support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD NETWORK ENGINEER

Free PROFESSIONAL CLOUD NETWORK ENGINEER Exam Braindumps
Professional Cloud Network Engineer Questions 96–100 (page: 21)

Updated On: 10-Feb-2026
Page 21 of 51
PDF with 316 Questions

In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost:

Port 8080 should always be open for VMs in the projects in the Dev folder.

Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder.

What should you do?

  1. Create and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
  2. Create a Shared VPC for the Dev projects and a Shared VPC for the Prod projects. Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall rule to deny traffic to port 8080 in the Shared VPC for Prod. Deploy VMs to those Shared VPCs.
  3. In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.
  4. Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev VMs and deny traffic to port 8080 on the Prod VMs.

Answer(s): A



You need to configure the Border Gateway Protocol (BGP) session for a VPN tunnel you just created between two Google Cloud VPCs, 10.1.0.0/16 and 172.16.0.0/16. You have a Cloud Router (router-1) in the 10.1.0.0/16 network and a second Cloud Router (router-2) in the 172.16.0.0/16 network.
Which configuration should you use for the BGP session?





Answer(s): C



Your company's on-premises network is connected to a VPC using a Cloud VPN tunnel. You have a static route of 0.0.0.0/0 with the VPN tunnel as its next hop defined in the VPC. All internet bound traffic currently passes through the on-premises network. You configured Cloud NAT to translate the primary IP addresses of Compute Engine instances in one region. Traffic from those instances will now reach the internet directly from their VPC and not from the on-premises network. Traffic from the virtual machines (VMs) is not translating addresses as expected.
What should you do?

  1. Lower the TCP Established Connection Idle Timeout for the NAT gateway.
  2. Add firewall rules that allow ingress and egress of the external NAT IP address, have a target tag that is on the Compute Engine instances, and have a priority value higher than the priority value of the default route to the VPN gateway.
  3. Add a default static route to the VPC with the default internet gateway as the next hop, the network tag associated with the Compute Engine instances, and a higher priority than the priority of the default route to the VPN tunnel.
  4. Increase the default min-ports-per-vm setting for the Cloud NAT gateway.

Answer(s): C



You are designing a Partner Interconnect hybrid cloud connectivity solution with geo-redundancy across two metropolitan areas. You want to follow Google-recommended practices to set up the following region/metro pairs:

(region 1/metro 1)

(region 2/metro 2)

What should you do?

  1. Create a Cloud Router in region 1 with two VLAN attachments connected to metro1-zone1-x.
    Create a Cloud Router in region 2 with two VLAN attachments connected to metro1-zone2-x.
  2. Create a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone1-x.
    Create a Cloud Router in region 2 with two VLAN attachments connected to metro2-zone2-x.
  3. Create a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone2-x.
    Create a Cloud Router in region 2 with one VLAN attachment connected to metro2-zone2-x.
  4. Create a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone1-x and one VLAN attachment connected to metro1-zone2-x.
    Create a Cloud Router in region 2 with one VLAN attachment connected to metro2-zone1-x and oneVLAN attachment to metro2-zone2-x.

Answer(s): D



You are designing the network architecture for your organization. Your organization has three developer teams:
Web, App, and Database. All of the developer teams require access to Compute Engine instances to perform their critical tasks. You are part of a small network and security team that needs to provide network access to the developers. You need to maintain centralized control over network resources, including subnets, routes, and firewalls. You want to minimize operational overhead. How should you design this topology?

  1. Configure a host project with a Shared VPC. Create service projects for Web, App, and Database.
  2. Configure one VPC for Web, one VPC for App, and one VPC for Database. Configure HA VPN between each VPC.
  3. Configure three Shared VPC host projects, each with a service project: one for Web, one for App, and one for Database.
  4. Configure one VPC for Web, one VPC for App, and one VPC for Database. Use VPC Network Peering to connect all VPCs in a full mesh.

Answer(s): A



  PDF
Viewing page 21 of 51
Viewing questions 101 - 105 out of 316 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD NETWORK ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!