Courseiva

Google Professional Cloud Network Engineer (PCNE) — Questions 1–75

961 questions total · 13pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 13

Page 2
1
MCQmedium

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

A.Assign a static external IP address to the forwarding rule.
B.Upload an SSL certificate to the load balancer.
C.Specify a subnet in the same region as the backend instances.
D.Create a Cloud NAT gateway for the backend instances.
AnswerC

The ILB's IP is allocated from a subnet in the same region.

Why this answer

An internal load balancer (ILB) in GCP requires a regional forwarding rule that routes traffic to backend instances within the same VPC. Specifying a subnet in the same region as the backend instances is mandatory because the ILB's internal IP address is allocated from that subnet, and the forwarding rule must reference a subnet to enable internal-only routing. Without a subnet, the ILB cannot be provisioned as an internal load balancer.

Exam trap

Google Cloud often tests the misconception that an internal load balancer requires an external IP or SSL termination, but the key requirement is specifying a subnet in the same region as the backends for internal IP allocation.

How to eliminate wrong answers

Option A is wrong because an internal load balancer uses an internal IP address, not an external one; assigning a static external IP would make it an external load balancer, which is not required for internal-only access. Option B is wrong because SSL certificates are only needed for HTTPS/SSL proxy load balancers, not for internal TCP/UDP load balancers, which operate at Layer 4 and do not terminate TLS. Option D is wrong because Cloud NAT is used to provide outbound internet access for instances without external IPs, but it is unrelated to inbound traffic distribution via an internal load balancer.

Full explanation →
2
MCQeasy

A developer wants to log all denied firewall rule events for security auditing purposes. What is the simplest way to achieve this without modifying existing firewall rules?

A.Use Cloud NAT logging
B.Enable firewall rule logging on existing rules
C.Create a deny-all firewall rule with logging enabled at the lowest priority
D.Enable VPC Flow Logs on all subnets
AnswerC

This catches all implicit denies and logs them.

Why this answer

Firewall rules logging can be enabled per rule. However, if you want to log all denied traffic without modifying existing rules, you can create a high-priority deny-all rule (e.g., priority 65535) with logging enabled. This will log any traffic not explicitly allowed.

Full explanation →
3
MCQhard

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

A.Local preference
B.MED (Multi-Exit Discriminator)
C.AS path prepend
D.Weight
AnswerB

MED is used to indicate preference for a route when multiple paths exist. A lower MED value is preferred, so setting a lower MED for the specific subnet will make it preferred over the less specific route.

Why this answer

MED (Multi-Exit Discriminator) is used to influence inbound route preference. A lower MED value is preferred. Setting a lower MED for the specific subnet will make it preferred over the less specific route.

Full explanation →
4
MCQmedium

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

A.DNS forwarding (inbound)
B.Managed zone with cross-project binding
C.DNS peering
D.Global DNS configuration
AnswerC

DNS peering enables cross-project DNS resolution by forwarding queries to a target VPC.

Why this answer

DNS peering allows forwarding DNS queries from one VPC to another VPC's DNS for resolution, without zone transfer.

Full explanation →
5
MCQmedium

A company has an on-premises data center connected to GCP via Cloud Interconnect. They want to expose an on-premises service to internet clients through Google Cloud's global load balancer. Which type of network endpoint group should they use?

A.Zonal NEG
B.Internet NEG
C.Serverless NEG
D.Hybrid connectivity NEG
AnswerD

Correct: hybrid NEGs allow load balancing to on-premises endpoints via Interconnect or VPN.

Why this answer

Hybrid connectivity NEGs allow you to expose on-premises destinations via Cloud Interconnect or VPN to a load balancer.

Full explanation →
6
MCQhard

A network engineer sees the above output from a Cloud Router. There are two BGP peers from the on-premises router (10.0.0.1 and 10.0.0.2). Both learned the same route 10.1.0.0/16 from their respective peers. However, traffic from Google Cloud to 10.1.0.0/16 is only going through the first peer (10.0.0.1) and not load-balanced. What could be the reason?

A.The on-premises router is advertising the route with different MED values
B.The on-premises router is advertising the route with different AS_PATH lengths
C.The VPC routing mode is set to 'global'
D.Cloud Router has a limit of one route per prefix
AnswerA

Different MED values prevent ECMP; Cloud Router selects the route with the lower MED.

Why this answer

BGP uses the MED (Multi-Exit Discriminator) attribute to influence inbound traffic from a neighboring AS. When the on-premises router advertises the same route (10.1.0.0/16) to the Cloud Router via two peers (10.0.0.1 and 10.0.0.2) with different MED values, the Cloud Router will prefer the route with the lower MED value. This causes all traffic to be sent through the peer with the lower MED, preventing load balancing.

By default, Cloud Router does not perform ECMP (Equal-Cost Multi-Path) for BGP routes unless the paths are identical in all BGP path selection criteria, including MED.

Exam trap

The trap here is that candidates often assume BGP automatically load-balances across multiple peers for the same prefix, forgetting that BGP's path selection algorithm picks a single best path unless all attributes (including MED) are equal, and that MED is compared even when AS_PATH lengths are the same.

How to eliminate wrong answers

Option B is wrong because if the on-premises router advertised the route with different AS_PATH lengths, the Cloud Router would prefer the shorter AS_PATH, which would also result in a single preferred path, not load balancing. However, the question states that both peers learned the same route, implying the AS_PATH lengths are likely equal; the issue is specifically about MED. Option C is wrong because the VPC routing mode (global vs. regional) affects how routes are propagated across regions, not how BGP path selection chooses between two peers in the same region.

Option D is wrong because Cloud Router does not have a limit of one route per prefix; it can learn multiple routes for the same prefix from different BGP peers and can perform ECMP if the routes are equal in all BGP selection criteria.

Full explanation →
7
MCQeasy

A developer is configuring a Compute Engine VM to host a web server. They want to ensure that only HTTP (port 80) and HTTPS (port 443) traffic from the internet is allowed. Which firewall rule should they create?

A.Egress allow rule for TCP ports 80 and 443 to 0.0.0.0/0.
B.Ingress deny rule for all ports except 80 and 443.
C.Egress deny rule for all ports.
D.Ingress allow rule for TCP ports 80 and 443 from 0.0.0.0/0.
AnswerD

This allows incoming HTTP/HTTPS traffic from any source.

Why this answer

For web server traffic, you need ingress rules that allow TCP on ports 80 and 443 from source 0.0.0.0/0. The target should be the VM (by tag or service account). A single rule can specify multiple ports.

Full explanation →
8
Multi-Selectmedium

A company is designing a multi-region application on GCP and wants to optimize egress costs. Which TWO of the following strategies will reduce cross-region egress costs? (Choose two.)

Select 2 answers
A.Use Cloud CDN to cache content at edge locations
B.Enable VPC Flow Logs to analyze traffic
C.Deploy backends in multiple regions and use a global load balancer
D.Use a regional load balancer when users are concentrated in one region
E.Use Premium Tier networking
AnswersA, D

Reduces requests to origin, lowering egress from the origin region.

Why this answer

Using Cloud CDN caches content at edge locations, reducing the need to fetch from the origin region. Using a regional load balancer instead of a global one can avoid cross-region traffic if users are in the same region as the backend. However, global LB with CDN is also good; but the question specifically asks for cost reduction.

Cloud CDN reduces egress from origin. Regional LB avoids cross-region traffic altogether if the user and backend are in the same region.

Full explanation →
9
Multi-Selecthard

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Select 3 answers
A.Cloud NAT can be configured per subnet or per region.
B.Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.
C.Cloud NAT automatically assigns external IP addresses to instances.
D.Cloud NAT can be configured with a manual list of NAT IP addresses.
E.Cloud NAT supports both TCP and UDP protocols.
AnswersB, D, E

Without a default route, traffic cannot reach the internet.

Why this answer

Options B, D, and E are correct. Option B: Cloud NAT requires a default route (0.0.0.0/0) pointing to the internet gateway to forward traffic. Option D: You can specify a manual list of NAT IP addresses (static external IPs) for Cloud NAT to use.

Option E: Cloud NAT supports both TCP and UDP protocols for outbound connections. Option A is incorrect because Cloud NAT is configured per region, not per subnet; it applies to all subnets in the region that are enabled for NAT. Option C is incorrect because Cloud NAT does not assign external IPs to instances; it provides NAT for instances without external IPs.

Full explanation →
10
Drag & Dropmedium

Drag and drop the steps to set up a Google Cloud Armor security policy for a backend service into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Security policy creation involves defining rules, setting default action, and attaching to a backend service. Testing ensures correct enforcement.

Full explanation →
11
MCQmedium

You are designing DNS resolution for a hybrid cloud. On-premises DNS servers must resolve GCP private VM hostnames, and GCP VMs must resolve on-premises hostnames. Which Cloud DNS feature should you use?

A.DNS peering
B.Cloud DNS public zones
C.DNS forwarding (inbound and outbound)
D.Split-horizon DNS
AnswerC

Inbound forwarding allows on-prem to forward queries to Cloud DNS; outbound forwards GCP queries to on-prem.

Why this answer

DNS forwarding with inbound and outbound policies is the correct choice because it enables bidirectional resolution between on-premises and GCP VMs. Outbound forwarding sends queries from GCP to on-premises DNS servers, while inbound forwarding allows on-premises clients to resolve GCP private VM hostnames by forwarding queries to Cloud DNS. This creates a seamless hybrid DNS namespace without exposing private zones to the internet.

