Knowledge + Practice

Google Professional Cloud Network Engineer (PCNE) — Questions 676–750

961 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 10 of 13

676

Multi-Selecthard

Which TWO statements about VPC Network Peering are correct?

Select 2 answers

A.VPC peering supports global load balancing with internal IPs

B.VPC peering is supported within the same organization

C.VPC peering supports transitivity across multiple peerings

D.VPC peering allows overlapping CIDR ranges

E.VPC peering can be used to connect VPCs in different regions

AnswersB, E

Peering can be established between VPCs in the same organization.

Why this answer

VPC Network Peering is designed to connect VPCs within the same organization (or across different organizations) without requiring a VPN or gateway. It allows private RFC 1918 IP communication between VPCs, and when both VPCs belong to the same organization, the peering setup is straightforward and does not involve cross-organization trust policies. This is a fundamental use case for peering in Google Cloud.

Exam trap

The trap here is that candidates often assume VPC peering supports transitivity (Option C) because they confuse it with traditional router-based networking, but Google Cloud explicitly enforces non-transitive peering to maintain security and simplicity.

Full explanation →

677

MCQhard

Refer to the exhibit. You are troubleshooting an on-premises to Cloud VPN connection with dynamic routing. The BGP session is CONNECTED, but no routes are received from the on-premises router. What is the most likely cause?

A.The firewall rules are blocking BGP traffic.

B.The on-premises router is not configured to advertise routes.

C.The VPN tunnel is down.

D.The cloud router is not advertising any routes.

AnswerB

Since the BGP session is CONNECTED but no routes received, the on-premises side is not advertising.

Why this answer

The BGP session is up, but routesReceived is 0, indicating the on-premises router is not advertising routes.

Full explanation →

678

MCQmedium

A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?

A.The on-premises network does not have a route back to the VPC subnet.

B.A firewall rule is blocking ingress traffic from the on-premises network.

C.The BGP session is down.

D.The Cloud Router is not configured.

AnswerA

Return traffic requires a route on-premises pointing to the VPN gateway.

Why this answer

The most likely cause is that the on-premises network lacks a route back to the VPC subnet. For Cloud VPN, return traffic from the on-premises server must have a route pointing to the on-premises VPN gateway to reach the VM. Without this route, packets are dropped, causing asymmetric routing.

Option B is incorrect because firewall rules affect all traffic, not just the return path. Option C is incorrect because if the BGP session were down, no connectivity would exist at all. Option D is incorrect because Cloud Router is used for dynamic routing, but a missing return route would still cause the issue even with static routes.

Full explanation →

679

Matchingmedium

Match each Google Cloud interconnect or peering type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Direct physical connection between on-premises and Google

Connection via a supported service provider

Direct BGP peering between on-premises and Google edge

Peering via a carrier's network

Encrypted tunnel over the internet to your VPC

Why these pairings

Dedicated Interconnect offers a direct physical link with SLA. Partner Interconnect uses a service provider. Direct Peering is a direct BGP session, while Carrier Peering uses a carrier partner.

Common confusion occurs between Dedicated and Partner Interconnect.

Full explanation →

680

Multi-Selecteasy

Which TWO statements about VPC Network Peering are correct? (Choose TWO.)

Select 2 answers

A.Transitive peering is not supported; if Network A is peered with Network B and Network A is peered with Network C, Network B cannot communicate with Network C through Network A.

B.Peered networks can use globally distributed routing to communicate across regions without additional configuration.

C.Default routes (0.0.0.0/0) are automatically exported and imported between peered networks.

D.Firewall rules from one network are automatically applied to the peered network.

E.The subnet IP ranges of peered VPC networks must not overlap.

AnswersA, E

VPC peering is non-transitive; traffic must be directly peered.

Why this answer

VPC Network Peering is non-transitive by design. This means that if Network A is peered with both Network B and Network C, traffic cannot flow from Network B to Network C through Network A. Each peering connection is a direct, point-to-point link, and routing is not propagated across multiple peering hops.

This behavior is enforced by the GCP networking stack to prevent complex and unintended routing topologies.

Exam trap

Google Cloud often tests the misconception that VPC Network Peering supports transitive routing, similar to how traditional router-based networks work, but GCP explicitly disallows this to enforce network segmentation and prevent unintended traffic flows.

Full explanation →

681

MCQmedium

A company uses Identity-Aware Proxy (IAP) to secure access to Compute Engine VMs. Users report that they can SSH into some VMs but not others, even though they have the IAP-secured Tunnel User role. Both VMs are in the same project and have the same network tags. What is the most likely reason?

A.Firewall rules allow ingress from IAP's IP ranges only for some VMs.

B.The VMs are in different zones with different DNS resolution.

C.The VMs that can be accessed have external IP addresses; the others only have internal IP addresses.

D.The VMs do not have OS Login enabled.

AnswerA

Correct. If firewall rules allowing ingress from IAP's IP ranges are not applied to all VMs (despite same network tags), those VMs become inaccessible via IAP tunnel.

Why this answer

IAP TCP forwarding relies on firewall rules that allow ingress from the IAP proxy's IP ranges (35.235.240.0/20) to the VM. If these rules are applied inconsistently across VMs (e.g., missing on some subnets or instances), users will be unable to SSH into those VMs. The fact that both VMs share the same network tags does not guarantee identical firewall configurations if rules are applied based on other criteria like target tags or service accounts.

Options B and D are incorrect as DNS resolution and OS Login are not prerequisites for IAP TCP forwarding. Option C is wrong because IAP TCP forwarding works with internal IPs; external IPs are not required.

Exam trap

The trap here is assuming that identical IAM roles and network tags guarantee access, while overlooking that IAP TCP forwarding also requires explicit firewall rules allowing ingress from the IAP proxy IP ranges. Candidates often forget to verify firewall rules.

How to eliminate wrong answers

Option A is wrong because firewall rules in a project apply to all VMs with the same network tags; if the rules allow ingress from IAP's IP ranges (35.235.240.0/20) for one VM with a given tag, they apply equally to all VMs with that tag, so this cannot explain why some VMs are inaccessible. Option B is wrong because DNS resolution is not a factor in IAP tunneling; IAP uses IP addresses, not DNS names, and zones do not affect DNS resolution for internal VM connectivity. Option D is wrong because OS Login is not required for IAP tunneling; IAP works with standard SSH keys or gcloud auth, and OS Login is an optional authentication method that does not affect the ability to establish the IAP tunnel itself.

Full explanation →

682

MCQhard

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

A.Deploy the Cloud SQL Auth Proxy on each VM and configure IAM permissions for each VM's service account

B.Use Shared VPC and assign the specific VMs to a subnet with a dedicated secondary IP range, then restrict database access to that range

C.Use Private Service Connect to publish the database as a managed service and create a Private Service Connect endpoint in the spoke VPC with IAM permissions for the specific VM service accounts

D.Configure firewall rules in the hub project to allow traffic only from the specific VM internal IPs

AnswerC

Private Service Connect provides per-service account authorization and network isolation.

Why this answer

Private Service Connect (PSC) allows you to publish a managed service (like Cloud SQL) and create a PSC endpoint in the spoke VPC. By combining the PSC endpoint with IAM permissions on the VM service accounts, you ensure that only specific VMs can connect to the database, providing fine-grained, identity-aware access control without exposing the database to the entire network.

Exam trap

Google Cloud often tests the misconception that network-level controls (firewall rules or IP ranges) are sufficient for securing access to managed services, when in fact identity-based controls (IAM + Private Service Connect) provide a more secure and auditable solution in a shared VPC topology.

How to eliminate wrong answers

Option A is wrong because Cloud SQL Auth Proxy provides authentication and encryption but does not restrict network-level access; any VM with the proxy installed and valid IAM credentials could connect, and it does not leverage the hub-and-spoke topology for isolation. Option B is wrong because Shared VPC with a dedicated secondary IP range only controls IP addressing, not access; firewall rules would still be needed, and any VM in that subnet could reach the database, not just the specific VMs. Option D is wrong because firewall rules in the hub project filter traffic based on source IPs, which can be spoofed within the VPC or bypassed if VMs are moved; they lack identity-based controls and do not prevent traffic from other VMs in the same subnet.

Full explanation →

683

MCQmedium

An organization uses Cloud DNS with a managed zone for example.com. They want to block or override DNS queries for a specific malicious domain (malware.com) to return a sinkhole IP address. Which Cloud DNS feature should they use?

A.DNS forwarding

B.Response Policy Zone (RPZ)

C.DNS peering

D.Managed zone with DNSSEC

AnswerB

RPZ can override DNS responses for specified domains.

Why this answer

Response Policy Zones (RPZ) allow DNS administrators to override DNS responses for specific domains, such as redirecting malicious domains to a sinkhole.

Full explanation →

684

MCQhard

An organization wants to mirror all traffic from a set of Compute Engine instances to a third-party IDS appliance running on a separate instance in the same VPC. The IDS appliance must receive a copy of both ingress and egress traffic without impacting production traffic. Which Google Cloud service should they use?

A.Firewall Insights

B.VPC Flow Logs

C.Packet Mirroring

D.Cloud NAT logging

AnswerC

Packet Mirroring copies all traffic to a collector for deep packet inspection.

Why this answer

Packet Mirroring copies traffic from source instances (mirror source) to a collector (IDS appliance) for monitoring. It is designed for this purpose without affecting production.

Full explanation →

685

MCQhard

A company uses Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer needs to establish BGP peering between the on-premises router and Cloud Router. What must be created in Google Cloud to enable this?

A.An HA VPN gateway.

B.A VLAN attachment of type PARTNER_PROVIDER.

C.A Dedicated Interconnect attachment.

D.A VLAN attachment of type PARTNER.

AnswerB

PARTNER_PROVIDER is used when the partner provides Layer 2 connectivity.

Why this answer

With Layer 2 Partner Interconnect, the service provider extends a VLAN to Google. You create a VLAN attachment of type PARTNER_PROVIDER, which allows you to configure the Cloud Router and BGP session.

Full explanation →

686

MCQeasy

A company needs to connect multiple on-premises sites to Google Cloud using a single Cloud VPN gateway. What is the recommended approach?

A.Create a single VPN tunnel and use policy-based routing to direct traffic.

B.Use a single VPN tunnel with multiple BGP sessions.

C.Create multiple VPN tunnels, each with its own BGP session to a Cloud Router.

D.Create a single VPN tunnel and use static routes for each site.

AnswerC

This allows each site to have its own encrypted tunnel and dynamic routing.

