Courseiva

Google Professional Cloud Network Engineer (PCNE) — Questions 901–961

961 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 12

Page 13 of 13

901
MCQhard

An organization has two VPC networks in different Google Cloud organizations. They need to allow private IP communication between instances in these VPCs without using public IPs or VPNs. Which solution should they use?

A.Cloud NAT
B.Shared VPC
C.Cloud VPN
D.VPC Network Peering
AnswerD

Supports cross-organization peering.

Why this answer

VPC Network Peering allows private IP connectivity between two VPC networks across different organizations without requiring public IPs, VPNs, or gateways. It uses the Google Cloud internal infrastructure to route traffic directly between instances, leveraging RFC 1918 addresses and supporting global peering.

Exam trap

Google Cloud often tests the distinction between Shared VPC (same org) and VPC Network Peering (cross-org), leading candidates to mistakenly choose Shared VPC when the question specifies different organizations.

How to eliminate wrong answers

Option A is wrong because Cloud NAT provides outbound internet access for private instances, not private inter-VPC communication. Option B is wrong because Shared VPC requires both VPCs to be in the same organization, not across different organizations. Option C is wrong because Cloud VPN uses public internet tunnels (IPsec) and is not a private IP-only solution, violating the requirement to avoid VPNs.

Full explanation →
902
Multi-Selecthard

A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC flow logs show traffic being dropped. Firewall rules are correctly configured. Which TWO actions should the engineer take to identify the cause?

Select 2 answers
A.Ensure that the subnets in both VPCs don't overlap.
B.Use Packet Mirroring to capture traffic on both sides and compare.
C.Check for asymmetric routing by reviewing the VPC peering routes and Cloud Router sessions.
D.Disable the firewall rules to see if traffic flows.
E.Verify that the VPCs are in the same project.
AnswersB, C

Packet Mirroring can help identify if traffic is reaching the destination instance.

Why this answer

Packet Mirroring allows you to capture and inspect actual traffic at the packet level on both sides of the VPC peering connection. Since firewall rules are correctly configured but flow logs still show drops, the issue is likely at a lower layer (e.g., routing, MTU, or asymmetric traffic). By comparing mirrored packets, you can see if traffic is actually reaching the destination interface and whether responses are being sent back, which flow logs alone cannot reveal.

Exam trap

Google Cloud often tests the misconception that flow logs provide enough detail to diagnose all connectivity issues, when in fact they only show summary statistics and cannot capture packet-level details needed to identify asymmetric routing or MTU problems.

Full explanation →
903
MCQmedium

A company has Compute Engine instances without external IP addresses that need to access external APIs. The instances are in multiple zones within a region, and each zone has a subnet. The company wants a cost-effective and highly available solution that does not require manual failover. What should they do?

A.Create a Cloud NAT gateway in each zone and configure region-specific NAT rules.
B.Create a Cloud NAT gateway in one zone and configure an instance tag-based route to the gateway.
C.Enable Private Google Access on the subnets and configure a Cloud NAT gateway in one zone.
D.Assign external IP addresses to each instance and create appropriate firewall rules.
AnswerA

Regional NAT with gateways per zone provides automatic failover and high availability.

Why this answer

A Cloud NAT gateway per zone provides highly available outbound connectivity for instances without external IPs. By placing a gateway in each zone, traffic from instances in that zone uses the local gateway, avoiding cross-zone hops and ensuring automatic failover if a zone fails. This meets the cost-effective and no-manual-failover requirements without needing instance-level external IPs.

Exam trap

The trap here is that candidates assume a single Cloud NAT gateway is sufficient for high availability, but the PCNE exam expects zone-level redundancy to avoid a single point of failure and to meet the 'no manual failover' requirement.

How to eliminate wrong answers

Option B is wrong because a single Cloud NAT gateway in one zone creates a single point of failure; if that zone goes down, all outbound connectivity is lost, and instance tag-based routes do not provide automatic failover. Option C is wrong because Private Google Access only enables access to Google APIs and services, not external APIs; adding a single Cloud NAT gateway still lacks zone-level high availability. Option D is wrong because assigning external IPs to each instance is not cost-effective (each IP incurs cost) and does not provide a managed, highly available solution; it also requires manual failover if an instance fails.

Full explanation →
904
MCQhard

Refer to the exhibit. A company uses a Cloud Router with two BGP sessions for an HA VPN to on-premises. Traffic is not flowing correctly to the on-premises network. What is the most likely issue?

A.The advertised route priority is too low.
B.The BGP session with vpn-tunnel-2 is down, causing asymmetric routing.
C.The keepalive interval is too high.
D.The ASN 65000 is private and not allowed.
AnswerB

A down BGP session can disrupt proper route advertisement and traffic flow.

Why this answer

The exhibit shows that vpn-tunnel-2's BGP session is in a state other than 'established' (likely down), while vpn-tunnel-1 is established. A down BGP session on one tunnel can cause asymmetric routing or loss of connectivity, especially if traffic is sent over the down tunnel. Option B correctly identifies this.

Option A is incorrect because the advertised route priority (MED) of 100 is not the issue; the problem is the session state. Option C is incorrect because keepalive interval 20 seconds is standard. Option D is incorrect because private ASN 65000 is allowed in Cloud Router BGP configurations.

Full explanation →
905
MCQhard

An engineer is troubleshooting a VPC Network Peering connection between VPC-A and VPC-B. They have verified that the peering is active. However, an instance in VPC-A cannot reach an instance in VPC-B using its internal IP. Both VPCs have firewall rules allowing the traffic. What is the most likely cause?