Exam trap

The trap here is that candidates confuse DNS peering (which only works between GCP VPCs) with the forwarding capabilities needed for hybrid on-premises-to-cloud resolution, leading them to select option A instead of C.

How to eliminate wrong answers

Option A is wrong because DNS peering allows two VPC networks within GCP to resolve each other's private zones, but it does not extend resolution to on-premises DNS servers. Option B is wrong because Cloud DNS public zones are used to publish DNS records to the internet, not to resolve private hostnames in a hybrid cloud environment. Option D is wrong because split-horizon DNS is a design pattern that returns different responses based on the source IP, but it is not a Cloud DNS feature; it would require custom configuration and does not inherently provide the forwarding mechanism needed for hybrid resolution.

Full explanation →
12
Drag & Dropmedium

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Troubleshooting starts with tunnel status, then BGP, firewall, routing, and finally connectivity tests.

Full explanation →
13
MCQeasy

A network engineer wants to test whether a Compute Engine VM can reach a Cloud SQL instance in a different VPC network, considering firewall rules and VPC peering. Which Google Cloud tool should they use?

A.VPC Flow Logs
B.Connectivity Tests
C.Firewall Insights
D.Packet Mirroring
AnswerB

Connectivity Tests are designed for this exactly — simulating traffic between endpoints.

Why this answer

Connectivity Tests in Network Intelligence Center allows you to specify source and destination (including IP addresses, instances, or Google APIs) and evaluate reachability based on firewall rules, routes, VPC peering, and other policy configurations.

Full explanation →
14
MCQmedium

A company wants to expose a set of internal services running on Compute Engine instances in a private VPC to other internal services using HTTP load balancing. They require L7 features like URL-based routing and SSL termination. Which load balancer should they use?

A.Regional Internal HTTP(S) Load Balancer
B.Global HTTPS Load Balancer
C.Internal TCP/UDP Load Balancer
D.Regional External HTTP(S) Load Balancer
AnswerA

Correct. It provides internal L7 load balancing.

Why this answer

Regional Internal HTTP(S) Load Balancer is an Envoy-based L7 load balancer for internal traffic, supporting URL maps and SSL termination.

Full explanation →
15
MCQhard

An organization uses Traffic Director with Envoy sidecars in GKE. They want to implement fault injection to test service resilience by injecting a 5-second delay into 10% of requests to a specific backend service. Which Traffic Director configuration resource should they use?

A.A backend service with outlier detection enabled
B.A network endpoint group with a health check that fails intermittently
C.A traffic splitting rule in the routing configuration
D.A fault injection policy in the TrafficDirectorRoute
AnswerD

Correct: Traffic Director allows fault injection via route rules in the routing configuration.

Why this answer

Traffic Director supports fault injection via the Envoy HTTP connection manager. The correct approach is to configure a TrafficDirectorRoute with a fault injection policy, which is part of the routing configuration.

Full explanation →
16
MCQmedium

An organization has multiple VPC networks and wants to allow traffic between them with fine-grained control over which VMs can communicate. Which solution should they implement?

A.Cloud Interconnect.
B.Shared VPC.
C.VPC peering with firewall rules.
D.Cloud VPN between VPCs.
AnswerC

VPC peering connects networks and firewall rules provide granular control.

Why this answer

VPC peering with firewall rules is the correct solution because it allows direct, private connectivity between two VPC networks while enabling fine-grained control over which specific VMs can communicate via firewall rules (ingress/egress). Unlike Shared VPC, which centralizes management but does not inherently provide per-VM granularity across separate VPCs, VPC peering combined with firewall rules allows you to restrict traffic based on source and destination tags, service accounts, or CIDR ranges. This meets the requirement for both inter-VPC traffic and granular VM-level control.

Exam trap

Google Cloud often tests the misconception that Shared VPC is the solution for inter-VPC traffic, but Shared VPC actually consolidates multiple projects into a single VPC, not connecting separate VPCs, while VPC peering with firewall rules provides the required granular control across distinct VPC networks.

How to eliminate wrong answers

Option A is wrong because Cloud Interconnect provides dedicated, high-bandwidth connectivity between on-premises networks and Google Cloud, not between multiple VPC networks within the same organization. Option B is wrong because Shared VPC allows multiple projects to share a common VPC network but does not enable traffic between separate VPC networks; it centralizes resources into one VPC, which contradicts the requirement of having multiple VPC networks. Option D is wrong because Cloud VPN creates an encrypted tunnel over the public internet, which is typically used for hybrid connectivity (on-premises to VPC) and adds latency and complexity; it is not designed for fine-grained VM-level control between VPCs, and firewall rules still apply but the underlying architecture is less direct than VPC peering.

Full explanation →
17
MCQmedium

A company wants to publish an internal service (e.g., a database) in their VPC so that consumers in other VPCs can connect to it privately via Private Service Connect (PSC). What must be created on the producer side?

A.A Cloud VPN tunnel to the consumer VPC.
B.A VPC peering connection.
C.A Private Service Connect endpoint in the producer VPC.
D.A Service Attachment that exposes the service.
AnswerD

The Service Attachment defines the service to be consumed via PSC.

Why this answer

Private Service Connect allows producers to publish services via a Service Attachment. The service attachment is created on a Network Endpoint Group (NEG) that points to the internal service (e.g., a backend service). Consumers then create PSC endpoints to connect.

Full explanation →
18
Multi-Selectmedium

A company wants to use BGP traffic engineering to control how traffic flows between GCP and their on-premises network over two Dedicated Interconnect connections. Which TWO BGP attributes can they use on Cloud Router? (Choose 2.)

Select 2 answers
A.BGP communities
B.MED (Multi-Exit Discriminator)
C.Weight
D.Local preference
E.AS path prepending
AnswersA, B

BGP communities can be used for traffic engineering with Cloud Router.

Why this answer

On Cloud Router, you can set MED (metric) to influence inbound traffic and use AS path prepending (though not directly on Cloud Router; you can influence outbound via MED). Actually, Cloud Router supports setting MED on advertised routes. BGP communities can also be used for tagging routes.

Weight is a Cisco-specific attribute, not available on Cloud Router.

Full explanation →
19
Multi-Selectmedium

A company is designing a global web application that must serve users worldwide with low latency. They plan to use a Global HTTPS Load Balancer with Cloud CDN. Which TWO features should they enable to further reduce latency for users connecting from various regions? (Choose two.)

Select 2 answers
A.Anycast IP address
B.Reserve a static IP address
C.Enable IAP for backend services
D.Cloud CDN with CDN Interconnect
E.Cloud Armor with rate limiting
AnswersA, D

Anycast allows users to connect to the nearest edge point, reducing latency.

Why this answer

CDN Interconnect provides dedicated connectivity to CDN caches, reducing latency. Anycast IP ensures users connect to the nearest edge location. Cloud Armor is security, not performance.

Full explanation →
20
MCQhard

A company uses Cloud DNS. They want to override DNS resolution for a specific domain (e.g., mycompany.com) to point to an internal IP for all queries originating from their VPC, while leaving all other domains unaffected. Which Cloud DNS feature should they use?

A.DNSSEC
B.A routing policy with a geo location rule
C.A response policy zone (RPZ)
D.A managed private zone
AnswerC

Correct: RPZ allows DNS overrides within the VPC.

Why this answer

Response Policy Zones (RPZ) allow you to create a local override zone that takes precedence over public DNS for specified domains within a VPC.

Full explanation →
21
Drag & Dropmedium

Drag and drop the steps to set up a Cloud Interconnect connection for dedicated on-premises connectivity into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Cloud Interconnect requires ordering, VLAN attachment, cross-connect, BGP, and verification.

Full explanation →
22
MCQmedium

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

A.The subnet routes are exported from VPC-B to VPC-A.
B.The BGP session status on the Cloud Router.
C.The MTU size of the instances.
D.The route tables for the peered network.
AnswerA

Correct. Subnet routes must be exported from VPC-B to VPC-A for peering to work. If not exported, instances in VPC-A cannot reach VPC-B.

Why this answer

VPC Network Peering requires that subnet routes be exported from the peered VPC. By default, subnet routes are automatically exported, but if the peering configuration was modified (e.g., exportSubnetRoutesWithPublicIp set to false), routes may not be exported. The engineer should verify that VPC-B exports its subnet routes to VPC-A.

Option B is incorrect because BGP is not used in VPC peering; Cloud Router is used for Cloud VPN or Dedicated Interconnect, not peering. Option C is incorrect because MTU mismatch is unlikely to cause complete lack of connectivity. Option D is incorrect because the route tables themselves are not the issue; the missing routes are due to export settings, not the presence of route tables.

Full explanation →
23
MCQeasy

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

A.Cloud NAT on the subnet or VPC
B.Configure a private Google access for the subnet
C.Assign a static external IP address to the instance
D.Set up an internal HTTP(S) load balancer
AnswerA

Enables outbound internet access without external IP.

Why this answer

Cloud NAT (Network Address Translation) allows private Compute Engine instances to initiate outbound connections to the internet without assigning them public IP addresses. It translates the instance's private IP to a Cloud NAT external IP address for outbound traffic, while unsolicited inbound connections from the internet are blocked. This is the correct solution because the requirement explicitly states no public IP on the instance, yet outbound internet access is needed.

