Knowledge + Practice

Google Professional Cloud Network Engineer (PCNE) — Questions 751–825

961 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 11 of 13

751

MCQmedium

Refer to the exhibit. A VM with the 'ssh-allowed' tag is unreachable via SSH from the internet, while other VMs with the same tag work. What is the most likely cause?

A.A firewall rule with priority 500 denies ingress traffic to the VM's tag or IP range.

B.The rule source range is set to 0.0.0.0/0, which includes all internet IPs, so it should allow SSH.

C.The VM is in a different VPC that does not have the allow-ssh rule.

D.The firewall rule 'allow-ssh' has a higher priority (1000) than the implicit deny (65535), so it should work.

AnswerA

A higher priority deny rule can override the allow rule.

Why this answer

The most likely cause is that a firewall rule with priority 500 explicitly denies ingress traffic to the specific VM's tag or IP range, overriding the allow-ssh rule (which has a lower priority, i.e., a higher numerical value). In Google Cloud Platform (GCP), firewall rules are evaluated from lowest to highest priority number, and a deny rule with a lower priority number (e.g., 500) takes precedence over an allow rule with a higher priority number (e.g., 1000). This explains why other VMs with the same 'ssh-allowed' tag remain reachable, as they are not affected by the specific deny rule.

Exam trap

Google Cloud often tests the misconception that a higher priority number means higher priority, when in fact a lower priority number (e.g., 500) takes precedence over a higher one (e.g., 1000), causing candidates to overlook the effect of a deny rule with a lower priority number.

How to eliminate wrong answers

Option B is wrong because the source range 0.0.0.0/0 does allow all internet IPs, but the issue is that a higher-priority deny rule (priority 500) is blocking the traffic, not that the allow rule is misconfigured. Option C is wrong because if the VM were in a different VPC without the allow-ssh rule, no VM in that VPC would be reachable via SSH, but the question states that other VMs with the same tag work, implying they are in the same VPC. Option D is wrong because while the allow-ssh rule with priority 1000 is higher than the implicit deny (65535), a deny rule with a lower priority number (500) takes precedence over the allow rule, blocking the traffic.

Full explanation →

752

Multi-Selectmedium

An organization is designing a hybrid connectivity architecture using Cloud Router and BGP. They need to advertise a specific prefix from an on-premises network to GCP, and they want to control the route priority. Which two BGP features should they configure? (Choose TWO.)

Select 2 answers

A.Global dynamic routing mode

B.Custom route exchange

C.Custom learned routes

D.BGP route aggregation

E.Route advertisement with MED

AnswersB, E

Custom route exchange allows advertising specific prefixes via BGP.

Why this answer

Cloud Router can advertise custom routes, and BGP allows setting MED values to influence route priority.

Full explanation →

753

MCQhard

A company is using Traffic Director with Envoy sidecars to manage traffic between microservices. They want to inject faults to test service resilience. Which Traffic Director feature should they use?

A.Traffic splitting

B.Fault injection

C.Circuit breakers

D.mTLS

AnswerB

Correct: fault injection allows testing resilience by injecting delays or errors.

Why this answer

Fault injection is a feature of Traffic Director that allows injecting delays or abort errors into requests for testing.

Full explanation →

754

Multi-Selecthard

An organization needs to design a hybrid connectivity solution with 99.99% availability for a mission-critical application. They have a co-location facility near a GCP region. Which THREE components are required to meet this SLA?

Select 3 answers

A.Two VLAN attachments

B.Two Dedicated Interconnect links in different edge availability domains

C.One Dedicated Interconnect link with multiple VLAN attachments

D.Cloud Router with BGP sessions

E.Classic VPN as a backup

AnswersA, B, D

Each link typically has its own VLAN attachment.

Why this answer

For 99.99% SLA with Dedicated Interconnect, you need two links in different edge availability domains, two VLAN attachments, and BGP sessions with Cloud Router.

Full explanation →

755

MCQmedium

An organization has a VPC with several subnets and wants to monitor firewall rule usage to identify rules that are overly permissive (e.g., allowing all traffic from 0.0.0.0/0). Which Google Cloud service provides this insight?

A.Cloud Monitoring

B.Firewall Insights

C.VPC Flow Logs

D.Cloud Logging

AnswerB

Firewall Insights identifies overly permissive and shadowed firewall rules.

Why this answer

Firewall Insights in Network Intelligence Center provides analytics on firewall rules, including overly permissive rules and shadowed rules.

Full explanation →

756

MCQmedium

A company is using a global external HTTP(S) load balancer to serve traffic from multiple regions. They notice high egress costs for traffic served to users in Asia. What change could reduce costs?

A.Switch to a regional internal load balancer

B.Enable VPC Flow Logs to analyze traffic

C.Use a regional external load balancer in Asia and enable Cloud CDN

D.Increase the number of backend instances in Asia

AnswerC

Correct: Regional LB reduces global routing costs, and CDN caches content, reducing egress from origin.

Why this answer

A regional load balancer can be used for each region where users are located, avoiding the cost of global load balancing, and Cloud CDN can cache content closer to users, reducing origin egress.

Full explanation →

757

MCQeasy

A company wants to restrict access to Google Cloud APIs from a specific set of VMs based on the VM's service account. Which type of firewall rule target should be used?

A.Target tags

B.All instances

C.Source service accounts

D.Target service accounts

AnswerD

Target service accounts specify which instances to apply the rule to based on their service account.

Why this answer

Firewall rules can target instances by service account, allowing fine-grained control based on identity rather than network tags.

Full explanation →

758

MCQmedium

A company is hitting the quota for number of firewall rules per VPC network. They need to add more rules without requesting a quota increase. Which approach can reduce the number of rules?

A.Convert all deny rules to allow rules

B.Use hierarchical firewall policies at the folder level

C.Use Cloud Firewall to manage rules

D.Delete unused subnets

AnswerB

Hierarchical policies have their own quotas and can reduce VPC-level rule usage.

Why this answer

Firewall rules can be consolidated using service accounts or tags. By grouping instances with tags and applying rules to those tags, you can reduce the number of rules. Also, hierarchical firewall policies (at folder or org level) have separate quotas and can offload rules from VPC-level quotas.

Full explanation →

759

Multi-Selecteasy

Which TWO of the following are benefits of using Cloud Interconnect over Cloud VPN for hybrid connectivity? (Choose two.)

Select 2 answers

A.Lower and more consistent latency.

B.Always provides encryption for data in transit.

C.Easier to set up as no physical connection is needed.

D.Lower cost for small bandwidth requirements.

E.Higher bandwidth capacity (up to 80 Gbps per circuit).

AnswersA, E

Dedicated connections avoid internet variability.

Why this answer

Cloud Interconnect provides a dedicated, private connection between your on-premises network and Google Cloud, bypassing the public internet. This results in lower and more consistent latency compared to Cloud VPN, which relies on the public internet and is subject to variable network conditions and potential congestion.

Exam trap

Google Cloud often tests the misconception that Cloud Interconnect provides encryption by default, when in fact it does not; the trap is that candidates confuse the private nature of the connection with inherent security, forgetting that encryption must be separately implemented.

Full explanation →

760

MCQhard

A company's application requires TLS termination at the load balancer, with backend instances in multiple regions running on Compute Engine. The backend instances must see the original client IP address. Which load balancer should be used?

A.Global external HTTPS load balancer

B.Regional external TCP/UDP Network Load Balancer

C.Global SSL Proxy load balancer

D.Regional internal HTTP(S) load balancer

AnswerC

Global SSL Proxy terminates TLS and can use Proxy Protocol to preserve client IP to backend instances.

Why this answer

Global SSL Proxy LB terminates TLS (SSL offload) and adds the Proxy Protocol header to preserve client IP. Global HTTPS LB does not support Proxy Protocol. NLB does not terminate TLS.

Internal LB is not external.

Full explanation →

761

MCQeasy

A startup is setting up their first GCP VPC. They want minimal manual configuration and need subnets in multiple regions. Which VPC creation mode should they use, and why?

A.Auto mode, because it allows overlapping IP ranges with on-premises networks.

B.Auto mode, because it automatically creates subnets in all regions with predefined IP ranges.

C.Custom mode, because it is the only mode that supports Shared VPC.

D.Custom mode, because it provides full control over IP ranges.

AnswerB

Auto mode creates subnets automatically in each region, which is ideal for minimal manual setup.

Why this answer

Auto mode VPCs automatically create a subnet in each region with predefined IP ranges, reducing manual effort. Custom mode requires manual subnet creation.

Full explanation →

762

MCQmedium

A company has a Cloud VPN between their on-premises network and Google Cloud. They want to ensure that traffic flows symmetrically, meaning that traffic from Google Cloud to on-premises uses the same VPN tunnel as traffic from on-premises to Google Cloud. Which best practice should they implement?

A.Use dynamic routing with BGP and ensure that the AS path length is the same on both sides.

B.Implement policy-based routing that forces traffic to and from specific subnets to use the same tunnel.

C.Deploy multiple VPN tunnels and use different priorities for each.

D.Use static routes pointing to the VPN tunnel on both sides.

AnswerB

Policy-based routing can enforce symmetric flows.

Why this answer

Policy-based routing (PBR) allows you to explicitly define forwarding rules based on source/destination IP addresses, ensuring that traffic from Google Cloud to on-premises uses the same VPN tunnel as the reverse direction. This enforces symmetric flow, which is critical for stateful firewalls and NAT devices that expect packets to arrive on the same interface they left. Dynamic routing (BGP) or static routes alone do not guarantee symmetry unless combined with PBR or tunnel interface configurations.

