Professional Cloud Network Engineer Free Practice Questions — Page 4
Question 24
Your organization has implemented Vertex AI online prediction in your Google Cloud environment, which is in the us-central1 region. Online prediction is available through private services access by using the IP CIDR range of 172.16.53.0/24. You need to configure access to Vertex AI without affecting the existing routes. You want to use the VLAN attachments that are located in the us-west1 region as primary. The interconnect VLAN attachments in the us-west2 region can only be used as a backup. What should you do?
A. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24.
B. Create a custom learned route on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
C. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
D. Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 200.
Show Answer
Correct Answer: C
Explanation: To steer traffic to Vertex AI Private Services Access without changing existing routing, advertise only the specific PSA prefix (172.16.53.0/24) over the Cloud Interconnect VLAN attachments. Use custom route advertisements and set a lower advertised BGP route priority (100) on the primary us-west1 attachments and a higher priority (200) on the backup us-west2 attachments. Google Cloud uses advertised route priority to influence path selection. Custom learned routes are not applicable here, and MED route policies are not the intended mechanism for this design.
Question 25
Your organization mandates that all internal IP addresses used by all database VMs must be statically allocated. While analyzing your VPC IP address allocations, you observed that the database VMs do not have static IP addresses. You need to configure the VPC to follow your organization's mandate without causing any disruption to current operations. What should you do?
A. Promote the internal IP addresses to static assignments for all database VMs.
B. Create a firewall rule to allow only traffic to the IP addresses allocated to your database VMs.
C. Define a maintenance window to shut down the database VMs one at a time, promote the internal IP address to a static assignment, and restart the VM.
D. Define an organization policy to allow only statically allocated IP addresses for VMs. Ensure the prefix matches your database VMs.
Show Answer
Correct Answer: A
Explanation: Internal IP addresses on Google Compute Engine can be promoted from ephemeral to static without changing the assigned address or requiring VM downtime. This satisfies the requirement that database VMs use statically allocated internal IPs while avoiding disruption. Firewall rules do not change IP allocation, shutting down VMs is unnecessary for promotion, and there is no organization policy that retroactively enforces static internal IP assignment by VM prefix in the manner described.
Question 26
You are configuring HA VPN for your organization to connect your on-premises environment to your Google Cloud network. Your on-premises environment is closest to the us-west1 Google Cloud region. You have Google Cloud resources in us-west2, which requires a throughput of 300,000 packets per second (PPS) and an approximate bandwidth of 4 Gbps. You need to have predictable bandwidth management and maintain an SLA of 99.99% with minimal costs. What should you do?
A. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 200. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
B. Create two HA VPN gateways, each with two tunnels. Configure BGP on each of the gateways' tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the same corresponding multi-exit discriminator (MED) value.
C. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
D. Create an HA VPN gateway with four tunnels. Configure BGP on four tunnels with tunnel 0 configured with a base routing priority metric of 100, tunnel 1 with a base routing priority metric of 200, tunnel 2 with a base routing priority of 300, and tunnel 3 with a base routing priority of 400. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
Show Answer
Correct Answer: C
Explanation: An HA VPN gateway provides two tunnels and achieves the 99.99% SLA when both are configured. Each tunnel supports up to about 3 Gbps and 250,000 PPS, so two active tunnels are sufficient for the stated requirement of approximately 4 Gbps and 300,000 PPS using ECMP with equal BGP routing priority. Using equal base routing priorities (MED) allows traffic to be balanced across both tunnels while minimizing cost. Option A prefers one tunnel instead of balancing, B adds an unnecessary second HA VPN gateway, and D is not a valid HA VPN gateway configuration.
Question 27
You are implementing a Shared VPC network for your organization, which has distributed teams. One of the application developers works across several teams and notices that they can deploy applications in subnets that are reserved for another application's service projects. You want to ensure that developers can only deploy resources in the subnets that are reserved for their respective service project. What should you do?
A. Specify which Shared VPC subnets each application's service projects can access by using the constraints/compute.restrictSharedVpcSubnetworks organizational constraint.
B. Grant the compute.NetworkViewer role to the developer in the Shared VPC host project.
C. Restrict another application's project from accessing specific subnets in the host project by using the constraints/compute.restrictSharedVpcHostProject organizational constraint.
D. Grant the compute.NetworkUser role to the developer in the specific Shared VPC service project.
Show Answer
Correct Answer: A
Explanation: The correct control is the Organization Policy constraint `constraints/compute.restrictSharedVpcSubnetworks`, which restricts which Shared VPC subnets each service project can use. This enforces that developers deploying within a service project can only attach resources to the designated subnets. `compute.NetworkViewer` is read-only, `compute.NetworkUser` grants permission to use networks but does not restrict subnet selection, and `constraints/compute.restrictSharedVpcHostProject` limits which host projects may be used rather than which subnets within a host project are accessible.
