Question bank
Professional Cloud Network Engineer
42 Professional Cloud Network Engineer questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Configuring network services
8 questions in this domain
- Question 1Single Choice
Which Google Cloud connectivity solution requires physical presence in a colocation facility and supports 10 Gbps or 100 Gbps circuits?
- ADedicated InterconnectCorrect answer
- BPartner Interconnect
- CCloud VPN
- DDNS Peering
Why this is the answer
Dedicated Interconnect requires a physical presence in a Google colocation facility and offers 10 Gbps or 100 Gbps circuits. Partner Interconnect uses a service provider and lower bandwidth increments.
- Question 2Multiple Select
Which components are mandatory for an Interconnect deployment? (Select all that apply.)
- ACloud Router for BGP sessionsCorrect answer
- BVLAN attachmentsCorrect answer
- CStatic routes without BGP
- DCloud VPN tunnel on the same link
Why this is the answer
Interconnect requires Cloud Router for BGP dynamic routing and VLAN attachments to connect VPCs to the physical link. Static routing is not supported, and Cloud VPN is a different connectivity option.
- Question 3Interactive
Refer to the gcloud command. What resource is being created?
- AVLAN attachment for Dedicated InterconnectCorrect answer
- BCloud Router BGP session
- CPartner Interconnect connection
- DCloud VPN tunnel
Why this is the answer
The command creates a VLAN attachment for a Dedicated Interconnect by specifying the interconnect resource, router, region, and VLAN tag.
- Question 4Single Choice
To meet the 99.99% SLA for Dedicated Interconnect, what architecture is required?
- ATwo connections in one metro area
- BRedundant connections across two distinct edge availability domainsCorrect answer
- CA single Dedicated Interconnect circuit with BGP
- DOne Dedicated Interconnect plus one Partner Interconnect in same metro
Why this is the answer
To achieve 99.99% SLA, Google requires redundant connections across two distinct edge availability domains, or metropolitan areas. 99.9% may be achieved within a single metro area.
- Question 5Multiple Select
Which statements about Cloud DNS inbound and outbound policies are true? (Select all that apply.)
- AInbound DNS policy allows on-premises clients to resolve Google Cloud private DNS zones.Correct answer
- BOutbound DNS policy forwards VPC queries for specific domains to external DNS servers.Correct answer
- CInbound and outbound policies can operate without VPN or Interconnect connectivity.
- DDNS Peering can replace a forwarding rule to reach on-premises servers.
Why this is the answer
Inbound DNS policy lets on-premises clients resolve private zones, while outbound DNS policy forwards VPC queries to external DNS servers. Both require underlying VPN or Interconnect connectivity to reach the proxy IPs.
- Question 6Interactive
Refer to the gcloud command. What type of DNS zone is being created?
- ACloud DNS private zone visible only to authorized VPC networks.Correct answer
- BPublic DNS zone
- CDNS peering zone
- DOutbound forwarding zone
Why this is the answer
A private DNS zone is created with --visibility=private and is only visible to authorized VPC networks. It is not a public zone, peering zone, or forwarding zone.
- Question 7Single Choice
Which mechanism should be used to share a DNS zone between two VPC networks?
- ADNS PeeringCorrect answer
- BInbound DNS policy
- COutbound DNS policy
- DDedicated Interconnect
Why this is the answer
DNS Peering is the mechanism to share a DNS zone between VPC networks. Inbound and outbound policies are for hybrid cloud DNS resolution, not VPC-to-VPC sharing.
- Question 8Multiple Select
Which statements correctly contrast Cloud VPN and Interconnect? (Select all that apply.)
- ACloud VPN is encrypted over the internet and may be affected by jitter.Correct answer
- BInterconnect provides predictable, high-speed performance.Correct answer
- CCloud VPN is recommended for massive bandwidth needs.
- DInterconnect is encrypted over the public internet.
Why this is the answer
Cloud VPN is encrypted over the internet and subject to jitter, while Interconnect provides predictable, high-speed performance. For massive bandwidth needs, Dedicated Interconnect is recommended.
