Professional Cloud Network Engineer Free Practice Questions — Page 7
Question 61
You are attempting to establish a HA VPN to your on-premises network; however, the VPN connection is not establishing successfully. You have full administrative control over the Google Cloud networking environment and the on-premises firewalls that are acting as the VPN devices. The Google Cloud console shows "Negotiation failure" and "BGP is down". You check Cloud Logging by using a query for resource.type="vpn_gateway" and resource.labels.gateway_id="TUNNEL_ID_NUMBER". Logs Explorer shows frequent log entries:
log name: …/logs/cloud.googleapis.com%2Fipsec_events"
type: "vpn_gateway"
textPayload: "received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built"
You need to troubleshoot the VPN failure and take corrective action based on the Cloud Logging entries. What should you do?
A. Update the Google Cloud BGP session configuration to match the BGP peer ASN on the on-premises side.
B. Compare and review the Phase 2 settings on the on-premises firewall. Make sure the settings match one of the supported cipher suites for HA VPN.
C. Create a new Cloud VPN gateway in a region closer to the peer VPN gateway.
D. Compare the Phase 1 settings and recreate the Cloud VPN tunnel by choosing a different IKE version and pre-shared key.
Show Answer
Correct Answer: B
Explanation: The IPsec log 'received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built' indicates that IKE negotiation succeeded far enough to attempt creating the CHILD_SA, but the Phase 2 (IPsec) proposals did not match. This is typically caused by mismatched Phase 2 encryption/authentication/PFS settings or unsupported cipher suites. Review the on-premises Phase 2 configuration and ensure it matches one of Google Cloud HA VPN's supported proposals. A BGP ASN mismatch would not produce this IPsec proposal error, and changing regions, IKE version, or recreating the tunnel is not the appropriate first corrective action for this specific log message.
Question 62
Your organization has five different VPCs across different projects in y our Google Cloud organization that need high-throughput connectivity. You have performed an audit of the IP address utilization in each VPC, and there are two overlapping subnets that are used by two of the VPCs: 240.0.0.0/16 and 240.128.0.0/24. You have confirmed that no Class E subnets (240.0.0.0/4) will require inter-VPC connectivity, but all other subnets in the VPCs will need connectivity. You need to deploy a Google Cloud routing solution to meet the connectivity requirements. What should you do?
A. Create a full mesh of VPC Network Peering connections between all five VPCs. Make sure not to import or export subnet routes with public IP addresses. Add Cloud network firewall policy rules to allow traffic.
B. Create a Network Connectivity Center hub with a mesh topology. Add a VPC spoke for each of the five VPCs and configure an export exclude filter for 240.0.0.0/4. Add Cloud network firewall policy rules to allow traffic.
C. Create a series of multiple network interface VMs with an interface in each VPPlace the VMs in an instance group. Create an internal passthrough Network Load Balancer in each VPC with the backend of the instance group. Configure custom static routes in each VPC with the next hop of the respective load balancer. Add Cloud network firewall policy rules to allow traffic.
D. Create a full mesh of VPC Network Peering connections between all five VPCs with an export exclude filter for 240.0.0.0/4 on every side. Add Cloud network firewall policy rules to allow traffic.
Show Answer
Correct Answer: B
Explanation: Network Connectivity Center mesh topology is designed to provide high-throughput any-to-any connectivity among multiple VPCs. Route export filters can exclude the overlapping 240.0.0.0/4 range so those conflicting prefixes are not propagated, while all other routes are shared. VPC Network Peering does not support transitive routing and does not provide the required route export exclusion mechanism described. The multi-NIC VM solution is unnecessarily complex and not the recommended managed routing architecture for this use case.
Question 63
You are deploying HA VPN within Google Cloud. You need to exchange routes dynamically between your on-premises gateway and Google Cloud. You have already created a HA VPN gateway and a peer VPN gateway resource. What should you do?
A. Create a Cloud Router, add VPN tunnels, and configure BGP sessions.
B. Create a Cloud Router, add VPN tunnels, and configure static routes to your subnet ranges.
C. Create a second HA VPN gateway, add VPN tunnels, and create firewall rules to allow BGP traffic to the Cloud Router.
D. Create a second HA VPN gateway, add VPN tunnels, and enable global dynamic routing.
Show Answer
Correct Answer: A
Explanation: HA VPN uses Cloud Router with BGP for dynamic route exchange. After creating the HA VPN gateway and peer VPN gateway, the remaining steps are to create a Cloud Router, create the VPN tunnels associated with it, and configure BGP sessions. Static routes are not used for dynamic exchange, and creating a second HA VPN gateway is unnecessary in this scenario.
