Free PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Test Questions and Answers (2026)

Get PROFESSIONAL-CLOUD-NETWORK-ENGINEER Exam Questions

Free preview: 20 questions.

PROFESSIONAL-CLOUD-NETWORK-ENGINEER.pdf

Q: 1

(You need to migrate multiple PostgreSQL databases from your on-premises data center to Google Cloud. You want to significantly improve the performance of your databases while minimizing changes to your data schema and application code. You expect to exceed 150 TB of data per geographical region. You want to follow Google-recommended practices and minimize your operational costs. What should you do?)

Options

Discussion

CarefulAnalyst5283 Jul 22, 2026 12:18 pm

I don’t think it’s Spanner. B isn’t right since Spanner isn’t fully compatible with PostgreSQL, so you’d have to do a ton of schema and code changes. A (AlloyDB) lets you keep your Postgres stuff and adds better performance, which is what the question wants. That fits Google’s migration best practices. Anyone disagree?

Sofia O. Jul 14, 2026 6:18 pm

AlloyDB is made for this since it's fully PostgreSQL-compatible and gives a big performance boost without much migration hassle. D would be faster, but you'd have to redo your data model, so that's not minimal changes. I'm pretty sure A is right here.

Reese F. Jul 22, 2026 6:59 am

Seen similar practice questions and the official Google guide, both recommend AlloyDB for PostgreSQL migrations with minimal app changes. A

Cameron G. Jul 10, 2026 5:35 pm

D , since Bigtable is built to handle massive datasets and scales really well performance-wise. You'd probably get the boost needed at that size. I think schema changes might be unavoidable, but maybe not as big a deal in this scenario? Disagree if you interpret "minimize changes" as almost none.

Grace I. Jul 10, 2026 9:30 am

D imo, because Bigtable can handle massive data and excels in performance at scale. But I'm reading "minimize changes" as only some schema tweaks might be ok, not a full overhaul. Maybe I'm stretching the requirement though-disagree?

Skyler P. Jul 17, 2026 5:59 am

A is wrong, AlloyDB (A). Official docs and practice exams always mention AlloyDB for PostgreSQL migrations with minimal changes.

Ravi H. Jul 26, 2026 7:56 am

Its D, seen similar in exam reports.

Aisha H. Jul 13, 2026 2:56 pm

AlloyDB makes the most sense, so A. It’s PostgreSQL compatible, so you hardly need schema or code changes, plus you get better performance and can handle big data sets. Pretty much what Google recommends for this case. Disagree?

Luna Z. Jul 15, 2026 8:25 pm

Nope, it's not D. Bigtable would force a full rework of schema and queries since it's NoSQL, so that's a trap. A fits best since AlloyDB is PostgreSQL-compatible and boosts performance with almost no app/code changes. Pretty sure Google's docs recommend AlloyDB here.

Mia L. Jul 13, 2026 9:37 am

C or D? The question says "minimizing changes to data schema and application code" and I’m wondering if they allow for some rewrites or strict minimal change. If extensive rewrites are allowed, then Bigtable might work, otherwise AlloyDB fits better.

Be respectful. No spam.

Correct Answer:

Explanation

Let's analyze each option based on the requirements: PostgreSQL compatibility, significant

performance improvement, minimal schema/code changes, handling large data volumes, Google-

recommended practices, and cost minimization:

A . Migrate your data to AlloyDB: AlloyDB for PostgreSQL is a fully managed, PostgreSQL-compatible

database service that offers significant performance improvements over standard PostgreSQL due to

its architectural optimizations. It is designed to handle large data volumes and minimizes the need

for schema and application code changes as it's wire-compatible with PostgreSQL. This aligns well

with the requirements for performance improvement, minimal changes, large data, and being a

Google-recommended option for PostgreSQL workloads.

B . Migrate your data to Spanner: Spanner is a globally distributed, horizontally scalable database

with strong consistency. While it offers excellent scalability and performance, it's not directly

PostgreSQL-compatible. Migrating to Spanner would likely require significant schema and application

code changes due to differences in data modeling and SQL dialect.

C . Migrate your data to Firebase: Firebase is a suite of mobile and web development tools, with its

primary database offering being Firestore (a NoSQL document database) and Realtime Database.

