Professional Cloud Network Engineer Free Practice Questions — Page 8
Question 65
You have provisioned a Cloud Interconnect connection with a VLAN attachment. You configured Border Gateway Protocol (BGP) between your on-premises router and your Cloud Router. After deploying and testing the connection, you discover that the BGP session is not established between your on-premises router and the Cloud Router. Which two actions should you take to resolve this issue? (Choose two.)
A. From the Google Cloud console, run gcloud compute routers get-status to verify the Address Resolution Protocol (ARP) learned.
B. Verify that you have configured the on-premises router's subinterface with a subnet mask of /31.
C. Verify that you have configured the on-premises router's eBGP multihop with a minimum hop length of 4.
D. Verify that you have configured the on-premises router's BGP security parameters to use MD5 authentication.
E. From the Google Cloud console, run gcloud compute interconnects get-diagnostics to verify the Address Resolution Protocol (ARP) learned.
Show Answer
Correct Answer: C, E
Explanation: Cloud Interconnect troubleshooting includes verifying the underlying interconnect with the Interconnect diagnostics command (which reports ARP status) and ensuring the on-premises router is configured for eBGP multihop as required for Cloud Interconnect topologies. A /31 mask is incorrect because VLAN attachments use a /29 link-local range by default, MD5 authentication is optional, and the Cloud Router get-status command is not the ARP diagnostic command.
Sources:
https://docs.cloud.google.com/network-connectivity/docs/interconnect/support/troubleshooting
Question 66
You are deploying your infrastructure in the us-central1 region. Your on-premises data center is located in New York City, and the Google Cloud region closest to New York City is us-east4. Your Cloud Interconnect is located in Ashburn, Virginia (VA), United States. You need to use Cloud Interconnect to connect your application infrastructure with backend systems in your data center location. You do not expect the application bandwidth to exceed 500 Mbps. You want to minimize latency and cost. What should you do?
A. Create a Cloud Router and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VEnable global routing in your VPC. Set the bandwidth on the VLAN attachments to 500 Mbps.
B. Create a Cloud Router and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VA. Enable global routing in your VPC.
C. Create a Cloud Router in the us-central1 region and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VA. Enable global routing in your VP
D. Create a Cloud Router and VLAN attachments in the us-central1 region attached to your physical Interconnect in Ashburn, VA.
Show Answer
Correct Answer: B
Explanation: To minimize latency, terminate the Interconnect, Cloud Router, and VLAN attachments in the region closest to the on-premises location and the Interconnect facility (us-east4/Ashburn), then enable global dynamic routing so workloads in us-central1 can reach on-premises over the Interconnect. Cloud Router must be in the same region as the VLAN attachments. Specifying a 500 Mbps VLAN attachment does not materially reduce cost here because the hourly charge is the same across the listed bandwidth tiers for Dedicated Interconnect VLAN attachments.
Question 68
Your company is moving to a hybrid cloud environment and needs to connect two on-premises data centers to Google Cloud. Your company has opted for no service level agreement (SLA) on the Dedicated Interconnect ports. You set up a single Dedicated Interconnect to connect each on-premises data center to Google Cloud: one Dedicated Interconnect in us-east1 and another Dedicated Interconnect in us-west1. You also configured a Cloud Router for each Dedicated Interconnect in each respective region. You now need to configure the Interconnect attachments to provide as much high availability diversity as possible based on this design. What should you do?
A. • Build one VLAN attachment from each Dedicated Interconnect corresponding to the Cloud Router in that region. • Enable global routing at the VPC layer.
B. • Build one VLAN attachment from each Dedicated Interconnect corresponding to the Cloud Router in that region. • Enable regional routing at the VPC layer.
C. • Build two VLAN attachments from each Dedicated Interconnect: one connecting to the Cloud Router in us-east1, and one connecting to the Cloud Router in us-west1. • Enable regional routing at the VPC layer.
D. • Build two VLAN attachments from each Dedicated Interconnect: one connecting to the Cloud Router in us-east1, and one connecting to the Cloud Router in us-west1. • Enable global routing at the VPC layer.
Show Answer
Correct Answer: D
Explanation: To maximize high-availability diversity with two Dedicated Interconnects in different regions, each Dedicated Interconnect should have VLAN attachments to both regional Cloud Routers, providing path diversity across routers and regions. Because traffic and learned routes must be usable across regions, the VPC should use global dynamic routing. Regional routing would limit route propagation and reduce cross-region resiliency.
Question 69
Your organization wants to set up hybrid connectivity with VLAN attachments that terminate in a single Cloud Router with 99.9% uptime. You need to create a network design for your on-premises router that meets those requirements and has an active/passive configuration that uses only one VLAN attachment at a time. What should you do?
A. Create a design that uses the LOCAL_PREF BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
B. Create a design that uses an equal-cost multipath (ECMP) with flow-based hashing on your on-premises devices.
C. Create a design that uses a BGP multi-exit discriminator (MED) attribute to influence the egress path from Google Cloud to the on-premises environment.
D. Create a design that uses the AS_PATH BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
Show Answer
Correct Answer: C
Explanation: For a single Cloud Router with redundant VLAN attachments in an active/passive design, Google Cloud recommends using the BGP MED attribute to influence Google Cloud's choice of egress path toward the on-premises network. ECMP is for active/active load sharing, while LOCAL_PREF is an intra-AS attribute used by your own routers, not by Google Cloud to select the outbound path. AS_PATH prepending is a less preferred mechanism for this specific design.
Question 70
You are configuring the intrusion prevention service (IPS) feature on Cloud Next Generation Firewall Enterprise. You deployed your firewall endpoints and you need to inspect the traffic of the VMs. What should you do?
A. Configure Packet Mirroring to match the source/destination IP addresses of the VMs.
B. Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the goto_next action.
C. Configure a firewall rule to match the hostnames of the VMs, and use the apply_security_profile_group action.
D. Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the apply_security_profile_group action.
Show Answer
Correct Answer: D
Explanation: Cloud NGFW Enterprise IPS inspects traffic that is matched by a firewall rule using the apply_security_profile_group action. The rule should match the relevant VM traffic (typically by source/destination IP ranges or tags), and the attached security profile group enables intrusion prevention inspection. Packet Mirroring is not how Cloud NGFW Enterprise IPS is invoked, goto_next only continues rule evaluation without applying security inspection, and matching by hostname is not the standard firewall rule match criterion for this use case.
Question 71
Your organization recently exposed a set of services through a global external Application Load Balancer. After conducting some testing, you observed that responses would intermittently yield HTTP 4xx or 5xx error response codes. You already enabled and reviewed the health check logs. You need to identify the error. What should you do?
A. Access a VM in the VPC through SSH to access the backend VM directly. If the request is successful from the VM, increase the quantity of backends.
B. Delete the load balancer and backend services. Create a new Passthrough Network Load Balancer. Configure a failover group of VMs for the backend.
C. Validate the health of the backend service. Enable logging for the backend service and identify the error response in Cloud Logging. Review the statusDetails log field.
D. Validate the health of the backend service. Disable any Cloud Armor policies on the backend service, and identify any error response in Cloud Logging. Review the statusDetails log field.
Show Answer
Correct Answer: C
Explanation: For a global external Application Load Balancer, intermittent HTTP 4xx/5xx responses are best diagnosed by enabling backend service logging and inspecting Cloud Logging entries, particularly the statusDetails field, which provides detailed failure reasons beyond health check logs. Health check logs alone do not explain all request failures. Replacing the load balancer, increasing backends without diagnosis, or disabling Cloud Armor preemptively are not appropriate first troubleshooting steps.
Question 72
Your company's current network architecture has two VPCs that are connected by a dual-NIC instance that acts as a bump-in-the-wire firewall between the two VPCs. Flows between pairs of subnets across the two VPCs are working correctly. Suddenly, you receive an alert that none of the flows between the two VPCs are working anymore. You need to troubleshoot the problem. What should you do? (Choose two.)
A. Verify that a VPC Service Controls perimeter has not been enabled for the project that contains the two VPCs and the dual-NIC instance.
B. Use Cloud Logging to verify that there were no modifications to the VPC firewall rules or policies that were applied to the two network interfaces of the dual-NIC instance.
