Skip to main content

PROFESSIONAL-CLOUD-NETWORK-ENGINEER Real Exam Questions

Professional Cloud Network Engineer

333 questions available · Page 1 of 34

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

Your company is deploying a public web application that must use path-based routing, integrate with Cloud Armor, and serve users from multiple continents with a single anycast frontend IP address.

Which load balancer should you use?

  1. A

    Global external Application Load Balancer.

  2. B

    Regional internal Application Load Balancer.

  3. C

    Passthrough Network Load Balancer.

  4. D

    Internal passthrough Network Load Balancer.

Show answer and explanation

Correct answer: A

Explanation

A global external Application Load Balancer supports HTTP(S) traffic management such as path-based routing, integrates with Cloud Armor, and uses a global anycast frontend. A regional internal Application Load Balancer is for private regional access inside a VPC. Passthrough Network Load Balancers are intended for layer 4 traffic and do not provide URL map path routing. Internal passthrough Network Load Balancers are private layer 4 load balancers and are not appropriate for a public global web application.

Question 2 Single choice

You are integrating your company's on-premises SD-WAN fabric with Google Cloud to route traffic from application VPCs to your on-premises network. The SD-WAN appliance is already deployed as a virtual machine in a central hub VPC. You want to minimize operational complexity by using the SD-WAN virtual appliance for policy enforcement and dynamic route exchange.

What should you do?

  1. A

    Place the SD-WAN appliance that is in the hub VPC in a backend service behind an internal passthrough Network Load Balancer. Create a custom route in the spoke VPC that uses the load balancer as the next hop.

  2. B

    Establish a direct HA VPN connection from the application VPCs to the on-premises data center, and configure BGP to exchange dynamic routes directly.

  3. C

    Create a Network Connectivity Center hub in the hub VPC, and register the SD-WAN virtual machine as a router appliance hybrid spoke. Add the application networks to the hub as VPC spokes.

  4. D

    Peer the central hub and application VPCs. Create a static route in the application VPCs for the on-premises CIDR range with the next-hop set to the internal IP address of the SD-WAN appliance.

Show answer and explanation

Correct answer: C

Explanation

Network Connectivity Center supports integrating third-party routing appliances by registering the SD-WAN VM as a router appliance spoke and attaching application VPCs as VPC spokes. This centralizes policy enforcement on the SD-WAN appliance and enables dynamic route exchange through NCC with minimal operational overhead compared to managing multiple direct VPNs or static routing across peerings.

Question 3 Single choice

Your organization has an on-premises data center. You need to provide connectivity from the on-premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet.

What should you do?

  1. A

    Configure HA VPN by using high availability gateways and tunnels.

  2. B

    Configure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.

  3. C

    Configure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.

  4. D

    Configure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.

Show answer and explanation

Correct answer: D

Explanation

Partner Interconnect delivers private connectivity over a service provider's network (no internet traversal) and supports capacity starting at 50 Mbps up to 10 Gbps, including the 1 Gbps you need, without the need for colocating gear in a Google facility. Simply create your VLAN attachment, exchange the pairing key with the provider, and activate the connection.

Question 4 Single choice

You are designing a highly resilient and secure connection between an on-premises data center and Google Cloud for a financial services company. The company requires 10 Gbps of bandwidth and mandates that all traffic be encrypted end-to-end between their on-premises network and their Google Cloud VPC. You have already provisioned two 10 Gbps Dedicated Interconnect connections. You need to determine an encryption strategy that meets these requirements and provides redundancy.

What should you do?

  1. A

    Deploy four HA VPN gateways on each Dedicated Interconnect connection.

  2. B

    Deploy two HA VPN gateways on each Dedicated Interconnect connection.

  3. C

    Configure MACsec on each of the Dedicated Interconnect connections.

  4. D

    Use one Dedicated Interconnect for traffic and an HA VPN over the internet for backup.

Show answer and explanation

Correct answer: B

Explanation

To meet the requirement for end-to-end encryption between the on-premises network and the VPC, use HA VPN over Cloud Interconnect rather than MACsec. Google documents that MACsec protects traffic only between your router and Google's edge, while HA VPN over Cloud Interconnect provides IPsec encryption for the traffic carried by the VLAN attachments. For a 10 Gbps encrypted design with failover across two Dedicated Interconnect attachments, Google recommends 4 tunnels per 10 Gbps attachment, or 8 tunnels total, and its 10 Gbps reference design uses four HA VPN gateways across the two encrypted attachments.

Question 5 Single choice

You manage your company's network security and have noticed unusual outbound traffic from a Compute Engine VM that is part of a production subnet. You suspect the VM may be compromised, because it is attempting to communicate with a malicious external IP address. You want to capture detailed metadata for every IP connection to and from this specific VM. including source/destination IP, port, protocol, and the amount of data transferred.

