CertBlaze

Google

Professional Cloud Network Engineer Free Practice Questions — Page 6

Question 44

Your organization requires that all SMTP traffic to your cloud environment is blocked, except for traffic that originates from your corporate network. Your organization also requires that only specific VPCs across your Google Cloud projects will allow SMTP access from your corporate network. You need to configure a security policy that will enable this connectivity. What should you do?

A. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action. 2. Configure an egress hierarchical firewall rule with priority 10010 specifying the source of your corporate network as TCP port 25 and the goto_next action. 3. Associate the hierarchical firewall policy at the organization level. 4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
B. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the allow action. 2. Associate the hierarchical firewall policy at the organization level. 3. Configure firewall policy rules to deny TCP port 25 in the firewall policies associated with the respective VPCs that do not require that access.
C. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the source of your corporate network, TCP port 25, and the goto_next action. 2. Configure an ingress hierarchical firewall rule with priority 10010 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action. 3. Associate the hierarchical firewall policy at the organization level. 4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
D. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action. 2. Associate the hierarchical firewall policy at the organization level. 3. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
Show Answer
Correct Answer: C
Explanation:
Use an organization-level hierarchical ingress firewall policy that sends only the corporate network's SMTP traffic to lower-level evaluation with a higher-priority goto_next rule, then deny all other SMTP traffic with a lower-priority deny rule. At the VPC level, create allow rules only for the specific VPCs that should accept SMTP from the corporate network. This enforces a default block organization-wide while permitting only selected VPCs to opt in.

Question 45

Your company uses web application firewall (WAF) capabilities from a third-party cloud WAF provider. This WAF provider proxies all the HTTPS connections from internet clients, applies security policies, and then opens a new HTTPS connection to the public IP address of your global Application Load Balancer in Google Cloud. Your Google Cloud workloads are the backend of this global Application Load Balancer. Currently, Cloud Am1or is not configured. You need to create a Cloud Armor security policy that blocks sessions that originate from internet clients with source IP addresses that belong to the IP_RANGE_BLOCK IP range. The block must be executed by the Cloud Armor security policy; it will not be done by the third-party cloud WAF provider. Whal should you do?

A. 1. Create a new Cloud Armor network edge security policy. In the policy, set the userIpRequestHeaders[] attribute. 2. Add a policy rule that denies traffic that matches inIpRange(origin.user_ip, 'IP_RANGE_BLOCK') statement. 3. Apply the policy to the backend service that includes all your Google Cloud workloads.
B. 1. Create a new Cloud Armor network edge security policy. In the policy, set the userIpRequestHeaders[] attribute. 2. Add a policy rule that denies traffic that matches the inIpRange(origin.ip, 'IP_RANGE_BLOCK') statement. 3. Apply the policy to the backend service that includes all your Google Cloud workloads.
C. 1. Create a new Cloud Armor backend security policy. In the policy, set the userIpRequestHeaders[] attribute. 2. Add a policy rule that denies traffic that matches the inIpRange(origin.user_ip, 'IP_RANGE_BLOCK') statement. 3. Apply the policy to the backend service that includes all your Google Cloud workloads.
D. 1. Create a new Cloud Armor backend security policy. In the policy, set the userIpRequestHeaders[] attribute. 2. Add a policy rule that denies traffic that matches the inIpRange(origin.ip, 'IP_RANGE_BLOCK') statement. 3. Apply the policy to the backend service that includes all your Google Cloud workloads.
Show Answer
Correct Answer: C
Explanation:
Because the third-party WAF terminates the client connection and establishes a new HTTPS connection to the Google Cloud Application Load Balancer, Cloud Armor sees the WAF as the network source IP. To filter based on the original client IP, configure userIpRequestHeaders[] so Cloud Armor extracts the client IP from a trusted forwarded header and use origin.user_ip in the rule (for example, inIpRange(origin.user_ip, 'IP_RANGE_BLOCK')). A global external Application Load Balancer uses a Cloud Armor backend security policy attached to the backend service, not a network edge security policy.

Question 46

Your organization is developing a landing zone architecture with the following requirements: • There should be no communication possible between production and non-production en-vironments. • Communication between applications within an environment may be necessary. • Network administrators should centrally manage all network resources, including subnets, routes, and firewall rules. • Each application should be billed separately. • Developers of an application within a project should have the autonomy to create their compute resources. They should not create or modify networking resources. • Up to 1000 applications are expected per environment. You need to create a design that accommodates these requirements. What should you do?

