Google Cloud Professional Cloud Network Engineer practice questions

Question 1

A platform team is designing a container host pattern on Compute Engine where each container on a VM needs its own routable IP address inside the VPC, without provisioning extra network interfaces. Which VPC feature is the right primitive?

Accepted Answer

Google Cloud alias IP ranges enable administrators to assign multiple internal IP addresses to a single VM network interface, giving each container its own address without extra NICs.

Answer

Cloud NAT, by reserving a port range per container and rewriting source ports on egress. Cloud NAT translates egress, it does not give each container a unique routable internal address.

Answer

Shared VPC service-project attachment, granting compute.networkUser on the host project. Shared VPC delegates subnets across projects; it does not place per-container IPs on one VM.

Answer

A VPC peering connection with custom route exchange to a sidecar network. Peering exchanges routes between networks but does not assign multiple IPs to one VM's NIC.

Question 2

A platform team is evaluating Cloud NAT to give a fleet of internal-only VMs outbound access, and the lead must decide which NAT type is needed for VMs that hold IPv6 addresses but must reach IPv4-only internet hosts. Which statement matches the Cloud NAT documentation?

Accepted Answer

Public NAT provides IPv6 to IPv4 translation, while both Public and Private NAT handle IPv4 to IPv4.

Answer

Private NAT provides the IPv6 to IPv4 translation, while Public NAT is limited to IPv4 to IPv4 only.

Answer

Both Public NAT and Private NAT translate IPv6 addresses to IPv4 addresses for outbound traffic.

Answer

Neither Public NAT nor Private NAT can translate IPv6 traffic, so an external load balancer must handle it.

Question 3

A network engineer is tasked with summarizing what a backend service represents in Cloud Load Balancing for an architecture review. Which description matches the documentation?

Accepted Answer

A backend service defines how Cloud Load Balancing distributes traffic, holding protocol settings, distribution modes, session affinity, and health check references.

Answer

A backend service is a Cloud DNS record set that resolves to backend VMs directly, replacing the load balancer's data path. Backend services are load balancer resources, not DNS records.

Answer

A backend service is a network tag assigned to every backend VM. Network tags target firewall rules; they are not configuration hubs for traffic distribution.

Answer

A backend service is a Cloud Armor policy that filters egress from the load balancer. Cloud Armor security policies attach to backend services rather than being them.

Question 4

A company is migrating workloads over Partner Interconnect, and the network engineer must decide who configures the BGP session depending on whether the service provider offers a Layer 2 or a Layer 3 connection. Which statement matches Google Cloud's documentation?

Accepted Answer

With a Layer 2 connection the customer establishes the BGP session per VLAN attachment, while with Layer 3 the service provider sets it up instead.

Answer

With both Layer 2 and Layer 3 connections, Google configures BGP automatically and the customer never has to touch any router configuration at all.

Answer

With a Layer 3 connection the customer manually configures BGP on the local router, while Layer 2 connections are fully managed by the service provider.

Answer

For Layer 2 connections the service provider establishes the BGP session, so the customer only has to supply a pre-shared key for each VLAN attachment.

Question 5

A security team is tasked with designing a control that mitigates the risk of data exfiltration from BigQuery and Cloud Storage by restricting which projects and networks can reach those services. Which Google Cloud control matches the design?

Accepted Answer

To protect Google Cloud services in your projects and mitigate the risk of data exfiltration, you can specify service perimeters at the project or VPC network level, using VPC Service Controls.

Answer

Cloud Armor security policy at the VPC level, since Armor is the documented exfiltration control. Cloud Armor filters traffic at the load balancer edge; it is not the documented data-exfiltration control.

Answer

VPC firewall rules with egress denies on all Google API ranges. Firewall rules cannot enforce service-aware exfiltration controls equivalent to VPC Service Controls perimeters.

Answer

Cloud NAT with explicit destination filtering. Cloud NAT translates egress; it is not a service-aware perimeter.

Question 6

A company is migrating workloads over a new Cloud VPN tunnel that will not come up, and the VPN logs report a no-proposal-chosen error. Given a scenario where the peer is an IKEv2 device, what does the documentation say is wrong and how is it fixed?

Accepted Answer

Cloud VPN and the peer could not agree on ciphers; for IKEv2 at least one common cipher must be proposed by each

Answer

The peer ASN conflicts with the Cloud Router ASN, so changing one side's ASN lets the tunnel negotiate its ciphers

Answer

The tunnel MTU is set too high, so lowering the peer interface MTU lets the IKE proposal complete successfully now

Answer

The pre-shared key rotated, so re-entering a matching shared secret on only the Cloud VPN side resolves the error

Question 7

A platform team is designing how internal consumers will reach a partner-published managed service, and the security architect insists that consumers must reach only that one service endpoint and never gain access to the rest of the producer's network. The team is evaluating Private Service Connect. Which property of Private Service Connect satisfies that requirement?

Accepted Answer

Its explicit authorization model lets consumers reach only the intended service endpoint and no other resources in the producer network.

Answer

Its service-oriented design publishes the producer service behind a load balancer that exposes the producer's entire VPC to the consumer.

Answer

It relies on VPC Network Peering, so consumers receive all of the producer's subnet routes but are firewalled away from extra hosts.

Answer

It assigns the consumer an alias IP range inside the producer VPC, scoping reachability to a single internal address by convention.

Question 8

An organization is implementing Shared VPC and a Shared VPC Admin is granting service-project teams the ability to use specific subnets in the host project. The architect is asked which predefined role matches the documented final step. Which option fits?

