[Oct-2026] Latest Google Professional-Cloud-Network-Engineer Certification Practice Test Questions [Q156-Q173]

Rate this post

[Oct-2026] Latest Google Professional-Cloud-Network-Engineer Certification Practice Test Questions

Verified Professional-Cloud-Network-Engineer Dumps Q&As – 1 Year Free & Quickly Updates

Google Professional-Cloud-Network-Engineer Exam Syllabus Topics:

Section	Objectives
Topic 1: Manage, monitor, and optimize network operations	– Monitor and troubleshoot network infrastructure 1. Monitor logs and metrics 2. Analyze latency and traffic flow 3. Troubleshoot connectivity issues 4. Optimize network cost and performance
Topic 2: Design, plan, and prototype a Google Cloud network	– Design overall network architecture 1. Plan secure and scalable network topologies 2. Design IP addressing plans for Google Kubernetes Engine 3. Design hybrid network connectivity 4. Design Virtual Private Cloud (VPC) networks
Topic 3: Implement hybrid interconnectivity	– Implement hybrid networking solutions 1. Configure Cloud Interconnect 2. Implement site-to-site connectivity 3. Configure Cloud Router and dynamic routing 4. Configure Cloud VPN
Topic 4: Implement Virtual Private Cloud (VPC) instances	– Configure and manage VPC networks 1. Configure firewall rules 2. Configure subnets and routes 3. Implement Shared VPC 4. Manage GKE networking
Topic 5: Implement network security	– Secure Google Cloud network environments 1. Configure Cloud Armor policies 2. Implement secure SSH access 3. Configure third-party network security appliances 4. Configure Identity and Access Management
Topic 6: Configure network services	– Deploy and manage Google Cloud network services 1. Enable additional networking services 2. Configure Cloud DNS 3. Configure Cloud CDN 4. Configure load balancing

NEW QUESTION 156
You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket. You are using the USE_ORIGIN_HEADERS cache mode. You receive an HTTP 403 error when opening the file in your browser, and you see that the HTTP response has a Cache-Control: private, max-age=0 header. How should you correct this issue?

Enable negative caching for the backend bucket.

Change the cache mode to Force cache all content.

Configure a Cloud Storage bucket permission that gives allUsers the Storage Legacy Object Reader role.

Increase the default time-to-live (TTL) for the backend service.

NEW QUESTION 157
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?

Create 2 VPCs, each with their own regions and individual subnets.
Create 2 VPN gateways to establish connectivity between these regions.

Create 2 VPCs, each with their own region and individual subnets.
Use external IP addresses on the instances to establish connectivity between these regions.

Create 1 VPC with 2 regional subnets.
Create a global load balancer to establish connectivity between the regions.

Create 1 VPC with 2 regional subnets.
Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.

NEW QUESTION 158
You need to configure a Google Kubernetes Engine (GKE) cluster. The initial deployment should have 5 nodes with the potential to scale to 10 nodes. The maximum number of Pods per node is 8. The number of services could grow from 100 to up to 1024. How should you design the IP schema to optimally meet this requirement?

Configure a /28 primary IP address range for the node IP addresses. Configure a (25 secondary IP range for the Pods. Configure a /22 secondary IP range for the Services.

Configure a /28 primary IP address range for the node IP addresses. Configure a /25 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.

Configure a /28 primary IP address range for the node IP addresses. Configure a /28 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.

Configure a /28 primary IP address range for the node IP addresses. Configure a /24 secondary IP range for the Pads. Configure a /22 secondary IP range for the Services.

NEW QUESTION 159
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin.
What should you do?

Ensure that the object you don’t want to be cached anymore is not shared publicly.

Create a new storage bucket, and move the object you don’t want to be checked anymore inside it. Then edit the bucket setting and enable the private attribute.

Add an appropriate lifecycle rule on the storage bucket containing the two objects.

Add a Cache-Control entry with value private to the metadata of the object you don’t want to be cached anymore. Invalidate all the previously cached copies.

NEW QUESTION 160
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?

Upload your public ssh key to the project Metadata.

Upload your public ssh key to each instance Metadata.

Create a custom Google Compute Engine image with your public ssh key embedded.

Use gcloud compute ssh to automatically copy your public ssh key to the instance.

NEW QUESTION 161
You are troubleshooting an issue where your organization’s Cloud HA VPN is disconnected from your on- premises router for approximately 10 seconds before reestablishing the tunnel. The issue regularly occurs every few hours. You notice that the HA VPN logs show an entry of Received SA_DELETE when this issue occurs. You need to resolve this issue and prevent future VPN downtime from impacting your production applications. What should you do?

