Professional Cloud Network Engineer Free Practice Questions — Page 8
Question 68
Your organization recently re-architected your cloud environment to use Network Connectivity Center. However, an error occurred when you tried to add a new VPC, named vpc-dev, as a spoke. The error indicated that there was an issue with an existing spoke and the IP space of a VPC, named vpc-pre-prod. You must complete the migration quickly and efficiently. What should you do?
A. Delete the VMs associated with the conflicting subnets, then delete the conflicting subnets in vpc-dev. Recreate the subnets with a new IP range and redeploy the previously-deleted VMs in the new subnets. Add the VPC spoke for vpc-dev.
B. Exclude the conflicting IP range by using the --exclude-export-ranges flag when creating the VPC spoke for vpc-dev.
C. Exclude the conflicting IP range by using the --exclude-export-ranges flag in the hub when attaching the VPC spoke for vpc-dev.
D. Remove the conflicting VPC spoke for vpc-pre-prod from the set of VPC spokes in Network Connectivity Center. Add the VPC spoke for vpc-dev. Add the previously removed vpc-pre-prod as a VPC spoke.
Show Answer
Correct Answer: B
Explanation: Network Connectivity Center requires that IP ranges exported by spokes do not overlap. The conflict occurs because vpc-dev has IP space overlapping with an existing spoke (vpc-pre-prod). The fastest and least disruptive way to proceed is to exclude the overlapping CIDR ranges when creating the vpc-dev spoke using the --exclude-export-ranges flag. This avoids readdressing VPCs, deleting resources, or removing existing spokes, and is explicitly supported for resolving such conflicts.
Question 69
Recently, your networking team enabled Cloud CDN for one of the external-facing services that is exposed through an external Application Load Balancer. The application team has already defined which content should be cached within the responses. Upon testing the load balancer, you did not observe any change in performance after the Cloud CDN enablement. You need to resolve the issue. What should you do?
A. Configure the CACHE_ALL_STATIC caching mode on Cloud CDN to ensure Cloud CDN caches all static content as well as content defined by the backends.
B. Configure the FORCE_CACHE_ALL caching mode on Cloud CDN to ensure all appropriate content is cached.
C. Configure the USE_ORIGIN_HEADERS caching mode on Cloud CDN to ensure Cloud CDN caches content depending on responses to requests from the backends.
D. Configure the CACHE_ALL_STATIC caching mode on Cloud CDN to ensure Cloud CDN cache content depending on responses to requests from the backends.
Show Answer
Correct Answer: C
Explanation: The application team has already defined cache behavior in the origin responses (for example, using Cache-Control headers). If Cloud CDN is enabled but performance does not change, it indicates Cloud CDN is not honoring those origin-defined caching directives. Configuring the caching mode to USE_ORIGIN_HEADERS ensures Cloud CDN caches content based on the backend’s response headers, which is exactly what the application team prepared. Other modes either override origin intent or cache different content than intended.
Question 70
You need to create the technical architecture for hybrid connectivity from your data center to Google Cloud. This will be managed by a partner. You want to follow Google-recommended practices for production-level applications. What should you do?
A. Ask the partner to install two security appliances in the data center. Configure one VPN connection from each of these devices to Google Cloud, and ensure that the VPN devices on-premises are in separate racks on separate power and cooling systems.
B. Configure two Partner Interconnect connections in one metropolitan area (metro). Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in a single region, and configure regional dynamic routing on the VPC.
C. Configure two Partner Interconnect connections in one metro and two connections in another metro. Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure global dynamic routing on the VP
D. Configure two Partner Interconnect connections in one metro and two connections in another metro. Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure regional dynamic routing on the VPC.
Show Answer
Correct Answer: C
Explanation: Google-recommended production hybrid connectivity with Partner Interconnect requires high availability at multiple layers: redundancy within a metro (separate metro edge availability domains), redundancy across metros, and redundancy across regions. Option C provides two Partner Interconnect connections in two different metros, VLAN attachments in two regions, and global dynamic routing so all paths are active and failover is automatic. This matches Google’s HA Partner Interconnect best practices for production workloads.
Question 71
Your company has a single on-premises data center that needs to be connected to a VPC in Google Cloud. The total bandwidth requirement is 10Gbps. The connection must be redundant and have a minimum SLA of 99.9%. Due to the sensitive nature of the workloads, you need to implement the solution with the lowest latency. What should you do?
A. Order a 10Gbps Partner Interconnect VLAN attachment. Create a Cloud Router in your Google Cloud VPC.
B. Order two 10Gbps Dedicated Interconnect connections in a single metropolitan area (metro). Distribute the connections across different edge availability domains. Create a Cloud Router and two 10Gbps VLAN attachments.
C. Create one HA VPN gateway. Create two tunnels-one tunnel for each of the two interfaces of the HA VPN gateway. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device that is located on-premises.
