Free GCP professional cloud network engineer practice test

Discover the valuable insights waiting to be unveiled in these free exam questions and answers, offering a glimpse into the world of a Professional Cloud Network Engineer. Picture someone who not only sets up and maintains network systems in Google Cloud but also collaborates with architects to design cloud infrastructures. They’re the ones who bring these visions to life.

Using tools like the Google Cloud Console and command line interface, they navigate through tasks like configuring network services, optimizing application and container networking, and ensuring seamless connectivity across hybrid and multi-cloud environments. With their expertise, they build Virtual Private Clouds (VPCs) that form the backbone of secure network architectures. These questions and answers shed light on the skills and know-how needed for successful cloud projects, painting a vivid picture of what it takes to thrive in this dynamic field.

Welcome to your gcpprofessionalnetworkenginer

Q1.You have configured your Cloud Routers for high availability. The Cloud Routers in us-central1 are advertising subnets in two different regions us-central1 and us-west1. VMs in each of the VPC Network regions learn about on-premises hosts automatically. How would you describe this Cloud Routing mode and configuration?

A.This represents Cloud Router Global Dynamic Routing

B.This represents Cloud Router Regional Dynamic Routing

C.This represents Cloud Router Global Static Routing

D.This represents Cloud Router Regional Static Routing

Q2.While on vacation, a manager in the sales department used a computer in the business center of a hotel to access their Google Workspace account. They cannot remember whether they signed out and closed the browser. You should investigate a potential breach and strongly secure the account with the least amount of disruption to the sales manager. What should you do?

A. Suspend the account. Transfer all emails, files, and folders to another account temporarily. Review the mobile devices associated with the account and wipe suspicious devices. Check the Login audit log for suspicious web sign-ins. Review the Security report for exposure of company data. Reset the account’s password and revoke any OAuth 2.0 tokens. Unsuspend the account and transfer the emails, files, and folders back to the original account. Review Gmail and Google Drive settings for anomalous configurations.

B.Suspend the account temporarily. Change the account password. Share the temporary password with the sales manager. Check the Login audit log for suspicious web sign-ins. Review the Admin audit logs for changes made recently by the user. Revoke access to all third party apps used by the manager. Have the manager enroll in 2-Step Verification by using text or phone call.

C.Suspend the account. Create a new Google Workspace account for the user. Transfer data from the original account to the new account. Share the temporary password for the new account with the sales manager. Review the Gmail security checklist with them. Review the Security report for exposure of company data. Change the Google Drive sharing policy to prevent external sharing. Revoke any OAuth 2.0 tokens.

D.Suspend the account temporarily. Review the mobile devices associated with the account, and wipe suspicious devices. Check the Login audit log for suspicious web sign-ins. Review the Security report for exposure of company data. Reset the account’s password and revoke any OAuth 2.0 tokens. Unsuspend the account and have the manager enroll a security key for 2-Step Verification. Have the manager review their Gmail settings for filters and forwarding.

Q3.There is one application that has been utilizing a lot of bandwidth – sending out large packets. This particular app attempts to control the TCP window size so that it can maximize its own performance, to the detriment of other services running on the same VM. Which Linux tunable below would you adjust to set the maximum OS send buffer size for all connections?

A.Net.core.rmem_max

B.Net.core.wmem_max

C.net.ipv4.tcp_rmem

D.net.ipv4.tcp_wmem

Q4.Your organization's development team has requested access to Bigtable and BigQuery for a project hosted in Google Cloud VM instances. These services do not require the VMs to have external IP addresses and they will not need one. As the VPC network admin, what would be the best solution for configuring private API access for the services?

A.Enable Private Google Access for subnet containing the Cloud VMs.

B.Enable Private Services Access for subnet containing the Cloud VMs.

C.Enable Serverless VPC Access for the subnet containing the Cloud VMs.

D.Enable the API for the desired services in the Cloud VM, and ensure that each user has access to enable the API. Then create an API key.

Q5.The program manager for patient experience at a health facility will be leaving the organization in less than a week. The new program manager will need access to the historical email of the former program manager. How will you transfer the email between accounts?

A.Use the Data migration tool to migrate Gmail data to the new program manager’s Gmail.

B.Download the former program manager’s email using a POP email client and then upload it into the new program manager’s Gmail.

C.Delete the former program manager’s Google Workspace account, select Gmail, and set the new program manager’s account as the destination.

D.Restore the data from Google Vault to the new program manager’s Gmail.

Q6.Your company would like to establish a direct, private connection between your on-premise network with Google networks, to connect with GCP resources without transmitting over the public internet. However, your on-premise network is too far from a Google colocation facility to establish a physical connection. You also expect your network topology to change in the next 18 months, so you will need to update all on-premise destination IP addresses. You would like this update to be entirely managed by your company's employees, even though you will need to connect through a service provider. Which GCP Hybrid Connectivity option will allow you to establish your desired network connection, and independently manage your upcoming network updates?

