Practice Professional-Cloud-Network-Engineer Exam Online

Question 1

You have provisioned a Partner Interconnect connection to extend connectivity from your on-premises data center to Google Cloud. You need to configure a Cloud Router and create a VLAN attachment to connect to resources inside your VPC. You need to configure an Autonomous System number (ASN) to use with the associated Cloud Router and create the VLAN attachment. What should you do?

A : Use a 4-byte private ASN 4200000000-4294967294.

B : Use a 2-byte private ASN 64512-65535.

C : Use a public Google ASN 15169.

D : Use a public Google ASN 16550.

Answer: B

Question 2

Your organization's security team recently discovered that there is a high risk of malicious activities originating from some of your VMs connected to the internet. These malicious activities are currently undetected when TLS communication is used. You must ensure that encrypted traffic to the internet is inspected. What should you do?

A : Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.

B :

Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the tls-inspect flag and associate the firewall rules with the VMs.

C :

Configure a TLS agent on every VM to intercept TLS traffic before it reaches the internet. Configure Sensitive Data Protection to analyze and allow/deny the content.

D :

Use Cloud NGFW Essentials. Create a firewall rule for egress traffic and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.

Answer: B

Question 3

Your organization wants to set up hybrid connectivity with VLAN attachments that terminate in a single Cloud Router with 99.9% uptime. You need to create a network design for your on-premises router that meets those requirements and has an active/passive configuration that uses only one VLAN attachment at a time. What should you do?

A :

Create a design that uses a BGP multi-exit discriminator (MED) attribute to influence the egress path from Google Cloud to the on-premises environment.

B :

Create a design that uses the as_path BGP attribute to influence the egress path from Google Cloud to the on-premises environment.

C :

Create a design that uses an equal-cost multipath (ECMP) with flow-based hashing on your on-premises devices.

D :

Create a design that uses the local_pref BGP attribute to influence the egress path from Google Cloud to the on-premises environment.

Answer: A

Question 4

Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The compute instances that run these applications have an associated secure tag. What should you do?

A :

Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.

B :

Deploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.

C :

Deploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.

D :

Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.

Answer: B

Question 5

You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy. Which GKE resource should you use?

A : GKE Node

B : GKE Pod

C : GKE Cluster

D : GKE Ingress

Answer: D

Name:	Professional Cloud Network Engineer
Exam Code:	Professional-Cloud-Network-Engineer
Certification:	Google Cloud Certified
Vendor:	Google
Total Questions:	235
Last Updated:	May 11, 2026

Google Professional-Cloud-Network-Engineer Answers