Google Cloud Professional Cloud Network Engineer Practice Exam

What the Google Cloud Professional Cloud Network Engineer exam covers

• Designing and planning a Google Cloud VPC network150 questions
• Implementing a VPC network164 questions
• Configuring managed network services168 questions
• Configuring and implementing hybrid and multicloud network interconnectivity134 questions
• Managing, monitoring, and troubleshooting network operations152 questions
• Configuring, implementing and managing a cloud network security solution110 questions

Free Google Cloud Professional Cloud Network Engineer sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 878.

1. Question 1Designing and planning a Google Cloud VPC network

   What is the scope of a Google Cloud VPC network and its subnets?

   • AThe VPC is regional; subnets are zonal
   • BThe VPC is global; subnets are regionalCorrect
   • CBoth are zonal
   • DBoth are global
   ✓ Correct answer: B

   In Google Cloud, a VPC network is a global resource - it spans all regions and zones automatically. Subnets, however, are regional resources and each subnet's IP range is tied to a specific region. VMs in any zone within a region can use subnets from that region, which allows cross-zone communication within a single subnet without any extra configuration.

   Why the other options are wrong

   • AA regional VPC with zonal subnets describes an AWS-style model, not Google Cloud - GCP VPCs are global resources and subnets are regional, not zonal.
   • CZonal scope applies to individual resources like VM instances and persistent disks, not to VPC networks or their subnets.
   • DSubnets are regional, not global - each subnet is scoped to a single region and carries a CIDR range bound to that region.
2. Question 2Configuring and implementing hybrid and multicloud network interconnectivitySelect all that apply

   Which TWO reduce cost or improve performance of hybrid connectivity without sacrificing availability? (Choose TWO)

   • ADisable BGP and hardcode static routes to one path
   • BUse Interconnect instead of high-volume VPN to lower per-GB egress at scaleCorrect
   • CRight-size VLAN attachment capacity to measured peak usageCorrect
   • DRun a single non-redundant tunnel to save money
   ✓ Correct answer: B, C

   Cloud Interconnect has significantly lower per-GB egress pricing than Cloud VPN when transferring large volumes of data, making it the cost-effective choice at scale. Right-sizing VLAN attachment capacity to measured peak usage (rather than over-provisioning) ensures you pay only for the bandwidth you actually need. Both practices reduce cost while maintaining the redundancy and availability of hybrid connectivity.

   Why the other options are wrong

   • ADisabling BGP and hardcoding static routes to one path eliminates dynamic failover - if that single path fails there is no automatic rerouting, sacrificing availability.
   • DRunning a single non-redundant tunnel eliminates failover capability, violating the 99.9%+ SLA requirements for most production workloads and contradicting the 'without sacrificing availability' constraint.
3. Question 3Managing, monitoring, and troubleshooting network operations

   VPC Flow Logs are enabled with an aggregation interval and a sample rate of 0.5. What does the sample rate control?

   • AThe fraction of packets/flows that are captured and logged, reducing log volume and cost while still being statistically representativeCorrect
   • BThe percentage of subnets in the VPC that have Flow Logs enabled, so a rate of 0.5 means logging is active on half of the subnets today
   • CThe proportion of the retention window that logs are kept before deletion, so a value of 0.5 effectively halves the default log retention period
   • DThe maximum share of firewall rules that will be logged, so a value of 0.5 caps logging at half of the total configured firewall rules
   ✓ Correct answer: A

   VPC Flow Logs sample rate is a value between 0.0 and 1.0 that controls what fraction of flows are actually written as log entries. A rate of 0.5 means roughly 50% of flows are captured, reducing ingestion volume and associated Cloud Logging costs while still providing statistically meaningful visibility into traffic patterns. The aggregation interval is a separate setting that controls how long a flow is observed before emitting a record.

   Why the other options are wrong

   • BThe sample rate applies within a single subnet's flows, not across subnets; it does not select which subnets have logging enabled.
   • CSampling controls how many flows are captured, not log retention, which is governed separately by the logging bucket configuration.
   • DFlow Logs sample network flows and have nothing to do with firewall rule logging, which is a distinct per-rule feature.
4. Question 4Managing, monitoring, and troubleshooting network operations

   A Connectivity Test from a client VM to a database VM reports 'dropped due to no matching route.' What is the most appropriate corrective action?