Exam trap

Google Cloud often tests the misconception that dynamic routing protocols like BGP inherently provide symmetric routing, but in reality, BGP only controls the best path selection independently on each router, so without additional configuration (e.g., PBR or tunnel interface binding), traffic can easily become asymmetric.

How to eliminate wrong answers

Option A is wrong because BGP with equal AS path length does not enforce symmetric traffic flow; BGP selects the best path based on multiple attributes, and the return path is determined independently by the remote router, so asymmetry can still occur. Option C is wrong because deploying multiple VPN tunnels with different priorities (e.g., using route metrics) only controls which tunnel is preferred for outbound traffic, but the return path is decided by the remote side, which may not match the priority settings. Option D is wrong because static routes pointing to the VPN tunnel on both sides do not guarantee symmetry; if the on-premises router has multiple equal-cost paths or a different routing table, return traffic could take a different tunnel, breaking symmetry.

Full explanation →

763

MCQhard

A network engineer has configured a Dedicated Interconnect with a VLAN attachment and Cloud Router. BGP sessions are up and routes are exchanged. However, traffic from a specific on-premises subnet is not reaching a VPC instance. The route table shows a custom static route with priority 1000 for that subnet pointing to a VPN tunnel, and a BGP learned route with priority 100 for the same subnet via Interconnect. What is the most likely reason for the traffic not using the Interconnect route?

A.The BGP route's next hop is not reachable due to a missing firewall rule on the on-premises side

B.Route propagation is disabled on the Cloud Router

C.VPC firewall rules are blocking traffic on the Interconnect VLAN attachment

D.The BGP route has a lower MED than the static route

AnswerA

If the on-premises next hop is unreachable, Cloud Router cannot forward traffic, causing blackhole.

Why this answer

The BGP route with priority 100 is preferred over the static route with priority 1000. However, if the BGP route's next hop is not reachable (e.g., due to a missing firewall rule on the on-premises side blocking the necessary ICMP or BGP session traffic), the route will be considered invalid and not installed in the routing table. This causes traffic to fall back to the less preferred static route via the VPN tunnel, explaining why the Interconnect path is not used.

Exam trap

Google Cloud often tests the misconception that route priority alone determines path selection, but the trap here is that a BGP route with a lower priority can still be invalid if its next hop is unreachable, causing the router to use a higher-priority static route instead.

How to eliminate wrong answers

Option B is wrong because route propagation is enabled by default on Cloud Router when BGP sessions are up and routes are exchanged, as stated in the scenario. Option C is wrong because VPC firewall rules apply to instances, not to the Interconnect VLAN attachment itself; the attachment operates at Layer 2/3 and is not subject to VPC firewall rules. Option D is wrong because MED is a BGP attribute used for path selection among multiple paths from the same AS, but a static route (priority 1000) is always less preferred than a BGP route (priority 100) regardless of MED values.

Full explanation →

764

MCQmedium

A company wants to allow on-premises DNS servers to resolve Google Cloud private VM names. They need to configure a Google-managed forwarding server IP. Which Cloud DNS feature should they use?

A.Outbound DNS forwarding

B.Cloud Router with BGP

C.Inbound DNS policy

D.Private DNS zone with peering

AnswerC

Inbound policy provides a Google-managed forwarding IP for on-premises to query.

Why this answer

Inbound DNS policy creates a forwarding zone and provides a Google-managed inbound server IP that on-premises servers can use to resolve GCP private DNS names.

Full explanation →

765

Multi-Selecteasy

Which TWO configurations can enable VM instances without external IPs to access the internet? (Choose TWO.)

Select 2 answers

A.Direct peering with Google

B.VPC peering with a network that has Cloud NAT

C.Private Google Access

D.Using a proxy instance with an external IP

E.Cloud NAT

AnswersB, E

Through VPC peering, VMs can use the NAT of the peered network for outbound traffic.

Why this answer

Cloud NAT (Option E) provides source network address translation for VMs in a subnet, enabling outbound internet access without external IPs. VPC peering with a network that has Cloud NAT (Option B) allows VMs to use the NAT of the peered network for internet access. Option A (Direct peering with Google) only provides connectivity to Google services, not the full internet.

Option C (Private Google Access) only grants access to Google APIs. Option D (Using a proxy instance with an external IP) is possible but not a native Google Cloud service and requires manual configuration.

Full explanation →

766

MCQeasy

An organization needs to create a VPC that automatically creates subnets in every region as new regions become available. Which VPC type should they use?

A.VPC Network Peering

B.Shared VPC

C.Auto mode VPC

D.Custom mode VPC

AnswerC

Correct. Auto mode VPCs automatically create subnets in each region.

Why this answer

Auto mode VPCs create subnets in all regions automatically and expand to new regions as they become available.

Full explanation →

767

Multi-Selectmedium

A company is designing a Shared VPC environment with a host project and several service projects. Which two steps are required to allow a service project team to create Compute Engine instances with internal IP addresses from a shared subnet?

Select 2 answers

A.Create a VPC peering connection between the host and service projects

B.Ensure the host project and service project are in the same organization

C.Grant the service project's network team the roles/compute.networkAdmin role on the host project

D.Grant the service project's Compute Engine service account the roles/compute.networkUser role on the host project's subnet

E.Assign the roles/compute.securityAdmin role to the service project team

AnswersB, D

Shared VPC requires projects to be in the same organization.

Why this answer

To use a shared subnet, the host project must grant the service project's Compute Engine service account the necessary IAM role on the subnet. The service project team must also have permissions to use the subnet.

Full explanation →

768

Multi-Selecthard

A Cloud VPN with dynamic routing (BGP) is established between an on-premises network and Google Cloud. The on-premises BGP router is advertising a default route (0.0.0.0/0). The Cloud Router in Google Cloud is receiving this route, but network traffic from Google Cloud VMs to the internet is not being routed through the VPN. Which THREE troubleshooting steps should you take? (Choose three.)

Select 3 answers

A.Verify that the VPC's dynamic routing mode is set to 'global' if using regional routing.

B.Check VPC firewall rules to ensure they allow egress traffic from VMs.

C.Check the route priority (preference) of the default route learned via BGP compared to the default internet gateway route.

D.Verify that the Cloud Router is configured to advertise the default route to the VPC.

E.Ensure that the on-premises router is sending the default route with a higher local preference.

AnswersA, C, D

Global routing ensures the default route is propagated to all regions.

Why this answer

The VPC's dynamic routing mode determines the scope of route propagation. If the VPC uses regional dynamic routing, Cloud Router only propagates routes within the region where the VPN tunnel is attached. A global dynamic routing mode is required for the BGP-learned default route to be available across all regions, ensuring VMs in any region can use the VPN for internet egress.

Exam trap

The trap here is that candidates often assume firewall rules are the issue when traffic fails to route, but the core problem is route selection and propagation—specifically, the default internet gateway route competing with the BGP-learned route, and the Cloud Router's advertisement settings.

Full explanation →

769

Multi-Selectmedium

Which TWO are best practices for securing a VPC network? (Choose 2.)

Select 2 answers

A.Use VPC Network Peering to connect to other projects.

B.Create a VPC with default firewall rules.

C.Enable Private Google Access on all subnets.

D.Use firewall rules to restrict ingress traffic to only necessary ports and IPs.

E.Enable VPC Flow Logs to monitor traffic patterns.

AnswersD, E

This minimizes attack surface.

Why this answer

Firewall rules are the primary mechanism for controlling ingress traffic in a VPC. By restricting traffic to only necessary ports and source IPs, you minimize the attack surface and enforce the principle of least privilege. This is a fundamental security best practice for network segmentation and access control.

Exam trap

Google Cloud often tests the misconception that default firewall rules are secure or that enabling features like Private Google Access or VPC Peering directly improve VPC security, when in fact they serve different purposes and can introduce risks if not configured correctly.

Full explanation →

770

Multi-Selecthard

A company uses Network Connectivity Center (NCC) to connect multiple on-premises sites and VPCs. They have a hub in us-central1 and spokes including two on-premises networks and three VPCs. Which two statements about NCC are accurate? (Choose TWO.)

Select 2 answers

A.NCC requires a Dedicated Interconnect for on-premises spokes.

B.Each spoke can be connected to multiple hubs.

C.Traffic between spokes must traverse the hub.

D.NCC supports both VPC spokes and on-premises spokes.

E.NCC provides transitive routing across all spokes automatically.

AnswersC, D

Correct. All traffic between spokes must pass through the hub.

Why this answer

Network Connectivity Center (NCC) operates on a hub-and-spoke model. Traffic between spokes must traverse the hub (C). NCC supports both VPC and on-premises spokes (D).

Other options are incorrect: on-premises spokes can use Partner Interconnect or VPN, not just Dedicated Interconnect; each spoke attaches to only one hub; transitive routing is not automatic and requires configuration.

Full explanation →

771

Multi-Selecthard

A company currently uses Cloud VPN with dynamic routing to connect to Google Cloud. They want to migrate to Dedicated Interconnect without downtime. Which THREE steps should they take to achieve a seamless migration? (Choose three.)