Accepted Answer

The admin defines Service Project Admins by granting them the compute.networkUser role, either for all subnets in the host project or selectively for specific subnets, completing the Shared VPC provisioning.

Answer

Grant roles/owner on the host project to every service project team. That role is far broader than what Shared VPC requires and is not what the documentation specifies.

Answer

Grant roles/storage.admin on the host project, since subnets are persisted as Cloud Storage objects. Subnets are not Cloud Storage objects and the storage role is irrelevant.

Answer

Grant roles/iam.securityReviewer on the service projects. That role is for IAM auditing, not for subnet consumption in Shared VPC.

Question 9

A team is migrating a public domain to Cloud DNS and wants to stop attackers from spoofing or poisoning DNS responses, while accepting that lookups are not kept private. Which statement about DNSSEC is accurate?

Accepted Answer

DNSSEC authenticates responses to prevent manipulation, but it does not provide privacy protections for lookups.

Answer

DNSSEC encrypts DNS queries and responses end to end, giving both authentication and full privacy for lookups.

Answer

DNSSEC requires you to manually rotate the DNSKEY records in the zone whenever the TLD registry changes its DS record.

Answer

DNSSEC protection is complete as soon as the zone is signed, with no DS record needed at the TLD registry level.

Question 10

An engineer is implementing a Dedicated Interconnect and has just created a VLAN attachment associated with a Cloud Router. The team wants to know what the Cloud Router does automatically as a result. Which statement matches Google Cloud's documentation?

Accepted Answer

It creates a BGP session with the on-premises peer router and adds learned routes as custom dynamic routes in the VPC.

Answer

It creates a static route in the VPC for each on-premises subnet and disables BGP until you manually enable dynamic routing.

Answer

It opens an IPsec tunnel to the on-premises peer router and encrypts all of the advertised routes by default.

Answer

It mirrors all on-premises routes into Cloud DNS so that VPC resources can resolve on-premises hostnames automatically.

Question 11

A security engineer is tasked with implementing VPC Service Controls ingress and egress rules for a regulated BigQuery dataset, and the architect is being asked which direction's rule applies when an external service account calls into the perimeter. Which statement matches the documentation?

Accepted Answer

Ingress refers to any access by an API client from outside the service perimeter to resources within a service perimeter, while egress encompasses access involving clients or resources within the perimeter accessing resources outside it, so the inbound external service account call is governed by an ingress rule.

Answer

Both directions are governed by a single combined 'access' rule with no inbound or outbound distinction whatsoever, so the engineer cannot pick a side. The VPC Service Controls documentation defines two distinct rule directions, ingress and egress, with separate from and to blocks.

Answer

External calls to the perimeter are always egress because the data leaves the perimeter on the response. The direction is defined by the API call direction, not by where the response bytes travel.

Answer

Direction in VPC Service Controls is purely based on the source region rather than perimeter boundaries. Direction is defined relative to the service perimeter, not by source region.

Question 12

A production team is tasked with determining whether sudden packet loss between two regions stems from their own application or from Google Cloud's underlying network, and they also want to review historical network performance. Which tool is built for this?

Accepted Answer

Performance Dashboard, which shows Google network performance and helps separate app problems from network problems

Answer

Network Topology, which only shows which entities have communicated and cannot attribute loss to app versus network

Answer

Connectivity Tests, which checks a configured path between two endpoints but does not chart ongoing packet-loss trends

Answer

Firewall Insights, which analyzes rule usage and shadowed rules rather than Google network packet-loss performance

Question 13

A company runs a batch pipeline that programmatically reserves regional external IP addresses, and an engineer is evaluating why a request failed even though the project still shows available quota. Which statement explains the behavior under Google Cloud's quotas and limits model?

Accepted Answer

Quota is only a maximum you may create; it does not guarantee availability, so the request can fail if no external IPs are free in that region.

Answer

Quota and resource availability are identical, so if the request failed the project must have silently exceeded its regional external IP address quota.

Answer

Reserved external IP addresses are exempt from all quota, so a failure like this can only be caused by an IAM permission problem on the project.

Answer

Available quota guarantees the resource will be created, so the failure must be a transient API error that will succeed on the very next retry.

Question 14

A security team is tasked with steering only TCP traffic from a specific source subnet through an inline firewall appliance, matching on protocol and source IP rather than destination alone. Which VPC routing construct is designed for this?

Accepted Answer

Policy-based routes, which match on protocol and source IP and redirect traffic to an internal passthrough NLB.

Answer

Custom static routes, which forward packets to a next hop chosen solely by the destination IP prefix you configure.

Answer

Global network firewall policies, which redirect matched TCP flows to a load balancer fronting the appliance pool.

Answer

VPC Network Peering, which mirrors matched source-subnet traffic into the appliance network for deep inspection.

Question 15

A platform team is designing Cloud DNS routing policies for a multi-region service and must align its configuration with documented routing-policy behavior. Which two statements are accurate? Select two.

Accepted Answer

When a geolocation policy lists multiple IP addresses for a location, Cloud DNS returns all of them.

Accepted Answer

A failover routing policy can use a geolocation routing policy as its configured backup target.

Answer

A single record set can directly combine a geolocation policy with a custom-weighted WRR policy.

Answer

Multiple routing policy types may be applied to a single resource record set at the same time by default.

Google Cloud Professional Cloud Network Engineer

Sample questions

Sources

Similar exams