Professional Cloud Network Engineer Free Practice Questions — Page 8
Question 72
Your company's current network architecture has two VPCs that are connected by a dual-NIC instance that acts as a bump-in-the-wire firewall between the two VPCs. Flows between pairs of subnets across the two VPCs are working correctly. Suddenly, you receive an alert that none of the flows between the two VPCs are working anymore. You need to troubleshoot the problem. What should you do? (Choose two.)
A. Verify that a VPC Service Controls perimeter has not been enabled for the project that contains the two VPCs and the dual-NIC instance.
B. Use Cloud Logging to verify that there were no modifications to the VPC firewall rules or policies that were applied to the two network interfaces of the dual-NIC instance.
C. Verify that a public IP address has not been assigned to any network interface of the dual-NIC instance.
D. Verify that the dual-NIC instance has the --can-Ip-Forward attribute enabled.
E. Verify that the dual-NIC instance has not been added to a backend service.
Show Answer
Correct Answer: B, D
Explanation: A dual-NIC instance forwarding traffic between VPCs requires IP forwarding to be enabled; if can-ip-forward is disabled, packets will not be forwarded. A sudden outage can also result from changes to VPC firewall rules or hierarchical firewall policies affecting either NIC, and Cloud Logging (audit logs) can be used to verify whether such changes occurred. VPC Service Controls do not govern this type of VPC-to-VPC packet forwarding, assigning a public IP does not inherently break forwarding, and being part of a backend service does not explain loss of inter-VPC forwarding.
Question 73
You have recently taken over responsibility for your organization's Google Cloud network security configurations. You want to review your Cloud Next Generation Firewall (Cloud NGFW) configurations and ensure there are no rules that are allowing ingress traffic to your VMs and services from the internet. You want to avoid manual work. What should you do?
A. Review the firewall policy rules associated with the VPC, and filter for rules that allow ingress from 0.0.0.0/0.
B. Enable "Overly permissive rules insights" in Firewall Insights. Review results for rules that show allowed ingress traffic from internet sources.
C. Run Connectivity Tests from multiple external sources to double-check ingress traffic settings.
D. Enable the Network Analyzer API and review the "VPC Network" category insights.
Show Answer
Correct Answer: B
Explanation: Firewall Insights includes an 'Overly permissive rules' insight that automatically identifies firewall rules allowing broad internet ingress (such as from 0.0.0.0/0), avoiding manual review. Reviewing firewall rules manually is more labor-intensive, Connectivity Tests are not intended for comprehensive policy auditing, and Network Analyzer provides broader network insights rather than this specific automated firewall permissiveness check.
Question 74
Your company's cloud network has hybrid connectivity to an on-premises environment through Cloud Interconnect in two regions (us-east4 and us-west1). You received complaints that some on-premises destinations are no longer reachable from us-east4, after changes were made to advertise additional routes to us-west1. You need to troubleshoot to see if any routes were dropped. What should you do?
A. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the global routing_mode metric attribute.
B. Query the dynamic_routes/learned_routes/unique_destinations_limit metric and review the global routing_mode metric attribute.
C. Query the dynamic_routes/learned_routes/any_dropped_unique_destinations metric and review the regional routing_mode metric attribute.
D. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the regional routing_mode metric attribute.
Show Answer
Correct Answer: C
Explanation: The metric any_dropped_unique_destinations is specifically intended to indicate whether any learned destinations were dropped because route quotas were exceeded. Since the issue is reachability after advertising additional routes in another region, first verify whether routes are being dropped. Because Cloud Interconnect exists in multiple regions, you should also review the regional routing_mode attribute to determine whether routing is regional or global, as this affects learned route behavior and quotas.
Question 75
Your organization has resources in two different VPCs, each in different Google Cloud projects, which require connectivity between them. You have already determined that there is no IP address overlap; however, one VPC uses privately used public IP (PUPI) ranges. You would like to enable connectivity between these resources by using a lower cost and higher performance method. What should you do?
A. Create a HA VPN between the two VPCs that includes the PUPI ranges in the Custom Route Advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using network tags as the source filter.
B. Create a HA VPN between the two VPCs that includes the PUPI ranges in the Custom Route Advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
C. Create a VPC Peering between the two VPCs that allows the export and import of custom routes. Create the necessary ingress VPC firewall rules that target the specific resources by using service accounts as the source filter.
D. Create a VPC Peering between the two VPCs that allows the export and import of subnet routes with public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
Show Answer
Correct Answer: D
Explanation: VPC Peering provides lower latency, higher throughput, and lower cost than HA VPN for connectivity between Google Cloud VPCs. Because one VPC uses privately used public IPv4 (PUPI) ranges, the peering must be configured to export and import subnet routes with public IP addresses (PUPI). Firewall rules for peered VPC traffic use IP address ranges as source matching; network tags and service accounts cannot identify sources across peered VPCs.
