Professional Cloud Network Engineer Free Practice Questions — Page 6
Question 48
You are using Network Connectivity Center and you already have the hub configured. All VPCs in your environment need to have network connectivity to each other. All the subnet ranges are unique. You need to configure your topology accordingly. What should you do?
A. Configure a star topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
B. Configure a mesh topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
C. Configure a mesh topology, and add the VPC spokes to the hub.
D. Configure a star topology, and add the VPC spokes to the hub.
Show Answer
Correct Answer: C
Explanation: All VPCs must have full, mutual connectivity. In Network Connectivity Center, a mesh topology provides any-to-any connectivity between all VPC spokes attached to the hub. Since subnet ranges are unique, no export filtering (excludeExportRanges) is required. Therefore, configuring a mesh topology and adding the VPC spokes to the hub is sufficient.
Question 49
Your company deployed Cloud Next Generation Firewall Enterprise (Cloud NGFW Enterprise). You have already created a CA pool and a CA in Certificate Authority Service. You need to enable TLS inspection. What should you do?
A. Grant the network security service agent service account the privateca.certificateRequester role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
B. Grant the network security service agent service account the privateca.poolReader role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
C. Grant the network security service agent service account the privateca.certificateRequester role. Create a trust config in Certificate Manager Flip the TLS inspection flag in your firewall policy rules to true.
D. Grant the network security service agent service account the privateca.certificateRequester role. Create a trust config in Certificate Manager. Flip the TLS inspection flag in your firewall policy rules to true.
Show Answer
Correct Answer: A
Explanation: To enable TLS inspection with Cloud NGFW Enterprise, the firewall service must be able to request certificates from your CA pool and be explicitly configured to use TLS inspection. This requires granting the network security service agent the roles/privateca.certificateRequester role, creating a TLS inspection policy that references the existing CA pool, associating that TLS inspection policy with your firewall endpoint (VPC endpoint association), and finally enabling TLS inspection in the relevant firewall policy rules. Only option A includes all required permissions and configuration steps.
Question 50
You have several VMs across multiple VPCs in your cloud environment, which require access to internet endpoints. These VMs cannot have public IP addresses due to security policies, so you plan to use Cloud NAT to provide outbound internet access. Within your VPCs, you have several subnets in each region. You want to ensure that only specific subnets have access to the internet through Cloud NAT. You want to avoid any unintentional configuration issues caused by other administrators, and align to Google-recommended practices. What should you do?
A. Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure all primary and secondary subnet source ranges.
B. Create a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the constraint to a folder that contains the associated projects. Configure the allowedValues to only contain the subnets that should have internet access. Deploy Cloud NAT and select only the allowed subnets.
C. Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure a custom source range that includes the allowed subnets.
D. Deploy Cloud NAT in each VPC, and configure a custom source range that includes the allowed subnets. Configure Cloud NAT rules to only permit the allowed subnets to egress through Cloud NAT.
Show Answer
Correct Answer: B
Explanation: Using an organization policy constraint (compute.restrictCloudNATUsage) is the Google‑recommended, preventative control to ensure only explicitly approved subnets can be configured for Cloud NAT. This avoids reliance on firewall rule ordering or manual NAT configuration, and protects against accidental or unauthorized changes by other administrators. By attaching the constraint at the folder or org level and allowing only specific subnets, you centrally enforce correct usage while still deploying Cloud NAT normally.
Question 51
Your company uses Compute Engine instances that are exposed to the public internet. Each compute instance has a single network interface with a single public IP address. You need to block any connection attempt that originates from internet clients with IP addresses that belong to the BGP_ASN_TOBLOCK BGP ASN. What should you do?
A. Create a new Cloud Armor backend security policy, and use the --network-src-asns parameter.
B. Create a new Cloud Armor network edge security policy, and use the --network-src-asns parameter.
C. Create a new Cloud Armor edge security policy, and use the --network-src-asns parameter.
D. Create a new firewall policy ingress rule, and use the --network-src-asns parameter.
Show Answer
Correct Answer: B
Explanation: Compute Engine instances with public IPs (no load balancer) are protected using Cloud Armor *network edge security policies*. These policies apply at Google’s edge directly to VM public IPs and support ASN-based filtering via the --network-src-asns parameter. Backend or edge security policies are tied to HTTP(S) load balancers, and firewall rules do not support ASN matching.
