Free PROFESSIONAL CLOUD NETWORK ENGINEER Exam Braindumps
Professional Cloud Network Engineer Questions 66–70 (page: 15)

Updated On: 10-Feb-2026

You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports.
While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue.

What should you do?

  1. Enable logging on the default Deny Any Firewall Rule.
  2. Enable logging on the VM Instances that receive traffic.
  3. Create a logging sink forwarding all firewall logs with no filters.
  4. Create an explicit Deny Any rule and enable logging on the new rule.

Answer(s): D



In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost.

Which two steps should you take? (Choose two.)

  1. Connect both projects using Cloud VPN.
  2. Connect the VPCs in project code-dev and data-dev using VPC Network Peering.
  3. Enable Shared VPC in one project (e. g., code-dev), and make the second project (e. g., data-dev) a service project.
  4. Enable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances in project data-dev, and vice versa.
  5. Create a route in the code-dev project to the destination prefixes in project data-dev and use nexthop as the default gateway, and vice versa.

Answer(s): B,D



You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements:

IP ranges for pods and services must be as small as possible.

The nodes and the master must not be reachable from the internet.

You must be able to use kubectl commands from on-premises subnets to manage the cluster.

How should you create the GKE cluster?

  1. · Create a private cluster that uses VPC advanced routes.
    · Set the pod and service ranges as /24.
    · Set up a network proxy to access the master.
  2. · Create a VPC-native GKE cluster using GKE-managed IP ranges.
    · Set the pod IP range as /21 and service IP range as /24.
    · Set up a network proxy to access the master.
  3. · Create a VPC-native GKE cluster using user-managed IP ranges.
    · Enable a GKE cluster network policy, set the pod and service ranges as /24.
    · Set up a network proxy to access the master.
    · Enable master authorized networks.
  4. · Create a VPC-native GKE cluster using user-managed IP ranges.
    · Enable privateEndpoint on the cluster master.
    · Set the pod and service ranges as /24.
    · Set up a network proxy to access the master.
    · Enable master authorized networks.

Answer(s): D



You are creating an instance group and need to create a new health check for HTTP(s) load balancing.

Which two methods can you use to accomplish this? (Choose two.)

  1. Create a new health check using the gcloud command-line tool.
  2. Create a new health check using the VPC Network section in the Google Cloud console.
  3. Create a new health check, or select an existing one, when you complete the load balancer's backend configuration in the Google Cloud console.
  4. Create a new legacy health check using the gcloud command-line tool.
  5. Create a new legacy health check using the Health checks section in the Google Cloud console.

Answer(s): A,C



You are in the early stages of planning a migration to GCP. You want to test the functionality of your hybrid cloud design before you start to implement it in production. The design includes services running on a Compute Engine Virtual Machine instance that need to communicate to on-premises servers using private IP addresses. The on-premises servers have connectivity to the internet, but you have not yet established any Cloud Interconnect connections. You want to choose the lowest cost method of enabling connectivity between your instance and on-premises servers and complete the test in 24 hours.

Which connectivity method should you choose?

  1. Cloud VPN
  2. 50-Mbps Partner VLAN attachment
  3. Dedicated Interconnect with a single VLAN attachment
  4. Dedicated Interconnect, but don't provision any VLAN attachments

Answer(s): A



Viewing page 15 of 51
Viewing questions 71 - 75 out of 316 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD NETWORK ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!