Exam trap

Google Cloud often tests the distinction between Private Google Access (which only reaches Google APIs) and Cloud NAT (which provides general internet access), causing candidates to confuse the two when the question mentions 'outbound connections to the internet' versus 'access to Google services'.

How to eliminate wrong answers

Option B is wrong because Private Google Access enables instances with only internal IPs to reach Google APIs and services (e.g., Cloud Storage, BigQuery) over Google's private network, not general internet destinations. Option C is wrong because assigning a static external IP address directly contradicts the requirement that the instance should not have a public IP address. Option D is wrong because an internal HTTP(S) load balancer distributes traffic among instances within a VPC using private IPs; it does not provide outbound internet connectivity for instances.

Full explanation →
24
MCQmedium

A company needs to connect on-premises to Google Cloud with overlapping IP ranges. The on-premises network uses 10.0.0.0/16 and the VPC uses 10.0.0.0/16. What is the best approach?

A.Use Cloud NAT.
B.Use VPC peering.
C.Use Private Google Access.
D.Use Cloud VPN with source NAT on the on-premises side.
AnswerD

Source NAT allows overlapping IPs by translating them.

Why this answer

Cloud VPN with source NAT on the on-premises side translates overlapping addresses.

Full explanation →
25
Multi-Selectmedium

A company wants to use Traffic Director to implement fault injection for testing service resilience. They want to inject delays and errors into a percentage of requests. Which two configurations are required? (Choose two.)

Select 2 answers
A.Enable Cloud Armor on the load balancer
B.Configure a fault injection policy in Traffic Director
C.Create a new backend service with different instance group
D.Configure a health check for the fault injection service
E.Apply a traffic splitting rule to direct a percentage of traffic to the fault injection policy
AnswersB, E

Fault injection policy defines delay and error percentages.

Why this answer

Traffic Director supports fault injection policies, which require a traffic splitting rule to apply the policy to a portion of traffic, and the fault injection filter config in Envoy.

Full explanation →
26
MCQmedium

A company has a VPC with a firewall rule that allows SSH (tcp:22) from 0.0.0.0/0. They want to restrict SSH access to only the public IP address of their Cloud VPN gateway. How should they modify the firewall rule?

A.Use Cloud Armor to block all SSH except from the VPN IP.
B.Change the source IP range to the VPN gateway's internal IP address.
C.Change the source IP range to the VPN gateway's public IP address.
D.Use IAP Tunneling instead of SSH firewall rules.
AnswerC

Restricts SSH to traffic coming from the VPN gateway.

Why this answer

The firewall rule currently allows SSH from any source IP (0.0.0.0/0). To restrict access to only the Cloud VPN gateway, you must change the source IP range to the gateway's public IP address, because the SSH connection originates from the VPN gateway's public-facing interface over the internet. Internal IP addresses are not routable over the internet and would not match the source of the incoming SSH traffic.

Exam trap

Google Cloud often tests the misconception that internal IPs can be used as source ranges for internet-originating traffic, leading candidates to choose Option B instead of recognizing that the source IP of the SSH connection is the VPN gateway's public IP.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall for HTTP/S traffic and cannot filter SSH (TCP/22) traffic at the network layer; it operates at Layer 7. Option B is wrong because the VPN gateway's internal IP address is private and not reachable from the internet; the SSH connection comes from the gateway's public IP, so using the internal IP would block all SSH traffic. Option D is wrong because IAP Tunneling is an alternative method for SSH access that does not modify the existing firewall rule; it requires separate IAP configuration and does not restrict the current rule's source range.

Full explanation →
27
MCQmedium

You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?

A.The SSL policy is configured to require TLS 1.3 only.
B.The domain is not verified for the Google-managed certificate on the frontend.
C.The backend self-managed certificate is not signed by a public CA.
D.The backend service must use a Google-managed certificate as well.
AnswerB

Google-managed certificates require domain verification; if not verified, the certificate may not issue, causing mismatch.

Why this answer

When a Google-managed certificate is used on the frontend of an SSL proxy load balancer, the domain must be verified via DNS or a challenge file. If the domain is not verified, the certificate cannot be provisioned or validated, causing a mismatch between the certificate's Subject Alternative Names (SANs) and the domain clients are connecting to, resulting in SSL errors.

Exam trap

Google Cloud often tests the distinction between frontend and backend certificate validation, and candidates mistakenly think a backend certificate issue (like not being signed by a public CA) would cause frontend client errors, when in fact the frontend certificate mismatch is caused by domain verification failure for the Google-managed certificate.

How to eliminate wrong answers

Option A is wrong because requiring TLS 1.3 only does not cause a certificate mismatch; it would instead cause handshake failures for clients using older TLS versions. Option C is wrong because a backend self-managed certificate not signed by a public CA would cause backend SSL errors, not frontend client-side certificate mismatch errors. Option D is wrong because the backend service does not need to use a Google-managed certificate; it can use a self-managed certificate, and the frontend certificate mismatch is independent of the backend certificate type.

Full explanation →
28
MCQmedium

An engineer needs to configure DNS resolution for a Compute Engine instance named "web-1" in zone us-central1-a of project my-project. What is the internal DNS name for this instance?

A.web-1.us-central1-a.c.my-project.internal
B.web-1.us-central1.c.my-project.internal
C.web-1.c.my-project.us-central1-a.internal
D.web-1.us-central1-a.my-project.internal
AnswerA

Correct format.

Why this answer

GCP internal DNS uses the format: [instance name].[zone].c.[project id].internal

Full explanation →
29
MCQmedium

A company uses Cloud NAT for outbound internet access. Engineering notices that some VM instances fail to connect to external services during peak hours. The network engineer suspects port exhaustion. Which action would best mitigate this issue?

A.Change the NAT type from standard to public.
B.Enable TCP keepalive on the NAT gateway.
C.Reduce the number of NAT gateways in the region.
D.Increase the number of NAT IP addresses assigned to the NAT gateway.
AnswerD

More NAT IPs provide additional source ports, alleviating exhaustion.

Why this answer

Port exhaustion occurs when the NAT gateway runs out of available source ports to map outbound connections. Increasing the number of NAT IP addresses assigned to the gateway multiplies the available port range (each IP provides 64,512 ports), directly alleviating port exhaustion during peak traffic. This is the standard mitigation for port exhaustion in Cloud NAT.

Exam trap

Google Cloud often tests the misconception that reducing NAT gateways or changing NAT type solves port exhaustion, when the actual solution is increasing the number of NAT IP addresses to expand the available port range.

How to eliminate wrong answers

Option A is wrong because changing the NAT type from standard to public is not a valid concept in Cloud NAT; Cloud NAT is always public-facing, and this option reflects a misunderstanding of NAT types. Option B is wrong because TCP keepalive helps maintain idle connections but does not increase the port pool or prevent port exhaustion; it may even delay port release. Option C is wrong because reducing the number of NAT gateways in the region would decrease the total available port capacity, worsening port exhaustion rather than mitigating it.

Full explanation →
30
MCQmedium

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

A.HTTPS
B.TCP
C.HTTP
D.gRPC
AnswerD

gRPC health check is specifically designed to check gRPC service health.

Why this answer

Health checks support HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC. For gRPC backends, a gRPC health check is the most appropriate as it reflects the application health. The other protocols may not accurately indicate gRPC service health.

Full explanation →
31
MCQhard

An organization wants to use Shared VPC but restrict access to certain subnets for specific service projects. Which GCP feature should they use?

A.Subnet-level IAM bindings
B.VPC Network Peering
C.VPC Service Perimeters
D.Firewall rules
AnswerA

Allows granular subnet access control for service projects.

Why this answer

Subnet-level IAM bindings allow you to grant roles (e.g., compute.networkUser) on specific subnets within a Shared VPC to service project principals. This restricts access to only those subnets, while the service project can still use the shared network. It is the native GCP mechanism for fine-grained subnet access control in a Shared VPC environment.

Exam trap

The trap here is that candidates confuse VPC Service Perimeters (which control data boundaries for managed services) with subnet-level IAM (which controls compute resource access within a Shared VPC), leading them to pick Option C when the question explicitly asks about restricting access to subnets for service projects.

How to eliminate wrong answers

Option B is wrong because VPC Network Peering connects two separate VPC networks, not a Shared VPC with service projects, and does not support subnet-level access restrictions within a single shared network. Option C is wrong because VPC Service Perimeters (part of VPC Service Controls) restrict data exfiltration from managed services (e.g., BigQuery, Cloud Storage) by defining perimeters around projects, not subnet-level IAM access for compute resources. Option D is wrong because Firewall rules control traffic flow (allow/deny) based on IP addresses, ports, and protocols, but do not control which principals can use or access a subnet; they are not an IAM mechanism.

Full explanation →
32
Drag & Dropmedium

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Shared VPC requires a host project with VPC, then granting access to service projects. Service projects then use the shared subnets.

Full explanation →
33
MCQhard

An engineer wants to use Cloud DNS to override DNS responses for a specific domain within their VPC. Which feature should they use?

A.Private zone
B.Response policy zone (RPZ)
C.DNSSEC
D.Routing policy
AnswerB

Correct: RPZ allows custom DNS responses for domains.