Question 76
Your organization recently re-architected your cloud environment to use Network Connectivity Center. However, an error occurred when you tried to add a new VPC, named vpc-dev, as a spoke. The error indicated that there was an issue with an existing spoke and the IP space of a VPC, named vpc-pre-prod. You must complete the migration quickly and efficiently. What should you do?
A. Delete the VMs associated with the conflicting subnets, then delete the conflicting subnets in vpc-dev. Recreate the subnets with a new IP range and redeploy the previously-deleted VMs in the new subnets. Add the VPC spoke for vpc-dev.
B. Exclude the conflicting IP range by using the --exclude-export-ranges flag when creating the VPC spoke for vpc-dev.
C. Exclude the conflicting IP range by using the --exclude-export-ranges flag in the hub when attaching the VPC spoke for vpc-dev.
D. Remove the conflicting VPC spoke for vpc-pre-prod from the set of VPC spokes in Network Connectivity Center. Add the VPC spoke for vpc-dev. Add the previously removed vpc-pre-prod as a VPC spoke.
Show Answer
Correct Answer: B
Explanation: Network Connectivity Center prevents overlapping exported IP ranges across VPC spokes. If only a specific conflicting range is the issue, the quickest and least disruptive solution is to exclude that range from export when creating the VPC spoke using the --exclude-export-ranges flag. This avoids renumbering subnets or removing existing spokes. The flag is specified on the VPC spoke creation, not on the hub.
Question 77
Recently, your networking team enabled Cloud CDN for one of the external-facing services that is exposed through an external Application Load Balancer. The application team has already defined which content should be cached within the responses. Upon testing the load balancer, you did not observe any change in performance after the Cloud CDN enablement. You need to resolve the issue. What should you do?
A. Configure the CACHE_ALL_STATIC caching mode on Cloud CDN to ensure Cloud CDN caches all static content as well as content defined by the backends.
B. Configure the FORCE_CACHE_ALL caching mode on Cloud CDN to ensure all appropriate content is cached.
C. Configure the USE_ORIGIN_HEADERS caching mode on Cloud CDN to ensure Cloud CDN caches content depending on responses to requests from the backends.
D. Configure the CACHE_ALL_STATIC caching mode on Cloud CDN to ensure Cloud CDN cache content depending on responses to requests from the backends.
Show Answer
Correct Answer: C
Explanation: If the application team has already defined which content should be cached within the responses, Cloud CDN should be configured to honor the origin's cache-control and related caching headers. The USE_ORIGIN_HEADERS cache mode caches content according to the backend's response headers. CACHE_ALL_STATIC applies default static-content caching behavior, while FORCE_CACHE_ALL overrides origin directives and is not appropriate when the origin has already defined the desired caching policy.
Question 78
You need to create the technical architecture for hybrid connectivity from your data center to Google Cloud. This will be managed by a partner. You want to follow Google-recommended practices for production-level applications. What should you do?
A. Ask the partner to install two security appliances in the data center. Configure one VPN connection from each of these devices to Google Cloud, and ensure that the VPN devices on-premises are in separate racks on separate power and cooling systems.
B. Configure two Partner Interconnect connections in one metropolitan area (metro). Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in a single region, and configure regional dynamic routing on the VPC.
C. Configure two Partner Interconnect connections in one metro and two connections in another metro. Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure global dynamic routing on the VP
D. Configure two Partner Interconnect connections in one metro and two connections in another metro. Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure regional dynamic routing on the VPC.
Show Answer
Correct Answer: C
Explanation: For production-grade Partner Interconnect, Google recommends high availability with redundant connections in separate metro edge availability domains, redundancy across two metros when possible, VLAN attachments in multiple regions, and global dynamic routing so prefixes are advertised and reachable across regions during failover. This provides resilience against metro, attachment, and regional failures. Regional dynamic routing would not provide the same cross-region route propagation, and VPN-only connectivity is not the recommended architecture for production Interconnect-class hybrid connectivity.
Question 79
Your company has a single on-premises data center that needs to be connected to a VPC in Google Cloud. The total bandwidth requirement is 10Gbps. The connection must be redundant and have a minimum SLA of 99.9%. Due to the sensitive nature of the workloads, you need to implement the solution with the lowest latency. What should you do?
A. Order a 10Gbps Partner Interconnect VLAN attachment. Create a Cloud Router in your Google Cloud VPC.
B. Order two 10Gbps Dedicated Interconnect connections in a single metropolitan area (metro). Distribute the connections across different edge availability domains. Create a Cloud Router and two 10Gbps VLAN attachments.
C. Create one HA VPN gateway. Create two tunnels-one tunnel for each of the two interfaces of the HA VPN gateway. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device that is located on-premises.