Why this answer

When connecting multiple on-premises sites to Google Cloud using a single Cloud VPN gateway, the recommended approach is to create multiple VPN tunnels, each with its own BGP session to a Cloud Router. This allows the Cloud VPN gateway to terminate multiple tunnels, and each tunnel can have a unique BGP session for dynamic route exchange, enabling the gateway to learn and advertise routes for each site independently. Using a single tunnel with multiple BGP sessions or policy-based routing is not supported because a Cloud VPN tunnel is a point-to-point connection that can only have one BGP session per tunnel, and static routes would not provide the redundancy or dynamic failover needed for multiple sites.

Exam trap

Google Cloud often tests the misconception that a single VPN tunnel can support multiple BGP sessions or that policy-based routing can be used to segregate traffic for multiple sites, but in Google Cloud, each tunnel is a point-to-point construct that requires its own BGP session, and policy-based routing is not available for Cloud VPN.

How to eliminate wrong answers

Option A is wrong because policy-based routing is not a supported feature for Cloud VPN tunnels; Cloud VPN uses route-based VPNs (with BGP or static routes) and cannot direct traffic based on policies across multiple sites through a single tunnel. Option B is wrong because a single VPN tunnel can only have one BGP session; multiple BGP sessions cannot be established over a single tunnel as each BGP session requires a separate tunnel interface and peer IP address. Option D is wrong because using a single VPN tunnel with static routes for each site would create a single point of failure and cannot provide the dynamic routing, failover, or load balancing needed for multiple on-premises sites; static routes also require manual updates if site topologies change.

Full explanation →

687

MCQeasy

A team needs to perform a health check for a gRPC backend service. Which health check type should they use?

A.HTTP health check

B.TCP health check

C.gRPC health check

D.SSL health check

AnswerC

gRPC health check uses the gRPC Health Checking Protocol to verify service health.

Why this answer

Cloud Load Balancing supports HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC health checks. For gRPC backends, the gRPC health check is the most appropriate.

Full explanation →

688

MCQeasy

A team has deployed Compute Engine instances with internal IPs only. They need to allow these instances to download updates from specific external IP ranges. Which action should they take?

A.Create egress firewall rules with target tags and allowed IP ranges.

B.Configure Cloud NAT and allow all traffic.

C.Attach a public IP to each instance.

D.Use Private Google Access.

AnswerA

Egress firewall rules can restrict outbound traffic to specific IP ranges.

Why this answer

Egress firewall rules with target tags allow you to control outbound traffic from Compute Engine instances based on destination IP ranges. By specifying the allowed external IP ranges for updates and applying the rule to instances with a specific tag, you enable secure outbound access without exposing the instances to inbound traffic or requiring public IPs.

Exam trap

Google Cloud often tests the misconception that Cloud NAT alone can restrict outbound traffic to specific destinations, but Cloud NAT only provides source NAT and does not filter traffic by destination; egress firewall rules are required for that control.

How to eliminate wrong answers

Option B is wrong because Cloud NAT provides outbound connectivity to the internet for instances without public IPs, but it does not restrict traffic to specific external IP ranges; allowing all traffic would violate the requirement to limit updates to specific IP ranges. Option C is wrong because attaching a public IP to each instance would expose them to inbound traffic from the internet, increasing the attack surface and contradicting the requirement to use internal IPs only. Option D is wrong because Private Google Access enables instances with internal IPs to reach Google APIs and services, not external third-party update servers.

Full explanation →

689

Matchingmedium

Match each VPC networking concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Regional IP range within a VPC

Connection between two VPCs for private IP communication

VPC from one project shared with other projects

Outbound internet access for private instances

Access Google APIs from on-premises or other clouds

Why these pairings

VPC is global, subnets are regional. Firewall rules filter traffic, routes determine paths. Common confusions: swapping global/regional or filtering/routing.

Full explanation →

690

MCQmedium

A company uses Shared VPC to grant separate teams access to subnets in a host project. They want to allow Team A to create VM instances in subnet-1, but not delete the subnet itself. Which IAM role should be granted to Team A on subnet-1?

A.roles/owner

B.roles/compute.networkAdmin

C.roles/compute.instanceAdmin.v1

D.roles/compute.networkUser

AnswerD

networkUser allows using the subnet without full administrative rights.

Why this answer

The Compute Network User role (roles/compute.networkUser) grants permissions to use existing networks and subnets (create VMs, attach disks, etc.) but not to delete or modify network resources.

Full explanation →

691

Multi-Selectmedium

A company has a VPC with three tiers: web, app, and db. They want to enforce that only the web tier can communicate with the app tier on TCP port 8080, and only the app tier can communicate with the db tier on TCP port 3306. All instances are in the same region but different subnets. Which TWO firewall rules should be created? (Choose 2.)

Select 2 answers

A.An ingress rule on the db tier instances with tag 'db' allowing TCP 3306 from instances with tag 'app'.

B.An egress rule on the web instances with tag 'web' allowing TCP 8080 to the app subnet.

C.An egress rule on the web subnet allowing TCP 8080 to any destination.

D.An ingress rule on the app tier instances with tag 'app' allowing TCP 8080 from instances with tag 'web'.

E.An ingress rule on the web subnet allowing TCP 8080 from the app subnet.

AnswersA, D

This ensures only app tier can reach db tier on port 3306.

Why this answer

To control traffic between tiers, ingress firewall rules should be applied to the destination instances using target tags. For web-to-app (TCP 8080), place an ingress rule on app instances (tag 'app') allowing TCP 8080 from source tag 'web' (Option D). For app-to-db (TCP 3306), place an ingress rule on db instances (tag 'db') allowing TCP 3306 from source tag 'app' (Option A).

Option B is an egress rule on web, which controls outbound traffic but does not prevent other sources from reaching app. Option C allows traffic to any destination, violating the principle of least privilege. Option E incorrectly places an ingress rule on the web subnet, but the web tier should be the source, not the destination. Therefore, the correct answers are A and D.

Full explanation →

692

MCQeasy

A company is deploying a hybrid cloud solution using Partner Interconnect. They have ordered a 1 Gbps connection from a partner at a colocation facility. The on-premises network uses a 10 Gbps link to the colo, and the partner provides a single 1 Gbps connection to Google Cloud. The company wants to connect two separate VPC networks in Google Cloud (production and development) to their on-premises network. Each VPC requires 500 Mbps of dedicated bandwidth. The company also needs high availability for the connection. What should they do?

A.Create a single VLAN attachment, then use a shared VPC with two subnets. Configure one Cloud Router with two BGP sessions, one for each subnet.

B.Create one VLAN attachment with 1 Gbps capacity, attach it to both VPCs using a single Cloud Router with two BGP sessions.

C.Create two VLAN attachments on the same interconnect, each with 500 Mbps capacity. Configure a separate Cloud Router for each VPC, each with a BGP session on its respective VLAN attachment. Use BGP metrics for active/passive failover.

D.Order two separate 1 Gbps Partner Interconnect connections, one for each VPC, and configure each with a single VLAN attachment.

AnswerC

Correct. This meets bandwidth and HA requirements.

Why this answer

Partner Interconnect supports multiple VLAN attachments on a single connection, each with its own capacity allocation. By creating two VLAN attachments with 500 Mbps each, you can dedicate bandwidth to each VPC while meeting the 500 Mbps requirement. Using separate Cloud Routers with BGP sessions on each VLAN attachment and adjusting BGP metrics (e.g., local preference) allows active/passive failover for high availability, satisfying both the bandwidth and HA needs without requiring additional physical connections.

Exam trap

The trap here is that candidates assume a single VLAN attachment can serve multiple VPCs or that multiple physical connections are required for multiple VPCs, but Partner Interconnect allows multiple VLAN attachments on one connection, each dedicated to a different VPC with its own bandwidth and BGP session.

How to eliminate wrong answers

Option A is wrong because a single VLAN attachment cannot be shared across two separate VPC networks; VLAN attachments are per-VPC resources, and using a shared VPC with subnets does not provide dedicated bandwidth per VPC or proper isolation. Option B is wrong because a single VLAN attachment cannot be attached to two VPCs simultaneously; each VLAN attachment is associated with exactly one VPC and one Cloud Router, and a single Cloud Router with two BGP sessions cannot route traffic to two different VPCs over the same attachment. Option D is wrong because ordering two separate 1 Gbps connections is unnecessary and cost-prohibitive; a single 1 Gbps Partner Interconnect connection can support multiple VLAN attachments (up to 8 per connection) to serve multiple VPCs with dedicated bandwidth.

Full explanation →

693

MCQmedium

Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?

A.Add a rate-based rule to limit the number of requests per second.

B.Create a rule with higher priority to allow the legitimate traffic before the WAF rule.

C.Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.

D.Enable TLS inspection for the load balancer to fully inspect encrypted traffic.

AnswerC

Reducing sensitivity reduces false positives.

Why this answer

The preconfigured WAF rule for SQL injection (sqli-stable) uses a default sensitivity level that may be too aggressive, causing false positives on legitimate traffic. By lowering the sensitivity level or excluding specific request attributes (e.g., headers, cookies, or URI paths), you can reduce false positives while still blocking actual SQL injection attempts. Cloud Armor allows fine-tuning of preconfigured rules via the `sensitivity` parameter and `exclude` lists, which is the correct approach here.

Exam trap

Google Cloud often tests the misconception that false positives from WAF rules are best handled by adding allow rules or rate limiting, rather than tuning the rule's sensitivity or exclusions, which is the proper Cloud Armor mechanism.

How to eliminate wrong answers

Option A is wrong because rate-based rules limit request frequency to mitigate DDoS or brute-force attacks, not to address false positives from a WAF rule that incorrectly flags legitimate SQL-like patterns. Option B is wrong because creating a higher-priority allow rule would bypass the WAF rule entirely for that traffic, defeating the purpose of SQL injection protection and potentially allowing actual attacks through. Option D is wrong because TLS inspection (e.g., using Cloud Armor with HTTPS load balancers) is already performed by default for encrypted traffic; the issue is not about decryption but about the WAF rule's sensitivity to benign SQL-like patterns.

Full explanation →

694

MCQhard

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

A.Move all resources to a single region, such as us-central1, and use a single VPC.

B.Set up a Cloud VPN tunnel with Cloud Router and use BGP to advertise routes between the two regions.

C.Create a VPC peering connection between the frontend and backend VPCs.

D.Enable Cloud CDN on the backend load balancer to cache database responses.

AnswerA

Correct. Consolidating all resources to a single region eliminates cross-region latency, reducing database query times and simplifying the network.

