Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Online Questions & Answers

• Question 281:

  You are designing the network architecture for your organization. Your organization has three developer teams: Web, App, and Database. All of the developer teams require access to Compute Engine instances to perform their critical tasks.

  You are part of a small network and security team that needs to provide network access to the developers. You need to maintain centralized control over network resources, including subnets, routes, and firewalls. You want to minimize operational overhead.

  How should you design this topology?

  A. Configure a host project with a Shared VPC. Create service projects for Web, App, and Database.
  B. Configure one VPC for Web, one VPC for App, and one VPC for Database. Configure HA VPN between each VPC.
  C. Configure three Shared VPC host projects, each with a service project: one for Web, one for App, and one for Database.
  D. Configure one VPC for Web, one VPC for App, and one VPC for Database. Use VPC Network Peering to connect all VPCs in a full mesh.
  A. Configure a host project with a Shared VPC. Create service projects for Web, App, and Database.

• Question 282:

  Your organization has approximately 100 teams that need to manage their own environments. A central team must manage the network. You need to design a landing zone that provides separate projects for each team. You must also make sure the solution can scale.

  What should you do?

  A. Configure Policy-based Routing for each team.
  B. Configure a Shared VPC, and create a VPC network in the host project.
  C. Configure VPC Network Peering, and peer one of the VPC's to the service project.
  D. Configure a Shared VPC, and create a VPC network in the service project.
  B. Configure a Shared VPC, and create a VPC network in the host project.

  ---

  Explanation

  To design a scalable landing zone for a large organization with centralized network management and separate environments for 100 teams, a Shared VPC is the most appropriate solution. Here's why:

  1. Shared VPC architecture: A host project contains the centrally managed VPC network. Service projects are created for each team. These projects attach to the Shared VPC in the host project, enabling the teams to use shared networking resources.

  2. Centralized network management: The central team retains full control over networking resources in the host project, including subnets, firewall rules, and routes. Teams in service projects can deploy and manage their resources (e.g., VMs) while inheriting the centrally managed network configuration.

  3. Scalability: Shared VPCs are designed to support multiple service projects, making this solution ideal for an organization with approximately 100 teams. Teams are isolated in their own projects, providing logical separation and better resource management.

  4. Best practices alignment: This approach aligns with Google Cloud's best practices for large-scale organizations, ensuring security, scalability, and operational efficiency.

• Question 283:

  Your company uses a multi-VPC architecture to isolate its production, development, and testing environments. Following a recent security mandate, you need to ensure that all Compute Engine VMs across multiple production VPCs can access Google APIs, such as Cloud Storage and Cloud SQL, without having any route pointing to the internet gateway to comply with security policies. Your solution must also be scalable and easy to manage across all VPCs.

  What should you do?

  A. Deploy a Cloud NAT gateway in each VPC region to provide a secure egress point for traffic destined for Google APIs.
  B. Configure VPC Service Controls, and create a service perimeter that includes all relevant projects and the required Google services on each VPC.
  C. Enable Private Google Access on all subnets where the VMs are located. Create a private zone in Cloud DNS for googleapis.com, with an A record pointing to 199.36.153.8/30.
  D. Create a Private Service Connect endpoint for Google APIs in each of the VPCs. Create a private zone in Cloud DNS for googleapis.com, with an A record pointing to the PSC endpoint created.
  D. Create a Private Service Connect endpoint for Google APIs in each of the VPCs. Create a private zone in Cloud DNS for googleapis.com, with an A record pointing to the PSC endpoint created.

  ---

  Explanation

  A Private Service Connect endpoint for Google APIs lets VMs reach Google services by using an internal IP address inside each VPC, and Google adds a special routing path to that endpoint so the VPC does not need a route whose next hop is the default internet gateway. This satisfies the security requirement while remaining scalable and manageable across multiple VPCs. Cloud NAT depends on internet-gateway routing, VPC Service Controls is a security boundary rather than a connectivity method, and Private Google Access with googleapis.com still requires routing that uses the default internet gateway next hop.

• Question 284:

  You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements: Each Google Cloud project must represent an internal project that your team will work on. After an internal project is finished, the infrastructure must be deleted. Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources. You have 10-100 projects deployed at a time. While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable with centralized management.

  What should you do?

