Free Access Google.Professional-Cloud-Network-Engineer.v2025-09-09.q179 Practice Test (Page 34)

Question 161

You have configured a Compute Engine virtual machine instance as a NAT gateway. You execute the following command:
gcloud compute routes create no-ip-internet-route \
--network custom-network1 \
--destination-range 0.0.0.0/0 \
--next-hop instance nat-gateway \
--next-hop instance-zone us-central1-a \
--tags no-ip --priority 800
You want existing instances to use the new NAT gateway. Which command should you execute?

A.sudo sysctl -w net.ipv4.ip_forward=1

B.gcloud compute instances add-tags [existing-instance] --tags no-ip

C.gcloud builds submit --config=cloudbuild.waml --substitutions=TAG_NAME=no-ip

D.gcloud compute instances create example-instance --network custom-network1 \
--subnet subnet-us-central \
--no-address \
--zone us-central1-a \
--image-family debian-9 \
--image-project debian-cloud \
--tags no-ip

Question 162

You are creating a new GKE standard cluster. You need to configure the cluster to ensure that pods can reach other VMs in Google Cloud in the 192.168.0.0/24 subnet using the source IP of the GKE nodes. What should you do?

A.Q Set a GKE pod IP address range that fits in 10.0.0.0/8. Configure the -disable-def ault-snat. flag.

B.Q Set a GKE pod IP address range that fits in 10.0.0.0/8. Do not configure the -disable-def ault-snat flag.

C.Q Set a GKE pod IP address range that does not fit in 10.0.0.0/8. Do not configure the -disable- default-snat flag.

D.Q Set a GKE pod IP address range that does not fit in 10.0.0.0/8. Configure the -disable-default-snat flag.

Correct Answer: A

By default, GKE uses SNAT (Source Network Address Translation) for pod egress traffic to destinations outside the cluster's IP ranges but within RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0
/16). This means that traffic from pods leaving the cluster for these private IP destinations will have their source IP address translated to the node's IP address.
To ensure pods can reach VMs in the 192.168.0.0/24 subnet using the source IP of the GKE nodes, you want the default SNAT behavior to apply to this destination. The default SNAT rule applies when the destination is an RFC 1918 address and the source is a pod IP that is not within the same RFC 1918 range as the destination (e.g., if your pods are in a 10.x.x.x range and the destination is 192.168.x.x).
Therefore, you should:
Set a GKE pod IP address range that fits in 10.0.0.0/8: This ensures that the pod IPs are within an RFC 1918 range different from 192.168.0.0/24.
Do NOT configure the --disable-default-snat flag: If you disable default SNAT, pods would use their own IP addresses as source IPs, which might not be routable to the 192.168.0.0/24 subnet unless specific routes are configured. The goal is to use the node's IP.
The combination of having pod IPs in a different RFC 1918 range and not disabling default SNAT ensures that GKE performs SNAT, making the node's IP the source for traffic destined for the 192.168.0.0/24 subnet.
Exact Extract:
"By default, GKE performs SNAT (Source Network Address Translation) for egress traffic from pods to destinations outside the cluster's IP address ranges but within the private IP address ranges defined in RFC
1918 (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16). When SNAT occurs, the source IP address of the egress packets is the node's IP address instead of the pod's IP address."
"The --disable-default-snat flag, when used, disables this default SNAT behavior. If you want traffic to use the node's IP as the source when reaching internal RFC 1918 destinations, do not set this flag."Reference:
Google Kubernetes Engine Documentation - IP masquerade agent, Private IP addresses for GKE Pods and Services

Question 163

Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue.
What should you do?

A.Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.

B.Create custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.

C.Create custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.

D.Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.

Question 164

Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?

A.Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.

B.Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.

C.Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.

D.Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.

Question 165

You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?

A.Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.

B.Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.

C.Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.

D.Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.

Other Version: 496Google.Professional-Cloud-Network-Engineer.v2025-05-14.q111; 587Google.Professional-Cloud-Network-Engineer.v2024-10-28.q109; 1794Google.Professional-Cloud-Network-Engineer.v2023-04-24.q111; 1382Google.Professional-Cloud-Network-Engineer.v2023-01-24.q52; 2290Google.Professional-Cloud-Network-Engineer.v2022-03-12.q83; 102Google.Ipassleader.Professional-Cloud-Network-Engineer.v2021-10-07.by.stephanie.79q.pdf

Latest Upload: 104Oracle.1Z0-1057-23.v2025-09-10.q47; 133Google.Professional-Cloud-Network-Engineer.v2025-09-09.q179; 130SAP.C-S4EWM-2023.v2025-09-08.q83; 147TheSecOpsGroup.CNSP.v2025-09-08.q20; 188CFAInstitute.ESG-Investing.v2025-09-08.q173; 135PECB.ISO-IEC-27001-Lead-Implementer.v2025-09-06.q132; 136Salesforce.Data-Architect.v2025-09-05.q216; 130Adobe.AD0-E605.v2025-09-05.q50; 169Nutanix.NCP-MCI-6.10.v2025-09-05.q55; 113Oracle.1z0-591.v2025-09-05.q104

Question 161

Question 162

Question 163

Question 164

Question 165

Download PDF File