Free Professional Cloud Network Engineer Exam Questions and Answers

Last updated: August 30, 2026

Provider

Google

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   You need to centralize the Identity and Access Management permissions and email distribution for the WebServices Team as efficiently as possible. What should you do?

   • A. Create a Google Group for the WebServices Team.
   • B. Create a G Suite Domain for the WebServices Team.
   • C. Create a new Cloud Identity Domain for the WebServices Team.
   • D. Create a new Custom Role for all members of the WebServices Team.
   Reveal Answer

2. Question #2

   You have a storage bucket that contains the following objects: - folder-a/image-a-1.jpg - folder-a/image-a-2.jpg - folder-b/image-b-1.jpg - folder-b/image-b-2.jpg Cloud CDN is enabled on the storage bucket, and all four objects have been successfully cached. You want to remove the cached copies of all the objects with the prefix folder-a, using the minimum number of commands. What should you do?

   • A. Add an appropriate lifecycle rule on the storage bucket.
   • B. Issue a cache invalidation command with pattern /folder-a/*.
   • C. Make sure that all the objects with prefix folder-a are not shared publicly.
   • D. Disable Cloud CDN on the storage bucke
   Reveal Answer

3. Question #3

   You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner's project while minimizing the amount of infrastructure required. Your partner's services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution. What should you do?

   • A. Create one Cloud Router and one HA VPN gateway in each region of your VPC and your partner's VP
   • B. Connect your VPN gateways to the partner's gateway
   • C. Enable global dynamic routing in each VPC.
   • D. Create one Cloud Router and one HA VPN gateway in the us-west1 region of your VP
   Reveal Answer

4. Question #4

   All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance. What should you do?

   • A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
   • B. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
   • C. Generate a new SSH key pai
   • D. Verify the format of the private key and add it to the instanc
   Reveal Answer

5. Question #5

   You need to create the network infrastructure to deploy a highly available web application in the us-east1 and us-west1 regions. The application runs on Compute Engine instances, and it does not require the use of a database. You want to follow Google-recommended practices. What should you do?

   • A. Create one VPC with one subnet in each region.Create a regional network load balancer in each region with a static IP addres
   • B. Enable Cloud CDN on the load balancers.Create an A record in Cloud DNS with both IP addresses for the load balancers.
   • C. Create one VPC with one subnet in each region.Create a global load balancer with a static IP address.Enable Cloud CDN and Google Cloud Armor on the load
   • D. Create one VPC in each region, and peer both VPCs.Create a global load balancer.Enable Cloud CDN on the load balancer.Create a CNAME for the load
   Reveal Answer

6. Question #6

   You recently deployed Cloud VPN to connect your on-premises data canter to Google Cloud. You need to monitor the usage of this VPN and set up alerts in case traffic exceeds the maximum allowed. You need to be able to quickly decide whether to add extra links or move to a Dedicated Interconnect. What should you do?

   • A. In the Network Intelligence Canter, check for the number of packet drops on the VPN.
   • B. In the Google Cloud Console, use Monitoring Query Language to create a custom alert for bandwidth utilization.
   • C. In the Monitoring section of the Google Cloud Console, use the Dashboard section to select a default dashboard for VPN usage.
   • D. In the VPN section of the Google Cloud Console, select the VPN under hybrid connectivity, and then select monitoring to display utilization on the dashboard.
   Reveal Answer

7. Question #7

   You are configuring an HA VPN connection between your Virtual Private Cloud (VPC) and on-premises network. The VPN gateway is named VPN_GATEWAY_1. You need to restrict VPN tunnels created in the project to only connect to your on-premises VPN public IP address: 203.0.113.1/32. What should you do?

   • A. Configure a firewall rule accepting 203.0.113.1/32, and set a target tag equal to VPN_GATEWAY_1.
   • B. Configure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs to use an allowList consisting of only the 203.0.113.1/32 address.
   • C. Configure a Google Cloud Armor security policy, and create a policy rule to allow 203.0.113.1/32.
   • D. Configure an access control list on the peer VPN gateway to deny all traffic except 203.0.113.1/32, and attach it to the primary external interface.
   Reveal Answer

8. Question #8

   You have several microservices running in a private subnet in an existing Virtual Private Cloud (VPC). You need to create additional serverless services that use Cloud Run and Cloud Functions to access the microservices. The network traffic volume between your serverless services and private microservices is low. However, each serverless service must be able to communicate with any of your microservices. You want to implement a solution that minimizes cost. What should you do?

   • A. Deploy your serverless services to the serverless VP
   • B. Peer the serverless service VPC to the existing VP
   • C. Configure firewall rules to allow traffic between the serverless services and your existing microservices.
   • D. Create a serverless VPC access connector for each serverless servic
   Reveal Answer

9. Question #9

   You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN. What should you do?

   • A. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
   • B. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
   • C. Add a second on-premises VPN gateway with a different public IP addres
   • D. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
   Reveal Answer

10. Question #10

    You are configuring a new application that will be exposed behind an external load balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest possible latency while ensuring high availability and autoscaling. Which configuration should you use?

    • A. Use global SSL Proxy Load Balancing with backends in both regions.
    • B. Use global TCP Proxy Load Balancing with backends in both regions.
    • C. Use global external HTTP(S) Load Balancing with backends in both regions.
    • D. Use Network Load Balancing in both regions, and use DNS-based load balancing to direct traffic to the closest region.
    Reveal Answer