   • ARotate the database VM's service account key to clear the missing-route condition
   • BAdd or correct a route (e.g., subnet/static/dynamic route) to the destination networkCorrect
   • CIncrease the Cloud CDN cache TTL so cached responses reach the client
   • DEnable object versioning on a bucket to restore the missing route entry
   ✓ Correct answer: B

   When Network Intelligence Center's Connectivity Tests reports a packet drop with reason 'no matching route,' it means GCP's routing table has no route that matches the destination IP of the database VM. The fix is to ensure a valid route exists - this could be a subnet route (if the VMs are in different VPCs without peering), a static custom route pointing to a next hop, or a dynamic route learned via BGP through Cloud Router. Without a matching route, the packet is dropped at the forwarding plane.

   Why the other options are wrong

   • AA service account key governs authentication, not IP routing, so rotating it cannot fix a missing route in the data path.
   • CCloud CDN caching applies to HTTP content delivery and cannot create the network route the test found missing.
   • DObject versioning protects Cloud Storage objects and has nothing to do with VPC routing between two VMs.
5. Question 5Designing and planning a Google Cloud VPC networkSelect all that apply

   When planning standalone VPCs versus a Shared VPC, which TWO statements are accurate considerations for the design? (Choose TWO)

   • AShared VPC centralizes subnet, route, and firewall administration in a host project while service projects deploy compute into shared subnetsCorrect
   • BA Shared VPC host and its service projects must all belong to the same organizationCorrect
   • CStandalone VPCs in different projects can never communicate, even with peering
   • DShared VPC removes the need for any IAM permissions on subnets
   ✓ Correct answer: A, B

   Shared VPC is a Google Cloud construct where a host project owns subnets, routes, and firewall rules, and service projects attach to those subnets so their compute resources can use the centrally managed network. A critical constraint is that all projects participating in a Shared VPC - both the host and all service projects - must belong to the same Google Cloud organization. This centralizes network governance while allowing application teams to manage compute independently within their own service projects.

   Why the other options are wrong

   • CStandalone VPCs in different projects can communicate when VPC Network Peering is configured between them - peering provides private IP connectivity without merging the networks.
   • DShared VPC still requires IAM permissions - subnet-level IAM bindings (roles/compute.networkUser) are needed to grant service project principals the right to use specific shared subnets.
6. Question 6Implementing a VPC networkSelect all that apply

   When you create a VPC-native GKE cluster, three distinct IP ranges are consumed from the subnet. Which TWO of the following are allocated from the subnet's SECONDARY ranges (alias IP ranges) rather than the primary range? (Choose TWO)

   • AThe Pod IP address range used by all Pods scheduled on the cluster's nodesCorrect
   • BThe Service (ClusterIP) IP address range used by Kubernetes ServicesCorrect
   • CThe node IP address range used by the cluster's worker node VMs
   • DThe external load balancer VIP range used by internet-facing Services
   ✓ Correct answer: A, B

   In a VPC-native GKE cluster, three IP ranges are needed: the node range (from the subnet's primary range), the Pod range (from a subnet secondary range), and the Service/ClusterIP range (from a separate subnet secondary range). The Pod and Service ranges are alias IP ranges defined as secondary ranges on the subnet. Node VMs take their primary internal IPs from the subnet's primary range, while Pod and Service CIDRs are secondary ranges that the GCP data plane understands as valid alias addresses.

   Why the other options are wrong

   • CThe node IP address range for worker VMs is drawn from the subnet's PRIMARY range, not a secondary range, because node VMs are standard Compute Engine instances that require a primary internal IP.
   • DExternal load balancer VIPs for internet-facing Services are regional external IP addresses managed by GCP's load balancing infrastructure and are not allocated from the subnet's primary or secondary ranges.
7. Question 7Configuring managed network services

   A team enables bot management on a Google Cloud Armor policy. For suspected automated clients they want a frictionless challenge that can silently verify good bots and humans, escalating to a visible challenge only when confidence is low. Which integration provides this?

   • AreCAPTCHA Enterprise WAF integration with a redirect-to-Google reCAPTCHA action evaluating session tokens and scoresCorrect
   • BA rate-based deny rule with a one-second enforcement interval that blocks any client exceeding a single request per second
   • CCloud CDN cache mode set to CACHE_ALL_STATIC so automated clients are served cached responses instead of reaching the origin
   • DA VPC Service Controls perimeter drawn around the backend service so only trusted automated clients can invoke it
   ✓ Correct answer: A

   Google Cloud Armor's reCAPTCHA Enterprise WAF integration enables frictionless bot management by evaluating session tokens and action tokens embedded in requests. Clients with high confidence scores pass silently, while low-confidence clients are redirected to a visible reCAPTCHA challenge - providing a tiered, risk-adaptive verification without blocking legitimate human users.

