CertBlaze

Google

Professional Cloud Network Engineer Free Practice Questions — Page 5

Question 38

Your organization is developing a landing zone architecture with the following requirements: • There should be no communication possible between production and non-production en-vironments. • Communication between applications within an environment may be necessary. • Network administrators should centrally manage all network resources, including subnets, routes, and firewall rules. • Each application should be billed separately. • Developers of an application within a project should have the autonomy to create their compute resources. They should not create or modify networking resources. • Up to 1000 applications are expected per environment. You need to create a design that accommodates these requirements. What should you do?

A. Create a design that has one Shared VPC host project for the production environment, and another Shared VPC host project for the nonproduction environment. Associate the various applications' service projects with the corresponding environment's host project.
B. Create a design that has a Shared VPC for each project. Implement hierarchical firewall policies to apply micro-segmentation between VPCs.
C. Create a design that implements a single Shared VPUse VPC firewall rules with secure tags to enforce micro-segmentation between environments.
D. Create a design where each project in each environment has its own VPC with its own subnets, routes, and firewall rules. Ensure all VPCs are added as spokes to a Network Connectivity Center hub.
Show Answer
Correct Answer: A
Explanation:
Using separate Shared VPC host projects for production and non-production provides strong isolation between environments. Service projects per application enable separate billing and allow developers to manage compute without network permissions, while network administrators centrally manage subnets, routes, and firewall rules in the host projects. Shared VPC scales to hundreds or thousands of service projects and allows intra-environment communication as needed.

Question 39

You are implementing a VPC architecture for your organization by using a Network Connectivity Center hub and spoke topology: • There is one Network Connectivity Center hybrid spoke to receive on-premises routes. • There is one VPC spoke that needs to be added as a Network Connectivity Center spoke. Your organization has limited routable IP space for their cloud environment (192.168.0.0/20). The Network Connectivity Center spoke VPC is connected to on-premises with a Cloud Interconnect connection in the us-east4 region. The on-premises IP range is 172.16.0.0/16. You need to reach on-premises resources from multiple Google Cloud regions (us-west1,europe-central1, and asia-southeast1) and minimize the IP addresses being used. What should you do?

A. 1. Configure a Private NAT gateway and NAT subnet in us-west1(192.168.1.0/24), europe-central1(192.168.2.0/24) and asia-southeast1(192.168.3.0/24). 2. Add the VPC as a spoke and configure an export include policy to advertise only 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1 and asia-southeast1 to reach the on-premises location through us-east4.
B. 1. Configure a Private NAT gateway instance in us-west1(172.16.1.0/24), europe-central1(172.16.2.0/24), and asia-southeast1(172.16.3.0/24). 2. Add the VPC as a spoke and configure an export include policy on the VPC spoke to advertise only the NAT subnets 172.16.1.0/24, 172.16.2.0/24, and 172.16.3.0/24 to the hub. 3. Enable global dynamic to allow resources in us-west1, us-central1, and asia-southeast1 to reach the on-premises location through us-east4.
C. 1. Configure a Private NAT gateway instance in us-east4(192.168.1.0/24). 2. Add the VPC as a spoke and configure an export include policy on the VPC spoke to advertise 192.168.1.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1 and asia-southeast1 to reach the on-premises location through us-east4.
D. 1. Configure a Private NAT gateway instance in us-west1(192.168.1.0/24), europe-central1(192.168.2.0/24), and asia-southeast1(192.168.3.0/24). 2. Add the VPC as a spoke and configure an export exclude policy on the VPC spoke to advertise only the NAT subnets 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1, and asia-southeast1 to reach the on-premises location through us-east4.
Show Answer
Correct Answer: A
Explanation:
To minimize IP consumption while enabling multi-region access to on-premises through an NCC hub, you should use Private NAT in each source region so only small NAT subnets are advertised instead of all workload subnets. Option A uses NAT ranges carved from the limited 192.168.0.0/20 space, advertises only those /24 NAT prefixes via an export include policy, and enables global dynamic routing so traffic from us-west1, europe-central1, and asia-southeast1 can reach on‑premises through the us-east4 interconnect. Other options either use overlapping on‑prem IP space, place NAT only in one region, or misuse export policies.