A.The firewall rules are not applied to the correct tags
B.The subnet IP ranges overlap
C.The instance in VPC-A does not have a default route
D.Custom routes are not being exchanged between the VPCs
AnswerD

By default, custom routes are not exchanged; the export/import custom routes flag must be enabled.

Why this answer

When VPC Network Peering is active but traffic fails, the most common cause is that custom routes are not being exchanged. By default, only subnet routes are exchanged; custom routes (e.g., static routes or routes from VPNs) are not shared unless explicitly configured using the 'export custom routes' option in the peering settings. Without this, the instance in VPC-A has no route to the internal IP of the instance in VPC-B, even if firewall rules allow the traffic.

Exam trap

The trap here is that candidates assume an active peering status guarantees full route exchange, but Google Cloud's VPC Network Peering only exchanges subnet routes by default; custom routes must be explicitly enabled using the 'Export custom routes' option when establishing the peering connection.

How to eliminate wrong answers

Option A is wrong because firewall rules are evaluated after routing; if there is no route to the destination, the packet is dropped before any firewall rule is checked, so tag misapplication would not be the primary cause. Option B is wrong because overlapping subnet IP ranges would prevent the peering from being established or cause routing conflicts, but the question states the peering is active, so overlapping ranges are not the issue. Option C is wrong because a default route (0.0.0.0/0) is used for internet-bound traffic, not for traffic within a VPC peering; the instance needs a specific route to the peered VPC's subnet, not a default route.

Full explanation →
906
MCQmedium

A company has two VPC networks (VPC-A and VPC-B) in the same project. They are connected via VPC peering. VPC-A contains an internal TCP load balancer with IP 10.1.2.3 serving on port 80. VPC-B needs to access this load balancer. The network engineer has verified that the firewall rules allow traffic from VPC-B to the load balancer's IP and port. However, instances in VPC-B cannot connect to 10.1.2.3:80. What is the most likely reason for this failure?

A.Internal load balancers are regional; clients must be in the same region as the load balancer when using VPC peering.
B.The VPC peering connection does not propagate routes for the load balancer IP.
C.The backend instances are unhealthy and the load balancer is not serving traffic.
D.Firewall rules in VPC-B are not allowing egress to the load balancer IP.
AnswerA

Internal TCP/UDP LBs are regional and only accept connections from VPCs in the same region via peering.

Why this answer

Internal TCP/UDP load balancers are regional and only accept traffic from clients in the same region when using VPC peering. If VPC-B's instances are in a different region than the load balancer, they cannot reach it via peering unless the load balancer has global access enabled (which is only available for external LBs). Option B is incorrect: VPC peering does propagate subnets, but the issue is not routing; it's the regional constraint.

Option C is incorrect: Health checks affect the load balancer's ability to send traffic to backends, not clients' ability to connect to the load balancer IP. Option D is incorrect: Firewall rules were already verified as allowing traffic.

Full explanation →
907
Multi-Selecthard

A company uses Cloud VPN with dynamic routing (BGP). The on-premises network advertises a prefix that overlaps with a subnet in the VPC. Which TWO actions can resolve this conflict? (Choose TWO.)

Select 2 answers
A.Delete the conflicting subnet in the VPC.
B.Modify the on-premises BGP advertisement to use a more specific prefix (longer subnet mask) that does not overlap.
C.Use route propagation with a filter in the VPC route table.
D.Create a static route in the VPC with the same prefix as the overlapping route.
E.Use Cloud Router custom route advertisements to control which routes are learned or advertised.
AnswersB, E

A more specific prefix will be preferred for traffic destined to that subnet, eliminating the conflict.

Why this answer

By advertising a more specific prefix (longer subnet mask) from on-premises, that route will be preferred over the less specific VPC subnet route due to longest prefix match. Option E is correct: Cloud Router custom route advertisements allow you to filter or modify which routes are learned or advertised, which can be used to prevent the overlapping route from being installed. Options A, C, and D are incorrect: deleting the subnet is unnecessary; route propagation filters are not a native feature; and a static route with the same prefix length would not override a dynamic BGP route.

Full explanation →
908
MCQeasy

An organization wants to connect two VPCs in different projects so that they can communicate using private IPs. The connection must not be transitive. Which solution meets these requirements?

A.Cloud Interconnect
B.Shared VPC
C.VPC Network Peering
D.Cloud VPN
AnswerC

Peering provides direct, non-transitive connectivity between two VPCs.

Why this answer

VPC Network Peering directly connects two VPCs and is non-transitive by default.

Full explanation →
909
Multi-Selecteasy

Which TWO configurations provide high availability for Dedicated Interconnect? (Choose two.)

Select 2 answers
A.Two connections to different PoPs.
B.A single circuit with L2 redundancy.
C.Using Cloud NAT for failover.
D.A single connection from one provider.
E.Two connections to the same PoP.
AnswersA, E

Geographic redundancy for higher availability.

Why this answer

Connecting to two different Points of Presence (PoPs) provides geographic redundancy; if one PoP fails, traffic can be rerouted through the other. Option E is correct because two connections to the same PoP provide link-level redundancy; if one circuit fails, the other can continue carrying traffic, and BGP can be used to load-balance or failover between them.