  A. Create a single project and single VPC for each internal project.
  B. Create a single Shared VPC and attach each Google Cloud project as a service project.
  C. Create a single project and additional VPCs for each internal project.
  D. Create a Shared VPC and service project for each internal project.
  B. Create a single Shared VPC and attach each Google Cloud project as a service project.

• Question 285:

  You correctly configured Cloud DNS forwarding zones to point towards your on-premises DNS. You noticed that you cannot query your on-premises Active Directory main Domain Controller by using "dig ad.company.int" over your interconnect attachment. However, the query is successful if you directly target your on-premises DNS server by using "dig @10.10.10.53 ad.company.int". You need to correctly configure Cloud DNS so VMs and other resources can correctly resolve DNS records in your on-premises DNS system.

  What should you do?

  A. Make sure that the Cloud DNS source range is advertised over your BGP sessions towards the on-premises environment, and that the on-premises ingress firewalls allow traffic from this range on port 53.
  B. Change the local DNS server in your Google Cloud VMs from 169.254.169.254 to your on-premises service, 10.10.10.53.
  C. Use a nslookup query instead of a dig query.
  D. Add an egress firewall rule in your VPC to allow DNS traffic on port 53 that is destined to your on-premises DNS server.
  A. Make sure that the Cloud DNS source range is advertised over your BGP sessions towards the on-premises environment, and that the on-premises ingress firewalls allow traffic from this range on port 53.

  ---

  Explanation

  When Cloud DNS forwarding is used, the forwarded queries originate from Google-managed Cloud DNS resolver source IP ranges, not from the VM's IP. Your on-premises environment must be able to route return traffic to those resolver source ranges and allow them through firewalls on TCP/UDP 53. Once the Cloud DNS source range is reachable and permitted, VMs can resolve on-premises records via the default metadata DNS.

• Question 286:

  You created a private GKE cluster with a private control plane endpoint. Administrators in your on-premises network connect to the VPC through Cloud VPN and need to run kubectl against the control plane. The administrators cannot reach the private endpoint.

  What should you do?

  A. Add the on-premises administrator subnet to the control plane authorized networks and ensure the private endpoint range is reachable through the hybrid connection.
  B. Enable Cloud NAT for the GKE node subnet and retry the kubectl command from on-premises.
  C. Assign an external IP address to each GKE node and add the addresses to authorized networks.
  D. Disable VPC-native networking on the cluster so the control plane can use primary subnet addresses.
  A. Add the on-premises administrator subnet to the control plane authorized networks and ensure the private endpoint range is reachable through the hybrid connection.

  ---

  Explanation

  For private GKE control plane access from a connected network, the client source ranges must be permitted by authorized networks and routing must allow traffic to the private endpoint. Cloud NAT is for outbound internet access from private resources and does not make the private control plane reachable from on-premises. Assigning external IP addresses to nodes does not provide private control plane access and weakens the private design. VPC-native networking cannot be disabled to solve this reachability issue and is not the relevant control plane access setting.

• Question 287:

  Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year.

  These are the assumptions for both GCP environments.

  - Each organization has enabled full connectivity between all of its projects by using Shared VPC.

  - Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.

  - There are no prefix overlaps between the two organizations.

  - Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.

  - Neither organization has Interconnects to their on-premises environment. You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.

  Which two steps should you take? (Choose two.)

  A. Provision Cloud Interconnect to connect both organizations together.
  B. Set up some variant of DNS forwarding and zone transfers in each organization.
  C. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
  D. Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
  E. Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC.
  B. Set up some variant of DNS forwarding and zone transfers in each organization.
  C. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.

• Question 288:

  Your organization's current architecture has one Shared VPC host project (SH_HOST_PRJ) that contains a single VPC (SH_VPC) and two Shared VPC service projects (SP_ONE_PRJ and SP_TWO_PRJ) that do not contain any VPCs.

  Each Shared VPC service project belongs to a different team: TEAM_ONE manages SP_ONE_PRJ and TEAM_TWO manages SP_TWO_PRJ. You must design a solution that allows each team to create their own DNS private zones and DNS records only in their respective Shared VPC service projects. Workloads in SP_ONE_PRJ must be able to resolve all the DNS private zones defined in SP_TWO_PRJ and conversely. Your design must have the least amount of set up effort.

  What should you do?