A.Dedicated Interconnect

B.Partner Interconnect

C.Direct Peering

D.Carrier Peering

Q7.Your organization has deployed resources in a shared VPC. Now you need to peer it with another shared VPC that is used by a distributed team. The additional shared VPC will contain pooled resources for a large project. However, you quickly discover that peering between the shared VPCs as they are is impossible. What could have happened during the setup of these shared VPCs that would keep you from connecting them now?

A.The analyst who built the shared VPCs may have set them up as Custom Mode Shared VPCs.

B.The options to import and export custom routes when peering must be configured before any route exchanges will take place between shared networks.

C.One or both of the shared VPCs has not met the minimum number of service projects required for peering.

D.The analyst who built the shared VPCs may have set them up as Auto Mode Shared VPCs.

Q8.You have created a Cloud Armor allowlisting rule intended to only allow IPs from a specified CIDR range access to external HTTP(S) Load balancers. You have not created a denylisting rule. Which of the following statements about your Cloud Armor rule are false?

A.Allowlisting rules enable you to allow specific source IP addresses or CIDR ranges to access external HTTP(S) load balancers.

B.IPv4 and IPv6 addresses are supported in allowlist rules

C.Deny rules can return HTTP 403, 404, or 502 responses

D.Allowlisting rules automatically block any source IP address or CIDR range not defined in the rule.

Q9.You've recently configured a new developer’s role in Cloud IAM. They've come back to you because they cannot access a resource they need to begin work. What three pieces of information do you need from the developer to troubleshoot their issue?

A.The Project-id, IAM Policy, and Role-id

B.The Role-id, Resource (Full Name of the Resource), and Group

C.The Member (User’s Email), the Resource (The Full name of the Resource), and the Permission Needed

D.The IAM Policy, the Permission Needed, and the Resource (The Full name of the Resource)

Q10.You are designing a VPN solution to connect your firms on-premises data center to Google Cloud. You have a BGP-capable VPN gateway installed in the data center and require 99.99% availability for the VPN link. What Cloud VPN configuration meets these requirements while requiring the least setup and maintenance?

A. Classic VPN with policy-based static routing.

B.Classic VPN with route-based static routing.

C. Classic VPN with Cloud Router and dynamic routing.

D.HA VPN with Cloud Router and dynamic routing

Q11.To reduce latency, you will be replacing an existing Cloud VPN Classic VPN connection. You will connect your organization’s on premises data center to Google Cloud resources in a VPC network with all resources in a single subnet and region using private/internal IP connectivity. The connection will need to support 1.5 Gbps of traffic. Due to cost considerations, you would like to order the option that provides just enough bandwidth and not more but must have significantly lower latency than the existing Cloud VPN connection. What should you use?

A.A 2 Gbps Dedicated Interconnect connection with one 2 Gbps VLAN attachments

B.A 10 Gbps Dedicated Interconnect connection with one 10 Gbps VLAN attachments

C.A Cloud VPN HA VPN connection with Cloud Router.

D.A Partner Interconnect connection with 1 or 2 VLAN attachments

Q12.You are selecting Google Cloud locations to deploy Google Cloud VMs. You have general requirements to maximize availability and reduce average user latency with a lower priority goal of reducing networking costs. The users served by these VMs will be in Toronto and Montreal. You must deploy workloads requiring instances at 99.5% availability in Toronto and 99.99% availability in Montreal. These instances all exchange a large amount of traffic among themselves. Which deployment option satisfies these requirements?

A.Deploy instances in multiple zones in the northamerica-northeast1 and northamerica-northeast2 regions

B.Deploy instances in a single zone in the northamerica-northeast1 region and multiple zones in the northamerica-northeast2 region

C.Deploy instances in multiple zones in the northamerica-northeast1 region and a single zone in the northamerica-northeast2

D.Deploy instances in a single zone in the northamerica-northeast1 and northamerica-northeast2 regions.

Q13.Your employer has decided to switch from your current DNS provider to Cloud DNS, and you have been tasked with migrating the existing domain to Cloud DNS. You have already created a managed zone to contain your DNS records. You also have the exported DNS configuration file in YAML records format from the current provider. What is the next step in the migration process?

A.The next step is to import the DNS configuration record sets into your managed zone. In the gcloud command-line tool, you will use the dns record-sets import command without the –zone-file-format flag.

B.The next step is to import the DNS configuration record sets into your managed zone. In the gcloud command-line tool, you will use the dns record-sets import command with the –zone-file-format flag.

C.The next step is to verify DNS propagation to the name servers. You will do this using the Linux command watch.

D.The next step is to verify DNS propagation to the name servers. You will do this using the Linux command dig.