Select 3 answers

A.Order and provision the Dedicated Interconnect

B.Configure BGP on the on-premises router for the Interconnect and start advertising routes

C.Create a new VLAN attachment and attach it to the existing Cloud Router to peer with both VPN and Interconnect

D.Decrease the BGP route priority (MED) on the VPN advertisements to make VPN less preferred

E.Update on-premises firewall rules to allow traffic over the new Interconnect

AnswersA, B, C

First, you need to have the physical connection ready.

Why this answer

Ordering and provisioning the Dedicated Interconnect is the foundational step to establish the physical connection between the on-premises network and Google Cloud. Without this, no migration can occur. This involves working with a Google Cloud partner to ensure the cross-connect is completed and the VLAN attachments are created.

Exam trap

Google Cloud often tests the misconception that firewall rules must be updated when migrating connectivity types, but in reality, the migration is driven by BGP route preference adjustments, not firewall changes.

Full explanation →

772

Multi-Selecthard

Which THREE of the following are requirements for VPC Network Peering?

Select 3 answers

A.The VPCs must have non-overlapping subnet IP ranges.

B.Peering supports transitive routing.

C.Routes are automatically exchanged.

D.You need IAM permissions to establish the peering.

E.The VPCs must be in the same project.

AnswersA, C, D

Overlapping IP ranges cannot be peered due to routing conflicts.

Why this answer

VPC Network Peering requires non-overlapping subnet IP ranges to prevent routing conflicts and ensure that traffic is correctly directed between the peered VPCs. Overlapping CIDR blocks would cause ambiguous routing, as the same IP address could exist in both VPCs, making it impossible for the VPC routers to determine the correct destination.

Exam trap

Google Cloud often tests the misconception that VPC Network Peering supports transitive routing, but the correct behavior is that peering is non-transitive and each pair must be explicitly configured.

Full explanation →

773

MCQmedium

An organization has two VPCs, VPC-A and VPC-B, in the same project. They need to allow communication between instances in these VPCs without using the public internet. The solution must support dynamic routes and be non-transitive. What should they configure?

A.Add a route in each VPC pointing to the other's subnet via the default internet gateway

B.Create a VPN tunnel between VPC-A and VPC-B

C.Configure VPC Network Peering between the two VPCs

D.Use Shared VPC with a host project and attach both VPCs as service projects

AnswerC

VPC Peering provides direct, non-transitive connectivity with dynamic route exchange, meeting all requirements.

Why this answer

VPC Network Peering allows direct connectivity between two VPCs with non-transitive peering. It supports dynamic routes via custom route exchange and does not use the internet.

Full explanation →

774

MCQhard

A network engineer is troubleshooting BGP route propagation between an on-premises network and a GCP VPC via Cloud Router. The on-premises router is advertising a specific subnet (10.1.0.0/16), but GCP is not receiving the route. Cloud Router BGP sessions are established. Which configuration could be the issue?

A.The Cloud Router is configured to only accept routes from a specific set of prefixes

B.The VPC firewall rules are blocking BGP traffic (TCP port 179)

C.The Cloud Router is configured with a higher MED value for the route

D.The on-premises router is not sending the AS_PATH attribute

AnswerA

Cloud Router can be configured with custom route advertisements or filters that limit which prefixes are accepted from a BGP peer.

Why this answer

Cloud Router has an option to set custom route advertisements. If the on-premises route is not being accepted, it could be because the Cloud Router is configured with 'advertised route priority' or 'advertised IP ranges' that exclude the on-premises prefixes. More likely, the BGP peer is configured to accept only specific prefixes via 'advertised route priority' or 'advertised groups'.

Another common issue: the on-premises router needs to advertise the route; Cloud Router must have 'advertise custom routes' enabled or the route must be within the allowed prefixes.

Full explanation →

775

MCQhard

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

A.The firewall rule allow-ssh is missing a source IP range or has a source IP range that does not include the user's IP

B.The firewall rule allow-ssh is for the wrong network

C.The firewall rule allow-ssh is disabled

D.The VM's external IP (34.67.89.10) is blocked by Cloud NAT

AnswerA

If the rule does not specify sourceRanges, it defaults to 0.0.0.0/0, but if it was created with an incorrect source range, traffic from 203.0.113.5 would be blocked. The exhibit does not show sourceRanges, but a common misconfiguration is to set sourceRanges to an internal range.

Why this answer

The most likely cause is that the firewall rule 'allow-ssh' is missing a source IP range or has a source IP range that does not include the user's public IP (203.0.113.5). In Google Cloud, firewall rules are stateful and by default deny all ingress traffic unless explicitly allowed; without a source IP range (or with an incorrect one), the SSH traffic from the user's workstation is dropped at the VPC firewall level, preventing access to the VM's external IP (34.67.89.10).

Exam trap

Google Cloud often tests the misconception that a firewall rule's existence alone is sufficient, but the trap here is that the source IP range must be explicitly defined or set to 0.0.0.0/0 for external access; candidates may overlook the source filter configuration and assume the rule name implies it works for all sources.

How to eliminate wrong answers

Option B is wrong because the firewall rule 'allow-ssh' is associated with the VM's network (as per the exhibit), and if it were for the wrong network, the VM would not be reachable at all, but the question states the rule exists and is likely correctly assigned. Option C is wrong because if the rule were disabled, the user would see a different error (e.g., 'connection refused' or timeout), but the question implies the rule exists and is active; disabling would be a more obvious configuration issue. Option D is wrong because Cloud NAT is used for outbound traffic from private instances to the internet, not for inbound SSH traffic to a VM's external IP; blocking by Cloud NAT would not affect ingress traffic destined to the VM's public IP.

Full explanation →

776

Multi-Selecthard

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Select 3 answers

A.Service projects

B.Host project

C.Cloud VPN

D.VPC peering

E.Shared VPC

AnswersA, B, E

Service projects consume Shared VPC networks.

Why this answer

A is correct because service projects in a Shared VPC architecture allow each project to host its own resources (e.g., Compute Engine instances) while maintaining separate firewall rules and security policies. This enables centralized network administration via the host project while giving each project autonomy over its own firewall configurations, meeting the requirement for multiple projects with independent firewall rules.

Exam trap

Google Cloud often tests the distinction between connectivity solutions (Cloud VPN, VPC peering) and network administration models (Shared VPC), leading candidates to mistakenly choose VPC peering for multi-project setups when Shared VPC is required for centralized control with per-project firewall rules.

Full explanation →

777

MCQmedium

You need to invalidate Cloud CDN cached content for specific URLs after updating files in Cloud Storage. Which command should you use?

A.gcloud compute cdn-cache invalidate

B.gcloud compute backend-buckets update

C.gcloud compute url-maps invalidate-cdn-cache

D.gcloud compute ssl-certificates update

AnswerC

Correct command to invalidate CDN cache for a URL map.

Why this answer

gcloud compute url-maps invalidate-cdn-cache invalidates CDN cache for a specific URL map. gcloud compute ssl-certificates is for certificates. gcloud compute backend-buckets update is for updating backend bucket configuration. gcloud compute cdn-cache invalidate does not exist.

Full explanation →

778

MCQmedium

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

A.Firewall Rules

B.Cloud IDS

C.VPC Service Controls

D.Cloud Armor

AnswerD

Cloud Armor offers WAF rules to protect against web attacks.

Why this answer

Cloud Armor provides Web Application Firewall (WAF) capabilities, including preconfigured rules to detect and block SQLi and XSS attacks. It attaches to HTTPS Load Balancers.

Full explanation →

779

MCQeasy

A network engineer wants to test whether a VM in VPC A can reach a VM in VPC B that is connected via VPC peering. The engineer suspects that firewall rules or routes are blocking traffic. Which Google Cloud service should they use to test the path and identify the blocking rule?

A.Performance Dashboard

B.VPC Flow Logs

C.Connectivity Tests

D.Firewall Insights

AnswerC

Connectivity Tests is designed to test reachability and diagnose firewall/route blocking.

Why this answer

Connectivity Tests in Network Intelligence Center allows you to check reachability between source and destination endpoints, analyzing firewall rules, routes, and VPC peering configurations to identify the blocking rule.

Full explanation →

780

MCQeasy

A company wants to protect its HTTP(S) Load Balancer against DDoS attacks and common web exploits like SQL injection and cross-site scripting. Which Google Cloud service should they use?

A.VPC Service Controls

B.Cloud Armor

C.Firewall Rules

D.Cloud NAT

AnswerB

Cloud Armor provides WAF rules for SQLi, XSS, and DDoS protection.

Why this answer

Cloud Armor is Google's web application firewall (WAF) and DDoS protection service. It integrates with Cloud Load Balancing to provide security policies that inspect traffic and block attacks like SQLi and XSS using pre-configured WAF rules.

Full explanation →

781

MCQhard

An organization uses HA VPN with dynamic routing and active-active BGP sessions. One tunnel fails, but traffic continues to flow through the other tunnel. However, they notice increased latency. What is the most likely explanation?

A.BGP multipath is enabled, causing all traffic to be sent through the remaining tunnel.

B.The remaining tunnel is using a different encryption algorithm.

C.The BGP timers are misconfigured.

D.The failed tunnel's routes are still in the routing table.

AnswerA

With multipath, traffic is normally split; after failure, all traffic goes through one tunnel, potentially causing congestion.

Why this answer

When BGP multipath is enabled on an HA VPN with active-active BGP sessions, the router can load-balance traffic across multiple tunnels. If one tunnel fails, all traffic is redirected through the remaining tunnel, which can cause increased latency due to congestion or suboptimal path selection. The correct answer is A because this behavior directly explains the latency increase after a tunnel failure.

