Google Cloud Certified - Professional Cloud Network Engineer Practice Tests 2026 | Pass Professional-Cloud-Network-Engineer with confidence!
Practice Google Cloud Platform Professional-Cloud-Network-Engineer exam. Online Exam Practice Tests with detailed explanations!
The Google Cloud Certified - Professional Cloud Network Engineer certification exam is structured to test the candidate's ability to design and configure Google Cloud networks, ensure high availability, and implement security measures to protect against threats. Professional-Cloud-Network-Engineer exam also evaluates the candidate's ability to troubleshoot issues related to network connectivity and performance. Professionals who pass Professional-Cloud-Network-Engineer exam demonstrate their competency in using Google Cloud networking technologies to create and manage secure and scalable networks.
NEW QUESTION # 42
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
* Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.
* The subnetwork logs are not excluded from Stackdriver.
* The instance that is hosting the application can communicate outside the subnet.
* Other instances within the subnet can communicate outside the subnet.
* The external resource initiates communication.
What is the most likely cause of the missing log lines?
- A. The traffic is not matching the expected ingress rule.
- B. The traffic is matching the expected ingress rule.
- C. The traffic is matching the expected egress rule.
- D. The traffic is not matching the expected egress rule.
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION # 43
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
GetIamPolicy() via REST API
- A. role roles/editor
gcloud projects add-iam-policy-binding $projectname --member user:$username -- - B. role roles/editor
- C. setIamPolicy() via REST API
- D. gcloud pubsub add-iam-policy-binding $projectname --member user:$username --
- E. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
Answer: B,E
Explanation:
Explanation/Reference: https://cloud.google.com/iam/docs/granting-changing-revoking-access
NEW QUESTION # 44
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the compute.instanceAdmin to your user account.
- B. Grant the read-only privilege to the service account for the Cloud Storage bucket.
- C. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
- D. Grant the iam.serviceAccountUser to your user account.
Answer: B
NEW QUESTION # 45
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
- B. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
- C. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- D. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
Answer: D
Explanation:
https://cloud.google.com/load-balancing/docs/https/setting-up-https#sendtraffic
NEW QUESTION # 46
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. TCP proxy load balancer
- B. Network load balancer
- C. SSL proxy load balancer
- D. HTTPS load balancer
Answer: C
NEW QUESTION # 47
Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access only from resources in your corporate public networks. What should you do?
- A. Create a VPC Service Controls perimeter for each VPC with an access context policy that allows your corporate public network IP ranges.
- B. Create a VPC Service Controls perimeter for your project with an access context policy that allows your corporate public network IP ranges.
- C. Create a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized networks.
- D. Create an access context policy that allows your VPC and corporate public network IP ranges, and then attach the policy to Cloud Storage and BigQuery.
Answer: B
NEW QUESTION # 48
Your company has provisioned 2000 virtual machines (VMs) in the private subnet of your Virtual Private Cloud (VPC) in the us-east1 region. You need to configure each VM to have a minimum of 128 TCP connections to a public repository so that users can download software updates and packages over the internet. You need to implement a Cloud NAT gateway so that the VMs are able to perform outbound NAT to the internet. You must ensure that all VMs can simultaneously connect to the public repository and download software updates and packages. Which two methods can you use to accomplish this? (Choose two.)
- A. Use the default Cloud NAT gateway's NAT proxy to dynamically scale using a single NAT IP address.
- B. Configure the NAT gateway in manual allocation mode, allocate 2 NAT IP addresses, and update the minimum number of ports per VM to 256.
- C. Use the default Cloud NAT gateway to automatically scale to the required number of NAT IP addresses, and update the minimum number of ports per VM to 128.
- D. Configure the NAT gateway in manual allocation mode, allocate 4 NAT IP addresses, and update the minimum number of ports per VM to 128.
- E. Create a second Cloud NAT gateway with the default minimum number of ports configured per VM to 64.
Answer: B,E
NEW QUESTION # 49
Your company's current network architecture has three VPC Service Controls perimeters:
One perimeter (PERIMETER_PROD) to protect production storage buckets
One perimeter (PERIMETER_NONPROD) to protect non-production storage buckets One perimeter (PERIMETER_VPC) that contains a single VPC (VPC_ONE) In this single VPC (VPC_ONE), the IP_RANGE_PROD is dedicated to the subnets of the production workloads, and the IP_RANGE_NONPROD is dedicated to subnets of non-production workloads. Workloads cannot be created outside those two ranges. You need to ensure that production workloads can access only production storage buckets and non-production workloads can access only non-production storage buckets with minimal setup effort. What should you do?
