PROFESSIONAL-CLOUD-NETWORK-ENGINEER Exam Questions and Answers (Page: 4)

QUESTION: 25

You have a web application that is currently hosted in the us-central1 region. Users experience high latency when traveling in Asia. You've configured a network load balancer, but users have not experienced a performance improvement. You want to decrease the latency.

What should you do?

Configure a policy-based route rule to prioritize the traffic.
Configure an HTTP load balancer, and direct the traffic to it.
Configure Dynamic Routing for the subnet hosting the application.
Configure the TTL for the DNS zone to decrease the time between updates.

Answer(s): B

Reference:

https://cloud.google.com/load-balancing/docs/tutorials/optimize-app-latency

Reveal Solution Next Question

QUESTION: 26

You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.

Which two methods can you use to accomplish this? (Choose two.)

Enable Private Google Access on all the subnets.
Enable Private Google Access on the VPC.
Enable Private Services Access on the VP
Create network peering between your VPC and BigQuery.
Create a Cloud NAT, and route the application traffic via NAT gateway.

Answer(s): A,E

Reveal Solution Next Question

QUESTION: 27

You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google-recommended practices.

How should you design this topology?

Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them. Use firewall rules to filter access between the specific networks.
Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.

Answer(s): D

Reference:

https://cloud.google.com/vpc/docs/shared-vpc

Reveal Solution Next Question

QUESTION: 28

You are adding steps to a working automation that uses a service account to authenticate. You need to give the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.

What should you do?

Grant the compute.instanceAdmin to your user account.
Grant the iam.serviceAccountUser to your user account.
Grant the read-only privilege to the service account for the Cloud Storage bucket.
Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.

Answer(s): C

Reveal Solution Next Question

QUESTION: 29

You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem.

What should you do?

Apply an additional IAM role to the Google API's service account to allow custom mode networks.
Update the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.
Explicitly reference the custom mode networks in the Cloud Armor whitelist.
Explicitly reference the custom mode networks in the Deployment Manager templates.

Answer(s): D

Reveal Solution Next Question

QUESTION: 30

You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.

Which two methods can you use to accomplish this? (Choose two.)

GetIamPolicy() via REST API
SetIamPolicy() via REST API
gcloud pubsub add-iam-policy-binding $projectname --member user:$username -- role roles/editor
gcloud projects add-iam-policy-binding $projectname --member user:$username -- role roles/editor
Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.

Answer(s): D,E

Reference:

https://cloud.google.com/iam/docs/granting-changing-revoking-access

Reveal Solution Next Question

QUESTION: 31

You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.

What should you do on your on-premises servers?

Tune TCP parameters on the on-premises servers.
Compress files using utilities like tar to reduce the size of data being sent.
Remove the -m flag from the gsutil command to enable single-threaded transfers.
Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET_NAME].

Answer(s): A

Reveal Solution Next Question

QUESTION: 32

You work for a multinational enterprise that is moving to GCP.

These are the cloud requirements:

· An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions us-west1 (primary HQ) and us-east4 (backup) · Multiple regional offices in Europe and APAC
· Regional data processing is required in europe-west1 and australia-southeast1 · Centralized Network Administration Team

Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us-west1.

What should you do?

· Create 2 VPCs in a Shared VPC Host Project.
· Configure a 2-NIC instance in zone us-west1-a in the Host Project.
· Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.
· Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.
· Deploy the instance.
· Configure the necessary routes and firewall rules to pass traffic through the instance.
· Create 2 VPCs in a Shared VPC Host Project.
· Configure a 2-NIC instance in zone us-west1-a in the Service Project.
· Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.
· Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.
· Deploy the instance.
· Configure the necessary routes and firewall rules to pass traffic through the instance.
· Create 1 VPC in a Shared VPC Host Project.
· Configure a 2-NIC instance in zone us-west1-a in the Host Project.
· Attach NIC0 in us-west1 subnet of the Host Project.
· Attach NIC1 in us-west1 subnet of the Host Project
· Deploy the instance.
· Configure the necessary routes and firewall rules to pass traffic through the instance.
· Create 1 VPC in a Shared VPC Service Project.
· Configure a 2-NIC instance in zone us-west1-a in the Service Project.
· Attach NIC0 in us-west1 subnet of the Service Project.
· Attach NIC1 in us-west1 subnet of the Service Project
· Deploy the instance.
· Configure the necessary routes and firewall rules to pass traffic through the instance.

Answer(s): B

Reveal Solution Next Question

Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Exam (page: 4) Google Professional Cloud Network Engineer Updated on: 07-Feb-2026

QUESTION: 25

Reference:

QUESTION: 26

QUESTION: 27

Reference:

QUESTION: 28

QUESTION: 29

QUESTION: 30

Reference:

QUESTION: 31

QUESTION: 32

Google PROFESSIONAL-CLOUD-NETWORK-ENGINEER Exam (page: 4)
Google Professional Cloud Network Engineer
Updated on: 07-Feb-2026