Q Update the pre-shared key (PSK) of the on-premises router’s VPN tunnel configuration to match the PSK of the Cloud HA VPN.

Q Update the on-premises router’s BGP router ID to reflect the link-local IP peer address assigned by Cloud Router.

Q Update the on-premises router’s Phase 1 and Phase 2 lifetime IKE parameters to match the values in the Cloud HA VPN documentation.

Q Update the on-premises router’s Diffie-Hellman groups and cipher proposal list to match the values in the Cloud HA VPN documentation.

NEW QUESTION 162
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution.
Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year.
These are the assumptions for both GCP environments.
– Each organization has enabled full connectivity between all of its
projects by using Shared VPC.
– Both organizations strictly use the 10.0.0.0/8 address space for
their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.
– There are no prefix overlaps between the two organizations.
– Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.
– Neither organization has Interconnects to their on-premises
environment.
You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.
Which two steps should you take? (Choose two.)

Provision Cloud Interconnect to connect both organizations together.

Set up some variant of DNS forwarding and zone transfers in each organization.

Connect VPCs in both organizations using Cloud VPN together with Cloud Router.

Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.

Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC.

NEW QUESTION 163
You are planning to use Terraform to deploy the Google Cloud infrastructure for your company The design must meet the following requirements
* Each Google Cloud project must represent an Internal project that your team Will work on
* After an internal project is finished, the infrastructure must be deleted
* Each Internal project must have Its own Google Cloud project owner to manage the Google Cloud resources-
* You have 10-100 projects deployed at a time,
While you are writing the Terraform code, you need to ensure that the deployment IS Simple, and the code IS reusable With centralized management What should you doo

Create a Single pt0Ject and additional VPCs for each Internal project

Create a Single Project and Single VPC for each internal project

Create a single Shared VPC and attach each Google Cloud project as a service project

Create a Shared VPC and service project for each Internal project

The correct answer is C. Create a single Shared VPC and attach each Google Cloud project as a service project.
This answer is based on the following facts:
A Shared VPC allows you to share one or more VPC networks across multiple Google Cloud projects1. This simplifies the deployment and management of the network infrastructure, as you only need to create and maintain one VPC network for all your internal projects.
A Shared VPC consists of a host project that owns the VPC network and one or more service projects that use the VPC network2. You can attach and detach service projects as needed, depending on the lifecycle of your internal projects. You can also delete service projects without affecting the host project or other service projects.
A Shared VPC allows you to delegate administrative roles to different project owners3. You can grant the Shared VPC Admin role to the owner of the host project, who can manage the VPC network and its subnets. You can also grant the Service Project Admin role to the owners of the service projects, who can manage the Google Cloud resources in their own projects.
The other options are not correct because:
Option A is not suitable. Creating a single project and additional VPCs for each internal project will increase the complexity and cost of the network infrastructure. You will need to create and maintain multiple VPC networks, firewall rules, routes, and VPN tunnels. You will also have a limit on the number of VPC networks per project4.
Option B is not feasible. Creating a single project and single VPC for each internal project will not meet the requirement of having separate project owners for each internal project. You will have only one project owner who can manage all the Google Cloud resources in the same project.
Option D is not optimal. Creating a Shared VPC and service project for each internal project will not meet the requirement of having a simple and reusable code with centralized management. You will need to create and maintain multiple Shared VPCs, which will increase the complexity and cost of the network infrastructure. You will also have more Terraform code to write and manage for each Shared VPC.

NEW QUESTION 164
You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing using the gcloud command.
Which next hop should you choose?

The default internet gateway

The IP address of the Cloud VPN gateway

The name and region of the Cloud VPN tunnel

The IP address of the instance on the remote side of the VPN tunnel

NEW QUESTION 165
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service.
What should you do?

Create a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing service.

Create a VPC Firewall rule that blocks all traffic except for the traffic-scrubbing service.

Create a VPC Service Control Perimeter that blocks all traffic except for the traffic-scrubbing service.

Create IPTables firewall rules that block all traffic except for the traffic-scrubbing service.

NEW QUESTION 166
Your multi-region VPC has had a long-standing HA VPN configured in “region 1” connected to your corporate network. You are planning to add two 10 Gbps Dedicated Interconnect connections and VLAN attachments in “region 2” to connect to the same corporate network. You need to plan for connectivity between your VPC and corporate network to ensure that traffic uses the Dedicated Interconnect connections as the primary path and the HA VPN as the secondary path. What should you do?

Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in “region 1” to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.

Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in “region 1” to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.

Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in “region 1” to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.

Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in “region 1” to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.

NEW QUESTION 167
You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your application availability and ensure it can autoscale.
How should you provision your instances?

Create a single managed instance group, specify the desired region, and select Multiple zones for the location.