These are not PostgreSQL-compatible and would require substantial changes to the data model and

application code.

D . Migrate your data to Bigtable: Bigtable is a highly scalable NoSQL wide-column store. It's not

compatible with PostgreSQL and requires a completely different data model and application logic.

Therefore, AlloyDB is the most suitable option as it provides PostgreSQL compatibility for minimal

migration effort, significant performance improvements, scalability for large data volumes, and is a

recommended Google Cloud database service for PostgreSQL workloads.

Google Cloud Documentation

References

AlloyDB for PostgreSQL Overview: https://cloud.google.com/alloydb/docs/overview - This document

highlights AlloyDB's PostgreSQL compatibility, performance benefits, scalability, and suitability for

migrating existing PostgreSQL workloads.

Spanner Overview: https://cloud.google.com/spanner/docs/overview - This emphasizes Spanner's

unique features and differences from traditional relational databases like PostgreSQL.

Firebase Documentation: https://firebase.google.com/docs - This outlines the features of Firebase,

including Firestore and Realtime Database, highlighting their NoSQL nature and incompatibility with

PostgreSQL.

Cloud Bigtable Overview: https://cloud.google.com/bigtable/docs/overview - This describes Bigtable

as a NoSQL database, emphasizing its differences from relational databases like PostgreSQL.

===========

Q: 2

Your company’s Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure: /fr/video /en/video /es/video /../video /fr/audio /en/audio /es/audio /../audio Which solution should you recommend?

Options

Discussion

ZoeC Jul 23, 2026 11:18 am

A . Official GCP docs and practice exams focus on path rules using wildcards, but not regex, so you'd need to adjust the structure. Worth reviewing the official guide for these URL map constraints.

Amelia Y. Jul 21, 2026 1:32 am

A. since GCP path rules only allow wildcards like /video/*, so directory structure needs tweaking.

Piya Jul 17, 2026 8:18 pm

Practice exams often mention D as a close fit, so I'd try D here.

Luna Jul 26, 2026 12:44 am

Saw a very similar question in recent practice sets, A matches what GCP supports. URL maps in GCP don't do regex, only wildcard after the slash, so you have to rearrange dirs if you want those path rules. Correct me if I'm missing anything.

Vikram Jul 27, 2026 7:04 pm

Just to clarify, is minimizing operational overhead more important than preserving the current directory structure? If keeping the structure unchanged is a hard requirement, that could change which option makes sense.

Parker O. Jul 17, 2026 3:00 pm

D imo. Since the directory already has /fr/video style, I'd think using /*/video path rules would be simple and keep overhead low. Not totally sure about the wildcard position with GCP but this makes sense to me. Disagree?

ParkerX Jul 25, 2026 7:10 pm

Its A. GCP URL maps only let you use wildcards at the end, so you can't match /*/video. D is a common trap, but won't work with GCP rules. Think this is what similar practice questions expect, but open to corrections.

Sanjay O. Jul 28, 2026 3:18 pm

C/D? I get why people are picking D since it matches the current structure, but GCP URL maps don't support wildcards in the middle, so you can't use /*/video. On the other hand, C uses regex which isn't supported either. So neither seems quite right without changing the directories. Maybe A is technically best, but still not 100% sure since the question talks about minimizing operational overhead. Am I missing something small in how path rules work?

Logan F. Jul 27, 2026 9:37 pm

D imo, since the existing structure already has the language as a path segment, you could just use /*/video and /*/audio for the URL map rules. Don't see why you'd need to rearrange. Maybe missing something in GCP docs so open to being corrected.

Layla V. Jul 21, 2026 8:35 pm

I remember a similar scenario from labs, and A fits with what GCP URL maps actually support for path rules. Agree?

Be respectful. No spam.

Q: 3

You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN. What should you do?

Options

Discussion

Jack C. Jul 17, 2026 10:11 pm

Its C for scaling bandwidth. You need a new on-prem gateway with a different public IP so Cloud VPN can actually use both tunnels in parallel. Pretty sure that’s what the docs recommend, though correct me if I missed a nuance.