Why this answer

The latency issue stems from inter-region communication between the backend and Cloud SQL database. By moving all resources to a single region (us-central1), you eliminate cross-region traffic entirely, reducing latency to the minimum possible within that region. This is the most cost-effective solution as it avoids any additional networking costs and simplifies the architecture.

While it may require a redesign of the MIGs, it directly addresses the root cause of high latency. Option B (Cloud VPN) adds a VPN tunnel over the Google backbone, which would introduce extra latency and cost without solving the underlying routing issue within the same VPC. Option C (VPC peering) is irrelevant since the resources are already in the same VPC.

Option D (Cloud CDN) is designed for caching static content, not database queries, and would not reduce latency for dynamic database traffic.

Exam trap

Google Cloud often tests the misconception that Cloud VPN with BGP can optimize routing within the same VPC, but the trap here is that VPN is for connecting separate networks, not for enhancing internal routing. The real solution is consolidation to a single region.

How to eliminate wrong answers

Option A is wrong because moving all resources to a single region would eliminate the multi-region architecture, potentially increasing latency for users in other regions and violating the requirement to minimize latency between regions while maintaining the existing deployment. Option C is wrong because VPC peering connects two separate VPCs, but the frontend and backend are already in the same VPC (custom subnet mode 10.0.0.0/16), so peering is unnecessary and does not address routing optimization between regions. Option D is wrong because Cloud CDN caches static content at edge locations, not database query responses, and it cannot reduce latency for dynamic database queries that require real-time access to Cloud SQL.

Full explanation →

695

Multi-Selectmedium

An organization needs low-latency connectivity between their on-premises data center and Google Cloud, supporting up to 20 Gbps throughput. They already have a Partner Interconnect connection but need to increase capacity. Which two actions should they take? (Choose two.)

Select 2 answers

A.Work with the service provider to upgrade the existing interconnect to a higher capacity

B.Create additional Cloud VPN tunnels to the same region

C.Provision a new Dedicated Interconnect to bypass the partner

D.Provision additional VLAN attachments on the existing Partner Interconnect

AnswersA, D

Partner Interconnect bandwidth can be upgraded with provider.

Why this answer

Partner Interconnect connections can be upgraded to higher capacity by working with the service provider, as the provider manages the underlying physical circuit. This allows increasing throughput up to 20 Gbps without replacing the existing connection, leveraging the existing Layer 2 or Layer 3 handoff.

Exam trap

Google Cloud often tests the misconception that adding Cloud VPN tunnels can scale throughput to match Interconnect speeds, but VPN tunnels have lower bandwidth limits and higher latency, making them unsuitable for high-throughput, low-latency requirements.

Full explanation →

696

Matchingmedium

Match each Google Cloud networking service to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Provides outbound connectivity for private instances

Securely connects on-premises to VPC via IPsec

Delivers content from edge caches globally

Translates domain names to IP addresses

Manages service mesh traffic with global load balancing

Why these pairings

Correct matches: Cloud Load Balancing distributes traffic, Cloud CDN caches content, Cloud DNS resolves domain names. Common confusions: Cloud NAT is for internet access without external IPs, Virtual Private Cloud provides isolated networks, and Cloud Interconnect connects on-premises to Google Cloud.

Full explanation →

697

Multi-Selecteasy

A network engineer needs to configure firewall rules to allow health checks from Google Cloud's health check systems to a backend service. Which two source IP ranges should they allow? (Choose two.)

Select 2 answers

A.169.254.0.0/16

B.10.0.0.0/8

C.130.211.0.0/22

D.35.191.0.0/16

E.0.0.0.0/0

AnswersC, D

This is the other health check range.

Why this answer

Google Cloud health check probes originate from the specific IP ranges 130.211.0.0/22 and 35.191.0.0/16. Allowing these source ranges in firewall rules is necessary to permit health check traffic to reach backend instances, ensuring load balancers can determine instance health.

Exam trap

Google Cloud often tests the misconception that health checks originate from the same subnet as the load balancer or from private IP ranges, leading candidates to incorrectly select 10.0.0.0/8 or 169.254.0.0/16 instead of the documented Google Cloud health check source ranges.

Full explanation →

698

MCQmedium

A company uses Cloud Armor to protect its HTTP(S) load balancer. They need to block requests from a specific geographic region and also apply a rate limiting rule. What is the correct order of evaluation for Cloud Armor security policies?

A.Rate limiting rules are evaluated separately from other rules.

B.Evaluate rules in priority order and apply all matching rules.

C.Evaluate rules in priority order; the first matching rule determines the action.

D.Evaluate all rules and apply the most restrictive action.

AnswerC

This is the correct behavior of Cloud Armor security policies.

Why this answer

Cloud Armor security policies evaluate rules in priority order, and the first rule that matches the request determines the action (allow or deny). This means that if a rate limiting rule matches first, it will be applied, and subsequent rules are not evaluated. Option C correctly describes this behavior.

Exam trap

Google Cloud often tests the misconception that all matching rules are applied or that the most restrictive action is taken, but Cloud Armor uses first-match semantics, not cumulative or most-restrictive logic.

How to eliminate wrong answers

Option A is wrong because rate limiting rules are not evaluated separately; they are integrated into the same priority-ordered rule set as other rules. Option B is wrong because Cloud Armor does not apply all matching rules; it stops at the first match and applies only that rule's action. Option D is wrong because Cloud Armor does not evaluate all rules and apply the most restrictive action; it uses the first match in priority order, not the most restrictive.

Full explanation →

699

MCQhard

A large enterprise uses hierarchical firewall policies across multiple VPCs. They have an organization policy that requires all VPCs to block SSH from the internet. However, a development team needs SSH from a specific external IP range for a building. How can they create a firewall rule that allows that range without violating the organization policy?

A.Remove the organization policy and implement firewall rules at the project level only.

B.Create a project-level firewall policy with a priority higher than the organization policy's deny rule, allowing the specific source range.

C.Use VPC firewall rules instead of hierarchical policies to allow the range, as they are evaluated after hierarchical policies.

D.Add the external IP range to an exception list in the organization policy.

AnswerB

In hierarchical firewall policies, lower priority numbers take precedence. A project-level rule with a higher priority (lower number) than the organization's deny rule will be evaluated first and allow the traffic.

Why this answer

In Google Cloud, hierarchical firewall policies are evaluated before VPC firewall rules, and the effective rule is the one with the highest priority (lowest numeric value). By creating a project-level firewall policy rule with a higher priority (e.g., priority 100) than the organization policy's deny rule (e.g., priority 1000), the allow rule for the specific external IP range will take precedence, effectively overriding the deny for that traffic while keeping the organization policy intact.

Exam trap

Google Cloud often tests the misconception that VPC firewall rules are evaluated after hierarchical policies and can override them, but in reality, hierarchical policies are evaluated first and their deny rules will block traffic unless a higher-priority allow rule exists within the hierarchical policy hierarchy.

How to eliminate wrong answers

Option A is wrong because removing the organization policy violates the enterprise's security requirements and is not necessary; the goal is to allow a specific exception without removing the global block. Option C is wrong because VPC firewall rules are evaluated after hierarchical policies, so a VPC rule allowing SSH would be overridden by the hierarchical deny rule, not the other way around. Option D is wrong because Google Cloud hierarchical firewall policies do not support an 'exception list' mechanism; exceptions must be implemented via higher-priority allow rules within the hierarchical policy or at a lower level.

Full explanation →

700

MCQmedium

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth of at least 10 Gbps. Which connectivity option meets these requirements?

A.Cloud VPN with two tunnels to different gateways

B.Dedicated Interconnect with two circuits (each 10 Gbps) to different edge locations

C.Direct Peering with multiple BGP sessions

D.Partner Interconnect with 1 Gbps VLAN attachments

AnswerB

Dedicated Interconnect offers 10 Gbps per circuit and with two circuits provides HA and meets bandwidth requirement.

Why this answer

Dedicated Interconnect with two 10 Gbps circuits to different edge locations meets the 10 Gbps bandwidth requirement and provides high availability through diverse physical paths. Cloud VPN maxes out at 3 Gbps per tunnel, Direct Peering does not offer SLA-backed bandwidth or support for 10 Gbps single connections, and Partner Interconnect typically caps at 1 Gbps per VLAN attachment.

Exam trap

Google Cloud often tests the misconception that Cloud VPN can achieve 10 Gbps by using multiple tunnels, but the per-tunnel and per-VPN gateway throughput limits (typically 3 Gbps) make it unsuitable for sustained 10 Gbps traffic, while Dedicated Interconnect provides dedicated physical circuits with guaranteed bandwidth.

How to eliminate wrong answers

Option A is wrong because Cloud VPN tunnels have a maximum throughput of approximately 3 Gbps per tunnel (even with two tunnels, aggregate throughput is limited by the VPN gateway capacity and does not guarantee 10 Gbps). Option C is wrong because Direct Peering is a bilateral arrangement without a Google SLA, does not support dedicated bandwidth guarantees, and is not designed for single-connection 10 Gbps throughput to a VPC. Option D is wrong because Partner Interconnect VLAN attachments are typically offered at 1 Gbps or lower, and even with multiple attachments, they do not provide the dedicated 10 Gbps circuit required.

Full explanation →

701

MCQmedium

A company wants to load balance TCP traffic (non-HTTP) across a group of Compute Engine instances in a single region, while preserving the client IP address. They also need to support session affinity based on client IP. Which load balancer should they choose?

A.Global SSL Proxy Load Balancer

B.Global TCP Proxy Load Balancer

C.Internal TCP/UDP Load Balancer

D.External TCP/UDP Network Load Balancer

AnswerD

Correct. It is pass-through, preserves client IP, and supports session affinity.

Why this answer

External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and supports session affinity. Other options either terminate connections or are HTTP-specific.

Full explanation →

702

MCQmedium

An organization wants to use Cloud DNS to resolve queries for a custom domain 'example.internal' across multiple projects in the same organization. They have a private zone in project A and want project B to be able to resolve records in that zone. Which feature should they use?

A.Shared VPC

B.Public zone with visibility

C.DNS forwarding

D.DNS peering

AnswerD

DNS peering enables cross-project DNS resolution by allowing a target project to query the source project's private zone.

Why this answer

DNS peering allows a private zone in one project to be shared with other projects for DNS resolution.

Full explanation →

703

Multi-Selecteasy

A network engineer is troubleshooting high latency between two VM instances in different GCP regions. Which TWO tools can help identify packet loss and latency issues? (Choose TWO.)

Select 2 answers

A.VPC Flow Logs

B.Performance Dashboard

C.Network Topology

D.Connectivity Tests

E.Firewall Insights

AnswersB, D

Performance Dashboard provides latency and packet loss metrics.