Question 28
Your organization has a highly available application that is not HTTP-based. The application runs on multiple TCP ports and is hosted in multiple regions. You need to design a solution to load balance the application in the same Shared VPC where the service will be accessed. The IP address header must contain the client's true source IP address. No public internet access is required. What should you do?
A. Configure multiple regional internal proxy Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
B. Configure multiple regional internal Application Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
C. Configure a single cross region internal proxy Network Load Balancer.
D. Configure multiple regional internal passthrough Network Load Balancers and enable global access. Use DNS routing policies to balance traffic across regions.
Show Answer
Correct Answer: D
Explanation: The application is non-HTTP and uses multiple TCP ports, so Layer 4 load balancing is required. The client's true source IP must be preserved, which internal passthrough Network Load Balancers provide; proxy load balancers do not preserve the original source IP to backends. Because the deployment spans multiple regions and there is no single cross-region internal passthrough load balancer, deploy regional internal passthrough Network Load Balancers with global access enabled and use Cloud DNS routing policies to distribute traffic across regions. Internal Application Load Balancers are HTTP(S)-based and therefore unsuitable.
Question 29
You plan to deploy Google Cloud Armor web application firewall (WAF) policies that use the preconfigured WAF rules. You want all Google Cloud Armor logs to be sent to Cloud Logging with the highest level of detail possible. You have enabled Cloud Load Balancing logs for all the backend services where Cloud Armor WAF policies are applied. What should you do?
A. Set the sample rate of the Cloud Load Balancing logs to 0.5.
B. Set the Google Cloud Armor logging option to VERBOSE.
C. Enable Google Cloud Armor logging for all the backend services where Cloud Armor WAF policies are applied. Set the Google Cloud Armor logging option to VERBOSE.
D. Set the sample rate of the Cloud Load Balancing logs to 1.0.
Show Answer
Correct Answer: B
Explanation: Cloud Armor request logging is included with Cloud Load Balancing logging. The question states that Cloud Load Balancing logging is already enabled for all relevant backend services. To obtain the highest level of detail for preconfigured WAF rule logs, configure the Google Cloud Armor logging option to VERBOSE. Changing the load balancer log sample rate affects log sampling, not the verbosity of Cloud Armor log fields, and enabling logging again is redundant because it is already enabled.
Question 30
As part of your organization's modernization efforts, the application teams are migrating services to GKE on Google Cloud (GKE). The GKE clusters will live in service projects. The teams have validated the applications and configurations in their sandbox projects. When moving to production, you noticed that GKE nodes were not being created. Users were able to create Compute Engine instances, but the operation failed when they tried to create a GKE cluster. You need to enable the application teams so they can create said GKE clusters. What should you do?
A. Ensure that the service project's GKE service account has the compute.securityAdmin, container.hostServiceAgentUser and compute.networkUser IAM permissions in the host project.
B. Ensure that the service project's GKE service account has the compute.securityAdmin, container.hostserviceAgentUser and compute.networkUser IAM permissions in the service project.
C. Ensure that the service project's GKE service account has the compute.networkUser IAM permission in the service project.
D. Review the firewall rules configuration in the VPC. Identify what rule is blocking node creation.
Show Answer
Correct Answer: A
Explanation: In a Shared VPC deployment, GKE clusters in service projects use the host project's network. The GKE service account from the service project must be granted the required roles in the host project, including compute.networkUser, container.hostServiceAgentUser, and compute.securityAdmin, so GKE can create and manage node instances, firewall rules, and networking resources. Granting these roles only in the service project is insufficient, and a firewall issue would not explain the missing IAM permissions required for node creation.
Question 31
You recently reviewed the user behavior for your main application, which uses an external global Application Load Balancer, and found that the backend servers were overloaded due to erratic spikes in the rate of client requests. You need to limit the concurrent sessions and return an HTTP 429 Too Many Requests response back to the client while following Google-recommended practices. What should you do?
A. Create a Cloud Armor security policy, and associate the policy with the load balancer. Configure the security policy's settings as follows: action: throttle; conform action: allow; exceed action: deny-429.
B. Configure the load balancer to accept only the defined amount of requests per client IP address, increase the backend servers to support more traffic, and redirect traffic to a different backend to burst traffic.