Avery Jul 21, 2026 12:46 pm

B or C? I'm thinking B lets you open another tunnel on the same gateway, which should help with more traffic since both are active. It's a common mistake to think two tunnels can't split load with the same public IP. Not 100% sure though, maybe I'm missing something about on-prem limits.

Avery I. Jul 20, 2026 11:47 am

C , you need a second on-premises VPN gateway with its own public IP to actually get more aggregate bandwidth. If you just add tunnels to the same on-prem IP, traffic still funnels through the same choke point. Only a separate gateway increases throughput. Not 100% but this is what Google's docs say too, agree?

Ethan O. Jul 25, 2026 10:44 am

I don’t think it’s B. C is more likely since using a different on-prem gateway IP actually increases bandwidth, not just redundancy.

FriendlyAnalyst2748 Jul 11, 2026 11:59 pm

B or D for me. If you create two tunnels on the same gateway going to the same destination, that should split some traffic and help with bandwidth, right? Haven’t seen docs say it must be different on-prem gateways. Maybe I’m missing something here.

Amelia Jul 15, 2026 8:58 am

Going with B here. Adding a second tunnel on the same gateway should let you split traffic and get more bandwidth.

Layla D. Jul 22, 2026 4:10 am

Sounds like B is the right move here. If both tunnels terminate on the same IP, maybe the software can balance traffic across them, so more bandwidth gets available without needing extra hardware or a different region. Could be an edge case depending on vendor support, though.

NathanA Jul 21, 2026 10:51 am

Saw something like this in a practice test, went with B.

Jamie W. Jul 30, 2026 12:54 am

Call it B can help here, seen similar logic in some official practice tests.

Neha P. Jul 15, 2026 2:19 am

C, not B. Only a second on-prem gateway with its own IP actually boosts bandwidth. B just adds tunnels to the same choke point so doesn’t help throughput. Pretty sure about this, but open if someone disagrees.

Be respectful. No spam.

Q: 4

You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection. Which two actions can accomplish this? (Choose two.)

Options

Discussion

Jack W. Jul 11, 2026 12:02 am

D/E. Official practice tests and Google docs both confirm those for Dedicated Interconnect, not B or C like Partner Interconnect.

Sara Jul 20, 2026 10:08 pm

Hard to say, B and C. Had something like this in a mock exam, and those options matched how we got the LOA-CFA details.

Luke Jul 21, 2026 1:07 pm

D/E for Dedicated Interconnect. The LOA-CFA gets sent out to the NOC contact and provider automatically, which matches D and E. That's what the official guide says, unless I'm missing something subtle here. Open to correction if anyone sees it differently.

Riley V. Jul 20, 2026 5:04 pm

DE tbh. For Dedicated Interconnect, Google emails the LOA-CFA directly to the NOC contact and cross-connect provider, so D and E make sense here. B would be for Partner Interconnect instead. Pretty sure this is right, but open to corrections.

Robin J. Jul 28, 2026 10:13 pm

C or D. I've seen similar stuff in the official guide and practice tests but never needed E.

Vikram N. Jul 26, 2026 8:13 am

Yeah, D and E work for Dedicated Interconnect. Google sends the LOA-CFA both to the NOC email (D) you list during setup, and also directly to the provider (E). Downloading from console is only for Partner Interconnect, not Dedicated. Pretty sure that's how it's been on my last project, but open to corrections if something's changed.

Kevin N. Jul 21, 2026 5:30 am

Probably D and E for this one. With Dedicated Interconnect, Google sends the LOA-CFA both to the NOC email you put in during ordering (D) and straight to the provider (E). The console download is only available for Partner Interconnect, not Dedicated. Pretty sure that's what the docs say but correct me if I'm wrong.

Owen O. Jul 29, 2026 10:38 am

D , matches what docs say about the LOA-CFA email for Dedicated Interconnect.

Sam H. Jul 11, 2026 7:06 pm

C/D? Not totally confident, but those seem most likely. Open to other views.

Drew G. Jul 26, 2026 5:26 pm

I don’t think it’s B and E. C is a trap, D is right.

Be respectful. No spam.

Q: 5

You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby. Which BGP attribute should you use on your on-premises router?

Options

Discussion

Chris C. Jul 18, 2026 6:39 am

Option D. saw a super similar question on a practice test, it was MED there too.