Question 52
Your team deployed two applications in GKE that are exposed through an external Application Load Balancer. When queries are sent to www.mountkirkgames.com/sales and www.mountkirkgames.com/get-an-analysis, the correct pages are displayed. However, you have received complaints that www.mountkirkgames.com yields a 404 error. You need to resolve this error. What should you do?
A. Review the Service YAML file. Add a new path rule for the * character that directs to the base service. Reapply the YAML.
B. Review the Ingress YAML file. Add a new path rule for the * character that directs to the base service. Reapply the YAML.
C. Review the Ingress YAML file. Define the default backend. Reapply the YAML.
D. Review the Service YAML file. Define a default backend. Reapply the YAML.
Show Answer
Correct Answer: C
Explanation: Requests to specific paths work, but the root URL returns 404, indicating no rule matches requests without a path. In GKE Ingress, unmatched requests are sent to the default backend. Since none is defined, the load balancer returns 404. Defining a default backend in the Ingress YAML ensures www.mountkirkgames.com (without a path) is properly handled.
Question 53
You are attempting to establish a HA VPN to your on-premises network; however, the VPN connection is not establishing successfully. You have full administrative control over the Google Cloud networking environment and the on-premises firewalls that are acting as the VPN devices. The Google Cloud console shows "Negotiation failure" and "BGP is down". You check Cloud Logging by using a query for resource.type="vpn_gateway" and resource.labels.gateway_id="TUNNEL_ID_NUMBER". Logs Explorer shows frequent log entries:
log name: …/logs/cloud.googleapis.com%2Fipsec_events"
type: "vpn_gateway"
textPayload: "received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built"
You need to troubleshoot the VPN failure and take corrective action based on the Cloud Logging entries. What should you do?
A. Update the Google Cloud BGP session configuration to match the BGP peer ASN on the on-premises side.
B. Compare and review the Phase 2 settings on the on-premises firewall. Make sure the settings match one of the supported cipher suites for HA VPN.
C. Create a new Cloud VPN gateway in a region closer to the peer VPN gateway.
D. Compare the Phase 1 settings and recreate the Cloud VPN tunnel by choosing a different IKE version and pre-shared key.
Show Answer
Correct Answer: B
Explanation: The log message "received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built" indicates that IKE negotiation succeeded up to Phase 1, but Phase 2 (CHILD_SA) failed because the two peers could not agree on IPsec parameters. This is typically caused by a mismatch in Phase 2 proposals such as encryption algorithms, integrity algorithms, PFS settings, or lifetimes. The correct corrective action is to review and align the Phase 2 settings on the on-premises firewall with one of the cipher suites supported by Google Cloud HA VPN.
Question 54
Your organization has five different VPCs across different projects in y our Google Cloud organization that need high-throughput connectivity. You have performed an audit of the IP address utilization in each VPC, and there are two overlapping subnets that are used by two of the VPCs: 240.0.0.0/16 and 240.128.0.0/24. You have confirmed that no Class E subnets (240.0.0.0/4) will require inter-VPC connectivity, but all other subnets in the VPCs will need connectivity. You need to deploy a Google Cloud routing solution to meet the connectivity requirements. What should you do?
A. Create a full mesh of VPC Network Peering connections between all five VPCs. Make sure not to import or export subnet routes with public IP addresses. Add Cloud network firewall policy rules to allow traffic.
B. Create a Network Connectivity Center hub with a mesh topology. Add a VPC spoke for each of the five VPCs and configure an export exclude filter for 240.0.0.0/4. Add Cloud network firewall policy rules to allow traffic.
C. Create a series of multiple network interface VMs with an interface in each VPPlace the VMs in an instance group. Create an internal passthrough Network Load Balancer in each VPC with the backend of the instance group. Configure custom static routes in each VPC with the next hop of the respective load balancer. Add Cloud network firewall policy rules to allow traffic.
D. Create a full mesh of VPC Network Peering connections between all five VPCs with an export exclude filter for 240.0.0.0/4 on every side. Add Cloud network firewall policy rules to allow traffic.