Exam trap

Google Cloud often tests the misconception that a single circuit with L2 redundancy (like LACP) is sufficient for high availability, but for Dedicated Interconnect, true HA requires multiple physical circuits (either to the same PoP or different PoPs) with BGP-based failover.

Full explanation →
910
Multi-Selecthard

Which THREE statements about VPC Flow Logs are correct?

Select 3 answers
A.Flow logs support sampling with a configurable interval.
B.Flow logs can be sent to BigQuery for analysis.
C.Flow logs record traffic to and from external IP addresses only.
D.Flow logs are enabled by default for all subnets.
E.VPC Flow Logs are enabled at the subnet level.
AnswersA, B, E

Sampling interval can be set to 5 seconds (default) or 1 minute.

Why this answer

Flow logs are subnet-level, can be sent to BigQuery, and support configurable sampling.

Full explanation →
911
MCQhard

A company is designing an HA VPN to connect their on-premises data center to Google Cloud VPC. The on-premises router supports two independent interfaces with public IPs. They want to achieve 99.99% availability for the VPN connection, understanding that HA VPN uses two tunnels and two Cloud Router instances. Which configuration meets this goal?

A.Two tunnels: both tunnels from the same on-premises interface to two different Cloud Router instances
B.Two tunnels: each tunnel from a separate on-premises interface to the same Cloud Router instance
C.Four tunnels: two tunnels from each on-premises interface to the same Cloud Router instance
D.Four tunnels: one tunnel from each on-premises interface to each Cloud Router instance, totaling four BGP sessions
AnswerD

This provides full device and path redundancy suitable for 99.99% availability.

Why this answer

HA VPN requires at least two Cloud Router instances and two tunnels from each on-premises interface to each Cloud Router instance to achieve 99.99% availability. This configuration creates four BGP sessions, ensuring that if one on-premises interface, one Cloud Router, or one tunnel fails, traffic can still flow through the remaining paths. The design leverages both redundancy of interfaces and redundancy of Cloud Routers to meet the high availability SLA.

Exam trap

The trap here is that candidates often think two tunnels (one per interface) to the same Cloud Router is sufficient, but they overlook that the Cloud Router itself is a single point of failure, and HA VPN requires redundancy at both the on-premises and Cloud Router layers to achieve 99.99% availability.

How to eliminate wrong answers

Option A is wrong because using the same on-premises interface for both tunnels creates a single point of failure at the on-premises side; if that interface fails, both tunnels go down, violating the 99.99% availability goal. Option B is wrong because both tunnels terminate on the same Cloud Router instance, which is a single point of failure in the Google Cloud side; if that Cloud Router fails, all BGP sessions are lost. Option C is wrong because four tunnels from two interfaces to the same Cloud Router instance still leaves the Cloud Router as a single point of failure, and the BGP sessions are not fully redundant across Cloud Routers.

Full explanation →
912
MCQhard

An organization has multiple VPCs in different projects that need to resolve DNS names across projects. They want to use Cloud DNS without creating a separate managed zone for each VPC. Which feature should they use?

A.Private managed zones
B.Shared VPC
C.DNS peering
D.DNS forwarding
AnswerC

DNS peering enables cross-project DNS resolution by peering zones.

Why this answer

DNS peering allows DNS resolution between projects without creating separate managed zones. DNS forwarding is for forwarding queries to an external DNS server.

Full explanation →
913
Multi-Selecteasy

A company wants to allow traffic to a specific set of Compute Engine instances only from a single management instance that uses a service account. The management instance has the service account 'sa-mgmt@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations can achieve this? (Choose TWO.)

Select 2 answers
A.Set the source IP range to the internal IP of the management instance
B.Set the source service account filter to 'sa-mgmt@project.iam.gserviceaccount.com'
C.Set the priority to 65535 to ensure it is evaluated last
D.Set the target tags to 'mgmt' and assign that tag to the management instance
E.Set the target of the rule to the service account 'sa-mgmt@project.iam.gserviceaccount.com'
AnswersA, B

This restricts traffic to that specific IP address.

Why this answer

Firewall rules can target instances by service account (using the 'target service accounts' field) and filter source traffic by service account (using the 'source service accounts' field). Both approaches can restrict traffic to only the management instance's service account.

Full explanation →
914
MCQhard

A company has a VPC with a single subnet in us-central1 (10.0.0.0/24). They have a Compute Engine instance running a database that uses an internal IP address 10.0.0.10. They need to ensure that this database instance can be accessed by a legacy on-premises application via a Cloud VPN tunnel. The on-premises network uses 192.168.0.0/16. They have set up a HA VPN gateway with two tunnels and BGP routing. The Cloud Router is configured to advertise the subnet 10.0.0.0/24. On the on-premises side, the router receives the route for 10.0.0.0/24 and has a static route for 10.0.0.0/24 pointing to the VPN tunnel. However, the on-premises application cannot reach the database. The application's server can ping the on-premises gateway, but not the database IP. The database instance's OS firewall allows all traffic from 0.0.0.0/0. What is the most likely cause?

A.The database instance's OS firewall is blocking the traffic despite the setting.
B.The VPC firewall rules are blocking ingress from on-premises; add a rule allowing traffic from 192.168.0.0/16 to the database IP.
C.The Cloud Router is not advertising the specific database IP 10.0.0.10, only the subnet 10.0.0.0/24.
D.The BGP session is not establishing properly; check the shared secret and IP addresses.
AnswerB

By default, VPC firewall denies ingress; an explicit allow rule is needed.

