support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD NETWORK ENGINEER

Free PROFESSIONAL CLOUD NETWORK ENGINEER Exam Braindumps
Professional Cloud Network Engineer Questions 126–130 (page: 27)

Updated On: 10-Feb-2026
Page 27 of 51
PDF with 316 Questions

You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC):



You need to update the firewall rule to add the following rule to the ruleset:



You are using a new user account. You must assign the appropriate identity and Access Management (IAM)

user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs.
What should you do?

  1. Assign the compute.securityAdmin and logging.viewer role to the new user account. Apply the new firewall rule with a priority of 50.
  2. Assign the compute.securityAdmin and logging.bucketWriter role to the new user account.
    Apply the new firewall rule with a priority of 150.
  3. Assign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account.
    Apply the new firewall rule with a priority of 50.
  4. Assign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.

Answer(s): A



Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access only from resources in your corporate public networks.
What should you do?

  1. Create an access context policy that allows your VPC and corporate public network IP ranges, and then attach the policy to Cloud Storage and BigQuery.
  2. Create a VPC Service Controls perimeter for your project with an access context policy that allows your corporate public network IP ranges.
  3. Create a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized networks.
  4. Create a VPC Service Controls perimeter for each VPC with an access context policy that allows your corporate public network IP ranges.

Answer(s): B



Your company has provisioned 2000 virtual machines (VMs) in the private subnet of your Virtual Private Cloud (VPC) in the us-east1 region. You need to configure each VM to have a minimum of 128 TCP connections to a public repository so that users can download software updates and packages over the internet. You need to implement a Cloud NAT gateway so that the VMs are able to perform outbound NAT to the internet. You must ensure that all VMs can simultaneously connect to the public repository and download software updates and packages.
Which two methods can you use to accomplish this? (Choose two.)

  1. Configure the NAT gateway in manual allocation mode, allocate 2 NAT IP addresses, and update the minimum number of ports per VM to 256.
  2. Create a second Cloud NAT gateway with the default minimum number of ports configured per VM to 64.
  3. Use the default Cloud NAT gateway's NAT proxy to dynamically scale using a single NAT IP address.
  4. Use the default Cloud NAT gateway to automatically scale to the required number of NAT IP addresses, and update the minimum number of ports per VM to 128.
  5. Configure the NAT gateway in manual allocation mode, allocate 4 NAT IP addresses, and update the minimum number of ports per VM to 128.

Answer(s): D,E



You have the following routing design. You discover that Compute Engine instances in Subnet-2 in the asia- southeast1 region cannot communicate with compute resources on-premises.
What should you do?

  1. Configure a custom route advertisement on the Cloud Router.
  2. Enable IP forwarding in the asia-southeast1 region.
  3. Change the VPC dynamic routing mode to Global.
  4. Add a second Border Gateway Protocol (BGP) session to the Cloud Router.

Answer(s): C



You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices.
What should you do?

  1. 1. Create a private forwarding zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
    2. Configure your on-premises firewall to accept traffic from 10.204.0.0/24.
    3. Set a custom route advertisement on the Cloud Router for 10.204.0.0/24.
  2. 1. Create a private forwarding zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com that points to 192.168 20.88.
    2. Configure your on-premises firewall to accept traffic from 35.199.192.0/19.
    3. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
  3. 1. Create a private forwarding zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
    2. Configure your on-premises firewall to accept traffic from 10.204.0.0/24.
    3. Modify the /etc/resolv conf file on your Compute Engine instances to point to 192.168.20 88.
  4. 1. Create a private zone in Cloud DNS for `corp.altostrat.com' called corp-altostrat-com.
    2. Configure DNS Server Policies and create a policy with Alternate DNS servers to 192.168.20.88.
    3. Configure your on-premises firewall to accept traffic from 35.199.192.0/19.
    4. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.

Answer(s): B



  PDF
Viewing page 27 of 51
Viewing questions 131 - 135 out of 316 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD NETWORK ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!