Professional Cloud Network Engineer Free Practice Questions — Page 3
Question 14
Your company uses VPC firewall rules and denies all egress traffic. You need to allow some VMs to contact external websites based on their fully qualified domain name (FQDN). You apply the new configuration, but the traffic is still denied. You need to adjust your setup to apply the new configuration. What would you do?
A. Raise the priority of the network firewall policy rules.
B. Lower the priority of the network firewall policy rules.
C. Update the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL.
D. Update the default policy and rule evaluation order to AFTER_CLASSIC_FIREWALL.
Show Answer
Correct Answer: C
Explanation: FQDN-based egress filtering is implemented with network firewall policies. If classic VPC firewall rules include a deny-all egress rule, the network firewall policy must be evaluated before the classic firewall rules for the FQDN allow rule to take effect. Setting the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL ensures the FQDN allow is considered before the VPC deny-all egress rule.
Question 15
Your organization has an on-premises data center. You need to provide connectivity from the on-premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?
A. Configure HA VPN by using high availability gateways and tunnels.
B. Configure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.
C. Configure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.
D. Configure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.
Show Answer
Correct Answer: D
Explanation: Partner Interconnect provides private connectivity that does not traverse the public internet and supports bandwidth options including 50 Mbps, 100 Mbps, 200 Mbps, 300 Mbps, 400 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, and 10 Gbps through a supported service provider. HA VPN uses the internet. Cross-Cloud Interconnect is for connecting from other cloud providers. Dedicated Interconnect requires dedicated 10 Gbps or 100 Gbps physical connections rather than a 1 Gbps partner-delivered connection.
Question 16
Your company’s web application was just deployed on Compute Engine VMS in multiple Google Cloud regions. You have created multiple instance groups and you need to distribute traffic between these VMs. You want your users to automatically connect to the backend that is located in the closest region while following Google-recommended practices. What should you do?
A. Create one global external Application Load Balancer and multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
B. Create one global external Application Load Balancer and one backend service with multiple backends. Point each backend to a different instance group.
C. Create two global external Application Load Balancers with one backend service and one backend. Point each back end to a different instance group.
D. Create two global external Application Load Balancers with multiple backend services. Ensure that each backend service contains one backend. Point each backend to a different instance group.
Show Answer
Correct Answer: B
Explanation: A global external Application Load Balancer supports a single backend service with multiple backends, where each backend can be a regional managed instance group. The global load balancer uses Google's global anycast network and routes users to the closest healthy backend based on proximity and capacity. Creating multiple backend services is unnecessary for this use case, and creating multiple global load balancers is not recommended.
Question 17
Your company uses Network Connectivity Center to connect its VPCs in Google Cloud. They plan to connect their on-premises data center to one of these VPCs by using HA VPN. The CIDR range of your on-premises network overlaps with the IP addresses in Google Cloud. You want your VMs in Google Cloud to connect directly to the IP address of the on-premises hosts. What should you do?
A. Configure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud application load balancer.
C. Configure a subnet of purpose REGIONAL_MANAGED_PROXY and use a Google Cloud TCP proxy load balancer.
D. Configure a subnet of purpose PRIVATE_NAT and use Private NAT for the Network Connectivity Center spokes.
E. Configure a subnet of purpose PRIVATE_NAT and use Hybrid NAT.
Show Answer
Correct Answer: D
Explanation: When using Network Connectivity Center with overlapping IP address ranges between Google Cloud VPCs and on-premises networks connected via HA VPN, the supported solution is Private NAT for Network Connectivity Center spokes. This requires a subnet with purpose PRIVATE_NAT and enables NAT between VPC spokes and hybrid spokes (such as HA VPN-connected on-premises networks). REGIONAL_MANAGED_PROXY subnets are for proxy load balancers, and Hybrid NAT is not the feature used in this NCC spoke scenario.
Sources:
https://www.certimaan.com/post/google-cloud-network-engineer-sample-questions
Question 18
Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two VLAN attachments. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?
A. Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Use the existing Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
B. Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
C. Enable MACsec on the VLAN attachments.
D. Enable MACsec on Partner Cloud Interconnect.
Show Answer
Correct Answer: B
Explanation: HA VPN over Cloud Interconnect uses two separate operational tiers. The Cloud Interconnect tier uses a Cloud Router for the VLAN attachments, while the HA VPN tier requires its own Cloud Router for the HA VPN BGP sessions. After creating the HA VPN gateway associated with the VLAN attachments, you create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
Question 19
Your organization wants to deploy an internal application named app-1 in VPC-1. The application will consume services from another internal application named app-2 in VPC-2. VPC Network Peering will connect both applications. You need to apply microsegmentation between these two applications and VPCs. What should you do?
A. Assign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
B. Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a hierarchical firewall policy with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
C. Assign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure an ingress VPC firewall rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
D. Assign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-2. Configure a network firewall policy that is attached to VPC-2 with an ingress rule that allows traffic from secure-tag-app-1 to secure-tag-app-2. Leave the default deny ingress rule and the default allow egress rule.
