Professional Cloud Network Engineer

Last checked October 22, 2026 against the official Google Cloud exam page.

1. Question 1Configure managed network services

   A web application needs an external HTTPS load balancer that routes each request to the nearest healthy backend across two regions. Which load balancer type fits?

   1. ARegional internal Application Load Balancer, which serves only clients inside the VPC network in one region
   2. BExternal passthrough Network Load Balancer, which forwards TCP and UDP traffic without terminating HTTP sessions
   3. CInternal passthrough Network Load Balancer, which balances traffic among VMs inside one region of the network
   4. DGlobal external Application Load Balancer, which terminates HTTPS and routes regionally
   Show answer and explanationHide answer

   Correct answer: D

   The global external Application Load Balancer terminates HTTPS and routes each request to the closest healthy backend across regions. The regional internal, passthrough and internal options do not provide global external HTTPS routing.

2. Question 2Configure and implement hybrid and multi-cloud network interconnectivity

   Which Cloud Router capability exchanges routes dynamically between the VPC and on-premises networks over Cloud VPN or Cloud Interconnect?

   1. AStatic routes entered manually for every on-premises prefix on each VM instance in the VPC network
   2. BFirewall policies that match the on-premises addresses and allow the traffic to pass the boundary
   3. CLoad balancer health checks that tell the Cloud Router which backends are reachable on the peer network
   4. DDynamic routing with BGP sessions, which exchange route advertisements between the Cloud Router and the peer
   Show answer and explanationHide answer

   Correct answer: D

   Cloud Router uses BGP to exchange routes dynamically with on-premises peers, which keeps routes current as networks change. Static routes do not adapt, firewall policies do not exchange routes, and health checks are used by load balancers rather than for route exchange.

3. Question 3Manage, monitor, and troubleshoot network operations

   A team needs to know which rule allowed or denied a connection from a VM, and it needs flow records for the traffic. Which tools provide this?

   1. AVPC Flow Logs and firewall rule logging, which record flows and show which rule allowed or denied them
   2. BCloud Audit Logs data access logs, which record each API call to the Compute Engine service in the project
   3. CCloud Monitoring uptime checks, which report whether a URL responds but not the packets that were dropped
   4. DCloud Trace spans, which record latency for each request between services but not the network packets involved
   Show answer and explanationHide answer

   Correct answer: A

   VPC Flow Logs record network flows for VM traffic, and firewall rule logging shows which rule allowed or denied a connection. Audit logs record API calls, uptime checks test URLs and Cloud Trace measures request latency, so none of them explain packet decisions.

4. Question 4Implement a Google Cloud VPC network

   Two VPC networks in different projects must exchange traffic on private IP addresses, without using the public internet and without transitive routing through either network. Which option fits?

   1. ACloud NAT on each network so that the networks reach each other through public addresses on the internet
   2. BA public load balancer in front of one network that forwards the other network's traffic to its backends
   3. CVPC Network Peering between the two networks, which exchanges subnet routes privately without transit
   4. DExternal IP addresses on every VM in both networks, with firewall rules that allow traffic between them
   Show answer and explanationHide answer

   Correct answer: C

   VPC Network Peering exchanges private routes between two networks without going over the internet, and it is not transitive. Cloud NAT, public load balancers and external IPs all send traffic through public addressing, which the requirement forbids.

5. Question 5Design and plan a Google Cloud VPC network

   A company needs one VPC network that spans several regions, with subnets in each region and no per-region network to manage. Which network property meets this requirement?

   1. AGlobal VPC network with regional subnets, which spans all regions without separate networks per region
   2. BRegional VPC networks in each region connected with a full mesh of VPN tunnels
   3. CLegacy networks with an auto-assigned range that spans all regions in the project automatically
   4. DShared VPC with one host project per region, so that each region's subnets belong to a different network
   Show answer and explanationHide answer

   Correct answer: A

   Google Cloud VPC networks are global, and their subnets are regional, so one network can cover several regions. Regional meshes of tunnels, legacy networks and per-region host projects add complexity that the requirement avoids.