Q14.A team leader has put in a help desk request to allow IP addresses within a specified CIDR range to have access to a GKE cluster control plane using HTTPS. They specifically do not want any other nodes within the VPC to have access to the control plane. What solution do you offer?

A.You suggest a private cluster with an authorized network.

B.You suggest they use a private cluster with authentication.

C.You suggest using authorized networks and rotating cluster credentials.

D.You suggest using a private cluster and TLS.

Q15.You are trying to determine which firewall rule(s) is/are incorrectly blocking requests between two VMs running within a VPC network: VM1 and VM2. Firewall logging is enabled for all firewall rules, including metadata. The Firewall Insights and Recommendations API also have been enabled. All insights have been enabled, and observation period set over a period capturing the blocked requests. Select a valid troubleshooting approach to find the incorrectly configured firewall rule.

A.Go to Logs Explorer or Legacy Logs Viewer page, view the firewall logs and filter for logs matching the source and destination VMs VM1 and VM2 using the jsonPayload.instance.project_id, jsonPayload.instance.vm_name, jsonPayload.instance.region, and jsonPayload.instance.zone, jsonPayload.remote_instance.vm_name, jsonPayload.remote_instance.region, and jsonPayload.remote_instance.zone

B.Go to Logs Explorer or Legacy Logs Viewer page, view the firewall logs and filter for logs matching the destination VM2 in the VPC using the jsonPayload.instance.project_id, jsonPayload.instance.vm_name, jsonPayload.instance.region, and jsonPayload.instance.zone fields.

C.Go to the Firewall Insights landing page of the Cloud Console. Find the names of the deny firewall rules with hits, to identify rules that are blocking requests. Go to the Legacy Logs Viewer or Logs Explorer page, view the firewall logs and filter for logs matching those rules by name using jsonPayload.rule_details.reference field, matching the names of the deny firewall rules with hits.

D.Go to the Firewall Insights landing page of the Cloud Console and find the names of the allow firewall rules with no hits (to identify rules that are not allowing requests) and then go to the Logs Viewer or Explorer page to view the firewall logs and filter for logs matching those rules by name using jsonPayload.rule_details.reference field (matching the names of the allow firewall rules with no hits).

Q16.You are using the gcloud tool to create a Classic VPN with static routing and a route-based tunnel. The on-premises resources are all in the 192.168.1.0/24 range. You have issued commands to create the VPN gateway, IP addresses, forwarding rules, and the VPN tunnel. Select the correct final resource that must be created.

A.A route with destination 192.168.1.0/24 and next hop set to the VPN gateway

B.A Cloud Router with default route advertisements

C. A route with destination 0.0.0.0/0 and next hop set to the VPN gateway

D.A Cloud Router with a custom route advertisements including the range 192.168.1.0/24

Q17.Your Organization would like to achieve 99.99% availability for their Dedicated Interconnect link from an on-premises network to their VPC. Select the configuration that will achieve this.

A.2 Cloud Routers in 2 distinct regions, with the VPC in global dynamic routing mode

B.1 Cloud Router in one region with the VPC in regional dynamic routing mode

C. 2 Cloud Routers in one region, with the VPC in global dynamic routing mode

D.2 Cloud Routers in 2 distinct regions, with the VPC in regional dynamic routing mode

Q18.You are setting up a Dedicated Interconnect connection and need to provide the highest capacity possible. Select the circuit configuration that achieves this.

A.8 10 Gbps circuits

B. 8 50 Gbps circuits

C.1 200 Gbps circuit

D.2 100 Gbps circuits

Q19.A telecoms company is connecting one of their Shared VPC networks to their on-premise network via Dedicated Interconnect. Select the recommended approach for configuring their VLAN attachments and Cloud Routers.

A.Create the VLAN attachments and Cloud Routers in the Shared VPC service projects.

B.Create the Cloud Routers in the Shared VPC host project and the VLAN attachments in the Shared VPC service projects.

C.Create the VLAN attachments and Cloud Routers in the Shared VPC host project.

D.Create the VLAN attachments in the Shared VPC host project and the Cloud Routers in the Shared VPC service projects.

Q20.Top Executives in your organization come to you as the network administrator because they believe that Google Cloud Premium Tier is not necessary for the company’s purposes. They are trying to make a final decision, and they want you to explain the difference between the load balancing options at the Premium Tier and what you would get at the Standard Tier. How would you best explain it?

A.The Standard Tier offers regional load balancing, while the Premium tier offers the ability to deploy Global Load Balancing of any single anycast IPv4 or IPv6 IP.

B.The Premium Tier offers regional load balancing, while the Standard tier offers the ability to deploy Global Load Balancing of any single anycast IPv4 or IPv6 IP.

C.Network load balancing at the Premium Tier requires a regional external IP address, while network load balancing at the Standard Tier does not.