Why this answer

Response policy zones (RPZ) allow overriding DNS responses for specified domains within a VPC.

Full explanation →
34
MCQhard

A company has multiple VPC networks in the same project, each with its own Cloud NAT configuration. They notice that traffic from a VM in VPC-A that has an external IP address is being NATed through the Cloud NAT gateway, but they only want Cloud NAT to be used for VMs without external IPs. What configuration ensures this?

A.Disable the 'send-tosource-ip' flag on the Cloud NAT gateway.
B.Set the network tier of the VM to 'Standard' instead of 'Premium'.
C.Remove any NAT rules that match the source subnet and include external IP addresses; Cloud NAT automatically applies only to VMs without external IPs if not explicitly configured otherwise.
D.Enable Cloud NAT logging to track which VMs are NATed.
AnswerC

By default, Cloud NAT only applies to VMs without external IPs when using default configuration.

Why this answer

Cloud NAT only performs source network address translation for VMs that do not have external IP addresses, unless you explicitly configure NAT rules that match traffic from VMs with external IPs. By removing any such custom NAT rules, the default behavior ensures that only VMs without external IPs are NATed through the Cloud NAT gateway, leaving VMs with external IPs to use their own public addresses directly.

Exam trap

The trap here is that candidates assume Cloud NAT always NATs all VMs in a subnet, but the default behavior explicitly excludes VMs with external IPs unless custom NAT rules are added to include them.

How to eliminate wrong answers

Option A is wrong because the 'send-tosource-ip' flag does not exist in Cloud NAT; the relevant flag is 'source_ip_ranges_to_nat' which controls which source IP ranges are NATed, and disabling a non-existent flag has no effect. Option B is wrong because the network tier (Standard vs. Premium) affects the routing path and pricing of egress traffic, but does not influence whether a VM with an external IP is NATed by Cloud NAT.

Option D is wrong because enabling Cloud NAT logging only provides visibility into which VMs are being NATed; it does not change the NAT behavior or prevent VMs with external IPs from being NATed.

Full explanation →
35
MCQhard

A GCP environment has a VPC with a subnet that enables Private Google Access. Instances in that subnet can access Google APIs without external IPs. However, an instance cannot reach storage.googleapis.com from a private IP. Cloud NAT is configured for the subnet. What is the most likely reason for the failure?

A.The instance does not have a DNS resolution for storage.googleapis.com.
B.The subnet's Private Google Access is enabled, but Cloud NAT is also routing traffic to Google APIs via NAT, bypassing the internal access.
C.The VPC does not have a default route to the internet.
D.The instance does not have a firewall rule allowing egress to 199.36.153.4/30.
AnswerB

When Cloud NAT is enabled, the default route (0.0.0.0/0) points to NAT, which may override Private Google Access routes. Private Google Access requires a specific route for 199.36.153.4/30 with next hop 'default internet gateway'.

Why this answer

Private Google Access uses the default routes for Google APIs. If Cloud NAT is configured, it may override Private Google Access because traffic to Google APIs can be matched by a default route with a next hop of NAT. To fix, ensure the subnet has a Private Google Access route with a next hop 'default internet gateway' for the restricted VIPs.

Option B correctly identifies that Cloud NAT is incorrectly routing traffic.

Full explanation →
36
Multi-Selecthard

Which THREE actions are required to configure a High-Availability Cloud VPN (HA VPN) with dynamic routing to an on-premises peer?

Select 3 answers
A.Create two VPN tunnels, each associated with a different Cloud VPN gateway interface
B.Create two separate Cloud Routers, one for each tunnel
C.Allocate two external IP addresses for the Cloud VPN gateway
D.Create a Cloud Router in the same region as the VPN gateway
E.Configure static routes for the remote network in the VPC
AnswersA, C, D

Two tunnels provide redundancy.

Why this answer

HA VPN requires two tunnels, each attached to a different interface of the Cloud VPN gateway, to provide redundancy and failover. This ensures that if one tunnel or interface fails, traffic can continue through the other tunnel. Option C is correct because each tunnel must have its own external IP address, so you need to allocate two external IP addresses for the HA VPN gateway interfaces.

Option D is correct because a Cloud Router must be created in the same region as the VPN gateway to manage BGP sessions for dynamic routing. Option B is incorrect because HA VPN uses a single Cloud Router to manage BGP sessions for both tunnels; separate Cloud Routers are not required. Option E is incorrect because with dynamic routing, static routes are not needed; the BGP sessions advertise routes automatically.

Exam trap

Google Cloud often tests the misconception that you need separate Cloud Routers for each tunnel, but HA VPN uses a single Cloud Router to manage BGP sessions for both tunnels, and static routes are not used with dynamic routing.

Full explanation →
37
MCQeasy

A company has deployed an HTTP load balancer with a backend service configured to use an unmanaged instance group. Users report that traffic is not reaching the backend instances. The backend instances are healthy and have proper firewall rules allowing traffic from the load balancer. What step should the network engineer take to resolve the issue?

A.Configure a firewall rule to allow health check probes from the load balancer's health check ranges.
B.Enable HTTP health check on the backend service.
C.Assign an external IP address to each backend instance.
D.Add a route for the load balancer's IP range.
AnswerD

Correct. A missing route for the load balancer's IP range prevents traffic from reaching the backend instances. Adding the route resolves the issue.

Why this answer

The load balancer sends traffic to backend instances using their internal IP addresses. If there is no route from the load balancer's frontend IP range to the subnet containing the backend instances, traffic will be dropped. Adding a route for the load balancer's IP range ensures that packets can reach the instances.

Since the problem states firewall rules are already proper, Option A (health check firewall rules) is unnecessary. Health checks are already configured (Option B is not needed). Instances do not require external IPs (Option C).

Therefore, the correct step is to add the missing route.

Exam trap

Candidates may mistakenly focus on health check firewall rules when the actual issue is a missing route for the load balancer's traffic.

Full explanation →
38
Multi-Selecthard

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

Select 3 answers
A.Check if the external service is blocking the Cloud NAT IP addresses.
B.Verify that the VPC firewall rules allow egress traffic from the instances.
C.Ensure that the VPC has a default route to the internet gateway.
D.Verify that the Cloud Router associated with Cloud NAT is healthy and has established BGP sessions.
E.Check the DNS resolution for the external service.
AnswersA, B, D

Some external services may block specific IP ranges, including NAT IPs.

Why this answer

Cloud NAT uses a set of public IP addresses for outbound traffic. If the external service has firewall rules or access control lists that block these specific IP addresses, the instances will be unable to reach it. Checking for IP-based blocking is a standard first step in troubleshooting connectivity issues through a NAT gateway.

Exam trap

Google Cloud often tests the misconception that DNS resolution is the primary cause of connectivity failures to external services, when in fact the issue is often at the network layer (e.g., IP blocking or firewall rules) rather than the application layer.

Full explanation →
39
MCQmedium

A financial services company requires a dedicated, low-latency connection between their on-premises data center and Google Cloud. They need a 99.99% SLA and bandwidth of 10 Gbps. Which connectivity option should they choose?

A.HA VPN
B.Partner Interconnect
C.Classic VPN
D.Dedicated Interconnect
AnswerD

Correct. Dedicated Interconnect offers 10 Gbps links and a 99.99% SLA.

Why this answer

Dedicated Interconnect provides 10 Gbps or 100 Gbps links with a 99.99% SLA when configured with two connections.

Full explanation →
40
Matchingmedium

Match each VPC firewall rule component to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Determines rule evaluation order (lower number = higher priority)

Specifies ingress or egress traffic

Allow or deny matching traffic

Specifies IP ranges or tags for traffic filtering

Selects VM instances to apply the rule

Why these pairings

Correct matches: Source refers to originating IPs, Destination to target IPs, Action to allow/deny, Direction to ingress/egress. Priority and Protocol are other components with distinct meanings.

Full explanation →
41
MCQmedium

Your organization has an internal HTTP load balancer (ILB) in us-central1. The backend service is a managed instance group with a health check on port 8080. Recently, some instances are reported as unhealthy despite the application running fine. What is the most likely cause?

A.The health check firewall rule is configured for the same source range as the VPC internal traffic.
B.The internal load balancer is using a proxy protocol which changes the health check source IP.
C.The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).
D.The instances are preemptible and become unhealthy after 24 hours.
AnswerC

Correct. Health check probes originate from Google's IP ranges (35.191.0.0/16, 130.211.0.0/22). If these are not allowed in the firewall rule, health checks fail.

Why this answer

The most likely cause is that the firewall rule allowing health check probes does not include the required Google Cloud health check source IP ranges (35.191.0.0/16 and 130.211.0.0/22). For internal HTTP load balancers, the health check probes originate from these specific ranges, not from within the VPC. If the firewall rule only permits traffic from the VPC internal ranges, health checks will fail even if the application is running.

Option A is wrong because the health check source range is not the same as VPC internal traffic; it must be the GCP health check ranges. Option B is wrong because proxy protocol does not affect health check source IPs for internal load balancers. Option D is wrong because preemptible instances do not become unhealthy after 24 hours due to preemption; they are terminated, not marked unhealthy.

Full explanation →
42
MCQmedium

A company has two VPCs connected via VPC peering. They want resources in VPC A to be able to reach a service in VPC B that uses a custom static route. What must be configured on the VPC peering connection?

