Free PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Test Questions and Answers (2026)

Last Update Check

View Mode
Q: 1
(You need to migrate multiple PostgreSQL databases from your on-premises data center to Google Cloud. You want to significantly improve the performance of your databases while minimizing changes to your data schema and application code. You expect to exceed 150 TB of data per geographical region. You want to follow Google-recommended practices and minimize your operational costs. What should you do?)
Options
27 comments in the community discussion
2
I don’t think it’s Spanner. B isn’t right since Spanner isn’t fully compatible with PostgreSQL, so you’d have to do a ton of schema and code changes. A (AlloyDB) lets you keep your Postgres stuff and adds better performance, which is what the question wants. That fits Google’s migration best practices. Anyone disagree?
1
AlloyDB is made for this since it's fully PostgreSQL-compatible and gives a big performance boost without much migration hassle. D would be faster, but you'd have to redo your data model, so that's not minimal changes. I'm pretty sure A is right here.
Q: 2
Your company’s Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure: /fr/video /en/video /es/video /../video /fr/audio /en/audio /es/audio /../audio Which solution should you recommend?
Options
27 comments in the community discussion
6
A . Official GCP docs and practice exams focus on path rules using wildcards, but not regex, so you'd need to adjust the structure. Worth reviewing the official guide for these URL map constraints.
3
A. since GCP path rules only allow wildcards like /video/*, so directory structure needs tweaking.
Q: 3
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN. What should you do?
Options
27 comments in the community discussion
1
Its C for scaling bandwidth. You need a new on-prem gateway with a different public IP so Cloud VPN can actually use both tunnels in parallel. Pretty sure that’s what the docs recommend, though correct me if I missed a nuance.
1
B or C? I'm thinking B lets you open another tunnel on the same gateway, which should help with more traffic since both are active. It's a common mistake to think two tunnels can't split load with the same public IP. Not 100% sure though, maybe I'm missing something about on-prem limits.
Q: 4
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection. Which two actions can accomplish this? (Choose two.)
Options
35 comments in the community discussion
1
D/E. Official practice tests and Google docs both confirm those for Dedicated Interconnect, not B or C like Partner Interconnect.
1
Hard to say, B and C. Had something like this in a mock exam, and those options matched how we got the LOA-CFA details.
Q: 5
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby. Which BGP attribute should you use on your on-premises router?
Options
33 comments in the community discussion
2
Option D. saw a super similar question on a practice test, it was MED there too.
1
C vs D for me. Leaning C since Local Preference picks which path Routers use, right? MED feels more for other scenarios.
Q: 6
You have configured Cloud CDN using HTTP(S) load balancing as the origin for cacheable content. Compression is configured on the web servers, but responses served by Cloud CDN are not compressed. What is the most likely cause of the problem?
Options
25 comments in the community discussion
5
Option D. but if the question had said the CDN stripped Via headers or servers ignored them, that'd change things.
4
D. The trap here is A, but Cloud CDN doesn't handle compression by itself so it's a web server config issue.
Q: 7
You are migrating to Cloud DNS and want to import your BIND zone file. Which command should you use?
Options
31 comments in the community discussion
5
C . The key is you need -zone-file-format when importing a BIND zone file, nothing in the question says to replace NS records or wipe out anything first. Only extra flags if the scenario calls for them. Someone shout if I'm missing a detail here.
5
C . The -zone-file-format flag is what Cloud DNS expects for BIND imports, saw that in the official doc and labs. If you’re reviewing, stick to the official gcloud guide and maybe run a quick hands-on practice.
Q: 8
You work for a university that is migrating to GCP. These are the cloud requirements: • On-premises connectivity with 10 Gbps • Lowest latency access to the cloud • Centralized Networking Administration Team New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud. What should you do?
Options
33 comments in the community discussion
2
Why not B if each department wants their own VLAN attachments? Wouldn’t that cover flexibility even with a Shared VPC host project?
1
A imo. Shared VPC in the host project lines up with centralized control and cuts down on extra interconnect costs since all departments use the same infrastructure. Pretty sure that’s what Google recommends for this setup, but let me know if you see it differently.
Q: 9
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs. Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)
Options
30 comments in the community discussion
2
A/C, saw a similar question on a practice test. B can’t span orgs, and D isn’t really for this scenario.
1
Why not B? Shared VPC can’t go across organizations, right?
Q: 10
Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that the caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it as a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost. Which two steps should you take? (Choose two.)
Options
28 comments in the community discussion
1
I don’t think E helps much, B and A make more sense. B increases your backend to handle the burst, A uses Cloud Armor to block malicious IPs and reduce load. Pretty sure that’s the fastest combo to restore access, though A might not catch everything in a big DDOS. Feel free to disagree if you see it differently.
1
Classic Google exam trick here, always go with the quick scaling (B) and logs (E) when it screams "urgent restore" on a DDoS. Option B and E.
Q: 11