Why this answer

The issue is likely that the VPC firewall rules are blocking ingress traffic from the on-premises network. Even though the database OS firewall is permissive, the VPC firewall must allow ingress from the on-premises IP range (192.168.0.0/16) to the database's IP. Option B is correct: Create a firewall rule allowing ingress from 192.168.0.0/16 to 10.0.0.10 on the required port.

Full explanation →
915
MCQeasy

A network engineer is designing a VPC in Google Cloud with multiple subnets across different regions. The application requires low-latency communication between instances in the same region but not across regions. Which VPC network configuration should be used?

A.Auto mode VPC with global subnets
B.Legacy network
C.Auto mode VPC with regional subnets
D.Custom mode VPC with regional subnets
AnswerD

Custom mode allows you to create subnets only in required regions, reducing complexity and latency.

Why this answer

Custom mode VPC with regional subnets (D) is correct because it allows you to explicitly define subnets in specific regions, ensuring that instances within the same region communicate over low-latency paths without cross-region traffic. This design avoids the automatic creation of subnets in every region (as in auto mode) and prevents the use of deprecated legacy networks, giving you full control over regional placement for latency-sensitive applications.

Exam trap

Google Cloud often tests the misconception that auto mode VPCs can be configured with regional subnets, but in reality, auto mode automatically creates subnets in every region, and only custom mode gives you the granularity to define subnets per region for low-latency designs.

How to eliminate wrong answers

Option A is wrong because auto mode VPC with global subnets automatically creates subnets in every GCP region, which would introduce unnecessary cross-region subnets and potential latency if instances are inadvertently placed in different regions. Option B is wrong because legacy networks are deprecated and do not support regional subnets or modern VPC features like custom subnetting, making them unsuitable for a multi-region design with low-latency requirements. Option C is wrong because auto mode VPC with regional subnets is a misnomer—auto mode VPCs always create subnets globally (one per region) and cannot be restricted to only regional subnets; the correct approach for regional control is custom mode.

Full explanation →
916
MCQeasy

Which GCP service provides a dedicated, low-latency connection from an on-premises data center to Google Cloud?

A.Cloud Router
B.Cloud Interconnect
C.Cloud VPN
D.VPC Network
AnswerB

Provides dedicated bandwidth and lower latency.

Why this answer

Cloud Interconnect provides a dedicated, low-latency connection from an on-premises data center to Google Cloud, bypassing the public internet. It offers two options: Dedicated Interconnect (a direct physical connection via a colocation facility) and Partner Interconnect (via a supported service provider). This ensures consistent bandwidth and lower latency compared to VPN-based solutions.

Exam trap

The trap here is that candidates often confuse Cloud Router (which handles routing) with the actual connection service, or assume Cloud VPN provides dedicated bandwidth, when in fact only Cloud Interconnect offers a dedicated, low-latency link that bypasses the public internet.

How to eliminate wrong answers

Option A is wrong because Cloud Router is a managed BGP-based router that dynamically exchanges routes between a Cloud VPN or Cloud Interconnect and a VPC network, but it does not provide the physical or dedicated connection itself. Option C is wrong because Cloud VPN uses the public internet with IPsec tunnels, which introduces variable latency and bandwidth, and does not offer a dedicated, low-latency connection. Option D is wrong because VPC Network is a virtual private cloud networking construct that defines the network topology within GCP, not a service for connecting on-premises data centers to Google Cloud.

Full explanation →
917
Multi-Selectmedium

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Select 1 answer
A.Set up VPC peering between the VPCs in each region.
B.Set up Cloud VPN or Dedicated Interconnect between the two VPCs.
C.Create firewall rules allowing all traffic from the other region's subnet CIDR.
D.Configure instances to use external IP addresses for cross-region communication.
E.Use a shared VPC to connect both regions.
AnswersC

Correct. Firewall rules are required to allow traffic between instances. By default, firewall rules may restrict traffic, so rules allowing the desired communication must be created.

Why this answer

In Google Cloud, a VPC is a global resource. Subnets are regional, but they all belong to the same VPC. Instances in different regions within the same VPC can communicate using internal IP addresses automatically over Google's global network, without needing VPC peering, VPN, or Dedicated Interconnect.

The only requirement is that firewall rules permit the traffic. Therefore, the necessary action is to create firewall rules (Option C). Options A and B are for connecting separate VPCs, which is not the scenario here.

Options D and E are incorrect because using external IPs would traverse the internet, and Shared VPC is for sharing subnets across projects, not for connecting regions.

Exam trap

Candidates may assume that cross-region communication requires additional connectivity like VPC peering or VPN, but Google Cloud's global VPC allows instances in different regions to communicate privately by default using internal IPs. The real trap is forgetting that firewall rules must allow the traffic, not that a Layer 3 connection is needed.

Full explanation →
918
Matchingmedium

Match each Cloud DNS record type to its use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Maps a hostname to an IPv4 address

Maps a hostname to an IPv6 address

Alias of one hostname to another

Specifies mail servers for a domain

Holds arbitrary text, often for verification

Why these pairings

Common DNS record types in Cloud DNS include A, AAAA, CNAME, and MX for IP mapping, aliasing, and email routing. Distractors swap definitions between record types.

Full explanation →
919
MCQeasy

A network engineer is configuring Cloud Router for Dedicated Interconnect. The on-premises router is advertising a route to 10.1.0.0/16. The engineer wants to ensure that Google Cloud always prefers this route over other routes learned from different on-premises routers. Which BGP attribute should be set on the on-premises router?