A.Enable VPC Flow Logs on both VPCs
B.Use a VPN between the VPCs
C.Create a Cloud Router in VPC A
D.Enable export of custom routes in VPC B and import of custom routes in VPC A
AnswerD

Correct. VPC B must export custom routes, and VPC A must import them.

Why this answer

By default, custom static routes are not exchanged across VPC peering. You must export custom routes from VPC B and import them into VPC A.

Full explanation →
43
MCQmedium

A company uses a shared VPC with multiple service projects. They want to connect their on-premises data center to the shared VPC through a Dedicated Interconnect. Where should they configure the Cloud Router and VLAN attachment?

A.In the same region as the majority of service project instances
B.In the host project of the shared VPC
C.In a global resource policy, cross-project
D.In the service project that will use the connectivity
AnswerB

Host project manages networking for all service projects.

Why this answer

In a shared VPC architecture, the Cloud Router and VLAN attachment for Dedicated Interconnect must be configured in the host project because the host project owns the VPC network and manages all network resources, including interconnect attachments. Service projects consume subnets from the host project but cannot create or manage interconnect resources. This ensures that the on-premises connectivity is centrally managed and that all service projects can use the interconnect through the shared VPC's routing.

Exam trap

Google Cloud often tests the misconception that interconnect resources can be configured in a service project because the service project uses the VPC, but in reality, the host project owns the VPC and all network-level resources like Cloud Routers and VLAN attachments must be created there.

How to eliminate wrong answers

Option A is wrong because the Cloud Router and VLAN attachment are not tied to the region of service project instances; they must be in the host project, and the Cloud Router can be regional or global, but the VLAN attachment is always regional and must be in the same region as the interconnect location, not the majority of instances. Option C is wrong because there is no 'global resource policy, cross-project' for interconnect configuration; Cloud Router and VLAN attachments are always project-scoped resources, and cross-project connectivity is handled via shared VPC host project ownership. Option D is wrong because service projects cannot configure Cloud Router or VLAN attachments; they lack the necessary permissions and the VPC network is not owned by them, so they cannot create interconnect resources in the host project's VPC.

Full explanation →
44
MCQhard

An organization uses Dedicated Interconnect with VLAN attachments in multiple regions. They need to ensure that traffic from one region to another flows over the interconnect backbone instead of the internet. Which configuration is required?

A.Use Partner Interconnect instead
B.Configure Network Connectivity Center
C.Enable global routing mode on the VPC
D.Set BGP MED values on Cloud Router
AnswerC

Global routing mode ensures routes are propagated to all regions, allowing cross-region traffic over backbone.

Why this answer

C is correct because enabling global routing mode on the VPC allows the VPC to use the same Dedicated Interconnect VLAN attachments across all regions. With global routing, routes learned via BGP over the interconnect are propagated to every region, ensuring that inter-region traffic is forwarded through the interconnect backbone rather than the public internet. Without global routing, each region would have its own VPC and would not share the interconnect routes, causing traffic to egress via the internet.

Exam trap

Candidates often assume Network Connectivity Center is required for inter-region traffic over interconnect, but the actual requirement is simply enabling global routing mode on the VPC. This setting controls route propagation scope and ensures routes learned via BGP over the interconnect are propagated to all regions.

How to eliminate wrong answers

Option A is wrong because Partner Interconnect is a different connectivity option that relies on a third-party provider and does not inherently force inter-region traffic over the interconnect backbone; the same VLAN attachment and routing configuration would be needed. Option B is wrong because Network Connectivity Center is a hub-and-spoke topology manager for on-premises and cloud networks, but it does not directly control how inter-region traffic within a single VPC is routed; global routing mode on the VPC is the specific setting required. Option D is wrong because BGP MED values influence inbound traffic path selection from on-premises to Google Cloud, not the routing of traffic between regions within Google Cloud; MED does not affect VPC internal routing decisions.

Full explanation →
45
MCQmedium

A company has an application running on Compute Engine that needs to send traffic to a third-party SaaS service on the internet. The VMs have no external IPs. Which solution provides outbound connectivity with minimal configuration and allows source IP preservation?

A.Configure a proxy instance with an external IP and route traffic through it
B.Use Cloud NAT with a static NAT IP
C.Assign external IPs to each VM
D.Use Private Google Access
AnswerB

Cloud NAT provides outbound internet access for VMs without external IPs. Using a static NAT IP preserves source IP and provides consistent IP for whitelisting.

Why this answer

Cloud NAT allows VMs without external IPs to reach the internet. It preserves the source IP (the NAT IP) for outbound connections. It is regional and can be configured per subnet.

Full explanation →
46
MCQhard

Company A and Company B both have networks in Google Cloud. They want to connect their VPCs using VPC peering, but they have overlapping IP addresses. How can they resolve this?

A.Use Cloud VPN to establish connectivity between the VPCs, as VPC peering cannot handle overlapping IPs.
B.Configure Private Service Connect to connect the VPCs.
C.Configure VPC peering with custom route exchange to exclude the overlapping subnets.
D.Use Dedicated Interconnect to connect the VPCs through a central router.
AnswerA

Cloud VPN can be configured with NAT or traffic selectors to handle overlapping IPs.

Why this answer

VPC peering does not support overlapping IP ranges. The only option from the list that can handle overlapping IPs is Cloud VPN with network address translation or filtering.

Full explanation →
47
Multi-Selecthard

A security team needs to block traffic from a specific geographic region (country) from reaching their HTTP Load Balancer. Additionally, they need to allow traffic from specific IP ranges that are known to be legitimate, even if they originate from that blocked region. Which THREE steps should they take? (Choose THREE.)

Select 3 answers
A.Attach the security policy to the backend service of the HTTPS Load Balancer
B.Create a Cloud Armor security policy with a rule that denies traffic from the country
C.Add a firewall rule in the VPC to deny traffic from the country
D.Create a Cloud Armor security policy with a higher-priority rule that allows the specific IP ranges
E.Use VPC Service Controls to restrict access from the country
AnswersA, B, D

Cloud Armor policies are applied to backend services.

Why this answer

Cloud Armor allows you to create security policies with rules. Geo-blocking can be implemented by denying traffic based on geographic origin. To allow specific IP ranges from the blocked region, you need a rule with higher priority that allows those IPs before the deny rule.

Attach the policy to the backend service of the HTTPS Load Balancer.

Full explanation →
48
MCQmedium

Your company has a Partner Interconnect connection via a service provider that offers Layer 3 connectivity. The provider assigns an IP address on the VLAN attachment. Which VLAN attachment type should you use when creating the attachment in Google Cloud?

A.PARTNER_PROVIDER
B.VPN
C.PARTNER
D.DEDICATED
AnswerC

PARTNER is correct for Layer 3 connectivity where the partner provides IP addresses and routing.

Why this answer

When a service provider offers Layer 3 connectivity and assigns an IP address on the VLAN attachment, you must use the PARTNER attachment type. This type is specifically designed for Partner Interconnect with Layer 3 (routed) connections, where the provider manages the IP addressing and routing. PARTNER_PROVIDER is used for Layer 2 attachments where you assign your own IP addresses.

Exam trap

The Google Professional Cloud Network Engineer exam often tests the distinction between Layer 2 and Layer 3 attachments in Partner Interconnect, trapping candidates who confuse PARTNER_PROVIDER (Layer 2, customer-assigned IPs) with PARTNER (Layer 3, provider-assigned IPs).

How to eliminate wrong answers

Option A is wrong because PARTNER_PROVIDER is used for Layer 2 (VLAN) attachments where you must assign your own IP addresses and manage routing, not for Layer 3 provider-assigned IPs. Option B is wrong because VPN is a separate technology (IPsec tunnels over the internet) and is not a VLAN attachment type for Partner Interconnect. Option D is wrong because DEDICATED is used for Dedicated Interconnect (direct physical connections), not for Partner Interconnect via a service provider.

Full explanation →
49
MCQeasy

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have already ordered a cross-connect from their co-location facility to a Google Point of Presence (PoP). What is the NEXT step to establish the connection?

A.Create a Cloud Router and BGP session
B.Run a ping test to verify connectivity
C.Configure BGP on the on-premises router
D.Create a VLAN attachment in Google Cloud
AnswerD

The VLAN attachment is the next logical step after the physical cross-connect is in place.

Why this answer

After the physical cross-connect is in place, the next step is to create a VLAN attachment in the Cloud Console or via gcloud. The VLAN attachment is the logical construct that represents the connection between the on-premises router and the Cloud Router.

Full explanation →
50
MCQmedium

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

A.IP allowlist/denylist
B.Pre-configured WAF rules
C.Named IP address lists
D.Rate limiting
AnswerB

WAF rules include signatures for SQL injection and other common web attacks.

Why this answer

Pre-configured WAF rules in Cloud Armor include a SQL injection (SQLi) rule that inspects HTTP(S) request bodies, headers, and URIs for SQL injection patterns. This rule uses a set of signatures to detect and block malicious SQL queries, directly addressing the requirement to protect against SQL injection attacks on an external HTTP(S) load balancer.

Exam trap

Google Cloud often tests the misconception that IP-based controls (allowlist/denylist or named IP lists) can protect against application-layer attacks like SQL injection, but these features operate at Layer 3/4 and cannot inspect HTTP payloads.