Designing and planning a VPC network
10 questions in this domain
- Question 9Single Choice
Which Cloud Interconnect option requires a direct physical connection in a Google colocation facility?
- ADedicated InterconnectCorrect answer
- BPartner Interconnect
- CCloud VPN
- DCloud NAT
Why this is the answer
Dedicated Interconnect requires a physical presence in a Google colocation facility and provides a direct physical connection to Google's edge network.
- Question 10Multiple Select
Which two components are required for Cloud Interconnect and HA VPN to dynamically exchange routes with on-premises networks?
- ACloud RouterCorrect answer
- BBGPCorrect answer
- CStatic routing protocol
- DCloud DNS
Why this is the answer
Cloud Interconnect and HA VPN require Cloud Router and BGP for dynamic route exchange; static routes are not supported.
- Question 11Interactive
In the code block, what type of logical interface is being defined?
- AVLAN AttachmentCorrect answer
- BCloud Router
- CDedicated Interconnect circuit
- DCloud DNS private zone
Why this is the answer
The code block creates a VLAN attachment, which is the logical interface used to connect a VPC to an interconnect.
- Question 12Single Choice
According to Google Cloud HA guidance, what SLA is supported by two connections located within one metro area?
- A99.9%Correct answer
- B99.99%
- C99.95%
- D100%
Why this is the answer
Two connections in one metro area provide a 99.9% SLA; 99.99% requires redundancy across two distinct edge availability domains.
- Question 13Multiple Select
Which statements accurately describe Dedicated Interconnect? (Select all that apply.)
- ARequires physical presence in a Google colocation facilityCorrect answer
- BSupports 10 Gbps or 100 Gbps circuitsCorrect answer
- CUses Cloud Router and BGP for routingCorrect answer
- DOffers bandwidth increments from 50 Mbps to 50 Gbps
Why this is the answer
Dedicated Interconnect requires a colocation presence, supports 10/100 Gbps circuits, and uses Cloud Router/BGP. Lower bandwidth increments are a Partner Interconnect characteristic.
- Question 14Interactive
What type of DNS resource is being configured in the code block?
- ACloud DNS Private ZoneCorrect answer
- BInbound DNS policy
- COutbound DNS policy
- DDNS Peering
Why this is the answer
The snippet creates a Cloud DNS private zone, which is visible only to authorized VPC networks and used for internal service discovery.
- Question 15Single Choice
What is the purpose of Cloud DNS forwarding zones?
- ARedirect queries for a specific domain to an inbound or outbound IP addressCorrect answer
- BReplace Cloud Interconnect for hybrid connectivity
- CEncrypt DNS traffic over the public internet
- DEstablish a BGP session between VPCs
Why this is the answer
Cloud DNS forwarding zones redirect queries for a specified domain to an inbound or outbound IP address, enabling hybrid DNS resolution.
- Question 16Multiple Select
Which options are Cloud DNS features used for private and hybrid name resolution? (Select all that apply.)
- AInbound DNS policyCorrect answer
- BOutbound DNS policyCorrect answer
- CDNS PeeringCorrect answer
- DCloud Router
Why this is the answer
Inbound DNS policy, outbound DNS policy, and DNS peering are Cloud DNS features; Cloud Router is a routing component for Interconnect and VPN.
- Question 17Interactive
When a VPC resource needs to resolve hostnames on a legacy on-premises DNS server, which DNS policy type is shown in the code block?
- AOutbound DNS policyCorrect answer
- BInbound DNS policy
- CDNS Peering
- DPrivate zone
Why this is the answer
The code block defines an outbound DNS policy, which forwards queries from VPC resources to external DNS servers such as on-premises resolvers.
- Question 18Single Choice
What is required to achieve a 99.99% SLA for Interconnect?