- A. Develop a design that creates a new VPC (VPC_NONPROD) in the same project as VPC_ONE. Migrate all the non-production workloads from VPC_ONE to the PERIMETER_NONPROD perimeter. Remove the PERIMETER_VPC perimeter. Update the PERIMETER_PROD perimeter to include VPC_ONE and the PERIMETER_NONPROD perimeter to include VPC_NONPROD.
- B. Develop a design that removes the PERIMETER_VPC perimeter. Update the PERIMETER_PROD perimeter to include the project containing VPC_ONE. Remove the PERIMETER_NONPROD perimeter.
- C. Develop a design that removes the PERIMETER_VPC perimeter. Update the PERIMETER_NONPROD perimeter to include the project containing VPC_ONE. Remove the PERIMETER_PROD perimeter.
- D. Develop a design that uses the IP_RANGE_PROD and IP_RANGE_NONPROD perimeters to create two access levels, with each access level referencing a single range. Create two ingress access policies with each access policy referencing one of the two access levels. Update the PERIMETER_PROD and PERIMETER_NONPROD perimeters.
Answer: D
Explanation:
Using IP range-based access levels for VPC Service Controls allows segmentation of production and non-production resources within the same VPC. By creating separate access levels and ingress policies for each IP range, you ensure that only production subnets access production buckets and non-production subnets access non-production buckets, providing the required isolation.
NEW QUESTION # 50
You have provisioned a Dedicated Interconnect connection of 20 Gbps with a VLAN attachment of 10 Gbps.
You recently noticed a steady increase in ingress traffic on the Interconnect connection from the on-premises data center. You need to ensure that your end users can achieve the full 20 Gbps throughput as quickly as possible. Which two methods can you use to accomplish this? (Choose two.)
- A. From the Google Cloud Console, request a new Dedicated Interconnect connection of 20 Gbps, and configure a VLAN attachment of 10 Gbps.
- B. Configure an additional VLAN attachment of 10 Gbps in the same region. Configure the on-premises router to advertise routes with the same multi-exit discriminator (MED).
- C. Configure an additional VLAN attachment of 10 Gbps in another region. Configure the on-premises router to advertise routes with the same multi-exit discriminator (MED).
- D. From the Google Cloud Console, modify the bandwidth of the VLAN attachment to 20 Gbps.
- E. Configure Link Aggregation Control Protocol (LACP) on the on-premises router to use the 20-Gbps Dedicated Interconnect connection.
Answer: D,E
NEW QUESTION # 51
You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods.
In one of your instances you notice the master is not responding, even though the cluster is up and running.
What should you do to solve the problem?
- A. Assign a public IP address to the instance.
- B. Create the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance.
- C. Create a route to reach the Master, pointing to the default internet gateway.
- D. Create the appropriate master authorized network entries to allow the instance to communicate to the master.
Answer: D
Explanation:
https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#cant_reach_cluster
https://cloud.google.com/kubernetes-engine/docs/how-to/authorized-networks
NEW QUESTION # 52
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- B. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- C. Generate a new SSH key pair. Verify the format of the public key and add it to the project.
SSH into the instance using a third-party tool like putty or ssh. - D. Generate a new SSH key pair. Verify the format of the private key and add it to the instance.
SSH into the instance using a third-party tool like putty or ssh.
Answer: B
Explanation:
https://cloud.google.com/compute/docs/storing-retrieving-metadata
NEW QUESTION # 53
Your company's current network architecture has two VPCs that are connected by a dual-NIC instance that acts as a bump-in-the-wire firewall between the two VPCs. Flows between pairs of subnets across the two VPCs are working correctly. Suddenly, you receive an alert that none of the flows between the two VPCs are working anymore. You need to troubleshoot the problem. What should you do? (Choose 2 answers)
- A. Verify that the dual-NIC instance has not been added to a backend service.
- B. Verify that a VPC Service Controls perimeter has not been enabled for the project that contains the two VPCs and the dual-NIC instance.
- C. Use Cloud Logging to verify that there were no modifications to the VPC firewall rules or policies that were applied to the two network interfaces of the dual-NIC instance.
- D. Verify that a public IP address has not been assigned to any network interface of the dual-NIC instance.
- E. Verify that the dual-NIC instance has the --can-ip-forward attribute enabled.
Answer: C,E
Explanation:
Explanation: You should check Cloud Logging to see if any firewall rules or policies were modified, as these could block traffic between the VPCs. Additionally, the --can-ip-forward attribute must be enabled for the dual-NIC instance to allow forwarding traffic between the interfaces.
NEW QUESTION # 54
You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible, To ease the transition, you decided to use the same architecture as your on-premises network' a hub-and-spoke model. Your on-premises architecture consists of over 50 spokes.
