Professional Cloud Network Engineer Free Practice Questions — Page 5
Question 41
Your organization has a legacy VPN device that uses IKEv1 and does not support BGP. Connectivity from your on-premises environment to Google Cloud needs to be established. You are using 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24 in your on-premises environment, and 192.168.100.0/24, 192.168.101.0/24, and 192.168.102.0/24 in your Google Cloud environment. You have configured a VPN gateway and you need to configure a policy-based VPN tunnel. What should you do?
A. Configure the tunnel with LOCAL_TS set to 172.16.100.0/22 and REMOTE_TS set to 192.168.100.0/22.
B. Configure the tunnel with LOCAL_TS set to 192.168.100.0/22 and REMOTE_TS set to 172.16.100.0/22.
C. Configure the tunnel with LOCAL_TS set to 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24, and REMOTE_TS set to 192.168.100.0/24,192.168.101.0/24, and 192.168.102.0/24.
D. Configure the tunnel with LOCAL_TS set to 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24, and REMOTE_TS set to 0.0.0.0/0.
Show Answer
Correct Answer: B
Explanation: For a policy-based Cloud VPN using IKEv1, only a single local traffic selector and a single remote traffic selector (single CIDR each) are supported. Therefore the three contiguous /24 networks must be summarized into a single /22 on each side. From the Google Cloud VPN perspective, LOCAL_TS refers to the Google Cloud local network (192.168.100.0/22) and REMOTE_TS refers to the on-premises remote network (172.16.100.0/22).
Question 42
Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue. What should you do?
A. Create custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.
B. Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
C. Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.
D. Create custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
Show Answer
Correct Answer: B
Explanation: In a hub-and-spoke architecture using VPC Network Peering, subnet routes from spoke VPCs are not automatically advertised over Cloud Router to on-premises. To make spoke subnets reachable from on-premises through the centralized hub, configure custom route advertisements on the Cloud Router in the hub to advertise the spoke VPC subnet prefixes. BGP route policies are for filtering/manipulating advertised routes but do not by themselves originate the missing spoke subnet advertisements. Custom learned routes are unrelated to advertising local prefixes, and Cloud Routers in spokes are not used for centralized hybrid connectivity in this design.
Question 43
You are implementing hybrid connectivity between your company's data center and Google Cloud. You've already deployed redundant Dedicated Interconnect connections, and are now deploying VLAN attachments in us-central1. You want to use an active/passive approach, where interconnect-1 is active and interconnect-2 is a passive backup. You need to deploy a Cloud Router to enable BGP connectivity. You want to follow Google-recommended practices. What should you do?
A. 1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0 and ASN 65101. 2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200 and ASN 65102. 3. Configure the on-premises ASN as 65000.
B. 1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0. 2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200. 3. Configure both Google-side BGP ASNs as 65100. 4. Configure the on-premises ASN as 65000.
C. 1. Configure the primary and secondary interconnects of the BGP sessions on the Cloud Router with priority 100 and ASN 16550. 2. Configure the on-premises ASN as 65001 for primary interconnect-1. 3. Configure the on-premises ASN as 65002 for secondary interconnect-2.
D. 1. Configure the primary and secondary interconnects of the BGP sessions on the Cloud Router with priority 100 and ASN 4200000001. 2. Configure the on-premises ASN as 4200000010. 3. Disable the BGP session on the on-premises router for the secondary interconnect-2.
Show Answer
Correct Answer: B
Explanation: For an active/passive Dedicated Interconnect design, set a lower Cloud Router advertised route priority on the preferred BGP session (0) and a higher priority on the backup (200). Cloud Router uses the same Google-side BGP ASN (65100) for both BGP sessions on the router, while the on-premises router uses its own private ASN (for example, 65000). Using different Google ASNs per session or disabling the backup BGP session is not the recommended design.
Question 44
Your organization requires that all SMTP traffic to your cloud environment is blocked, except for traffic that originates from your corporate network. Your organization also requires that only specific VPCs across your Google Cloud projects will allow SMTP access from your corporate network. You need to configure a security policy that will enable this connectivity. What should you do?
A. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action. 2. Configure an egress hierarchical firewall rule with priority 10010 specifying the source of your corporate network as TCP port 25 and the goto_next action. 3. Associate the hierarchical firewall policy at the organization level. 4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
B. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the allow action. 2. Associate the hierarchical firewall policy at the organization level. 3. Configure firewall policy rules to deny TCP port 25 in the firewall policies associated with the respective VPCs that do not require that access.
C. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the source of your corporate network, TCP port 25, and the goto_next action. 2. Configure an ingress hierarchical firewall rule with priority 10010 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action. 3. Associate the hierarchical firewall policy at the organization level. 4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
D. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action. 2. Associate the hierarchical firewall policy at the organization level. 3. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
Show Answer
Correct Answer: C
Explanation: Use an organization-level hierarchical ingress firewall policy that sends only the corporate network's SMTP traffic to lower-level evaluation with a higher-priority goto_next rule, then deny all other SMTP traffic with a lower-priority deny rule. At the VPC level, create allow rules only for the specific VPCs that should accept SMTP from the corporate network. This enforces a default block organization-wide while permitting only selected VPCs to opt in.
Question 45
Your company uses web application firewall (WAF) capabilities from a third-party cloud WAF provider. This WAF provider proxies all the HTTPS connections from internet clients, applies security policies, and then opens a new HTTPS connection to the public IP address of your global Application Load Balancer in Google Cloud. Your Google Cloud workloads are the backend of this global Application Load Balancer. Currently, Cloud Am1or is not configured. You need to create a Cloud Armor security policy that blocks sessions that originate from internet clients with source IP addresses that belong to the IP_RANGE_BLOCK IP range. The block must be executed by the Cloud Armor security policy; it will not be done by the third-party cloud WAF provider. Whal should you do?
A. 1. Create a new Cloud Armor network edge security policy. In the policy, set the userIpRequestHeaders[] attribute. 2. Add a policy rule that denies traffic that matches inIpRange(origin.user_ip, 'IP_RANGE_BLOCK') statement. 3. Apply the policy to the backend service that includes all your Google Cloud workloads.
B. 1. Create a new Cloud Armor network edge security policy. In the policy, set the userIpRequestHeaders[] attribute. 2. Add a policy rule that denies traffic that matches the inIpRange(origin.ip, 'IP_RANGE_BLOCK') statement. 3. Apply the policy to the backend service that includes all your Google Cloud workloads.
C. 1. Create a new Cloud Armor backend security policy. In the policy, set the userIpRequestHeaders[] attribute. 2. Add a policy rule that denies traffic that matches the inIpRange(origin.user_ip, 'IP_RANGE_BLOCK') statement. 3. Apply the policy to the backend service that includes all your Google Cloud workloads.
D. 1. Create a new Cloud Armor backend security policy. In the policy, set the userIpRequestHeaders[] attribute. 2. Add a policy rule that denies traffic that matches the inIpRange(origin.ip, 'IP_RANGE_BLOCK') statement. 3. Apply the policy to the backend service that includes all your Google Cloud workloads.
Show Answer
Correct Answer: C
Explanation: Because the third-party WAF terminates the client connection and establishes a new HTTPS connection to the Google Cloud Application Load Balancer, Cloud Armor sees the WAF as the network source IP. To filter based on the original client IP, configure userIpRequestHeaders[] so Cloud Armor extracts the client IP from a trusted forwarded header and use origin.user_ip in the rule (for example, inIpRange(origin.user_ip, 'IP_RANGE_BLOCK')). A global external Application Load Balancer uses a Cloud Armor backend security policy attached to the backend service, not a network edge security policy.
Question 46
Your organization is developing a landing zone architecture with the following requirements:
• There should be no communication possible between production and non-production en-vironments.
• Communication between applications within an environment may be necessary.
• Network administrators should centrally manage all network resources, including subnets, routes, and firewall rules.
• Each application should be billed separately.
• Developers of an application within a project should have the autonomy to create their compute resources. They should not create or modify networking resources.
• Up to 1000 applications are expected per environment.
You need to create a design that accommodates these requirements. What should you do?
A. Create a design that has one Shared VPC host project for the production environment, and another Shared VPC host project for the nonproduction environment. Associate the various applications' service projects with the corresponding environment's host project.
B. Create a design that has a Shared VPC for each project. Implement hierarchical firewall policies to apply micro-segmentation between VPCs.
C. Create a design that implements a single Shared VPUse VPC firewall rules with secure tags to enforce micro-segmentation between environments.
D. Create a design where each project in each environment has its own VPC with its own subnets, routes, and firewall rules. Ensure all VPCs are added as spokes to a Network Connectivity Center hub.
Show Answer
Correct Answer: A
Explanation: Using two Shared VPC host projects—one for production and one for non-production—provides hard network isolation between environments while allowing communication among applications within the same environment. Network administrators retain centralized control of subnets, routes, and firewall rules in the host projects, while each application resides in its own service project for separate billing and developer autonomy over compute resources without network administration. This design also scales to a large number of application service projects.
Question 47
You are implementing a VPC architecture for your organization by using a Network Connectivity Center hub and spoke topology:
• There is one Network Connectivity Center hybrid spoke to receive on-premises routes.
• There is one VPC spoke that needs to be added as a Network Connectivity Center spoke.