- ARedundant connections across two distinct edge availability domainsCorrect answer
- BTwo connections in the same metro area
- COne connection with multiple VLAN attachments
- DTwo connections in the same colocation facility
Why this is the answer
A 99.99% SLA requires redundant connections across two distinct edge availability domains; a single metro only supports 99.9%.
Hybrid connectivity
8 questions in this domain
- Question 19Single Choice
Which type of Interconnect requires a physical presence in a Google colocation facility and provides 10 Gbps or 100 Gbps circuits?
- ADedicated InterconnectCorrect answer
- BPartner Interconnect
- CCloud VPN
- DCloud DNS Peering
Why this is the answer
Dedicated Interconnect is the direct physical connection housed in Google colocation facilities, supporting 10 Gbps or 100 Gbps circuits.
- Question 20Multiple Select
Which statements about Interconnect high-availability requirements are correct?
- ATwo connections within one metro area can support a 99.9% SLA.Correct answer
- BA single Dedicated Interconnect circuit is enough for a 99.99% SLA.
- C99.99% SLA requires redundant connections across two distinct edge availability domains.Correct answer
- DCloud VPN over the internet provides the same predictable performance as Interconnect.
Why this is the answer
For 99.9%, two links in one metro suffice; for 99.99%, redundancy must span two metropolitan areas. Single circuits are single points of failure.
- Question 21Interactive
Review the configuration snippet. What must be configured on the Cloud Router to enable dynamic route exchange for this VLAN attachment?
- AConfigure a BGP session with the on-premises peerCorrect answer
- BDeploy Cloud NAT
- CCreate a DNS peering zone
- DAdd a static default route to Google
Why this is the answer
Cloud Router uses BGP to exchange routes. Without a BGP session, the VLAN attachment cannot dynamically route traffic between on-premises and VPC.
- Question 22Single Choice
Which service is appropriate for an organization that cannot place equipment in a Google colocation facility and needs a 200 Mbps connection?
- APartner InterconnectCorrect answer
- BDedicated Interconnect
- CCloud VPN
- DDNS Peering
Why this is the answer
Partner Interconnect is delivered through supported providers and supports 50 Mbps to 50 Gbps, so it suits 200 Mbps requirements without colocation equipment.
- Question 23Multiple Select
Which statements about Cloud DNS inbound/outbound policies and DNS peering are correct?
- AInbound DNS policy lets on-premises clients resolve Google Cloud private DNS zones.Correct answer
- BOutbound DNS policy forwards queries for specified domains to external DNS servers.Correct answer
- CDNS policies will work even without VPN or Interconnect connectivity.
- DDNS peering natively bridges a VPC to an on-premises network.
Why this is the answer
Inbound answers on-premises queries for private zones; outbound forwards VPC queries to external servers. Both require underlying connectivity, and peering connects VPCs, not on-premises.
- Question 24Interactive
Review the outbound DNS forwarding configuration. Where will VPC resources send matching domain queries?
- AThe on-premises DNS servers at 10.0.0.5 and 10.0.0.6Correct answer
- BGoogle Public DNS at 8.8.8.8
- CCloud DNS private zone records
- DVPC peering networks
Why this is the answer
An outbound forwarding policy sends matching queries to the listed on-premises DNS server addresses, allowing VPC resources to resolve internal hostnames.
- Question 25Single Choice
Which DNS feature shares a zone between two VPC networks and supports centralized management in hub-and-spoke topologies?
- ADNS peeringCorrect answer
- BInbound DNS policy
- COutbound DNS policy
- DCloud Interconnect
Why this is the answer
DNS peering allows two VPC networks to share zones, making it a common building block for hub-and-spoke DNS architecture.
- Question 26Multiple Select
Select the true statements about Dedicated Interconnect and Partner Interconnect.
- ADedicated Interconnect supports 10 Gbps and 100 Gbps circuits.Correct answer
- BPartner Interconnect supports bandwidth from 50 Mbps up to 50 Gbps.Correct answer
- CCloud VPN offers the same predictability as Interconnect for high-throughput workloads.
- DPartner Interconnect requires physical presence in a Google colocation facility.
Why this is the answer
Dedicated circuits are 10/100 Gbps at colocation; Partner Interconnect offers 50 Mbps–50 Gbps through providers and does not require colocation presence.
Implementing a VPC network
8 questions in this domain
- Question 27Single Choice
In hybrid cloud networking, which statement correctly defines Dedicated Interconnect and its primary characteristics?
- ADirect physical connection at a Google colocation facilityCorrect answer
- BEncrypted tunnel over the public internet
- CService provider bridges on-premises to Google Cloud
- DLogical interface connecting VPC to an interconnect
Why this is the answer
Dedicated Interconnect is a direct physical link in a Google colocation facility, designed for high-bandwidth, predictable hybrid connectivity.
- Question 28Multiple Select
Which elements are required to achieve a 99.99% availability SLA for an Interconnect deployment? Choose all that apply.
- ACloud VPN as primary transport for high throughput
- BRedundant connections in two distinct metro areasCorrect answer
- COne Dedicated Interconnect circuit in one metro
- DBGP sessions managed by Cloud RouterCorrect answer
Why this is the answer
A 99.99% SLA requires redundant connections across two distinct edge availability domains; Cloud Router/BGP is required for dynamic routing. A single circuit or VPN does not meet this SLA.
- Question 29Interactive
In the gcloud command shown, what is the function of the flag that references the Cloud Router resource?
- ASpecifies the on-premises router
- BSelects the VPC network
- CIdentifies the Cloud Router managing BGP sessionsCorrect answer
- DEnables static routing instead of BGP
Why this is the answer
The router flag names the Cloud Router that manages BGP sessions for the VLAN attachment, enabling route exchange between on-premises and VPC.
- Question 30Single Choice
A company has no presence in a Google colocation facility and needs 200 Mbps of interconnect bandwidth. Which connection type should it choose?
- ADedicated Interconnect
- BPartner InterconnectCorrect answer
- CCloud VPN
- DDNS Peering
Why this is the answer
Partner Interconnect uses a service provider and supports lower bandwidth increments, making it ideal for organizations without a colocation location.
- Question 31Multiple Select
Which statements correctly describe Cloud DNS inbound and outbound policies in a hybrid cloud? Select all that apply.
- AInbound forwards VPC queries to on-prem DNS servers
- BOutbound forwards VPC queries to on-prem DNS serversCorrect answer
- CBoth policies require VPN or Interconnect connectivityCorrect answer
- DInbound lets on-prem clients resolve private zonesCorrect answer
Why this is the answer
Inbound policies allow on-premises clients to query private zones; outbound policies forward VPC domain queries to on-prem DNS. Both depend on VPN or Interconnect connectivity.
- Question 32Interactive
In the Cloud DNS policy command shown, what does the flag that enables inbound forwarding allow?
- AForwards VPC queries to on-prem DNS servers
- BAllows on-prem clients to resolve private zones through a VPC IPCorrect answer
- CPeers DNS between two VPCs
- DExposes private zones to public internet
Why this is the answer
The enable-inbound-forwarding flag makes Cloud DNS accept queries from on-premises clients and resolve private zones through a VPC-internal IP address.
- Question 33Single Choice
Which resource represents the logical interface that connects a VPC network to an Interconnect?
- ACloud Router
- BBGP session
- CVLAN attachmentCorrect answer
- DCloud DNS private zone
Why this is the answer
A VLAN attachment is the logical interface that connects a VPC to an Interconnect link, mapped to a VLAN ID.
- Question 34Multiple Select
Which statements about Cloud Router and BGP in an Interconnect architecture are true? Select all that apply.
- AStatic routes can replace Cloud Router
- BCloud Router manages BGP sessionsCorrect answer
- CMED and AS-Path affect route selectionCorrect answer
- DInterconnect depends on Cloud Router/BGPCorrect answer
Why this is the answer
Cloud Router establishes BGP sessions and exchanges routes; BGP attributes such as MED and AS-Path are used for traffic engineering. Static routes do not replace Cloud Router for Interconnect.
Managing network operations
8 questions in this domain
- Question 35Single Choice
What is a fundamental requirement for establishing a Dedicated Interconnect connection?
- AA supported service provider
- BA physical presence in a Google colocation facilityCorrect answer
- CA public internet connection
- DA Cloud VPN tunnel
Why this is the answer
Dedicated Interconnect provides a direct physical connection and requires a physical presence in a Google colocation facility, unlike Partner Interconnect which uses a service provider.
- Question 36Multiple Select
Which statements about Interconnect high availability architectures are correct? (Choose all that apply.)
- ATwo connections in one metro area are enough for a 99.9% SLA.Correct answer
- BA 99.99% SLA requires redundant connections across two distinct edge availability domains.Correct answer
- CA single Dedicated Interconnect circuit provides high availability.
- DA 99.9% SLA is always achieved with a single connection.
Why this is the answer
For 99.9% SLA, two connections in one metro area are required; for 99.99%, redundant connections must span two distinct edge availability domains. A single circuit is a single point of failure.
- Question 37Interactive
The configuration snippet defines a Cloud Router resource. What routing protocol does it enable for Interconnect?
- ABGPCorrect answer
- BOSPF
- CIS-IS
- DEIGRP
Why this is the answer
Interconnect relies on Border Gateway Protocol (BGP) for dynamic routing; Cloud Router manages BGP sessions.
- Question 38Single Choice
What is a VLAN attachment in the context of Cloud Interconnect?
- AA logical interface that maps a VPC to the InterconnectCorrect answer
- BA physical cable in the colocation facility
- CA VPN gateway in Google Cloud
- DA DNS forwarding rule
Why this is the answer
A VLAN attachment is the logical interface used to connect your VPC to the Interconnect; for Dedicated Interconnect, it maps to a VLAN ID on the physical link.
- Question 39Multiple Select
Which statements about Partner Interconnect are accurate? (Choose all that apply.)
- AIt uses a supported service provider to connect to Google Cloud.Correct answer
- BIt is ideal for organizations without a presence in a Google colocation facility.Correct answer
- CIt requires a physical presence in a Google colocation facility.
- DIt supports bandwidth increments from 50 Mbps to 50 Gbps.Correct answer
Why this is the answer
Partner Interconnect uses a supported service provider, is suited for environments without a Google colocation presence, and supports lower bandwidth increments; Dedicated Interconnect requires colocation presence.
- Question 40Interactive
Review the DNS zone configuration in the code block. What type of zone is being created?
- ACloud DNS Private ZoneCorrect answer
- BPublic DNS zone
- CDNS peering zone
- DForwarding zone
Why this is the answer
The configuration creates a private DNS zone visible only to authorized VPC networks, used for internal service discovery.
- Question 41Single Choice
What is the primary purpose of a Cloud DNS forwarding zone?
- AIt redirects queries for a specific domain to an inbound or outbound IP address.Correct answer
- BIt creates a public hosted zone on the internet.
- CIt replaces Cloud VPN for hybrid connectivity.
- DIt shares DNS zones between VPC networks without IP forwarding.
Why this is the answer
Forwarding zones redirect queries for a specific domain to an inbound or outbound IP address, enabling hybrid DNS resolution.
- Question 42Multiple Select
Which conditions are required for an outbound DNS policy to work correctly? (Choose all that apply.)
- AThe underlying Cloud VPN or Cloud Interconnect must properly route traffic to the DNS proxy IPs.Correct answer
- BThe DNS proxy IPs must be reachable from the VPC.Correct answer
- CA public DNS zone must be registered with a registrar.
- DCloud NAT must be configured on every subnet.
Why this is the answer
Outbound DNS policy requires working hybrid connectivity and reachability to DNS proxy IPs; public registration and Cloud NAT are not prerequisites.
Frequently asked questions
Everything about the Professional Cloud Network Engineer question bank and how to use it.