A.NEXT_HOP
B.AS_PATH
C.LOCAL_PREF
D.MED
AnswerD

Lower MED makes the route more preferred for inbound traffic from on-premises.

Why this answer

MED (Multi-Exit Discriminator) is the correct BGP attribute to influence inbound traffic from Google Cloud to prefer a specific on-premises router when multiple paths exist. By setting a lower MED value on the on-premises router, the Cloud Router will select that route over others with higher MED values, ensuring Google Cloud always prefers this path for traffic destined to 10.1.0.0/16.

Exam trap

The trap here is that candidates often confuse LOCAL_PREF (used for outbound path selection within an AS) with MED (used for inbound path selection between ASes), leading them to incorrectly choose LOCAL_PREF when the question asks about influencing Google Cloud's route preference from on-premises routers.

How to eliminate wrong answers

Option A is wrong because NEXT_HOP is a mandatory BGP attribute that specifies the IP address of the next-hop router, not a metric for path selection; it cannot influence route preference. Option B is wrong because AS_PATH is used for loop prevention and path selection (shorter AS_PATH is preferred), but it is not the attribute to force preference for a specific on-premises router; modifying AS_PATH artificially is not the intended mechanism. Option C is wrong because LOCAL_PREF is a well-known discretionary attribute used to influence outbound traffic from an AS, not inbound traffic; it is set within the local AS and not exchanged between peers, so it cannot be set on the on-premises router to affect Google Cloud's path selection.

Full explanation →
920
MCQeasy

Which Google Cloud hybrid connectivity option can be configured without using BGP?

A.Partner Interconnect
B.Dedicated Interconnect
C.HA VPN
D.Classic VPN with static routes
AnswerD

Classic VPN supports static routes, eliminating the need for BGP.

Why this answer

Classic VPN can be configured with static routes and does not require BGP. Partner Interconnect and Dedicated Interconnect require BGP for routing. HA VPN also typically uses BGP for dynamic routing, making D the only option that can operate without BGP.

Full explanation →
921
MCQhard

A network engineer is using Connectivity Tests to diagnose a reachability issue between two instances in the same VPC but different subnets. The test indicates that traffic is denied by firewall rules. However, the engineer cannot find any firewall rule denying the traffic. What is a possible explanation?

A.The subnet is in a different region
B.VPC Flow Logs are not enabled
C.The instances have external IPs
D.The firewall rule is in a different project that is not being checked
AnswerD

Correct: In shared VPC, firewall rules may be in the host project, and if not checked, they can cause denial.

Why this answer

If there is an implied deny rule that is not explicitly listed, Connectivity Tests may still show it as the reason. Also, firewall rules are stateful; if return traffic is not matched, it could be denied. But a common oversight is that the firewall rule is in a different project (if using shared VPC) or the rule is disabled.

Full explanation →
922
MCQmedium

An enterprise is using a 10 Gbps Dedicated Interconnect between their on-premises data center and Google Cloud. They measure throughput and find it is only 5 Gbps even though there is no congestion. The on-premises router is configured with a single VLAN attachment. What is the most likely cause?

A.BGP is not configured, causing routing loop
B.The on-premises router does not support full line rate
C.MTU mismatch between on-premises and Google Cloud
D.QoS policy is limiting throughput on Google Cloud side
AnswerB

The on-premises router may be the bottleneck.

Why this answer

A single VLAN attachment on a 10 Gbps Dedicated Interconnect means the on-premises router must handle all traffic through one physical interface. If the router lacks the forwarding capacity to process packets at 10 Gbps line rate, throughput will be capped at its maximum switching or routing performance, which in this case is 5 Gbps. This is a common hardware limitation, not a configuration or congestion issue.

Exam trap

Google Cloud often tests the misconception that throughput issues are always caused by configuration errors (e.g., MTU, BGP, QoS) rather than hardware limitations, leading candidates to overlook the router's actual forwarding capacity.

How to eliminate wrong answers

Option A is wrong because BGP is required for Dedicated Interconnect to exchange routes; without BGP, the interconnect would not establish connectivity at all, not just limit throughput to 5 Gbps. Option C is wrong because an MTU mismatch would cause packet fragmentation or drops, not a consistent 50% throughput reduction, and would typically manifest as packet loss or connectivity issues rather than a steady 5 Gbps cap. Option D is wrong because Google Cloud does not apply QoS policies that throttle throughput on Dedicated Interconnect attachments; throughput is limited by the on-premises router's capacity or the interconnect's bandwidth, not by cloud-side QoS.

Full explanation →
923
MCQeasy

An engineer needs to provide outbound internet access to a set of Compute Engine instances that have only internal IP addresses. The instances must use a static IP address for outbound traffic. Which solution should they implement?

A.Create a Cloud NAT gateway with static IP address and configure it on the VPC network.
B.Assign a static external IP to each instance and configure a firewall rule to allow egress.
C.Configure Private Google Access on the subnet to route traffic to Google APIs.
D.Deploy a Compute Engine instance as a NAT instance with IP forwarding enabled.
AnswerA

Cloud NAT provides outbound internet access for instances without external IPs using a static IP.

Why this answer

Cloud NAT with manual port allocation allows a static IP to be assigned to the NAT gateway, providing outbound internet access to instances without external IPs.

