. Look for logs with errors matching the destination IP address of the public SaaS provider.
B. Enable and review Cloud Logging on your Cloud NAT gateway. Look for logs with errors matching the destination IP address of the public SaaS provider.
C. Enable the Firewall Insights API. Set the deny rule insights observation period to one day. Review the insights to assure there are no firewall rules denying traffic.
D. Create a Connectivity Test by using TCP, the source IP address of your test VM, and the destination IP address of the public SaaS provider. Review the live data plane analysis and take the next steps based on the test results.
Show Answer
Correct Answer: B
Explanation: ICMP succeeds while TCP intermittently fails at predictable daily times, which strongly suggests Cloud NAT ephemeral port exhaustion during peak usage rather than routing or firewall issues. Enabling Cloud NAT logging allows you to see dropped or failed TCP connections and errors correlated with the SaaS destination IP, providing the most direct insight into what is occurring within Google Cloud.
Question 27
You are configuring an Application Load Balancer. The backend resides in your on-premises data center and is connected by Dedicated Interconnect. You need to ensure the load balancer can reference these on-premises resources. You do not want the traffic to traverse the internet at all. What should you do?
A. Configure an internet network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the proxy-only subnet.
B. Configure a zonal network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the client source IPs.
C. Configure a hybrid network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the proxy-only subnet.
D. Configure a Private Service Connect network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the client source IPs.
Show Answer
Correct Answer: C
Explanation: To use an Application Load Balancer with backends located in an on‑premises data center over Dedicated Interconnect without sending traffic over the public internet, you must use a backend type that supports non‑Google Cloud endpoints. Hybrid network endpoint groups (NEGs) are designed specifically for this purpose: they allow you to register on‑premises IP:port endpoints as backends for Google Cloud load balancers. Traffic flows over the private Interconnect/VPN path, and for HTTP(S) load balancing you must allow traffic from the proxy‑only subnet to reach the on‑premises endpoints. Other NEG types (internet, zonal, or PSC) do not meet the requirement of privately referencing on‑premises backends.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.