Free Google Professional Cloud Network Engineer practice questions

10 free Google Professional Cloud Network Engineer practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 316 questions. Work through them, then open each answer to check your reasoning.

Get all 316 questions (US$39) · Download these 10 as a PDF

Question 1

You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.

What should you do?

  1. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
  2. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
  3. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
  4. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
Show answer and explanation

Correct answer: C. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.

firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges. Firewall rules with target tags are the standard GCP mechanism for restricting traffic to backend instances. You create a firewall rule targeting instances tagged 'application' and specify source IP ranges including both allowed client IPs and Google health check IP ranges (required for the load balancer to function). Options A and B involve VPC Service Controls, which are designed for API-level access control rather than network-level IP restrictions. Option D uses labels instead of tags; while labels exist, firewall rules use tags for target specification.

Why the other options are wrong

  • A. VPC Service Controls manages API access, not network-layer IP filtering for load- balanced applications.
  • B. VPC Service Controls restricts API access, not ingress traffic to load balancers based on source IP.
  • D. Firewall rules use tags, not labels, for target specification on instances.

Question 2

Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.

How should you design this topology?

  1. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
  2. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
  3. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
  4. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
Show answer and explanation

Correct answer: D. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.

workloads in these subnets and have them communicate using private RFC1918 IP addresses. Creating a single VPC with regional subnets in us-east1 and europe-west1 allows workloads to communicate directly using private RFC1918 IP addresses. This approach minimizes cost by avoiding external IP address charges and VPN overhead, and improves efficiency through Google's internal backbone. Option A and B unnecessarily create multiple VPCs or use external IPs, increasing complexity and cost. Option C uses a global load balancer, which is for load balancing, not for establishing inter-regional connectivity.

Why the other options are wrong

  • A. Multiple VPCs with VPN adds unnecessary complexity and cost when a single VPC can serve both regions.
  • B. Using external IP addresses exposes instances to the internet and incurs higher costs compared to private communication.
  • C. Global load balancers distribute traffic; they do not establish general-purpose connectivity between regions.

Question 3

Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.

How should you design the topology?

  1. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
  2. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
  3. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
  4. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
Show answer and explanation

Correct answer: C. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.

establish connectivity between the two appropriate VPCs. Separate VPC networks are the boundary for network administration in Google Cloud, so three VPCs give each department its own administrative domain. VPC Network Peering then connects only the two departments that need to communicate, while the third VPC stays isolated because peering is not transitive. Peering is fully managed with no tunnels, gateways, or routers to operate, so it is the lowest-overhead way to meet the requirement.

Why the other options are wrong

  • A. Shared VPC centralizes network administration in a single host project network, which is the opposite of creating separate administrative domains per department.
  • B. Cloud VPN would connect the two departments but adds tunnels, gateways, bandwidth limits, and cost that peering avoids.
  • D. Firewall rules and network tags inside one VPC only filter traffic, they do not create separate network administrative domains.

Question 4

You are migrating to Cloud DNS and want to import your BIND zone file.

Which command should you use?

  1. gcloud dns record-sets import ZONE_FILE –zone MANAGED_ZONE
  2. gcloud dns record-sets import ZONE_FILE –replace-origin-ns –zone MANAGED_ZONE
  3. gcloud dns record-sets import ZONE_FILE –zone-file-format –zone MANAGED_ZONE
  4. gcloud dns record-sets import ZONE_FILE –delete-all-existing –zone MANAGED ZONE
Show answer and explanation

Correct answer: C. gcloud dns record-sets import ZONE_FILE –zone-file-format –zone MANAGED_ZONE

format –zone MANAGED_ZONE gcloud dns record-sets import expects a YAML record-set file by default, so importing a BIND zone file requires the –zone-file-format flag to tell gcloud how to parse the input. The command is gcloud dns record-sets import ZONE_FILE –zone-file-format –zone MANAGED_ZONE. Other flags exist for this command, but none of them change the parser to BIND format.

Why the other options are wrong

  • A. Without –zone-file-format the file is parsed as a YAML record-set file, so a BIND zone file import fails.
  • B. –replace-origin-ns is a real flag that substitutes the NS records at the origin, but it does not tell gcloud to read BIND zone file syntax.
  • D. –delete-all-existing is a real flag that removes existing records first, but it does not enable BIND parsing, and the zone argument here is malformed.

Question 5

You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.

How should you configure the Distribution VPC?

  1. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
  2. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
  3. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
  4. Rename the default VPC as "Distribution" and peer it via network peering.
Show answer and explanation

Correct answer: B. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.

CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering. Auto mode VPC networks create one subnet per region from the 10.128.0.0/9 block, so the Retail network already occupies ranges inside 10.128.0.0/9. Peered networks cannot have overlapping subnet IP ranges, so the Distribution network must be custom mode using addresses outside that block, such as 10.0.0.0/9. Creating custom subnets from 10.0.0.0/9 and then peering the two networks works without conflict.

Why the other options are wrong

  • A. A second auto mode network would also draw subnets from 10.128.0.0/9 and overlap with Retail, so peering would be rejected.
  • C. 10.128.0.0/9 is exactly the block auto mode uses for Retail's subnets, so these ranges would overlap.
  • D. The default network is itself an auto mode network in the same 10.128.0.0/9 space, and renaming a VPC network is not supported.

