Professional Cloud Network Engineer Free Practice Questions — Page 3
Question 21
You are configuring the final elements of a migration effort where resources have been moved from on-premises to Google Cloud. While reviewing the deployed architecture, you noticed that DNS resolution is failing when queries are being sent to the on-premises environment. You login to a Compute Engine instance, try to resolve an on-premises hostname, and the query fails. DNS queries are not arriving at the on-premises DNS server. You need to use managed services to reconfigure Cloud DNS to resolve the DNS error. What should you do?
A. Ensure that the operating systems of the Compute Engine instances are configured to send DNS queries to the on-premises DNS servers directly.
B. Validate that there is network connectivity to the on-premises environment and that the Compute Engine instances can reach other on-premises resources. If errors persist, remove the VPC Network Peerings and recreate the peerings after validating the routes.
C. Validate that the Compute Engine instances are using the Metadata Service IP address as their resolver. Configure an outbound forwarding zone for the on-premises domain pointing to the on-premises DNS server. Configure Cloud Router to advertise the Cloud DNS proxy range to the on-premises network.
D. Review the existing Cloud DNS zones, and validate that there is a route in the VPC directing traffic destined to the IP address of the DNS servers. Recreate the existing DNS forwarding zones for . to forward all queries to the on-premises DNS servers.
Show Answer
Correct Answer: C
Explanation: Compute Engine instances should use the Google metadata server (169.254.169.254) for DNS resolution rather than querying on-premises DNS directly. To resolve on-premises names with managed Cloud DNS, configure an outbound forwarding zone for the on-premises domain that forwards queries to the on-premises DNS server, and ensure Cloud Router advertises the Cloud DNS proxy range so return traffic can reach the Cloud DNS forwarding proxies. This is the managed, recommended hybrid DNS configuration.
Question 22
Your organization's security team recently discovered that there is a high risk of malicious activities originating from some of your VMs connected to the internet. These malicious activities are currently undetected when TLS communication is used. You must ensure that encrypted traffic to the internet is inspected. What should you do?
A. Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.
B. Use Cloud NGFW Essentials. Create a firewall rule for egress traffic, and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.
C. Configure a TLS agent on every VM to intercept TLS traffic before it reaches the internet. Configure Sensitive Data Protection to analyze and allow/deny the content.
D. Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the --tls-inspect flag, and associate the firewall rules with the VMs.
Show Answer
Correct Answer: D
Explanation: Cloud NGFW Enterprise supports TLS inspection for egress traffic from VMs using TLS inspection-enabled firewall rules. Cloud Armor protects ingress application traffic at load balancers, not VM egress. Cloud NGFW Essentials does not provide TLS decryption/inspection, and VPC Flow Logs do not inspect encrypted payloads. Deploying custom TLS interception agents on every VM is not the recommended native Google Cloud solution.
Question 23
Your organization is launching a new video game that will be available to all users globally through Cloud CDN. During the earl y release phase, you discovered that the wrong binary version was uploaded from Cloud Storage and cached in Cloud CDN. Thousands of users have downloaded the wrong version. Your marketing department has notified users that this was the wrong version of the game and asked all users to download the updated version using the same URL. You need to ensure users are downloading the updated version of the game. What should you do?
A. Create a security policy to block all Cloud CON requests, review the logs, and filter which users are attempting to download the wrong game binary.
B. Create a new URL path for the updated game binary. Allow the cache to expire automatically through HTTP headers.
C. Upload the updated game binary to Cloud Storage. Invalidate the wrong game binary from the Cloud CDN cache.
D. Disable Cloud CDN. Reconfigure the load balancer with the updated game binary. Enable Cloud CDN.
Show Answer
Correct Answer: C
Explanation: The updated binary should be uploaded to the Cloud Storage origin, and the stale cached object should be invalidated in Cloud CDN. Cache invalidation removes the incorrect object from edge caches so subsequent requests to the same URL fetch the updated binary from the origin. This preserves the existing URL as requested. Creating a new URL changes the download location, blocking requests is unrelated, and disabling Cloud CDN is unnecessary.
