Professional Cloud Network Engineer Free Practice Questions — Page 7
Question 55
You are creating a design that will connect your single on-premises data center to a VPC in Google Cloud by using an IPsec VPN connection. The connection must have a minimum SLA of 99.99%. There is a single VPN termination device located in your on-premises data center. The VPN termination device can be configured only with a single public IP address. Your design must also have the least amount of setup effort. What should you do?
A. 1. Create two HA VPN gateways. 2. Create one tunnel on interface 0 of one gateway and create one tunnel on interface 1 of the other gateway. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
B. 1. Create one Classic VPN gateway and one HA VPN gateway. 2. Create one tunnel on the interface of the Classic VPN gateway and one tunnel on interface 1 of the HA VPN gateway. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
C. 1. Replace the existing on-premises VPN termination device with a new device that is configured with two different public IP addresses. 2. Create one HA VPN gateway. 3. Create one tunnel for each of the two HA VPN gateway interfaces. 4. Terminate each of the two tunnels on one of the two public IP addresses that is configured on the new VPN termination device located in your on-premises data center.
D. 1. Create one HA VPN gateway. 2. Create one tunnel for each of the two HA VPN gateway interfaces. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
Show Answer
Correct Answer: D
Explanation: A single HA VPN gateway with one tunnel on each of its two interfaces satisfies the 99.99% HA VPN SLA requirement. Google Cloud supports terminating both tunnels on the same on-premises peer public IP address (1 peer, 1 external IP topology), so there is no need to replace the on-premises device or deploy additional HA VPN gateways. This also requires the least setup effort.
Question 56
You are using Network Connectivity Center and you already have the hub configured. All VPCs in your environment need to have network connectivity to each other. All the subnet ranges are unique. You need to configure your topology accordingly. What should you do?
A. Configure a star topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
B. Configure a mesh topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
C. Configure a mesh topology, and add the VPC spokes to the hub.
D. Configure a star topology, and add the VPC spokes to the hub.
Show Answer
Correct Answer: C
Explanation: To provide full connectivity between all VPCs attached to an existing Network Connectivity Center hub, configure a mesh topology and add each VPC as a spoke. Because all subnet ranges are unique, there is no need to configure excludeExportRanges filters; those filters are used to prevent exporting selected routes, which is unnecessary here.
Question 57
Your company deployed Cloud Next Generation Firewall Enterprise (Cloud NGFW Enterprise). You have already created a CA pool and a CA in Certificate Authority Service. You need to enable TLS inspection. What should you do?
A. Grant the network security service agent service account the privateca.certificateRequester role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
B. Grant the network security service agent service account the privateca.poolReader role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
C. Grant the network security service agent service account the privateca.certificateRequester role. Create a trust config in Certificate Manager Flip the TLS inspection flag in your firewall policy rules to true.
D. Grant the network security service agent service account the privateca.certificateRequester role. Create a trust config in Certificate Manager. Flip the TLS inspection flag in your firewall policy rules to true.
Show Answer
Correct Answer: A
Explanation: To enable TLS inspection in Cloud NGFW Enterprise, you must grant the Network Security service agent the Private CA Certificate Requester role so it can obtain certificates from the CA pool, create a TLS inspection policy that references the CA pool, associate that TLS inspection policy with the relevant firewall endpoint association, and enable TLS inspection in the applicable firewall policy rules. The poolReader role is insufficient because the service must request certificates, and creating only a Certificate Manager trust config does not replace the required TLS inspection policy workflow.
Question 58
You have several VMs across multiple VPCs in your cloud environment, which require access to internet endpoints. These VMs cannot have public IP addresses due to security policies, so you plan to use Cloud NAT to provide outbound internet access. Within your VPCs, you have several subnets in each region. You want to ensure that only specific subnets have access to the internet through Cloud NAT. You want to avoid any unintentional configuration issues caused by other administrators, and align to Google-recommended practices. What should you do?
A. Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure all primary and secondary subnet source ranges.
B. Create a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the constraint to a folder that contains the associated projects. Configure the allowedValues to only contain the subnets that should have internet access. Deploy Cloud NAT and select only the allowed subnets.
C. Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure a custom source range that includes the allowed subnets.
D. Deploy Cloud NAT in each VPC, and configure a custom source range that includes the allowed subnets. Configure Cloud NAT rules to only permit the allowed subnets to egress through Cloud NAT.
Show Answer
Correct Answer: B
Explanation: The recommended approach is to restrict which subnets can use Cloud NAT through organization policy, providing centralized enforcement that prevents accidental configuration changes by other administrators. Then configure the Cloud NAT gateway to include only the approved subnets. Firewall rules do not control whether Cloud NAT is available to a subnet, and the options referring to custom source ranges or Cloud NAT rules are not the appropriate mechanism for subnet selection in this scenario.
Question 59
Your company uses Compute Engine instances that are exposed to the public internet. Each compute instance has a single network interface with a single public IP address. You need to block any connection attempt that originates from internet clients with IP addresses that belong to the BGP_ASN_TOBLOCK BGP ASN. What should you do?
A. Create a new Cloud Armor backend security policy, and use the --network-src-asns parameter.
B. Create a new Cloud Armor network edge security policy, and use the --network-src-asns parameter.
C. Create a new Cloud Armor edge security policy, and use the --network-src-asns parameter.
D. Create a new firewall policy ingress rule, and use the --network-src-asns parameter.
Show Answer
Correct Answer: B
Explanation: Compute Engine instances with public IPs that are not behind an external HTTP(S) load balancer can be protected with Cloud Armor network edge security policies. Network edge security policies support matching on source BGP Autonomous System Numbers using the --network-src-asns parameter. Backend security policies are for load-balanced backends, edge security policies are for CDN/load-balancing use cases rather than direct VM public IP protection, and firewall policies do not support ASN-based matching.
Question 60
Your team deployed two applications in GKE that are exposed through an external Application Load Balancer. When queries are sent to www.mountkirkgames.com/sales and www.mountkirkgames.com/get-an-analysis, the correct pages are displayed. However, you have received complaints that www.mountkirkgames.com yields a 404 error. You need to resolve this error. What should you do?
A. Review the Service YAML file. Add a new path rule for the * character that directs to the base service. Reapply the YAML.
B. Review the Ingress YAML file. Add a new path rule for the * character that directs to the base service. Reapply the YAML.
C. Review the Ingress YAML file. Define the default backend. Reapply the YAML.
D. Review the Service YAML file. Define a default backend. Reapply the YAML.
Show Answer
Correct Answer: C
Explanation: The path-specific routes are working, so the Ingress rules for /sales and /get-an-analysis are functioning. A request to the root path that returns 404 indicates there is no matching rule and no default backend configured. In GKE Ingress, the default backend is defined in the Ingress resource, not the Service. Adding a wildcard path is not the correct fix for handling unmatched requests; defining the Ingress default backend is.
Question 61
You are attempting to establish a HA VPN to your on-premises network; however, the VPN connection is not establishing successfully. You have full administrative control over the Google Cloud networking environment and the on-premises firewalls that are acting as the VPN devices. The Google Cloud console shows "Negotiation failure" and "BGP is down". You check Cloud Logging by using a query for resource.type="vpn_gateway" and resource.labels.gateway_id="TUNNEL_ID_NUMBER". Logs Explorer shows frequent log entries:
log name: …/logs/cloud.googleapis.com%2Fipsec_events"
type: "vpn_gateway"
textPayload: "received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built"
You need to troubleshoot the VPN failure and take corrective action based on the Cloud Logging entries. What should you do?
A. Update the Google Cloud BGP session configuration to match the BGP peer ASN on the on-premises side.
B. Compare and review the Phase 2 settings on the on-premises firewall. Make sure the settings match one of the supported cipher suites for HA VPN.
C. Create a new Cloud VPN gateway in a region closer to the peer VPN gateway.
D. Compare the Phase 1 settings and recreate the Cloud VPN tunnel by choosing a different IKE version and pre-shared key.