You are maintaining a Shared VPC in a host project. Several departments within your company have infrastructure in different service projects attached to the Shared VPC and use Identity and Access Management (IAM) permissions to manage the cloud resources in those projects. VPC Network Peering is also set up between the Shared VPC and a common services VPC that is not in a service project. Several users are experiencing failed connectivity between certain instances in different Shared VPC service projects and between certain instances and the internet. You need to validate the network configuration to identify whether a misconfiguration is the root cause of the problem. What should you do?
Options
10 comments in the community discussion
1
Not D here-enabling Flow Logs is good for traffic analysis, but C directly checks network paths for misconfigurations in real-time. Connectivity Tests flag routing/firewall issues fast. Think C is the move, unless I'm missing something subtle.
1
Its D (saw similar question on a practice set).
Q: 12
You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider. Which connection type should you choose?
Options
8 comments in the community discussion
1
Its A
1
B or maybe A? But leaning B because Direct Peering is the only one that skips the third-party provider and gives you straight access to Google over public IPs. Carrier Peering looks similar but actually still uses a carrier. Correct me if I missed something.
Q: 13
You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
Options
8 comments in the community discussion
6
Option D is the way to go. Had something like this in a mock and Google recommends using DNS Server Policies for hybrid environments, not just private zones or forwarding. The 35.199.192.0/19 range is used by Cloud DNS forwarding proxies, so the firewall rule has to allow that, not just your instance subnet. Pretty
5
D imo. A is tempting but misses the point about DNS server policies, which is the Google-recommended way for hybrid setups like this. Option D also uses the right source IP range for DNS traffic. Open to pushback.
Q: 14
You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on-premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
Options
13 comments in the community discussion
3
A . Only A keeps the VPN architecture simple by using central DNS forwarding and peering zones, no extra tunnels in the spokes. Having direct VPNs from each spoke like in C or D isn't needed unless you want more resiliency, which the scenario doesn't mention. Anyone disagree?
1
Its A
Q: 15
You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT. What is the most likely cause of this problem?
Options
5 comments in the community discussion
6
B . If you assign an external IP to the instance, it won't use Cloud NAT for egress.
1
Had something like this in a mock. B is correct since if the VM has its own external IP, it bypasses Cloud NAT and sends outbound traffic directly.
Q: 16
Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances. Which two products should you incorporate into the solution? (Choose two.)
Options
9 comments in the community discussion
1
Option A and B work together for this. VPC flow logs cover general network traffic, and firewall logs show what gets blocked or allowed at the GCP firewall. Pretty sure that's what's needed, but open to other takes.
I don’t think it’s C. AB make more sense since we’re talking about network traffic, not just API actions or admin events. Pretty sure E is a common trap here because system logs won’t show all network flow. Disagree?
Q: 17
Your organization has an on-premises data center. You need to provide connectivity from the on- premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?
Options
10 comments in the community discussion
1
D not B, since Partner Interconnect gives you private connectivity at 1 Gbps, while Dedicated Interconnect is really for 10 Gbps and up. Pretty sure HA VPN (A) is a common trap here because it goes over the internet.
D tbh, Partner Interconnect hits the 1 Gbps requirement and stays off the public internet. Dedicated Interconnect is overkill for this bandwidth, and HA VPN still goes over the internet. Let me know if you see it differently.
Q: 18
You are in the process of deploying an internal HTTP(S) load balancer for your web server virtual machine (VM) Instances What two prerequisite tasks must be completed before creating the load balancer? Choose 2 answers
Options
5 comments in the community discussion
2
Probably A and E, but if "prerequisite" means you need these done before anything else, does that flip things?
If region choice and subnet mask are needed before the LB process, I think A and E.
Q: 19
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from on-premises locations using Cloud Interconnect connections. Your company must be able to send traffic to Cloud Storage only through the Interconnect links while accessing other Google APIs and services over the public internet. What should you do?
Options
10 comments in the community discussion
5
Option B, Saw similar questions in practice tests, official docs mention Private Service Connect is the way for isolating specific Google service traffic like Cloud Storage through Interconnect.
Maybe D. Private Google Access with private.googleapis.com for Cloud Storage seems like it would fit the requirement, since it routes that traffic internally over Interconnect. The only catch is that restricted.googleapis.com usually covers all APIs, but the question feels close to D's logic. Could be missing a detail-
Q: 20
In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost. Which two steps should you take? (Choose two.)
Options
7 comments in the community discussion
1
Its C and E, since shared VPC helps centralize control and custom routes handle cross-project traffic.
B/D makes sense since VPC peering (B) lets both projects manage their own VPCs without extra cost, and D covers the firewall rules needed so the VMs can actually talk. I think that's pretty much GCP best practice here, unless I'm missing something.
Question 1 of 20

Premium Access Includes

  • ✓Quiz Simulator
  • ✓Exam Mode
  • ✓Progress Tracking
  • ✓Question Saving
  • ✓Flash Cards
  • ✓Drag & Drops
  • ✓3 Months Access
  • ✓PDF Downloads
Get Premium Access

← Back to all Google exams & practice tests

Scroll to Top