Download [PCNE] Google Cloud Certified Professional Cloud Network Engineer Certification Exam Guide and more Exams Technology in PDF only on Docsity!
Cloud Network Engineer Certification Exam
Guide
Question 1. Which VPC topology allows multiple projects to share a common network while retaining centralized control of firewall rules? A) Standalone VPC B) Shared VPC C) VPC Network Peering D) Cloud VPN Answer: B Explanation: Shared VPC lets several projects use the same VPC network, enabling centralized security and routing management while each project maintains its own resources. Question 2. When planning a multi‑regional deployment, which design principle best ensures low latency for users across continents? A) Deploy a single regional VPC and use Cloud CDN B) Use a single global load balancer with a single backend pool C) Deploy separate VPCs per region and interconnect them via Cloud Interconnect D) Deploy GKE clusters in each region and use global external HTTP(S) load balancing Answer: D Explanation: Deploying GKE clusters in each region and front‑ending them with a global external HTTP(S) load balancer routes traffic to the nearest healthy backend, minimizing latency. Question 3. Which CIDR block size is recommended for a subnet that will host up to 500 VM instances, assuming IPv4 only? A) / B) / C) /
Cloud Network Engineer Certification Exam
Guide
D) /
Answer: A Explanation: A /24 provides 256 IP addresses; with GCP reserving a few, it comfortably supports up to 500 instances when combined with alias IP ranges or secondary ranges. Question 4. In a dual‑stack VPC, which setting enables IPv6 address assignment to VM instances automatically? A) Enable Private Google Access B) Enable IPv6 access type “External” on the subnet C) Set “IPv6 address range” on the subnet and enable “Automatic” allocation D) Use BYOIP for IPv6 blocks only Answer: C Explanation: Defining an IPv6 address range on the subnet and selecting automatic allocation allows GCP to assign IPv6 addresses to VMs without manual configuration. Question 5. Which feature allows you to bring a publicly routable IPv4 block that you own into a GCP VPC? A) Cloud NAT B) Private Service Connect C) Bring Your Own IP (BYOIP) D) VPC Peering Answer: C Explanation: BYOIP lets customers import IP ranges they already own and use them as external or internal addresses within GCP.
Cloud Network Engineer Certification Exam
Guide
C) Network policy enforcement D) Node‑local DNS cache Answer: B Explanation: Control plane authorized networks limit which IP ranges can reach the GKE master endpoint, enhancing security for private clusters. Question 9. How can you dynamically expand a subnet’s IP range without recreating resources? A) Delete and recreate the subnet with a larger CIDR B) Use the “Resize subnet” API to add a secondary IP range C) Create a new subnet and migrate workloads manually D) Use VPC Network Peering to combine multiple subnets Answer: B Explanation: GCP allows you to resize a subnet’s primary IP range via the API/Console, automatically updating routes and preserving existing resources. Question 10. Which GCP feature enables VMs without external IPs to reach Google APIs and services? A) Cloud NAT B) Private Google Access C) Cloud VPN D) VPC Service Controls Answer: B Explanation: Private Google Access lets instances without external IPs send traffic to Google APIs over the internal network.
Cloud Network Engineer Certification Exam
Guide
Question 11. When configuring a static route that should be preferred over a default route, which attribute must you adjust? A) Next hop IP address B) Priority (lower value) C) Route tag D) BGP AS path prepend Answer: B Explanation: In GCP, a lower priority number indicates higher preference; setting a lower priority than the default route ensures the static route is chosen. Question 12. Which routing protocol does Cloud Router use to exchange routes with on‑prem BGP peers? A) OSPF B) RIP C) BGP D) IS‑IS Answer: C Explanation: Cloud Router implements BGP to dynamically advertise and learn routes between GCP and external networks. Question 13. In a hub‑and‑spoke model using Network Connectivity Center (NCC), what is the primary role of the hub? A) Host all VM workloads B) Provide a central routing point for inter‑spoke traffic
Cloud Network Engineer Certification Exam
Guide
Question 16. Which option provides a managed, automatically renewed SSL/TLS certificate for a custom domain on a load balancer? A) Self‑managed certificate uploaded by the user B) Google‑managed certificate C) Cloud Armor certificate D) Compute Engine managed certificate Answer: B Explanation: Google‑managed certificates are provisioned, renewed, and attached automatically to load balancers for supported domains. Question 17. Enabling Cloud CDN on a backend service primarily improves which metric? A) CPU utilization of backend VMs B) Latency for cacheable content C) Number of health‑check failures D) Size of the VPC flow logs Answer: B Explanation: Cloud CDN caches content at edge locations, reducing latency for repeat requests of cacheable assets. Question 18. How can you invalidate a single object cached in Cloud CDN without affecting other objects? A) Delete the entire backend bucket B) Use the “invalidateCache” method with the object’s path C) Wait for the object’s TTL to expire