Show Answer
Correct Answer: B
Explanation: The IPsec log 'received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built' indicates that IKE negotiation succeeded far enough to attempt creating the CHILD_SA, but the Phase 2 (IPsec) proposals did not match. This is typically caused by mismatched Phase 2 encryption/authentication/PFS settings or unsupported cipher suites. Review the on-premises Phase 2 configuration and ensure it matches one of Google Cloud HA VPN's supported proposals. A BGP ASN mismatch would not produce this IPsec proposal error, and changing regions, IKE version, or recreating the tunnel is not the appropriate first corrective action for this specific log message.
Question 62
Your organization has five different VPCs across different projects in y our Google Cloud organization that need high-throughput connectivity. You have performed an audit of the IP address utilization in each VPC, and there are two overlapping subnets that are used by two of the VPCs: 240.0.0.0/16 and 240.128.0.0/24. You have confirmed that no Class E subnets (240.0.0.0/4) will require inter-VPC connectivity, but all other subnets in the VPCs will need connectivity. You need to deploy a Google Cloud routing solution to meet the connectivity requirements. What should you do?
A. Create a full mesh of VPC Network Peering connections between all five VPCs. Make sure not to import or export subnet routes with public IP addresses. Add Cloud network firewall policy rules to allow traffic.
B. Create a Network Connectivity Center hub with a mesh topology. Add a VPC spoke for each of the five VPCs and configure an export exclude filter for 240.0.0.0/4. Add Cloud network firewall policy rules to allow traffic.
C. Create a series of multiple network interface VMs with an interface in each VPPlace the VMs in an instance group. Create an internal passthrough Network Load Balancer in each VPC with the backend of the instance group. Configure custom static routes in each VPC with the next hop of the respective load balancer. Add Cloud network firewall policy rules to allow traffic.
D. Create a full mesh of VPC Network Peering connections between all five VPCs with an export exclude filter for 240.0.0.0/4 on every side. Add Cloud network firewall policy rules to allow traffic.
Show Answer
Correct Answer: B
Explanation: Network Connectivity Center mesh topology is designed to provide high-throughput any-to-any connectivity among multiple VPCs. Route export filters can exclude the overlapping 240.0.0.0/4 range so those conflicting prefixes are not propagated, while all other routes are shared. VPC Network Peering does not support transitive routing and does not provide the required route export exclusion mechanism described. The multi-NIC VM solution is unnecessarily complex and not the recommended managed routing architecture for this use case.
Question 63
You are deploying HA VPN within Google Cloud. You need to exchange routes dynamically between your on-premises gateway and Google Cloud. You have already created a HA VPN gateway and a peer VPN gateway resource. What should you do?
A. Create a Cloud Router, add VPN tunnels, and configure BGP sessions.
B. Create a Cloud Router, add VPN tunnels, and configure static routes to your subnet ranges.
C. Create a second HA VPN gateway, add VPN tunnels, and create firewall rules to allow BGP traffic to the Cloud Router.
D. Create a second HA VPN gateway, add VPN tunnels, and enable global dynamic routing.
Show Answer
Correct Answer: A
Explanation: HA VPN uses Cloud Router with BGP for dynamic route exchange. After creating the HA VPN gateway and peer VPN gateway, the remaining steps are to create a Cloud Router, create the VPN tunnels associated with it, and configure BGP sessions. Static routes are not used for dynamic exchange, and creating a second HA VPN gateway is unnecessary in this scenario.
Question 64
Your company deployed a hub and spoke architecture in Google Cloud to host their workloads. They use VPC network peerings to connect the hub and the spokes. You need to replicate the design and use Network Connectivity Center. What should you do?
A. Choose a Network Connectivity Center star topology. Deploy the hub VPC in the center group. Deploy the spoke VPCs in the edge group.
B. Choose a Network Connectivity Center star topology. Deploy the spoke VPCs in the center group. Deploy the hub VPC in the edge group.
C. Choose a Network Connectivity Center mesh topology. Configure the hub and the spokes as Network Connectivity Center spokes.
D. Choose a Network Connectivity Center mesh topology. Configure the spokes as Network Connectivity Center spokes.
Show Answer
Correct Answer: A
Explanation: To replicate a traditional hub-and-spoke VPC peering design with Network Connectivity Center, use the star topology. Place the hub VPC in the center spoke group and the spoke VPCs in the edge spoke group. This preserves the hub-and-spoke communication pattern where edge spokes communicate through the hub and not directly with each other.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.