D. Create one HA VPN gateway. Create two tunnels-one tunnel for each of the two interfaces of the HA VPN gateway. Terminate each of the two tunnels on different public IPs addresses that are configured on the VPN termination device that is located on-premises.
Show Answer
Correct Answer: B
Explanation: The requirements call for 10 Gbps bandwidth, redundancy, at least 99.9% SLA, and the lowest possible latency. Dedicated Interconnect provides the lowest latency because it is a direct physical connection to Google’s network, unlike Partner Interconnect (which depends on a service provider) or HA VPN (which runs over the public internet and cannot reliably meet 10 Gbps or low-latency requirements). To achieve a 99.9% SLA with Dedicated Interconnect, you must provision at least two connections in the same metro and place them in different edge availability domains, with Cloud Router and VLAN attachments for dynamic routing. This is exactly described in option B.
Question 72
Your frontend application VMs and your backend database VMs are all deployed in the same VPC but across different subnets. Global network firewall policy rules are configured to allow traffic from the frontend VMs to the backend VMs. Based on a recent compliance requirement, this traffic must now be inspected by network virtual appliances (NVAs) firewalls that are deployed in the same VPC. The NVAs are configured to be full network proxies and will source NAT-allowed traffic. You need to configure VPC routing to allow the NVAs to inspect the traffic between subnets. What should you do?
A. Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add the global network firewall policy rules to allow traffic through your NVAs. Create a policy-based route (PBR) with the source IP range of the backend VM subnet, destination IP range of the frontend VM subnet, and the next hop of ILB1. Scope the PBR to the VMs with the backend network tag. Add a backend network tag to your backend servers.
B. Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add global network firewall policy rules to allow traffic through your NVAs. Create a custom static route with the destination IP range of the backend VM subnet, frontend instance tag, and the next hop of ILB1. Add a frontend network tag to your frontend VMs.
C. Create your NVA with multiple interfaces. Configure NIC0 for NVA in the backend subnet. Configure NIC1 for NVA in the frontend subnet. Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add global network firewall policy rules to allow traffic through your NVAs. Create a custom static route with the destination IP range of the backend VM subnet, frontend instance tag, and the next hop of ILB1. Add a frontend network tag to your frontend VMs.
D. Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add global network firewall policy rules to allow traffic through your NVAs. Create a policy-based route (PBR) with the source IP range of the frontend VM subnet, destination IP range of the backend VM subnet, and the next hop of ILB1. Scope the PBR to the VMs with the frontend network tag. Add a frontend network tag to your frontend servers.
Show Answer
Correct Answer: D
Explanation: To force inter-subnet traffic through NVAs that act as full network proxies with SNAT, you must steer only the initiating traffic (from frontend to backend) to the NVAs. The correct approach is to place the NVAs behind an internal passthrough Network Load Balancer and use a policy-based route (PBR) that matches source = frontend subnet and destination = backend subnet, with the next hop set to the ILB. Scoping the PBR to frontend VMs ensures only this traffic is inspected. Because the NVAs SNAT the traffic, return traffic from the backend will automatically flow back through the NVAs without requiring routing on the backend. Static tag-based routes are inappropriate here, and dual-NIC designs are unnecessary.
Question 73
You are implementing firewall controls to protect your computer resources in a newly created VPC. To make the protection process easier to manage and control, you've defined the hierarchical firewall policies, global network firewall policies, and VPC firewall rules. The configuration of rules defines the following characteristics:
• The hierarchical firewall policy, bound at the organization level, is allowing/denying spe-cific external traffic.
• There is a global network firewall policy with rules that enforce intrusion prevention sys-tem (IPS) capabilities for specific external inbound/outbound traffic.
• The VPC firewall rules allow internal communication from RFC 1918 defined subnets communications.
• The VPC firewall contains an explicit deny rule with logs enabled.
This configuration was successful in multiple preexisting VF'Cs. However, you noticed that the logs were missing when you were reviewing a newly created VPC. All external communications are hanging, but internal traffic is working as expected. You want to fix the connectivity issue.
What should you do?
A. Create a new VPC and migrate existing resources to the new VPC. Delete the old VPC, and reapply the firewall policies and rules in the newVPC.
B. Raise the priority numbers of the firewall policy rules and lower the priority numbers of the VPC firewall rules.
C. Review the order in which the VPC firewall rules and policies are evaluated. If the VPC firewall rules are being evaluated before firewall policies, switch the order.