C. Create a Cloud Armor security policy, and apply the predefined Open Worldwide Security Application Project (OWASP) rules to automatically implement the rate limit per client IP address.
D. Configure a VM with Linux, implement the rate limit through iptables, and use a firewall rule to send an HTTP 429 response to the client application.
Show Answer
Correct Answer: A
Explanation: Google-recommended practice for controlling request spikes on an external global Application Load Balancer is to use Cloud Armor rate limiting. A throttle rule allows requests under the configured threshold (conform action: allow) and, when the threshold is exceeded, can return HTTP 429 using exceed action: deny-429. The OWASP preconfigured rules do not implement rate limiting, and implementing limits on backend VMs or via custom load balancer behavior is not the recommended managed approach.
Question 32
You are troubleshooting an application in your organization's Google Cloud network that is not functioning as expected. You suspect that packets are getting lost somewhere. The application sends packets intermittently at a low volume from a Compute Engine VM to a destination on your on-premises network through a pair of Cloud Interconnect VLAN attachments. You validated that the Cloud Next Generation Firewall (Cloud NGFW) rules do not have any deny statements blocking egress traffic, and you do not have any explicit allow rules. Following Google-recommended practices, you need to analyze the flow to see if packets are being sent correctly out of the VM to isolate the issue. What should you do?
A. Create a packet mirroring policy that is configured with your VM as the source and destined to a collector. Analyze the packet captures.
B. Enable VPC Flow Logs on the subnet that the VM is deployed in with SAMPLE_RATE = 1.0, and run a query in Logs Explorer to analyze the packet flow.
C. Verify the network/attachment/egress_dropped_packets_count Cloud Interconnect VLAN attachment metric.
D. Enable Firewall Rules Logging on your firewall rules and review the logs.
Show Answer
Correct Answer: A
Explanation: Packet Mirroring is the most appropriate choice for intermittent, low-volume traffic when you need to verify exactly what is leaving the VM. It captures actual packets, allowing deep inspection of headers and payloads to confirm whether packets are transmitted correctly. VPC Flow Logs provide flow metadata rather than packet captures and are subject to flow-log generation behavior, making them less reliable for confirming every intermittent packet. Firewall logging is not useful here because there are no explicit allow rules and firewall logs do not validate packet contents. The Cloud Interconnect dropped-packet metric only indicates drops at the attachment and does not show whether the VM transmitted the packets correctly.
Question 33
Your organization's current architecture has one Shared VPC host project (SH_HOST_PRJ) that contains a single VPC (SH_VPC) and two Shared VPC service projects (SP_ONE_PRJ and SP_TWO_PRJ) that do not contain any VPCs. Each Shared VPC service project belongs to a different team: TEAM_ONE manages SP_ONE_PRJ and TEAM_TWO manages SP_TWO_PRJ.
You must design a solution that allows each team to create their own DNS private zones and DNS records only in their respective Shared VPC service projects. Workloads in SP_ONE_PRJ must be able to resolve all the DNS private zones defined in SP_TWO_PRJ and conversely. Your design must have the least amount of set up effort. What should you do?
A. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO creates Cloud DNS private zones and DNS records in SP_TWO_PRJ, and uses cross-project binding to connect the zones to the Shared VPC host project (SH_HOST_PRJ).
B. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO creates DNS private zones and DNS records in SP_TWO_PRJ and uses cross-project binding to connect the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).
C. 1. TEAM_ONE creates a new VPC (SP_ONE_VPC) in the Shared VPC service projects (SP_ONE_PRJ). TEAM_ONE creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the new VPC (SP_ONE_VPC). TEAM_ONE creates a Cloud DNS peering relationship between SP_ONE_VPC and the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO completes the same actions for the SP_TWO_PRJ project.
D. 1. TEAM_ONE creates a new VPC (SP_ONE_VPC) in the Shared VPC service projects (SP_ONE_PRJ). TEAM_ONE creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the new VPC (SP_ONE_VPC). TEAM_ONE creates a VPC Network Peering relationship between SP_ONE_VPC and the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO completes the same actions for the SP_TWO_PRJ project.
Show Answer
Correct Answer: B
Explanation: Cross-project binding allows private Cloud DNS managed zones to be created in a service project while authorizing a VPC network in another project. Authorization is to a VPC network, not to a project. Binding each team's private zones to the shared VPC (SH_VPC) in the host project makes the zones resolvable by workloads in both Shared VPC service projects attached to that VPC, while allowing each team to manage only its own zones with minimal setup. Options C and D require additional VPCs and peering, adding unnecessary complexity, and A is imprecise because private zones are bound to VPC networks rather than projects.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.