D.Network load balancing at the Standard Tier requires a regional external IP address, while network load balancing at the Premium Tier does not.

Q21.Which GCP Hybrid Connectivity service can connect your GCP and on-premise networks with the highest level of availability, the lowest level of latency, and the least potential points of network failure?

A.Dedicated Interconnect

B.Cloud VPN

C.Partner Interconnect

D.Carrier Peering

Q22.You are creating a regional managed instance group (MIG) with VMs in 3 zones. You would like to specify which zone the VMs will be deployed. Which gcloud command would give you the desired MIG setup?

A.gcloud compute instance-groups managed create example-rmig \ –template example-template \ –size 30 \ –zones us-east1-a,us-east1-b,us-east1-c

B.gcloud compute instance-groups managed create example-rmig \ –template example-template \ –size 30 \ –zones us-east1-b,us-east1-c

C.gcloud compute instance-groups managed create example-rmig \ –template example-template \ –size 30 \ –instance-redistribution-type NONE \ –zones us-east1-b,us-east1-c

D.gcloud compute instance-groups managed create example-rmig \ –template example-template \ –size 30 \ –region us-east1-a,us-east1-b,us-east1-c

Q23.Within your organization, there is currently one Shared VPC. A newly created team owns a single standalone project, and your executives have decided to combine the new team with an existing team, and they have asked you to make sure the standalone project is brought into the Shared VPC. Which of the following solutions will ensure the resource hierarchy is correct, and the newly combined teams have access to their projects under the current development host project?

A.The standalone project will need to be added as a service project under the existing Host project, and the Service Project Admins from the existing project will need to be given the same role in the newly added service project.

B.The standalone project will need to be added as a service project attached to the service project belonging to the existing team, and the Service Project Admins from the existing project will need to be given the same role in the newly added service project.

C.The standalone project will need to be enabled as a second host project, and the existing project will need to be attached to both host projects to ensure Service Project Admins from the existing project have the same permissions for both projects.

D.The Service Project Admins for the existing will simply need admin rights to the folder containing the standalone project.

Q24.You have configured a network endpoint group specifically as a backend service for deploying containers on VMs. This also gives you granularity in distributing traffic to applications on the VM. This NEG works perfectly as a backend to an external HTTP(S) load balancer. Which type of network endpoint group have you configured?

A.Internet NEG

B.Serverless NEG

C.Zonal Neg

D.SSL Proxy

Q25.You have Endpoint-Independent Mapping enable on Cloud NAT, and you have deployed a TURN server for NAT traversal. How would you explain how a TURN server permits communication between two VMs behind NAT?

A.The VMs behind the NAT connect to the external IP address of a third server, and that server relays communication between the two VMs.

B.Once a communication channel is established, TURN allows direct communication between the VMs behind NAT.

C.The VMs behind the NAT connect to the internal IP address of a third server, and that server relays communication to external clients.

D.Permitting connections between existing VMs requires one to drain external IP addresses associated with NAT.

Q26.Your organization would like to get a high level topological graph of their Google Cloud network infrastructure. You also want to see the typical latencies and throughputs of traffic between elements of the infrastructure. What is the best tool for this purpose?

A.Network Topology

B. Performance Dashboard

C. Packet mirroring

D.VPC flow logs

Q27.You are debugging a Layer 2 Partner Interconnect connection that is indicating a failure to create a BGP session in the Cloud Router for the associated VLAN attachments. Select the most likely cause to investigate when troubleshooting this issue.

A.Check the route configuration of the VPC the Cloud Router is in.

B.Check the BGP keepalive timer configuration of the Cloud Router.

C.Check the ASN configuration of the on-premises router and the Cloud Router.

D.Check the route advertisement configuration of the Cloud Router.

Q28.You are using VPC flow logs to analyze traffic arriving at a subnet. You need to capture approximately 10% of the traffic and determine how much traffic originates from outside the subnet. The VPC flow logs have already been enabled for the subnet. You want to use the least expensive process. How should you configure the VPC flow logs?

A.Configure them with a sampling rate of 0.1 and a filter expression for the connection source and destination IP within the IP range of the subnet.

B.Configure them with a sampling rate of 1.0 and a filter expression for the connection destination IP within the IP range of the subnet.

C. Configure them with a sampling rate of 1.0 and a filter expression for the connection source and destination IP within the IP range of the subnet.

D.Configure them with a sampling rate of 0.1 and a filter expression for the connection destination IP within the IP range of the subnet.

Also, check out our free Cloud DevOps engineer practice test

Google Cloud associate cloud engineer free practice test

GCP Professional machine learning engineer practice test.

Google Cloud professional cloud architect free practice test

Free GCP professional cloud network engineer practice test

Related posts:

Leave a Comment Cancel reply