D. Create one HA VPN gateway. Create two tunnels-one tunnel for each of the two interfaces of the HA VPN gateway. Terminate each of the two tunnels on different public IPs addresses that are configured on the VPN termination device that is located on-premises.
Show Answer
Correct Answer: B
Explanation: Dedicated Interconnect provides the lowest-latency private connectivity to Google Cloud and supports 10 Gbps links. To achieve at least a 99.9% SLA, you need redundant Dedicated Interconnect connections in a single metro placed in different edge availability domains, along with Cloud Router and VLAN attachments for BGP. Partner Interconnect depends on a provider and is not the lowest-latency option, while HA VPN runs over the internet and cannot meet the combination of 10 Gbps bandwidth and lowest-latency requirements.
Question 80
Your frontend application VMs and your backend database VMs are all deployed in the same VPC but across different subnets. Global network firewall policy rules are configured to allow traffic from the frontend VMs to the backend VMs. Based on a recent compliance requirement, this traffic must now be inspected by network virtual appliances (NVAs) firewalls that are deployed in the same VPC. The NVAs are configured to be full network proxies and will source NAT-allowed traffic. You need to configure VPC routing to allow the NVAs to inspect the traffic between subnets. What should you do?
A. Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add the global network firewall policy rules to allow traffic through your NVAs. Create a policy-based route (PBR) with the source IP range of the backend VM subnet, destination IP range of the frontend VM subnet, and the next hop of ILB1. Scope the PBR to the VMs with the backend network tag. Add a backend network tag to your backend servers.
B. Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add global network firewall policy rules to allow traffic through your NVAs. Create a custom static route with the destination IP range of the backend VM subnet, frontend instance tag, and the next hop of ILB1. Add a frontend network tag to your frontend VMs.
C. Create your NVA with multiple interfaces. Configure NIC0 for NVA in the backend subnet. Configure NIC1 for NVA in the frontend subnet. Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add global network firewall policy rules to allow traffic through your NVAs. Create a custom static route with the destination IP range of the backend VM subnet, frontend instance tag, and the next hop of ILB1. Add a frontend network tag to your frontend VMs.
D. Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add global network firewall policy rules to allow traffic through your NVAs. Create a policy-based route (PBR) with the source IP range of the frontend VM subnet, destination IP range of the backend VM subnet, and the next hop of ILB1. Scope the PBR to the VMs with the frontend network tag. Add a frontend network tag to your frontend servers.
Show Answer
Correct Answer: D
Explanation: Policy-based routing is the correct mechanism to steer selected east-west traffic through an internal passthrough Network Load Balancer fronting NVAs. Because the traffic requiring inspection originates from the frontend subnet and is destined for the backend subnet, the PBR should match that source/destination pair and be scoped to the frontend VMs (via network tag). Since the NVAs perform source NAT, return traffic is naturally sent back through the NVAs without requiring a corresponding reverse PBR or multiple NIC configuration. Static routes with instance tags are not the appropriate mechanism for this selective traffic steering.
Question 81
You are implementing firewall controls to protect your computer resources in a newly created VPC. To make the protection process easier to manage and control, you've defined the hierarchical firewall policies, global network firewall policies, and VPC firewall rules. The configuration of rules defines the following characteristics:
• The hierarchical firewall policy, bound at the organization level, is allowing/denying spe-cific external traffic.
• There is a global network firewall policy with rules that enforce intrusion prevention sys-tem (IPS) capabilities for specific external inbound/outbound traffic.
• The VPC firewall rules allow internal communication from RFC 1918 defined subnets communications.
• The VPC firewall contains an explicit deny rule with logs enabled.
This configuration was successful in multiple preexisting VF'Cs. However, you noticed that the logs were missing when you were reviewing a newly created VPC. All external communications are hanging, but internal traffic is working as expected. You want to fix the connectivity issue.
What should you do?
A. Create a new VPC and migrate existing resources to the new VPC. Delete the old VPC, and reapply the firewall policies and rules in the newVPC.
B. Raise the priority numbers of the firewall policy rules and lower the priority numbers of the VPC firewall rules.
C. Review the order in which the VPC firewall rules and policies are evaluated. If the VPC firewall rules are being evaluated before firewall policies, switch the order.
D. Lower the priority numbers of the firewall policy rules and raise the priority numbers of the VPC firewall rules.
Show Answer
Correct Answer: C
Explanation: Hierarchical firewall policies are evaluated before network/VPC firewall rules by default, so a deny at a higher layer can prevent traffic from ever reaching the VPC firewall rule with logging, explaining the missing logs. The relevant fix is to review and correct the evaluation order/configuration so that the intended policy processing occurs. Changing numeric priorities alone cannot override the fixed precedence between hierarchical policies and VPC firewall rules.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.