Google Professional Cloud Network Engineer Practice Exams
Last updated on Oct 21,2026- Exam Code: Professional Cloud Network Engineer
- Exam Name: Professional Cloud Network Engineer
- Certification Provider: Google
- Latest update: Oct 21,2026
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
• Each on-premises router is configured with the same ASN.
• Each on-premises router is configured with the same routes and priorities.
• Both on-premises routers are configured with a VPN connected to a single Cloud Router.
• The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
• BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?
- A . One of the VPN sessions is configured incorrectly.
- B . A firewall is blocking the traffic across the second VPN connection.
- C . You do not have a load balancer to load-balance the network traffic.
- D . BGP sessions are not established between both on-premises routers and the Cloud Router.
A
Explanation:
If the VPN logs show a no-proposal-chosen error, this error indicates that Cloud VPN and your peer VPN gateway were unable to agree on a set of ciphers. For IKEv1, the set of ciphers must match exactly. For IKEv2, there must be at least one common cipher proposed by each gateway. Make sure that you use supported ciphers to configure your peer VPN gateway.
https://cloud.google.com/network-connectivity/docs/vpn/support/troubleshooting#:~:text=If%20the%20VPN%20logs%20show,of%20ciphers%20must%20match%20exactly.&text=Make%20sure%20that%20you%20use,configure%20your%20peer%20VPN%20gateway.
You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible, To ease the transition, you decided to use the same architecture as your on-premises network’ a hub-and-spoke model. Your on-premises architecture consists of over 50 spokes. Each spoke does not have connectivity to the other spokes, and all traffic IS sent through the hub for security reasons. You need to ensure that the Google Cloud architecture matches your on-premises architecture. You want to implement a solution that minimizes management overhead and cost, and uses default networking quotas and limits.
What should you do?
- A . Connect all the spokes to the hub with Cloud VPN.
- B . Connect all the spokes to the hub with VPC Network Peering.
- C . Connect all the spokes to the hub With Cloud VPN. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes
- D . Connect all the spokes to the hub with VPC Network Peering. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.
D
Explanation:
The correct answer is D because it meets the following requirements:
It matches the hub-and-spoke model of the on-premises network, where each spoke is a separate VPC network that is connected to a central hub VPC network.
It minimizes management overhead and cost, because VPC Network Peering is a simple and low-cost way to connect VPC networks without using any external IP addresses or VPN gateways1.
It uses default networking quotas and limits, because VPC Network Peering does not consume any quota or limit for VPN tunnels, external IP addresses, or forwarding rules2.
It prevents connectivity between the spokes, because VPC Network Peering is non-transitive by default, meaning that a spoke can only communicate with the hub, not with other spokes1. To enforce this restriction, a third-party network appliance can be used as a default gateway in each spoke VPC network, which can filter out any traffic destined for other spokes3.
Option A is incorrect because it does not minimize cost, as Cloud VPN charges for egress traffic and requires external IP addresses for the VPN gateways4.
Option B is incorrect because it does not prevent connectivity between the spokes, as VPC Network Peering allows direct communication between peered VPC networks by default1.
Option C is incorrect because it does not minimize cost or use default quotas and limits, for the same reasons as option A.
Reference: VPC Network Peering overview | VPC
Quotas and limits | VPC
Hub-and-spoke network architecture | Cloud Architecture Center
Cloud VPN overview | Google Cloud
In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost.
Which two steps should you take? (Choose two.)
- A . Connect both projects using Cloud VPN.
- B . Connect the VPCs in project code-dev and data-dev using VPC Network Peering.
- C . Enable Shared VPC in one project (e. g., code-dev), and make the second project (e. g., data-dev) a service project.
- D . Enable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances in project data-dev, and vice versa.
- E . Create a route in the code-dev project to the destination prefixes in project data-dev and use nexthop as the default gateway, and vice versa.
You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters, Due to IP address exhaustion of the RFC 1918 address space in your enterprise, you plan to use privately used public IP space for the new dusters. You want to follow Google-recommended practices.
What should you do after designing your IP scheme?
- A . Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters. Re-use the secondary address range for the pods across multiple private GKE clusters.
- B . Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters Re-use the secondary address range for the services across multiple private GKE clusters.
- C . Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster With the following options selected: –enab1e-ip-a1ias and –enable-private-nodes.
- D . Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected and C siable-default-snat, –enable-ip-alias, and Cenable-private-nodes
D
Explanation:
The correct answer is D. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: –disable-default-snat, –enable-ip-alias, and –enable-private-nodes.
This answer is based on the following facts:
Privately used public IP (PUPI) addresses are any public IP addresses not owned by Google that a customer can use privately on Google Cloud1. You can use PUPI addresses for GKE pods and services in private clusters to mitigate address exhaustion.
A private GKE cluster is a cluster that has no public IP addresses on the nodes2. You can use private clusters to isolate your workloads from the public internet and enhance security.
The –disable-default-snat option disables source network address translation (SNAT) for the cluster3. This option allows you to use PUPI addresses without conflicting with other public IP addresses on the internet.
The –enable-ip-alias option enables alias IP ranges for the cluster4. This option allows you to use separate subnet ranges for nodes, pods, and services, and to specify the size of those ranges.
