Google Cloud Professional Cloud Network Engineer - Full Practice Exam 1

1. A company connects several cloud and on-premises sites and needs a managed hub-and-spoke connectivity orchestration model for supported resources. Which approach best fits?
2. A company needs Interconnect connectivity but cannot establish a direct physical connection at a Google-supported colocation facility. Which approach best fits?
3. A company plans hybrid connectivity to several sites whose address ranges are known. It wants to avoid translation and ambiguous routing. Which approach best fits?
4. A company requires dedicated high-bandwidth connectivity from its data center to Google Cloud and can meet the colocation and physical connection requirements. Which approach best fits?
5. A company uses HA VPN for hybrid connectivity and requires resilience to a supported single-path failure with working dynamic route exchange. Which two activities are essential? Select 2 answers.
6. A company wants to publish only one managed backend privately to consumers without establishing full VPC connectivity. Which approach best fits?
7. A connection is allowed by a stateful VPC firewall rule. The team asks whether a separate reverse rule is normally required only for its response packets. Which approach best fits?
8. A custom VPC route should send a supported destination prefix to a specified next hop. DNS resolution is already correct. Which approach best fits?
9. A design assumes traffic can pass from VPC A through peered VPC B to another VPC C without additional transit design. Which approach best fits?
10. A design must distinguish control of packet reachability from control of access to supported managed-service data APIs. Which approach best fits?
11. A firewall rule should identify target VMs through their workload service account rather than a broad subnet range. Which approach best fits?
12. A hybrid application resolves a name to the wrong endpoint despite a working network route. Which approach best fits?
13. A large organization needs predictable subnet addresses and wants to avoid automatically created subnets in every region. Which approach best fits?
14. A load balancer marks all backends unhealthy after a firewall-policy change, although the application listens on the correct health-check port. Which approach best fits?
15. A managed service needs a private allocation in the consumer's network through a producer peering-based integration. Which approach best fits?
16. A multi-project network needs separation of network administration from application deployment without copying network configurations into each project. Which approach best fits?
17. A network change must be audited to identify who changed a route and when. Which approach best fits?
18. A network design needs to reduce lateral movement between application tiers while allowing only documented service paths. Which approach best fits?
19. A network is expected to support hundreds of future clusters. Initial allocation should preserve room for predictable growth. Which approach best fits?
20. A network must span multiple Google Cloud regions with separate regional subnets while retaining one logical VPC network. Which approach best fits?
21. A network packet is routed correctly but blocked by an ingress policy on the receiving VM. The intended source and destination are approved. Which approach best fits?
22. A networking team needs a private DNS zone usable by workloads in an authorized VPC without exposing its records publicly. Which approach best fits?
23. A new network path fails only for large packets; smaller requests succeed. The application and authentication are healthy. Which approach best fits?
24. A private service design must prevent clients from bypassing an approved proxy and reaching the backend directly. Which approach best fits?
25. A private VM needs outbound internet access for updates while remaining without an external IP address. Unsolicited inbound internet access is unnecessary. Which approach best fits?
26. A private VM needs supported Google API access without an external IP, using the documented Google API VIP path rather than a customer-owned endpoint. Which approach best fits?
27. A private workload should access selected Google APIs but not gain broad internet egress through a NAT gateway. Which approach best fits?
28. A proposed hybrid design uses overlapping address ranges across multiple acquired businesses. Renumbering and supported translation options must be evaluated before deployment. Which approach best fits?
29. A proposed Interconnect design uses one physical link and one attachment, while the application requires resilience to a single connection failure. Which approach best fits?
30. A public site serves cacheable static assets worldwide and wants to reduce repeated origin requests and user download latency. Which approach best fits?
31. A public web application needs HTTP host- and path-based routing across backends. The load balancer must understand application-layer request attributes. Which approach best fits?
32. A regional subnet's primary IPv4 range is almost exhausted. More addresses are needed and the larger contiguous range is available without conflicts. Which approach best fits?
33. A remote site's private prefixes are advertised, but only some application regions see them because the VPC uses regional dynamic routing. Which approach best fits?
34. A security engineer needs evidence of which firewall rule denied a connection. Which approach best fits?
35. A security team needs to control allowed network flows between workload tiers using sources, targets, protocols, and ports. Which approach best fits?
36. A service must accept arbitrary unsolicited inbound internet connections. An engineer proposes using Public Cloud NAT as the inbound gateway. Which approach best fits?
37. A stateless web tier on Compute Engine must add or remove VMs automatically as CPU demand changes, using a consistent instance configuration. Which approach best fits?
38. A supported internet-facing HTTP application needs application-edge filtering and protected backend access so clients cannot bypass the edge policy. Which two controls should the team combine? Select 2 answers.
39. A TCP application needs a proxy load balancer that terminates client connections and opens separate backend connections; preserving client source IP as the backend packet source is not required. Which approach best fits?
40. A team added a more-specific destination route but traffic still fails. The selected path is visible in diagnostics, and the destination denies the connection. Which approach best fits?
41. A team needs to inspect sampled source, destination, byte, and connection metadata for supported VPC traffic over time. Which approach best fits?
42. A VPC peering connection is established, but a required custom route is not exchanged. The design supports exchange of that route type. Which approach best fits?
43. A VPN architecture must survive the failure of one gateway interface while meeting the documented HA topology requirements. Which approach best fits?
44. Administrators need identity-aware access to an internal web application without exposing unrestricted public access to its backend. Which approach best fits?
45. An application needs to balance TCP traffic while preserving the original client source IP at the backend, without HTTP routing features. Which approach best fits?
46. An engineer wants a configuration-based assessment of whether a specified source-to-destination path should be reachable. Which approach best fits?
47. An HTTP service should distribute requests only to private regional backends and be reachable through an internal application endpoint. Which approach best fits?
48. An internet-facing web application needs HTTP-layer protection against common injection attacks and abusive request patterns at its supported load balancer. Which approach best fits?
49. An on-premises system must call Google APIs through an endpoint using the organization's own RFC 1918 address. Hybrid routing is already available. Which approach best fits?
50. An operator needs alerts when a VPN's availability or traffic metrics deviate from expected behavior. Which approach best fits?
51. An organization requires IPsec encryption for traffic carried over its eligible Interconnect connectivity. Which approach best fits?
52. Application teams operate in different projects but the networking team must centrally own their common VPC configuration. Which approach best fits?
53. On-premises clients must resolve names hosted in a private Cloud DNS zone. Hybrid IP connectivity already works. Which approach best fits?
54. One VPN tunnel is up, but a remote subnet is unreachable and absent from learned routes. IPsec parameters are valid. Which approach best fits?
55. Private VMs using Public Cloud NAT intermittently fail new outbound connections during high concurrency. Logs indicate port allocation exhaustion. Which approach best fits?
56. Security requires visibility into mirrored packet content for an investigation, rather than only aggregated flow metadata. Which approach best fits?
57. Sensitive managed-service data should be protected against access paths outside an approved perimeter, in addition to valid IAM permissions. Which approach best fits?
58. Traffic stops after a BGP peer withdraws a required prefix. The team needs the immediate routing cause before changing firewall rules. Which approach best fits?
59. Two independent companies need access to one published service through consumer-owned internal IPs, without exposing their entire VPC networks to each other. Which approach best fits?
60. Two VPC networks with non-overlapping address ranges need direct private connectivity. No transitive routing through either VPC is required. Which approach best fits?

Comments — 0