What should you do?

  1. A

    Enable VPC Flow Logs on the subnet containing the VM. Set the sampling rate to 1.0 for maximum detail, and filter the logs in Cloud Logging for the VM's IP address.

  2. B

    Navigate to Network Intelligence Center, and run a new connectivity test for the VM. Analyze the report to see which configurations are allowing the traffic.

  3. C

    Use Packet Mirroring to create a real-time copy of all network packets from the suspected VM. Forward the copies to a collector VM for analysis.

  4. D

    Create a new egress firewall rule with a priority of 65535 that allows all outbound traffic. Enable Firewall Rules Logging on this new rule to capture all connection details.

Show answer and explanation

Correct answer: A

Explanation

VPC Flow Logs provide detailed, per-connection metadata including source and destination IP addresses, ports, protocol, bytes sent/received, and connection direction. Enabling them on the subnet with a sampling rate of 1.0 ensures full visibility for all traffic, and filtering by the VM's IP in Cloud Logging allows precise monitoring of the suspected compromised instance.

Question 6 Single choice

You created a new VPC for your development team. You want to allow access to the resources in this VPC via SSH only.

How should you configure your firewall rules?

  1. A

    Create two firewall rules: one to block all traffic with priority 0, and another to allow port 22 with priority
    1000.

  2. B

    Create two firewall rules: one to block all traffic with priority 65536, and another to allow port 3389 with priority 1000.

  3. C

    Create a single firewall rule to allow port 22 with priority 1000.

  4. D

    Create a single firewall rule to allow port 3389 with priority 1000.

Show answer and explanation

Correct answer: C

Explanation

References:
https://geekflare.com/gcp-firewall-configuration/

Question 7 Single choice

You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
- Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.
- The subnetwork logs are not excluded from Stackdriver.
- The instance that is hosting the application can communicate outside the subnet.
- Other instances within the subnet can communicate outside the subnet.
- The external resource initiates communication.

What is the most likely cause of the missing log lines?

  1. A

    The traffic is matching the expected ingress rule.

  2. B

    The traffic is matching the expected egress rule.

  3. C

    The traffic is not matching the expected ingress rule.

  4. D

    The traffic is not matching the expected egress rule.

Show answer and explanation

Correct answer: C

Question 8 Single choice

You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on-premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices.

What should you do?

  1. A

    1. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC.
    2. Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
    3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
    4. Configure VPC peering in the spoke VPCs to peer with the hub VPC.

  2. B

    1. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
    2. Associate the zone with the hub VPC. Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke PCs, with the hub VPC as the target.
    3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.

  3. C

    1. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88. Associate the zone with the hub VPC.
    2. Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
    3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
    4. Create a hub-and-spoke VPN deployment in each spoke VPC to connect back to the on-premises network directly.

  4. D

    1. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192. 168.20.88. Associate the zone with the hub VPC.
    2. Create a private peering zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com associated with the spoke VPCs, with the hub VPC as the target.
    3. Sat a custom route advertisement on the Cloud Router for 35.199.192.0/19.
    4. Create a hub and spoke VPN deployment in each spoke VPC to connect back to the hub VPC.

Show answer and explanation

Correct answer: A

Question 9 Single choice

Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers. The migration to GCP will be lift-and-shift, and all requests to the servers will be served by a single network load balancer frontend. You want to use a GCP-native solution when possible.

How should you deploy this service in GCP?

  1. A

    Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.

  2. B

    Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.

  3. C

    Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.

  4. D

    Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal-priority static routes to the backend servers.

Show answer and explanation

Correct answer: B

Explanation

References:
https://cloud.google.com/compute/docs/instance-groups/adding-an-instance-group-to-a-load-balancer

Question 10 Single choice

You are designing a hub-and-spoke network architecture for your company's cloud-based environment.
You need to make sure that all spokes are peered with the hub. The spokes must use the hub's virtual appliance for internet access. The virtual appliance is configured in high-availability mode with two instances using an internal load balancer with IP address 10.0.0.5.

What should you do?

  1. A

    1. Create a default route in the hub VPC that points to IP address 10.0.0.5.
    2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.
    3. Export the custom routes in the hub.
    4. Import the custom routes in the spokes.

  2. B

    1. Create a default route in the hub VPC that points to IP address 10.0.0.5.
    2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.
    3. Export the custom routes in the hub. Import the custom routes in the spokes.
    4. Delete the default internet gateway route of the spokes.

  3. C

    1. Create two default routes in the hub VPC that point to the next hop instances of the virtual appliances.
    2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.
    3. Export the custom routes in the hub. Import the custom routes in the spokes.

  4. D

    1. Create a default route in the hub VPC that points to IP address 10.0.0.5.
    2. Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.
    3. Create a new route in the spoke VPC that points to IP address 10.0.0.5.

Show answer and explanation

Correct answer: B