Question 40

You are reviewing and tuning Secure Web Proxy at your organization, Mount Kirk Games. Users have reported that they are unable to reach the documents they need on the Terram Earth website (https://www.terramearth.com/docs/*). The Secure Web Proxy rules configuration is as follows: You need to enable access to these documents. What should you do?

A. Delete the updates-limiter rule.
B. Modify the updates-1 rule to perform the TLS inspection.
C. Review Cloud Logging for errors with Cloud NAT. If there are no errors, assign the VM a public IP address.
D. Modify the priority of the updates-limiter rule to 1000.
Show Answer
Correct Answer: B
Explanation:
For HTTPS traffic, Secure Web Proxy evaluates rules only if TLS inspection is enabled. The rule intended to allow access to https://www.terramearth.com/docs/* is being skipped because it does not perform TLS inspection. Modifying the updates-1 rule to enable TLS inspection allows the proxy to inspect and correctly match the HTTPS request, restoring access to the documents.

Question 41

Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The compute instances that run these applications have an associated secure tag. What should you do?

A. Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.
B. Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.
C. Deploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
D. Deploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
Show Answer
Correct Answer: D
Explanation:
You need URL-level (hostname and path) egress control based on secure tags across multiple regions. Cloud NAT with firewall rules cannot filter by URL paths or use secure tags for FQDN filtering. Secure Web Proxy supports URL lists (hostnames and paths) and policies that match secure tags, and it is a regional service, requiring deployment in each region where applications run.

Question 42

Your multi-region VPC has had a long-standing HA VPN configured in "region 1" connected to your corporate network. You are planning to add two 10 Gbps Dedicated Interconnect connections and VLAN attachments in "region 2" to connect to the same corporate network. You need to plan for connectivity between your VPC and corporate network to ensure that traffic uses the Dedicated Interconnect connections as the primary path and the HA VPN as the secondary path. What should you do?

A. Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
B. Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
C. Enable global dynamic routing mode on the VPConfigure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
D. Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
Show Answer
Correct Answer: C
Explanation:
To prefer Dedicated Interconnect over HA VPN, you must influence BGP path selection so Interconnect routes are more preferred and still allow VPN as backup. Global dynamic routing mode is required so routes learned in region 2 (Interconnect VLAN attachments) are advertised VPC‑wide and can be compared with routes from the HA VPN in region 1. In Cloud Router, a lower BGP base priority value is preferred, so setting VLAN attachments to 100 and HA VPN to 20000 makes Interconnect primary and VPN secondary. Matching MED values on on‑premises routers ensures consistent path selection in both directions.

Question 43

Your organization's on-premises networking team is reporting frequent BGP session flaps toward your Google Cloud environment. You need to review the BGP configuration. What should you do?

A. Switch to static routing.
B. Increase the BGP hold timer to 36000 seconds max.
C. Ensure that graceful restart is enabled on the on-premises router.
D. Ask the on-premises team to enable Bidirectional Forwarding Detection (BFD).
Show Answer
Correct Answer: D
Explanation:
Frequent BGP session flaps are typically caused by slow or unreliable failure detection on the underlying link. Bidirectional Forwarding Detection (BFD) provides rapid detection of forwarding path failures and integrates with BGP to trigger faster, more stable session handling. Enabling BFD on the on-premises router is the appropriate configuration review step for diagnosing and mitigating BGP flaps with Google Cloud.

Question 44

Your organization is connecting their Shared VPC network to their on-premises data center by using Dedicated Interconnect to provide connectivity to all of its service projects. You need to create a design to configure your VLAN attachments and Cloud Routers. You also want to achieve a 99.9% Cloud Interconnect SLA based on Google Cloud s reference design. What should you do?