Why this answer

Performance Dashboard shows latency and packet loss between regions. Connectivity Tests can also report latency and packet loss along the path.

Full explanation →

704

MCQmedium

You need to configure firewall rules to allow HTTP (TCP 80) traffic from the internet to instances in a VPC. The instances are in different subnets and have a network tag 'web-server'. You want to minimize the number of rules. Which rule configuration is correct?

A.Create an ingress rule with source 0.0.0.0/0, protocol tcp:0-65535, and target tags 'web-server'.

B.Create an egress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

C.Create an ingress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

D.Create an ingress rule for each subnet with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

AnswerC

This single ingress rule allows HTTP from any source to instances tagged 'web-server'.

Why this answer

Firewall rules are global, so one ingress rule can apply to all instances with the tag 'web-server' regardless of subnet. The direction must be ingress, source 0.0.0.0/0, protocol tcp:80, and target tags 'web-server'.

Full explanation →

705

MCQmedium

A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?

A.The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.

B.Cloud NAT is enabled.

C.Firewall rules allow ingress from on-premises IPs.

D.The on-premises router is advertising the route via BGP.

AnswerA

Correct. A custom route with the correct next-hop VPN tunnel interface ensures traffic to 10.1.0.0/16 goes through the intended tunnel.

Why this answer

A custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface is required to force traffic to go through that specific tunnel. Option B is incorrect because Cloud NAT is for outbound internet access, not routing to on-premises. Option C is incorrect because firewall rules control access but not routing.

Option D is incorrect because on-premises BGP advertisement is for routes from on-premises to Google Cloud, not for directing traffic within Google Cloud.

Full explanation →

706

MCQmedium

A company wants to route traffic to different backend services based on the geographic location of the client. Which Cloud DNS routing policy should they use?

A.Weighted round robin

B.Failover

C.Geolocation

D.Cloud CDN

AnswerC

Correct: geolocation routing routes traffic based on client location.

Why this answer

Geolocation routing policy directs traffic to different backends based on the geographic location of the DNS resolver.

Full explanation →

707

MCQhard

A company is designing a hub-and-spoke VPC architecture in Google Cloud. The hub VPC hosts a set of shared services, including a third-party firewall appliance (NGFW) in a managed instance group behind a TCP load balancer. Spoke VPCs need to send traffic to the hub's internal TCP load balancer IP (10.0.0.10) for inspection. The firewall appliance inspects traffic and forwards it to the final destination. The network team notices that traffic from one spoke to the load balancer is being dropped. They have verified that VPC peering is established, routes are propagated, and firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

A.The spoke VPC's subnet routes are not advertised to the hub VPC via VPC peering.

B.The spoke VPC does not have a route to the hub's internal load balancer IP via the peering connection.

C.The internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target.

D.The hub VPC uses Cloud NAT, which is not compatible with VPC peering.

AnswerC

Correct. If the forwarding rule on the internal TCP load balancer points to the wrong target (e.g., a different instance group or an unresponsive backend), traffic will be dropped even though routing and firewall rules are correct.

Why this answer

The most likely cause is that the internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target (e.g., an incorrect backend instance group or port). Even though VPC peering, routes, and firewall rules are verified as correctly set up, if the load balancer does not forward traffic to the NGFW appliance, the traffic will be dropped. Misconfiguration of the forwarding rule is a common issue that can occur independently of network layer setup.

Exam trap

Candidates often overlook load balancer configuration when troubleshooting connectivity, assuming that if routes and firewall rules are correct, the issue must be at the network layer. However, internal TCP/UDP load balancers require correct forwarding rules and healthy backends.

How to eliminate wrong answers

Option B is wrong because the spoke VPC does have a route to the hub's internal load balancer IP via the peering connection — VPC peering automatically installs routes for the entire peered VPC's subnet ranges, so the spoke can reach 10.0.0.10. Option C is wrong because the forwarding rule misconfiguration would cause traffic to never reach the load balancer, but the question states traffic is being dropped (not that it fails to arrive), and the team has verified firewall rules and routes, implying the forwarding rule is correct. Option D is wrong because Cloud NAT is used for outbound internet access from instances without external IPs, and it is fully compatible with VPC peering — it does not interfere with traffic to internal load balancers.

Full explanation →

708

MCQhard

A security team wants to restrict which Google services can be accessed from their VPC without external IPs. They use Private Google Access. What should they use to block access to specific services?

A.VPC Service Controls

B.Firewall rules blocking destination IPs

C.Cloud NAT with a specific IP range

D.Private Google Access with restricted VIPs

AnswerA

This service creates perimeters to control access to Google services.

Why this answer

VPC Service Controls allows creating security perimeters that restrict access to services.

Full explanation →

709

MCQeasy

A company has a VPC with subnet 10.1.0.0/24 in us-central1. They created a Cloud NAT gateway named 'nat-us-central1' attached to that subnet. During peak hours, many VM instances in the subnet cannot connect to the internet. The NAT configuration shows only one NAT IP. Firewall rules allow egress traffic, and health checks confirm the NAT gateway is functioning. What is the most likely cause of the failure?

A.The Cloud Router is missing or misconfigured.

B.The NAT gateway is not attached to the correct subnet.

C.An egress firewall rule blocks ICMP packets.

D.Port exhaustion due to insufficient NAT IP addresses.

AnswerD

One NAT IP provides limited source ports, easily exhausted by many concurrent connections.

Why this answer

With only one NAT IP address and many VM instances sharing it, the available source ports (65,535 per IP) are quickly exhausted during peak hours. Each concurrent outbound connection consumes a unique source port; once all ports are in use, new connections fail. This is a classic port exhaustion scenario, not a configuration or firewall issue.

Exam trap

Google Cloud often tests the misconception that firewall rules or router misconfiguration are the primary cause of connectivity failures, when in reality port exhaustion from insufficient NAT IPs is a common scaling issue in high-traffic environments.

How to eliminate wrong answers

Option A is wrong because Cloud NAT requires a Cloud Router for dynamic routing, but the question states the NAT gateway is functioning and health checks pass, indicating the router is present and correctly configured. Option B is wrong because the NAT gateway is explicitly attached to subnet 10.1.0.0/24, and health checks confirm it is working, so the attachment is correct. Option C is wrong because the firewall rules allow egress traffic, and ICMP is not required for general internet connectivity; the failure affects all protocols, not just ICMP.

Full explanation →

710

MCQmedium

A company needs to advertise a specific prefix from their on-premises network to GCP via Cloud Router. They do not want to advertise all connected networks. What should they configure on the Cloud Router's BGP peer?

A.Use a static route instead

B.Export custom routes

C.Global routing mode

D.Route advertisements with custom learned routes

AnswerD

Correct. You can set custom learned routes to control advertised prefixes.

Why this answer

Custom learned routes allow you to specify which prefixes are advertised to GCP via BGP.

Full explanation →

711

Multi-Selectmedium

A company has two Dedicated Interconnect connections from different metro areas to their GCP VPC. They want to use both connections actively (active-active load balancing) without manual intervention. Which TWO configurations are required to achieve this? (Choose two.)

Select 2 answers

A.Use AS path prepending on one of the BGP sessions

B.Advertise the same on-premises prefix with the same MED on both BGP sessions

C.Configure ECMP on the Cloud Router

D.Create two separate Cloud Routers

E.Set different MED values on each BGP session

AnswersB, C

Equal MED ensures both paths are considered equal by BGP, enabling ECMP.

Why this answer

To use active-active, you must configure ECMP on the Cloud Router to load balance across both BGP sessions, and advertise the same prefixes with equal priority (same MED) from both on-premises routers.

Full explanation →

712

MCQeasy

Your company has a VPC with a single subnet in us-central1 (10.0.1.0/24). You have a managed instance group (MIG) of web servers (10.0.1.2-10.0.1.10) and a standalone database instance (10.0.1.100). The web servers need to communicate with the database on TCP port 3306. You have configured a firewall rule allowing ingress from 10.0.1.0/24 to 10.0.1.100 on tcp:3306. However, the web servers cannot connect to the database. You verified that the database is running and listening on port 3306, and that the web servers can ping the database. What should you do to resolve the issue?

A.Create a custom route from the web servers to the database.

B.Check the database instance's OS-level firewall (e.g., iptables) and ensure it allows traffic on port 3306 from the web servers.

C.Add a network tag 'db' to the database instance and update the firewall rule to target 'db'.

D.Configure the firewall rule to use the database's service account as the target.

AnswerB

The VPC firewall allows traffic, but the OS firewall on the database may be blocking the connection.

Why this answer

The firewall rule is correctly configured at the VPC level to allow ingress from the web servers' subnet to the database on TCP port 3306. Since the web servers can ping the database, network connectivity exists, but the application-layer connection fails. This indicates the database instance's OS-level firewall (e.g., iptables on Linux) is blocking the port, as cloud VPC firewall rules and guest OS firewalls operate independently.

Exam trap

Google Cloud often tests the distinction between cloud-level firewall rules and guest OS firewalls, leading candidates to overcomplicate the solution with network tags or routes when the issue is a simple OS-level block.

How to eliminate wrong answers

Option A is wrong because custom routes control packet forwarding paths, not firewall filtering; the web servers and database are in the same subnet, so no routing is needed. Option C is wrong because network tags are used to apply firewall rules to specific instances, but the existing rule already allows traffic from the entire subnet (10.0.1.0/24) to the database IP, so tags are unnecessary and would not fix an OS-level block. Option D is wrong because service accounts are used for authentication and authorization to Google Cloud APIs, not for controlling network traffic within a VPC; firewall rules cannot target service accounts.

Full explanation →

713

MCQhard

A network engineer configured a hierarchical firewall policy at the organization level with a priority 100 rule that denies all ingress traffic. At the folder level, a policy with priority 110 allows ingress from a specific IP range. At the VPC level, a network firewall policy with priority 90 allows ingress from a different IP range. Which traffic will be allowed?

A.Traffic matching either the folder-level or VPC-level allow rules

B.Only traffic matching the folder-level allow rule

C.Only traffic matching the VPC-level allow rule

D.No traffic is allowed because the org-level deny is evaluated last

AnswerC

The VPC-level policy has priority 90, which is lower than the org-level deny (100), so it overrides the deny and allows matching traffic.

Why this answer

Hierarchical firewall policies are evaluated in order of priority (lower number = higher priority) and then network firewall policies. The org-level rule with priority 100 denies all ingress. The folder-level rule with priority 110 allows specific IPs, but since the org rule has higher priority, it overrides the folder rule.

