CertsPoint
Sign In Get Started
See all results for ""
Exams About Us
Sign In Get Started
Exam Overview
Exam Code Professional-Cloud-Network-Engineer
Exam Name Professional Cloud Network Engineer
Vendor Google
Total Questions 233
Last Updated 26-Oct, 2026
Free Professional-Cloud-Network-Engineer Questions Get Premium Access
Why CertsPoint?
  • Latest & Verified Questions
  • Detailed Explanations
  • Regular Updates
  • Full-Length Practice Tests
  • Boost Your Exam Confidence

PDF Study Materials

Downloadable guides and resources

Practice Tests

Full-length tests with real exam experience

Progress Tracking

Monitor your performance and improvement

Study Anywhere

Access on desktop, tablet, and mobile

Excellent
4.6 (398 Up Votes)
Secure Payment Privacy Protected Money Back Guarantee

Free Professional-Cloud-Network-Engineer Practice Questions

Explore 5 free practice questions for the Google Professional-Cloud-Network-Engineer exam and review the answers and explanations to support your preparation.

  1. Question 1

    Single answer

    Your company’s on-premises network is connected to a VPC using a Cloud VPN tunnel. You have a static route of 0.0.0.0/0 with the VPN tunnel as its next hop defined in the VPC. All internet bound traffic currently passes through the on-premises network. You configured Cloud NAT to translate the primary IP addresses of Compute Engine instances in one region. Traffic from those instances will now reach the internet directly from their VPC and not from the on-premises network. Traffic from the virtual machines (VMs) is not translating addresses as expected. What should you do?

    • Option A:

      Lower the TCP Established Connection Idle Timeout for the NAT gateway.

      Correct
    • Option B:

      Add firewall rules that allow ingress and egress of the external NAT IP address, have a target tag that is on the Compute Engine instances, and have a priority value higher than the priority value of the default route to the VPN gateway.

      Correct
    • Option C:

      Add a default static route to the VPC with the default internet gateway as the next hop, the network tag associated with the Compute Engine instances, and a higher priority than the priority of the default route to the VPN tunnel.

      Correct
    • Option D:

      Increase the default min-ports-per-vm setting for the Cloud NAT gateway.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: A

  2. Question 2

    Single answer

    You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.

    What should you do?

    • Option A:

      Upload your public ssh key to the project Metadata.

      Correct
    • Option B:

      Upload your public ssh key to each instance Metadata.

      Correct
    • Option C:

      Create a custom Google Compute Engine image with your public ssh key embedded.

      Correct
    • Option D:

      Use gcloud compute ssh to automatically copy your public ssh key to the instance.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: A

    Explanation

    Overview By creating and managing SSH keys, you can let users access a Linux instance through third-party tools. An SSH key consists of the following files: A public SSH key file that is applied to instance-level metadata or project-wide metadata. A private SSH key file that the user stores on their local devices. If a user presents their private SSH key, they can use a third-party tool to connect to any instance that is configured with the matching public SSH key file, even if they aren ' t a member of your Google Cloud project. Therefore, you can control which instances a user can access by changing the public SSH key metadata for one or more instances. https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#addkey

  3. Question 3

    Single answer

    Your organization has an on-premises data center. You need to provide connectivity from the on-premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?

    • Option A:

      Configure HA VPN by using high availability gateways and tunnels.

      Correct
    • Option B:

      Configure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.

      Correct
    • Option C:

      Configure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.

      Correct
    • Option D:

      Configure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: D

    Explanation

    For private connectivity with at least 1 Gbps bandwidth and without using the public internet, Partner Interconnect is the suitable choice if you do not require the 10 Gbps minimum of Dedicated Interconnect. With Partner Interconnect, you create a VLAN attachment and work with a service provider that facilitates the connection between your on-premises network and Google Cloud. This solution supports connections as low as 50 Mbps and up to 10 Gbps.

    [Reference: Google Cloud - Choosing the right Interconnect product]

  4. Question 4

    Single answer

    Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with on-premises connectivity already in place. You are deploying a new application using Google Kubernetes Engine (GKE), which must be accessible only from the same VPC network and on-premises locations. You must ensure that the GKE control plane is exposed to a predefined list of on-premises subnets through private connectivity only. What should you do?

    • Option A:

      Create a GKE private cluster with a private endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.

      Correct
    • Option B:

      Create a GKE private cluster with a public endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers.

      Correct
    • Option C:

      Create a GKE private cluster with a private endpoint for the control plane. Configure authorized networks to specify the desired on-premises subnets.

      Correct
    • Option D:

      Create a GKE public cluster. Configure authorized networks to specify the desired on-premises subnets.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: C

  5. Question 5

    Single answer

    You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial-of-service and application layer (layer 7) attacks. What should you do?

    • Option A:

      Configure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.

      Correct
    • Option B:

      Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.

      Correct
    • Option C:

      Configure VPC firewall rules to protect the Compute Engine instances against distributed denial-of-service attacks.

      Correct
    • Option D:

      Configure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: C