Cloud Network Engineer Certification Exam
Guide
D) Disable Cloud CDN for the backend service temporarily Answer: B Explanation: The invalidateCache API call can target specific URL paths, forcing a refresh of the selected object. Question 19. Which mechanism allows you to grant temporary, signed access to private objects stored in Cloud Storage via Cloud CDN? A) IAM roles on the bucket B) Signed URLs or Signed Cookies C) VPC Service Controls perimeter D) Cloud Armor security policy Answer: B Explanation: Signed URLs and Signed Cookies provide time‑limited access tokens that Cloud CDN validates before serving private objects. Question 20. What is the primary purpose of Cloud NAT in a VPC? A) Provide inbound SSH access to private instances B) Allow outbound internet traffic from instances without external IPs C) Encrypt traffic between VPCs D) Route traffic through a partner interconnect Answer: B Explanation: Cloud NAT translates private internal IPs to a public IP for outbound connections, enabling internet access without assigning external IPs to each VM. Question 21. Private Service Connect (PSC) is used to:
Cloud Network Engineer Certification Exam
Guide
Explanation: The SA lifetime defines how long the negotiated security association remains valid before renegotiation. Question 24. When choosing Dedicated Interconnect over Partner Interconnect, which factor is most decisive? A. Need for lower latency than 10 ms B. Requirement for a minimum 10 Gbps connection C. Preference for a fully managed Google‑owned link D. Lack of a nearby partner facility Answer: B Explanation: Dedicated Interconnect provides 10 Gbps or 100 Gbps capacities, while Partner Interconnect is limited to up to 10 Gbps per connection. Organizations needing higher bandwidth typically select Dedicated. Question 25. What does a VLAN attachment (VLAN attachment) in Cloud Interconnect represent? A. A virtual router instance inside GCP B. A logical connection between a Cloud Router and a physical interconnect link C. A DNS forwarding zone for on‑prem resolution D. An IPSec tunnel for HA VPN Answer: B Explanation: A VLAN attachment binds a Cloud Router to a specific VLAN on a Dedicated or Partner Interconnect link, enabling BGP route exchange. Question 26. Which peering option is specifically designed for Google Workspace and YouTube traffic to reduce latency?
Cloud Network Engineer Certification Exam
Guide
A. Direct Peering B. Carrier Peering C. Private Service Connect D. VPC Peering Answer: A Explanation: Direct Peering establishes a physical connection between a customer’s network and Google’s edge network, optimizing traffic for services like Workspace and YouTube. Question 27. In Cloud Armor, which rule type is used to block traffic from specific geographic locations? A. Rate‑based rule B. IP block list C. Geo‑match rule D. TLS inspection rule Answer: C Explanation: Geo‑match rules let you allow or deny traffic based on the source country or region. Question 28. Which firewall rule attribute lets you apply a rule only to instances that have a specific network tag? A. Service account B. Destination IP range C. Target tags D. Source service account Answer: C
Cloud Network Engineer Certification Exam
Guide
C. cloudsql.googleapis.com/database/disk/bytes_used D. storage.googleapis.com/bucket/object_count Answer: B Explanation: The egress_bytes_count metric reports outbound traffic volume for a subnetwork. Question 32. To receive alerts when a VPN tunnel goes down, which alerting policy condition should you configure? A. Metric absence on vpn.googleapis.com/tunnel/packet_loss B. Metric threshold on vpn.googleapis.com/tunnel/active_sessions < 1 C. Metric threshold on vpn.googleapis.com/tunnel/state = DOWN D. Log‑based alert on “vpn tunnel established” messages missing Answer: C Explanation: The tunnel state metric reflects the operational status; setting a threshold for the “DOWN” state triggers alerts. Question 33. Enabling VPC Flow Logs provides visibility into: A. DNS query logs for private zones B. Network traffic metadata (source/destination IP, ports, protocol) for each flow C. Application‑level request logs for Cloud Run services D. Firewall rule changes over time Answer: B Explanation: VPC Flow Logs capture packet‑level metadata for traffic traversing VPC interfaces, useful for auditing and troubleshooting.
