Professional Cloud Network Engineer
Length: 2 hours
Languages: English
Exam format: 50-60 multiple choice and multiple select questions
Exam delivery method:
a) Take the online-proctored exam from a remote location, review the online testing requirements
b) Take the onsite-proctored exam at a testing center, locate a test center near you
Examkingdom Google-Professional-Cloud-Network-Engineer Exam pdf, Certkingdom Google-Professional-Cloud-Network-Engineer Exam PDF
Best Google-Professional-Cloud-Network-Engineer Certification, Google-Professional-Cloud-Network-Engineer PDF Training at Certkingdom.com
Prerequisites: None
Recommended experience: 3+ years of industry experience including 1+ years designing and managing solutions using Google Cloud
Certification Renewal / Recertification: Candidates must recertify in order to maintain their certification status. Unless explicitly stated in the detailed exam descriptions, all Google Cloud certifications are valid for two years from the date of certification. Recertification is accomplished by retaking the exam during the recertification eligibility time period and achieving a passing score. You may attempt recertification starting 60 days prior to your certification expiration date.
Certification exam guide
A Professional Cloud Network Engineer implements and manages network architectures in Google Cloud. This individual may work on networking or cloud teams with architects who design cloud infrastructure. The Cloud Network Engineer uses the Google Cloud console and/or command line interface, and leverages experience with network services, application and container networking, hybrid and multi-cloud connectivity, implementing VPCs, and security for established network architectures to ensure successful cloud implementations.
The Professional Cloud Network Engineer exam assesses your ability to:
Design, plan, and prototype a Google Cloud network
Implement Virtual Private Cloud (VPC) instances
Configure network services
Implement hybrid interconnectivity
Manage, monitor, and optimize network operations
Exam overview
1. Review the exam guide
The exam guide contains a complete list of topics that may be included on the exam, helping you determine if your skills align with the topics on the exam.
Section 1: Designing, planning, and prototyping a Google Cloud network
1.1 Designing an overall network architecture. Considerations include:
● High availability, failover, and disaster recovery strategies
● DNS strategy (e.g., on-premises, Cloud DNS)
● Security and data exfiltration requirements
● Load balancing
● Applying quotas per project and per VPC
● Hybrid connectivity (e.g., Google private access for hybrid connectivity)
● Container networking
● IAM roles
● SaaS, PaaS, and IaaS services
● Microsegmentation for security purposes (e.g., using metadata, tags, service accounts)
1.2 Designing Virtual Private Cloud (VPC) instances. Considerations include:
● IP address management and bring your own IP (BYOIP)
● Standalone vs. Shared VPC
● Multiple vs. single
● Regional vs. multi-regional
● VPC Network Peering
● Firewalls (e.g., service account-based, tag-based)
● Custom routes
● Using managed services (e.g., Cloud SQL, Memorystore)
● Third-party device insertion (NGFW) into VPC using multi-NIC and internal load balancer as a next hop or equal-cost multi-path (ECMP) routes
1.3 Designing a hybrid and multi-cloud network. Considerations include:
● Dedicated Interconnect vs. Partner Interconnect
● Multi-cloud connectivity
● Direct Peering
● IPsec VPN
● Failover and disaster recovery strategy
● Regional vs. global VPC routing mode
● Accessing multiple VPCs from on-premises locations (e.g., Shared VPC, multi-VPC peering topologies)
● Bandwidth and constraints provided by hybrid connectivity solutions
● Accessing Google Services/APIs privately from on-premises locations
● IP address management across on-premises locations and cloud
● DNS peering and forwarding
1.4 Designing an IP addressing plan for Google Kubernetes Engine. Considerations include:
● Public and private cluster nodes
● Control plane public vs. private endpoints
● Subnets and alias IPs
● RFC 1918, non-RFC 1918, and privately used public IP (PUPI) address options
Section 2: Implementing Virtual Private Cloud (VPC) instances
2.1 Configuring VPCs. Considerations include:
● Google Cloud VPC resources (e.g., networks, subnets, firewall rules)
● VPC Network Peering
● Creating a Shared VPC network and sharing subnets with other projects
● Configuring API access to Google services (e.g., Private Google Access, public interfaces)
● Expanding VPC subnet ranges after creation
2.2 Configuring routing. Considerations include:
● Static vs. dynamic routing
● Global vs. regional dynamic routing
● Routing policies using tags and priority
● Internal load balancer as a next hop
● Custom route import/export over VPC Network Peering
2.3 Configuring and maintaining Google Kubernetes Engine clusters. Considerations include:
● VPC-native clusters using alias IPs
● Clusters with Shared VPC
● Creating Kubernetes Network Policies
● Private clusters and private control plane endpoints
● Adding authorized networks for cluster control plane endpoints
2.4 Configuring and managing firewall rules. Considerations include:
● Target network tags and service accounts
● Rule priority
● Network protocols
● Ingress and egress rules
● Firewall rule logging
● Firewall Insights
● Hierarchical firewalls
2.5 Implementing VPC Service Controls. Considerations include:
● Creating and configuring access levels and service perimeters
● VPC accessible services
● Perimeter bridges
● Audit logging
● Dry run mode
Section 3: Configuring network services
3.1 Configuring load balancing. Considerations include:
● Backend services and network endpoint groups (NEGs)
● Firewall rules to allow traffic and health checks to backend services
● Health checks for backend services and target instance groups
● Configuring backends and backend services with balancing method (e.g., RPS, CPU, Custom), session affinity, and capacity scaling/scaler
● TCP and SSL proxy load balancers