Exam trap

Google Cloud often tests the misconception that increased latency after a tunnel failure is due to routing table issues or encryption changes, when in fact it is the result of BGP multipath concentrating all traffic onto a single tunnel, causing congestion.

How to eliminate wrong answers

Option B is wrong because encryption algorithms (e.g., AES-128 vs AES-256) affect security and CPU overhead, not latency in a way that would suddenly increase after a tunnel failure; the remaining tunnel would have been using the same algorithm before the failure. Option C is wrong because misconfigured BGP timers (e.g., keepalive or hold timers) would cause session instability or flapping, not a gradual latency increase after a single tunnel failure. Option D is wrong because if the failed tunnel's routes were still in the routing table, traffic would attempt to use the failed tunnel and result in packet loss or blackholing, not increased latency; BGP withdraws routes from the failed tunnel upon session loss.

Full explanation →

782

MCQmedium

A global HTTPS load balancer is configured with a backend service that points to a serverless NEG for Cloud Run services. Some requests are failing with 502 errors. What is a likely cause?

A.The SSL certificate is expired.

B.The Cloud Run service requires IAP authentication.

C.The health check is misconfigured for serverless NEGs.

D.The serverless NEG is in a different region than the load balancer's forwarding rule.

AnswerD

For a global load balancer, the serverless NEG must be in a supported region and the load balancer must be configured to route to that region.

Why this answer

Serverless NEGs require the load balancer to be in the same region as the Cloud Run service, or use a global external load balancer with serverless NEGs in multiple regions. A 502 error often indicates connectivity issues, such as the load balancer not being able to reach the backend due to missing network endpoint group or incorrect region.

Full explanation →

783

Multi-Selecthard

A company wants to deploy a network appliance (e.g., firewall) on a Compute Engine instance that requires inspecting traffic between two VPCs. The instance must have interfaces in both VPCs. Which three configurations are required? (Choose three.)

Select 3 answers

A.Assign an external IP to each interface

B.Attach at least two network interfaces (NIC0 and NIC1)

C.Use the same subnet for both interfaces

D.Configure static routes in both VPCs pointing to the appliance's IP

E.Enable IP forwarding on the instance

AnswersB, D, E

Required to connect to two different VPCs.

Why this answer

For a multi-NIC network appliance, you need at least two network interfaces (NIC0, NIC1) attached to different VPCs. Each interface must be in a different subnet. Also, IP forwarding must be enabled on the instance to allow it to forward traffic between interfaces.

Full explanation →

784

MCQeasy

A company wants to use Cloud DNS to resolve queries for a private zone (e.g., example.internal) from multiple VPCs in the same project. They need to ensure that instances in all VPCs can resolve the zone. What is the simplest approach?

A.Configure each VM to use a custom DNS resolver

B.Use Cloud DNS peering to forward queries between VPCs

C.Create a public zone and set visibility to private

D.Create a private zone and associate it with all relevant VPCs

AnswerD

Cloud DNS private zones can be associated with up to 10 VPCs per zone; this allows resolution from those VPCs.

Why this answer

A private managed zone can be associated with one or more VPCs in the same project. By associating the zone with all VPCs that need resolution, instances in those VPCs can resolve the zone without additional peering.

Full explanation →

785

MCQhard

A company is deploying a GKE cluster with Dataplane V2 and wants to enforce micro-segmentation using network policies. They also need to monitor policy violations. What should they do?

A.Enable Packet Mirroring.

B.Use Cloud IDS to monitor traffic.

C.Use VPC firewall rules with pod IP ranges.

D.Enable GKE Dataplane V2 and use Kubernetes Network Policies with audit logging.

AnswerD

Dataplane V2 natively enforces network policies and audit logs record violations.

Why this answer

Dataplane V2 uses eBPF to implement Kubernetes Network Policies directly in the kernel, providing native support for micro-segmentation. Enabling audit logging on the cluster captures denied or allowed policy actions, allowing the company to monitor policy violations without additional infrastructure.

Exam trap

The trap here is that candidates confuse VPC firewall rules (Option C) with Kubernetes Network Policies, not realizing that VPC firewalls cannot enforce pod-level segmentation because they lack pod IP awareness and are applied at the node or subnet level.

How to eliminate wrong answers

Option A is wrong because Packet Mirroring copies pod traffic for analysis but does not enforce or monitor network policy violations; it is a troubleshooting tool, not a policy enforcement or audit mechanism. Option B is wrong because Cloud IDS is an intrusion detection service that inspects traffic for threats, not a tool for monitoring Kubernetes Network Policy violations; it operates at a different layer and does not integrate with policy audit logs. Option C is wrong because VPC firewall rules operate at the node network level, not at the pod level, and cannot enforce Kubernetes Network Policies; they lack the pod identity awareness needed for micro-segmentation within a cluster.

Full explanation →

786

MCQhard

A network engineer is troubleshooting a failing HA VPN tunnel. They need to view VPN gateway logs to identify the issue. Which Google Cloud service should they use to access the logs?

A.Cloud Audit Logs

B.Cloud Debugger

C.Cloud Monitoring

D.Cloud Logging

AnswerD

Cloud Logging stores and allows querying of VPN gateway logs.

Why this answer

Cloud Logging captures logs from Cloud VPN gateways, including tunnel events, IKE negotiations, and error messages.

Full explanation →

787

Multi-Selectmedium

A cloud engineer is configuring a Global External HTTPS Load Balancer with a backend service that targets a Cloud Run service via a serverless NEG. They want to enable Cloud CDN and set cache behavior to cache all responses regardless of origin headers. Which THREE steps are required? (Choose three.)

Select 3 answers

A.Configure a cache key policy that includes the query string

B.Generate a signed URL key

C.Set the cache mode to FORCE_CACHE_ALL on the backend service

D.Create a backend bucket instead of a backend service

E.Enable Cloud CDN on the backend service

AnswersA, C, E

Often needed to ensure proper caching per request, though not always required; but recommended.

Why this answer

To force cache all, you set cache mode to FORCE_CACHE_ALL. You also need to enable Cloud CDN on the backend service and set the appropriate cache key policy. Signed URL key is not required for basic caching.

The URL map is not modified for caching.

Full explanation →

788

MCQeasy

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

A.It eliminates the need for SSL certificates.

B.It provides DDoS protection only.

C.It increases compute instance capacity.

D.It reduces latency by serving content from edge locations.

AnswerD

Content is cached at edges closer to users, reducing round-trip time.

Why this answer

Cloud CDN caches content at Google's global edge locations, which are geographically closer to end users. By serving static content from these edge caches instead of the origin HTTP load balancer, the request latency is significantly reduced because the data travels a shorter distance over the network.

Exam trap

Google Cloud often tests the misconception that CDN replaces security features like SSL or DDoS protection, but the trap here is that candidates confuse caching benefits with infrastructure scaling or security capabilities.

How to eliminate wrong answers

Option A is wrong because Cloud CDN does not eliminate the need for SSL certificates; the origin load balancer still requires an SSL certificate to terminate HTTPS, and the CDN can use Google-managed certificates for edge termination. Option B is wrong because while Cloud CDN can absorb some volumetric attacks through caching, it is not a dedicated DDoS protection service; Google Cloud Armor is the primary DDoS protection solution. Option C is wrong because Cloud CDN does not increase compute instance capacity; it offloads requests from the origin, reducing the load on backend instances, but does not add compute resources.

Full explanation →

789

MCQmedium

A company has a Global SSL Proxy Load Balancer handling HTTPS traffic. They want to offload SSL decryption to the load balancer and forward encrypted traffic to backends. Which backend protocol should they use?

A.HTTPS

B.TCP

C.HTTP

D.SSL

AnswerD

Correct: SSL Proxy forwards traffic using SSL to backends.

Why this answer

Global SSL Proxy LB terminates SSL and forwards traffic using SSL (TCP with SSL) to backends, allowing end-to-end encryption.

Full explanation →

790

MCQmedium

A company has deployed a web application on Compute Engine instances in a VPC with subnet 10.1.0.0/20. The instances need to access an external API that whitelists IP addresses. The company uses Cloud NAT to provide outbound connectivity. The API integration tests are failing, and the operations team suspects that the source IP addresses seen by the API are not consistent. What is the most likely cause and solution?

A.Cloud NAT is configured with endpoint-independent mapping; change to endpoint-dependent mapping to ensure consistent source IP.

B.Cloud NAT is configured with dynamic port allocation; use static port allocation instead.

C.Cloud NAT is using a manual NAT IP address that is not assigned to the instances; assign the NAT IP to the instances as an alias IP range.

D.Cloud NAT is configured with a default rule that does not include the subnet; add a custom NAT rule that specifically includes subnet 10.1.0.0/20.

AnswerD

If the subnet is not in a NAT rule, instances may not use NAT or use different NAT IPs, causing inconsistent source IPs. Adding the subnet ensures consistent NAT IP usage.

Why this answer

If Cloud NAT's default rule does not include the subnet 10.1.0.0/20, instances in that subnet will not have their outbound traffic translated through the NAT gateway, causing them to use their ephemeral public IPs (if any) or fail to reach the external API. Adding a custom NAT rule that explicitly includes the subnet ensures all outbound traffic from those instances uses the consistent NAT IP address that the API whitelist expects.