The VPC-level network firewall policy is evaluated after hierarchical policies and has priority 90, which is lower than 100, so it would override the org rule. However, hierarchical policies are evaluated before network firewall policies only if they have higher priority. Here, the VPC policy has priority 90, which is lower than 100, so it takes precedence over the org-level deny.

Thus, traffic matching the VPC policy's allowed IP range is allowed.

Full explanation →

714

Multi-Selectmedium

Which THREE of the following are benefits of using VPC Flow Logs?

Select 3 answers

A.Compliance and audit requirements.

B.Troubleshooting connectivity issues.

C.Detecting DDoS attacks.

D.Reducing network latency.

E.Real-time network monitoring.

AnswersA, B, C

Flow logs provide records of network traffic for compliance.

Why this answer

VPC Flow Logs capture network traffic metadata, which can be used for compliance auditing (A), troubleshooting connectivity issues (B), and analyzing traffic patterns to detect DDoS attacks (C). Option D is incorrect because flow logs do not reduce latency; they only log data. Option E is incorrect because flow logs are not real-time; there is a delay in log delivery.

Full explanation →

715

MCQeasy

A company is deploying a Dedicated Interconnect with a 10 Gbps circuit to Google Cloud. They need to ensure high availability. Which configuration is required by Google Cloud to meet the high availability SLA?

A.Combine Dedicated Interconnect with a Cloud VPN tunnel for failover

B.Use Partner Interconnect instead of Dedicated Interconnect

C.Provision two VLAN attachments on two separate Cloud Routers in different zones

D.Provision a single VLAN attachment on one Cloud Router

AnswerC

Two VLAN attachments in different zones provide redundancy and meet the HA SLA.

Why this answer

To meet the high availability SLA for Dedicated Interconnect, Google Cloud requires at least two VLAN attachments, each on a separate Cloud Router in different zones. This ensures that if one zone or Cloud Router fails, traffic can still flow through the other attachment, providing redundancy. A single VLAN attachment or a single Cloud Router does not meet the 99.99% availability SLA because it creates a single point of failure.

Exam trap

The trap here is that candidates often think a single Cloud Router with multiple VLAN attachments is sufficient, but Google Cloud requires the Cloud Routers themselves to be in different zones to avoid a single point of failure at the zone level.

How to eliminate wrong answers

Option A is wrong because combining Dedicated Interconnect with a Cloud VPN tunnel is not a required configuration for the high availability SLA; while it can provide a backup path, the SLA specifically requires redundant VLAN attachments on separate Cloud Routers in different zones. Option B is wrong because Partner Interconnect is an alternative connectivity option, not a requirement for high availability; the SLA for Dedicated Interconnect is met with redundant VLAN attachments, not by switching to Partner Interconnect. Option D is wrong because a single VLAN attachment on one Cloud Router creates a single point of failure and does not meet the high availability SLA, which mandates at least two attachments in different zones.

Full explanation →

716

Multi-Selecteasy

An organization is considering using Partner Interconnect to connect to Google Cloud. They want the service provider to manage the BGP sessions. Which TWO configurations must they choose? (Choose TWO.)

Select 2 answers

A.Select Layer 2 connectivity option with the provider

B.Create VLAN attachment of type PARTNER_PROVIDER

C.Select Layer 3 connectivity option with the provider

D.Create VLAN attachment of type PARTNER

E.Configure BGP sessions on the Cloud Router

AnswersB, C

PARTNER_PROVIDER is used when the provider manages BGP.

Why this answer

For Layer 3 connectivity where the provider manages BGP, the VLAN attachment type must be PARTNER_PROVIDER, and the provider handles BGP.

Full explanation →

717

MCQmedium

A company needs to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have a service level agreement that requires 99.99% availability for the connection. What is the minimum number of VLAN attachments they must provision, and how should they be configured to meet this SLA?

A.One VLAN attachment with a single Interconnect

B.Two VLAN attachments, each on a different Interconnect

C.Four VLAN attachments on two Interconnects

D.Two VLAN attachments on the same Interconnect

AnswerB

Two VLAN attachments on redundant Interconnects provide the required availability.

Why this answer

To achieve 99.99% availability for Dedicated Interconnect, you must eliminate single points of failure. A single VLAN attachment on one Interconnect (Option A) provides no redundancy. Google Cloud requires at least two VLAN attachments, each on a different Interconnect (and ideally different edge availability domains), to meet this SLA.

This ensures that if one Interconnect or VLAN attachment fails, traffic can fail over to the other, maintaining connectivity.

Exam trap

Google Cloud often tests the misconception that two VLAN attachments on the same Interconnect provide redundancy, but the trap here is that they share the same physical link and edge availability domain, so a single failure takes down both attachments.

How to eliminate wrong answers

Option A is wrong because a single VLAN attachment on one Interconnect creates a single point of failure; Google Cloud's 99.99% SLA for Dedicated Interconnect requires redundant connections across at least two separate Interconnects. Option C is wrong because four VLAN attachments on two Interconnects exceed the minimum requirement; two VLAN attachments (one per Interconnect) are sufficient to meet the 99.99% SLA, and adding more does not increase availability beyond the SLA. Option D is wrong because two VLAN attachments on the same Interconnect share the same physical link; if that Interconnect fails, both attachments go down, so this configuration does not provide the required redundancy.

Full explanation →

718

MCQmedium

A company wants to protect its external HTTPS load balancer from SQL injection and cross-site scripting attacks. Which Google Cloud service should they use?

A.VPC Service Controls

B.Cloud Firewall

C.Cloud IDS

D.Cloud Armor

AnswerD

Cloud Armor provides WAF with preconfigured rules for SQLi and XSS.

Why this answer

Cloud Armor provides WAF capabilities including preconfigured rules for OWASP Top 10 threats like SQLi and XSS, and can be attached to HTTPS load balancers.

Full explanation →

719

MCQmedium

A network engineer is setting up a Dedicated Interconnect between an on-premises network and Google Cloud. After the circuit is ordered and the physical connection is established at the co-location facility, what is the first step to configure the interconnect inside GCP?

A.Configure a VPN tunnel for backup connectivity.

B.Create a VLAN attachment to associate with the interconnect.

C.Enable Cloud NAT for outbound traffic.

D.Create a Cloud Router with BGP sessions.

AnswerB

A VLAN attachment is the first logical configuration step after the physical connection.

Why this answer

After the physical connection is ready, you must create a VLAN attachment in Google Cloud to define the connection between your VPC and the interconnect.

Full explanation →

720

MCQeasy

A startup is deploying its first application on Google Cloud and needs to create a VPC network. They want to avoid manual subnet planning and prefer that Google automatically creates subnets in each region as they expand. Which VPC type should they choose?

A.Shared VPC

B.Auto mode VPC

C.VPC Network Peering

D.Custom mode VPC

AnswerB

Auto mode VPCs automatically create subnets in each region, which is ideal for avoiding manual subnet planning.

Why this answer

Auto mode VPCs automatically create subnets in each region with predetermined IP ranges, simplifying initial setup. Custom mode VPCs require manual subnet creation.

Full explanation →

721

Multi-Selectmedium

Your organization uses Cloud DNS for private DNS resolution within GCP. You need to enable on-premises DNS servers to resolve GCP private zone names (e.g., myinstance.internal.example.com). Which TWO resources must you configure? (Choose two.)

Select 1 answer

A.Configure an outbound DNS server policy in GCP

B.Create a DNS peering zone in Cloud DNS that points to the on-premises DNS servers

C.Configure an inbound DNS server policy in GCP

D.Set up a VPN tunnel between GCP and on-premises

E.Create a forwarding zone in Cloud DNS

AnswersC

An inbound DNS server policy creates a forwarding endpoint with a Google-managed IP. On-premises DNS servers forward queries for the private zone to this IP, enabling resolution.

Why this answer

To allow on-premises DNS servers to resolve GCP private zone names, you only need to configure an inbound DNS server policy (option C). This creates a forwarding endpoint with a Google-managed IP address in a VPC network. On-premises DNS servers must then be configured to forward queries for the private zone to that IP address.

A DNS peering zone (option B) is not required because the inbound endpoint can resolve records in any private zone that is in the same project and VPC network. The other options (A, D, E) are not relevant for this use case.

Exam trap

Candidates often think a DNS peering zone is necessary to connect on-premises DNS to GCP private zones, but the inbound DNS server policy alone is sufficient. The on-premises servers just need to forward queries to the Google-managed IP.

Full explanation →

722

MCQeasy

A startup is creating a new VPC for their production environment. They want to minimize management overhead and plan to use multiple regions. Which VPC type should they choose?

A.Auto mode VPC

B.Custom mode VPC

C.Shared VPC

D.VPC Network Peering

AnswerA

Auto mode creates subnets in each region automatically, suitable for multi-region setups with minimal management.

Why this answer

Auto mode VPCs automatically create subnets in each region and manage IP ranges, reducing management overhead. Custom mode requires manual subnet creation.

Full explanation →

723

Multi-Selecthard

A company is setting up HA VPN between GCP and on-premises. They want 99.99% SLA. Which TWO configurations are required? (Choose 2)

Select 2 answers

A.One external IP address on the Cloud VPN gateway

B.Four IKEv2 tunnels with BGP

C.Cloud Router configured with BGP

D.Two external IP addresses on the Cloud VPN gateway

E.Static routing

AnswersB, D

Correct. Four IKEv2 tunnels with BGP are required for the 99.99% SLA.

Why this answer

The 99.99% SLA for Cloud HA VPN requires two interfaces on the Cloud VPN gateway, each with a unique external IP address (two external IPs total — option D). Additionally, each interface must have two tunnels, resulting in four tunnels total, and these tunnels must use IKEv2 and BGP dynamic routing (option B). Cloud Router with BGP is required for dynamic routing, but the two specific configurations from the options are two external IP addresses and four IKEv2 tunnels with BGP.

Therefore, options B and D are correct.

Exam trap

A common misconception is that a single VPN gateway with two tunnels is sufficient for high availability, but the 99.99% SLA specifically requires two gateways (two external IPs) and four tunnels with BGP.

Full explanation →

724

MCQhard

An engineer configures an HA VPN with two tunnels to an on-premises network using IKEv2 and pre-shared keys. After configuration, the tunnels show as established, but no traffic flows. The Cloud Router BGP sessions are not established. The on-premises firewall logs show IKE packets are being sent but no response. What is the most likely cause?