How to eliminate wrong answers

Option A is wrong because IP allowlist/denylist only controls access based on source IP addresses and cannot inspect application-layer payloads for SQL injection patterns. Option C is wrong because Named IP address lists are simply a way to group IP addresses for use in firewall rules or allowlist/denylist policies, not a mechanism for content inspection. Option D is wrong because Rate limiting only restricts the number of requests from a client over a time window and does not analyze request content for SQL injection signatures.

Full explanation →
51
Multi-Selectmedium

A company is planning to connect multiple VPCs in different regions to their on-premises network using a single Dedicated Interconnect. Which TWO configurations are required to achieve this?

Select 2 answers
A.Create a single Cloud Router for all VPCs
B.Set up Cloud VPN tunnels for regional connectivity
C.Create a Cloud Router in each VPC
D.Use a global VLAN attachment
E.Provision a separate VLAN attachment for each VPC
AnswersC, E

Each VPC needs its own Cloud Router to establish BGP sessions.

Why this answer

Each VPC requires its own Cloud Router to establish dynamic routing (BGP) over the Dedicated Interconnect. A Cloud Router is a per-VPC resource that manages BGP sessions and routes for that specific VPC, and since the interconnect is shared, each VPC must have its own router to participate in routing independently.

Exam trap

Google Cloud often tests the misconception that a single Cloud Router or global VLAN attachment can serve multiple VPCs across regions, but in reality, each VPC requires its own regional Cloud Router and VLAN attachment for Dedicated Interconnect.

Full explanation →
52
MCQhard

A company is using Traffic Director with Envoy sidecar proxies to manage traffic between microservices. They want to gradually shift 5% of traffic from version v1 to v2 of a service for testing. Which Traffic Director resource should they configure?

A.Define a weighted traffic split in the HTTP route rule of the Traffic Director route configuration
B.Use the Envoy runtime to dynamically adjust traffic percentages
C.Create a new backend service for v2 and set the traffic split in the backend service
D.Configure a weighted round-robin routing policy in Cloud DNS
AnswerA

Traffic Director uses route rules with weighted clusters to split traffic.

Why this answer

Traffic Director supports traffic splitting via weighted routing in the HTTP route configuration, not in the backend service. The traffic splitting is done at the routing level.

Full explanation →
53
MCQmedium

An organization has two VPCs in the same project: VPC-A and VPC-B. They want instances in VPC-A to reach Cloud Storage buckets without external IPs. What is the simplest solution?

A.Create a Cloud NAT gateway in VPC-A and configure firewall rules to allow traffic to Cloud Storage.
B.Peer VPC-A with VPC-B and enable Private Google Access on VPC-B.
C.Enable Private Google Access on the subnets in VPC-A.
D.Assign external IPs to the instances in VPC-A.
AnswerC

Private Google Access allows instances to reach Google APIs using internal IPs.

Why this answer

Private Google Access enables instances without external IPs to reach Google API endpoints (including Cloud Storage) via the private IP range. The feature is enabled per subnet, so enabling it on subnets in VPC-A allows those instances to access Cloud Storage.

Full explanation →
54
MCQeasy

A company wants to protect its HTTPS Load Balancer from DDoS attacks and common web application attacks like SQL injection and cross-site scripting (XSS). Which Google Cloud service should be used?

A.Cloud IDS
B.Cloud Armor
C.VPC Service Controls
D.Firewall Rules
AnswerB

Correct. Cloud Armor provides WAF and DDoS protection for HTTPS Load Balancers.

Why this answer

Cloud Armor provides DDoS protection and WAF capabilities including preconfigured rules for OWASP, XSS, and SQLi. It attaches to HTTPS Load Balancers.

Full explanation →
55
MCQhard

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

A.Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.
B.Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.
C.Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.
D.Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.
AnswerC

This is the correct configuration: two tunnels, each with its own BGP session.

Why this answer

HA VPN requires two tunnels (one per interface) to form a pair. Each tunnel requires a separate BGP session to provide redundancy.

Full explanation →
56
MCQmedium

A company is deploying a global web application on Google Cloud. They need to serve traffic from the closest region to users, support both HTTP and HTTPS, and offload SSL/TLS termination at the load balancer. Which load balancing solution should they use?

A.Global SSL Proxy Load Balancer
B.Regional External HTTP(S) Load Balancer
C.Global HTTPS Load Balancer
D.Global TCP Proxy Load Balancer
AnswerC

The Global HTTPS LB provides SSL offload, anycast IP, and URL-based routing.

Why this answer

The Global HTTPS Load Balancer is a layer 7 proxy that can terminate SSL/TLS, route traffic based on URL maps, and serve users from the closest region via anycast IP. It supports both HTTP and HTTPS.

Full explanation →
57
MCQmedium

Refer to the exhibit. A DNS managed zone is configured with private visibility and associated with a VPC network. A Compute Engine instance in a different VPC network tries to resolve 'test.example.com' but fails. What is the most likely reason?

A.The zone is not set as authoritative for example.com.
B.The Cloud DNS name servers are not reachable from the instance.
C.The instance's VPC is not in the list of authorized networks.
D.The instance does not have the required IAM permissions.
AnswerC

The zone only resolves queries from vpc1; other VPCs are not authorized.

Why this answer

Private zones only respond to queries from authorized VPC networks. The instance is in a different VPC, so resolution fails.

Full explanation →
58
MCQhard

A security team wants to serve private content through Cloud CDN but restrict access to only authorized users. They need to generate time-limited URLs that do not require users to log in. Which approach should they use?

A.Use Cloud CDN signed URLs
B.Use IAM permissions on the bucket
C.Use Cloud CDN signed cookies
D.Enable Cloud CDN and set the bucket to public
AnswerA

Signed URLs provide time-limited access without user login.

Why this answer

Signed URLs allow generating time-limited URLs for private content without requiring user login. Signed cookies are for multiple URLs. Public buckets or IAM are not suitable.

Full explanation →
59
MCQmedium

Refer to the exhibit. You have two VPCs, vpc-a and vpc-b, with VPC peering configured and custom route import/export enabled. An instance in subnet-a (10.0.1.2) cannot ping an instance in subnet-b (10.0.2.2) using internal IP. Firewall rules are default (deny all ingress). What is the required action?

A.Add a firewall rule allowing ICMP from 10.0.1.0/24 to 10.0.2.0/24.
B.Add a static route for the peer range.
C.Enable Private Google Access.
D.Create a Cloud VPN tunnel.
AnswerA

This rule allows the ping traffic between the subnets.

Why this answer

Even with peering, firewall rules are needed to allow traffic. Default deny all ingress blocks the ping.

Full explanation →
60
Multi-Selecteasy

Which TWO are necessary components for setting up Dedicated Interconnect? (Choose two.)

Select 2 answers
A.A Cloud VPN tunnel for management traffic
B.A QoS policy to ensure bandwidth guarantee
C.A Cloud Router in the same region as the VLAN attachment
D.Two physical interconnect connections for redundancy
E.A VLAN attachment mapped to a VPC
AnswersC, E

Cloud Router handles BGP routing for the interconnect.

Why this answer

A Cloud Router is required in the same region as the VLAN attachment to enable dynamic routing (BGP) between your on-premises network and Google Cloud VPC. The VLAN attachment must be mapped to a VPC to define which VPC network the interconnect circuit connects to, allowing traffic to flow between your on-premises network and Google Cloud resources.

Exam trap

Google Cloud often tests the misconception that Dedicated Interconnect requires a VPN tunnel for management or redundancy, when in fact the VPN tunnel is a separate service for encrypted connectivity and is not a component of Dedicated Interconnect setup.

Full explanation →
61
MCQeasy

You need to configure Cloud CDN to cache all content from a backend bucket, ignoring any Cache-Control headers sent by the origin. Which cache mode should you use?

A.USE_ORIGIN_HEADERS
B.CACHE_ALL_STATIC
C.DYNAMIC_MODE
D.FORCE_CACHE_ALL
AnswerD

Correct: forces caching regardless of origin headers.

Why this answer

FORCE_CACHE_ALL ignores origin headers and caches all responses for the specified TTL.

Full explanation →
62
MCQhard

A large multinational corporation uses a Shared VPC in Google Cloud with multiple service projects. They have a central Cloud NAT configured in the host project in the us-central1 region to provide internet egress for all VMs. Recently, the IT team added a new subnet (10.0.10.0/24) in a service project and deployed VMs there. All other VMs in the same project but in different subnets (e.g., 10.0.1.0/24) can reach the internet, but the new VMs in 10.0.10.0/24 cannot. The Cloud NAT gateway is configured in us-central1 with all IP ranges allowed. The VPC firewall rules allow egress traffic to the internet. The team verified that the VMs have a default route (0.0.0.0/0) with next-hop 'default-internet-gateway' and that the Cloud NAT router's NAT IPs are properly assigned. However, the new subnet's VMs are unable to connect to any external IP. The network engineer suspects that the Cloud NAT's NAT reservations might be the issue, but all NAT IPs are ephemeral. Further investigation shows that the Cloud Router used by Cloud NAT is advertising custom IP ranges via BGP to an on-premises router for a different use case. What is the most likely cause and solution?