Question 64
Your company deployed a hub and spoke architecture in Google Cloud to host their workloads. They use VPC network peerings to connect the hub and the spokes. You need to replicate the design and use Network Connectivity Center. What should you do?
A. Choose a Network Connectivity Center star topology. Deploy the hub VPC in the center group. Deploy the spoke VPCs in the edge group.
B. Choose a Network Connectivity Center star topology. Deploy the spoke VPCs in the center group. Deploy the hub VPC in the edge group.
C. Choose a Network Connectivity Center mesh topology. Configure the hub and the spokes as Network Connectivity Center spokes.
D. Choose a Network Connectivity Center mesh topology. Configure the spokes as Network Connectivity Center spokes.
Show Answer
Correct Answer: A
Explanation: To replicate a traditional hub-and-spoke VPC peering design with Network Connectivity Center, use the star topology. Place the hub VPC in the center spoke group and the spoke VPCs in the edge spoke group. This preserves the hub-and-spoke communication pattern where edge spokes communicate through the hub and not directly with each other.
Question 65
You have provisioned a Cloud Interconnect connection with a VLAN attachment. You configured Border Gateway Protocol (BGP) between your on-premises router and your Cloud Router. After deploying and testing the connection, you discover that the BGP session is not established between your on-premises router and the Cloud Router. Which two actions should you take to resolve this issue? (Choose two.)
A. From the Google Cloud console, run gcloud compute routers get-status to verify the Address Resolution Protocol (ARP) learned.
B. Verify that you have configured the on-premises router's subinterface with a subnet mask of /31.
C. Verify that you have configured the on-premises router's eBGP multihop with a minimum hop length of 4.
D. Verify that you have configured the on-premises router's BGP security parameters to use MD5 authentication.
E. From the Google Cloud console, run gcloud compute interconnects get-diagnostics to verify the Address Resolution Protocol (ARP) learned.
Show Answer
Correct Answer: C, E
Explanation: Cloud Interconnect troubleshooting includes verifying the underlying interconnect with the Interconnect diagnostics command (which reports ARP status) and ensuring the on-premises router is configured for eBGP multihop as required for Cloud Interconnect topologies. A /31 mask is incorrect because VLAN attachments use a /29 link-local range by default, MD5 authentication is optional, and the Cloud Router get-status command is not the ARP diagnostic command.
Sources:
https://docs.cloud.google.com/network-connectivity/docs/interconnect/support/troubleshooting
Question 66
You are deploying your infrastructure in the us-central1 region. Your on-premises data center is located in New York City, and the Google Cloud region closest to New York City is us-east4. Your Cloud Interconnect is located in Ashburn, Virginia (VA), United States. You need to use Cloud Interconnect to connect your application infrastructure with backend systems in your data center location. You do not expect the application bandwidth to exceed 500 Mbps. You want to minimize latency and cost. What should you do?
A. Create a Cloud Router and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VEnable global routing in your VPC. Set the bandwidth on the VLAN attachments to 500 Mbps.
B. Create a Cloud Router and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VA. Enable global routing in your VPC.
C. Create a Cloud Router in the us-central1 region and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VA. Enable global routing in your VP
D. Create a Cloud Router and VLAN attachments in the us-central1 region attached to your physical Interconnect in Ashburn, VA.
Show Answer
Correct Answer: B
Explanation: To minimize latency, terminate the Interconnect, Cloud Router, and VLAN attachments in the region closest to the on-premises location and the Interconnect facility (us-east4/Ashburn), then enable global dynamic routing so workloads in us-central1 can reach on-premises over the Interconnect. Cloud Router must be in the same region as the VLAN attachments. Specifying a 500 Mbps VLAN attachment does not materially reduce cost here because the hourly charge is the same across the listed bandwidth tiers for Dedicated Interconnect VLAN attachments.
Question 68
Your company is moving to a hybrid cloud environment and needs to connect two on-premises data centers to Google Cloud. Your company has opted for no service level agreement (SLA) on the Dedicated Interconnect ports. You set up a single Dedicated Interconnect to connect each on-premises data center to Google Cloud: one Dedicated Interconnect in us-east1 and another Dedicated Interconnect in us-west1. You also configured a Cloud Router for each Dedicated Interconnect in each respective region. You now need to configure the Interconnect attachments to provide as much high availability diversity as possible based on this design. What should you do?