Question 6

You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall.

You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.

Which two actions should you take? (Choose two.)

  1. Turn on Private Google Access at the subnet level.
  2. Turn on Private Google Access at the VPC level.
  3. Turn on Private Services Access at the VPC level.
  4. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
  5. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.
Show answer and explanation

Correct answer: A, D

A. Turn on Private Google Access at the subnet level. D. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway. Private Google Access must be enabled at the subnet level (option A) to allow instances without public IPs to access Google APIs through private IP addresses. Additionally, custom static routes (option D) must be created to direct traffic to Google API IP ranges via the default internet gateway rather than through the firewall. This ensures BigQuery and Pub/Sub API traffic bypasses the third-party firewall. Option B is incorrect because Private Google Access is a subnet-level feature, not VPC-level. Option C refers to Private Services Access, which is for VPC peering with Google services, not API access. Option E would route to internal IPs, which are not the correct destination.

Why the other options are wrong

  • B. Private Google Access is configured at the subnet level, not the VPC level.
  • C. Private Services Access is for establishing VPC peering with Google-managed services, not for API access.
  • E. Google APIs are accessed via external IP addresses, not internal IP addresses; routing to internal IPs would fail.

Question 7

All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys.

None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.

What should you do?

  1. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
  2. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
  3. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
  4. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
Show answer and explanation

Correct answer: A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.

gcloud compute ssh. With enable-oslogin set to FALSE, gcloud compute ssh falls back to metadata-based keys: it generates a key pair for you and, because project-wide keys are blocked, publishes the public key in the instance's own metadata. Cloud Shell already has authenticated gcloud credentials and the required Compute permissions, so a single gcloud compute ssh command connects successfully. Firewall rules already permit SSH from any source, so nothing else needs to change.

Why the other options are wrong

  • B. Switching instances to OS Login is an unnecessary configuration change, and a third-party client still needs a key or certificate provisioned first.
  • C. You add the public key, not the private key, to instance metadata, and doing it by hand is extra work when gcloud does it automatically.
  • D. Project-level keys are ignored because the instances block project-wide SSH keys, so the login would still fail.

Question 8

You work for a university that is migrating to GCP.

These are the cloud requirements:

"¢ On-premises connectivity with 10 Gbps "¢ Lowest latency access to the cloud "¢ Centralized Networking Administration Team New departments are asking for on- premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.

What should you do?

  1. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
  2. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
  3. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
  4. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
Show answer and explanation

Correct answer: A. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.

and Interconnect in the host project. Shared VPC with Interconnect and VLAN attachments deployed in the host project provides centralized networking administration while serving all departments. This is the most cost-efficient approach because it uses a single physical Interconnect connection shared across the entire organization, reducing redundant infrastructure costs. The host project manages connectivity, and service projects can attach to it as needed. Options B, C, and D either require multiple Interconnects per department or lack centralized administration, increasing costs and complexity.

Why the other options are wrong

  • B. VLAN attachments belong in the host project, not service projects, for centralized control of the Interconnect.
  • C. Deploying multiple Interconnects in standalone projects creates redundant 10 Gbps connections, multiplying costs unnecessarily.
  • D. Deploying separate Interconnects in each project is the most expensive option and defeats centralized administration requirements.

Question 9

You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.

Which session affinity should you choose?

  1. None
  2. Client IP
  3. Client IP and protocol
  4. Client IP, port and protocol
Show answer and explanation

Correct answer: B. Client IP

Session affinity by Client IP ensures that all traffic from a single client IP address is routed to the same backend instance. This works across multiple protocols (HTTP and TFTP) because the affinity is based on the source IP alone, not on protocol-specific information. This is the simplest and most appropriate choice for ensuring stickiness across both services without unnecessary granularity.

Why the other options are wrong

  • A. None would distribute traffic without any affinity, breaking the requirement for clients to stick to a particular instance.
  • C. Client IP and protocol would be overly specific and could cause issues since TFTP and HTTP are different protocols; a client using both would not maintain proper affinity.
  • D. Client IP, port and protocol adds unnecessary complexity and would fragment traffic from the same client across instances if different ports are used.

Question 10

You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging.

When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.

What should you do?

  1. Check the VPC flow logs for the instance.
  2. Try connecting to the instance via SSH, and check the logs.
  3. Create a new firewall rule to allow traffic from port 22, and enable logs.
  4. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.
Show answer and explanation

Correct answer: D. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.

all traffic, and enable logs. Firewall Rules Logging records only traffic that matches a rule you created with logging enabled, and the implied deny ingress rule cannot have logging turned on. Adding an explicit low-priority deny-all rule, for example priority 65500, with logging enabled makes the dropped RDP packets match a logged rule so the denials appear in Cloud Logging. The rule sits below the existing HTTP allow rule, so permitted traffic is unaffected.

Why the other options are wrong

  • A. VPC Flow Logs sample allowed flows between VMs and do not record packets dropped by firewall rules, so they will not show the blocked RDP attempts.
  • B. SSH on port 22 is not allowed either, so that attempt fails the same way and still produces no log entries.
  • C. Allowing port 22 only opens another protocol and does nothing to log the denied RDP traffic.

That was 10 of 316.

The full Google Professional Cloud Network Engineer pack has all 316 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack