Updated Google Professional Cloud Network Engineer Exam Dumps

Question No: 1

MultipleChoice

You want to create a service in GCP using IPv6.

What should you do?

Options

ACreate the instance with the designated IPv6 address.

BConfigure a TCP Proxy with the designated IPv6 address.

CConfigure a global load balancer with the designated IPv6 address.

DConfigure an internal load balancer with the designated IPv6 address.

Question No: 2

MultipleChoice

Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.

How should you design the topology?

Options

ACreate a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.

BCreate 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.

CCreate 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.

DCreate a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.

Question No: 3

MultipleChoice

Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.

During troubleshooting you find:

* Each on-premises router is configured with the same ASN.

* Each on-premises router is configured with the same routes and priorities.

* Both on-premises routers are configured with a VPN connected to a single Cloud Router.

* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.

* BGP session is not established between one on-premises router and the Cloud Router.

What is the most likely cause of this problem?

Options

AOne of the VPN sessions is configured incorrectly.

BA firewall is blocking the traffic across the second VPN connection.

CYou do not have a load balancer to load-balance the network traffic.

DBGP sessions are not established between both on-premises routers and the Cloud Router.

Question No: 4

MultipleChoice

Your company's on-premises office is connected to Google Cloud using HA VPN. The security team will soon enable VPC Service Controls. You need to create a plan with minimal configuration adjustments, so clients at the office will still be able to privately call the Google APIs and be protected by VPC Service Controls. What should you do?

Options

ACreate a design with a DNS configuration that resolves the Google APIs to 199.36.153.4/30; advertise 199.36.153.4/30 from Google Cloud to the onpremises routers; add an access level to authorize the on-premises network to access the APIs.

BCreate a design with a DNS configuration that resolves the Google APIs to 199.36.153.8/30; advertise 199.36.153.8/30 from Google Cloud to the onpremises routers.

CCreate a design with a DNS configuration that resolves the Google APIs to 199.36.153.8/30; advertise 199.36.153.8/30 from Google Cloud to the onpremise routers: add an access level to authorize the on-premises network to access the APIs.

DCreate a design with a DNS configuration that resolves the Google APIs to 199.36.153.4/30; advertise 199.36.153.4/30 from Google Cloud to the onpremises routers.

Question No: 5

MultipleChoice

You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.

What should you do?

Options

AConfigure VPC peering in a full mesh.

BAlter the routing table to resolve the asymmetric route.

CCreate network tags to allow connectivity between all three VPCs.

DDelete the legacy network and recreate it to allow transitive peering.

Question No: 6

MultipleChoice

Your company has 10 separate Virtual Private Cloud (VPC) networks, with one VPC per project in a single region in Google Cloud. Your security team requires each VPC network to have private connectivity to the main on-premises location via a Partner Interconnect connection in the same region. To optimize cost and operations, the same connectivity must be shared with all projects. You must ensure that all traffic between different projects, on-premises locations, and the internet can be inspected using the same third-party appliances. What should you do?

Options

AConfigure the third-party appliances with multiple interfaces and specific Partner Interconnect VLAN attachments per project. Create the relevant routes on the third-party appliances and VPC networks.

BConfigure the third-party appliances with multiple interfaces, with each interface connected to a separate VPC network. Create separate VPC networks for on- premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks.

CConsolidate all existing projects' subnetworks into a single VPC. Create separate VPC networks for on-premises and internet connectivity. Configure the third-party appliances with multiple interfaces, with each interface connected to a separate VPC network. Create the relevant routes on the third-party appliances and VPC networks.

DConfigure the third-party appliances with multiple interfaces. Create a hub VPC network for all projects, and create separate VPC networks for on-premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks. Use VPC Network Peering to connect all projects' VPC networks to the hub VPC. Export custom routes from the hub VPC and import on all projects' VPC networks.

Question No: 7

MultipleChoice

You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.

What should you do?

Options

AGrant the compute.instanceAdmin to your user account.

BGrant the iam.serviceAccountUser to your user account.

CGrant the read-only privilege to the service account for the Cloud Storage bucket.

DGrant the cloud-platform privilege to the service account for the Cloud Storage bucket.

Question No: 8

MultipleChoice

Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node Which Pod per node CIDR range should you use?

Options

A/24

B/25

C/26

D/28

Question No: 9

MultipleChoice

Refer to the exhibit.

You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC):

You need to update the firewall rule to add the following rule to the ruleset:

You are using a new user account. You must assign the appropriate identity and Access Management (IAM) user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs. What should you do?

Options

AAssign the compute.securityAdmin and logging.viewer rule to the new user account. Apply the new firewall rule with a priority of 50.

BAssign the compute.securityAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.

CAssign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account. Apply the new firewall rule with a priority of 50.

DAssign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.

Question No: 10

MultipleChoice

You create multiple Compute Engine virtual machine instances to be used at TFTP servers.

Which type of load balancer should you use?

Options

AHTTP(S) load balancer

BSSL proxy load balancer

CTCP proxy load balancer

DNetwork load balancer

Question No: 11

MultipleChoice

Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:

* Your ISP is a Google Partner Interconnect provider.

* Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps.

* A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses.

* Most of the data transfer will be from GCP to the on-premises environment.

* The application can burst up to 1.5 Gbps during peak transfers over the Interconnect.

* Cost and the complexity of the solution should be minimal.

How should you provision the connectivity solution?

Options

AProvision a Partner Interconnect through your ISP.

BProvision a Dedicated Interconnect instead of a VPN.

CCreate multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.

DUse network compression over your VPN to increase the amount of data you can send over your VPN.

Free Google Professional Cloud Network Engineer Exam Dumps September 2026