Professional Cloud Network Engineer Free Practice Questions — Page 9
Question 78
Your company recently migrated to Google Cloud. You configured separate Virtual Private Cloud (VPC) networks for Department A and Department B. You need to configure both VPC networks to have access to the same on-premises location through separate links with full isolation between the VPC networks. Your design must also query on-premises DNS servers from workloads in Google Cloud using conditional forwarding. You want to minimize operational overhead. What should you do?
A. Customize the operating system DNS configuration files to target the on-premises DNS servers.
B. Keep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
C. Peer Department A's and Department B's VPC networks to have all on-premises connectivity via a single VPC network. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
D. Configure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network.
Show Answer
Correct Answer: D
Explanation: The requirement is to keep the two VPCs fully isolated, provide separate on‑premises connectivity, enable conditional DNS forwarding to on‑premises DNS, and minimize operational overhead. Google Cloud best practices explicitly advise against configuring outbound DNS forwarding from multiple VPCs to the same on‑premises DNS servers, because all queries originate from the same Google DNS IP range and return traffic cannot be reliably routed. Using Cloud DNS peering allows only one VPC to perform outbound forwarding while the other resolves through DNS peering, avoiding multiple outbound forwarding configurations. Option D achieves this, maintains network isolation (no VPC peering or shared connectivity), and follows Cloud DNS best practices.
Question 79
You are designing a packet mirroring policy as part of your network security architecture for your gaming workload. Your infrastructure is located in the us-west2 region and deployed across several zones: us-west2-a, us-west2-b, and us-west2-c. The infrastructure is running a web-based application on TCP ports 80 and 443 with other game servers that utilize the UDP protocol. You need to deploy packet mirroring policies and collector instances to monitor web application traffic while minimizing inter-zonal network egress costs.
Following Google-recommended practices, how should you deploy the packet mirroring policies and collector instances?
A. Crate three packet mirroring policies: one for each zone. Create one group of collector instances for the us-west2 region. Configure each packet mirroring policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
B. Create one packet mirroring policy for the us-west2 region. Create one group of collector instances for the us-west2 region. Configure the packet mirroring policy to match traffic for web server instances based on instance-tags, and create a filter for TCP traffic.
C. Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
D. Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on subnets, and create a filter for TCP traffic.
Show Answer
Correct Answer: C
Explanation: To minimize inter-zonal network egress costs, mirrored traffic should remain within the same zone whenever possible. Google-recommended practices therefore suggest deploying packet mirroring policies and collector instances on a per-zone basis. By creating one packet mirroring policy and one collector instance group in each zone (us-west2-a, us-west2-b, us-west2-c), mirrored traffic does not cross zone boundaries. Using instance-tags precisely targets only the web server instances, and applying a TCP filter ensures that only ports 80 and 443 traffic is mirrored, excluding UDP-based game traffic. This design is both cost-efficient and aligned with Google Cloud best practices.
Question 80
You are designing a new network infrastructure for your customer in Google Cloud. Your customer requires a connection between two Google Cloud VPCs that must include a VPN tunnel. You want to follow Google-recommended practices while ensuring maximum availability of the connection. Which VPN configuration should you choose?
A. Policy-based VPN using Classic VPN between the two Google Cloud VPCs
B. Border Gateway Protocol (BGP)-based VPN using Classic VPN between the two Google Cloud VPCs
C. Route-based VPN using Classic VPN between the two Google Cloud VPCs
D. Border Gateway Protocol (BGP)-based VPN using HA VPN between the two Google Cloud VPCs
Show Answer
Correct Answer: D
Explanation: Google-recommended best practice for maximum availability between VPCs is HA VPN with BGP. HA VPN provides SLA-backed high availability with multiple tunnels and dynamic routing via BGP, unlike Classic VPN options which are legacy and less resilient.
Question 81
You are configuring your organization's Google Cloud environment to connect to your on-premises network, which does not support Border Gateway Protocol (BGP). Your on-premises network has 30 CIDR ranges that must be reachable from Google Cloud. Your VPN gateway creates a unique child security association (SA) per CIDR. You must ensure that the 30 CIDR ranges in your on-premises network are reachable from Google Cloud.
Following Google-recommended practices, which two methods can you use to accomplish this? (Choose two.)
A. Create a single Cloud VPN tunnel that uses route-based VPN.
B. Create a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors.
C. Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to unique peer IP addresses.
D. Create multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the remote traffic selectors.
E. Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to the same peer IP address.
Show Answer
Correct Answer: A, C
Explanation: Google-recommended practice prefers route-based VPNs when possible because they avoid traffic-selector scaling limits. Even without BGP, a single route-based Cloud VPN tunnel can be used with static routes, and route-based VPNs use 0.0.0.0/0 traffic selectors while allowing more specific routes in Cloud Router/VPC (A). When policy-based routing is required due to peer constraints (unique child SA per CIDR), Google recommends creating multiple policy-based tunnels, each with exactly one local and one remote CIDR per tunnel, which aligns SAs cleanly. This requires multiple tunnels, each mapped one-to-one with CIDRs, and peers must provide distinct external IPs per tunnel (C). Other options either exceed recommended selector limits or do not follow Google’s route-alignment guidance.
Question 82
You have two VPCs: VPC A in Project A and VPC B in Project B. The VPCs are peered, and each VPC has VM instances in four zones. You are using the Network Intelligence Center Performance Dashboard to investigate the packet loss for traffic flows that start in VPC A and terminate in VPC B. You need the reported packet loss metric to have at least a 90% confidence level. What should you do?
A. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project A for the reported metric.
B. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project B for the reported metric.
C. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project A for the reported metric.
D. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project B for the reported metric.
Show Answer
Correct Answer: D
Explanation: For the Performance Dashboard packet loss metric to reach 90% confidence, Google Cloud requires 2.5 VMs multiplied by the number of zones in the project. With four zones, this equals 10 VM instances per zone in each VPC. Additionally, when VPCs are peered across different projects, packet loss metrics are visible only in the destination project. Since traffic starts in VPC A and terminates in VPC B, the metric must be viewed in Project B. Therefore, option D is correct.
Question 83
You have the following Shared VPC design. VPC Flow Logs is configured for Subnet-1 in the host VPC. You also want to monitor flow logs for Subnet-2. What should you do?
A. Configure a VPC Flow Logs filter for Subnet-2 in the host project VPC.
B. Configure VPC Flow Logs in the service project VPC for Subnet-2.
C. Configure Packet Mirroring in both the host and service project VPCs.
D. Configure a firewall rule to permit Subnet-2 IP addresses outbound in the host project VPC.
Show Answer
Correct Answer: A
Explanation: In a Shared VPC, all subnets are created and owned by the host project VPC, even though VM instances may run in service projects. VPC Flow Logs are enabled per subnet on the VPC network that owns the subnet. Therefore, to monitor flow logs for Subnet-2, you must enable (or configure) VPC Flow Logs for Subnet-2 in the host project VPC. You do not configure VPC Flow Logs in a service project for a Shared VPC subnet.
Question 84
You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements:
• Each Google Cloud project must represent an internal project that your team will work on.
• After an internal project is finished, the infrastructure must be deleted.
• Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources.
• You have 10-100 projects deployed at a time.
While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable with centralized management.
What should you do?
A. Create a single project and single VPC for each internal project.
B. Create a single Shared VPC and attach each Google Cloud project as a service project.
C. Create a single project and additional VPCs for each internal project. D.O Create a Shared VPC and service project for each internal project.
Show Answer
Correct Answer: B
Explanation: The requirements call for simple, reusable Terraform code with centralized management, while supporting 10–100 short‑lived internal projects, each with its own project owner. Using a single Shared VPC host project with each internal project as a service project centralizes network management, reduces duplication, and is a well‑established Google Cloud best practice for multi‑project environments. Projects can still be independently owned and safely deleted when finished, while Terraform modules remain reusable and easy to manage. Options A and C duplicate networking and increase operational overhead, and D is invalid because a Shared VPC requires a distinct host project rather than one per internal project.
Question 85
You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network. Currently, there is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability. What should you do?
A. Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
B. Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
C. Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VP
D. Use HA VPN. Configure one tunnel from each interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.
Show Answer
Correct Answer: D
Explanation: A 99.99% SLA can be achieved with HA VPN when you use an HA VPN gateway with two interfaces and establish one tunnel from each interface to redundant peer interfaces on‑premises, along with Cloud Router and dynamic routing. Two Dedicated Interconnect connections in a single metro only provide up to 99.9% availability; 99.99% would require four connections across two metros. Therefore, option D is the only design that meets the stated SLA.
Question 86
You have the networking configuration shown in the diagram. Two VLAN attachments associated with two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BGP) sessions associated with each of the VLAN attachments.
You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow?
A. From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results.
B. From the Cloud CLI, run gcloud compute –-project PROJECT_ID routers get-status mycloudrouter –-region REGION and review the results.
C. From the Google Cloud console, navigate to the Hybrid Connectivity, select the Cloud Router, and view BGP sessions.
D. From the Cloud CLI, run gcloud compute routers describe mycloudrouter –-region REGION and review the results.
Show Answer
Correct Answer: B
Explanation: To troubleshoot asymmetric traffic over multiple Interconnects advertising the same prefixes, you need to inspect which BGP routes the Cloud Router has learned and which next hops are being selected. The `gcloud compute routers get-status` command shows the effective BGP routes, their attributes, and next-hop selection per BGP session, which is essential for diagnosing asymmetric routing. The console BGP session view is higher-level and does not provide the same detailed routing decision information.
Question 87
You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible. To ease the transition, you decided to use the same architecture as your on-premises network: a hub-and-spoke model. Your on-premises architecture consists of over 50 spokes. Each spoke does not have connectivity to the other spokes, and all traffic is sent through the hub for security reasons. You need to ensure that the Google Cloud architecture matches your on-premises architecture. You want to implement a solution that minimizes management overhead and cost, and uses default networking quotas and limits. What should you do?
A. Connect all the spokes to the hub with Cloud VPN.
B. Connect all the spokes to the hub with VPC Network Peering.
C. Connect all the spokes to the hub with Cloud VPN. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.
D. Connect all the spokes to the hub with VPC Network Peering. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.
Show Answer
Correct Answer: C
Explanation: The design must support more than 50 spokes while staying within default Google Cloud quotas and minimizing overhead. VPC Network Peering is limited to 25 peerings per VPC, so options using peering (B and D) do not scale to 50 spokes. Cloud VPN supports a hub-and-spoke model at this scale using default limits and allows transitive routing through the hub. To match the on‑premises requirement that spokes cannot communicate directly, a third‑party network appliance in the hub is used as the default gateway to enforce isolation and security controls. Therefore, option C best meets all requirements.
$19
Get all 248 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.