Ajay Jul 18, 2026 6:44 am

C vs D for me. Leaning C since Local Preference picks which path Routers use, right? MED feels more for other scenarios.

Cameron M. Jul 28, 2026 9:23 pm

Nah, I don't think it's C. MED (D) is what tells the on-prem router which Cloud Router should be active for inbound traffic. Local Preference mainly influences outbound routes on your network, not how Google receives the prefixes. Trap is thinking Local Pref does both directions. Pretty sure it's D, but open to a counterpoint.

Emma C. Jul 13, 2026 3:41 am

Seen this setup before, you'd use D. Multi-exit Discriminator (MED) helps your on-prem router know which Cloud Router should be primary for inbound BGP traffic. It's not about Local Preference since that's more for outbound path selection. Pretty sure it's D, but if someone disagrees let me know.

Mia Jul 10, 2026 11:03 am

Actually, Multi-exit Discriminator (D) is the standard way to influence inbound traffic from the on-prem router to GCP. MED lets you signal your preferred path when there are multiple entry points, so setting a lower MED on the active router makes it primary. I think that's what Google Cloud expects here. Open for debate if someone disagrees.

Chloe X. Jul 17, 2026 12:22 am

D , seen it in both the official guide and some practice exams.

SamZ Jul 28, 2026 2:55 am

D tbh

SteadyNeteng2668 Jul 19, 2026 1:07 am

D imo. MED (Multi-exit Discriminator) is what you set on your on-prem router to tell it which Cloud Router should be preferred for inbound traffic. That's what enables the standby/active BGP session design. Pretty sure that's right, but open to corrections.

Chloe E. Jul 27, 2026 3:50 pm

D is what you'd set on the on-prem side to make one Google Cloud Router preferred for inbound routes. Official docs and practice tests mention using MED for this exact active-standby BGP setup. Pretty sure that's right but let me know if you’ve seen different.

Chloe Jul 19, 2026 6:36 pm

It's actually D in this scenario because MED tells your on-prem router which Cloud Router path to prefer for inbound routes. If you set a lower MED on the active Cloud Router, that one gets picked for incoming traffic. Local Preference (C) would influence outbound from your own side, not which Google peer is active. I think that's how most exam guides explain it, but if anyone's got a real-world case where C worked, let me know!

Be respectful. No spam.

Q: 6

You have configured Cloud CDN using HTTP(S) load balancing as the origin for cacheable content. Compression is configured on the web servers, but responses served by Cloud CDN are not compressed. What is the most likely cause of the problem?

Options

Discussion

Karan O. Jul 24, 2026 1:31 pm

Option D. but if the question had said the CDN stripped Via headers or servers ignored them, that'd change things.

Sara Jul 21, 2026 8:55 pm

D. The trap here is A, but Cloud CDN doesn't handle compression by itself so it's a web server config issue.

Adam T. Jul 22, 2026 11:14 am

C/D? Not sure, but leaning D since most web servers stop compressing if a Via header is present.

Emma C. Jul 13, 2026 3:18 am

Option D The Via header disables compression on a lot of default web server configs, seen that before.

AlexJ Jul 15, 2026 3:33 pm

Probably D, since web servers usually disable compression if requests have a Via header from proxies like Cloud HTTP(S) LB. Seen that in docs before. Not totally certain, open to other takes.

FriendlyLearner6230 Jul 17, 2026 3:24 pm

A isn’t it, D is more likely. Remember seeing a similar scenario in practice tests, where the Via header caused the web server to skip compression. But just to confirm, does the question specify if all load-balanced web servers are running identical configs? That could switch things between D and C.

Ryan G. Jul 24, 2026 6:10 am

C tbh. If the web servers behind the load balancer are set up with different compression types, that might cause inconsistent responses. I've seen similar practice questions recommend checking server config first. Exam guide suggests alignment across backends is important, but not totally sure here.

Nina I. Jul 13, 2026 9:52 pm

Its A

ThoughtfulConsultant6501 Jul 28, 2026 10:43 pm

Don’t think it’s A, since Cloud CDN doesn’t handle compression itself. D is the issue here, web servers skip compression if they see a Via header from the load balancer. Seen similar reports in other exam threads.