Exam trap

The trap here is that candidates assume Cloud NAT automatically applies to all subnets in the VPC, but in reality, the default rule must explicitly include the subnet, and if it is removed or not configured, traffic from that subnet will not be NATed.

How to eliminate wrong answers

Option A is wrong because endpoint-independent mapping (which preserves the same source IP and port for all sessions to a given destination) actually provides consistency; endpoint-dependent mapping would change the source IP per destination, causing inconsistency. Option B is wrong because dynamic port allocation is the default and does not affect source IP consistency; static port allocation is used for specific port forwarding rules, not for ensuring a consistent source IP. Option C is wrong because a manual NAT IP address is assigned to the Cloud NAT gateway, not to the instances; assigning it as an alias IP range to instances would bypass Cloud NAT and use the instance's own IP, defeating the purpose of NAT.

Full explanation →

791

MCQhard

A company uses Cloud CDN with an external HTTP(S) load balancer. They have two origin server groups: a primary in us-central1 and a backup in europe-west1. They want traffic directed to the primary unless it is unhealthy, in which case traffic should fail over to the backup. Which configuration is required?

A.Create a Cloud CDN with two origins and enable failover in the CDN settings.

B.Use a TCP/UDP network load balancer with two target pools.

C.Configure a weighted round-robin with primary weight 100 and backup weight 0, and change weights manually.

D.Create a backend service with two backends (primary and failover) and a failover policy that marks the primary as failover when unhealthy.

AnswerD

This is the correct architecture for failover across origins.

Why this answer

Cloud CDN with an external HTTP(S) load balancer uses a backend service that can contain multiple backends (e.g., instance groups or NEGs) with a failover policy. When the primary backend is marked as unhealthy by the health check, the load balancer automatically routes traffic to the failover backend. This configuration meets the requirement without manual intervention.

Exam trap

The trap here is that candidates confuse Cloud CDN's origin settings with backend service failover policies, assuming CDN itself handles failover, when in fact failover is a property of the backend service used by the external HTTP(S) load balancer.

How to eliminate wrong answers

Option A is wrong because Cloud CDN does not have a built-in failover setting for origins; failover is configured at the backend service level, not within CDN settings. Option B is wrong because a TCP/UDP network load balancer uses target pools and does not support HTTP(S) traffic or failover policies between backends in different regions. Option C is wrong because weighted round-robin requires manual weight changes to fail over, which does not provide automatic failover based on health checks.

Full explanation →

792

MCQeasy

Which Cloud DNS routing policy should you use to direct users to the nearest healthy backend based on their geographic location?

A.Failover

B.Geolocation

C.Weighted round robin

D.Response policy

AnswerB

Routes traffic based on the DNS resolver's geographic location.

Why this answer

Geolocation routing policy directs traffic based on the user's geographic location. Weighted round robin distributes by weight, failover is for primary/backup.

Full explanation →

793

MCQeasy

You need to distribute incoming TCP traffic to a set of Compute Engine instances in the same region while preserving the client IP address. The load balancer must be used for non-HTTP(S) workloads. Which load balancer should you choose?

A.Global TCP Proxy Load Balancer

B.Regional External TCP/UDP Network Load Balancer

C.Global HTTPS Load Balancer

D.Regional Internal TCP/UDP Load Balancer

AnswerB

This is a pass-through LB for TCP/UDP that preserves client IP.

Why this answer

Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and works for TCP/UDP traffic.

Full explanation →

794

Multi-Selectmedium

A company wants to restrict access to Google Cloud Storage so that only traffic originating from a specific VPC network is allowed. They also need to prevent data exfiltration to other VPCs. Which two services should they use? (Choose two.)

Select 2 answers

A.VPC Service Controls

B.Cloud VPN

C.Cloud NAT

D.Firewall rules

E.Private Google Access

AnswersA, E

Creates a perimeter to restrict access.

Why this answer

VPC Service Controls creates a service perimeter around the Storage API, and Private Google Access enables VMs without external IPs to access Google APIs from within the VPC.

Full explanation →

795

MCQhard

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.0.0.0/16). They want to establish VPC Network Peering between them. What is the outcome?

A.Peering succeeds, and only non-overlapping subnets are used

B.Peering succeeds, and routes are exchanged, but traffic may be unpredictable

C.Peering fails because subnets overlap

D.Peering succeeds, but routes are not exchanged

AnswerC

Overlapping IP ranges prevent VPC peering from being established.

Why this answer

VPC Network Peering requires that the subnets in the two VPCs do not overlap. Since both VPCs use the same CIDR block (10.0.0.0/16), peering will fail due to subnet overlap.

Full explanation →

796

MCQhard

A network engineer runs the gcloud command above for a Cloud NAT configured in us-central1. The VPC has 20 instances without external IPs in us-central1. They notice that only three instances have NAT mappings displayed. What could explain this?

A.Only instances with active outbound connections are shown.

B.The NAT gateway is configured only for a specific subnet.

C.Only instances with external IPs are mapped.

D.The other instances are using a different NAT gateway.

AnswerA

NAT gateway info displays only active NAT mappings; idle instances have no mapping.

Why this answer

The `gcloud compute nat-gateways list-mappings` command only displays NAT mappings for instances that currently have active outbound connections traversing the Cloud NAT gateway. Cloud NAT uses dynamic port address translation (PAT) and only creates a mapping entry when an instance sends traffic that requires source NAT. Instances without active sessions will not appear in the listing, even though they are configured to use the NAT gateway.

Exam trap

The trap here is that candidates assume the `list-mappings` command shows all instances configured to use the NAT gateway, rather than understanding it only shows instances with currently active NAT sessions.

How to eliminate wrong answers

Option B is wrong because even if the NAT gateway is configured for a specific subnet, all 20 instances in that subnet would still be eligible for NAT mappings; the command would show mappings for any instance with active connections, not just three. Option C is wrong because Cloud NAT is specifically designed for instances without external IPs; instances with external IPs do not use NAT and would not appear in NAT mappings at all. Option D is wrong because if the other 17 instances were using a different NAT gateway, the command would show zero mappings for the queried gateway, not exactly three; the question states only three instances have mappings, implying the others simply have no active connections.

Full explanation →

797

MCQmedium

A company needs to ensure that all traffic between GCP VMs in different regions is encrypted in transit. What is the recommended approach?

A.Use VPC peering with encryption enabled

B.By default, traffic between GCP VMs is encrypted

C.Use Cloud VPN between the two regions

D.Enable IPsec on the VPC

AnswerB

Google encrypts all inter-region traffic at the physical layer.

Why this answer

Google Cloud encrypts all traffic between VMs at the hypervisor level, regardless of region, using application-layer encryption (e.g., TLS) and network-layer encryption (e.g., IPSec) by default. This encryption is transparent, always-on, and does not require any configuration, making option B the correct answer. The encryption covers all VM-to-VM traffic within the same VPC or across VPCs, including inter-region communication.

Exam trap

The trap here is that candidates assume inter-region traffic requires explicit encryption configuration (like VPN or IPsec), but Google Cloud encrypts all VM-to-VM traffic by default, making those options unnecessary and incorrect.

How to eliminate wrong answers

Option A is wrong because VPC peering does not have an 'encryption enabled' toggle; traffic over VPC peering is already encrypted by default at the Google network layer, and there is no separate encryption setting for peering. Option C is wrong because Cloud VPN is used to connect on-premises networks or other cloud providers to GCP, not for encrypting traffic between GCP VMs in different regions, as that traffic is already encrypted by default. Option D is wrong because IPsec cannot be 'enabled on the VPC' as a whole; IPsec is a protocol used for site-to-site VPNs, and applying it to VPC-level traffic is unnecessary and not supported as a VPC-wide feature.

Full explanation →

798

MCQmedium

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They have two VLAN attachments (vlan-100 and vlan-200) connected to two separate Cloud Routers in the same region. Each Cloud Router has a BGP session with the on-premises router. The on-premises router advertises the same prefixes (10.0.0.0/8) over both sessions. In Google Cloud, they have workloads in two different VPCs: VPC-A and VPC-B. They want traffic to VPC-A to use vlan-100, and traffic to VPC-B to use vlan-200. Cloud Router 1 is attached to VPC-A, Cloud Router 2 is attached to VPC-B. Currently, traffic from on-premises to VPC-A sometimes goes through vlan-200, causing asymmetric routing. What configuration change should they make to ensure traffic is symmetric?

A.Set a higher MED on the on-premises router for routes advertised to vlan-200, making vlan-100 preferred for all traffic.

B.Configure static routes on the on-premises router to force traffic to VPC-A via vlan-100 and to VPC-B via vlan-200.

C.Create two separate VPCs and assign each VLAN attachment to a different VPC.

D.Use BGP community tags on the on-premises router to label routes for VPC-A and VPC-B, and configure route priority on Cloud Router to match these communities.

AnswerD

BGP communities allow granular route manipulation, ensuring traffic for each VPC uses the designated attachment.

Why this answer

BGP community tags allow the on-premises router to tag routes for VPC-A and VPC-B differently. Cloud Router can then use these community tags to influence route priority (e.g., via local preference or MED matching), ensuring that traffic to VPC-A is always routed through vlan-100 and traffic to VPC-B through vlan-200, solving the asymmetric routing issue without relying on static routes or MED manipulation that would affect all traffic.

Exam trap

The trap here is that candidates often assume MED or static routes can solve asymmetric routing, but they overlook that MED affects all routes from a neighbor and static routes on-premises cannot control Google Cloud's return path selection, whereas BGP communities provide the necessary granularity to influence path selection per prefix in both directions.

How to eliminate wrong answers

Option A is wrong because setting a higher MED on the on-premises router for routes advertised to vlan-200 would make vlan-100 preferred for all prefixes, not just those destined for VPC-A; this would force all traffic through vlan-100, breaking the requirement for VPC-B traffic to use vlan-200. Option B is wrong because static routes on the on-premises router cannot override BGP-learned routes on the Google Cloud side; the asymmetric routing occurs because Google Cloud's Cloud Routers may still prefer the alternate path due to equal-cost multi-path (ECMP) or BGP best-path selection, and static routes on-premises do not control return path selection in Google Cloud. Option C is wrong because the two VLAN attachments are already connected to separate VPCs (VPC-A and VPC-B) via their respective Cloud Routers; creating two separate VPCs again would not change the routing behavior—the issue is that both Cloud Routers receive the same prefix (10.0.0.0/8) and Google Cloud may load-balance or choose the wrong path, not a VPC attachment problem.

Full explanation →

799

MCQhard

A large enterprise has two on-premises data centers (DC1 and DC2) connected to Google Cloud via two separate VPN tunnels to the same VPC. Each tunnel terminates on a different Cloud VPN gateway (gateway1 in us-east1, gateway2 in us-west1). The on-premises routers advertise the same CIDR 172.16.0.0/12 from both DCs. Cloud Router is configured with BGP and uses default route priority. You notice that after a failover event where one tunnel goes down, traffic continues to flow, but there is a significant increase in latency for traffic coming from GCP to on-premises. You verify that both tunnels have re-established. What is the most likely cause of the increased latency?

A.The on-premises routers are using site-to-site VPN between themselves causing a routing loop

B.The on-premises routers do not use AS path prepending to prefer the local DC's path for the prefix

C.The Cloud VPN tunnels are using different preshared keys

D.Bidirectional Forwarding Detection (BFD) is not enabled on the Cloud VPN tunnels

AnswerB

Without AS path prepending, GCP may choose a suboptimal path (e.g., sending DC1 traffic via DC2) if the routes have equal AS path length, causing increased latency.

Why this answer

When both on-premises routers advertise the same CIDR (172.16.0.0/12) to Google Cloud via BGP, Cloud Router selects the path with the shorter AS path length by default. Without AS path prepending on the backup DC's router, both routes have equal AS path length, causing Cloud Router to load-balance or pick a suboptimal path after failover. After the tunnel re-establishes, traffic from GCP may still be routed to the remote DC (e.g., DC2) instead of the local DC (DC1), resulting in higher latency due to cross-country or inter-DC transit.

Exam trap

Google Cloud often tests the misconception that increased latency after failover is due to a routing loop or BFD misconfiguration, when the real issue is the lack of AS path prepending to influence BGP path selection for the same prefix advertised from multiple locations.

How to eliminate wrong answers

Option A is wrong because site-to-site VPN between on-premises routers would not cause a routing loop in this scenario; the increased latency is due to suboptimal path selection, not a loop. Option C is wrong because different preshared keys would prevent the VPN tunnels from establishing at all, not cause increased latency after re-establishment. Option D is wrong because BFD is used for fast failure detection, not for influencing path selection or latency after tunnels are up; its absence would delay failover detection, not increase latency post-failover.

Full explanation →

800

MCQeasy

A company has a single VPC with subnets in us-central1 and europe-west1. They have Compute Engine instances in both subnets that need to communicate with each other. The security team wants to ensure that only specific instances in us-central1 can connect to a database instance in europe-west1 on port 3306. Currently, the default firewall rules allow all internal traffic (priority 65535). The network engineer first creates a new ingress firewall rule to allow TCP traffic on port 3306 from instances with the network tag 'app' to instances with the tag 'db', with priority 1000. Then, to enforce the restriction, they delete the default allow internal rule (priority 65535). However, after applying the changes, the app instances (tagged 'app') in us-central1 cannot connect to the database instance (tagged 'db') in europe-west1. The engineer verifies that the tags are correctly applied to the instances. What is the most likely cause of the connectivity failure?

A.The firewall rule only allows ingress from instances with tag 'app' but the egress traffic from app instances is blocked.

B.The app instances need a firewall rule to allow egress traffic to the database on port 3306.

C.The firewall rule is applied to the wrong VPC network.

D.The database instance's network tag 'db' was not applied to the database instance.

AnswerB

With the default allow internal rule removed, egress must be explicitly allowed.

Why this answer

B is correct because in Google Cloud VPC, firewall rules are stateful for ingress but not for egress. The ingress rule allowing traffic from 'app' to 'db' on port 3306 only controls incoming packets to the database instance. The app instance still needs an egress firewall rule to allow outbound traffic on port 3306, otherwise the outbound SYN packet is dropped before it reaches the database.

Deleting the default allow internal rule (priority 65535) removed the implicit egress permission, so a specific egress rule is required.

Exam trap

Google Cloud often tests the misconception that an ingress rule alone is sufficient for bidirectional communication, but in Google Cloud VPC, egress rules are required for outbound traffic initiation unless a default allow egress rule exists.

How to eliminate wrong answers

Option A is wrong because the ingress rule is correctly defined to allow traffic from 'app' to 'db' on port 3306; the issue is not that ingress is blocked but that egress from the app instance is missing. Option C is wrong because the question states there is a single VPC, and the rule is applied to that same VPC; there is no indication of a wrong VPC selection. Option D is wrong because the engineer verified that the tags are correctly applied, so the database instance does have the 'db' tag; the failure is not due to missing tags.

Full explanation →

801

Multi-Selecthard

A company is using Traffic Director with Envoy sidecars. They want to enable mutual TLS (mTLS) between services. Which two steps are required? (Choose two.)

Select 2 answers

A.Enable mTLS in Traffic Director configuration

B.Deploy a service mesh with Istio

C.Configure Envoy sidecars with certificates

D.Use a Global HTTPS Load Balancer

E.Set up Cloud DNS

AnswersA, C

Correct: mTLS must be enabled in Traffic Director.

Why this answer

To enable mTLS, you need to enable mTLS in Traffic Director and configure Envoy sidecars with certificates.

Full explanation →

802

MCQmedium

An engineer needs to provide outbound internet access to a set of Compute Engine instances that do not have external IP addresses. The instances are in a VPC subnet with a Cloud NAT configured. However, the instances still cannot reach the internet. The engineer verified that Cloud NAT is configured on the same region and VPC as the instances. What is the most likely cause?

A.The firewall rules block all outbound traffic from the subnet

B.The instances are using a custom network that does not support Cloud NAT

C.The instances are not tagged with the correct network tag used in the Cloud NAT configuration

D.The Cloud NAT gateway uses dynamic port allocation, which is disabled

AnswerC

Cloud NAT uses tags or service accounts to determine which instances can use it for outbound connectivity.

Why this answer

Cloud NAT requires the instances to have the 'allow NAT' network tag or service account configured in the NAT gateway rules. If the instances are not tagged or the service account is not specified, traffic is not forwarded.

Full explanation →

803

Multi-Selecthard

A company wants to set up a hybrid network with HA VPN between an on-premises network and GCP. They need a 99.99% SLA. Which THREE conditions must be met to achieve this SLA?

Select 2 answers

A.Cloud Router configured with global dynamic routing mode

B.Two Cloud VPN gateways in GCP, each with one interface

C.Each tunnel uses a unique IKE pre-shared key

D.Two or more tunnels established with BGP sessions

E.On-premises VPN gateway with two distinct public IP addresses

AnswersD, E

Two or more tunnels with BGP sessions are required to meet the SLA, ensuring redundancy and failover.

Why this answer

To achieve a 99.99% SLA with HA VPN, you need at least two tunnels, each with a separate external IP on the GCP side, and the on-premises gateway must have two distinct public IP addresses. Unique pre-shared keys per tunnel are recommended for security but are not a requirement for the SLA.

Exam trap

The 99.99% SLA requires redundancy at both ends: two GCP external IPs and two on-premises peer IPs. Unique PSKs are a best practice but not a condition.

Full explanation →

804

Multi-Selecthard

A company wants to use Cloud Armor to block traffic from a specific IP range (198.51.100.0/24) and also apply rate limiting. Which TWO components are needed? (Select 2)

Select 2 answers

A.A Cloud CDN cache rule

B.A Cloud Armor security policy with one rule that combines IP deny and rate limiting

C.A Cloud Armor security policy with two rules: one for IP deny and one for rate limiting

D.A network firewall rule to block the IP range

E.An HTTPS load balancer with the security policy attached

AnswersC, E

A single policy can contain multiple rules to achieve both requirements.

Why this answer

Cloud Armor security policies contain rules with conditions like IP ranges and rate limiting. The policy is attached to a backend service of an HTTPS load balancer.

Full explanation →

805

MCQhard

A company has a VPC with a subnet in us-central1. Compute Engine instances in that subnet have no external IPs but need to reach the internet for software updates. The engineer configured Cloud NAT with the default settings. However, instances fail to reach the internet. What is the most likely cause?

A.Cloud NAT is not configured in the correct region.

B.An egress firewall rule is missing that allows traffic from the instances to the internet via NAT.

C.Private Google Access is enabled on the subnet, which overrides Cloud NAT.