Your organization has limited routable IP space for their cloud environment (192.168.0.0/20). The Network Connectivity Center spoke VPC is connected to on-premises with a Cloud Interconnect connection in the us-east4 region. The on-premises IP range is 172.16.0.0/16. You need to reach on-premises resources from multiple Google Cloud regions (us-west1,europe-central1, and asia-southeast1) and minimize the IP addresses being used. What should you do?
A. 1. Configure a Private NAT gateway and NAT subnet in us-west1(192.168.1.0/24), europe-central1(192.168.2.0/24) and asia-southeast1(192.168.3.0/24). 2. Add the VPC as a spoke and configure an export include policy to advertise only 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1 and asia-southeast1 to reach the on-premises location through us-east4.
B. 1. Configure a Private NAT gateway instance in us-west1(172.16.1.0/24), europe-central1(172.16.2.0/24), and asia-southeast1(172.16.3.0/24). 2. Add the VPC as a spoke and configure an export include policy on the VPC spoke to advertise only the NAT subnets 172.16.1.0/24, 172.16.2.0/24, and 172.16.3.0/24 to the hub. 3. Enable global dynamic to allow resources in us-west1, us-central1, and asia-southeast1 to reach the on-premises location through us-east4.
C. 1. Configure a Private NAT gateway instance in us-east4(192.168.1.0/24). 2. Add the VPC as a spoke and configure an export include policy on the VPC spoke to advertise 192.168.1.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1 and asia-southeast1 to reach the on-premises location through us-east4.
D. 1. Configure a Private NAT gateway instance in us-west1(192.168.1.0/24), europe-central1(192.168.2.0/24), and asia-southeast1(192.168.3.0/24). 2. Add the VPC as a spoke and configure an export exclude policy on the VPC spoke to advertise only the NAT subnets 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1, and asia-southeast1 to reach the on-premises location through us-east4.
Show Answer
Correct Answer: A
Explanation: Private NAT for hybrid connectivity should use addresses from the VPC's own RFC1918 space, not the on-premises range. Deploying regional Private NAT gateways in the source regions allows traffic from those regions to be translated before reaching on-premises. Advertising only the NAT subnets with an export include policy minimizes the prefixes shared through the Network Connectivity Center hub, and global dynamic routing allows resources in other regions to use the Cloud Interconnect attachment in us-east4.
Question 48
You are reviewing and tuning Secure Web Proxy at your organization, Mount Kirk Games. Users have reported that they are unable to reach the documents they need on the Terram Earth website (https://www.terramearth.com/docs/*). The Secure Web Proxy rules configuration is as follows:
You need to enable access to these documents. What should you do?
A. Delete the updates-limiter rule.
B. Modify the updates-1 rule to perform the TLS inspection.
C. Review Cloud Logging for errors with Cloud NAT. If there are no errors, assign the VM a public IP address.
D. Modify the priority of the updates-limiter rule to 1000.
Show Answer
Correct Answer: B
Explanation: For HTTPS traffic in Google Cloud Secure Web Proxy, URL/path-based matching requires TLS inspection. If the relevant allow rule does not perform TLS inspection, it is skipped for HTTPS requests, preventing access to paths such as https://www.terramearth.com/docs/*. Enabling TLS inspection on the updates-1 rule allows the proxy to evaluate the HTTPS request and apply the intended rule.
Question 49
Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The compute instances that run these applications have an associated secure tag. What should you do?
A. Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.
B. Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.
C. Deploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
D. Deploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
Show Answer
Correct Answer: D
Explanation: Secure Web Proxy provides URL-level filtering, including hostnames and paths via URL lists and policies. It supports matching source secure tags in proxy policies. Because Secure Web Proxy is a regional service, workloads in multiple regions require a proxy deployment in each region. Cloud NAT with FQDN firewall objects filters by domain, not full URL paths, and does not meet the URL path requirement.
Question 50
Your multi-region VPC has had a long-standing HA VPN configured in "region 1" connected to your corporate network. You are planning to add two 10 Gbps Dedicated Interconnect connections and VLAN attachments in "region 2" to connect to the same corporate network. You need to plan for connectivity between your VPC and corporate network to ensure that traffic uses the Dedicated Interconnect connections as the primary path and the HA VPN as the secondary path. What should you do?
A. Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
B. Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
C. Enable global dynamic routing mode on the VPConfigure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
D. Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
Show Answer
Correct Answer: C
Explanation: Use global dynamic routing so routes learned in one region are available across the multi-region VPC. To prefer Dedicated Interconnect over HA VPN, configure the VLAN attachment BGP sessions with a lower advertised base priority (MED) of 100 and the HA VPN BGP sessions with a higher base priority of 20000. Matching MED behavior on the on-premises routers ensures the Interconnect is the primary path and HA VPN is used as backup.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.