Create a managed instance group for each region, select Single zone for the location, and manually distribute instances across the zones in that region.

Create an unmanaged instance group in a single zone, and then create an HTTP load balancer for the instance group.

Create an unmanaged instance group for each zone, and manually distribute the instances across the desired zones.

NEW QUESTION 168
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?

Update the TTL for the zone.

Set the zone to the TRANSFER state.

Disable DNSSEC at your domain registar.

Transfer ownership of the domain to a new registar.
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone.

NEW QUESTION 169
You are responsible for designing a new connectivity solution between your organization’s on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network Currently, there Is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability What should you do?

Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.

Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.

Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.

Use HA VPN. Configure one tunnel from each Interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.

NEW QUESTION 170
You have two VPCs: VPC A in Project A and VPC B in Project B. The VPCs are peered, and each VPC has VM instances in four zones. You are using the Network Intelligence Center Performance Dashboard to investigate the packet loss for traffic flows that start in VPC A and terminate in VPC B. You need the reported packet loss metric to have at least a 90% confidence level. What should you do?

Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project A for the reported metric.

Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project B for the reported metric.

Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project A for the reported metric.

Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project B for the reported metric.

NEW QUESTION 171
(You are managing an application deployed on Cloud Run. The development team has released a new version of the application. You want to deploy and redirect traffic to this new version of the application. To ensure traffic to the new version of the application is served with no startup time, you want to ensure that there are two idle instances available for incoming traffic before adjusting the traffic flow. You also want to minimize administrative overhead. What should you do?)

Ensure the checkbox “Serve this revision immediately” is unchecked when deploying the new revision.
Before changing the traffic rules, use a traffic simulation tool to send load to the new revision.

Configure service autoscaling and set the minimum number of instances to 2.

Configure revision autoscaling for the new revision and set the minimum number of instances to 2.

Configure revision autoscaling for the existing revision and set the minimum number of instances to 2.

Let’s analyze each option to find the one that meets the requirements of no startup time for new traffic, two idle instances, and minimal administrative overhead:
A: Unchecking “Serve this revision immediately” and using a traffic simulation tool: Unchecking “Serve this revision immediately” does prevent the new revision from receiving traffic immediately. However, manually using a traffic simulation tool adds administrative overhead. It also doesn’t guarantee that two idle instances will be ready before traffic is shifted; you would need to monitor and adjust traffic manually based on the simulation.
B: Configuring service autoscaling and setting the minimum number of instances to 2: Service-level autoscaling applies to all revisions of the service. Setting the minimum instances at the service level would ensure at least two instances are running across all active revisions, not specifically for the new revision before traffic shift.
C: Configuring revision autoscaling for the new revision and setting the minimum number of instances to 2:
This is the correct approach. By configuring revision autoscaling specifically for the new revision and setting the minimum number of instances to 2, Cloud Run will ensure that at least two instances of the new version are running and ready to serve traffic before you redirect any traffic to it. This eliminates startup latency when you do shift traffic. It also minimizes administrative overhead as Cloud Run manages the instance scaling based on this configuration.
D: Configuring revision autoscaling for the existing revision and setting the minimum number of instances to
2: This would ensure the existing version has at least two idle instances, which doesn’t directly address the requirement of having idle instances ready for the new version before traffic redirection.
Google Cloud Documentation References:
Cloud Run Autoscaling: https://cloud.google.com/run/docs/configuring/min-instances – This document explains how to configure minimum and maximum instances for Cloud Run services and revisions. It clarifies that you can set minimum instances at the revision level to ensure instances are always ready.
Cloud Run Traffic Management: https://cloud.google.com/run/docs/managing/traffic – This describes how to deploy new revisions and gradually shift traffic between them. Combining minimum instances on the new revision with traffic splitting allows for zero-downtime deployments with pre-warmed instances.

NEW QUESTION 172
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?

Enable logging on the default Deny Any Firewall Rule.

Enable logging on the VM Instances that receive traffic.

Create a logging sink forwarding all firewall logs with no filters.

Create an explicit Deny Any rule and enable logging on the new rule.

NEW QUESTION 173
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner’s network that need access to some resources in your company’s VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)

Cloud NAT

Cloud VPN

Shared VPC

VPC peering

Dedicated Interconnect

Latest 2026 Realistic Verified Professional-Cloud-Network-Engineer Dumps – 100% Free Professional-Cloud-Network-Engineer Exam Dumps: https://www.prepawaytest.com/Google/Professional-Cloud-Network-Engineer-practice-exam-dumps.html

Google Professional-Cloud-Network-Engineer Exam Syllabus Topics:

Leave a Reply Cancel reply