Show Answer
Correct Answer: D
Explanation: Microsegmentation across VPC Network Peering requires secure tags rather than legacy network tags, because secure tags can be referenced by network firewall policies across peered VPCs. Since the default implied allow egress remains in place, only an ingress allow rule is needed on the destination VPC. Attaching a network firewall policy to VPC-2 with an ingress rule allowing traffic from the secure tag on app-1 to the secure tag on app-2 satisfies the requirement.
Question 20
You are designing the architecture for your organization so that clients can connect to certain Google APIs. Your plan must include a way to connect to Cloud Storage and BigQuery. You also need to ensure the traffic does not traverse the internet. You want your solution to be cloud-first and require the least amount of configuration steps. What should you do?
A. Configure Private Google Access on the VPC resource. Create a default route to the internet.
B. Configure Private Google Access on the subnet resource. Create a default route to the internet.
C. Configure Cloud NAT, and remove the default route to the internet.
D. Configure a global Secure Web Proxy, and remove the default route to the internet.
Show Answer
Correct Answer: B
Explanation: Private Google Access is configured at the subnet level, not the VPC level. It allows VMs without external IP addresses to privately reach supported Google APIs such as Cloud Storage and BigQuery. A default route to the default internet gateway is still required; traffic to Google APIs remains on Google's network and does not traverse the public internet despite using that route.
Question 21
You are configuring the final elements of a migration effort where resources have been moved from on-premises to Google Cloud. While reviewing the deployed architecture, you noticed that DNS resolution is failing when queries are being sent to the on-premises environment. You login to a Compute Engine instance, try to resolve an on-premises hostname, and the query fails. DNS queries are not arriving at the on-premises DNS server. You need to use managed services to reconfigure Cloud DNS to resolve the DNS error. What should you do?
A. Ensure that the operating systems of the Compute Engine instances are configured to send DNS queries to the on-premises DNS servers directly.
B. Validate that there is network connectivity to the on-premises environment and that the Compute Engine instances can reach other on-premises resources. If errors persist, remove the VPC Network Peerings and recreate the peerings after validating the routes.
C. Validate that the Compute Engine instances are using the Metadata Service IP address as their resolver. Configure an outbound forwarding zone for the on-premises domain pointing to the on-premises DNS server. Configure Cloud Router to advertise the Cloud DNS proxy range to the on-premises network.
D. Review the existing Cloud DNS zones, and validate that there is a route in the VPC directing traffic destined to the IP address of the DNS servers. Recreate the existing DNS forwarding zones for . to forward all queries to the on-premises DNS servers.
Show Answer
Correct Answer: C
Explanation: Compute Engine instances should use the Google metadata server (169.254.169.254) for DNS resolution rather than querying on-premises DNS directly. To resolve on-premises names with managed Cloud DNS, configure an outbound forwarding zone for the on-premises domain that forwards queries to the on-premises DNS server, and ensure Cloud Router advertises the Cloud DNS proxy range so return traffic can reach the Cloud DNS forwarding proxies. This is the managed, recommended hybrid DNS configuration.
Question 22
Your organization's security team recently discovered that there is a high risk of malicious activities originating from some of your VMs connected to the internet. These malicious activities are currently undetected when TLS communication is used. You must ensure that encrypted traffic to the internet is inspected. What should you do?
A. Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.
B. Use Cloud NGFW Essentials. Create a firewall rule for egress traffic, and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.
C. Configure a TLS agent on every VM to intercept TLS traffic before it reaches the internet. Configure Sensitive Data Protection to analyze and allow/deny the content.
D. Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the --tls-inspect flag, and associate the firewall rules with the VMs.
Show Answer
Correct Answer: D
Explanation: Cloud NGFW Enterprise supports TLS inspection for egress traffic from VMs using TLS inspection-enabled firewall rules. Cloud Armor protects ingress application traffic at load balancers, not VM egress. Cloud NGFW Essentials does not provide TLS decryption/inspection, and VPC Flow Logs do not inspect encrypted payloads. Deploying custom TLS interception agents on every VM is not the recommended native Google Cloud solution.
Question 23
Your organization is launching a new video game that will be available to all users globally through Cloud CDN. During the earl y release phase, you discovered that the wrong binary version was uploaded from Cloud Storage and cached in Cloud CDN. Thousands of users have downloaded the wrong version. Your marketing department has notified users that this was the wrong version of the game and asked all users to download the updated version using the same URL. You need to ensure users are downloading the updated version of the game. What should you do?
A. Create a security policy to block all Cloud CON requests, review the logs, and filter which users are attempting to download the wrong game binary.
B. Create a new URL path for the updated game binary. Allow the cache to expire automatically through HTTP headers.
C. Upload the updated game binary to Cloud Storage. Invalidate the wrong game binary from the Cloud CDN cache.
D. Disable Cloud CDN. Reconfigure the load balancer with the updated game binary. Enable Cloud CDN.
Show Answer
Correct Answer: C
Explanation: The updated binary should be uploaded to the Cloud Storage origin, and the stale cached object should be invalidated in Cloud CDN. Cache invalidation removes the incorrect object from edge caches so subsequent requests to the same URL fetch the updated binary from the origin. This preserves the existing URL as requested. Creating a new URL changes the download location, blocking requests is unrelated, and disabling Cloud CDN is unnecessary.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.