Google Professional Cloud Network Engineer Practice Exams
Last updated on Oct 21,2026- Exam Code: Professional Cloud Network Engineer
- Exam Name: Professional Cloud Network Engineer
- Certification Provider: Google
- Latest update: Oct 21,2026
Your company has provisioned 2000 virtual machines (VMs) in the private subnet of your Virtual Private Cloud (VPC) in the us-east1 region. You need to configure each VM to have a minimum of 128 TCP connections to a public repository so that users can download software updates and packages over the internet. You need to implement a Cloud NAT gateway so that the VMs are able to perform outbound NAT to the internet. You must ensure that all VMs can simultaneously connect to the public repository and download software updates and packages.
Which two methods can you use to accomplish this? (Choose two.)
- A . Configure the NAT gateway in manual allocation mode, allocate 2 NAT IP addresses, and update the minimum number of ports per VM to 256.
- B . Create a second Cloud NAT gateway with the default minimum number of ports configured per VM to 64.
- C . Use the default Cloud NAT gateway’s NAT proxy to dynamically scale using a single NAT IP address.
- D . Use the default Cloud NAT gateway to automatically scale to the required number of NAT IP addresses, and update the minimum number of ports per VM to 128.
- E . Configure the NAT gateway in manual allocation mode, allocate 4 NAT IP addresses, and update the minimum number of ports per VM to 128.
You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses.
Which subnet mask should you use for the Pod IP address range?
- A . /21
- B . /22
- C . /23
- D . /25
B
Explanation:
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips#cluster_sizing_secondary_range_pods
Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr https://cloud.google.com/kubernetes-engine/docs/concepts/alias-ips#defaults_limits
You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from.
What should you do?
- A . Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.
- B . Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.
- C . Enable VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.
- D . Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.
You ate planning to use Terraform to deploy the Google Cloud infrastructure for your company.
The design must meet the following requirements
• Each Google Cloud project must represent an Internal project that your team Will work on
• After an Internal project is finished, the infrastructure must be deleted
• Each Internal project must have Its own Google Cloud project owner to manage the Google Cloud resources.
• You have 10―100 projects deployed at a time
While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable With centralized management
What should you do?
- A . Create a Single project and additional VPCs for each internal project
- B . Create a Single Shared VPC and attach each Google Cloud project as a service project
- C . dCreate a Single project and Single VPC for each internal project
- D . Create a Shared VPC and service project for each internal project
D
Explanation:
The correct answer is D because it meets the following requirements:
Each internal project has its own Google Cloud project, which can be easily created and deleted by Terraform using the google_project resource1.
Each internal project has its own Google Cloud project owner, which can be assigned by Terraform using the google_project_iam_member resource1.
The deployment is simple and the code is reusable with centralized management, because the Shared VPC allows you to connect multiple service projects to a single host project that contains the network resources2. This way, you can use Terraform modules to create and manage the network resources in the host project, and then reference them in the service projects3.
Option A is incorrect because it does not create separate Google Cloud projects for each internal project, which makes it harder to delete the infrastructure and assign project owners.
Option B is incorrect because it does not create separate Google Cloud projects for each internal project, and also because it attaches the service projects to a Shared VPC, which is not recommended for short-lived projects2.
Option C is incorrect because it does not use a Shared VPC, which means that each internal project has to create and manage its own network resources, which increases complexity and reduces reusability.
Reference: google_project – Terraform Registry
Managing infrastructure as code with Terraform, Cloud Build, and GitOps | Google Cloud Automating your automation by Creating Google Cloud Projects Automatically
You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner’s project while minimizing the amount of infrastructure required. Your partner’s services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution.
What should you do?
- A . Create one Cloud Router and one HA VPN gateway in each region of your VPC and your partner’s VPC. Connect your VPN gateways to the partner’s gateways. Enable global dynamic routing in each
VPC. - B . Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC. Create one OpenVPN Access Server in each region of your partner’s VPC. Connect your VPN gateway to your partner’s servers.
- C . Create one OpenVPN Access Server in each region of your VPC and your partner’s VPC. Connect your servers to the partner’s servers.
- D . Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner’s VPC. Connect your VPN gateways to the partner’s gateways with a pair of tunnels. Enable global dynamic routing in each VPC.
Your multi-region VPC has had a long-standing HA VPN configured in "region 1" connected to your corporate network. You are planning to add two 10 Gbps Dedicated Interconnect connections and VLAN attachments in "region 2" to connect to the same corporate network. You need to plan for connectivity between your VPC and corporate network to ensure that traffic uses the Dedicated Interconnect connections as the primary path and the HA VPN as the secondary path.
What should you do?
- A . Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.
- B . Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.
- C . Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.
- D . Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.
B
Explanation:
For the Dedicated Interconnect to be the primary connection over the HA VPN, you should:
Enable global dynamic routing mode to allow the VPC to distribute routes dynamically across regions.
Set the BGP priority for the VLAN attachments associated with the Dedicated Interconnect to a lower base priority (e.g., 100) than the HA VPN’s priority (e.g., 20000) to ensure it is preferred.
Setting up global dynamic routing with adjusted BGP priorities on both Interconnect and VPN will allow dynamic routing of traffic based on set preferences and path attributes, such as MED and priority levels. This setup ensures the Dedicated Interconnect, with a lower priority value, becomes the primary path for traffic, while the HA VPN, with a higher priority, serves as a backup.
Reference: Google Cloud – Cloud Interconnect
Reference: Google Cloud – HA VPN Overview
You created a new VPC for your development team. You want to allow access to the resources in this VPC via SSH only.
How should you configure your firewall rules?
- A . Create two firewall rules: one to block all traffic with priority 0, and another to allow port 22 with priority 1000.
- B . Create two firewall rules: one to block all traffic with priority 65536, and another to allow port 3389 with priority 1000.
- C . Create a single firewall rule to allow port 22 with priority 1000.
- D . Create a single firewall rule to allow port 3389 with priority 1000.
C
Explanation:
Reference: https://geekflare.com/gcp-firewall-configuration/
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.
What should you do?
- A . Enable logging on the default Deny Any Firewall Rule.
- B . Enable logging on the VM Instances that receive traffic.
- C . Create a logging sink forwarding all firewall logs with no filters.
- D . Create an explicit Deny Any rule and enable logging on the new rule.
D
Explanation:
https://cloud.google.com/vpc/docs/firewall-rules-logging#egress_deny_example
You can only enable Firewall Rules Logging for rules in a Virtual Private Cloud (VPC) network. Legacy networks are not supported. Firewall Rules Logging only records TCP and UDP connections. Although you can create a firewall rule applicable to other protocols, you cannot log their connections. You cannot enable Firewall Rules Logging for the implied deny ingress and implied allow egress rules. Log entries are written from the perspective of virtual machine (VM) instances. Log entries are only created if a firewall rule has logging enabled and if the rule applies to traffic sent to or from the VM. Entries are created according to the connection logging limits on a best effort basis. The number of connections that can be logged in a given interval is based on the machine type. Changes to firewall rules can be viewed in VPC audit logs. https://cloud.google.com/vpc/docs/firewall-rules-logging#specifications
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A . Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- B . Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
- C . Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- D . Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
C
Explanation:
https://cloud.google.com/vpc/docs/vpc-peering
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.
What should you do?
- A . Configure VPC peering in a full mesh.
- B . Alter the routing table to resolve the asymmetric route.
- C . Create network tags to allow connectivity between all three VPCs.
- D . Delete the legacy network and recreate it to allow transitive peering.
A
Explanation:
https://cloud.google.com/vpc/docs/using-vpc-peering