CertBlaze

Google

Professional Cloud Network Engineer Free Practice Questions — Page 5

Question 34

You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. Connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?

A. Enable and review Cloud Logging for Cloud Armor. Look for logs with errors matching the destination IP address of the public SaaS provider.
B. Enable and review Cloud Logging on your Cloud NAT gateway. Look for logs with errors matching the destination IP address of the public SaaS provider.
C. Enable the Firewall Insights API. Set the deny rule insights observation period to one day. Review the insights to assure there are no firewall rules denying traffic.
D. Create a Connectivity Test by using TCP, the source IP address of your test VM, and the destination IP address of the public SaaS provider. Review the live data plane analysis and take the next steps based on the test results.
Show Answer
Correct Answer: B
Explanation:
The most likely Google Cloud-side cause of intermittent TCP failures while ICMP continues to work is Cloud NAT ephemeral port exhaustion or other NAT translation issues during recurring peak traffic. Enabling Cloud NAT logging provides visibility into NAT translations and dropped connections, making it the most useful Google Cloud tool for diagnosing this pattern. Cloud Armor is unrelated unless it is explicitly in the traffic path, Firewall Insights focuses on firewall rule evaluation rather than intermittent NAT behavior, and Connectivity Tests analyze configuration and reachability but are less effective for diagnosing time-based runtime NAT resource exhaustion.

Question 35

You are configuring an Application Load Balancer. The backend resides in your on-premises data center and is connected by Dedicated Interconnect. You need to ensure the load balancer can reference these on-premises resources. You do not want the traffic to traverse the internet at all. What should you do?

A. Configure an internet network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the proxy-only subnet.
B. Configure a zonal network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the client source IPs.
C. Configure a hybrid network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the proxy-only subnet.
D. Configure a Private Service Connect network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the client source IPs.
Show Answer
Correct Answer: C
Explanation:
Hybrid Network Endpoint Groups (NEGs) are designed to represent on-premises or other non-Google Cloud endpoints reachable over hybrid connectivity such as Dedicated Interconnect or Cloud VPN. This allows the Application Load Balancer to send traffic privately without traversing the public internet. For proxy-based Application Load Balancers, the backends must allow traffic from the proxy-only subnet, so firewall rules should permit that source.

Question 36

Your organization has over 250 autonomous business units that currently operate in a decentralized manner. Due to the organization's maturity, there is limited routable private IP address space, which is insufficient to accommodate all of the necessary workloads. You need to create a cloud-first network design that uses the same IP address space across business unit workloads where possible. These business units require communication between units, and access to their on-premises data center. What should you do?

A. Create a hub and spoke model that incorporates VPC Network Peering with hybrid connectivity centralized within the hub.
B. Create a Network Connectivity Center design that incorporates Private NAT to facilitate communication between VPC spokes, and a Routing VPC to exchange dynamic routes from the on-premises environment.
C. Create a Network Connectivity Center design that incorporates Private Service Connect to provide bidirectional communication between VPC spokes, and a Routing VPC to exchange dynamic routes from the on-premises environment.
D. Create a hub and spoke design that incorporates a centralized network virtual appliance (NVA) in the hub to perform routing and NAT between spokes.
Show Answer
Correct Answer: B
Explanation:
Network Connectivity Center is designed for large-scale multi-VPC connectivity. When overlapping RFC1918 address space must be reused across autonomous business units, Private NAT enables communication between overlapping VPCs by translating addresses. A Routing VPC can exchange dynamic routes with the on-premises environment, providing scalable hybrid connectivity. VPC Peering does not support overlapping IP ranges, Private Service Connect is for service publishing/consumption rather than general bidirectional network connectivity between overlapping VPCs, and a centralized NVA is less scalable and not the recommended cloud-first architecture.

Question 37

You have recently taken over responsibility for your organization's Google Cloud network security configurations. You want to review your Cloud Next Generation Firewall (Cloud NGFW) configurations to ensure that there are no rules allowing ingress traffic to your VMs and services from the internet. You want to avoid manual work. What should you do?

A. Export all your Cloud NGFW rules into a CSV file and search for 0.0.0.0/0.
B. Use Firewall Insights, and enable insights for Overly permissive rules.
C. Run Connectivity Tests from multiple external sources to confirm that traffic is not allowed to ingress to your most critical services in Google Cloud.
D. Review Network Analyzer insights on the VPC network category.
Show Answer
Correct Answer: B
Explanation:
Firewall Insights includes an 'Overly permissive rules' insight that automatically identifies firewall rules that are broader than necessary, including ingress rules exposing resources to the internet (such as 0.0.0.0/0). This is the purpose-built, automated way to review Cloud NGFW configurations. Exporting rules is manual, Connectivity Tests validate specific paths rather than auditing all rules, and Network Analyzer provides broader networking insights rather than this targeted firewall-permissiveness analysis.

