Free Professional Cloud Network Engineer Exam Questions and Answers

Last updated: September 19, 2026

Provider

Google

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   You are configuring a new application that will be exposed behind an external load balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest possible latency while ensuring high availability and autoscaling. Which configuration should you use?

   • A. Use global SSL Proxy Load Balancing with backends in both regions.
   • B. Use global TCP Proxy Load Balancing with backends in both regions.
   • C. Use global external HTTP(S) Load Balancing with backends in both regions.
   • D. Use Network Load Balancing in both regions, and use DNS-based load balancing to direct traffic to the closest region.
   Reveal Answer

2. Question #2

   You have a Cloud Storage bucket in Google Cloud project XYZ. The bucket contains sensitive data. You need to design a solution to ensure that only instances belonging to VPCs under project XYZ can access the data stored in this Cloud Storage bucket. What should you do?

   • A. Configure Private Google Access to privately access the Cloud Storage service using private IP addresses.
   • B. Configure a VPC Service Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter.
   • C. Configure Cloud Storage with projectPrivate Access Control List (ACL) that gives permission to the project team based on their roles.
   • D. Configure Private Service Connect to privately access Cloud Storage from all VPCs under project XYZ.
   Reveal Answer

3. Question #3

   Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments. • Each organization has enabled full connectivity between all of its projects by using Shared VPC. • Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic. • There are no prefix overlaps between the two organizations. • Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space. • Neither organization has Interconnects to their on-premises environment. You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime. Which two steps should you take? (Choose two.)

   Select 2 answers.

   • A. Provision Cloud Interconnect to connect both organizations together.
   • B. Set up some variant of DNS forwarding and zone transfers in each organization.
   • C. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
   • D. Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
   • E. Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC.
   Reveal Answer

4. Question #4

   You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services. Which session affinity should you choose?

   • A. None
   • B. Client IP
   • C. Client IP and protocol
   • D. Client IP, port and protocol
   Reveal Answer

5. Question #5

   You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template. How should you update your instances?

   • A. Manually patch some of the instances, and then perform a rolling restart on the instance group.
   • B. Using the new instance template, perform a rolling update across all instances in the instance group.Verify the new feature once the rollout completes.
   • C. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
   • D. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
   Reveal Answer

6. Question #6

   You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection. Which two actions can accomplish this? (Choose two.)

   Select 2 answers.

   • A. Open a Cloud Support ticket under the Cloud Interconnect category.
   • B. Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
   • C. Run gcloud compute interconnects describe <interconnect>.
   • D. Check the email for the account of the NOC contact that you specified during the ordering process.
   • E. Contact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.
   Reveal Answer

7. Question #7

   You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem. What should you do?

   • A. Apply an additional IAM role to the Google API’s service account to allow custom mode networks.
   • B. Update the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.
   • C. Explicitly reference the custom mode networks in the Cloud Armor whitelist.
   • D. Explicitly reference the custom mode networks in the Deployment Manager templates.
   Reveal Answer

8. Question #8

   You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In one of your instances you notice the master is not responding, even though the cluster is up and running. What should you do to solve the problem?

   • A. Assign a public IP address to the instance.
   • B. Create a route to reach the Master, pointing to the default internet gateway.
   • C. Create the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance.
   • D. Create the appropriate master authorized network entries to allow the instance to communicate to the master.
   Reveal Answer

9. Question #9

   You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules. Always allow Secure Shell (SSH) from your corporate IP address. Restrict SSH access from all other IP addresses. There are multiple projects and VPCs in your Google Cloud organization. You need to ensure that other VPC firewall rules cannot bypass the security team’s requirements. What should you do?

   • A. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 0.Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 1.
   • B. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0.Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 1.
   • C. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1.Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 0.
   • D. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 1Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 0.
   Reveal Answer

10. Question #10

    You need to enable Cloud CDN for all the objects inside a storage bucket. You want to ensure that all the object in the storage bucket can be served by the CDN. What should you do in the GCP Console?

    • A. Create a new cloud storage bucket, and then enable Cloud CDN on it.
    • B. Create a new TCP load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.
    • C. Create a new SSL proxy load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.
    • D. Create a new HTTP load balancer, select the storage bucket as a backend, enable Cloud CDN on the backend, and make sure each object inside the storage bucket is shared publicly.
    Reveal Answer