Professional Cloud Network Engineer Free Practice Questions — Page 7
Question 58
You are deploying your infrastructure in the us-central1 region. Your on-premises data center is located in New York City, and the Google Cloud region closest to New York City is us-east4. Your Cloud Interconnect is located in Ashburn, Virginia (VA), United States. You need to use Cloud Interconnect to connect your application infrastructure with backend systems in your data center location. You do not expect the application bandwidth to exceed 500 Mbps. You want to minimize latency and cost. What should you do?
A. Create a Cloud Router and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VEnable global routing in your VPC. Set the bandwidth on the VLAN attachments to 500 Mbps.
B. Create a Cloud Router and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VA. Enable global routing in your VPC.
C. Create a Cloud Router in the us-central1 region and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VA. Enable global routing in your VP
D. Create a Cloud Router and VLAN attachments in the us-central1 region attached to your physical Interconnect in Ashburn, VA.
Show Answer
Correct Answer: B
Explanation: To minimize latency, the Cloud Router and VLAN attachments must be created in the region closest to the on‑premises data center and the Interconnect location, which is us‑east4 (Ashburn, VA). Enabling global routing allows the us‑central1 VPC resources to reach the on‑premises network over the Interconnect. Options C and D are invalid because Cloud Routers must be in the same region as the VLAN attachments and Interconnect. Option A adds an explicit 500‑Mbps bandwidth setting, but this does not reduce cost for Cloud Interconnect VLAN attachments (pricing is the same across supported sizes) and does not change latency, so it provides no benefit over B.
Question 59
Your company runs an enterprise platform on-premises using virtual machines (VMs). Your internet customers have created tens of thousands of DNS domains pointing to your public IP addresses allocated to the VMs. Typically, your customers hard-code your IP addresses in their DNS records. You are now planning to migrate the platform to Compute Engine and you want to use Bring Your Own IP. You want to minimize disruption to the platform. What should you do?
A. Create a VPC and request static external IP addresses from Google Cloud. Assign the IP addresses to the Compute Engine instances. Notify your customers of the new IP addresses so they can update their DNS records.
B. Verify ownership of your IP addresses. After the verification, Google Cloud advertises and provisions the IP prefix for you. Assign the IP addresses to the Compute Engine instances.
C. Create a VPC with the same IP address range as your on-premises network. Assign the IP addresses to the Compute Engine instances.
D. Verify ownership of your IP addresses. Use live migration to import the prefix. Assign the IP addresses to the Compute Engine instances.
Show Answer
Correct Answer: D
Explanation: To minimize disruption when many customers have hard-coded your public IPs, you should use Google Cloud BYOIP with live migration. Live migration allows Google to begin advertising your IP prefix while traffic is still flowing, enabling a seamless cutover with minimal or no downtime. Option B describes the general BYOIP process but does not address minimizing disruption during an active migration, whereas option D explicitly does.
Question 60
Your company is moving to a hybrid cloud environment and needs to connect two on-premises data centers to Google Cloud. Your company has opted for no service level agreement (SLA) on the Dedicated Interconnect ports. You set up a single Dedicated Interconnect to connect each on-premises data center to Google Cloud: one Dedicated Interconnect in us-east1 and another Dedicated Interconnect in us-west1. You also configured a Cloud Router for each Dedicated Interconnect in each respective region. You now need to configure the Interconnect attachments to provide as much high availability diversity as possible based on this design. What should you do?
A. • Build one VLAN attachment from each Dedicated Interconnect corresponding to the Cloud Router in that region. • Enable global routing at the VPC layer.
B. • Build one VLAN attachment from each Dedicated Interconnect corresponding to the Cloud Router in that region. • Enable regional routing at the VPC layer.
C. • Build two VLAN attachments from each Dedicated Interconnect: one connecting to the Cloud Router in us-east1, and one connecting to the Cloud Router in us-west1. • Enable regional routing at the VPC layer.
D. • Build two VLAN attachments from each Dedicated Interconnect: one connecting to the Cloud Router in us-east1, and one connecting to the Cloud Router in us-west1. • Enable global routing at the VPC layer.