C. Verify that a public IP address has not been assigned to any network interface of the dual-NIC instance.
D. Verify that the dual-NIC instance has the --can-Ip-Forward attribute enabled.
E. Verify that the dual-NIC instance has not been added to a backend service.
Show Answer
Correct Answer: B, D
Explanation: A dual-NIC instance forwarding traffic between VPCs requires IP forwarding to be enabled; if can-ip-forward is disabled, packets will not be forwarded. A sudden outage can also result from changes to VPC firewall rules or hierarchical firewall policies affecting either NIC, and Cloud Logging (audit logs) can be used to verify whether such changes occurred. VPC Service Controls do not govern this type of VPC-to-VPC packet forwarding, assigning a public IP does not inherently break forwarding, and being part of a backend service does not explain loss of inter-VPC forwarding.
Question 73
You have recently taken over responsibility for your organization's Google Cloud network security configurations. You want to review your Cloud Next Generation Firewall (Cloud NGFW) configurations and ensure there are no rules that are allowing ingress traffic to your VMs and services from the internet. You want to avoid manual work. What should you do?
A. Review the firewall policy rules associated with the VPC, and filter for rules that allow ingress from 0.0.0.0/0.
B. Enable "Overly permissive rules insights" in Firewall Insights. Review results for rules that show allowed ingress traffic from internet sources.
C. Run Connectivity Tests from multiple external sources to double-check ingress traffic settings.
D. Enable the Network Analyzer API and review the "VPC Network" category insights.
Show Answer
Correct Answer: B
Explanation: Firewall Insights includes an 'Overly permissive rules' insight that automatically identifies firewall rules allowing broad internet ingress (such as from 0.0.0.0/0), avoiding manual review. Reviewing firewall rules manually is more labor-intensive, Connectivity Tests are not intended for comprehensive policy auditing, and Network Analyzer provides broader network insights rather than this specific automated firewall permissiveness check.
Question 74
Your company's cloud network has hybrid connectivity to an on-premises environment through Cloud Interconnect in two regions (us-east4 and us-west1). You received complaints that some on-premises destinations are no longer reachable from us-east4, after changes were made to advertise additional routes to us-west1. You need to troubleshoot to see if any routes were dropped. What should you do?
A. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the global routing_mode metric attribute.
B. Query the dynamic_routes/learned_routes/unique_destinations_limit metric and review the global routing_mode metric attribute.
C. Query the dynamic_routes/learned_routes/any_dropped_unique_destinations metric and review the regional routing_mode metric attribute.
D. Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the regional routing_mode metric attribute.
Show Answer
Correct Answer: C
Explanation: The metric any_dropped_unique_destinations is specifically intended to indicate whether any learned destinations were dropped because route quotas were exceeded. Since the issue is reachability after advertising additional routes in another region, first verify whether routes are being dropped. Because Cloud Interconnect exists in multiple regions, you should also review the regional routing_mode attribute to determine whether routing is regional or global, as this affects learned route behavior and quotas.
Question 75
Your organization has resources in two different VPCs, each in different Google Cloud projects, which require connectivity between them. You have already determined that there is no IP address overlap; however, one VPC uses privately used public IP (PUPI) ranges. You would like to enable connectivity between these resources by using a lower cost and higher performance method. What should you do?
A. Create a HA VPN between the two VPCs that includes the PUPI ranges in the Custom Route Advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using network tags as the source filter.
B. Create a HA VPN between the two VPCs that includes the PUPI ranges in the Custom Route Advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
C. Create a VPC Peering between the two VPCs that allows the export and import of custom routes. Create the necessary ingress VPC firewall rules that target the specific resources by using service accounts as the source filter.
D. Create a VPC Peering between the two VPCs that allows the export and import of subnet routes with public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
Show Answer
Correct Answer: D
Explanation: VPC Peering provides lower latency, higher throughput, and lower cost than HA VPN for connectivity between Google Cloud VPCs. Because one VPC uses privately used public IPv4 (PUPI) ranges, the peering must be configured to export and import subnet routes with public IP addresses (PUPI). Firewall rules for peered VPC traffic use IP address ranges as source matching; network tags and service accounts cannot identify sources across peered VPCs.
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.