Layla B. Jul 24, 2026 6:53 am

Its D, web servers often skip compression if they see a Via header from the load balancer.

Be respectful. No spam.

Q: 7

You are migrating to Cloud DNS and want to import your BIND zone file. Which command should you use?

Options

Discussion

Luke X. Jul 17, 2026 2:31 am

C . The key is you need -zone-file-format when importing a BIND zone file, nothing in the question says to replace NS records or wipe out anything first. Only extra flags if the scenario calls for them. Someone shout if I'm missing a detail here.

Jamie C. Jul 24, 2026 8:21 am

C . The -zone-file-format flag is what Cloud DNS expects for BIND imports, saw that in the official doc and labs. If you’re reviewing, stick to the official gcloud guide and maybe run a quick hands-on practice.

SanjayU Jul 13, 2026 8:37 pm

Option C

Sam J. Jul 21, 2026 4:05 am

B tbh, had something like this in a mock and picked B for import tasks.

MasonC Jul 15, 2026 4:38 am

Its C for sure, only need -zone-file-format flag to import standard BIND files. No extra options required unless the question says otherwise.

Taylor K. Jul 10, 2026 5:40 pm

You just need the -zone-file-format flag for a standard BIND import. C

QuietLead7735 Jul 17, 2026 1:23 am

C tbh

Drew K. Jul 26, 2026 6:10 am

I don’t think it’s C, B makes more sense to me. The -replace-origin-ns flag adjusts the NS records which might be required when importing from a BIND file so those don’t conflict. Not 100 percent sure though, someone correct me if that’s off.

Ishaan T. Jul 27, 2026 4:01 am

Feels like it's C here, since -zone-file-format is needed for importing from a BIND file. B looks tempting but that flag is only for replacing NS records, which isn't what the question asks.

Jason L. Jul 27, 2026 10:53 pm

B. I went with -replace-origin-ns because importing from a BIND file sometimes needs to adjust the NS records, right? The command looks close and covers handling the origin NS. Pretty sure that's needed here, but open to being corrected.

Be respectful. No spam.

Q: 8

You work for a university that is migrating to GCP. These are the cloud requirements: • On-premises connectivity with 10 Gbps • Lowest latency access to the cloud • Centralized Networking Administration Team New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud. What should you do?

Options

Discussion

Casey N. Jul 24, 2026 10:11 am

Why not B if each department wants their own VLAN attachments? Wouldn’t that cover flexibility even with a Shared VPC host project?

Jordan M. Jul 9, 2026 1:00 pm

A imo. Shared VPC in the host project lines up with centralized control and cuts down on extra interconnect costs since all departments use the same infrastructure. Pretty sure that’s what Google recommends for this setup, but let me know if you see it differently.

Sean Jul 22, 2026 11:24 am

NoahY Jul 20, 2026 1:08 am

Probably A, but only because centralized networking flips it. If departments needed autonomy then B could be right.

Ryan O. Jul 23, 2026 6:52 am

B tbh, since VLAN attachments in service projects might work for new departments if central admin trusts local control.

SkepticalAnalyst2759 Jul 12, 2026 3:58 pm

Hmm, I see where B could work since VLAN attachments in service projects might allow more flexibility. B

Daniel N. Jul 27, 2026 1:22 am

Probably A, the other options would either duplicate Interconnects for each department (C/D) or complicate VLAN management (B). A central Interconnect in the host project matches the centralized admin and best cost efficiency. If I'm missing something, feel free to chime in.

Layla Jul 14, 2026 2:56 am

A is the most cost-effective since you only need one Interconnect in the Shared VPC host project and all departments can connect through it. Centralized networking fits because the admin team keeps control rather than spreading it across multiple projects. Pretty sure that's best unless each department really needs their own network hardware, but doesn't look like that's the case here. Someone correct me if I'm missing a scenario.

Jack Q. Jul 25, 2026 4:22 pm

B not A. Had something like this in a mock, where each department needed their own VLAN attachment for flexibility but still used Shared VPC. I think B fits if departments might need to manage their own attachments. Open to other takes.

