Professional Cloud Network Engineer Free Practice Questions — Page 9
Question 82
Your organization has multiple VMs running on Google Cloud within a VPC. The VMs require connectivity to certain Google APIs. You need to enable Private Google Access for VM connectivity to Cloud Storage. What should you do?
A. Enable Private Google Access on the project, remove the default route that points to the default internet gateway, and enable the Cloud Storage API.
B. Enable Private Google Access on the VM, remove the default route that points to the default internet gateway, and enable the Cloud Storage API.
C. Enable Private Google Access on the VPC, create a default route that points to the default internet gateway, and enable the Cloud Storage API.
D. Enable Private Google Access on the subnet, create a default route that points to the default internet gateway, and enable the Cloud Storage API.
Show Answer
Correct Answer: D
Explanation: Private Google Access is configured at the subnet level, not the project, VPC, or individual VM. VMs without external IP addresses still require a default route to the default internet gateway so traffic to Google APIs can reach Google's network internally via Private Google Access. The Cloud Storage API must also be enabled for the project.
Question 83
Your organization has approximately 100 teams that need to manage their own environments. A central team must manage the network. You need to design a landing zone that provides separate projects for each team. You must also make sure the solution can scale. What should you do?
A. Configure Policy-based Routing for each team.
B. Configure a Shared VPC, and create a VPC network in the host project.
C. Configure VPC Network Peering, and peer one of the VPC's to the service project.
D. Configure a Shared VPC, and create a VPC network in the service project.
Show Answer
Correct Answer: B
Explanation: A Shared VPC is the recommended Google Cloud landing zone pattern when a central networking team manages networking while many application teams each use separate service projects. The VPC network resides in the host project and is shared with service projects, providing centralized network administration and scalable project separation.
Question 84
Your organization, TerramEarth, is launching a global application to manage credit card payments. There are some client VMs inside the same VPC as the application that need to access this application privately. Due to compliance requirements, the internal clients cannot use the global external IP address of the application. Currently, Cloud DNS only resolves myglobalapp.terramearth.com to the public IP address with a public zone. The clients will need to reach myglobalapp.example.com, without using its external IP address. You need to configure Cloud DNS to follow this requirement while following Google-recommended practices. What should you do?
A. Create a sub-domain named internal.terramearth.com. Add the new DNS entry (myglobalapp.internal.terramearth.com) to the sub-domain pointing to the internal IP address from the application VM.
B. Configure a query logic script inside Cloud DNS to check the source IP address from the VPC, and respond with a modified DNS record to include the internal IP address from the application VM.
C. Configure a private zone for the application record (myglobalapp.terramearth.com) and point to the internal IP address of the application VM. Bind this zone to the VP
D. Promote the ephemeral IP address from the application VM to static, add this static ip address to each internal client's host file, and change the myglobalapp.terramearth.com DNS record to this new static IP address.
Show Answer
Correct Answer: C
Explanation: Use split-horizon DNS by creating a Cloud DNS private zone for the same DNS name and associating it with the relevant VPC. In the private zone, create an A record for myglobalapp.terramearth.com that resolves to the application's internal IP address. Internal clients in the VPC will resolve the private record, while external clients continue to use the public zone and public IP. This is the recommended Google Cloud approach. Query-based response logic is not a Cloud DNS feature, changing the hostname is unnecessary, and editing host files is not scalable or recommended.
Question 85
You configured a single IPSec Cloud VPN tunnel for your organization to a third-party customer. You confirmed that the VPN tunnel is established. However, the BGP session status states that the BGP is not configured. The customer has provided you with their BGP settings:
• Local BGP address: 169.254.11.1/30
• Local ASN: 64515
• Peer BGP address: 169.254.11.2
• Peer ASN: 64517
• Base MED: 1000
• MD5 Authentication: Disabled
You need to configure the local BGP session for this tunnel based on the settings provided by the customer. You already associated the Cloud Router with the Cloud VPN Tunnel. What settings should you use for the BGP session?
Explanation: Configure the Google Cloud side using the customer's provided values from the opposite perspective: the peer ASN is the customer's local ASN (64515), the local BGP IP is the customer's peer BGP address (169.254.11.2), and the peer BGP IP is the customer's local BGP address (169.254.11.1). MD5 remains disabled. Although the customer lists a base MED of 1000, among the provided options only C correctly matches the required ASN, IP assignment, and MD5 settings; the other options have incorrect ASN, IP, or MD5 configuration.
Question 86
Your company recently migrated to Google Cloud. You configured separate Virtual Private Cloud (VPC) networks for Department A and Department B. You need to configure both VPC networks to have access to the same on-premises location through separate links with full isolation between the VPC networks. Your design must also query on-premises DNS servers from workloads in Google Cloud using conditional forwarding. You want to minimize operational overhead. What should you do?
A. Customize the operating system DNS configuration files to target the on-premises DNS servers.
B. Keep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
C. Peer Department A's and Department B's VPC networks to have all on-premises connectivity via a single VPC network. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
D. Configure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network.
Show Answer
Correct Answer: D
Explanation: The requirements combine network isolation, separate on-premises connectivity for each VPC, conditional forwarding to on-premises DNS, and low operational overhead. Using outbound forwarding independently from multiple VPCs is discouraged because Cloud DNS forwarding queries originate from the same source range, which can create return-path ambiguity. A Cloud DNS peering zone allows one VPC to use the other's outbound forwarding configuration while keeping separate network connectivity. Option C breaks the isolation requirement, A has high operational overhead, and B conflicts with Cloud DNS best practices for multiple outbound forwarders.
