Download Google Cloud Professional Cloud Network Engineer Ultimate Exam and more Exams Technology in PDF only on Docsity!
Network Engineer Ultimate Exam
Question 1. Which GCP networking construct allows multiple projects to share a common VPC while keeping resource ownership separate? A) VPC Peering B) Shared VPC C) Cloud VPN D) Cloud Interconnect Answer: B Explanation: Shared VPC lets an organization host a central VPC in a host project and grant other service projects permission to create resources in that VPC, preserving separate IAM ownership. Question 2. When would you prefer VPC Network Peering over Shared VPC? A) When you need transitive connectivity across many projects B) When you want to enforce a single billing account for all traffic C) When you need to connect VPCs in different organizations without overlapping IPs D) When you require firewall rule inheritance across projects Answer: C Explanation: VPC Network Peering connects two VPCs (even across organizations) without requiring a shared host project, but the IP ranges must not overlap. Question 3. In a hierarchical firewall policy, where should you place a rule that blocks all inbound traffic to development environments across the entire organization? A) Project level in each development project B) Folder level containing all development projects
Network Engineer Ultimate Exam
C) Organization level D) VPC level inside each development VPC Answer: C Explanation: An organization-level firewall rule applies to every project under the organization, ensuring a consistent block for all development workloads. Question 4. Which CIDR block is reserved for non-RFC1918 private IPs that can be used for Google-owned services in a VPC? A) 10.0.0.0/ B) 172.16.0.0/ C) 192.168.0.0/ D) 169.254.0.0/ Answer: D Explanation: The 169.254.0.0/16 range is used for link-local addresses and for Google’s internal services like Private Google Access. Question 5. To avoid IP exhaustion when adding many GKE clusters, which strategy is recommended? A) Allocate a single /16 subnet per region and split it manually B) Use secondary IP ranges for Pods and Services per cluster C) Assign static IPs to each node manually D) Reserve all IPs in a /12 block for future use Answer: B Explanation: GKE can allocate separate secondary ranges for Pods and Services, allowing multiple clusters to coexist without overlapping IPs. Question 6. Which routing option provides dynamic route advertisement between on-premises and GCP without manual route updates?
Network Engineer Ultimate Exam
Question 9. What is the purpose of a split-horizon DNS setup in GCP? A) To provide different DNS answers based on client location (internal vs. external) B) To replicate DNS zones across multiple regions automatically C) To encrypt DNS queries using DNS-SEC D) To load-balance DNS queries across Cloud DNS servers Answer: A Explanation: Split-horizon DNS serves distinct records for internal (on-prem/peered) and external clients, useful for hybrid environments. Question 10. Which Cloud DNS feature allows on-premises DNS servers to forward queries for Google-managed zones to Cloud DNS? A) Private zones B) Forwarding zones C) DNSSEC signing D) Managed peering zones Answer: B Explanation: Forwarding zones forward queries for specific domains to Cloud DNS resolvers, enabling seamless hybrid name resolution. Question 11. When creating a VPC network, which subnet type ensures that IP addresses are allocated per region rather than per zone? A) Auto-mode subnet B) Custom-mode subnet with regional scope C) Custom-mode subnet with zonal scope D) Global subnet Answer: B
Network Engineer Ultimate Exam
Explanation: Custom-mode subnets are regional; you define CIDR blocks per region, and the same subnet can be used in any zone within that region. Question 12. How can you expand a subnet’s CIDR block without causing downtime for existing workloads? A) Delete the subnet and recreate it with a larger CIDR B) Use the “Subnet expansion” feature to add a secondary CIDR range and migrate IPs C) Add a new subnet with a larger CIDR and re-assign workloads manually D) Enable automatic CIDR expansion in VPC settings Answer: B Explanation: GCP allows adding secondary CIDR ranges to an existing subnet and gradually moving resources, avoiding downtime. Question 13. Which of the following best describes Private Service Connect (PSC)? A) A method to expose a Cloud Run service on a public IP B) A way to consume Google APIs over a private IP address within a VPC C) A VPN alternative for connecting on-premises networks D) A load-balancing algorithm for internal traffic Answer: B Explanation: PSC provides private IP endpoints for Google-hosted services (e.g., Cloud Storage, BigQuery) so traffic never traverses the public internet. Question 14. When configuring VPC Peering, which statement about transitive connectivity is true? A) Peering automatically creates transitive routes across all peered networks B) You must manually configure Cloud Router for transitive connectivity
Network Engineer Ultimate Exam