A. Create two Cloud Interconnect connections in different edge availability domains of two different co-location facilities in a project that will contain your connections. Create one VLAN attachment and Cloud Router for each physical interconnect in the Shared VPC host project.
B. Create two Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create one VLAN attachment for each physical Cloud Interconnect connection and a single Cloud Router in the Shared VPC host project.
C. Create two Cloud Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create one VLAN attachment for each physical interconnect and a single Cloud Router in the service projects.
D. Create two Cloud Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create a Cloud Router in the Shared VPC host project and the VLAN attachments in the Shared VPC service projects.
Show Answer
Correct Answer: B
Explanation:
To achieve the 99.9% Dedicated Interconnect SLA, Google’s reference design requires two Dedicated Interconnect connections in different edge availability domains within the same colocation facility, one VLAN attachment per physical interconnect, and BGP managed by Cloud Router. A single Cloud Router can terminate multiple VLAN attachments and is the recommended design. For Shared VPC, the Cloud Router and VLAN attachments should reside in the Shared VPC host project so connectivity is available to all service projects. Option B matches these requirements exactly.

Question 45

Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two encrypted VLAN attachments that have a 5 Gbps capacity and a BGP configuration. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?

A. Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Configure the HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels. Use the same encrypted Cloud Router used for the Cloud Interconnect tier.
B. Enable MACsec on Partner Interconnect.
C. Enable MACsec for Cloud Interconnect on the VLAN attachments.
D. Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Create a new dedicated HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels.
Show Answer
Correct Answer: D
Explanation:
HA VPN over Cloud Interconnect requires two separate tiers: the Cloud Interconnect tier (VLAN attachments with its own Cloud Router) and the HA VPN tier (HA VPN gateways, tunnels, and a dedicated Cloud Router). You must create an HA VPN gateway and use a separate Cloud Router for the HA VPN BGP sessions rather than reusing the Interconnect Cloud Router. MACsec options are unrelated to HA VPN over Interconnect.

Question 46

Your organization is using a Shared VPC model. Service project owners want to independently manage their DNS zones in service projects. All service project workloads must be able to resolve all private zones that are defined in other service projects. You need to create a solution that meets these goals. What should you do?

A. Create a Cloud DNS private zone in each service project. Use a Cloud DNS forwarding zone to forward queries to the Shared VPC in the host project.
B. Create a Cloud DNS private zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
C. Create a Cloud DNS response policy zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
D. Create a Cloud DNS private zone in each service project. Use cross-project binding to associate the zones to the Shared VPC in the host project.
Show Answer
Correct Answer: D
Explanation:
In a Shared VPC, private Cloud DNS zones are only visible to the VPC networks they are associated with. Using cross-project binding allows each service project to independently own and manage its private DNS zones while associating those zones with the Shared VPC network in the host project. This makes the zones resolvable by all workloads attached to the Shared VPC, including those in other service projects. Forwarding or peering zones are unnecessary and do not provide full bidirectional visibility across all service projects.

Question 47

You are creating a design that will connect your single on-premises data center to a VPC in Google Cloud by using an IPsec VPN connection. The connection must have a minimum SLA of 99.99%. There is a single VPN termination device located in your on-premises data center. The VPN termination device can be configured only with a single public IP address. Your design must also have the least amount of setup effort. What should you do?

A. 1. Create two HA VPN gateways. 2. Create one tunnel on interface 0 of one gateway and create one tunnel on interface 1 of the other gateway. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
B. 1. Create one Classic VPN gateway and one HA VPN gateway. 2. Create one tunnel on the interface of the Classic VPN gateway and one tunnel on interface 1 of the HA VPN gateway. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
C. 1. Replace the existing on-premises VPN termination device with a new device that is configured with two different public IP addresses. 2. Create one HA VPN gateway. 3. Create one tunnel for each of the two HA VPN gateway interfaces. 4. Terminate each of the two tunnels on one of the two public IP addresses that is configured on the new VPN termination device located in your on-premises data center.
D. 1. Create one HA VPN gateway. 2. Create one tunnel for each of the two HA VPN gateway interfaces. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
Show Answer
Correct Answer: D
Explanation:
To achieve a 99.99% SLA with minimal setup effort and only a single on‑premises public IP, you must use a single HA VPN gateway in Google Cloud with both of its interfaces active. Creating one tunnel per HA VPN interface and terminating both tunnels on the same on‑premises public IP is a supported HA VPN topology and meets the 99.99% availability requirement. Other options either add unnecessary complexity, mix unsupported gateway types, or require changing the on‑premises device, which violates the constraints.

$19

Get all 248 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full Professional Cloud Network Engineer study guide →