Cloud Network Engineer Intermediate Practice Exam: Medium Difficulty 2025

A SaaS company is designing its GCP network for production. They will deploy services in multiple regions and want to minimize latency for global users while keeping failover simple. They also want to avoid exposing backends directly to the internet. Which design best meets these goals?

Your organization uses a Shared VPC with a host project and multiple service projects. Two teams need to deploy workloads in different service projects but must communicate over private IPs while preventing lateral movement to other subnets. What is the best approach?

A company is migrating from on-prem to GCP. They want a single VPC spanning multiple regions with consistent subnet IP ranges per region. They also want to avoid IP overlap with on-prem networks. What should you do?

You need to allow a set of VMs without external IPs to access the internet for OS updates while ensuring inbound connections from the internet are not possible. Which configuration meets the requirement?

A security team requires that only VMs with a specific service account can reach a sensitive internal database on TCP port 5432, regardless of VM tags or IP changes. How should you enforce this in a VPC?

You are publishing an internal HTTP service to employees across multiple regions. The service must be reachable only via private IP and should load balance across backends in multiple zones within a region. What should you deploy?

Your public web application is behind an external HTTP(S) load balancer. You need to mitigate L7 DDoS and restrict access so only requests from a known set of countries are allowed, while still allowing Google-managed health checks. What should you configure?

A workload in a VPC needs private access to Google APIs (for example, Cloud Storage and BigQuery) without using public IPs or Cloud NAT. The organization wants to keep traffic on Google’s network. What should you enable?

A company needs high availability connectivity between its on-prem data center and GCP with predictable latency. They require a private connection that does not traverse the public internet and want to use dynamic routing. Which solution is most appropriate?

You suspect intermittent packet loss between two subnets in the same VPC. You need to identify which 5-tuple flows are being dropped and whether firewall rules are involved, without installing agents on VMs. What should you do?