Google Professional Cloud Network Engineer Practice Exams
Last updated on Oct 21,2026- Exam Code: Professional Cloud Network Engineer
- Exam Name: Professional Cloud Network Engineer
- Certification Provider: Google
- Latest update: Oct 21,2026
You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial-of-service and application layer (layer 7) attacks.
What should you do?
- A . Configure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.
- B . Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.
- C . Configure VPC firewall rules to protect the Compute Engine instances against distributed denial-of-service attacks.
- D . Configure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level.
Your company’s security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web servers within your Virtual Private Cloud (VPC) to handle HTTP and HTTPS web traffic for TCP only.
What should you do?
- A . Create an allow on match ingress firewall rule with the target tag “web-server” to allow all IP addresses for TCP port 80.
- B . Create an allow on match egress firewall rule with the target tag “web-server” to allow all IP addresses for TCP port 80.
- C . Create an allow on match ingress firewall rule with the target tag “web-server” to allow all IP addresses for TCP ports 80 and 443.
- D . Create an allow on match egress firewall rule with the target tag “web-server" to allow web server IP addresses for TCP ports 60 and 443.
C
Explanation:
Reference: https://cloud.google.com/load-balancing/docs/https
Your company has recently installed a Cloud VPN tunnel between your on-premises data center and your Google Cloud Virtual Private Cloud (VPC). You need to configure access to the Cloud Functions API for your on-premises servers.
The configuration must meet the following requirements:
Certain data must stay in the project where it is stored and not be exfiltrated to other projects. Traffic from servers in your data center with RFC 1918 addresses do not use the internet to access Google Cloud APIs.
All DNS resolution must be done on-premises.
The solution should only provide access to APIs that are compatible with VPC Service Controls.
What should you do?
- A . Create an A record for private.googleapis.com using the 199.36.153.8/30 address range.
Create a CNAME record for *.googleapis.com that points to the A record.
Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates. - B . Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.
Create a CNAME record for *.googleapis.com that points to the A record.
Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
Configure your on-premises firewalls to allow traffic to the restricted.googleapis.com addresses. - C . Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.
Create a CNAME record for *.googleapis.com that points to the A record.
Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates. - D . Create an A record for private.googleapis.com using the 199.36.153.8/30 address range.
Create a CNAME record for *.googleapis.com that points to the A record.
Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record.
Configure your on-premises firewalls to allow traffic to the private.googleapis.com addresses.
You are configuring a new HTTP application that will be exposed externally behind both IPv4 and IPv6 virtual IP addresses, using ports 80, 8080, and 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest-possible latency while ensuring high availability and autoscaling, and create native content-based rules using the HTTP hostname and request path. The IP addresses of the clients that connect to the load balancer need to be visible to the backends.
Which configuration should you use?
- A . Use Network Load Balancing
- B . Use TCP Proxy Load Balancing with PROXY protocol enabled
- C . Use External HTTP(S) Load Balancing with URL Maps and custom headers
- D . Use External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header
Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue.
What should you do?
- A . Create custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
- B . Create custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.
- C . Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.
- D . Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
A
Explanation:
Creating custom learned routes at the hub’s Cloud Router is required for advertising VPC spokes’ subnets to the on-premises environment. This centralizes route configuration and ensures that all spoke subnet routes are propagated to the hybrid network.
Reference: Google Cloud – Cloud Router Custom Routes
Your organization wants to set up hybrid connectivity with VLAN attachments that terminate in a single Cloud Router with 99.9% uptime. You need to create a network design for your on-premises router that meets those requirements and has an active/passive configuration that uses only one VLAN attachment at a time.
What should you do?
- A . Create a design that uses a BGP multi-exit discriminator (MED) attribute to influence the egress path from Google Cloud to the on-premises environment.
- B . Create a design that uses the as_path BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
- C . Create a design that uses an equal-cost multipath (ECMP) with flow-based hashing on your on-premises devices.