Question 24
Your organization has implemented Vertex AI online prediction in your Google Cloud environment, which is in the us-central1 region. Online prediction is available through private services access by using the IP CIDR range of 172.16.53.0/24. You need to configure access to Vertex AI without affecting the existing routes. You want to use the VLAN attachments that are located in the us-west1 region as primary. The interconnect VLAN attachments in the us-west2 region can only be used as a backup. What should you do?
A. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24.
B. Create a custom learned route on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
C. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
D. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 200.
Show Answer
Correct Answer: C
Explanation: To steer traffic to Vertex AI Private Services Access without changing existing routing, advertise only the specific PSA prefix (172.16.53.0/24) over the Cloud Interconnect VLAN attachments. Use custom route advertisements and set a lower advertised BGP route priority (100) on the primary us-west1 attachments and a higher priority (200) on the backup us-west2 attachments. Google Cloud uses advertised route priority to influence path selection. Custom learned routes are not applicable here, and MED route policies are not the intended mechanism for this design.
Question 25
Your organization mandates that all internal IP addresses used by all database VMs must be statically allocated. While analyzing your VPC IP address allocations, you observed that the database VMs do not have static IP addresses. You need to configure the VPC to follow your organization's mandate without causing any disruption to current operations. What should you do?
A. Promote the internal IP addresses to static assignments for all database VMs.
B. Create a firewall rule to allow only traffic to the IP addresses allocated to your database VMs.
C. Define a maintenance window to shut down the database VMs one at a time, promote the internal IP address to a static assignment, and restart the VM.
D. Define an organization policy to allow only statically allocated IP addresses for VMs. Ensure the prefix matches your database VMs.
Show Answer
Correct Answer: A
Explanation: Internal IP addresses on Google Compute Engine can be promoted from ephemeral to static without changing the assigned address or requiring VM downtime. This satisfies the requirement that database VMs use statically allocated internal IPs while avoiding disruption. Firewall rules do not change IP allocation, shutting down VMs is unnecessary for promotion, and there is no organization policy that retroactively enforces static internal IP assignment by VM prefix in the manner described.
Question 26
You are configuring HA VPN for your organization to connect your on-premises environment to your Google Cloud network. Your on-premises environment is closest to the us-west1 Google Cloud region. You have Google Cloud resources in us-west2, which requires a throughput of 300,000 packets per second (PPS) and an approximate bandwidth of 4 Gbps. You need to have predictable bandwidth management and maintain an SLA of 99.99% with minimal costs. What should you do?
A. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 200. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
B. Create two HA VPN gateways, each with two tunnels. Configure BGP on each of the gateways' tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the same corresponding multi-exit discriminator (MED) value.
C. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
D. Create an HA VPN gateway with four tunnels. Configure BGP on four tunnels with tunnel 0 configured with a base routing priority metric of 100, tunnel 1 with a base routing priority metric of 200, tunnel 2 with a base routing priority of 300, and tunnel 3 with a base routing priority of 400. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
Show Answer
Correct Answer: C
Explanation: An HA VPN gateway provides two tunnels and achieves the 99.99% SLA when both are configured. Each tunnel supports up to about 3 Gbps and 250,000 PPS, so two active tunnels are sufficient for the stated requirement of approximately 4 Gbps and 300,000 PPS using ECMP with equal BGP routing priority. Using equal base routing priorities (MED) allows traffic to be balanced across both tunnels while minimizing cost. Option A prefers one tunnel instead of balancing, B adds an unnecessary second HA VPN gateway, and D is not a valid HA VPN gateway configuration.
Question 27
You are implementing a Shared VPC network for your organization, which has distributed teams. One of the application developers works across several teams and notices that they can deploy applications in subnets that are reserved for another application's service projects. You want to ensure that developers can only deploy resources in the subnets that are reserved for their respective service project. What should you do?
A. Specify which Shared VPC subnets each application's service projects can access by using the constraints/compute.restrictSharedVpcSubnetworks organizational constraint.
B. Grant the compute.NetworkViewer role to the developer in the Shared VPC host project.
C. Restrict another application's project from accessing specific subnets in the host project by using the constraints/compute.restrictSharedVpcHostProject organizational constraint.