Full explanation →
924
Multi-Selecthard

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Select 3 answers
A.Cloud NAT gateway
B.Private Google Access
C.Service perimeter
D.VPC accessible services configuration
E.Access level
AnswersC, D, E

Defines the protected resources.

Why this answer

VPC Service Controls perimeters require: 1) A service perimeter that includes the project and services, 2) Access levels that define allowed client attributes (e.g., IP addresses, device policy), and 3) VPC accessible services configuration to restrict access to only requests originating from specified VPC networks. Ingress rules are optional for allowing access from outside the perimeter.

Full explanation →
925
MCQhard

A network engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but different subnets (us-east1 and europe-west1). The engineer suspects an MTU issue. What is the default MTU for traffic within Google Cloud, and what MTU should the engineer expect when packets traverse the internet?

A.1400 bytes internally, 1500 bytes internet
B.1460 bytes internally, 1500 bytes internet
C.1500 bytes both internally and internet
D.1500 bytes internally, 1460 bytes internet
AnswerB

Correct: GCP internal MTU is 1460, internet standard is 1500.

Why this answer

Google Cloud uses an MTU of 1460 bytes (64 bytes less than the standard 1500) to accommodate encapsulation headers. Internet traffic typically uses 1500 bytes. Fragmentation can occur if a packet larger than 1460 bytes is sent over a path that expects 1500 but the internal path is 1460.

Full explanation →
926
MCQeasy

A developer needs to create a subnet for GKE pods that will be used by a cluster. They need to specify a secondary IP range for pods. What is the purpose of the 'purpose' field when creating a subnet?

A.It enables private Google access
B.It indicates the subnet is used for GKE pods or services
C.It defines whether the subnet is auto or custom
D.It sets the region for the subnet
AnswerB

When creating a subnet for GKE, the purpose can be set to e.g., 'PRIVATE_RFC_1918' or a secondary range purpose.

Why this answer

The purpose field determines the subnet's usage; for GKE pods, you set purpose to 'PRIVATE_RFC_1918' or use a secondary range with specific purpose.

Full explanation →
927
Multi-Selectmedium

A company needs to cache API responses that are dynamic but cacheable for short periods. They want to use Cloud CDN with a Global HTTPS Load Balancer. Which three settings should they configure?

Select 3 answers
A.Disable Cloud CDN for the backend service
B.Set cache mode to USE_ORIGIN_HEADERS
C.Set a short TTL (e.g., 60 seconds)
D.Configure cache keys to include query parameters
E.Set cache mode to FORCE_CACHE_ALL
AnswersC, D, E

Correct: TTL controls how long content is cached.

Why this answer

To cache dynamic but cacheable API responses with Cloud CDN and a Global HTTPS Load Balancer, three settings are required: Set a short TTL (e.g., 60 seconds) to control how long responses are cached. Set cache mode to FORCE_CACHE_ALL to override origin cache headers and allow caching of all responses. Configure cache keys to include query parameters to distinguish different API calls.

These three settings ensure dynamic content is cached appropriately.

Full explanation →
928
MCQmedium

A team is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They need to set up BGP sessions. Which of the following is a required parameter when creating a BGP peer on the Cloud Router?

A.Peer ASN
B.Route priority (MED)
C.VLAN ID
D.Peer IP address
AnswerA

The BGP peer must have a peer ASN configured.

Why this answer

The peer ASN is required to configure the BGP session; the Cloud Router ASN is set at the router level.

Full explanation →
929
MCQmedium

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

A.Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).
B.Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.
C.Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.
D.Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.
AnswerA

This ensures that only traffic from the load balancer's health check probes and the load balancer itself (via service account) reaches the backend instances.

Why this answer

It uses a service account filter to allow traffic from the cloud-services service account, which is the identity used by Cloud Load Balancing to forward traffic to backend instances. This ensures that only traffic originating from the load balancer (including health check probes) is permitted, while also automatically covering the health check ranges (35.191.0.0/16, 130.211.0.0/22) without needing to hardcode IP ranges. This approach is more secure and scalable than IP-based rules, as it avoids the risk of IP range changes and provides identity-based access control.

Exam trap

Google Cloud often tests the misconception that you can simply allow the load balancer's frontend IP address, but the trap here is that the frontend IP is a virtual IP that never appears as the source IP in packets reaching the backend—instead, the source IP is the load balancer's internal IP or health check ranges, so candidates must understand the difference between frontend and backend traffic flows.

How to eliminate wrong answers

Option B is wrong because allowing all traffic from 0.0.0.0/0 would permit any source on the internet to reach the backend instances, completely bypassing the load balancer and violating the requirement to restrict access only to the load balancer's health check ranges and source IPs. Option C is wrong because denying all traffic except from the load balancer's frontend IP address is ineffective; the frontend IP is a virtual IP (VIP) that does not appear as the source IP in packets arriving at the backend instances—the actual source IPs are the load balancer's internal IPs (e.g., 130.211.0.0/22) and health check ranges, so this rule would block legitimate traffic. Option D is wrong because it relies on static IP ranges (35.191.0.0/16, 130.211.0.0/22) which can change over time as Google updates its infrastructure, leading to potential access failures; additionally, it does not cover all possible load balancer source IPs in all scenarios (e.g., when using internal load balancers or cross-region load balancing).

Full explanation →
930
Multi-Selecteasy

A network engineer is designing a hybrid cloud architecture connecting an on-premises data center to Google Cloud via Dedicated Interconnect. The on-premises network uses BGP for dynamic routing. The engineer needs to configure Cloud Router to exchange routes with the on-premises router. Which two configuration steps are required? (Choose two.)