- D . Create a design that uses the local_pref BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
A
Explanation:
The BGP multi-exit discriminator (MED) attribute is used in BGP configurations to influence the choice of path in an active/passive setup by prioritizing one path over another for egress traffic. This is ideal for a design that uses only one VLAN attachment at a time.
Reference: Google Cloud Interconnect BGP Configuration
Your organization has a Google Cloud Virtual Private Cloud (VPC) with subnets in us-east1, us-west4, and europe-west4 that use the default VPC configuration. Employees in a branch office in Europe need to access the resources in the VPC using HA VPN. You configured the HA VPN associated with the Google Cloud VPC for your organization with a Cloud Router deployed in europe-west4. You need to ensure that the users in the branch office can quickly and easily access all resources in the VPC.
What should you do?
- A . Create custom advertised routes for each subnet.
- B . Configure each subnet’s VPN connections to use Cloud VPN to connect to the branch office.
- C . Configure the VPC dynamic routing mode to Global.
- D . Set the advertised routes to Global for the Cloud Router.
You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on- premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access.
What configuration changes should you make to enable Private Google Access while adhering to your security team’s requirements?
- A . Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google’s restricted API address range.
Create a custom route that points Google’s restricted API address range to the default internet gateway as the next hop. - B . Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google’s restricted API address range.
Change the custom route that points the default route (0/0) to the default internet gateway as the next hop. - C . Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record painting to Google’s private AP address range.
Change the custom route that points the default route (0/0) to the default internet gateway as the next hop. - D . Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google’s private API address range.
Create a custom route that points Google’s private API address range to the default internet gateway as the next hop.
You have configured a service on Google Cloud that connects to an on-premises service via a Dedicated Interconnect. Users are reporting recent connectivity issues. You need to determine whether the traffic is being dropped because of firewall rules or a routing decision.
What should you do?
- A . Use the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.
- B . Use Network Intelligence Center Network Topology to check the traffic flow, and replay the traffic from the time period when the connectivity issue occurred.
- C . Configure VPC Flow Logs. Review the logs by filtering on the source and destination.
- D . Configure a Compute Engine instance on the same VPC as the service running on Google Cloud to run a traceroute targeted at the on-premises service.
In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers in subnet-a. You will also deploy the application servers and web servers in subnet-b. You want to configure firewall rules that only allow database traffic from the application servers to the database servers.
What should you do?
- A . Create network tag app-server and service account [email protected].
Add the tag to the application servers, and associate the service account with the database servers.
Run the following command:
gcloud compute firewall-rules create app-db-firewall-rule –action allow
–direction ingress
–rules top:3306
–source-tags app-server
–target-service-accounts sa-db@my-
project.iam.gserviceaccount.com - B . Create service accounts [email protected] and [email protected]. Associate service account sa-app with the application servers, and associate the
service account sa-db with the database servers. Run the following command:
gcloud compute firewall-rules create app-db-firewall-ru
–allow TCP:3306
–source-service-accounts sa-app@democloud-idp-
demo.iam.gserviceaccount.com
–target-service-accounts sa-db@my-
project.iam.gserviceaccount.com - C . Create service accounts [email protected] and [email protected]. Associate the service account sa-app with the application servers, and associate
the service account sa-db with the database servers. Run the following command:
gcloud compute firewall-rules create app-db-firewall-ru
–allow TCP:3306
–source-ranges 10.128.0.0/20
–source-service-accounts sa-app@my-
project.iam.gserviceaccount.com
–target-service-accounts sa-db@my-
project.iam.gserviceaccount.com - D . Create network tags app-server and db-server. Add the app-server tag to the application servers, and add the db-server tag to the database servers.
Run the following command:
gcloud compute firewall-rules create app-db-firewall-rule –action allow
–direction ingress
–rules tcp:3306
–source-ranges 10.128.0.0/20
–source-tags app-server
–target-tags db-server