Show Answer
Correct Answer: D
Explanation: With no SLA on Dedicated Interconnect ports, high availability must be achieved through architectural diversity. Creating two VLAN attachments per Dedicated Interconnect and connecting them to Cloud Routers in both us-east1 and us-west1 maximizes path and regional diversity. Enabling global dynamic routing allows routes learned in one region to be used in the other, providing cross‑region failover and the highest availability possible with this design.
Question 61
Your organization wants to set up hybrid connectivity with VLAN attachments that terminate in a single Cloud Router with 99.9% uptime. You need to create a network design for your on-premises router that meets those requirements and has an active/passive configuration that uses only one VLAN attachment at a time. What should you do?
A. Create a design that uses the LOCAL_PREF BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
B. Create a design that uses an equal-cost multipath (ECMP) with flow-based hashing on your on-premises devices.
C. Create a design that uses a BGP multi-exit discriminator (MED) attribute to influence the egress path from Google Cloud to the on-premises environment.
D. Create a design that uses the AS_PATH BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
Show Answer
Correct Answer: C
Explanation: To achieve an active/passive design with multiple VLAN attachments terminating on a single Cloud Router, you must influence Google Cloud’s egress path selection toward on‑premises. Google Cloud honors the BGP MED attribute for this purpose, allowing you to prefer one VLAN attachment while keeping the other as standby. LOCAL_PREF applies only within a single AS (on‑prem) and cannot influence Google Cloud’s choice, ECMP would be active/active rather than active/passive, and AS_PATH prepending is not the recommended or deterministic approach for this scenario.
Question 62
You are configuring the intrusion prevention service (IPS) feature on Cloud Next Generation Firewall Enterprise. You deployed your firewall endpoints and you need to inspect the traffic of the VMs. What should you do?
A. Configure Packet Mirroring to match the source/destination IP addresses of the VMs.
B. Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the goto_next action.
C. Configure a firewall rule to match the hostnames of the VMs, and use the apply_security_profile_group action.
D. Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the apply_security_profile_group action.
Show Answer
Correct Answer: D
Explanation: To inspect VM traffic with Cloud NGFW Enterprise IPS, traffic must be matched by a firewall rule and explicitly sent to the NGFW endpoint using a security profile group. This is done by configuring a firewall rule that matches the source and/or destination IP addresses of the VMs and using the apply_security_profile_group action. Packet mirroring is not used for NGFW IPS, goto_next does not trigger inspection, and hostname-based matching is not supported for applying security profile groups.
Question 63
Your organization recently exposed a set of services through a global external Application Load Balancer. After conducting some testing, you observed that responses would intermittently yield HTTP 4xx or 5xx error response codes. You already enabled and reviewed the health check logs. You need to identify the error. What should you do?
A. Access a VM in the VPC through SSH to access the backend VM directly. If the request is successful from the VM, increase the quantity of backends.
B. Delete the load balancer and backend services. Create a new Passthrough Network Load Balancer. Configure a failover group of VMs for the backend.
C. Validate the health of the backend service. Enable logging for the backend service and identify the error response in Cloud Logging. Review the statusDetails log field.
D. Validate the health of the backend service. Disable any Cloud Armor policies on the backend service, and identify any error response in Cloud Logging. Review the statusDetails log field.
Show Answer
Correct Answer: C
Explanation: Intermittent 4xx/5xx responses from a global external Application Load Balancer are best diagnosed by inspecting backend service logs. Enabling backend service logging and reviewing Cloud Logging—especially the statusDetails field—reveals whether errors originate from the load balancer, backend health, timeouts, or configuration issues. Health checks alone are insufficient, and disabling Cloud Armor or changing load balancer types is unnecessary for initial diagnosis.
Question 64
Your company's current network architecture has two VPCs that are connected by a dual-NIC instance that acts as a bump-in-the-wire firewall between the two VPCs. Flows between pairs of subnets across the two VPCs are working correctly. Suddenly, you receive an alert that none of the flows between the two VPCs are working anymore. You need to troubleshoot the problem. What should you do? (Choose two.)
A. Verify that a VPC Service Controls perimeter has not been enabled for the project that contains the two VPCs and the dual-NIC instance.
