Free Access Google.Professional-Cloud-Network-Engineer.v2026-06-03.q145 Practice Test (Page 2)

Question 1

In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers in subnet- a. You will also deploy the application servers and web servers in subnet-b. You want to configure firewall rules that only allow database traffic from the application servers to the database servers. What should you do?

A.Create service accounts [email protected] and [email protected]. Associate service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command:
gcloud compute firewall-rules create app-db-firewall-ru
--allow TCP:3306 \
--source-service-accounts sa-app@democloud-idp-
demo.iam.gserviceaccount.com \
--target-service-accounts sa-db@my-
project.iam.gserviceaccount.com

B.Create network tag app-server and service account [email protected]. Add the tag to the application servers, and associate the service account with the database servers. Run the following command:
gcloud compute firewall-rules create app-db-firewall-rule \
--action allow \
--direction ingress \
--rules top:3306 \
--source-tags app-server \
--target-service-accounts sa-db@my-
project.iam.gserviceaccount.com

C.Create network tags app-server and db-server. Add the app-server tag to the application servers, and add the db-server tag to the database servers. Run the following command:
gcloud compute firewall-rules create app-db-firewall-rule \
--action allow \
--direction ingress \
--rules tcp:3306 \
--source-ranges 10.128.0.0/20 \
--source-tags app-server \
--target-tags db-server

D.Create service accounts [email protected] and [email protected]. Associate the service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command:
gcloud compute firewall-rules create app-db-firewall-ru
--allow TCP:3306 \
--source-ranges 10.128.0.0/20 \
--source-service-accounts sa-app@my-
project.iam.gserviceaccount.com \
--target-service-accounts sa-db@my-
project.iam.gserviceaccount.com

Question 2

Question:
Your organization has a new security policy that requires you to monitor all egress traffic payloads from your virtual machines in the us-west2 region. You deployed an intrusion detection system (IDS) virtual appliance in the same region to meet the new policy. You now need to integrate the IDS into the environment to monitor all egress traffic payloads from us-west2. What should you do?

A.Enable firewall logging and forward all filtered egress firewall logs to the IDS.

B.Create an internal HTTP(S) load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

C.Create an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

D.Enable VPC Flow Logs. Create a sink in Cloud Logging to send filtered egress VPC Flow Logs to the IDS.

Question 3

Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?

A.Assign members of the networking team the compute.networkAdmin role.

B.Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.

C.Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.

D.Assign members of the networking team the compute.networkUser role.

Question 4

You have two Google Cloud projects in a perimeter to prevent data exfiltration. You need to move a third project inside the perimeter; however, the move could negatively impact the existing environment. You need to validate the impact of the change. What should you do?

A.Enable VPC Flow Logs inside the third project, and monitor the logs for negative impact.

B.Modify the existing VPC Service Controls policy to include the new project in dry run mode.

C.Enable Firewall Rules Logging inside the third project.

D.Monitor the Resource Manager audit logs inside the perimeter.

Question 5

An application development team believes their current logging tool will not meet their needs for their new cloud-based product. They want a better tool to capture errors and help them analyze their historical log data. You want to help them find a solution that meets their needs, what should you do?

A.Send them a list of online resources about logging best practices.

B.Help them define their requirements and assess viable logging tools.

C.Help them upgrade their current tool to take advantage of any new features.

D.Direct them to download and install the Google StackDriver logging agent.

Other Version: 2389Google.Professional-Cloud-Network-Engineer.v2025-09-09.q179; 1941Google.Professional-Cloud-Network-Engineer.v2025-05-14.q111; 2129Google.Professional-Cloud-Network-Engineer.v2024-10-28.q109; 2965Google.Professional-Cloud-Network-Engineer.v2023-04-24.q111; 1939Google.Professional-Cloud-Network-Engineer.v2023-01-24.q52; 3021Google.Professional-Cloud-Network-Engineer.v2022-03-12.q83; 102Google.Ipassleader.Professional-Cloud-Network-Engineer.v2021-10-07.by.stephanie.79q.pdf

Latest Upload: 129Databricks.Databricks-Generative-AI-Engineer-Associate.v2026-08-18.q40; 135SAP.C_CR125_2601.v2026-08-17.q28; 179Salesforce.Field-Service-Consultant.v2026-08-17.q134; 150Oracle.1Z0-1170.v2026-08-16.q64; 156Oracle.1Z1-1170.v2026-08-16.q64; 193Juniper.JN0-336.v2026-08-13.q60; 327EMC.NCP-AII.v2026-08-13.q200; 205CIRO.RSE.v2026-08-12.q41; 175CrowdStrike.CCSE-204.v2026-08-12.q50; 161ISQI.CT-GenAI.v2026-08-11.q14

Question 1

Question 2

Question 3

Question 4

Question 5

Download PDF File