● Load balancers (e.g., External TCP/UDP Network Load Balancing, Internal TCP/UDP Load Balancing, External HTTP(S) Load Balancing, Internal HTTP(S) Load Balancing)
● Protocol forwarding
● Accommodating workload increases using autoscaling vs. manual scaling
3.2 Configuring Google Cloud Armor policies. Considerations include:
● Security policies
● Web application firewall (WAF) rules (e.g., SQL injection, cross-site scripting, remote file inclusion)
● Attaching security policies to load balancer backends
3.3 Configuring Cloud CDN. Considerations include:
● Enabling and disabling
● Cloud CDN
● Cache keysInvalidating cached objects
● Signed URLs
● Custom origins
3.4 Configuring and maintaining Cloud DNS. Considerations include:
● Managing zones and records
● Migrating to Cloud DNS
● DNS Security Extensions (DNSSEC)
● Forwarding and DNS server policies
● Integrating on-premises DNS with Google Cloud
● Split-horizon DNS
● DNS peering
● Private DNS logging
3.5 Configuring Cloud NAT. Considerations include:
● Addressing
● Port allocations
● Customizing timeouts
● Logging and monitoring
● Restrictions per organization policy constraints
3.6 Configuring network packet inspection. Considerations include:
● Packet Mirroring in single and multi-VPC topologies
● Capturing relevant traffic using Packet Mirroring source and traffic filters
● Routing and inspecting inter-VPC traffic using multi-NIC VMs (e.g., next-generation firewall appliances)
● Configuring an internal load balancer as a next hop for highly available multi-NIC VM routing
Section 4: Implementing hybrid interconnectivity
4.1 Configuring Cloud Interconnect. Considerations include:
● Dedicated Interconnect connections and VLAN attachments
● Partner Interconnect connections and VLAN attachments
4.2 Configuring a site-to-site IPsec VPN. Considerations include:
● High availability VPN (dynamic routing)
● Classic VPN (e.g., route-based routing, policy-based routing)
4.3 Configuring Cloud Router. Considerations include:
● Border Gateway Protocol (BGP) attributes (e.g., ASN, route priority/MED, link-local addresses)
● Custom route advertisements via BGP
● Deploying reliable and redundant Cloud Routers
Section 5: Managing, monitoring, and optimizing network operations
5.1 Logging and monitoring with Google Cloud’s operations suite. Considerations include:
● Reviewing logs for networking components (e.g., VPN, Cloud Router, VPC Service Controls)
● Monitoring networking components (e.g., VPN, Cloud Interconnect connections and interconnect attachments, Cloud Router, load balancers, Google Cloud Armor, Cloud NAT)
5.2 Managing and maintaining security. Considerations include:
● Firewalls (e.g., cloud-based, private)
● Diagnosing and resolving IAM issues (e.g., Shared VPC, security/network admin)
5.3 Maintaining and troubleshooting connectivity issues. Considerations include:
● Draining and redirecting traffic flows with HTTP(S) Load Balancing
● Monitoring ingress and egress traffic using VPC Flow Logs
● Monitoring firewall logs and Firewall Insights
● Managing and troubleshooting VPNs
● Troubleshooting Cloud Router BGP peering issues
5.4 Monitoring, maintaining, and troubleshooting latency and traffic flow. Considerations include:
● Testing network throughput and latency
● Diagnosing routing issues
● Using Network Intelligence Center to visualize topology, test connectivity, and monitor performance
Sample Questions:
QUESTION 1
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
A. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
B. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
C. Tag the backend instances “application,” and create a firewall rule with target tag “application” and the source IP range of the allowed clients and Google health check IP ranges.
D. Label the backend instances “application,” and create a firewall rule with the target label “application” and the source IP range of the allowed clients and Google health check IP ranges.
Explanation:
Answer: C
https://cloud.google.com/load-balancing/docs/https/setting-up-https#sendtraffic
QUESTION 2
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?
A. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
B. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
C. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
D. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
Explanation:
Answer: D
https://cloud.google.com/vpc/docs/using-vpc#create-auto-network
We create one VPC network in auto mode that creates one subnet in each Google Cloud region automatically. So, region us east1 and europe-west1 are in the same network and they can communicate using their internal IP address even though they are in different Regions. They take advantage of Google’s global fiber network.
QUESTION 3
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
A. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
B. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
C. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
D. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
Answer: C
Explanation:
https://cloud.google.com/vpc/docs/vpc-peering
QUESTION 4
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
A. gcloud dns record-sets import ZONE_FILE –zone MANAGED_ZONE
B. gcloud dns record-sets import ZONE_FILE –replace-origin-ns –zone MANAGED_ZONE
C. gcloud dns record-sets import ZONE_FILE –zone-file-format –zone MANAGED_ZONE
D. gcloud dns record-sets import ZONE_FILE –delete-all-existing –zone MANAGED ZONE
Explanation:
Answer: C
https://cloud.google.com/sdk/gcloud/reference/dns/record-sets/import
QUESTION 5
You created a VPC network named Retail in auto mode. You want to create a VPC network named
Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?
A. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
B. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0. Create the necessary subnets, and then peer them via network peering.
C. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0. Create the necessary subnets, and then peer them via network peering.
D. Rename the default VPC as “Distribution” and peer it via network peering.
Answer: B