Logan R. Jul 20, 2026 3:42 am

A vs B. With centralized networking and cost efficiency, A makes sense since Shared VPC host lets the admin team control Interconnect and VLANs for everyone. But in some scenarios B can work if you want tighter segregation. Official doc or practice exam would help confirm.

Be respectful. No spam.

Q: 9

Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs. Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)

Options

Discussion

Ravi X. Jul 22, 2026 4:47 pm

A/C, saw a similar question on a practice test. B can’t span orgs, and D isn’t really for this scenario.

Jamie L. Jul 20, 2026 1:01 am

Why not B? Shared VPC can’t go across organizations, right?

Sofia R. Jul 22, 2026 11:57 am

A/C tbh. Only VPC peering and Cloud VPN support cross-org connectivity without CIDR overlap. Shared VPC (B) doesn't work across orgs, and NAT or Interconnect aren't meant for this use case. Pretty sure that's what GCP docs say unless there's some weird edge policy.

Daniel Jul 20, 2026 5:23 am

C or D. I saw a similar question in a practice set, both work for secure connectivity.

Robin O. Jul 19, 2026 11:11 am

Yeah I’d go with AC. VPC peering works if there’s no CIDR overlap, Cloud VPN is solid for encrypted tunnels.

Layla R. Jul 23, 2026 2:17 pm

B . Shared VPC should work since it's made for resource sharing across projects, maybe C is a trap.

MethodicalArchitect483 Jul 24, 2026 2:45 pm

A/C is right, Shared VPC (B) is a trap since it can't go across orgs.

Ryan J. Jul 28, 2026 7:48 am

A and C make sense here. VPC peering (A) works even if the VPCs are in different orgs and have no CIDR overlap. Cloud VPN (C) is also valid for secure cross-org communication. Shared VPC can't span organizations, so that's out. Let me know if I'm missing something!

Sara R. Jul 26, 2026 8:36 am

A/C tbh, B looks tempting but Shared VPC doesn't cross org boundaries. D and E don't fit the secure cross-org VPC access use case.

Chris Jul 15, 2026 12:27 am

A/C. Both let you connect separate org VPCs securely when there's no CIDR overlap.

Be respectful. No spam.

Q: 10

Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that the caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it as a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost. Which two steps should you take? (Choose two.)

Options

Discussion

Morgan M. Jul 28, 2026 4:57 pm

I don’t think E helps much, B and A make more sense. B increases your backend to handle the burst, A uses Cloud Armor to block malicious IPs and reduce load. Pretty sure that’s the fastest combo to restore access, though A might not catch everything in a big DDOS. Feel free to disagree if you see it differently.

Jamie F. Jul 17, 2026 9:39 am

Classic Google exam trick here, always go with the quick scaling (B) and logs (E) when it screams "urgent restore" on a DDoS. Option B and E.

AjayY Jul 9, 2026 1:01 pm

Option B and E seem right. B makes sense because bumping up autoscaling max is an immediate way to restore access, even though it can get pricey. E helps pin down if it's really a DDoS before you roll out other fixes, especially since IP blacklisting (A) isn’t super useful with distributed attacks. Pretty sure about this, but if anyone thinks A is better here for urgent response, let me know.

Emma F. Jul 16, 2026 2:06 pm

Probably B and E. A is a trap since just blacklisting IPs won't work well if the attacker uses many sources.

Reese Z. Jul 27, 2026 1:49 pm

encountered exactly similar question in my exam, on practice tests. Does official documentation or study guide specifically mention using B and E together for urgent DDoS recovery, or is there a better combo noted in Google’s prep materials?

Mason M. Jul 12, 2026 6:32 am

B and E. B gives you capacity right away, E helps confirm it’s actually a DDoS. Open to better ideas.

Alex S. Jul 24, 2026 3:42 pm

Maybe A for sure, blocking the attacker IPs with Cloud Armor should drop bad traffic fast.

Ethan Jul 22, 2026 9:22 pm

Its B and E. A is tempting but not effective against large DDoS since attacker IPs rotate a lot.

Sanjay Jul 20, 2026 5:14 am

B . Increasing autoscaling max (B) restores access fast, while looking at logs (E) helps confirm it was actually a DDoS and not a config issue. A is tempting but blacklisting isn’t super practical for big DDoS, IPs change fast. Open to disagreement if I missed something.