A.Remove the new subnet range (10.0.10.0/24) from the custom advertised routes on the Cloud Router associated with the Cloud NAT.
B.Add a static route for 0.0.0.0/0 with next-hop set to the Cloud NAT gateway's IP address in the VPC.
C.Update the VPC firewall rules to explicitly allow egress traffic from the new subnet's IP range to 0.0.0.0/0.
D.Reserve static NAT IPs for the new subnet in the Cloud NAT configuration to ensure that the VMs have a consistent egress IP.
AnswerA

The Cloud Router is advertising that subnet to on-premises, causing Cloud NAT to think traffic for that subnet should be sent through the VPN, not NATed.

Why this answer

The Cloud Router associated with Cloud NAT is advertising custom IP ranges via BGP to an on-premises router. If the new subnet range (10.0.10.0/24) is included in those custom advertised routes, the on-premises router may advertise a more specific route back to the VPC, causing the VMs in that subnet to prefer the on-premises route over the default route (0.0.0.0/0) for internet-bound traffic. Since the on-premises router does not have internet access, the traffic is blackholed.

Removing the subnet range from the custom advertised routes on the Cloud Router resolves the issue by ensuring the default route remains the preferred path for internet egress.

Exam trap

The trap here is that candidates often focus on Cloud NAT configuration or firewall rules, overlooking how BGP custom route advertisements from the Cloud Router can inject more specific routes that override the default route and cause asymmetric routing or blackholing.

How to eliminate wrong answers

Option B is wrong because adding a static route for 0.0.0.0/0 with next-hop set to the Cloud NAT gateway's IP address is not a valid configuration; Cloud NAT is not a next-hop target, and the default route already exists with next-hop 'default-internet-gateway'. Option C is wrong because the VPC firewall rules already allow egress traffic to the internet, and the issue is not firewall-related; the problem is a routing conflict caused by BGP advertisements. Option D is wrong because reserving static NAT IPs would not fix the routing issue; the Cloud NAT is already using ephemeral IPs and the problem stems from the Cloud Router's BGP advertisements overriding the default route for the new subnet.

Full explanation →
63
MCQeasy

A company wants to use Cloud DNS to resolve DNS queries from their on-premises network for a private zone that contains internal GCP resource names. They do not want to manage DNS servers on-premises. Which Cloud DNS feature should they use?

A.Private DNS zone
B.Inbound DNS server policy
C.Outbound DNS server policy
D.DNS peering
AnswerB

Inbound policy allows on-premises resolvers to forward queries to Cloud DNS private zones, meeting the requirement.

Why this answer

Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS private zones, enabling resolution without managing on-premises DNS servers.

Full explanation →
64
MCQeasy

You are a cloud network engineer for a company that runs a web application on Compute Engine instances in a managed instance group (MIG) behind an external HTTP(S) load balancer. The backend instances are in a subnet with CIDR 10.0.2.0/24 and are tagged 'web-backend'. The health checks are configured to use TCP port 80. Recently, the security team added new firewall rules to restrict traffic, and now the health checks are failing. The current firewall rules (in order of priority) are: 1. Priority 100: Deny ingress from 0.0.0.0/0 to all instances (deny-all). 2. Priority 200: Allow ingress from 130.211.0.0/22 and 35.191.0.0/16 to instances with tag 'health-checked' on TCP port 80. 3. Priority 300: Allow ingress from 0.0.0.0/0 to instances with tag 'web-backend' on TCP port 80. The MIG instances are tagged 'web-backend' but not 'health-checked'. The health checks are failing. What is the most efficient course of action to fix the health checks while maintaining security?

A.Change the priority 300 rule to allow from 0.0.0.0/0 to instances with tag 'health-checked' on TCP port 80.
B.Add a new ingress firewall rule with priority 150 that allows traffic from 130.211.0.0/22 and 35.191.0.0/16 to instances with tag 'web-backend' on TCP port 80.
C.Delete the deny-all rule (priority 100) because it is blocking health checks.
D.Modify the existing priority 200 rule to set target tags to 'web-backend' instead of 'health-checked'.
AnswerD

This directly fixes the issue by allowing health checks to the MIG instances without creating an additional rule, maintaining the security posture.

Why this answer

The health check probes originate from Google's health checker IP ranges (130.211.0.0/22 and 35.191.0.0/16) and must reach the instances. The current priority 200 rule allows these ranges only to instances tagged 'health-checked', but the MIG instances are tagged 'web-backend'. By modifying the priority 200 rule to target 'web-backend' instead, you permit health check traffic to the correct instances without creating a new rule or lowering security, as the deny-all rule (priority 100) remains in place and the more specific allow rule (priority 200) will match first.

Exam trap

Google Cloud often tests the misconception that you must create a new firewall rule or delete the deny-all rule, rather than simply modifying the target tags of an existing allow rule that already has the correct source IP ranges and protocol.

How to eliminate wrong answers

Option A is wrong because changing the priority 300 rule to target 'health-checked' would allow all internet traffic (0.0.0.0/0) to instances tagged 'health-checked', which does not exist on the MIG instances and would not fix the health check failure; it also unnecessarily opens broad access. Option B is wrong because adding a new rule at priority 150 is redundant and less efficient; the existing priority 200 rule already permits the required health checker ranges, so simply modifying its target tags is sufficient and avoids adding extra rules that could complicate firewall management. Option C is wrong because deleting the deny-all rule would remove the baseline security posture, allowing all traffic to all instances, which is a significant security risk and not required to fix the health checks.

Full explanation →
65
MCQhard

Your company has a hybrid cloud architecture with two on-premises data centers: DC1 and DC2. Each DC is connected to Google Cloud via separate Cloud VPN tunnels (tunnel1 from DC1, tunnel2 from DC2) to a VPC in us-west1. The VPC has two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). DC1 has a subnet 192.168.1.0/24 and DC2 has 192.168.2.0/24. You configure BGP on both tunnels with the VPC dynamic routing, and each on-premises router advertises its local subnet. The VPC automatically imports the learned routes. You notice that traffic from DC1 to an instance in subnet-a (10.0.1.5) works, but traffic from DC2 to the same instance fails intermittently. Additionally, traffic from DC2 to DC1 (192.168.1.0/24) fails completely. You check the route tables and see that both tunnels have learned the routes for the remote subnets. What is the most likely cause and solution?

A.Create a new VPN tunnel from DC2 to a different VPC and use VPC peering.
B.Increase the MTU on the VPN tunnels to avoid fragmentation.
C.Configure each Cloud VPN tunnel with a separate Cloud Router and assign different BGP priorities to influence route selection, or use distinct regions for the VPN gateways.
D.Disable dynamic routing on both tunnels and use static routes instead.
AnswerC

Separate Cloud Routers allow fine-grained control over route priority, preventing asymmetric routing.

Why this answer

The issue is that both Cloud VPN tunnels are using the same Cloud Router, causing BGP to learn identical routes for the on-premises subnets from both tunnels. This leads to asymmetric routing and potential black-holing, especially when traffic from DC2 to DC1 or to subnet-a is routed via DC1's tunnel due to equal-cost multi-path (ECMP) or default BGP tie-breaking. By configuring separate Cloud Routers with different BGP priorities (MED or local preference), you can force traffic from each DC to use its own tunnel, ensuring symmetric routing and consistent connectivity.

Exam trap

Google Cloud often tests the misconception that VPN tunnels inherently provide symmetric routing, when in fact BGP route propagation without proper priority configuration can cause ECMP or suboptimal path selection, leading to intermittent failures.

How to eliminate wrong answers

Option A is wrong because creating a new VPN tunnel to a different VPC and using VPC peering adds unnecessary complexity and does not address the root cause of route conflict between the two tunnels; the problem is within the same VPC. Option B is wrong because increasing MTU addresses fragmentation issues, which would manifest as packet drops or performance degradation, not intermittent or complete connectivity failures for specific traffic flows. Option D is wrong because disabling dynamic routing and using static routes would remove the learned routes for remote subnets, breaking connectivity entirely, and would not resolve the asymmetric routing caused by BGP route propagation.

Full explanation →
66
MCQmedium

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

A.Assign external IPs to non-NAT instances.
B.Use firewall rules to allow NAT for tagged instances.
C.Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.
D.Create separate subnets for NAT instances.
AnswerC

This is the standard method to select which instances are NATed.

Why this answer

Cloud NAT uses network tags to filter which instances use it.

Full explanation →
67
MCQhard

Refer to the exhibit. The Cloud Router shows one BGP peer as ESTABLISHED and one as IDLE. The best routes show two routes to the same destination with different priorities. What is the most likely reason the IDLE peer is not establishing?

A.The on-premises router is not sending routes for the IDLE peer
B.The IDLE peer has a higher priority route, so it is not needed
C.BGP configuration mismatch between Cloud Router and on-premises router for the IDLE peer
D.The IDLE peer is not configured on the Cloud Router
AnswerC

IDLE state indicates a BGP session issue, typically misconfiguration.

Why this answer

The IDLE state in BGP indicates that the session has not been established, typically due to a configuration mismatch. Since the Cloud Router shows one peer as ESTABLISHED and another as IDLE, the most likely cause is a mismatch in BGP parameters (such as AS number, peer IP, or authentication) between the Cloud Router and the on-premises router for the IDLE peer. This prevents the BGP session from transitioning out of the IDLE state.