The –enable-private-nodes option enables private nodes for the cluster5. This option ensures that the nodes have no public IP addresses and can only communicate with other Google Cloud resources in the same VPC network or peered networks.
The other options are not correct because:
Option A is not suitable. Creating RFC 1918 primary and secondary subnet IP ranges for the clusters does not solve the problem of address exhaustion. Re-using the secondary address range for pods across multiple private GKE clusters can cause IP conflicts and routing issues.
Option B is also not suitable. Creating RFC 1918 primary and secondary subnet IP ranges for the clusters does not solve the problem of address exhaustion. Re-using the secondary address range for services across multiple private GKE clusters can cause IP conflicts and routing issues.
Option C is not feasible. Creating privately used public IP primary and secondary subnet ranges for the clusters is a valid step, but creating a private GKE cluster with only –enable-ip-alias and –enable-private-nodes options is not enough. You also need to disable default SNAT to avoid IP conflicts with other public IP addresses on the internet.
You have configured a Compute Engine virtual machine instance as a NAT gateway.
You execute the following command:
gcloud compute routes create no-ip-internet-route
–network custom-network1
–destination-range 0.0.0.0/0
–next-hop instance nat-gateway
–next-hop instance-zone us-central1-a
–tags no-ip –priority 800
You want existing instances to use the new NAT gateway.
Which command should you execute?
- A . sudo sysctl -w net.ipv4.ip_forward=1
- B . gcloud compute instances add-tags [existing-instance] –tags no-ip
- C . gcloud builds submit –config=cloudbuild.waml –substitutions=TAG_NAME=no-ip
- D . gcloud compute instances create example-instance –network custom-network1 –subnet subnet-us-central
–no-address
–zone us-central1-a
–image-family debian-9
–image-project debian-cloud –tags no-ip
B
Explanation:
https://cloud.google.com/sdk/gcloud/reference/compute/routes/create
In order to apply a route to an existing instance we should use a tag to bind the route to it.
Reference: https://cloud.google.com/vpc/docs/special-configurations
Recently, your networking team enabled Cloud CDN for one of the external-facing services that is exposed through an external Application Load Balancer. The application team has already defined which content should be cached within the responses. Upon testing the load balancer, you did not observe any change in performance after the Cloud CDN enablement. You need to resolve the issue.
What should you do?
- A . Configure the CACHE_MAX_STATIC caching mode on Cloud CDN to ensure Cloud CDN caches content depending on responses from the backends.
- B . Configure the USE_ORIGIN_HEADERS caching mode on Cloud CDN to ensure Cloud CDN caches content based on response headers from the backends.
- C . Configure the CACHE_ALL_STATIC caching mode on Cloud CDN to ensure Cloud CDN caches all static content as well as content defined by the backends.
- D . Configure the FORCE_CACHE_ALL caching mode on Cloud CDN to ensure all appropriate content is cached.
B
Explanation:
When enabling Cloud CDN, for caching behavior to follow the application-defined caching headers, you need to configure the USE_ORIGIN_HEADERS caching mode. This setting ensures that the Cloud CDN respects the cache control headers specified by the backend, allowing the application-defined caching rules to dictate what content gets cached. This is often required when specific caching directives are already set by the application.
Reference: Google Cloud – Cloud CDN Caching Modes
Your organization recently exposed a set of services through a global external Application Load Balancer. After conducting some testing, you observed that responses would intermittently yield a non-HTTP 200 response. You need to identify the error.
What should you do? (Choose 2 answers)
- A . Delete the load balancer and backend services. Create a new passthrough Network Load Balancer.
Configure a failover group of VMs for the backend. - B . Access a VM in the VPC through SSH and try to access a backend VM directly. If the request is successful from the VM, increase the quantity of backends.
- C . Enable and review the health check logs. Review the error responses in Cloud Logging.
- D . Validate the health of the backend service. Enable logging for the backend service and identify the error response in Cloud Logging. Determine the cause of the error by reviewing the statusDetails log field.
- E . Validate the health of the backend service. Enable logging on the load balancer and identify the error response in Cloud Logging. Determine the cause of the error by reviewing the statusDetails log field.
C, E
Explanation:
To troubleshoot the intermittent non-HTTP 200 responses, you should enable and review health check logs and log the backend service’s responses in Cloud Logging. Reviewing the statusDetails field helps identify the cause of the error. Enabling logging on the load balancer and backend service provides visibility into the issue.
Reference: Google Cloud Load Balancer Logging
Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments.
What should you do?
- A . Create a VPC firewall rule in each VPC to block traffic from any source, with priority 0.
- B . Create a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.
- C . Create two hierarchical firewall policies per department’s folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.
- D . Create two hierarchical firewall policies per department’s folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service.
What should you do?
- A . Create a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing
service. - B . Create a VPC Firewall rule that blocks all traffic except for the traffic-scrubbing service.
- C . Create a VPC Service Control Perimeter that blocks all traffic except for the traffic-scrubbing
service. - D . Create IPTables firewall rules that block all traffic except for the traffic-scrubbing service.
A
Explanation:
Global load balancer will proxy the connection . thus no trace of session origin IP. you should use
Cloud Armor to geofence your service.
https://cloud.google.com/load-balancing/docs/https
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?
- A . Assign members of the networking team the compute.networkUser role.
- B . Assign members of the networking team the compute.networkAdmin role.
- C . Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
- D . Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.