D.The Cloud NAT router is not attached to the correct VPC network.

AnswerB

Firewall rules control egress traffic; Cloud NAT does not bypass them. A rule allowing egress to 0.0.0.0/0 is needed.

Why this answer

Cloud NAT requires that the instances are allowed egress traffic to the internet. Without a suitable egress firewall rule, NAT traffic is blocked. The default firewall rules only allow egress to Google APIs (private.googleapis.com) but not to general internet destinations.

A firewall rule allowing egress to 0.0.0.0/0 on the appropriate ports is required.

Full explanation →

806

Matchingmedium

Match each Cloud Load Balancing type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Global, proxy-based, for HTTP/S traffic from internet

Regional, pass-through, for traffic within VPC

Regional, proxy-based, for non-HTTP/S internet traffic

Regional, proxy-based, for internal HTTP/S traffic

Global, terminates SSL, for non-HTTPS SSL traffic

Why these pairings

The correct matches are: External HTTP(S) Load Balancer handles internet HTTP/HTTPS traffic; Internal TCP/UDP Load Balancer handles internal TCP/UDP traffic. Common confusions include mixing external/internal roles and protocol support.

Full explanation →

807

Multi-Selectmedium

A company is using Cloud Interconnect with multiple VLAN attachments. They want to implement traffic shaping to prioritize real-time traffic over bulk transfers. Which THREE actions should they take?

Select 3 answers

A.Set up Cloud Router with BGP QoS policies to match DSCP values

B.Enable Cloud NAT to handle traffic shaping

C.Create VPC firewall rules to classify traffic based on source/destination

D.Configure DSCP markings on the on-premises routers for different traffic types

E.Use VPC flow logs to identify heavy traffic flows

AnswersA, C, D

Cloud Router can apply QoS based on DSCP.

Why this answer

Cloud Router with BGP QoS policies can match DSCP values to prioritize traffic. By configuring BGP QoS policies, you can map specific DSCP values to different traffic classes, allowing Cloud Interconnect to apply traffic shaping that prioritizes real-time traffic (e.g., VoIP) over bulk transfers. This leverages BGP community attributes to signal QoS requirements across the hybrid connection.

Exam trap

The trap here is that candidates confuse monitoring tools (VPC flow logs) or unrelated services (Cloud NAT) with traffic shaping mechanisms, overlooking that DSCP marking and BGP QoS policies are the correct approach for prioritizing traffic on Cloud Interconnect.

Full explanation →

808

MCQeasy

A company needs private connectivity between its on-premises data center and Google Cloud with consistent low latency and high throughput. The on-premises location is close to a Google Cloud point of presence that supports Dedicated Interconnect. The company expects to use more than 10 Gbps of bandwidth in the near future. Which connectivity solution should they choose?

A.Dedicated Interconnect

B.Partner Interconnect

C.HA VPN with dynamic routing

D.Cloud VPN with static routing

AnswerA

Dedicated Interconnect provides a direct, private connection with low latency and high bandwidth (10/100 Gbps) suitable for growing needs.

Why this answer

Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, offering consistent low latency and high throughput. Since the on-premises location is near a Google Cloud point of presence that supports Dedicated Interconnect and the bandwidth requirement exceeds 10 Gbps (Dedicated Interconnect supports up to 10 Gbps per circuit, with multiple circuits for higher aggregate bandwidth), this is the optimal solution.

Exam trap

Google Cloud often tests the misconception that Partner Interconnect is equivalent to Dedicated Interconnect for high-bandwidth needs, but the key trap is that Partner Interconnect introduces a third-party provider's network, which cannot guarantee the same consistent low latency and throughput as a direct physical connection.

How to eliminate wrong answers

Option B is wrong because Partner Interconnect relies on a third-party service provider's network, which introduces additional latency and potential throughput variability, and typically supports lower bandwidths (up to 10 Gbps per VLAN attachment) compared to Dedicated Interconnect's direct physical links. Option C is wrong because HA VPN with dynamic routing uses the public internet or a third-party network, cannot guarantee consistent low latency or high throughput, and is limited to bandwidths far below 10 Gbps (typically up to 3 Gbps per tunnel). Option D is wrong because Cloud VPN with static routing also uses the public internet, lacks the performance guarantees needed for >10 Gbps, and static routing does not provide the redundancy or dynamic failover required for enterprise-grade hybrid connectivity.

Full explanation →

809

MCQmedium

An organization has multiple VPCs in a Shared VPC setup. They want to allow only certain service projects to use a specific subnet in the host project. What should they configure?

A.Use VPC peering between host and service projects

B.Grant the compute.networkUser role to the service project

C.Create a separate host project for each service project

D.Use shared subnet IAM to grant compute.subnetUser on the specific subnet

AnswerD

Correct. Shared subnet IAM allows fine-grained access.

Why this answer

Shared VPC allows IAM permissions on individual subnets. You can grant the compute.subnetUser role on a specific subnet to a service project.

Full explanation →

810

MCQeasy

A developer wants to create a GKE cluster with a separate subnet for pods and services to avoid IP address exhaustion. What type of secondary IP ranges should they configure on the VPC subnet?

A.Primary IP ranges

B.External IP ranges

C.Alias IP ranges

D.Secondary IP ranges for pods and services

AnswerD

Correct. GKE requires secondary ranges for pods and services.

Why this answer

GKE uses secondary IP ranges for pods and services. You specify these ranges when creating the subnet.

Full explanation →

811

MCQhard

An organization wants to allow only certain users to access a service published via Private Service Connect. They need to restrict access based on the source VPC network. What should they use?

A.Firewall rules in the consumer VPC

B.IAM permissions on the service attachment

C.Consumer allow lists in the service attachment

D.VPC Service Controls

AnswerC

Consumer allow lists restrict which projects or VPCs can access the published service.

Why this answer

Private Service Connect allows publishing services with access control using service attachment with consumer allow lists that specify which projects or VPCs can connect.

Full explanation →

812

Multi-Selectmedium

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Select 2 answers

A.Configure Cloud NAT for the VPC.

B.Assign an external IP address to the VM.

C.Enable Private Google Access on the subnet.

D.Assign a static internal IP address to the VM.

E.Create a firewall rule to allow ingress on TCP port 80 from 0.0.0.0/0.

AnswersB, E

An external IP allows the VM to be reachable from the internet.

Why this answer

A VM must have an external (public) IP address assigned to be directly reachable from the internet. Without an external IP, the VM cannot receive inbound traffic initiated from outside the VPC, even with proper firewall rules. This is a fundamental requirement for internet-facing workloads in Google Cloud.

Exam trap

Google Cloud often tests the misconception that Cloud NAT or Private Google Access can substitute for an external IP when allowing inbound internet traffic, but these services only support outbound or API-specific connectivity, not inbound internet access.

Full explanation →

813

MCQeasy

A company wants to serve static content from a Cloud Storage bucket and dynamic content from Compute Engine VMs behind a single external URL. Which GCP feature allows this configuration?

A.URL map

B.Traffic Director

C.Cloud CDN

D.Cloud DNS

AnswerA

Correct: URL map routes traffic to different backends based on URL path.

Why this answer

URL map in the Global HTTPS Load Balancer can route requests to different backends (backend bucket for static, backend service for dynamic) based on URL path.

Full explanation →

814

Multi-Selectmedium

Which TWO considerations are important when designing a VPC peering strategy between multiple projects in Google Cloud?

Select 2 answers

A.Peering is transitive by default

B.Subnet IP ranges in peered VPCs must not overlap

C.Firewall rules in one VPC automatically apply to peered VPCs

D.VPC peering can only be used within the same project

E.Custom routes can be exchanged between peered VPCs if configured

AnswersB, E

Overlapping ranges cause routing issues.

Why this answer

VPC peering requires that subnet IP ranges in peered VPCs do not overlap. This is a fundamental constraint of VPC peering in Google Cloud: if two VPCs have overlapping CIDR blocks, routes cannot be exchanged unambiguously, and the peering connection will fail to establish or will cause routing conflicts. Overlapping ranges would break the ability to route traffic correctly between the VPCs, as there would be no way to determine which subnet a packet should be delivered to.

Exam trap

Google Cloud often tests the misconception that VPC peering is transitive by default, leading candidates to incorrectly select Option A, when in fact transitivity must be explicitly engineered.

Full explanation →

815

MCQmedium

A company is using Partner Interconnect with a service provider that offers Layer 3 connectivity. The service provider manages the BGP sessions. The engineer needs to create a VLAN attachment on the Google side. Which attachment type should they choose?

A.PARTNER

B.MANAGED

C.DEDICATED

D.PARTNER_PROVIDER

AnswerD

PARTNER_PROVIDER attachment type is for Layer 3 connectivity where the service provider manages BGP.

Why this answer

For Partner Interconnect, when the service provider manages Layer 3 (BGP), the VLAN attachment type must be PARTNER_PROVIDER. The PARTNER type is for Layer 2 connectivity where the customer manages BGP.

Full explanation →

816

Multi-Selectmedium

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

Select 2 answers

A.Ingress rule with source IP range of the company's public IPs and allow tcp:443

B.Ingress rule with source IP range 0.0.0.0/0 and allow tcp:80

C.Ingress rule with source IP range of the company's public IPs and allow tcp:80

D.Ingress rule with source tag 'web' and allow tcp:80

E.Ingress rule with destination IP range 0.0.0.0/0 and allow tcp:80

AnswersA, C

Restricts HTTPS traffic to company IPs.

