Free Professional Cloud Network Engineer practice test: 30 questions with answers

The global external Application Load Balancer terminates HTTPS and routes each request to the closest healthy backend across regions. The regional internal, passthrough and internal options do not provide global external HTTPS routing.

A private managed zone bound to the VPC resolves names only for resources in the bound networks, which keeps internal names private. Public zones publish records externally, forwarding policies route queries rather than hold zones, and Cloud Armor does not filter DNS resolution.

Cloud NAT provides outbound internet access to instances without external IPs, through a NAT gateway configured with a Cloud Router. Load balancing is for inbound traffic, Cloud VPN is for hybrid connectivity, and Private Google Access only reaches Google APIs and services.

Private Google Access on a subnet allows VMs without external IPs to reach Google APIs and services over Google's network. Cloud NAT uses public addressing, load balancers are not used for API access, and removing the default internet route does not provide API reachability.

MX records name the mail exchangers for a domain and their preference order. A and AAAA map hostnames to addresses, and CNAME maps one name to another.

The regional internal Application Load Balancer provides Layer 7 routing for clients inside the VPC in one region. The global external option serves internet clients, and the passthrough options forward packets without HTTP routing.

Cloud Router uses BGP to exchange routes dynamically with on-premises peers, which keeps routes current as networks change. Static routes do not adapt, firewall policies do not exchange routes, and health checks are used by load balancers rather than for route exchange.

Dedicated and Partner Interconnect provide private, high-bandwidth connections with SLA-backed options and do not depend on public internet paths. Cloud VPN over the internet, Cloud NAT and public load balancers all use public connectivity, which the requirement forbids.

HA VPN provides redundant tunnels, and Cloud Router with BGP exchanges routes dynamically. Classic VPN with one static tunnel lacks redundancy, while peering connects VPC networks and NAT does not connect networks in this way.

Custom route advertisements let a Cloud Router advertise additional prefixes to BGP peers beyond the default subnet advertisements. Learning routes is the opposite direction, firewall rules do not advertise routes, and forwarding rules are not route advertisements.

Partner Interconnect connects through a supported service provider, which suits sites that cannot reach a colocation facility directly. Dedicated Interconnect requires a direct physical connection, peering connects VPCs, and classic VPN uses the public internet.

An external or peer VPN gateway resource describes the on-premises device so that the tunnel can be configured against it. Peering groups, NAT gateways and host projects are other resources with different purposes.

VPC Flow Logs record network flows for VM traffic, and firewall rule logging shows which rule allowed or denied a connection. Audit logs record API calls, uptime checks test URLs and Cloud Trace measures request latency, so none of them explain packet decisions.

Connectivity Tests analyze configurations to determine whether traffic can reach its destination and where it is stopped. Profiler, Error Reporting and Cloud Armor address code performance, errors and HTTP filtering, which are not connectivity diagnostics.

Tunnel status, BGP session state and byte counts show whether the VPN is up and carrying traffic, which points to the cause quickly. The backend VM count, application CPU and log counts are downstream and do not show tunnel health.

Minimizing chatty traffic across the link and keeping bulk data near its source both reduce transfer volume and cost. Sending bulk data over the VPN, repeated copies and distant regions each increase cross-boundary traffic and charges.

Flow logs sample flows, and the sampling can be configured, and they can be exported to Cloud Logging and BigQuery. Flow logs do not capture payloads, they are not enabled by default on every subnet, and firewall rule logging is a separate source.

Performance Dashboard shows latency and packet loss over time between regions and zones. Firewall Insights, Network Topology and Connectivity Tests provide other views of the same network.

VPC Network Peering exchanges private routes between two networks without going over the internet, and it is not transitive. Cloud NAT, public load balancers and external IPs all send traffic through public addressing, which the requirement forbids.

Compute Network User on a subnet allows service project users to create resources that use it, which is the least-privilege grant for consumption. Network Admin is broader than needed, Viewer cannot create instances, and Owner on the host project is far more than required.

In Shared VPC the host project owns the network and subnets, and service projects use them while retaining their own billing and IAM for compute resources. The other statements invert ownership or limit the scope of the sharing in ways that do not match the product.

Google Cloud supports expanding a subnet's primary IP range to a larger prefix that contains the original range, without recreating it. Deleting the subnet changes addresses, moving VMs to another network is disruptive, and changing region is not how expansion works.

Firewall rules are evaluated from the lowest priority number to the highest, so 0 is evaluated first. The implied rules use the largest value, and the other numbers are ordinary defaults that are evaluated later.

VPC firewall rules are stateful, and they can target instances by network tags or service accounts. Ingress is denied by default rather than allowed, custom mode networks use firewall rules, and priorities do determine evaluation order.

Google Cloud VPC networks are global, and their subnets are regional, so one network can cover several regions. Regional meshes of tunnels, legacy networks and per-region host projects add complexity that the requirement avoids.

Non-overlapping private ranges with room for growth, which also do not clash with on-premises networks, prevent costly readdressing later. Tiny ranges run out, identical ranges conflict when networks are connected, and public ranges are not the usual design for private subnets.

Auto mode creates a subnet per region with predefined ranges, and it can be converted to custom mode when the team needs control over ranges. Custom mode starts empty, legacy networks are deprecated, and hybrid is not a VPC subnet mode.

VPC networks are global, so workload distribution across regions and the sharing model shape the design choice. Diagram colors, console banners and VM names do not affect network architecture decisions.

Shared VPC keeps the subnets centrally managed, while hierarchical firewall policies at folder level let each unit govern rules within its scope. Separate networks break the central subnet model, a shared project gives Owner too broadly, and legacy networks are deprecated.

VPC Service Controls creates a perimeter that blocks access to protected services from outside the perimeter, even with valid credentials. Cloud Armor and firewall rules filter network traffic to workloads, and IAM Conditions do not stop access to APIs from outside.