Question 38

Your organization's application is running on a VPC-native GKE Standard cluster with public IP addresses. You need to configure access to the remote address range 35.100.0.0/16 through Cloud NAT, instead of using the GKE nodes' external IP addresses. SNAT is enabled on the cluster and needs to be configured. What should you do?

A. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Include the 35.100.0.0/16 range in the list.
B. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Remove the 35.100.0.0/16 range from the list.
C. Configure Cloud NAT and create an exclusion rule for any SNAT address translation.
D. Configure Cloud NAT with nonMasqueradeCIDRs, and enable SNAT with the same configuration to allow traffic to 35.100.0.0/16.
Show Answer
Correct Answer: B
Explanation:
To have traffic to 35.100.0.0/16 use Cloud NAT rather than the GKE nodes' external IPs, the destination must not be treated as a non-masquerade CIDR by the ip-masq-agent. Removing 35.100.0.0/16 from nonMasqueradeCIDRs ensures the traffic is not exempted in a way that would bypass the desired Cloud NAT path. Cloud NAT does not use a nonMasqueradeCIDRs setting, and it does not provide SNAT exclusion rules as described in the other options.

Question 39

You are configuring a Cross-Cloud Interconnect connection for your Google Cloud organization with two public cloud service providers (CSPs)–CSP 1 and CSP 2. The CSP 1 and CSP 2 environments are closest to Frankfurt, Germany. You can choose between two common colocation locations, Frankfurt and Munich. Your organization's Google Cloud infrastructure is deployed in the North American region, us-east4, which is located in Virginia, USA. The VPC dynamic routing mode has been set to GLOBAL. Your organization requires 20 Gbps of protected bandwidth with a 99.9% Google Cloud SLA. You want to minimize costs where possible. What should you do?

A. 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
B. 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 20 Gbps of total bandwidth (10 Gbps in zone 1 and 10 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 2. Create two Cross-Cloud Interconnect connections to CSP 2, with 20 Gbps of total bandwidth (10 Gbps in zone 1 and 10 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
C. 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1) in a common co-location facility located in Frankfurt, Germany and (20 Gbps in zone 2) in a common co-location facility located in Munich, Germany. 2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1) in a common co-location facility located in Frankfurt, Germany and (20 Gbps in zone 2) in a common co-location facility located in Munich, Germany. 3. Create a Cloud Router in europe-west3 (Frankfurt), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
D. 1. Create two Cross-Cloud Interconnect connections to CSP 1, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 2. Create two Cross-Cloud Interconnect connections to CSP 2, with 40 Gbps of total bandwidth (20 Gbps in zone 1 and 20 Gbps in zone 2) in a common co-location facility located in Frankfurt, Germany. 3. Create a Cloud Router in us-east4 (Ashburn, Virginia, USA), and configure two VLAN attachments for CSP 1 and two VLAN attachments for CSP 2.
Show Answer
Correct Answer: A
Explanation:
To provide 20 Gbps of protected bandwidth, each redundant path must be able to carry the full 20 Gbps during a failure, requiring 20 Gbps in each edge availability zone (40 Gbps provisioned total) per CSP. A Cloud Router must be in the same Google Cloud region as the VLAN attachments (europe-west3), and using Frankfurt minimizes cost because both CSPs are closest there. Global dynamic routing makes the routes available to us-east4 without placing the Cloud Router there. Sources: https://cloud.google.com/network-connectivity/docs/interconnect/concepts/cross-site-locations https://cloud.google.com/network-connectivity/docs/interconnect/how-to

Question 40

Your organization deployed a mission critical application that is expected to be a new revenue source. As part of the planning and deployment process, you have recently implemented a security profile with the default set of threat signatures provided by Cloud Next Generation Firewall (Cloud NGFW). This application is the only application running on this project. You need to increase the security posture of the application to log the threat and drop the related packets. What should you do?

