Free Professional Cloud Network Engineer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Professional Cloud Network Engineer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An internet-facing architecture must use Google's backbone for traffic transport as close to end users as possible. Which Network Service Tier supports this design?

   1. A. Standard Tier for both ingress and egress
   2. B. Premium Tier for the external connectivity
   3. C. Standard Tier with a regional external address
   4. D. Standard Tier with a regional load balancer

   Answer: B

   Explanation: Google states: "Premium Tier delivers traffic on Google's premium backbone, while Standard Tier uses regular ISP networks." Premium Tier supplies the required transport; choosing a regional address or load balancer does not change Standard Tier into backbone transport.

   Reference: Network Service Tiers overview — Network Service Tiers overview

2. 2A VM has no external IP address and must access supported Google APIs. DNS, routes, and firewall rules are already correct. Which setting must be enabled on the VM's subnet?

   1. A. Private Google Access
   2. B. VPC Network Peering
   3. C. Global dynamic routing
   4. D. Private services access

   Answer: A

   Explanation: Google specifies: "The VM interface is connected to a subnet where Private Google Access is enabled." Enable Private Google Access on that subnet. Peering, dynamic routing scope, and private services access do not substitute for this setting for the stated Google API access method.

   Reference: Configure Private Google Access — Specifications

3. 3An Application Load Balancer must send /images/* requests for shop.example.com to an image backend and other paths for that host to a web backend. Which component defines this mapping?

   1. A. The backend health check's request path
   2. B. The forwarding rule's destination port
   3. C. The URL map's host rule and path matcher
   4. D. The backend service's session affinity setting

   Answer: C

   Explanation: Google says a path matcher "defines the relationship between the path portion of a URL and the backend service or backend bucket". The host rule selects the matcher, whose path rules and default backend implement the requirement. Health-check paths probe health; forwarding ports and affinity do not select application backends by URL path.

   Reference: URL maps overview — URL map components — Path matcher

4. 4A Partner Interconnect service uses Layer 2 connectivity. Which BGP arrangement must the customer configure for each VLAN attachment?

   1. A. BGP only between the service provider and Cloud Router
   2. B. BGP between the customer's on-premises router and Cloud Router
   3. C. BGP only between two VMs inside the consumer VPC
   4. D. Static routing instead of any Cloud Router BGP session

   Answer: B

   Explanation: Google states: "For Layer 2 connections, you must configure and establish a BGP session between your Cloud Routers and on-premises routers". Layer 3 provider-managed BGP is a different arrangement; neither VM-to-VM BGP nor static-only routing implements the Layer 2 attachment requirement.

   Reference: Partner Interconnect overview — Layer 2 versus Layer 3 connectivity

5. 5A VPC Flow Logs configuration uses a secondary sampling rate of 1.0. Does this provide a complete record of every packet sent through the network?

   1. A. Yes, because secondary sampling replaces primary sampling
   2. B. Yes, because aggregation reconstructs every missing packet
   3. C. No, because secondary sampling applies after primary packet sampling
   4. D. No, because a rate of 1.0 disables flow-log collection

   Answer: C

   Explanation: Google states: "The secondary sampling is performed on the flow logs generated by the primary flow log sampling process." A secondary rate of 1.0 retains those generated entries, not every original packet. Aggregation does not reconstruct packet captures, and 1.0 does not disable collection.

   Reference: VPC Flow Logs overview — Log sampling and processing — Secondary flow log sampling

6. 6A global external Application Load Balancer uses Cloud CDN. Requests from a blocked IP range must be filtered before cached objects are served. Which Cloud Armor policy type should implement this filter?

   1. A. An edge security policy on the CDN backend
   2. B. Only a backend security policy on the origin backend
   3. C. An internal service security policy on the workload
   4. D. A network edge security policy on a backend VM

   Answer: A

   Explanation: Google states: "Edge security policies can be configured to filter requests before the request is served from Google's cache." Backend policies alone only evaluate applicable cache-miss traffic after edge policies. Internal service and network edge policies target different enforcement points and do not provide this CDN cache-layer filter.

   Reference: Cloud Armor security policy overview — Edge security policies

7. 7A producer publishes a service using Private Service Connect. Consumers need private access through an endpoint in their own VPC, without a consumer-managed load balancer. Which connectivity option matches this design?

   1. A. Private services access through Service Networking
   2. B. Private Service Connect backends for published services
   3. C. Private Service Connect endpoints for published services
   4. D. Private Google Access for Google API domains

   Answer: C

   Explanation: The endpoints option states: "Connect to services in another VPC network through an endpoint." PSC backends use a consumer-managed load balancer; private services access uses peering, and Private Google Access targets supported Google APIs rather than a PSC-published endpoint.

   Reference: Private access options for services — Connect to services in VPC networks — Private Service Connect endpoints for published services

8. 8An ordinary custom-mode subnet uses 10.50.0.0/24 and needs more primary IPv4 addresses. The adjacent space is free and all overlap checks permit expansion. Which in-place change increases capacity?

   1. A. Change the primary range to 10.50.0.0/25
   2. B. Move the primary range to 10.51.0.0/24
   3. C. Change the primary range to 10.50.0.0/23
   4. D. Replace the primary range with a secondary /24

   Answer: C

   Explanation: Google allows expansion by "setting the prefix length to a smaller number." A /23 contains the existing /24 and adds addresses. A /25 shrinks the range, moving to a different /24 is replacement rather than expansion, and a secondary range does not expand the primary range.

   Reference: Create and modify VPC networks — Expand a primary IPv4 range

9. 9An external Application Load Balancer receives /public/logo.png, but its origin expects /assets/logo.png. The browser's displayed URL must stay at /public/logo.png. Which load-balancer action meets this requirement?

   1. A. Rewrite the request path to /assets/logo.png
   2. B. Redirect the client to /assets/logo.png
   3. C. Match only /assets/logo.png in a path rule
   4. D. Rewrite only the request's Host header

   Answer: A

   Explanation: Google states: "you can configure a URL rewrite action before the load balancer sends requests to the backend service or backend bucket." A path rewrite changes the backend request while preserving the client-visible URL. Redirecting changes the client's requested URL, a path match does not rewrite the incoming path, and changing only Host leaves the wrong path unchanged.

   Reference: Traffic management overview for classic Application Load Balancers — URL map traffic actions — URL rewrites

10. 10After creating a Partner Interconnect VLAN attachment, an engineer must request the corresponding connection from a supported service provider. Which generated value links that request to the attachment?

    1. A. The attachment's unique pairing key
    2. B. The host project's billing account ID
    3. C. The on-premises router's BGP password
    4. D. The VPC network's default route priority

    Answer: A

    Explanation: Google states that attachment creation "generates a unique pairing key that you use to request a connection from your service provider." That key identifies the attachment for provisioning. Billing IDs, BGP authentication secrets, and route priorities serve different functions and do not pair the provider connection.

    Reference: Partner Interconnect overview — Provisioning