CertBlaze

Google

Professional Cloud Network Engineer Free Practice Questions — Page 4

Question 31

You recently reviewed the user behavior for your main application, which uses an external global Application Load Balancer, and found that the backend servers were overloaded due to erratic spikes in the rate of client requests. You need to limit the concurrent sessions and return an HTTP 429 Too Many Requests response back to the client while following Google-recommended practices. What should you do?

A. Create a Cloud Armor security policy, and associate the policy with the load balancer. Configure the security policy's settings as follows: action: throttle; conform action: allow; exceed action: deny-429.
B. Configure the load balancer to accept only the defined amount of requests per client IP address, increase the backend servers to support more traffic, and redirect traffic to a different backend to burst traffic.
C. Create a Cloud Armor security policy, and apply the predefined Open Worldwide Security Application Project (OWASP) rules to automatically implement the rate limit per client IP address.
D. Configure a VM with Linux, implement the rate limit through iptables, and use a firewall rule to send an HTTP 429 response to the client application.
Show Answer
Correct Answer: A
Explanation:
Google-recommended practice for controlling request spikes on an external global Application Load Balancer is to use Cloud Armor rate limiting. A throttle rule allows requests under the configured threshold (conform action: allow) and, when the threshold is exceeded, can return HTTP 429 using exceed action: deny-429. The OWASP preconfigured rules do not implement rate limiting, and implementing limits on backend VMs or via custom load balancer behavior is not the recommended managed approach.

Question 32

You are troubleshooting an application in your organization's Google Cloud network that is not functioning as expected. You suspect that packets are getting lost somewhere. The application sends packets intermittently at a low volume from a Compute Engine VM to a destination on your on-premises network through a pair of Cloud Interconnect VLAN attachments. You validated that the Cloud Next Generation Firewall (Cloud NGFW) rules do not have any deny statements blocking egress traffic, and you do not have any explicit allow rules. Following Google-recommended practices, you need to analyze the flow to see if packets are being sent correctly out of the VM to isolate the issue. What should you do?

A. Create a packet mirroring policy that is configured with your VM as the source and destined to a collector. Analyze the packet captures.
B. Enable VPC Flow Logs on the subnet that the VM is deployed in with SAMPLE_RATE = 1.0, and run a query in Logs Explorer to analyze the packet flow.
C. Verify the network/attachment/egress_dropped_packets_count Cloud Interconnect VLAN attachment metric.
D. Enable Firewall Rules Logging on your firewall rules and review the logs.
Show Answer
Correct Answer: A
Explanation:
Packet Mirroring is the most appropriate choice for intermittent, low-volume traffic when you need to verify exactly what is leaving the VM. It captures actual packets, allowing deep inspection of headers and payloads to confirm whether packets are transmitted correctly. VPC Flow Logs provide flow metadata rather than packet captures and are subject to flow-log generation behavior, making them less reliable for confirming every intermittent packet. Firewall logging is not useful here because there are no explicit allow rules and firewall logs do not validate packet contents. The Cloud Interconnect dropped-packet metric only indicates drops at the attachment and does not show whether the VM transmitted the packets correctly.

Question 33

Your organization's current architecture has one Shared VPC host project (SH_HOST_PRJ) that contains a single VPC (SH_VPC) and two Shared VPC service projects (SP_ONE_PRJ and SP_TWO_PRJ) that do not contain any VPCs. Each Shared VPC service project belongs to a different team: TEAM_ONE manages SP_ONE_PRJ and TEAM_TWO manages SP_TWO_PRJ. You must design a solution that allows each team to create their own DNS private zones and DNS records only in their respective Shared VPC service projects. Workloads in SP_ONE_PRJ must be able to resolve all the DNS private zones defined in SP_TWO_PRJ and conversely. Your design must have the least amount of set up effort. What should you do?

A. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO creates Cloud DNS private zones and DNS records in SP_TWO_PRJ, and uses cross-project binding to connect the zones to the Shared VPC host project (SH_HOST_PRJ).
B. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO creates DNS private zones and DNS records in SP_TWO_PRJ and uses cross-project binding to connect the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).
C. 1. TEAM_ONE creates a new VPC (SP_ONE_VPC) in the Shared VPC service projects (SP_ONE_PRJ). TEAM_ONE creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the new VPC (SP_ONE_VPC). TEAM_ONE creates a Cloud DNS peering relationship between SP_ONE_VPC and the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO completes the same actions for the SP_TWO_PRJ project.
D. 1. TEAM_ONE creates a new VPC (SP_ONE_VPC) in the Shared VPC service projects (SP_ONE_PRJ). TEAM_ONE creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the new VPC (SP_ONE_VPC). TEAM_ONE creates a VPC Network Peering relationship between SP_ONE_VPC and the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ). 2. TEAM_TWO completes the same actions for the SP_TWO_PRJ project.
Show Answer
Correct Answer: B
Explanation:
Cross-project binding allows private Cloud DNS managed zones to be created in a service project while authorizing a VPC network in another project. Authorization is to a VPC network, not to a project. Binding each team's private zones to the shared VPC (SH_VPC) in the host project makes the zones resolvable by workloads in both Shared VPC service projects attached to that VPC, while allowing each team to manage only its own zones with minimal setup. Options C and D require additional VPCs and peering, adding unnecessary complexity, and A is imprecise because private zones are bound to VPC networks rather than projects.

Question 34

You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. Connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?

A. Enable and review Cloud Logging for Cloud Armor. Look for logs with errors matching the destination IP address of the public SaaS provider.
B. Enable and review Cloud Logging on your Cloud NAT gateway. Look for logs with errors matching the destination IP address of the public SaaS provider.
C. Enable the Firewall Insights API. Set the deny rule insights observation period to one day. Review the insights to assure there are no firewall rules denying traffic.
D. Create a Connectivity Test by using TCP, the source IP address of your test VM, and the destination IP address of the public SaaS provider. Review the live data plane analysis and take the next steps based on the test results.
Show Answer
Correct Answer: B
Explanation:
The most likely Google Cloud-side cause of intermittent TCP failures while ICMP continues to work is Cloud NAT ephemeral port exhaustion or other NAT translation issues during recurring peak traffic. Enabling Cloud NAT logging provides visibility into NAT translations and dropped connections, making it the most useful Google Cloud tool for diagnosing this pattern. Cloud Armor is unrelated unless it is explicitly in the traffic path, Firewall Insights focuses on firewall rule evaluation rather than intermittent NAT behavior, and Connectivity Tests analyze configuration and reachability but are less effective for diagnosing time-based runtime NAT resource exhaustion.

Question 35

You are configuring an Application Load Balancer. The backend resides in your on-premises data center and is connected by Dedicated Interconnect. You need to ensure the load balancer can reference these on-premises resources. You do not want the traffic to traverse the internet at all. What should you do?

A. Configure an internet network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the proxy-only subnet.
B. Configure a zonal network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the client source IPs.
C. Configure a hybrid network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the proxy-only subnet.
D. Configure a Private Service Connect network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the client source IPs.
Show Answer
Correct Answer: C
Explanation:
Hybrid Network Endpoint Groups (NEGs) are designed to represent on-premises or other non-Google Cloud endpoints reachable over hybrid connectivity such as Dedicated Interconnect or Cloud VPN. This allows the Application Load Balancer to send traffic privately without traversing the public internet. For proxy-based Application Load Balancers, the backends must allow traffic from the proxy-only subnet, so firewall rules should permit that source.

Question 36

Your organization has over 250 autonomous business units that currently operate in a decentralized manner. Due to the organization's maturity, there is limited routable private IP address space, which is insufficient to accommodate all of the necessary workloads. You need to create a cloud-first network design that uses the same IP address space across business unit workloads where possible. These business units require communication between units, and access to their on-premises data center. What should you do?

A. Create a hub and spoke model that incorporates VPC Network Peering with hybrid connectivity centralized within the hub.
B. Create a Network Connectivity Center design that incorporates Private NAT to facilitate communication between VPC spokes, and a Routing VPC to exchange dynamic routes from the on-premises environment.
C. Create a Network Connectivity Center design that incorporates Private Service Connect to provide bidirectional communication between VPC spokes, and a Routing VPC to exchange dynamic routes from the on-premises environment.
D. Create a hub and spoke design that incorporates a centralized network virtual appliance (NVA) in the hub to perform routing and NAT between spokes.
Show Answer
Correct Answer: B
Explanation:
Network Connectivity Center is designed for large-scale multi-VPC connectivity. When overlapping RFC1918 address space must be reused across autonomous business units, Private NAT enables communication between overlapping VPCs by translating addresses. A Routing VPC can exchange dynamic routes with the on-premises environment, providing scalable hybrid connectivity. VPC Peering does not support overlapping IP ranges, Private Service Connect is for service publishing/consumption rather than general bidirectional network connectivity between overlapping VPCs, and a centralized NVA is less scalable and not the recommended cloud-first architecture.

Question 37

You have recently taken over responsibility for your organization's Google Cloud network security configurations. You want to review your Cloud Next Generation Firewall (Cloud NGFW) configurations to ensure that there are no rules allowing ingress traffic to your VMs and services from the internet. You want to avoid manual work. What should you do?

A. Export all your Cloud NGFW rules into a CSV file and search for 0.0.0.0/0.
B. Use Firewall Insights, and enable insights for Overly permissive rules.
C. Run Connectivity Tests from multiple external sources to confirm that traffic is not allowed to ingress to your most critical services in Google Cloud.
D. Review Network Analyzer insights on the VPC network category.
Show Answer
Correct Answer: B
Explanation:
Firewall Insights includes an 'Overly permissive rules' insight that automatically identifies firewall rules that are broader than necessary, including ingress rules exposing resources to the internet (such as 0.0.0.0/0). This is the purpose-built, automated way to review Cloud NGFW configurations. Exporting rules is manual, Connectivity Tests validate specific paths rather than auditing all rules, and Network Analyzer provides broader networking insights rather than this targeted firewall-permissiveness analysis.

Question 38

Your organization's application is running on a VPC-native GKE Standard cluster with public IP addresses. You need to configure access to the remote address range 35.100.0.0/16 through Cloud NAT, instead of using the GKE nodes' external IP addresses. SNAT is enabled on the cluster and needs to be configured. What should you do?

A. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Include the 35.100.0.0/16 range in the list.
B. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Remove the 35.100.0.0/16 range from the list.
C. Configure Cloud NAT and create an exclusion rule for any SNAT address translation.
D. Configure Cloud NAT with nonMasqueradeCIDRs, and enable SNAT with the same configuration to allow traffic to 35.100.0.0/16.
Show Answer
Correct Answer: B
Explanation:
To have traffic to 35.100.0.0/16 use Cloud NAT rather than the GKE nodes' external IPs, the destination must not be treated as a non-masquerade CIDR by the ip-masq-agent. Removing 35.100.0.0/16 from nonMasqueradeCIDRs ensures the traffic is not exempted in a way that would bypass the desired Cloud NAT path. Cloud NAT does not use a nonMasqueradeCIDRs setting, and it does not provide SNAT exclusion rules as described in the other options.

Question 39

You are configuring a Cross-Cloud Interconnect connection for your Google Cloud organization with two public cloud service providers (CSPs)–CSP 1 and CSP 2. The CSP 1 and CSP 2 environments are closest to Frankfurt, Germany. You can choose between two common colocation locations, Frankfurt and Munich. Your organization's Google Cloud infrastructure is deployed in the North American region, us-east4, which is located in Virginia, USA. The VPC dynamic routing mode has been set to GLOBAL. Your organization requires 20 Gbps of protected bandwidth with a 99.9% Google Cloud SLA. You want to minimize costs where possible. What should you do?

A. 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
B. 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 20 Gbps of total bandwidth (10 Gbps in zone 1 and 10 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 2. Create two Cross-Cloud Interconnect connections to CSP 2, with 20 Gbps of total bandwidth (10 Gbps in zone 1 and 10 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
C. 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1) in a common co-location facility located in Frankfurt, Germany and (20 Gbps in zone 2) in a common co-location facility located in Munich, Germany. 2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1) in a common co-location facility located in Frankfurt, Germany and (20 Gbps in zone 2) in a common co-location facility located in Munich, Germany. 3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
D. 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 3. Create a Cloud Router in us-east4 (Ashburn, Virginia, USA), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
Show Answer
Correct Answer: A
Explanation:
To provide 20 Gbps of protected bandwidth, each redundant path must be able to carry the full 20 Gbps during a failure, requiring 20 Gbps in each edge availability zone (40 Gbps provisioned total) per CSP. A Cloud Router must be in the same Google Cloud region as the VLAN attachments (europe-west3), and using Frankfurt minimizes cost because both CSPs are closest there. Global dynamic routing makes the routes available to us-east4 without placing the Cloud Router there. Sources: https://cloud.google.com/network-connectivity/docs/interconnect/concepts/cross-site-locations https://cloud.google.com/network-connectivity/docs/interconnect/how-to

Question 40

Your organization deployed a mission critical application that is expected to be a new revenue source. As part of the planning and deployment process, you have recently implemented a security profile with the default set of threat signatures provided by Cloud Next Generation Firewall (Cloud NGFW). This application is the only application running on this project. You need to increase the security posture of the application to log the threat and drop the related packets. What should you do?

A. Configure a new default threat signature with Deny All to all severity options. Review the logs to understand the impact.
B. Set up a Linux VM as the frontend gateway for the application. Create iptables rules to drop all packets, excluding the application port.
C. For all severity options (critical, high, medium, low and informational) in the security profile, change the default override action to Deny.
D. Configure Cloud Scheduler to run a task that checks the Cloud NGFW logs to verify the threats. Configure the task to create a security profile with each signature ID set to override the default action.
Show Answer
Correct Answer: C
Explanation:
Cloud NGFW threat prevention profiles allow overriding the default action by severity. Changing the override action to Deny for each severity causes matching threats to be logged and the associated packets dropped, which directly satisfies the requirement to increase the security posture. The other options either describe unsupported configuration concepts or introduce unnecessary components rather than using the existing security profile.

$19

Get all 251 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full Professional Cloud Network Engineer study guide →