Exam trap

Google Cloud often tests the misconception that route advertisement or route priority affects BGP session state, but the IDLE state is strictly a session establishment issue caused by misconfiguration or network reachability problems between the peers.

How to eliminate wrong answers

Option A is wrong because the on-premises router not sending routes does not prevent BGP session establishment; the session can still reach ESTABLISHED state even if no routes are advertised. Option B is wrong because route priority (administrative distance or local preference) affects route selection, not BGP peering state; a higher priority route does not cause a peer to remain IDLE. Option D is wrong because if the IDLE peer were not configured on the Cloud Router, it would not appear in the BGP peer list at all; the fact that it is listed as IDLE indicates it is configured but not establishing.

Full explanation →
68
MCQmedium

A developer wants to use Cloud CDN to cache content from a backend bucket. They want to cache all objects regardless of cache-control headers, but need to exclude certain URL patterns (e.g., /private/*) from caching. Which cache mode should they choose?

A.FORCE_CACHE_ALL
B.CACHE_ALL_STATIC
C.DISABLED
D.USE_ORIGIN_HEADERS
AnswerA

This mode caches all objects regardless of cache-control. To exclude specific paths, you would need additional configuration like separate backends.

Why this answer

Cloud CDN cache modes: FORCE_CACHE_ALL caches all content irrespective of origin headers; USE_ORIGIN_HEADERS respects cache-control; CACHE_ALL_STATIC is similar to FORCE_CACHE_ALL but for static content. To exclude certain paths, you need to set up cache key or use URL map routing to different backends. The question asks for cache mode; FORCE_CACHE_ALL will cache everything by default, but to exclude patterns, you need to configure cache key rules or separate backends.

However, the best answer among the options is FORCE_CACHE_ALL because it caches all objects, but the exclusion would require additional configuration. There is no "CACHE_ALL_EXCEPT" mode. Actually, the correct approach is to use a URL map with two backend buckets: one for public content with FORCE_CACHE_ALL, and one for private content with no CDN.

But among the cache modes, FORCE_CACHE_ALL is the one that ignores cache-control.

Full explanation →
69
MCQeasy

A service provider uses a Shared VPC with multiple service projects. The host project has a Cloud NAT configured for subnet 10.1.0.0/24 to provide outbound internet access to all service projects using that subnet. A new service project needs to use its own Cloud NAT for its VM instances in subnet 10.1.0.0/24 to meet compliance requirements. The network engineer attempts to create a Cloud NAT in the service project for that subnet but receives an error that the subnet already has a NAT gateway. What action should the engineer take to meet the compliance requirement?

A.Create a new Cloud NAT in the service project for the same subnet, overwriting the existing one.
B.Use VPC peering to connect the service project to a different network that has a Cloud NAT.
C.Implement a proxy instance with an external IP in the service project.
D.Remove the host project's NAT from the subnet and create a Cloud NAT in the service project for that subnet.
AnswerD

This removes the conflict and allows the service project to manage its own NAT.

Why this answer

A subnet can have only one NAT gateway associated. To allow the service project to use its own Cloud NAT for subnet 10.1.0.0/24, the host project's Cloud NAT must first be removed from that subnet. Then the service project can create its own Cloud NAT for the same subnet.

Option A is not possible due to the conflict. Option B (VPC peering) would not allow the service project to have its own NAT on the same subnet. Option C (proxy instance) introduces management overhead and is not a native solution.

Full explanation →
70
MCQhard

A company uses High Availability VPN (HA VPN) with two tunnels and BGP to connect to an on-premises network. They notice traffic only flows through one tunnel. They want to ensure both tunnels are used simultaneously. What should they do?

A.Increase the MED value on the active tunnel to make it less preferred
B.Configure both tunnels with the same BGP AS number on the on-premises side
C.Configure static routes with equal cost for both tunnels
D.Enable equal-cost multipath (ECMP) on the Cloud Router
AnswerD

ECMP allows both VPN tunnels to be used simultaneously for traffic engineering.

Why this answer

To use both tunnels simultaneously, ECMP must be enabled in the VPC. By default, HA VPN with BGP uses active-passive if the on-premises router uses a lower local preference for one path. ECMP can be enabled on the Cloud Router.

Full explanation →
71
MCQeasy

An engineer needs to provide outbound internet access to Compute Engine instances that do not have external IP addresses. The solution must allow instances to access a specific set of external IPs only. What should the engineer configure?

A.Use Private Google Access only, which provides access to Google APIs and services.
B.Create a Cloud NAT gateway and configure firewall egress rules to allow traffic only to the specific IPs.
C.Assign external IPs to instances and use firewall rules to restrict outbound traffic.
D.Deploy a NAT instance with iptables rules to restrict destination IPs.
AnswerB

Cloud NAT provides outbound connectivity for instances without external IPs, and firewall rules can restrict traffic to specific destinations.

Why this answer

Cloud NAT with firewall rules can restrict outbound traffic to specific destinations. By default, Cloud NAT uses the instance's network tags and firewall egress rules to control traffic. The engineer can create an egress deny rule with higher priority for all destinations, then an egress allow rule for the specific IPs.

Full explanation →
72
Matchingmedium

Match each network troubleshooting command/tool to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Tests basic connectivity to an IP address

Traces the path packets take to a destination

Displays network connections and listening ports

Queries DNS to resolve a hostname

Captures and analyzes network packets

Why these pairings

Common network troubleshooting tools: ping tests connectivity, traceroute maps the route, nslookup resolves DNS, netstat shows connections. The distractors swap ping and traceroute functions.

Full explanation →
73
MCQmedium

You are designing a multi-tier application where an internal HTTP(S) load balancer should route requests to a backend service based on the URL path (e.g., /api/* to one service, /web/* to another). Which component is essential for this routing?

A.Cloud NAT
B.VPC peering
C.URL map
D.Firewall rules
AnswerC

Correct: URL maps define content-based routing.

Why this answer

The Internal HTTP(S) Load Balancer uses a URL map to define path-based routing rules to backend services.

Full explanation →
74
MCQeasy

A company wants to connect two VPC networks (vpc-a and vpc-b) that both reside in the same Google Cloud project. They need to ensure that all IP ranges in both VPCs can communicate using internal private IP addresses. Which solution should they implement?

A.Use Dedicated Interconnect to connect the VPCs.
B.Enable VPC Network Peering between vpc-a and vpc-b.
C.Set up Cloud VPN tunnels between the two VPCs.
D.Configure Cloud NAT to allow the VPCs to communicate through NAT.
AnswerB

VPC Network Peering allows private RFC 1918 connectivity across two VPCs, regardless of project or region, as long as they are in the same organization or project.

Why this answer

VPC Network Peering directly connects two VPCs within the same project using internal RFC 1918 IP addresses, with no bandwidth limitations and no single point of failure. It allows all subnets in both VPCs to communicate privately without requiring external connectivity, VPN tunnels, or NAT gateways.

Exam trap

Google Cloud often tests the misconception that VPN or Interconnect is required for VPC-to-VPC connectivity, but in Google Cloud, VPC Network Peering is the native, simpler solution for same-project or cross-project private communication.

How to eliminate wrong answers

Option A is wrong because Dedicated Interconnect is a hybrid connectivity solution for connecting on-premises networks to a VPC, not for connecting two VPCs within the same project. Option C is wrong because Cloud VPN tunnels introduce latency, bandwidth limits, and complexity (e.g., BGP configuration) that are unnecessary when VPC Network Peering provides simpler, lower-latency private connectivity. Option D is wrong because Cloud NAT is designed to allow private instances to access the internet outbound, not to enable direct private communication between VPCs; it would force traffic through external IPs and break internal routing.

Full explanation →
75
MCQeasy

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

A.Service attachment
B.Internal forwarding rule
C.Cloud VPN tunnel
D.Private Service Connect endpoint
AnswerD

The consumer creates an endpoint to connect to the producer's service.

Why this answer

When a consumer wants to connect to a managed SaaS application published via Private Service Connect (PSC), they must create a Private Service Connect endpoint in their own VPC. This endpoint is a regional resource that uses an internal IP address from the consumer's VPC and establishes a connection to the service attachment published by the provider. The endpoint effectively makes the SaaS service accessible as if it were a resource inside the consumer's VPC, without requiring public IPs or VPNs.

Exam trap

Google Cloud often tests the distinction between who creates which resource — candidates mistakenly think the consumer creates the service attachment (Option A) because they confuse it with the endpoint, but the service attachment is always created by the provider.

How to eliminate wrong answers

Option A is wrong because a service attachment is created by the service provider (the SaaS company) to publish their service, not by the consumer. Option B is wrong because an internal forwarding rule is used within a VPC to route traffic to a backend service (e.g., a load balancer), but it does not directly connect to a PSC service attachment; the PSC endpoint itself handles the forwarding. Option C is wrong because a Cloud VPN tunnel is used for site-to-site or remote access connectivity between on-premises networks and Google Cloud, not for connecting to a published PSC service.

Full explanation →

Page 1 of 13

Page 2

All pages

12345678910111213

Practice PCNE by domain

Target a specific domain to shore up weak areas.

Configuring Network ServicesManaging, Monitoring, and Optimising Network OperationsImplementing Hybrid InterconnectivityDesigning, Planning, and Prototyping a GCP NetworkImplementing VPC InstancesImplementing network securityImplementing a Virtual Private Cloud
See all domains with question counts →