A.The Cloud Router BGP AS number is duplicated

B.The pre-shared keys do not match

C.The on-premises firewall is blocking UDP port 500

D.The VPN tunnel is configured as policy-based instead of route-based

AnswerB

Mismatched pre-shared keys would cause IKE negotiation to fail, resulting in no response from Google side.

Why this answer

B is correct because the on-premises firewall logs show IKE packets being sent but no response, which indicates that the IKEv2 pre-shared key mismatch causes the IKE authentication phase to fail. Even though the tunnel status shows as established (likely due to a stale or misconfigured status check), the BGP sessions cannot form because the IKE security association (SA) is not fully authenticated, preventing the IPsec SA from being created and thus blocking all traffic, including BGP packets.

Exam trap

In Google Cloud HA VPN, the tunnel status may show as established after IKE_SA_INIT but before full authentication. Candidates often mistakenly assume that the IPsec SA is up, but the pre-shared key mismatch prevents full authentication and IPsec SA creation, which is why BGP sessions fail despite the tunnel status indicating established.

How to eliminate wrong answers

Option A is wrong because a duplicate Cloud Router BGP AS number would cause BGP session flapping or rejection, but it would not prevent IKE packets from receiving a response; the IKE phase would still complete successfully. Option C is wrong because if the on-premises firewall were blocking UDP port 500, the firewall logs would show IKE packets being dropped or no packets at all, not 'IKE packets are being sent but no response' (the packets are sent, but the response is missing due to authentication failure). Option D is wrong because a policy-based tunnel would still allow IKE to establish and BGP to form if the correct policies are in place; the issue here is specifically at the IKE authentication layer, not the tunnel type.

Full explanation →

725

MCQhard

An organization needs to restrict access to Google Cloud APIs such that only traffic from a specific set of VMs inside a VPC can reach the APIs, and all other traffic (including from other VPCs) must be denied. The VMs do not have external IPs. Which combination of services should they use?

A.Private Service Connect and VPC Service Controls

B.Cloud NAT and VPC Service Controls

C.Private Google Access and VPC Service Controls

D.Cloud NAT and Private Google Access

AnswerC

Private Google Access enables VMs without external IPs to reach Google APIs; VPC Service Controls restrict to the specified VPC.

Why this answer

Private Google Access allows VMs without external IPs to reach Google APIs. VPC Service Controls can create a service perimeter that restricts access to APIs from only authorized VPCs.

Full explanation →

726

MCQhard

You have set up a Dedicated Interconnect with two VLAN attachments (each 10 Gbps) and configured ECMP on the Cloud Router. You observe that traffic from on-premises to a specific VM is only using one attachment. What is the most likely cause?

A.Route propagation is disabled on one Cloud Router interface

B.One of the VLAN attachments has a higher route priority

C.BGP ASN mismatch between the two attachments

D.The traffic consists of a single flow that is hashed to one attachment

AnswerD

ECMP per-flow hashing keeps each flow to one path.

Why this answer

D is correct because ECMP (Equal-Cost Multi-Path) relies on hashing of packet headers (e.g., 5-tuple: source/destination IP, protocol, source/destination port) to select a path. A single flow (e.g., a TCP connection between two specific IPs and ports) will always hash to the same attachment, so it cannot use both VLAN attachments simultaneously. This is expected behavior, not a fault.

Exam trap

Google Cloud often tests the misconception that ECMP should load-balance every packet across all links, but the trap here is that ECMP operates on a per-flow basis (not per-packet) to avoid packet reordering, so a single flow will always use only one path.

How to eliminate wrong answers

Option A is wrong because route propagation is a BGP setting that controls whether learned routes are advertised to VPC networks; if disabled on one interface, routes would be missing entirely, not just for a single flow. Option B is wrong because route priority (e.g., MED, local preference) affects which route is preferred for a prefix, but both attachments have equal cost (same bandwidth, same AS path length), so priority does not cause single-flow behavior. Option C is wrong because an ASN mismatch would prevent BGP peering from establishing at all, causing complete loss of connectivity on that attachment, not selective use of one attachment for a single flow.

Full explanation →

727

MCQeasy

When setting up a Partner Interconnect, which Google Cloud resource is used to connect to the partner's network?

A.Cloud VPN gateway

B.Cloud Interconnect attachment

C.VLAN attachment

D.Cloud Router

AnswerC

A VLAN attachment is the logical connection between Google Cloud and the partner's network.

Why this answer

When setting up a Partner Interconnect, the correct Google Cloud resource is a VLAN attachment. This attachment is provisioned on a Cloud Interconnect connection that is managed by a supported service provider, and it defines the VLAN and the Cloud Router configuration used to exchange routes via BGP. The VLAN attachment is the logical construct that connects your VPC network to the partner's network through the partner's physical infrastructure.

Exam trap

Google Cloud often tests the distinction between the physical connection (Dedicated Interconnect or Partner Interconnect) and the logical attachment (VLAN attachment), so candidates mistakenly select 'Cloud Interconnect attachment' as a generic term instead of the precise 'VLAN attachment' resource name used in Google Cloud.

How to eliminate wrong answers

Option A is wrong because Cloud VPN gateway is used for IPsec VPN tunnels over the public internet, not for dedicated or partner-managed physical interconnections. Option B is wrong because 'Cloud Interconnect attachment' is not a specific Google Cloud resource; the correct term is 'VLAN attachment' which is the attachment created on a Dedicated or Partner Interconnect connection. Option D is wrong because Cloud Router is a dynamic routing appliance that exchanges BGP routes over the VLAN attachment, but it is not the resource that directly connects to the partner's network—the VLAN attachment is the connection point.

Full explanation →

728

MCQhard

Refer to the exhibit. A Cloud Router has two BGP sessions. The first session is UP, the second is DOWN. What is the most likely cause for the second session being down?

A.The advertised route priority is too low.

B.The session initialization mode is set to PASSIVE.

C.The peer IP address 169.254.1.2 is not routable.

D.The BFD multiplier is too low (3).

AnswerB

If the peer is also PASSIVE, the session cannot establish. One side must be ACTIVE.

Why this answer

The second session has sessionInitializationMode set to PASSIVE. If the peer router is also configured as PASSIVE, the BGP session will never establish. The first session is ACTIVE, so it came up.

This is a common misconfiguration.

Full explanation →

729

MCQeasy

A company wants to analyze VPC Flow Logs to understand which external IPs are generating the most outbound traffic. What is the most scalable way to store and query these logs?

A.BigQuery

B.Cloud Storage and analyze with gsutil

C.Cloud Logging with Logs Explorer

D.Cloud Monitoring Metrics

AnswerA

BigQuery offers scalable, SQL-based analysis of Flow Logs.

Why this answer

VPC Flow Logs can be exported to BigQuery, which provides scalable SQL analysis for large datasets. This is the recommended approach for complex queries.

Full explanation →

730

MCQeasy

A company needs to connect their on-premises data center to Google Cloud using a VPN with high availability. They have two VPN appliances on-premises in different locations. What is the best design on the GCP side?

A.Deploy one Cloud VPN gateway with two tunnels to both on-premises appliances, using one Cloud Router.

B.Deploy two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.

C.Deploy one Cloud VPN gateway with a single tunnel to one on-premises appliance.

D.Deploy two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.

AnswerD

Provides regional redundancy and full HA.

Why this answer

It provides true high availability by using two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance. This design ensures that if one region or gateway fails, traffic can still flow through the other region, meeting the requirement for high availability. Using separate Cloud Routers allows for dynamic routing with BGP, enabling automatic failover and load balancing across the two tunnels.

Exam trap

The trap here is that candidates often assume two tunnels from a single gateway provide high availability, but they overlook that the gateway itself is a single point of failure; true high availability requires redundancy at both the gateway and region level.

How to eliminate wrong answers

Option A is wrong because deploying one Cloud VPN gateway creates a single point of failure in the GCP region; if that gateway or region fails, both tunnels are lost, even though they connect to different on-premises appliances. Option B is wrong because deploying two Cloud VPN gateways in the same region still leaves the design vulnerable to a regional outage; if the entire region goes down, both gateways and their tunnels are unavailable. Option C is wrong because a single tunnel provides no redundancy at all; if the tunnel, gateway, or on-premises appliance fails, connectivity is completely lost.

Full explanation →

731

MCQmedium

An organization wants to restrict data exfiltration from a GCP project. They need to prevent users from copying data to external cloud storage services like AWS S3, but allow access to Google Cloud Storage. Which VPC Service Controls (VPC-SC) configuration should they use?

A.Combine VPC Service Controls with a Cloud Firewall that denies egress to non-Google IPs.

B.Use Cloud Firewall rules to block egress to AWS IP ranges.

C.Enable Data Loss Prevention (DLP) API to inspect outgoing data.

D.Create a VPC Service Controls perimeter that includes the project and set access levels to allow only Google Cloud Storage.

AnswerA

VPC-SC secures Google services, and firewall rules can block external destinations.

Why this answer

VPC Service Controls (VPC-SC) can create a perimeter that restricts data movement to only Google Cloud Storage, while Cloud Firewall egress rules can deny traffic to non-Google IP ranges (including AWS S3 endpoints). This combination ensures that even if a user attempts to copy data to an external cloud storage service, the firewall blocks the egress traffic, and VPC-SC prevents access to Google Cloud Storage from outside the perimeter.

Exam trap

Google Cloud often tests the misconception that VPC Service Controls alone can block data exfiltration to external cloud storage services, when in fact they only control access to Google Cloud services and must be combined with network-level controls like Cloud Firewall egress rules to block traffic to non-Google endpoints.

How to eliminate wrong answers

Option B is wrong because Cloud Firewall rules alone cannot distinguish between Google Cloud Storage and external cloud storage services like AWS S3 based on IP ranges alone, as both may share overlapping or dynamic IP ranges; also, firewall rules do not enforce data exfiltration policies at the application layer. Option C is wrong because the Data Loss Prevention (DLP) API inspects data for sensitive content but does not block data exfiltration to external cloud storage services; it is a detection tool, not a prevention mechanism. Option D is wrong because setting access levels to allow only Google Cloud Storage within a VPC-SC perimeter does not prevent users from copying data to external cloud storage services like AWS S3, as VPC-SC perimeters control access to Google Cloud services, not egress traffic to non-Google endpoints.

Full explanation →

732

MCQeasy

What is the default Maximum Transmission Unit (MTU) for Compute Engine virtual machines?

A.1460

B.1500

C.9001

D.1400

AnswerA

1460 is the default MTU for Compute Engine instances.

Why this answer

GCP uses an MTU of 1460 for both VMs and the underlying network infrastructure.