Show Answer
Correct Answer: B
Explanation: Network Connectivity Center (NCC) with a mesh topology is designed for high‑throughput, multi‑VPC connectivity across projects and supports scalable hub‑and‑spoke or mesh designs. Although NCC relies on standard VPC routing, it supports route export/import filters. By excluding the entire Class E range (240.0.0.0/4), the overlapping subnets are never propagated, so no routing conflict occurs while all other required subnets can communicate.
A and D rely on VPC Network Peering, which does not support fine‑grained CIDR‑based route filtering (other than public IP handling) and becomes operationally complex and less scalable in a five‑VPC full mesh. C would technically work around overlaps but introduces unnecessary VM‑based routing, operational overhead, and reduced reliability compared to a managed NCC solution.
Therefore, option B best meets the requirements.
Question 55
You are deploying HA VPN within Google Cloud. You need to exchange routes dynamically between your on-premises gateway and Google Cloud. You have already created a HA VPN gateway and a peer VPN gateway resource. What should you do?
A. Create a Cloud Router, add VPN tunnels, and configure BGP sessions.
B. Create a Cloud Router, add VPN tunnels, and configure static routes to your subnet ranges.
C. Create a second HA VPN gateway, add VPN tunnels, and create firewall rules to allow BGP traffic to the Cloud Router.
D. Create a second HA VPN gateway, add VPN tunnels, and enable global dynamic routing.
Show Answer
Correct Answer: A
Explanation: Dynamic route exchange for HA VPN in Google Cloud requires BGP. After creating the HA VPN gateway and peer gateway, you must create a Cloud Router, attach VPN tunnels to it, and configure BGP sessions. Static routes do not provide dynamic routing, and creating a second HA VPN gateway or enabling global dynamic routing is unnecessary for this requirement.
Question 56
Your company deployed a hub and spoke architecture in Google Cloud to host their workloads. They use VPC network peerings to connect the hub and the spokes. You need to replicate the design and use Network Connectivity Center. What should you do?
A. Choose a Network Connectivity Center star topology. Deploy the hub VPC in the center group. Deploy the spoke VPCs in the edge group.
B. Choose a Network Connectivity Center star topology. Deploy the spoke VPCs in the center group. Deploy the hub VPC in the edge group.
C. Choose a Network Connectivity Center mesh topology. Configure the hub and the spokes as Network Connectivity Center spokes.
D. Choose a Network Connectivity Center mesh topology. Configure the spokes as Network Connectivity Center spokes.
Show Answer
Correct Answer: A
Explanation: To replicate a traditional hub-and-spoke VPC peering design using Network Connectivity Center (NCC), you should use the NCC star topology. In this model, a single hub acts as the central connectivity point and multiple VPC spokes attach to it, matching the behavior of hub-and-spoke peering. A mesh topology would not replicate the same design or traffic patterns. Despite some imprecise terminology in the option wording, option A correctly represents the intended NCC architecture.
Question 57
You have provisioned a Cloud Interconnect connection with a VLAN attachment. You configured Border Gateway Protocol (BGP) between your on-premises router and your Cloud Router. After deploying and testing the connection, you discover that the BGP session is not established between your on-premises router and the Cloud Router. Which two actions should you take to resolve this issue? (Choose two.)
A. From the Google Cloud console, run gcloud compute routers get-status to verify the Address Resolution Protocol (ARP) learned.
B. Verify that you have configured the on-premises router's subinterface with a subnet mask of /31.
C. Verify that you have configured the on-premises router's eBGP multihop with a minimum hop length of 4.
D. Verify that you have configured the on-premises router's BGP security parameters to use MD5 authentication.
E. From the Google Cloud console, run gcloud compute interconnects get-diagnostics to verify the Address Resolution Protocol (ARP) learned.
Show Answer
Correct Answer: C, E
Explanation: To troubleshoot a BGP session that is not establishing over a Cloud Interconnect VLAN attachment, first confirm Layer 2 connectivity. The correct way to verify whether Google Cloud has learned your on‑premises router’s MAC address is by running `gcloud compute interconnects get-diagnostics`, which exposes ARP status for the Interconnect.
Additionally, for Cloud Interconnect L3-only topologies, Google recommends configuring eBGP with multihop (typically a hop count of 4). If multihop is not configured, the BGP session may fail to establish even when physical connectivity is up.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.