  A. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the Shared VPC host project (SH_HOST_PRJ).2. TEAM_TWO creates Cloud DNS private zones and DNS records in SP_TWO_PRJ, and uses cross-project binding to connect the zones to the Shared VPC host project (SH_HOST_PRJ).
  B. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).2. TEAM_TWO creates DNS private zones and DNS records in SP_TWO_PRJ and uses cross-project binding to connect the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).
  C. 1. TEAM_ONE creates a new VPC (SP_ONE_VPC) in the Shared VPC service projects (SP_ONE_PRJ). TEAM_ONE creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the new VPC (SP_ONE_VPC). TEAM_ONE creates a Cloud DNS peering relationship between SP_ONE_VPC and the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).2. TEAM_TWO completes the same actions for the SP_TWO_PRJ project.
  D. 1. TEAM_ONE creates a new VPC (SP_ONE_VPC) in the Shared VPC service projects (SP_ONE_PRJ). TEAM_ONE creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the new VPC (SP_ONE_VPC). TEAM_ONE creates a VPC Network Peering relationship between SP_ONE_VPC and the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).2. TEAM_TWO completes the same actions for the SP_TWO_PRJ project.
  B. 1. TEAM_ONE uses cross-project binding and creates Cloud DNS private zones and DNS records in SP_ONE_PRJ, and binds the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).2. TEAM_TWO creates DNS private zones and DNS records in SP_TWO_PRJ and uses cross-project binding to connect the zones to the VPC (SH_VPC) in the Shared VPC host project (SH_HOST_PRJ).

  ---

  Explanation

  In this scenario, using cross-project binding is the simplest and most efficient way to allow each team to create and manage their own DNS private zones while ensuring that workloads across both service projects can resolve DNS records across the Shared VPC. Cross-project binding: This feature allows private DNS zones created in the service projects (SP_ONE_PRJ and SP_TWO_PRJ) to be associated with the Shared VPC (SH_VPC) in the host project (SH_HOST_PRJ).

  It enables DNS queries for those zones to be resolved by workloads attached to the Shared VPC. Centralized connectivity: Since all workloads in both service projects (SP_ONE_PRJ and SP_TWO_PRJ) use the Shared VPC (SH_VPC), no additional VPCs or VPC peering setups are required, minimizing setup effort. Team independence: Each team manages their DNS private zones and records independently within their respective service projects, fulfilling the requirement for decentralization.

  This design achieves the desired DNS resolution while requiring the least amount of setup effort compared to solutions involving new VPCs, DNS peering, or VPC Network Peering.

• Question 289:

  You work for a university that is migrating to GCP.

  These are the cloud requirements:

  - On-premises connectivity with 10 Gbps.

  - Lowest latency access to the cloud.

  - Centralized Networking Administration Team.

  New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.

  What should you do?

  A. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
  B. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
  C. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
  D. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
  A. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.

• Question 290:

  Your organization's application is running on a VPC-native GKE Standard cluster with public IP addresses. You need to configure access to the remote address range 35.100.0.0/16 through Cloud NAT, instead of using the GKE nodes' external IP addresses. SNAT is enabled on the cluster and needs to be configured.

  What should you do?

  A. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Include the 35.100.0.0/16 range in the list.
  B. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Remove the 35.100.0.0/16 range from the list.
  C. Configure Cloud NAT and create an exclusion rule for any SNAT address translation.
  D. Configure Cloud NAT with nonMasqueradeCIDRs, and enable SNAT with the same configuration to allow traffic to 35.100.0.0/16.
  A. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Include the 35.100.0.0/16 range in the list.

  ---

  Explanation

  In a VPC-native GKE Standard cluster, traffic to external destinations can go through Cloud NAT instead of using the nodes' external IP addresses. The ip-masq-agent ConfigMap controls whether specific IP ranges are masqueraded (i.e., source NAT applied) or not: Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap: Add the 35.100.0.0/16 range to the nonMasqueradeCIDRs list in the ConfigMap. This ensures that traffic destined for this range does not get

  source NATed by the GKE cluster itself but instead relies on Cloud NAT for external access. SNAT with Cloud NAT: Once the range 35.100.0.0/16 is excluded from GKE's masquerading, traffic to this range will flow through Cloud NAT for SNAT (source network address translation), enabling proper communication with the remote address. Avoid disrupting existing traffic: Including the 35.100.0.0/16 range ensures that only traffic to this specific destination uses Cloud NAT, leaving other traffic patterns unaffected.