D. Grant the compute.NetworkUser role to the developer in the specific Shared VPC service project.
Show Answer
Correct Answer: A
Explanation: The correct control is the Organization Policy constraint `constraints/compute.restrictSharedVpcSubnetworks`, which restricts which Shared VPC subnets each service project can use. This enforces that developers deploying within a service project can only attach resources to the designated subnets. `compute.NetworkViewer` is read-only, `compute.NetworkUser` grants permission to use networks but does not restrict subnet selection, and `constraints/compute.restrictSharedVpcHostProject` limits which host projects may be used rather than which subnets within a host project are accessible.
Question 28
Your organization has a highly available application that is not HTTP-based. The application runs on multiple TCP ports and is hosted in multiple regions. You need to design a solution to load balance the application in the same Shared VPC where the service will be accessed. The IP address header must contain the client's true source IP address. No public internet access is required. What should you do?
A. Configure multiple regional internal proxy Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
B. Configure multiple regional internal Application Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
C. Configure a single cross region internal proxy Network Load Balancer.
D. Configure multiple regional internal passthrough Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
Show Answer
Correct Answer: D
Explanation: The application is non-HTTP and uses multiple TCP ports, so Layer 4 load balancing is required. The client's true source IP must be preserved, which internal passthrough Network Load Balancers provide; proxy load balancers do not preserve the original source IP to backends. Because the deployment spans multiple regions and there is no single cross-region internal passthrough load balancer, deploy regional internal passthrough Network Load Balancers with global access enabled and use Cloud DNS routing policies to distribute traffic across regions. Internal Application Load Balancers are HTTP(S)-based and therefore unsuitable.
Question 29
You plan to deploy Google Cloud Armor web application firewall (WAF) policies that use the preconfigured WAF rules. You want all Google Cloud Armor logs to be sent to Cloud Logging with the highest level of detail possible. You have enabled Cloud Load Balancing logs for all the backend services where Cloud Armor WAF policies are applied. What should you do?
A. Set the sample rate of the Cloud Load Balancing logs to 0.5.
B. Set the Google Cloud Armor logging option to VERBOSE.
C. Enable Google Cloud Armor logging for all the backend services where Cloud Armor WAF policies are applied. Set the Google Cloud Armor logging option to VERBOSE.
D. Set the sample rate of the Cloud Load Balancing logs to 1.0.
Show Answer
Correct Answer: B
Explanation: Cloud Armor request logging is included with Cloud Load Balancing logging. The question states that Cloud Load Balancing logging is already enabled for all relevant backend services. To obtain the highest level of detail for preconfigured WAF rule logs, configure the Google Cloud Armor logging option to VERBOSE. Changing the load balancer log sample rate affects log sampling, not the verbosity of Cloud Armor log fields, and enabling logging again is redundant because it is already enabled.
Question 30
As part of your organization's modernization efforts, the application teams are migrating services to GKE on Google Cloud (GKE). The GKE clusters will live in service projects. The teams have validated the applications and configurations in their sandbox projects. When moving to production, you noticed that GKE nodes were not being created. Users were able to create Compute Engine instances, but the operation failed when they tried to create a GKE cluster. You need to enable the application teams so they can create said GKE clusters. What should you do?
A. Ensure that the service project's GKE service account has the compute.securityAdmin, container.hostServiceAgentUser and compute.networkUser IAM permissions in the host project.
B. Ensure that the service project's GKE service account has the compute.securityAdmin, container.hostserviceAgentUser and compute.networkUser IAM permissions in the service project.
C. Ensure that the service project's GKE service account has the compute.networkUser IAM permission in the service project.
D. Review the firewall rules configuration in the VPC. Identify what rule is blocking node creation.
Show Answer
Correct Answer: A
Explanation: In a Shared VPC deployment, GKE clusters in service projects use the host project's network. The GKE service account from the service project must be granted the required roles in the host project, including compute.networkUser, container.hostServiceAgentUser, and compute.securityAdmin, so GKE can create and manage node instances, firewall rules, and networking resources. Granting these roles only in the service project is insufficient, and a firewall issue would not explain the missing IAM permissions required for node creation.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.