Select 2 answers
A.Enable the BGP session on the Cloud Router and configure the peer IP address and ASN.
B.Create a VLAN attachment for the Interconnect connection.
C.Configure a static route in Google Cloud VPC with the on-premises prefix.
D.Assign a primary and secondary IP range to the Cloud Router interface.
E.Configure the Cloud Router with the same ASN as the on-premises router.
AnswersA, B

A BGP session is needed to exchange routes with the on-premises router.

Why this answer

Cloud Router uses BGP to dynamically exchange routes with the on-premises router over Dedicated Interconnect. Enabling the BGP session requires configuring the peer IP address (the on-premises router's interface IP) and the on-premises ASN, which allows the two routers to establish a BGP peering and exchange prefixes.

Exam trap

Google Cloud often tests the misconception that Cloud Router must use the same ASN as the on-premises router, but eBGP requires different ASNs, and Cloud Router does not support iBGP for Dedicated Interconnect.

Full explanation →
931
MCQeasy

A developer wants to use Cloud CDN to cache static assets from an external origin (not a GCP bucket). Which backend type supports this?

A.Backend bucket
B.Serverless NEG
C.Zonal NEG
D.Internet NEG
AnswerD

Internet NEG is designed to reference an external endpoint via FQDN, enabling CDN caching.

Why this answer

Internet NEG allows specifying an external FQDN as a backend, enabling Cloud CDN to cache content from external origins. Backend buckets are for GCS. Serverless NEG is for Cloud Run/Functions/App Engine.

Zonal NEG is for GCP VMs/containers.

Full explanation →
932
MCQmedium

A company has two VPC networks in the same project: Network A (hosting a private zone for 'example.internal.') and Network B. They are connected via VPC peering. The network engineer created a DNS peering zone in Network B for 'example.internal.' pointing to Network A. However, instances in Network B cannot resolve 'host.example.internal.' which is defined in Network A's private zone. The engineer verified that the peering zone is active and the networks are properly peered. What is the most likely reason for the resolution failure?

A.An inbound server policy must be created in Network A.
B.The peering zone should be a forwarding zone instead.
C.An outbound server policy must be created in Network B.
D.The private zone in Network A is not configured to allow resolution from peered networks.
AnswerD

Private zones must explicitly list which VPC networks can query them via peering.

Why this answer

Cloud DNS private zones do not automatically allow resolution from peered VPC networks unless explicitly configured. Even though VPC peering and DNS peering are active, the private zone in Network A must have its 'Allow resolution from peered networks' setting enabled. Without this, queries from Network B via the DNS peering zone are rejected, causing resolution failures for records like 'host.example.internal.'.

Exam trap

Google Cloud often tests the distinction between VPC peering connectivity and DNS resolution permissions, trapping candidates who assume that active VPC peering and a DNS peering zone are sufficient without checking the private zone's peering settings.

How to eliminate wrong answers

Option A is wrong because an inbound server policy is used to allow DNS queries from on-premises or external networks into a VPC, not for VPC peering scenarios. Option B is wrong because a forwarding zone is used to send queries to a specific target (e.g., on-premises DNS), whereas a peering zone is the correct type for recursively resolving from another VPC's private zone. Option C is wrong because an outbound server policy controls DNS queries leaving a VPC to on-premises or external targets, not for resolving via a peering zone within the same project.

Full explanation →
933
MCQeasy

An organization needs to distribute incoming traffic across multiple GCE instances in the same region while preserving the client IP address. Which load balancer should they use?

A.Global TCP Proxy Load Balancer
B.Global HTTPS Load Balancer
C.Regional External TCP/UDP Network Load Balancer
D.Regional Internal TCP/UDP Load Balancer
AnswerC

Correct: pass-through LB preserves client IP and works regionally.

Why this answer

Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves the client IP.

Full explanation →
934
MCQeasy

A company wants to ensure that only traffic from specific source IP ranges can reach a Cloud Load Balancer. How should they enforce this?

A.Use IAP.
B.Configure Cloud Armor with IP allowlist.
C.Set up Cloud NAT.
D.Use VPC firewall rules on the load balancer's backend.
AnswerB

Cloud Armor can filter traffic to the load balancer based on source IP.

Why this answer

Cloud Armor is a web application firewall (WAF) that can be attached to a Cloud Load Balancer to filter incoming traffic based on IP addresses, including allowlisting specific source IP ranges. This directly meets the requirement to restrict access to the load balancer by source IP without affecting backend instance configurations.

Exam trap

The trap here is that candidates confuse VPC firewall rules (which apply to VM instances) with Cloud Armor (which applies to the load balancer frontend), leading them to incorrectly select Option D.

How to eliminate wrong answers

Option A is wrong because IAP (Identity-Aware Proxy) controls access based on user identity and context, not source IP ranges, and it operates at the application layer, not the network layer. Option C is wrong because Cloud NAT provides outbound internet access for private instances, not inbound traffic filtering or allowlisting. Option D is wrong because VPC firewall rules apply to the load balancer's backend instances, not to the load balancer itself, and they cannot filter traffic arriving at the load balancer's frontend IP.

Full explanation →
935
Multi-Selectmedium

A company uses Traffic Director with Envoy sidecars to manage traffic in their service mesh. They want to perform canary deployments where 10% of traffic goes to the new version and 90% to the stable version. Which TWO Traffic Director resources should they configure? (Choose two.)