Full explanation →

733

Multi-Selectmedium

You need to configure a health check for a backend service that uses HTTP2. Which THREE settings must be configured correctly for the health check to work? (Select three.)

Select 3 answers

A.Request path

B.Protocol: HTTP2

C.Proxy protocol

D.SSL certificate

E.Port

AnswersA, B, E

Required: health check sends a request to a path.

Why this answer

For an HTTP2 health check, you need to specify the protocol (HTTP2), a port, and a request path.

Full explanation →

734

Multi-Selectmedium

A company is deploying a new application across three VPCs in the same project, using Shared VPC. The security team wants to restrict traffic such that only the frontend subnet (10.0.1.0/24) can send traffic to the backend subnet (10.0.2.0/24) on TCP port 8080. The backend instances have the service account 'backend-sa@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations achieve this goal?

Select 2 answers

A.Create an ingress firewall rule on the backend VPC with source service account 'frontend-sa@project.iam.gserviceaccount.com', protocol tcp:8080, and target service account 'backend-sa@project.iam.gserviceaccount.com'.

B.Create an egress firewall rule on the frontend VPC with source CIDR 10.0.1.0/24, protocol tcp:8080, and target CIDR 10.0.2.0/24.

C.Create an ingress firewall rule on the backend VPC with source CIDR 10.0.1.0/24, protocol tcp:8080, and target tag 'backend-tag'.

D.Create an ingress firewall rule on the backend VPC with source tag 'frontend-tag', protocol tcp:8080, and target tag 'backend-tag'.

E.Create a VPC firewall rule with priority 1000 that denies all traffic from 10.0.1.0/24 to 10.0.2.0/24, and then a higher priority rule allowing tcp:8080.

AnswersA, C

Using source and target service accounts precisely restricts traffic to only the frontend service account communicating to the backend service account on tcp:8080.

Why this answer

It uses service accounts as both source and target in an ingress rule on the backend VPC. This allows only instances with the frontend service account to send traffic to instances with the backend service account on TCP 8080, meeting the security requirement without relying on IP addresses or network tags.

Exam trap

The trap here is that candidates often assume egress rules on the source VPC are sufficient to control inbound traffic to the backend, but Google Cloud requires ingress rules on the destination VPC to filter incoming packets, and service account-based rules are often overlooked in favor of IP-based rules.

Full explanation →

735

Multi-Selectmedium

A company uses Shared VPC to centralize network management. The host project contains subnets for production and development environments. Which two statements accurately describe the capabilities of Shared VPC? (Choose TWO.)

Select 2 answers

A.Service project VMs can use internal IP addresses from the shared subnets.

B.Shared VPC supports transitive peering across service projects.

C.IAM policies on shared subnets can be delegated to service project administrators.

D.Service project administrators can create subnets in the host project.

E.Service projects cannot have their own VPCs when using Shared VPC.

AnswersA, C

VMs in service projects are assigned internal IPs from the shared subnets.

Why this answer

Shared VPC allows a host project to share subnets with service projects. IAM on shared subnets can be delegated to service project administrators, and VMs in service projects can use internal IPs from the shared subnets.

Full explanation →

736

Multi-Selectmedium

An engineer needs to plan IP address ranges for a new GCP environment that will connect to an on-premises network via Dedicated Interconnect. The on-premises network uses 10.0.0.0/8. The GCP VPC must support GKE pods and services and future expansion. Which THREE best practices should the engineer follow? (Choose three.)

Select 3 answers

A.Plan secondary IP ranges for GKE pods and services

B.Use the same IP range as on-premises for simplicity

C.Use a public IP range for the VPC to avoid overlap

D.Select a CIDR block that does not overlap with the on-premises network

E.Use a RFC 1918 private IP range for the VPC

AnswersA, D, E

Secondary ranges are required for GKE.

Why this answer

Best practices: Use RFC 1918 private ranges, avoid overlapping with on-premises, plan secondary ranges for GKE (pods and services), and use non-overlapping ranges for future expansion.

Full explanation →

737

Multi-Selectmedium

Which TWO factors should be considered when selecting a Google Cloud region for deploying a globally distributed application to minimize latency for users?

Select 2 answers

A.Availability of required Google Cloud services in the region

B.Compliance with data residency requirements

C.Proximity to the majority of users

D.Number of zones in the region

E.Cost of resources in the region

AnswersA, C

The region must support the services needed (e.g., Compute Engine, Cloud Load Balancing).

Why this answer

The availability of required Google Cloud services in a region is a fundamental constraint: if a service (e.g., Cloud Spanner, BigQuery, or a specific machine series) is not offered in a region, you cannot deploy that component there, regardless of latency benefits. Option C is correct because minimizing latency for a globally distributed application requires placing compute and data resources as close as possible to the majority of users, reducing round-trip time (RTT) and improving user experience. Google Cloud's global network and edge caching locations (e.g., Cloud CDN) further amplify the benefit of proximity.

Exam trap

Google Cloud often tests the misconception that compliance or cost are primary factors for latency minimization, when in fact they are separate design constraints that may conflict with latency goals.

Full explanation →

738

MCQhard

An organization uses a hierarchical firewall policy at the organization level with a deny-all egress rule (priority 100). They also have a VPC-level firewall rule allowing egress to a specific external IP (priority 1000). Will traffic to that external IP be allowed?

A.Yes, because VPC firewall rules override hierarchical policies for the same traffic.

B.Yes, because the VPC rule has a higher priority number and is more specific.

C.No, because hierarchical firewall policies take precedence over VPC firewall rules.

D.No, because both rules deny and allow cancel out, resulting in default deny.

AnswerC

Hierarchical policies are evaluated first and if they deny, traffic is denied regardless of VPC rules.

Why this answer

Hierarchical firewall policies are evaluated before VPC firewall rules and have higher precedence. A deny rule at the org level with priority 100 will override a VPC allow rule with lower priority (higher number).

Full explanation →

739

MCQhard

A network engineer is troubleshooting connectivity between an on-premises network and Google Cloud. The on-premises router has two BGP sessions configured for redundancy with a Cloud Router. The engineer runs the command above. Which issue does the output indicate?

A.Both BGP sessions are down

B.The BGP session for peer-a is down

C.The on-premises router is not advertising any routes to the Cloud Router

D.The Cloud Router is not advertising any routes to on-premises

AnswerC

learnedRoutes is empty for peer-a, indicating no routes received from on-premises.

Why this answer

The output shows that both BGP sessions are established (state = Established), so options A and B are incorrect. However, the 'Received routes' count is 0 for both peers, meaning the on-premises router is not sending any routes to the Cloud Router. This prevents the Cloud Router from learning the on-premises prefixes, breaking connectivity from Google Cloud to on-premises.

Exam trap

The trap here is that candidates see 'Established' sessions and assume full connectivity, overlooking that BGP session up does not guarantee routes are being exchanged, which is the actual root cause of the connectivity failure.

How to eliminate wrong answers

Option A is wrong because the BGP session state for both peers is 'Established', indicating the TCP connection and BGP session are up, not down. Option B is wrong because peer-a's session state is also 'Established', so it is not down. Option D is wrong because the 'Advertised routes' count is non-zero (e.g., 5 for peer-a), showing the Cloud Router is sending routes; the issue is with received routes, not advertised routes.

Full explanation →

740

Multi-Selectmedium

A company is designing a hybrid network using Dedicated Interconnect. They want to configure BGP for load balancing across multiple VLAN attachments. Which TWO statements are correct?

Select 2 answers

A.You must create a separate Cloud Router for each VLAN attachment.

B.You can configure the Cloud Router to advertise the same IP prefixes over both VLAN attachments.

C.You should use BGP MED to load balance outbound traffic from Google Cloud.

D.You can use the same BGP ASN for both VLAN attachments.

E.Load balancing across VLAN attachments requires a single BGP session.

AnswersB, D

Advertising the same prefixes over multiple VLANs enables load balancing.

Why this answer

A Cloud Router can advertise the same IP prefixes over multiple VLAN attachments to enable load balancing. This allows Google Cloud to use ECMP (Equal-Cost Multi-Path) routing to distribute outbound traffic across the two VLAN attachments, as long as the BGP attributes (e.g., AS path length, MED) are equal.

Exam trap

Google Cloud often tests the misconception that BGP MED controls outbound traffic, but in reality, MED is a hint for inbound path selection, while outbound load balancing relies on equal BGP attributes and ECMP.

Full explanation →

741

MCQeasy

A company has a Dedicated Interconnect with one 10 Gbps connection. They need high availability for critical workloads. Which design is the best practice according to Google Cloud recommendations?

A.Provision a second Dedicated Interconnect connection to a different PoP.

B.Add a second connection to the same PoP using the same provider.

C.Rely on the single connection and monitor for failures.

D.Use Cloud VPN as a backup to the Dedicated Interconnect.

AnswerA

Connections to different PoPs provide geographic redundancy and higher availability.

Why this answer

Google Cloud best practice for high availability with Dedicated Interconnect requires at least two physical connections, each to a different edge point of presence (PoP), to eliminate single points of failure at the network edge. A single 10 Gbps connection, even with a backup VPN, does not provide the same SLA or bandwidth guarantees for critical workloads. Option A ensures that if one PoP or provider fails, the other connection can maintain connectivity.

Exam trap

The trap here is that candidates often assume a second connection to the same PoP or a VPN backup is sufficient for high availability, but Google Cloud explicitly requires diverse PoPs to protect against facility-level failures, and VPN backup lacks the bandwidth and SLA for critical workloads.

How to eliminate wrong answers

Option B is wrong because adding a second connection to the same PoP using the same provider still creates a single point of failure at that PoP; both connections share the same physical location and provider infrastructure, so an outage at that PoP or provider will take down both links. Option C is wrong because relying on a single connection with monitoring does not provide high availability; any failure of that single link will cause downtime for critical workloads, and Google Cloud recommends at least two connections for HA. Option D is wrong because Cloud VPN as a backup to Dedicated Interconnect does not provide the same bandwidth (typically limited to 3 Gbps per tunnel) or latency guarantees, and it introduces additional encryption overhead; it is suitable for lower-bandwidth or non-critical failover, not for maintaining 10 Gbps throughput for critical workloads.

Full explanation →

742

MCQmedium

An organization needs to reduce egress costs for a global application serving users worldwide. The application serves static content from Compute Engine instances. Which action is most cost-effective?

A.Move all instances to a single region to reduce cross-region traffic

B.Use Cloud CDN to cache content at edge locations

C.Upgrade to premium tier networking

D.Enable Private Google Access

AnswerB

Cloud CDN reduces egress by serving cached content from edge PoPs, lowering bandwidth to origin.

Full explanation →

743

MCQmedium

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

A.The VM is in a different zone than the Cloud NAT gateway

B.The VPC firewall rules are blocking outbound traffic from the VM to the Cloud NAT IP

C.Cloud Router is misconfigured and not advertising the Cloud NAT IP

D.The VM has a custom route that does not use the default route through Cloud NAT

AnswerD

Traffic must match the default route to be source NATed by Cloud NAT.

Why this answer

Cloud NAT relies on the default route (0.0.0.0/0) pointing to the Cloud Router to direct traffic through the NAT gateway. If a VM has a custom route that overrides the default route (e.g., a more specific route to an external IP or a route to a different next hop), the VM's outbound traffic will bypass Cloud NAT entirely, resulting in the source IP being the VM's private IP instead of the Cloud NAT IP. This causes external firewalls to block the traffic as the source IP is not the expected NAT IP.

Exam trap

Google Cloud often tests the misconception that Cloud NAT is zone-dependent or that firewall rules are the cause, when in reality the issue is almost always a routing override that prevents traffic from reaching the NAT gateway.

How to eliminate wrong answers

Option A is wrong because Cloud NAT operates at the VPC level and is not zone-specific; a VM in any zone within the same region can use the same Cloud NAT gateway as long as the subnet is associated with the NAT configuration. Option B is wrong because VPC firewall rules control traffic at the instance level (ingress/egress) but do not affect the routing path; if outbound traffic were blocked by firewall rules, the traffic would not reach the Cloud NAT IP at all, but the symptom here is that traffic reaches the internet with the wrong source IP, indicating a routing issue, not a firewall block. Option C is wrong because Cloud Router is used for dynamic routing (e.g., BGP) with on-premises or VPN connections, not for advertising Cloud NAT IPs; Cloud NAT IPs are not advertised via BGP—they are used for source NAT and are not routable from the internet.

Full explanation →

744

Multi-Selecteasy

Which TWO of the following methods can be used to encrypt traffic between VPC networks?

Select 2 answers

A.Use of SSL/TLS at the application layer.

B.VPC peering.

C.Cloud Interconnect with VLAN attachments.

D.Cloud VPN with IPsec.

E.Cloud NAT.

AnswersA, D

SSL/TLS encrypts application data end-to-end.

Why this answer

SSL/TLS operates at the application layer (Layer 7) of the OSI model, providing end-to-end encryption for traffic between VPC networks. When applications use HTTPS (HTTP over TLS), the payload is encrypted before leaving the source, ensuring confidentiality even if the underlying network path is untrusted. This method is independent of the underlying network connectivity, making it suitable for encrypting traffic across VPCs connected via any means, including the public internet.

Exam trap

Google Cloud often tests the misconception that VPC peering or Cloud Interconnect inherently encrypts traffic, when in fact they only provide private connectivity without encryption, and candidates must remember that encryption requires explicit protocols like IPsec or TLS.

Full explanation →

745

MCQeasy

A company wants to establish a dedicated physical connection between their on-premises network and Google Cloud. They need a 10 Gbps connection and are willing to manage the circuit and colocation facility themselves. Which Google Cloud service should they use?

A.Dedicated Interconnect

B.Partner Interconnect

C.Cloud CDN

D.Cloud VPN

AnswerA

Dedicated Interconnect provides a direct physical connection up to 10 Gbps (or 100 Gbps) and requires the customer to manage circuit ordering and colocation.

Why this answer

Dedicated Interconnect provides a direct physical connection between the on-premises network and Google's network via a colocation facility and Google Partner PoP. It is managed by the customer for circuit ordering and colocation.

Full explanation →

746

Multi-Selecthard

A company is experiencing a BGP session flap between Cloud Router and an on-premises router. Which THREE actions should the engineer take to diagnose the issue?

Select 3 answers

A.Check VPN tunnel status and IKE parameters

B.Examine Cloud Router logs for BGP state changes

C.Enable VPC Flow Logs on the subnet

D.Review Network Topology for path changes

E.Verify firewall rules allow tcp/179 between peer IPs

AnswersA, B, E

If BGP over VPN, tunnel issues can cause flaps.

Why this answer

Check Cloud Router logs for BGP events, verify firewall rules allow BGP traffic (TCP 179), and check VPN tunnel status if using VPN. VPC Flow Logs and Network Topology are less relevant.

Full explanation →

747

MCQmedium

A company uses Identity-Aware Proxy (IAP) to secure access to a group of Compute Engine instances running a web application. The instances have no external IP addresses and are accessed via IAP TCP forwarding. Recently, the security team discovered that some users can access the instances directly via SSH from other instances within the same VPC, bypassing IAP. What is the most effective way to ensure all SSH access goes through IAP?

A.Modify the VPC firewall rule to deny ingress traffic on TCP port 22 from all sources except the IAP IP range (35.235.240.0/20).

B.Assign a service account to each instance with the IAP-secured Tunnel User role.

C.Remove SSH keys from the instances and use OS Login.

D.Create a new firewall rule that allows SSH only from the IAP IP range and delete the existing SSH rule.

AnswerA

This ensures only IAP can initiate SSH connections.

Why this answer

The IAP TCP forwarding source IP range (35.235.240.0/20) is the only range that should be allowed to initiate SSH connections to the instances. By modifying the VPC firewall rule to deny all other sources on TCP port 22, you ensure that any SSH traffic not originating from the IAP IP range is blocked, even from other instances within the same VPC. This directly addresses the bypass scenario where users SSH from other internal instances.

Exam trap

Google Cloud often tests the misconception that IAP alone enforces access control, when in reality it relies on VPC firewall rules to restrict traffic to only the IAP source IP range; candidates may incorrectly choose options that change authentication (OS Login) or authorization (service account roles) instead of addressing the network path.

How to eliminate wrong answers

Option B is wrong because assigning a service account with the IAP-secured Tunnel User role controls who can use IAP to connect, but does not prevent direct SSH access from other instances within the VPC; it does not enforce traffic to go through IAP. Option C is wrong because removing SSH keys and using OS Login changes the authentication method but does not restrict the network path; instances can still be reached directly via SSH from other VPC instances, bypassing IAP. Option D is wrong because creating a new firewall rule that allows SSH only from the IAP IP range and deleting the existing SSH rule is functionally identical to Option A, but the question asks for the most effective way; Option A is more precise as it modifies the existing rule rather than deleting and recreating, but both achieve the same result; however, the key distinction is that Option D's wording could imply a less controlled change, and in practice, modifying the existing rule is the recommended approach to avoid accidental exposure during the transition.

Full explanation →

748

Multi-Selecthard

A company has VPC peering between two VPC networks. They want to ensure that traffic from VPC A to VPC B can use a custom route in VPC A that points to a next-hop appliance in VPC A. Which TWO conditions must be met?

Select 2 answers

A.VPC B must have a route back to VPC A.

B.VPC peering must be set up with 'export custom routes' enabled from VPC A.

C.The appliance must be in the same region as VPC A.

D.The appliance must have a firewall rule allowing traffic from VPC B.

E.VPC A must have a route with destination inside VPC B and next-hop set to the appliance.

AnswersB, E

Export of custom routes is required for the peer to see and use them.

Why this answer

Required because custom routes must be exported from VPC A to VPC B via peering. This allows VPC B to learn the route and send return traffic back through the same appliance, ensuring bidirectional communication via the appliance. Without exporting custom routes, VPC B would send return traffic directly via the peering connection, bypassing the appliance.

Option E is required because VPC A must have a route that specifies the destination inside VPC B and sets the next-hop to the appliance. This route is what directs the traffic from VPC A to VPC B through the appliance. Options A, C, and D are not necessary for the forward path: VPC B does not need a route back (the return path is handled via export), the appliance can be in any region (it just needs connectivity), and a firewall rule on the appliance is needed but is not a condition specific to using the custom route via peering.

Full explanation →

749

MCQeasy

An organization is using Cloud CDN to deliver content globally. Which of the following is a primary benefit of using Cloud CDN?

A.Provides DDoS protection only

B.Increases bandwidth to the origin server

C.Eliminates the need for SSL certificates

D.Reduces latency for users by caching content at edge locations

AnswerD

Correct: Cloud CDN caches content at Google's edge locations, reducing latency and origin load.

Why this answer

Cloud CDN caches content at edge locations, reducing egress costs from the origin and improving latency for users.

Full explanation →

750

MCQmedium

Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?

A.The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.

B.The on-premises server is not configured with a default gateway pointing to the on-premises gateway.

C.The Cloud VPN tunnel is not configured with an IKE version supported by the on-premises device.

D.A firewall rule on the GCP VPC is blocking ICMP traffic from 192.168.1.100.

AnswerA

Without a return route, the on-premises server sends replies through the default route (likely internet), causing asymmetric routing and packet drop.

Why this answer

Since the VM can ping the on-premises gateway (192.168.1.1) but not the server (192.168.1.100), the VPN tunnel and BGP session are working, and GCP has the correct route. The issue is that the on-premises router is not advertising or does not have a route for the GCP subnet 10.0.1.0/24 pointing back to the VPN tunnel, so return traffic from the server to the VM is dropped. Without this route, the on-premises router cannot forward packets destined for 10.0.1.10 back through the VPN.

Exam trap

Google Cloud often tests the misconception that a successful ping to the remote gateway proves full bidirectional connectivity, but the trap here is that the gateway responds from its own IP stack, not from behind it, so a missing return route for the GCP subnet on the on-premises router breaks traffic to hosts beyond the gateway.

How to eliminate wrong answers

Option B is wrong because if the on-premises server lacked a default gateway pointing to the on-premises gateway, the server would not be able to reach any off-subnet destination, including the gateway itself, but the problem states the server is reachable from the gateway. Option C is wrong because an IKE version mismatch would prevent the VPN tunnel from establishing at all, yet the VM can ping the on-premises gateway, proving the tunnel is up and BGP is exchanging routes. Option D is wrong because the GCP firewall rule explicitly allows ingress from 192.168.1.0/24 to all VMs, and the VM can receive ICMP from the gateway (192.168.1.1), so a firewall block on 192.168.1.100 specifically is inconsistent with the rule and the successful ping from the gateway.

Full explanation →

Page 10 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCNE by domain

Target a specific domain to shore up weak areas.

Configuring Network Services Managing, Monitoring, and Optimising Network Operations Implementing Hybrid Interconnectivity Designing, Planning, and Prototyping a GCP Network Implementing VPC Instances Implementing network security Implementing a Virtual Private Cloud

See all domains with question counts →