D. Lower the priority numbers of the firewall policy rules and raise the priority numbers of the VPC firewall rules.
Show Answer
Correct Answer: C
Explanation: In Google Cloud, firewall evaluation follows a fixed hierarchy: hierarchical firewall policies (organization/folder) are evaluated before global network firewall policies, which are evaluated before VPC firewall rules. Priority numbers only affect ordering within the same level and cannot override this hierarchy. The symptoms—external traffic hanging, no VPC deny logs, but internal traffic working—indicate that traffic is being denied by a higher-level policy before it reaches the VPC firewall rules. The correct action is to review the evaluation order and identify higher-level rules blocking traffic, then adjust those policies accordingly. Option C best reflects this approach.
Question 74
Your organization has multiple VMs running on Google Cloud within a VPC. The VMs require connectivity to certain Google APIs. You need to enable Private Google Access for VM connectivity to Cloud Storage. What should you do?
A. Enable Private Google Access on the project, remove the default route that points to the default internet gateway, and enable the Cloud Storage API.
B. Enable Private Google Access on the VM, remove the default route that points to the default internet gateway, and enable the Cloud Storage API.
C. Enable Private Google Access on the VPC, create a default route that points to the default internet gateway, and enable the Cloud Storage API.
D. Enable Private Google Access on the subnet, create a default route that points to the default internet gateway, and enable the Cloud Storage API.
Show Answer
Correct Answer: D
Explanation: Private Google Access is configured at the subnet level, not per VM or per project. To allow VMs without external IPs to reach Google APIs such as Cloud Storage, you must enable Private Google Access on the subnet, ensure a default route to the default internet gateway exists (used to reach Google APIs internally), and enable the Cloud Storage API.
Question 75
Your organization has approximately 100 teams that need to manage their own environments. A central team must manage the network. You need to design a landing zone that provides separate projects for each team. You must also make sure the solution can scale. What should you do?
A. Configure Policy-based Routing for each team.
B. Configure a Shared VPC, and create a VPC network in the host project.
C. Configure VPC Network Peering, and peer one of the VPC's to the service project.
D. Configure a Shared VPC, and create a VPC network in the service project.
Show Answer
Correct Answer: B
Explanation: A Shared VPC is designed for large-scale, multi-team environments where a central team manages networking while individual teams operate in separate projects. Creating the VPC network in a host project and attaching multiple service projects allows centralized control, strong isolation, and scalability to hundreds of teams. The other options either do not scale well or do not provide centralized network governance.
Question 76
Your organization, TerramEarth, is launching a global application to manage credit card payments. There are some client VMs inside the same VPC as the application that need to access this application privately. Due to compliance requirements, the internal clients cannot use the global external IP address of the application. Currently, Cloud DNS only resolves myglobalapp.terramearth.com to the public IP address with a public zone. The clients will need to reach myglobalapp.example.com, without using its external IP address. You need to configure Cloud DNS to follow this requirement while following Google-recommended practices. What should you do?
A. Create a sub-domain named internal.terramearth.com. Add the new DNS entry (myglobalapp.internal.terramearth.com) to the sub-domain pointing to the internal IP address from the application VM.
B. Configure a query logic script inside Cloud DNS to check the source IP address from the VPC, and respond with a modified DNS record to include the internal IP address from the application VM.
C. Configure a private zone for the application record (myglobalapp.terramearth.com) and point to the internal IP address of the application VM. Bind this zone to the VP
D. Promote the ephemeral IP address from the application VM to static, add this static ip address to each internal client's host file, and change the myglobalapp.terramearth.com DNS record to this new static IP address.
Show Answer
Correct Answer: C
Explanation: Use split-horizon DNS with Cloud DNS. Create a private DNS zone for the same FQDN (myglobalapp.terramearth.com) that resolves to the internal IP and attach the zone to the VPC. Internal clients will receive the private IP, while external users continue to resolve the public IP from the public zone. This follows Google-recommended practices and meets compliance by avoiding use of the external IP.
Question 77
You configured a single IPSec Cloud VPN tunnel for your organization to a third-party customer. You confirmed that the VPN tunnel is established. However, the BGP session status states that the BGP is not configured. The customer has provided you with their BGP settings:
• Local BGP address: 169.254.11.1/30
• Local ASN: 64515
• Peer BGP address: 169.254.11.2
• Peer ASN: 64517
• Base MED: 1000
• MD5 Authentication: Disabled
You need to configure the local BGP session for this tunnel based on the settings provided by the customer. You already associated the Cloud Router with the Cloud VPN Tunnel. What settings should you use for the BGP session?
Explanation: For a Cloud VPN BGP session, the Peer ASN must be the customer’s ASN, not your own. The customer specifies Local ASN 64515 and Peer ASN 64517, so from your side the Peer ASN is 64515. The customer’s local BGP IP is 169.254.11.1, meaning your local BGP IP must be 169.254.11.2 and the peer IP 169.254.11.1. MD5 authentication is disabled per the requirements. Option C is the only choice that correctly matches ASN roles, IP addressing, and authentication settings.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.