Neha Y. Jul 25, 2026 10:58 pm

B and E for me. Blacklisting (A) might sound good but on a large DDoS, it's usually useless since attacker IPs are super dynamic. B gives instant capacity, E helps confirm attack details. Pretty sure that's what the exam looks for here.

Be respectful. No spam.

Q: 11

You are maintaining a Shared VPC in a host project. Several departments within your company have infrastructure in different service projects attached to the Shared VPC and use Identity and Access Management (IAM) permissions to manage the cloud resources in those projects. VPC Network Peering is also set up between the Shared VPC and a common services VPC that is not in a service project. Several users are experiencing failed connectivity between certain instances in different Shared VPC service projects and between certain instances and the internet. You need to validate the network configuration to identify whether a misconfiguration is the root cause of the problem. What should you do?

Options

Q: 12

You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider. Which connection type should you choose?

Options

Q: 13

You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?

Options

Q: 14

You are designing a hybrid cloud environment. Your Google Cloud environment is interconnected with your on-premises network using HA VPN and Cloud Router in a central transit hub VPC. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88. You need to ensure that your Compute Engine resources in multiple spoke VPCs can resolve on-premises private hostnames using the domain corp.altostrat.com while also resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?

Options

Discussion

Emma Jul 26, 2026 5:57 am

A . Only A keeps the VPN architecture simple by using central DNS forwarding and peering zones, no extra tunnels in the spokes. Having direct VPNs from each spoke like in C or D isn't needed unless you want more resiliency, which the scenario doesn't mention. Anyone disagree?

Casey P. Jul 13, 2026 6:16 am

Its A

SkepticalCandidate8413 Jul 17, 2026 4:06 am

Is "best practice" in the question about minimizing VPN tunnels or more about DNS configuration specifics?

Alex Jul 16, 2026 1:24 pm

Choosing A lets you centralize DNS resolution using the hub’s forwarding and peering zones, so spokes don’t need their own VPNs. That lines up with Google’s best practices for keeping things simple and scalable. The others add extra complexity that isn't called for here, I think. Anyone see a reason it couldn’t just be A?

ReeseD Jul 24, 2026 11:22 pm

I think A, but second-guessing myself since the VPN setup details get tricky. I think Google wants you to centralize DNS via the hub and not build more VPNs in the spokes unless you absolutely need to. Anyone see a gotcha here?

FriendlyArchitect9029 Jul 17, 2026 1:03 am

Seen similar on practice exams. Pretty sure A fits Google best practices since it centralizes DNS forwarding in the hub and avoids building more VPNs than needed. The private peering zone lets the spokes use the hub for resolution. Could be missing a detail but I think A covers both DNS and network simplicity.

Mason Jul 10, 2026 6:12 pm

If you set up the forwarding zone and private peering as in A, wouldn't that cover DNS resolution from the spokes to on-prem via the hub anyway? I think extra direct VPNs from each spoke (like in C or D) aren't really needed.

Ivy S. Jul 22, 2026 1:52 am

Nah, not D. Pretty sure it's A because it doesn't require extra VPN tunnels from each spoke. Google recommends centralizing DNS and minimizing direct on-prem connections. Anyone see a reason to prefer D over A?

Be respectful. No spam.

Q: 15

You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT. What is the most likely cause of this problem?

Options

Q: 16

Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances. Which two products should you incorporate into the solution? (Choose two.)

Options

Q: 17

Your organization has an on-premises data center. You need to provide connectivity from the on- premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?

Options

Q: 18

You are in the process of deploying an internal HTTP(S) load balancer for your web server virtual machine (VM) Instances What two prerequisite tasks must be completed before creating the load balancer? Choose 2 answers

Options

Q: 19

Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from on-premises locations using Cloud Interconnect connections. Your company must be able to send traffic to Cloud Storage only through the Interconnect links while accessing other Google APIs and services over the public internet. What should you do?

Options

Q: 20

In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost. Which two steps should you take? (Choose two.)

Options

Question 1 of 20

PROFESSIONAL-CLOUD-NETWORK-ENGINEER.pdf

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE

Free PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE