Google Cloud Network Engineer Professional

1. 1.A global web application must serve users from the closest Google edge with traffic entering Google's network as early as possible, and the company accepts higher egress cost for better performance. Which network service tier should be selected?

   • APremium TierCorrect answer
   • BStandard Tier
   • CEnterprise Tier
   • DGlobal Tier

   Why

   Premium Tier carries traffic over Google's global backbone, entering at the edge point of presence closest to the user, which delivers the lowest latency at a higher price. Standard Tier routes over the public internet until close to the destination region and costs less, and there is no Enterprise or Global tier in the network service tiers model.

2. 2.An organization needs a single VPC network whose subnets are consumed by workloads in 30 separate projects, with one team owning all subnets, routes, and firewall rules. Which design should be used?

   • AShared VPC with a host project and service projectsCorrect answer
   • BVPC Network Peering between all 30 projects
   • CAn independent VPC in each project
   • DPrivate Service Connect endpoints in each project

   Why

   Shared VPC places the network in a host project owned by the network team and attaches service projects whose workloads use the shared subnets, which centralizes network control across many projects. VPC Network Peering connects independently owned networks without centralizing ownership, a separate VPC per project fragments management, and Private Service Connect publishes services rather than sharing subnets.

3. 3.A network engineer must connect 40 VPC networks so that every VPC can reach every other VPC, without building a full mesh of peerings. Which service should be used?

   • ANetwork Connectivity Center with VPC spokesCorrect answer
   • BA full mesh of VPC Network Peering connections
   • CPrivate Service Connect endpoints between every pair
   • DHA VPN tunnels between every pair of VPCs

   Why

   Network Connectivity Center provides a hub with VPC spokes, giving full connectivity between spokes without the quadratic growth and non-transitivity of direct peerings. VPC Network Peering is non-transitive and would require a full mesh, Private Service Connect publishes individual services, and Cloud VPN between every pair is operationally heavy and unnecessary within Google Cloud.

4. 4.A GKE cluster must scale to 5,000 Pods and 2,000 Services. Which subnet planning decision is essential at cluster creation time?

   • ASize the secondary ranges for Pods and Services appropriatelyCorrect answer
   • BSize only the subnet's primary range for the Pod count
   • CPlan to add a second subnet when Pod capacity runs out
   • DEnable Private Google Access on the subnet

   Why

   A VPC-native cluster draws Pod and Service addresses from secondary ranges on the subnet, so those ranges must be sized for the target Pod and Service counts before the cluster is created. The primary range sizes only the nodes, adding a second subnet later does not extend the cluster's existing Pod range, and enabling Private Google Access concerns API reachability rather than address capacity.

5. 5.An application must be reachable at a single global anycast IPv4 address with HTTPS termination and URL-based routing to backends in three regions. Which load balancer should be chosen?

   • AGlobal external Application Load BalancerCorrect answer
   • BRegional external Application Load Balancer
   • CExternal passthrough Network Load Balancer
   • DInternal Application Load Balancer

   Why

   The global external Application Load Balancer provides a single anycast address, TLS termination, and URL map routing across backends in multiple regions. A regional external Application Load Balancer serves one region and has no global anycast address, a passthrough Network Load Balancer does not terminate HTTPS or route by URL, and an internal load balancer is not reachable from the internet.

Practice all 65 questions

Frequently asked questions