What are the prerequisites for taking the Professional Cloud Network Engineer exam?

Google recommends that candidates have at least 3 years of experience with Google Cloud Platform (GCP) and be familiar with GCP networking services. You should also have a solid understanding of network design, implementation, and management concepts. There are no formal prerequisites, but hands-on experience with GCP networking is essential for success.

How long is the Professional Cloud Network Engineer exam and what is the passing score?

The exam is 2 hours long and consists of multiple-choice and multiple-select questions. You need to achieve a score of approximately 70% or higher to pass the exam, though Google does not publicly disclose the exact passing percentage.

What topics are covered on the Professional Cloud Network Engineer certification exam?

The exam covers key areas including VPC networks, hybrid connectivity, load balancing, cloud DNS, cloud CDN, network security, Cloud Armor, VPN and Interconnect technologies. It also includes monitoring and troubleshooting, as well as designing and implementing Google Cloud network solutions.

How much does the Professional Cloud Network Engineer exam cost?

The exam costs $200 USD. Some regions may have different pricing, and you should check the Google Cloud certification website for pricing in your specific country or region.

What is the validity period of the Professional Cloud Network Engineer certification?

The Professional Cloud Network Engineer certification is valid for 3 years from the date you pass the exam. After 3 years, you will need to recertify by passing the exam again to maintain your certified status.

Free Google Professional-Cloud-Network-Engineer Exam Questions

Q1 MultipleChoice

Your organization is developing a landing zone architecture with the following requirements:

There should be no communication between production and non-production environments.

Communication between applications within an environment may be necessary.

Network administrators should centrally manage all network resources, including subnets, routes, and firewall rules.

Each application should be billed separately.

Developers of an application within a project should have the autonomy to create their compute resources.

Up to 1000 applications are expected per environment.

You need to create a design that accommodates these requirements. What should you do?

ACreate a design where each project has its own VPC. Ensure all VPCs are connected by a Network Connectivity Center hub that is centrally managed by the network team.

BCreate a design that implements a single Shared VPC. Use VPC firewall rules with secure tags to enforce micro-segmentation between environments.

CCreate a design that has one host project with a Shared VPC for the production environment, another host project with a Shared VPC for the non-production environment, and a service project that is associated with the corresponding host project for each initiative.

DCreate a design that has a Shared VPC for each project. Implement hierarchical firewall policies to apply micro-segmentation between VPCs.

Correct Answer: C

Explanation:

This design allows you to separate production and non-production environments while using Shared VPCs. Each environment has its own Shared VPC, and a service project is associated with each, allowing for separate billing and autonomy for developers. Centralized management of network resources is handled by the host projects.

Q2 MultipleChoice

You are designing the architecture for your organization so that clients can connect to certain Google APIs. Your plan must include a way to connect to Cloud Storage and BigQuery. You also need to ensure the traffic does not traverse the internet. You want your solution to be cloud-first and require the least amount of configuration steps. What should you do?

AConfigure Private Google Access on the VPC resource. Create a default route to the internet.

BConfigure Private Google Access on the subnet resource. Create a default route to the internet.

CConfigure Cloud NAT and remove the default route to the internet.

DConfigure a global Secure Web Proxy and remove the default route to the internet.

Correct Answer: B

Explanation:

Enabling Private Google Access on the subnet allows VMs to access Google APIs (like Cloud Storage and BigQuery) directly, without routing traffic over the internet. This approach is cloud-native and involves minimal setup, aligning with a cloud-first strategy.

Q3 MultipleChoice

One instance in your VPC is configured to run with a private IP address only. You want to ensure that even if this instance is deleted, its current private IP address will not be automatically assigned to a different instance.

In the GCP Console, what should you do?

AAssign a public IP address to the instance.

BAssign a new reserved internal IP address to the instance.

CChange the instance's current internal IP address to static.

DAdd custom metadata to the instance with key internal-address and value reserved.

Correct Answer: C

Explanation:

https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address#reservenewip Since here https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address#reservenewip it is written that 'automatically allocated or an unused address from an existing subnet'.

Q4 MultipleChoice

Your organization is implementing a new security policy to control how firewall rules are applied to control flows between virtual machines (VMs). Using Google-recommended practices, you need to set up a firewall rule to enforce strict control of traffic between VM A and VM B. You must ensure that communications flow only from VM A to VM B within the VPC, and no other communication paths are allowed. No other firewall rules exist in the VPC. Which firewall rule should you configure to allow only this communication path?

AFirewall rule direction: ingress
Action: allow
Target: VM B service account
Source ranges: VM A service account
Priority: 1000

BFirewall rule direction: ingress
Action: allow
Target: specific VM B tag
Source ranges: VM A tag and VM A source IP address
Priority: 1000

CFirewall rule direction: ingress
Action: allow
Target: VM A service account
Source ranges: VM B service account and VM B source IP address
Priority: 100

DFirewall rule direction: ingress
Action: allow
Target: specific VM A tag
Source ranges: VM B tag and VM B source IP address
Priority: 100

Correct Answer: D

Q5 MultipleChoice

Your organization's security policy requires that all internet-bound traffic return to your on-premises data center through HA VPN tunnels before egressing to the internet, while allowing virtual machines (VMs) to leverage private Google APIs using private virtual IP addresses 199.36.153.4/30. You need to configure the routes to enable these traffic flows. What should you do?

AConfigure a custom route 0.0.0.0/0 with a priority of 500 whose next hop is the default internet gateway. Configure another custom route 199.36.153.4/30 with priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.

BConfigure a custom route 0.0.0.0/0 with a priority of 1000 whose next hop is the internet gateway. Configure another custom route 199.36.153.4/30 with a priority of 500 whose next hop is the VPN tunnel back to the on-premises data center.

CAnnounce a 0.0.0.0/0 route from your on-premises router with a MED of 1000. Configure a custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the default internet gateway.

DAnnounce a 0.0.0.0/0 route from your on-premises router with a MED of 500. Configure another custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the VPN tunnel back to the on-
premises data center.

Correct Answer: A

Professional-Cloud-Network-Engineer Exam Questions & Answers

Sample Professional-Cloud-Network-Engineer Questions

Frequently Asked Questions

Pass Professional-Cloud-Network-Engineer First Time