A. Configure a new default threat signature with Deny All to all severity options. Review the logs to understand the impact.
B. Set up a Linux VM as the frontend gateway for the application. Create iptables rules to drop all packets, excluding the application port.
C. For all severity options (critical, high, medium, low and informational) in the security profile, change the default override action to Deny.
D. Configure Cloud Scheduler to run a task that checks the Cloud NGFW logs to verify the threats. Configure the task to create a security profile with each signature ID set to override the default action.
Show Answer
Correct Answer: C
Explanation:
Cloud NGFW threat prevention profiles allow overriding the default action by severity. Changing the override action to Deny for each severity causes matching threats to be logged and the associated packets dropped, which directly satisfies the requirement to increase the security posture. The other options either describe unsupported configuration concepts or introduce unnecessary components rather than using the existing security profile.

Question 41

Your organization has a legacy VPN device that uses IKEv1 and does not support BGP. Connectivity from your on-premises environment to Google Cloud needs to be established. You are using 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24 in your on-premises environment, and 192.168.100.0/24, 192.168.101.0/24, and 192.168.102.0/24 in your Google Cloud environment. You have configured a VPN gateway and you need to configure a policy-based VPN tunnel. What should you do?

A. Configure the tunnel with LOCAL_TS set to 172.16.100.0/22 and REMOTE_TS set to 192.168.100.0/22.
B. Configure the tunnel with LOCAL_TS set to 192.168.100.0/22 and REMOTE_TS set to 172.16.100.0/22.
C. Configure the tunnel with LOCAL_TS set to 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24, and REMOTE_TS set to 192.168.100.0/24,192.168.101.0/24, and 192.168.102.0/24.
D. Configure the tunnel with LOCAL_TS set to 172.16.100.0/24, 172.16.101.0/24, and 172.16.102.0/24, and REMOTE_TS set to 0.0.0.0/0.
Show Answer
Correct Answer: B
Explanation:
For a policy-based Cloud VPN using IKEv1, only a single local traffic selector and a single remote traffic selector (single CIDR each) are supported. Therefore the three contiguous /24 networks must be summarized into a single /22 on each side. From the Google Cloud VPN perspective, LOCAL_TS refers to the Google Cloud local network (192.168.100.0/22) and REMOTE_TS refers to the on-premises remote network (172.16.100.0/22).

Question 42

Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue. What should you do?

A. Create custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.
B. Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
C. Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.
D. Create custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
Show Answer
Correct Answer: B
Explanation:
In a hub-and-spoke architecture using VPC Network Peering, subnet routes from spoke VPCs are not automatically advertised over Cloud Router to on-premises. To make spoke subnets reachable from on-premises through the centralized hub, configure custom route advertisements on the Cloud Router in the hub to advertise the spoke VPC subnet prefixes. BGP route policies are for filtering/manipulating advertised routes but do not by themselves originate the missing spoke subnet advertisements. Custom learned routes are unrelated to advertising local prefixes, and Cloud Routers in spokes are not used for centralized hybrid connectivity in this design.

Question 43

You are implementing hybrid connectivity between your company's data center and Google Cloud. You've already deployed redundant Dedicated Interconnect connections, and are now deploying VLAN attachments in us-central1. You want to use an active/passive approach, where interconnect-1 is active and interconnect-2 is a passive backup. You need to deploy a Cloud Router to enable BGP connectivity. You want to follow Google-recommended practices. What should you do?

A. 1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0 and ASN 65101. 2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200 and ASN 65102. 3. Configure the on-premises ASN as 65000.
B. 1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0. 2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200. 3. Configure both Google-side BGP ASNs as 65100. 4. Configure the on-premises ASN as 65000.
C. 1. Configure the primary and secondary interconnects of the BGP sessions on the Cloud Router with priority 100 and ASN 16550. 2. Configure the on-premises ASN as 65001 for primary interconnect-1. 3. Configure the on-premises ASN as 65002 for secondary interconnect-2.
D. 1. Configure the primary and secondary interconnects of the BGP sessions on the Cloud Router with priority 100 and ASN 4200000001. 2. Configure the on-premises ASN as 4200000010. 3. Disable the BGP session on the on-premises router for the secondary interconnect-2.
Show Answer
Correct Answer: B
Explanation:
For an active/passive Dedicated Interconnect design, set a lower Cloud Router advertised route priority on the preferred BGP session (0) and a higher priority on the backup (200). Cloud Router uses the same Google-side BGP ASN (65100) for both BGP sessions on the router, while the on-premises router uses its own private ASN (for example, 65000). Using different Google ASNs per session or disabling the backup BGP session is not the recommended design.

$19

Get all 251 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full Professional Cloud Network Engineer study guide →