A. • Build one VLAN attachment from each Dedicated Interconnect corresponding to the Cloud Router in that region. • Enable global routing at the VPC layer.
B. • Build one VLAN attachment from each Dedicated Interconnect corresponding to the Cloud Router in that region. • Enable regional routing at the VPC layer.
C. • Build two VLAN attachments from each Dedicated Interconnect: one connecting to the Cloud Router in us-east1, and one connecting to the Cloud Router in us-west1. • Enable regional routing at the VPC layer.
D. • Build two VLAN attachments from each Dedicated Interconnect: one connecting to the Cloud Router in us-east1, and one connecting to the Cloud Router in us-west1. • Enable global routing at the VPC layer.
Show Answer
Correct Answer: D
Explanation: To maximize high-availability diversity with two Dedicated Interconnects in different regions, each Dedicated Interconnect should have VLAN attachments to both regional Cloud Routers, providing path diversity across routers and regions. Because traffic and learned routes must be usable across regions, the VPC should use global dynamic routing. Regional routing would limit route propagation and reduce cross-region resiliency.
Question 69
Your organization wants to set up hybrid connectivity with VLAN attachments that terminate in a single Cloud Router with 99.9% uptime. You need to create a network design for your on-premises router that meets those requirements and has an active/passive configuration that uses only one VLAN attachment at a time. What should you do?
A. Create a design that uses the LOCAL_PREF BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
B. Create a design that uses an equal-cost multipath (ECMP) with flow-based hashing on your on-premises devices.
C. Create a design that uses a BGP multi-exit discriminator (MED) attribute to influence the egress path from Google Cloud to the on-premises environment.
D. Create a design that uses the AS_PATH BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
Show Answer
Correct Answer: C
Explanation: For a single Cloud Router with redundant VLAN attachments in an active/passive design, Google Cloud recommends using the BGP MED attribute to influence Google Cloud's choice of egress path toward the on-premises network. ECMP is for active/active load sharing, while LOCAL_PREF is an intra-AS attribute used by your own routers, not by Google Cloud to select the outbound path. AS_PATH prepending is a less preferred mechanism for this specific design.
Question 70
You are configuring the intrusion prevention service (IPS) feature on Cloud Next Generation Firewall Enterprise. You deployed your firewall endpoints and you need to inspect the traffic of the VMs. What should you do?
A. Configure Packet Mirroring to match the source/destination IP addresses of the VMs.
B. Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the goto_next action.
C. Configure a firewall rule to match the hostnames of the VMs, and use the apply_security_profile_group action.
D. Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the apply_security_profile_group action.
Show Answer
Correct Answer: D
Explanation: Cloud NGFW Enterprise IPS inspects traffic that is matched by a firewall rule using the apply_security_profile_group action. The rule should match the relevant VM traffic (typically by source/destination IP ranges or tags), and the attached security profile group enables intrusion prevention inspection. Packet Mirroring is not how Cloud NGFW Enterprise IPS is invoked, goto_next only continues rule evaluation without applying security inspection, and matching by hostname is not the standard firewall rule match criterion for this use case.
Question 71
Your organization recently exposed a set of services through a global external Application Load Balancer. After conducting some testing, you observed that responses would intermittently yield HTTP 4xx or 5xx error response codes. You already enabled and reviewed the health check logs. You need to identify the error. What should you do?
A. Access a VM in the VPC through SSH to access the backend VM directly. If the request is successful from the VM, increase the quantity of backends.
B. Delete the load balancer and backend services. Create a new Passthrough Network Load Balancer. Configure a failover group of VMs for the backend.
C. Validate the health of the backend service. Enable logging for the backend service and identify the error response in Cloud Logging. Review the statusDetails log field.
D. Validate the health of the backend service. Disable any Cloud Armor policies on the backend service, and identify any error response in Cloud Logging. Review the statusDetails log field.
Show Answer
Correct Answer: C
Explanation: For a global external Application Load Balancer, intermittent HTTP 4xx/5xx responses are best diagnosed by enabling backend service logging and inspecting Cloud Logging entries, particularly the statusDetails field, which provides detailed failure reasons beyond health check logs. Health check logs alone do not explain all request failures. Replacing the load balancer, increasing backends without diagnosis, or disabling Cloud Armor preemptively are not appropriate first troubleshooting steps.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.