B. Use Cloud Logging to verify that there were no modifications to the VPC firewall rules or policies that were applied to the two network interfaces of the dual-NIC instance.
C. Verify that a public IP address has not been assigned to any network interface of the dual-NIC instance.
D. Verify that the dual-NIC instance has the --can-Ip-Forward attribute enabled.
E. Verify that the dual-NIC instance has not been added to a backend service.
Show Answer
Correct Answer: B, D
Explanation: A dual-NIC bump-in-the-wire firewall depends on correct firewall rules and IP forwarding. If traffic suddenly stops, first verify via Cloud Logging that no VPC firewall rules or policies were modified on either NIC, which could block traffic. Also ensure the instance still has IP forwarding enabled (--can-ip-forward); without it, the instance cannot forward packets between its two network interfaces.
Question 65
You have recently taken over responsibility for your organization's Google Cloud network security configurations. You want to review your Cloud Next Generation Firewall (Cloud NGFW) configurations and ensure there are no rules that are allowing ingress traffic to your VMs and services from the internet. You want to avoid manual work. What should you do?
A. Review the firewall policy rules associated with the VPC, and filter for rules that allow ingress from 0.0.0.0/0.
B. Enable "Overly permissive rules insights" in Firewall Insights. Review results for rules that show allowed ingress traffic from internet sources.
C. Run Connectivity Tests from multiple external sources to double-check ingress traffic settings.
D. Enable the Network Analyzer API and review the "VPC Network" category insights.
Show Answer
Correct Answer: B
Explanation: Firewall Insights provides automated analysis of Cloud NGFW policies. Enabling the Overly permissive rules insights surfaces rules that allow ingress from internet sources (such as 0.0.0.0/0) without manual review, directly meeting the requirement to avoid manual work.
Question 66
Your company's cloud network has hybrid connectivity to an on-premises environment through Cloud Interconnect in two regions (us-east4 and us-west1). You received complaints that some on-premises destinations are no longer reachable from us-east4, after changes were made to advertise additional routes to us-west1. You need to troubleshoot to see if any routes were dropped. What should you do?
A. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the global routing_mode metric attribute.
B. Query the dynamic_routes/learned_routes/unique_destinations_limit metric and review the global routing_mode metric attribute.
C. Query the dynamic_routes/learned_routes/any_dropped_unique_destinations metric and review the regional routing_mode metric attribute.
D. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the regional routing_mode metric attribute.
Show Answer
Correct Answer: C
Explanation: To determine whether routes were dropped, you need a metric that explicitly signals route drops due to quota limits. The any_dropped_unique_destinations metric indicates whether any learned routes were dropped because one or more route quotas were exceeded. Since reachability differs by region after advertising more routes to us-west1, the routing scope matters; checking the regional routing_mode attribute helps confirm whether regional dynamic routing caused routes learned in one region (us-west1) not to be available in another (us-east4).
Question 67
Your organization has resources in two different VPCs, each in different Google Cloud projects, which require connectivity between them. You have already determined that there is no IP address overlap; however, one VPC uses privately used public IP (PUPI) ranges. You would like to enable connectivity between these resources by using a lower cost and higher performance method. What should you do?
A. Create a HA VPN between the two VPCs that includes the PUPI ranges in the Custom Route Advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using network tags as the source filter.
B. Create a HA VPN between the two VPCs that includes the PUPI ranges in the Custom Route Advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
C. Create a VPC Peering between the two VPCs that allows the export and import of custom routes. Create the necessary ingress VPC firewall rules that target the specific resources by using service accounts as the source filter.
D. Create a VPC Peering between the two VPCs that allows the export and import of subnet routes with public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
Show Answer
Correct Answer: D
Explanation: VPC Peering provides lower cost and higher performance than VPN. Because one VPC uses privately used public IPv4 (PUPI) ranges, peering must explicitly enable exchange of subnet routes with privately used public IP addresses. IPv4 subnet routes are exchanged by default once this option is enabled, allowing reachability without IP overlap. Appropriate firewall rules can then be created using IP ranges. HA VPN is unnecessary and higher cost, making options A and B inferior.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.