Question 17. Which load balancer type should you use for a globally distributed web application that requires SSL termination at the edge? A) Regional Internal TCP/UDP Load Balancer B) Global External HTTP(S) Load Balancer C) Network Load Balancer (TCP) D) Internal HTTP(S) Load Balancer Answer: B Explanation: The Global External HTTP(S) Load Balancer terminates SSL at Google’s edge POPs and distributes traffic globally. Question 18. What is the primary benefit of using Cloud CDN in front of a backend service behind an external HTTP(S) load balancer? A) Reduces latency by caching content at edge locations B) Provides DDoS protection for the backend C) Enables automatic SSL certificate rotation D) Allows traffic to bypass the load balancer entirely Answer: A Explanation: Cloud CDN caches responses at edge POPs, delivering content with lower latency to users worldwide. Question 19. Which Google Cloud Armor feature helps mitigate HTTP-based OWASP Top 10 attacks? A) Rate-limiting policies B) IP allow/deny lists C) Preconfigured WAF rulesets D) Geo-blocking policies Answer: C
Network Engineer Ultimate Exam
Explanation: Cloud Armor offers pre-configured Web Application Firewall (WAF) rulesets that target OWASP Top 10 vulnerabilities. Question 20. How does DNSSEC improve the security of Cloud DNS zones? A) By encrypting DNS queries in transit B) By signing DNS records to verify authenticity C) By limiting query rate per client IP D) By providing DNS over HTTPS (DoH) support only Answer: B Explanation: DNSSEC adds digital signatures to DNS records, allowing resolvers to verify that responses have not been tampered with. Question 21. Which Cloud VPN configuration provides a 99.99 % SLA for site-to-site connectivity? A) Classic VPN with a single tunnel B) HA VPN with two tunnels in active-active mode C) Cloud Interconnect with a single VLAN D) Partner Interconnect with a single link Answer: B Explanation: HA VPN creates two tunnels per gateway, offering redundancy and the 99.99 % SLA. Question 22. Which Interconnect option is best suited for enterprises that need >10 Gbps bandwidth and have a dedicated data-center presence? A) Partner Interconnect B) Dedicated Interconnect C) Cloud VPN
Network Engineer Ultimate Exam
Question 25. In Network Intelligence Center, which tool helps you verify end-to-end connectivity between two VM instances across different VPCs? A) Topology B) Connectivity Tests C) Performance Dashboard D) Packet Mirroring Answer: B Explanation: Connectivity Tests simulate traffic between source and destination endpoints and report any firewall or routing issues. Question 26. Which log type should you analyze to detect unexpected inbound traffic to a specific subnet? A) Cloud Audit Logs B) VPC Flow Logs C) Cloud DNS Logs D) Cloud Storage Access Logs Answer: B Explanation: VPC Flow Logs capture network flow metadata for each subnet, useful for traffic analysis and security investigations. Question 27. Which Cloud Monitoring metric would you set an alert on to detect a VPN tunnel failure? A) vpn.googleapis.com/tunnel/packet_loss B) compute.googleapis.com/instance/cpu/utilization C) vpn.googleapis.com/tunnel/state D) interconnect.googleapis.com/link/status Answer: C
Network Engineer Ultimate Exam
Explanation: The tunnel/state metric reflects the operational state (UP/DOWN) of a VPN tunnel; an alert on a transition to DOWN signals a failure. Question 28. Which tier of Google Cloud Next Generation Firewall provides the most advanced intrusion detection capabilities? A) Essentials B) Standard C) Enterprise D) Premium Answer: C Explanation: The Enterprise tier includes advanced threat detection, intrusion prevention, and integration with security operations tools. Question 29. What is the purpose of VPC Service Controls perimeters? A) To enforce network firewall rules across projects B) To limit data exfiltration from Google Cloud services by creating security perimeters C) To provide DDoS protection for VPC networks D) To automatically encrypt all traffic within the perimeter Answer: B Explanation: VPC Service Controls define security perimeters that restrict data movement between Google Cloud services, reducing risk of data leakage. Question 30. Which feature allows you to capture a copy of live traffic from a VM’s network interface for deep packet inspection? A) VPC Flow Logs B) Cloud NAT
Network Engineer Ultimate Exam
Question 33. How can you troubleshoot an MTU mismatch causing packet loss between a GCP VPC and an on-premises router? A) Increase the VPC’s subnet mask length B) Enable Cloud NAT with a larger MTU C) Set the “mtu” parameter on the Cloud Router BGP session to match the on-prem side D) Disable BGP and use static routes only Answer: C Explanation: BGP sessions can advertise the MTU; aligning the MTU value on both sides resolves fragmentation or drop issues. Question 34. Which IaC tool is officially supported by Google Cloud for declaratively provisioning networking resources? A) Ansible B) Chef C) Terraform D) Puppet Answer: C Explanation: Google Cloud provides a Terraform provider that supports all networking resources, enabling reproducible infrastructure deployments. Question 35. When using Terraform to create a Shared VPC, which resource must be defined in the host project before attaching service projects? A) google_compute_subnetwork B) google_compute_shared_vpc_host_project C) google_compute_network_peering D) google_project_iam_binding
Network Engineer Ultimate Exam