A. Create a design that has one Shared VPC host project for the production environment, and another Shared VPC host project for the nonproduction environment. Associate the various applications' service projects with the corresponding environment's host project.
B. Create a design that has a Shared VPC for each project. Implement hierarchical firewall policies to apply micro-segmentation between VPCs.
C. Create a design that implements a single Shared VPUse VPC firewall rules with secure tags to enforce micro-segmentation between environments.
D. Create a design where each project in each environment has its own VPC with its own subnets, routes, and firewall rules. Ensure all VPCs are added as spokes to a Network Connectivity Center hub.
Show Answer
Correct Answer: A
Explanation:
Using two Shared VPC host projects—one for production and one for non-production—provides hard network isolation between environments while allowing communication among applications within the same environment. Network administrators retain centralized control of subnets, routes, and firewall rules in the host projects, while each application resides in its own service project for separate billing and developer autonomy over compute resources without network administration. This design also scales to a large number of application service projects.

Question 47

You are implementing a VPC architecture for your organization by using a Network Connectivity Center hub and spoke topology: • There is one Network Connectivity Center hybrid spoke to receive on-premises routes. • There is one VPC spoke that needs to be added as a Network Connectivity Center spoke. Your organization has limited routable IP space for their cloud environment (192.168.0.0/20). The Network Connectivity Center spoke VPC is connected to on-premises with a Cloud Interconnect connection in the us-east4 region. The on-premises IP range is 172.16.0.0/16. You need to reach on-premises resources from multiple Google Cloud regions (us-west1,europe-central1, and asia-southeast1) and minimize the IP addresses being used. What should you do?

A. 1. Configure a Private NAT gateway and NAT subnet in us-west1(192.168.1.0/24), europe-central1(192.168.2.0/24) and asia-southeast1(192.168.3.0/24). 2. Add the VPC as a spoke and configure an export include policy to advertise only 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1 and asia-southeast1 to reach the on-premises location through us-east4.
B. 1. Configure a Private NAT gateway instance in us-west1(172.16.1.0/24), europe-central1(172.16.2.0/24), and asia-southeast1(172.16.3.0/24). 2. Add the VPC as a spoke and configure an export include policy on the VPC spoke to advertise only the NAT subnets 172.16.1.0/24, 172.16.2.0/24, and 172.16.3.0/24 to the hub. 3. Enable global dynamic to allow resources in us-west1, us-central1, and asia-southeast1 to reach the on-premises location through us-east4.
C. 1. Configure a Private NAT gateway instance in us-east4(192.168.1.0/24). 2. Add the VPC as a spoke and configure an export include policy on the VPC spoke to advertise 192.168.1.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1 and asia-southeast1 to reach the on-premises location through us-east4.
D. 1. Configure a Private NAT gateway instance in us-west1(192.168.1.0/24), europe-central1(192.168.2.0/24), and asia-southeast1(192.168.3.0/24). 2. Add the VPC as a spoke and configure an export exclude policy on the VPC spoke to advertise only the NAT subnets 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 to the hub. 3. Enable global dynamic routing to allow resources in us-west1, us-central1, and asia-southeast1 to reach the on-premises location through us-east4.
Show Answer
Correct Answer: A
Explanation:
Private NAT for hybrid connectivity should use addresses from the VPC's own RFC1918 space, not the on-premises range. Deploying regional Private NAT gateways in the source regions allows traffic from those regions to be translated before reaching on-premises. Advertising only the NAT subnets with an export include policy minimizes the prefixes shared through the Network Connectivity Center hub, and global dynamic routing allows resources in other regions to use the Cloud Interconnect attachment in us-east4.

Question 49

Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The compute instances that run these applications have an associated secure tag. What should you do?

A. Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.
B. Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.
C. Deploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
D. Deploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
Show Answer
Correct Answer: D
Explanation:
Secure Web Proxy provides URL-level filtering, including hostnames and paths via URL lists and policies. It supports matching source secure tags in proxy policies. Because Secure Web Proxy is a regional service, workloads in multiple regions require a proxy deployment in each region. Cloud NAT with FQDN firewall objects filters by domain, not full URL paths, and does not meet the URL path requirement.

Question 50

Your multi-region VPC has had a long-standing HA VPN configured in "region 1" connected to your corporate network. You are planning to add two 10 Gbps Dedicated Interconnect connections and VLAN attachments in "region 2" to connect to the same corporate network. You need to plan for connectivity between your VPC and corporate network to ensure that traffic uses the Dedicated Interconnect connections as the primary path and the HA VPN as the secondary path. What should you do?

A. Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
B. Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
C. Enable global dynamic routing mode on the VPConfigure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
D. Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
Show Answer
Correct Answer: C
Explanation:
Use global dynamic routing so routes learned in one region are available across the multi-region VPC. To prefer Dedicated Interconnect over HA VPN, configure the VLAN attachment BGP sessions with a lower advertised base priority (MED) of 100 and the HA VPN BGP sessions with a higher base priority of 20000. Matching MED behavior on the on-premises routers ensures the Interconnect is the primary path and HA VPN is used as backup.

Question 51

Your organization's on-premises networking team is reporting frequent BGP session flaps toward your Google Cloud environment. You need to review the BGP configuration. What should you do?

A. Switch to static routing.
B. Increase the BGP hold timer to 36000 seconds max.
C. Ensure that graceful restart is enabled on the on-premises router.
D. Ask the on-premises team to enable Bidirectional Forwarding Detection (BFD).
Show Answer
Correct Answer: C
Explanation:
Frequent BGP session flaps should prompt verification of BGP features that improve session stability. On Google Cloud Cloud Router, enabling graceful restart on the on-premises router is the recommended configuration to help maintain routing during control-plane restarts and avoid unnecessary BGP session disruption. BFD accelerates failure detection but does not prevent flapping and can make unstable links transition down more quickly. Static routing is not an appropriate replacement, and increasing the hold timer to an extreme value is not recommended.

Question 52

Your organization is connecting their Shared VPC network to their on-premises data center by using Dedicated Interconnect to provide connectivity to all of its service projects. You need to create a design to configure your VLAN attachments and Cloud Routers. You also want to achieve a 99.9% Cloud Interconnect SLA based on Google Cloud s reference design. What should you do?

A. Create two Cloud Interconnect connections in different edge availability domains of two different co-location facilities in a project that will contain your connections. Create one VLAN attachment and Cloud Router for each physical interconnect in the Shared VPC host project.
B. Create two Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create one VLAN attachment for each physical Cloud Interconnect connection and a single Cloud Router in the Shared VPC host project.
C. Create two Cloud Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create one VLAN attachment for each physical interconnect and a single Cloud Router in the service projects.
D. Create two Cloud Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create a Cloud Router in the Shared VPC host project and the VLAN attachments in the Shared VPC service projects.
Show Answer
Correct Answer: B
Explanation:
For the 99.9% Dedicated Cloud Interconnect reference design, deploy two Dedicated Interconnect connections in different edge availability domains within the same colocation facility, create one VLAN attachment per physical interconnect, and use a single Cloud Router to establish redundant BGP sessions. In a Shared VPC environment, the Cloud Router and VLAN attachments belong in the Shared VPC host project so connectivity is shared with service projects. Two Cloud Routers are not required for this topology.

Question 53

Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two encrypted VLAN attachments that have a 5 Gbps capacity and a BGP configuration. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?

A. Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Configure the HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels. Use the same encrypted Cloud Router used for the Cloud Interconnect tier.
B. Enable MACsec on Partner Interconnect.
C. Enable MACsec for Cloud Interconnect on the VLAN attachments.
D. Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Create a new dedicated HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels.
Show Answer
Correct Answer: D
Explanation:
HA VPN over Cloud Interconnect uses two separate tiers: the Cloud Interconnect tier (VLAN attachments and its Cloud Router) and the HA VPN tier (HA VPN gateways, tunnels, and a separate Cloud Router for HA VPN). After the encrypted VLAN attachments and Interconnect BGP are operational, you complete the deployment by creating the HA VPN gateway, a dedicated HA VPN Cloud Router, the peer VPN gateway, and HA VPN tunnels. MACsec options are unrelated to HA VPN over Cloud Interconnect.

Question 54

Your organization is using a Shared VPC model. Service project owners want to independently manage their DNS zones in service projects. All service project workloads must be able to resolve all private zones that are defined in other service projects. You need to create a solution that meets these goals. What should you do?

A. Create a Cloud DNS private zone in each service project. Use a Cloud DNS forwarding zone to forward queries to the Shared VPC in the host project.
B. Create a Cloud DNS private zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
C. Create a Cloud DNS response policy zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
D. Create a Cloud DNS private zone in each service project. Use cross-project binding to associate the zones to the Shared VPC in the host project.
Show Answer
Correct Answer: D
Explanation:
Cross-project binding allows private Cloud DNS managed zones created in service projects to be bound to the Shared VPC network in the host project. This lets service project owners manage their own private zones independently while making those zones resolvable by workloads attached to the Shared VPC. Forwarding and peering zones do not provide this cross-project private zone association, and response policy zones are for DNS policy overrides rather than authoritative private DNS.

$19

Get all 251 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full Professional Cloud Network Engineer study guide →