   Why the other options are wrong

   • BA one-second rate deny bluntly blocks clients and offers no silent verification or graduated visible challenge for suspected bots.
   • CCloud CDN caching serves static content and does not verify whether a client is a good bot or a human.
   • DVPC Service Controls establish data-exfiltration perimeters and provide no bot-challenge or session-scoring capability.
8. Question 8Configuring and implementing hybrid and multicloud network interconnectivity

   Your design uses a Dedicated Interconnect (primary) and HA VPN (backup) to the same on-prem network, both terminating on the same Cloud Router, advertising the same on-prem prefixes. You want Google Cloud to use the Interconnect whenever it is healthy. Which BGP technique implemented on the Cloud Router or peer achieves this?

   • AAdvertise the VPN-learned routes with a higher route priority (MED) value than the Interconnect-learned routes so the lower-priority Interconnect path winsCorrect
   • BConfigure both peers with identical route priority so ECMP always splits traffic equally across the Interconnect and the VPN
   • CPermanently disable the VPN BGP peer so that only the Interconnect path is ever used for reaching the on-prem prefixes
   • DAssign a public ASN to the VPN peer and a private ASN to the Interconnect peer so the Interconnect is automatically preferred
   ✓ Correct answer: A

   Cloud Router selects the best path based on route priority, where a lower priority value means higher preference. By assigning a higher (worse) route priority to routes learned via HA VPN and keeping the Interconnect routes at a lower (better) priority, the VPC always prefers the Interconnect paths when they are healthy. When the Interconnect fails and its routes withdraw, the VPN routes become the only available paths and traffic automatically fails over - no manual intervention required.

   Why the other options are wrong

   • BIdentical priority produces ECMP load-sharing, which contradicts the goal of using the Interconnect whenever it is healthy.
   • CPermanently disabling the VPN peer removes the backup path entirely, defeating the purpose of having a failover route.
   • DASN type (public versus private) does not drive path preference; the correct lever is the MED/route priority difference.
9. Question 9Implementing a VPC networkSelect all that apply

   You want to mirror traffic from a set of production VMs to a security/IDS collector for inspection without placing an appliance inline. Which TWO are required or true about configuring Packet Mirroring in a VPC? (Choose TWO)

   • AA packet mirroring policy names mirrored sources (subnet, tag, or instance) and a collector behind an internal passthrough NLBCorrect
   • BMirrored and collector resources must be in the same region, and the collector NLB needs mirroring enabled on its forwarding ruleCorrect
   • CPacket Mirroring drops the original packets right after copying them to the collector, so it works inline like an appliance
   • DPacket Mirroring only captures packet headers and TCP flag metadata, and it cannot include the packet payload data
   ✓ Correct answer: A, B

   Packet Mirroring clones full traffic (headers and payloads) from selected sources and sends copies to a collector group, which must be fronted by an internal passthrough Network Load Balancer whose forwarding rule has the packet mirroring option enabled. The mirrored instances and the collector must reside in the same region, and the policy specifies what to mirror (by subnet, network tag, or specific instances) and optional filters. Because it copies rather than redirects traffic, it is out-of-band and does not affect the original flow's delivery.

   Why the other options are wrong

   • CPacket Mirroring is out-of-band; it copies packets and never drops or holds the originals, so it is not inline.
   • DPacket Mirroring captures full packets including payloads, not just headers.
10. Question 10Configuring, implementing and managing a cloud network security solution

    You create a new VPC network named prod-vpc and do not add any firewall rules or firewall policies. What is the default connectivity behavior for VMs in this network?

    • AEgress to any destination is allowed, and all ingress is blockedCorrect
    • BBoth ingress and egress are allowed until you add a deny rule
    • CBoth ingress and egress are blocked until you add an allow rule
    • DIngress from the same network is allowed, all egress is blocked
    ✓ Correct answer: A

    Each VPC network includes two implied firewall rules at priority 65535 that cannot be deleted: an implied allow egress rule permitting all outbound traffic, and an implied deny ingress rule blocking all inbound traffic. Until you add higher-priority allow rules, new VMs can initiate outbound connections but accept no unsolicited inbound connections.

    Why the other options are wrong

    • BThis reverses the model, ingress is not open by default; the implied deny ingress rule blocks all inbound traffic.
    • CEgress is not blocked by default, the implied allow egress rule permits all outbound traffic without any rule being added.
    • DThere is no implied same-network ingress allow, and egress is allowed, not blocked, by the implied egress rule.

Related Google resources

• Google Cloud Professional Cloud Network Engineer study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Google Cloud Professional Cloud Security Engineer practice examRelated
• Associate Google Workspace Administrator practice examRelated
• Google Cloud Professional Data Engineer practice examRelated

Google Cloud Professional Cloud Network Engineer practice exam FAQ