Why this answer

Options A and C are correct. Ingress firewall rules with source IP ranges limited to the company's known public IPs on ports 443 (HTTPS) and 80 (HTTP) ensure that only traffic from those IPs can access the web server instances. Option B is incorrect because source range 0.0.0.0/0 allows all IPs, which does not restrict to known IPs.

Option D is incorrect because source tags identify target instances, not source IPs. Option E is incorrect because ingress rules use source IP ranges, not destination IP ranges, to restrict incoming traffic.

Full explanation →

817

MCQmedium

An engineer is configuring Dedicated Interconnect between an on-premises data center and Google Cloud. Cloud Router is set up with BGP sessions. The BGP session remains in Idle state. Which of the following is the most likely cause?

A.The Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface.

B.The on-premises router is not advertising the Google Cloud VPC subnet routes.

C.The interconnect is not configured with redundant links.

D.The VLAN attachment is not in the same region as the Cloud Router.

AnswerA

IP mismatch is a common cause of BGP Idle state.

Why this answer

The BGP session remains in Idle state because the Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface. For BGP peering over Dedicated Interconnect, the two routers must be directly connected at Layer 3, meaning their BGP peer IP addresses must belong to the same /30 or /31 subnet. If they are in different subnets, the TCP connection for BGP cannot be established, keeping the session in Idle state.

Exam trap

The trap here is that candidates often confuse BGP session states with route advertisement issues, assuming missing routes cause Idle state, when in fact Idle state is a Layer 3 connectivity problem, not a routing policy problem.

How to eliminate wrong answers

Option B is wrong because the on-premises router not advertising the Google Cloud VPC subnet routes would not cause the BGP session to remain in Idle state; it would instead cause routes to be missing from the routing table after the session is established. Option C is wrong because redundant links are not required for a single BGP session to transition out of Idle state; redundancy affects high availability, not the initial BGP peering process. Option D is wrong because the VLAN attachment must be in the same region as the Cloud Router for the interconnect to function, but if it were not, the BGP session would not even be configured or would fail at a lower layer, not specifically remain in Idle state.

Full explanation →

818

Multi-Selecthard

An organization has a VPC with multiple subnets. They want to log all outbound connections from instances to the internet for compliance. They also want to use a cost-effective solution that doesn't require a proxy. Which three components are needed? (Choose three.)

Select 3 answers

A.Cloud NAT

B.Cloud Logging

C.Cloud VPN

D.Cloud Router

E.VPC Flow Logs

AnswersA, B, D

Provides outbound connectivity with optional logging.

Why this answer

Cloud NAT with logging enabled provides logs of outbound connections. Cloud Router is required to set up Cloud NAT. Firewall rules allow the traffic but are not specifically needed for logging; the NAT logs capture the connections.

Full explanation →

819

MCQmedium

An organization uses Cloud CDN to serve static content from a backend bucket. They want to ensure that content is always served from the edge regardless of cache-control headers from the origin. Which cache mode should they set?

A.USE_ORIGIN_HEADERS

B.ENABLE_CACHE

C.FORCE_CACHE_ALL

D.CACHE_ALL_STATIC

AnswerC

Forces caching of all content regardless of origin headers.

Why this answer

FORCE_CACHE_ALL mode forces Cloud CDN to cache all content, ignoring origin cache directives. CACHE_ALL_STATIC caches based on file type, USE_ORIGIN_HEADERS respects origin headers.

Full explanation →

820

MCQhard

A company has a VPC with subnets in us-central1 and europe-west1. They create a Private Service Connect endpoint for a managed service in us-central1. Can Compute Engine instances in europe-west1 access the endpoint?

A.Yes, if they use a global load balancer in front of the endpoint.

B.No, unless the VPC is peered with another VPC that contains the endpoint.

C.Yes, because the endpoint is accessible from any region in the VPC.

D.No, because the endpoint is only accessible from the same region.

AnswerD

Private Service Connect endpoints are regional; instances must be in the same region to access the endpoint.

Why this answer

Private Service Connect (PSC) endpoints are regional resources. An endpoint created in us-central1 is only accessible from Compute Engine instances within the same region (us-central1) of the VPC. Instances in europe-west1 cannot directly reach the endpoint because traffic would need to cross regional boundaries, which PSC does not support for producer endpoints.

Option D correctly identifies this regional restriction.

Exam trap

The trap here is that candidates assume a VPC is a global construct and therefore any resource within it is globally accessible, but Google Cloud tests the specific regional nature of Private Service Connect endpoints, which are not globally routable within the VPC without additional configuration.

How to eliminate wrong answers

Option A is wrong because a global load balancer does not extend the regional scope of a PSC endpoint; the endpoint itself remains regional, and the load balancer would still need to forward traffic to the endpoint in us-central1, which does not change the regional access limitation. Option B is wrong because VPC peering does not enable cross-region access to a PSC endpoint; the endpoint is tied to the region where it is created, and peering does not override that regional constraint. Option C is wrong because PSC endpoints are not globally accessible within a VPC; they are regional resources, and instances in other regions cannot reach them directly without additional constructs like inter-region VPC peering or VPN, which still do not make the endpoint itself global.

Full explanation →

821

Multi-Selecthard

A company has a Hybrid Connectivity setup using Cloud VPN with BGP. They want to migrate to Dedicated Interconnect for better performance. During the migration, they need to avoid downtime. Which THREE steps should they take?

Select 3 answers

A.Set a lower local preference on the Interconnect BGP session

B.Remove the VPN tunnels immediately after Interconnect is up

C.Provision the Dedicated Interconnect and VLAN attachments

D.Configure BGP on the Interconnect with a higher local preference than the VPN

E.Gradually withdraw VPN routes after verifying Interconnect traffic

AnswersC, D, E

Must have the Interconnect physical path ready.

Why this answer

Provisioning the Dedicated Interconnect and VLAN attachments is the foundational step to establish the new high-performance connection. Without this, there is no physical or logical path to migrate traffic onto. This must be done before any BGP configuration or route manipulation can occur.

Exam trap

Google Cloud often tests the misconception that you should immediately remove the old connection (VPN tunnels) once the new one (Interconnect) is up, but the correct approach is to gracefully shift traffic using BGP attributes and then decommission the old path only after verification.

Full explanation →

822

MCQeasy

A network engineer wants to see a real-time graphical representation of the topology of their VPC network, including instances, subnets, and load balancers. Which Network Intelligence Center tool should they use?

A.Performance Dashboard

B.Network Topology

C.Connectivity Tests

D.Firewall Insights

AnswerB

Network Topology displays a live graph of VPC resources.

Why this answer

Network Topology provides a visual map of your VPC network's resources and their relationships, updated in near real-time.

Full explanation →

823

MCQeasy

A developer needs to create a GKE cluster that uses a secondary IP range for pods and another for services. During VPC subnet creation, they set a primary IP range and two secondary ranges. Which flag must be used when creating the subnet to specify the pods range?

A.--pods-range

B.--secondary-range

C.--additional-ip-range

D.--auxiliary-range

AnswerB

This flag allows specifying secondary IP ranges for pods and services during subnet creation.

Why this answer

When creating a subnet with secondary IP ranges, the '--secondary-range' flag is used to specify the name and range for pods (or services). The CLI command allows multiple secondary ranges.

Full explanation →

824

MCQmedium

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

A.CACHE_ALL_STATIC

B.USE_ORIGIN_HEADERS

C.None of the above

D.FORCE_CACHE_ALL

AnswerB

This mode caches only if the origin's Cache-Control headers allow caching.

Why this answer

USE_ORIGIN_HEADERS mode respects the origin's Cache-Control headers. Only objects with Cache-Control: public or similar will be cached.

Full explanation →

825

MCQeasy

A company wants to forward DNS queries from their on-premises network to Google Cloud for resolution of private zone names. Which configuration is required?

A.DNS peering

B.DNS inbound server policy

C.DNS forwarding zone

D.Managed private zone

AnswerB

DNS inbound server policy allows on-premises resolvers to forward queries to Cloud DNS over VPN/Interconnect.

Why this answer

A DNS inbound server policy allows an on-premises DNS resolver to forward queries to Google Cloud, enabling resolution of private zone names. This policy creates a forwarding path from on-premises to Cloud DNS using a specific inbound endpoint, which is required for hybrid cloud DNS resolution.

Exam trap

The trap here is that candidates confuse the direction of DNS forwarding—assuming a forwarding zone (which sends queries from Cloud to on-premises) is the same as an inbound policy (which receives queries from on-premises)—and overlook that the question specifies forwarding from on-premises to Google Cloud.

How to eliminate wrong answers

Option A is wrong because DNS peering is used to enable resolution between two Google Cloud VPC networks, not for forwarding queries from an on-premises network. Option C is wrong because a DNS forwarding zone is a Cloud DNS configuration that forwards queries from Google Cloud to an on-premises resolver, not the reverse direction required here. Option D is wrong because a managed private zone only hosts DNS records within Google Cloud and does not provide any mechanism to receive or forward queries from external networks.

Full explanation →

Page 11 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCNE by domain

Target a specific domain to shore up weak areas.

Configuring Network Services Managing, Monitoring, and Optimising Network Operations Implementing Hybrid Interconnectivity Designing, Planning, and Prototyping a GCP Network Implementing VPC Instances Implementing network security Implementing a Virtual Private Cloud

See all domains with question counts →