Question 87
You are designing a packet mirroring policy as part of your network security architecture for your gaming workload. Your infrastructure is located in the us-west2 region and deployed across several zones: us-west2-a, us-west2-b, and us-west2-c. The infrastructure is running a web-based application on TCP ports 80 and 443 with other game servers that utilize the UDP protocol. You need to deploy packet mirroring policies and collector instances to monitor web application traffic while minimizing inter-zonal network egress costs.
Following Google-recommended practices, how should you deploy the packet mirroring policies and collector instances?
A. Crate three packet mirroring policies: one for each zone. Create one group of collector instances for the us-west2 region. Configure each packet mirroring policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
B. Create one packet mirroring policy for the us-west2 region. Create one group of collector instances for the us-west2 region. Configure the packet mirroring policy to match traffic for web server instances based on instance-tags, and create a filter for TCP traffic.
C. Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
D. Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on subnets, and create a filter for TCP traffic.
Show Answer
Correct Answer: C
Explanation: To minimize inter-zonal egress costs, deploy collector instance groups in each zone so mirrored traffic stays within the same zone. Use separate packet mirroring policies aligned to each zone and match the web server instances using instance tags, filtering only TCP traffic (ports 80/443 are TCP, while UDP game traffic is excluded by the protocol filter). Using a single regional collector group can cause cross-zone mirrored traffic, and subnet-based matching is less appropriate than instance tags for targeting the web servers.
Question 88
You are designing a new network infrastructure for your customer in Google Cloud. Your customer requires a connection between two Google Cloud VPCs that must include a VPN tunnel. You want to follow Google-recommended practices while ensuring maximum availability of the connection. Which VPN configuration should you choose?
A. Policy-based VPN using Classic VPN between the two Google Cloud VPCs
B. Border Gateway Protocol (BGP)-based VPN using Classic VPN between the two Google Cloud VPCs
C. Route-based VPN using Classic VPN between the two Google Cloud VPCs
D. Border Gateway Protocol (BGP)-based VPN using HA VPN between the two Google Cloud VPCs
Show Answer
Correct Answer: D
Explanation: Google recommends HA VPN for new VPN deployments because it provides a highly available architecture with two interfaces and supports dynamic routing using BGP via Cloud Router. Between two Google Cloud VPCs, an HA VPN with BGP offers the highest availability and is the recommended configuration. Classic VPN is a legacy option and does not match the recommended practice for maximum availability.
Question 89
You are configuring your organization's Google Cloud environment to connect to your on-premises network, which does not support Border Gateway Protocol (BGP). Your on-premises network has 30 CIDR ranges that must be reachable from Google Cloud. Your VPN gateway creates a unique child security association (SA) per CIDR. You must ensure that the 30 CIDR ranges in your on-premises network are reachable from Google Cloud.
Following Google-recommended practices, which two methods can you use to accomplish this? (Choose two.)
A. Create a single Cloud VPN tunnel that uses route-based VPN.
B. Create a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors.
C. Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to unique peer IP addresses.
D. Create multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the remote traffic selectors.
E. Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to the same peer IP address.
Show Answer
Correct Answer: A, C
Explanation: Google recommends either using a route-based VPN (traffic selectors 0.0.0.0/0 with static routes when BGP is unavailable) or, for policy-based VPNs with many CIDRs and peers that create a separate child SA per CIDR, creating one tunnel per local/remote CIDR pair. For Classic VPN, those tunnels must connect to unique peer gateway IP addresses. A single policy-based tunnel with 30 remote traffic selectors is not the recommended design for peers that require a unique child SA per CIDR, and splitting into arbitrary groups of 10 CIDRs is not the documented recommendation.
Question 90
You have two VPCs: VPC A in Project A and VPC B in Project B. The VPCs are peered, and each VPC has VM instances in four zones. You are using the Network Intelligence Center Performance Dashboard to investigate the packet loss for traffic flows that start in VPC A and terminate in VPC B. You need the reported packet loss metric to have at least a 90% confidence level. What should you do?
A. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project A for the reported metric.
B. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project B for the reported metric.
C. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project A for the reported metric.
D. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project B for the reported metric.
Show Answer
Correct Answer: D
Explanation: For Network Intelligence Center Performance Dashboard, a 90% confidence level for packet loss requires at least 2.5 VMs multiplied by the number of zones in the project, per zone. With four zones, that is 2.5 × 4 = 10 VMs in each zone. For VPC peering across different projects, packet loss for flows is visible in the destination project. Since traffic starts in VPC A and terminates in VPC B, you should view the metric in Project B.
Question 91
You have the following Shared VPC design. VPC Flow Logs is configured for Subnet-1 in the host VPC. You also want to monitor flow logs for Subnet-2. What should you do?
A. Configure a VPC Flow Logs filter for Subnet-2 in the host project VPC.
B. Configure VPC Flow Logs in the service project VPC for Subnet-2.
C. Configure Packet Mirroring in both the host and service project VPCs.
D. Configure a firewall rule to permit Subnet-2 IP addresses outbound in the host project VPC.
Show Answer
Correct Answer: A
Explanation: In a Shared VPC, subnets belong to the host project's VPC network. VPC Flow Logs are enabled per subnet, so to monitor Subnet-2 you enable/configure VPC Flow Logs for that subnet in the host project's VPC. Flow logs for Shared VPC resources are reported in the host project. Packet Mirroring and firewall rules are unrelated, and you do not enable Shared VPC subnet flow logs in the service project's VPC because the subnet is owned by the host project.
Sources:
https://cloud.google.com/vpc/docs/flow-logs?hl=en
https://cloud.google.com/vpc/docs/using-flow-logs
$19
Get all 251 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.