Cloud Network Engineer Certification Exam
Guide
Question 34. Which log type must be enabled to see denied firewall rule matches? A. System logs B. Audit logs C. Firewall rule logging (via “logConfig”) D. Cloud DNS query logs Answer: C Explanation: Setting “logConfig” on a firewall rule enables logging of matched packets, including denied traffic. Question 35. In Network Intelligence Center, the Connectivity Test tool helps you: A. Measure latency between two Cloud SQL instances B. Verify DNS resolution from a GKE pod to an external domain C. Identify broken network paths between two endpoints (VMs, URLs, etc.) D. Generate firewall rule recommendations automatically Answer: C Explanation: Connectivity Tests simulate traffic between source and destination, reporting any routing, firewall, or policy issues. Question 36. Which visualization in Network Intelligence Center displays the relationship between VPCs, VPNs, and interconnects? A. Performance Dashboard B. Network Topology C. Traffic Flow Explorer D. Cloud Asset Inventory
Cloud Network Engineer Certification Exam
Guide
A. BGP peer IP address B. Advertised route priority C. BGP ASN (Autonomous System Number) D. MTU size Answer: C Explanation: Both sides of a BGP session must agree on their respective ASNs to establish a proper peering relationship. Question 40. Which Cloud Armor feature protects against sudden traffic spikes from a single IP address? A. Geo‑blocking rule B. Rate‑based rule C. Pre‑configured WAF rule set D. TLS policy enforcement Answer: B Explanation: Rate‑based rules limit the number of requests per IP over a defined interval, mitigating burst attacks. Question 41. To restrict access to a Cloud Run service to only users in a specific Google Workspace domain, you would configure: A. VPC Service Controls B. Identity‑Aware Proxy (IAP) with domain‑restricted OAuth client C. Cloud Armor with a domain‑allowlist rule D. Firewall rule using service account tags Answer: B
Cloud Network Engineer Certification Exam
Guide
Explanation: IAP can enforce authentication and allow you to restrict access based on the user’s Google Workspace domain. Question 42. Which of the following best describes the effect of enabling “Private Google Access” on a subnet that already has a Cloud NAT gateway? A. Redundant – both provide the same functionality B. Private Google Access enables access to Google APIs without NAT, while Cloud NAT provides internet egress for other destinations C. Cloud NAT disables Private Google Access automatically D. Private Google Access becomes required for all outbound traffic, bypassing NAT Answer: B Explanation: Private Google Access lets VMs reach Google APIs via internal routes; Cloud NAT handles internet traffic. They complement each other. Question 43. In a Shared VPC host project, which IAM role grants the ability to create subnets in the host VPC? A. roles/compute.networkAdmin B. roles/owner C. roles/compute.subnetworkViewer D. roles/compute.securityAdmin Answer: A Explanation: The compute.networkAdmin role includes permissions to create, delete, and modify subnets within a VPC. Question 44. Which load balancer type automatically terminates SSL/TLS at the edge and forwards traffic as HTTP to backends?
Cloud Network Engineer Certification Exam
Guide
Explanation: DNS does not automatically resolve across peered VPCs; you must configure DNS peering or forwarding for cross‑network name resolution. Question 47. If you need to enforce a “least‑privilege” network policy for a set of GKE workloads, which combination is most appropriate? A. Use NetworkPolicy objects together with GKE private clusters B. Enable Cloud Armor on the node pool C. Apply firewall rules based on service accounts only D. Use VPC‑native clusters with alias IPs and configure NetworkPolicy with Calico Answer: D Explanation: VPC‑native clusters with alias IP ranges allow fine‑grained NetworkPolicy enforcement using Calico, aligning with least‑privilege principles. Question 48. Which metric would you monitor to detect a possible DDoS attack on a Cloud HTTP(S) load balancer? A. compute.googleapis.com/instance/disk/write_bytes_count B. loadbalancing.googleapis.com/https/request_count per second C. storage.googleapis.com/bucket/bytes_received D. bigquery.googleapis.com/query/row_count Answer: B Explanation: A sudden surge in request count on the load balancer is indicative of a potential DDoS event. Question 49. When configuring a Cloud VPN tunnel with BGP, which field specifies the IP address of the GCP side of the BGP session?
Cloud Network Engineer Certification Exam
Guide
A. BGP peer IP address (peerIp) B. BGP advertised routes C. BGP session name D. BGP remote ASN Answer: A Explanation: The BGP peer IP (peerIp) is the IP of the Cloud Router interface that participates in the BGP session. Question 50. Which GCP service provides a managed, global Anycast IP address for services like Cloud DNS and HTTP(S) load balancers? A. Cloud Armor B. Cloud CDN C. Cloud Load Balancing (global external) D. Cloud Interconnect Answer: C Explanation: Global external HTTP(S) load balancers use Anycast IPs that are advertised from Google’s edge locations worldwide. Question 51. In order to prevent data exfiltration from a GKE cluster to the public internet, you should enable: A. Private Google Access B. VPC Service Controls perimeter that includes the GKE cluster C. Cloud NAT with deny‑all egress rules D. Firewall rule that blocks all egress traffic Answer: B