Answer: B Explanation: The google_compute_shared_vpc_host_project resource marks a project as a Shared VPC host, allowing subsequent service-project attachments. Question 36. Gemini for Network Engineers can assist in which of the following tasks? A) Automatically generating firewall rules from natural-language security policies B. Replacing Cloud Router’s BGP decision engine C. Providing real-time packet captures within the console D. Encrypting all VPC traffic with post-quantum algorithms Answer: A Explanation: Gemini’s AI capabilities can translate high-level security intents into concrete firewall rule configurations. Question 37. Which Cloud Load Balancer type supports pass-through of TLS traffic to backend instances without termination at the load balancer? A) Global External HTTP(S) Load Balancer B) Network Load Balancer (TCP) C) Internal HTTP(S) Load Balancer D) Cloud CDN Answer: B Explanation: The Network Load Balancer operates at Layer 4 and forwards TCP traffic unchanged, allowing TLS termination on the backend. Question 38. What is the effect of enabling “Private Google Access” on a subnet without external IPs? A) The subnet can reach Google APIs via the internet gateway
Network Engineer Ultimate Exam
Question 41. Which Cloud Router setting controls how quickly a BGP session detects a failure and withdraws routes? A. Hold time B. Keepalive interval C. BFD (Bidirectional Forwarding Detection) D. MED Answer: C Explanation: BFD provides rapid failure detection (sub-second) for BGP sessions, faster than traditional hold-time mechanisms. Question 42. When using Cloud Interconnect, what is the purpose of a VLAN attachment? A. To create a virtual firewall inside the Interconnect link B. To separate traffic into distinct Layer 2 segments over the same physical connection C. To enable IPv6 routing over Interconnect D. To provide DNS forwarding capabilities Answer: B Explanation: VLAN attachments (also called Interconnect attachments) partition the physical link into logical Layer 2 segments, each with its own configuration. Question 43. Which of the following statements about Cloud NAT is true? A. It provides inbound connectivity to VMs without external IPs B. It can be scoped to a single subnet or whole region C. It replaces the need for Private Google Access D. It automatically encrypts all outbound traffic Answer: B
Network Engineer Ultimate Exam
Explanation: Cloud NAT can be configured to apply to specific subnets or an entire region, providing outbound NAT for resources without external IPs. Question 44. What is the recommended way to expose a GKE service externally while keeping the nodes private? A. Use a NodePort service and assign external IPs to nodes B. Deploy an Internal TCP/UDP Load Balancer C. Create a Service of type LoadBalancer with a private cluster and enable Cloud NAT D. Use a GKE Ingress with a Global External HTTP(S) Load Balancer and private nodes Answer: D Explanation: An Ingress on a private GKE cluster uses a Global External HTTP(S) Load Balancer to expose services while the nodes remain private. Question 45. Which Cloud DNS record type is used to delegate authority for a sub-domain to another DNS zone? A. A record B. CNAME record C. NS record D. TXT record Answer: C Explanation: NS (Name Server) records delegate DNS resolution for a sub-domain to the specified authoritative name servers. Question 46. In a scenario where two VPCs have overlapping IP ranges, which solution allows them to communicate without renumbering? A. VPC Peering with NAT B. Shared VPC with IP aliasing
Network Engineer Ultimate Exam
Question 49. When configuring a Cloud Router for a Dedicated Interconnect, which BGP session type should you use? A. eBGP with a public ASN B. iBGP with Google’s ASN 16550 C. BGP over VPN D. No BGP; static routing only Answer: B Explanation: For Interconnect, you establish an iBGP session using Google’s ASN (16550) to exchange routes between your on-premises router and Google’s network. Question 50. What is the maximum number of secondary IP ranges that can be associated with a single subnet? A. 5 B. 8 C. 10 D. 15 Answer: C Explanation: GCP allows up to 10 secondary IP ranges per subnet, useful for GKE pod and service CIDRs. Question 51. Which Cloud Armor feature can be used to limit the number of requests per second from a single IP address? A. Geo-blocking B. Rate-based rule C. Preconfigured WAF rule D. IP allowlist Answer: B
Network Engineer Ultimate Exam
Explanation: Rate-based rules let you define thresholds (e.g., 100 req/s) and take actions (deny, throttle) when the limit is exceeded. Question 52. In the context of VPC Service Controls, what does “Bridge” refer to? A. A method to allow traffic between two perimeters B. A way to connect a VPC to Cloud DNS C. A feature that automatically encrypts data in transit D. A tool for visualizing network topology Answer: A Explanation: A Bridge allows selective communication between two separate service perimeters while maintaining overall isolation. Question 53. Which of the following is a limitation of VPC Flow Logs? A. They cannot be exported to BigQuery B. They do not capture packet payloads, only metadata C. They are only available for auto-mode VPCs D. They require Cloud Armor to be enabled Answer: B Explanation: Flow logs contain header information (source/destination IP, ports, protocol, bytes, packets) but never include packet payload data. Question 54. Which Cloud DNS policy enables you to serve different IP addresses for the same hostname based on the client’s geographic location? A. DNSSEC policy B. Forwarding zone C. Geo-location routing policy D. Private zone