Each spoke does not have connectivity to the other spokes, and all traffic IS sent through the hub for security reasons. You need to ensure that the Google Cloud architecture matches your on-premises architecture. You want to implement a solution that minimizes management overhead and cost, and uses default networking quotas and limits. What should you do?
- A. Connect all the spokes to the hub with VPC Network Peering. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.
- B. Connect all the spokes to the hub with Cloud VPN.
- C. Connect all the spokes to the hub With Cloud VPN. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes
- D. Connect all the spokes to the hub with VPC Network Peering.
Answer: A
Explanation:
The correct answer is D because it meets the following requirements:
* It matches the hub-and-spoke model of the on-premises network, where each spoke is a separate VPC network that is connected to a central hub VPC network.
* It minimizes management overhead and cost, because VPC Network Peering is a simple and low-cost way to connect VPC networks without using any external IP addresses or VPN gateways1.
* It uses default networking quotas and limits, because VPC Network Peering does not consume any quota or limit for VPN tunnels, external IP addresses, or forwarding rules2.
* It prevents connectivity between the spokes, because VPC Network Peering is non-transitive by default, meaning that a spoke can only communicate with the hub, not with other spokes1. To enforce this restriction, a third-party network appliance can be used as a default gateway in each spoke VPC network, which can filter out any traffic destined for other spokes3.
Option A is incorrect because it does not minimize cost, as Cloud VPN charges for egress traffic and requires external IP addresses for the VPN gateways4. Option B is incorrect because it does not prevent connectivity between the spokes, as VPC Network Peering allows direct communication between peered VPC networks by default1. Option C is incorrect because it does not minimize cost or use default quotas and limits, for the same reasons as option A.
NEW QUESTION # 55
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the compute.instanceAdminto your user account.
- B. Grant the cloud-platformprivilege to the service account for the Cloud Storage bucket.
- C. Grant the iam.serviceAccountUserto your user account.
- D. Grant the read-onlyprivilege to the service account for the Cloud Storage bucket.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/access/iam
NEW QUESTION # 56
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.
What should you do?
- A. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
- B. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
- C. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.* Configure the appropriate static routes.
- D. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel per subnet.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Create the appropriate static routes.
Answer: C
NEW QUESTION # 57
Your organization is developing a landing zone architecture with the following requirements:
* There should be no communication between production and non-production environments.
* Communication between applications within an environment may be necessary.
* Network administrators should centrally manage all network resources, including subnets, routes, and firewall rules.
* Each application should be billed separately.
* Developers of an application within a project should have the autonomy to create their compute resources.
* Up to 1000 applications are expected per environment.
You need to create a design that accommodates these requirements. What should you do?
- A. Create a design that implements a single Shared VPC. Use VPC firewall rules with secure tags to enforce micro-segmentation between environments.
- B. Create a design that has a Shared VPC for each project. Implement hierarchical firewall policies to apply micro-segmentation between VPCs.
- C. Create a design that has one host project with a Shared VPC for the production environment, another host project with a Shared VPC for the non-production environment, and a service project that is associated with the corresponding host project for each initiative.
- D. Create a design where each project has its own VPC. Ensure all VPCs are connected by a Network Connectivity Center hub that is centrally managed by the network team.
Answer: C
Explanation:
Explanation: This design allows you to separate production and non-production environments while using Shared VPCs. Each environment has its own Shared VPC, and a service project is associated with each, allowing for separate billing and autonomy for developers. Centralized management of network resources is handled by the host projects.
: Google Cloud Shared VPC Documentation
NEW QUESTION # 58
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?
- A. Create unique DNS records for each service that sends traffic to the desired IP address.
- B. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.
- C. Configure global load balancing to point 172.16.45.0/24 to the correct instance.
- D. Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION # 59
......
Google Professional-Cloud-Network-Engineer certification exam covers a wide range of topics related to GCP networking, including designing and implementing a GCP virtual private cloud (VPC), configuring network services like Cloud Load Balancing and Cloud CDN, and optimizing network performance. Candidates are also expected to be proficient in GCP security and compliance.
Google Professional-Cloud-Network-Engineer exam is a certification test designed for individuals who want to demonstrate their skills and knowledge in designing, implementing, and managing complex network architectures on the Google Cloud Platform. Google Cloud Certified - Professional Cloud Network Engineer certification exam is intended for network professionals who want to validate their expertise in building and managing secure, scalable, and high-performance networks on the Google Cloud Platform.
Get instant access to Professional-Cloud-Network-Engineer practice exam questions: https://drive.google.com/open?id=1GCIvnwedW0Nenbdz5JTutTGodyeFmlyC
The best Professional-Cloud-Network-Engineer exam study material and preparation tool is here: https://www.examslabs.com/Google/Google-Cloud-Platform/best-Professional-Cloud-Network-Engineer-exam-dumps.html