Select 2 answers
A.A TrafficDirectorService with a traffic splitting policy (weighted clusters)
B.A BackendService defining the backend (version) for each traffic pool
C.A gRPC filter in the Envoy configuration
D.An HTTPRoute resource
E.An Envoy Route Configuration with weighted clusters
AnswersA, B

Defines the weighted distribution of traffic between versions.

Why this answer

Traffic splitting is achieved through TrafficDirectorService with a weighted traffic policy. BackendService defines the service backends. Envoy Route Configuration is used for routing, but Traffic Director configures it automatically.

HTTPRoute and gRPC filters are not used for traffic splitting.

Full explanation →
936
MCQeasy

A company wants to run a DNS resolution service for their hybrid cloud environment. They need on-premises servers to resolve GCP private VM hostnames, and GCP VMs to resolve on-premises hostnames. Which Google Cloud service should they use?

A.Cloud DNS public zone
B.Cloud DNS private zone with DNS peering
C.Cloud NAT
D.Cloud DNS with inbound and outbound DNS forwarding
AnswerD

Inbound forwarding allows on-prem to query GCP private zones; outbound forwarding allows GCP to query on-prem DNS.

Why this answer

Cloud DNS with inbound and outbound DNS forwarding enables bidirectional DNS resolution between on-premises and GCP.

Full explanation →
937
MCQmedium

A company uses Cloud NAT to allow private instances to reach the internet. They notice that egress traffic from Compute Engine VMs is intermittently failing. The VMs are in us-central1-a and use the default VPC network. Cloud NAT is configured with a single NAT IP address. What is the most likely cause?

A.Missing default route to Internet gateway
B.Port exhaustion due to insufficient NAT IP addresses
C.Cloud NAT not configured in the correct region
D.Firewall rule blocking egress traffic from VM
AnswerB

A single NAT IP provides limited ports; many VMs can exhaust them.

Why this answer

Cloud NAT uses source network address translation (SNAT) to map private VM IPs to a public NAT IP. With only a single NAT IP address, the available port range (typically 64,512 ephemeral ports per NAT IP per VM) can be exhausted under high egress traffic, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures and the single IP configuration.

Exam trap

Google Cloud often tests the misconception that Cloud NAT automatically scales with traffic or that a single NAT IP is sufficient for any workload, when in reality port exhaustion is a common scaling bottleneck.

How to eliminate wrong answers

Option A is wrong because the default VPC network already includes a default route (0.0.0.0/0) pointing to the internet gateway, so a missing default route is not the issue. Option C is wrong because Cloud NAT is regionally scoped, and the VMs are in us-central1-a, which is within the us-central1 region; if the NAT were misconfigured for a different region, no traffic would work at all, not just intermittently. Option D is wrong because firewall rules in VPC are stateful and allow return traffic; an egress firewall rule blocking traffic would cause consistent failure, not intermittent, and the default VPC allows all egress by default.

Full explanation →
938
MCQeasy

A startup is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose a service to the internet using a load balancer that provides SSL termination and supports WebSocket. Which type of Service should they use?

A.Create a Service of type ClusterIP and use an Ingress resource with a backendConfig.
B.Create a Service of type LoadBalancer with an HTTP(S) load balancer.
C.Create a Service of type NodePort and configure an external TCP/UDP load balancer.
D.Create a Headless Service with an external DNS A record pointing to the pod IPs.
AnswerB

GKE integrates with Cloud Load Balancing; HTTP(S) LB supports SSL and WebSocket.

Why this answer

A Service of type LoadBalancer with an HTTP(S) load balancer is correct because it provides a public IP address, handles SSL termination at the load balancer level, and natively supports WebSocket connections without additional configuration. This is the simplest and most direct way to expose a microservice to the internet with these requirements on GKE.

Exam trap

Google Cloud often tests the misconception that an Ingress resource is always required for SSL termination and WebSocket support, but in GKE, a LoadBalancer Service with an HTTP(S) load balancer directly provides these features without the complexity of Ingress.

How to eliminate wrong answers

Option A is wrong because a ClusterIP Service is only reachable within the cluster, and while an Ingress with a backendConfig can provide SSL termination, it does not inherently support WebSocket without additional annotations and configuration, making it less straightforward. Option C is wrong because a NodePort Service exposes a static port on each node, but an external TCP/UDP load balancer does not provide SSL termination (which requires an HTTP/HTTPS layer) and is not the recommended approach for HTTP-based WebSocket traffic. Option D is wrong because a Headless Service is used for stateful workloads and DNS-based service discovery, not for exposing a service to the internet with SSL termination and load balancing.

Full explanation →
939
MCQeasy

Which Google Cloud service provides a managed Envoy proxy control plane for traffic management, including traffic splitting and fault injection, in a service mesh?

A.Traffic Director
B.Cloud Endpoints
C.Cloud Load Balancing
D.Anthos Service Mesh
AnswerA

Traffic Director is the managed control plane for Envoy proxies.

Why this answer

Traffic Director is the managed control plane for Envoy-based service mesh, providing traffic management features.

Full explanation →
940
MCQhard

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

A.It depends on the redundancy requirements; typically two per attachment for active-active.
B.Four: two per VLAN attachment.
C.Two: one per VLAN attachment.
D.One: one session per Cloud Router.
AnswerA

For HA, each VLAN attachment should have two BGP sessions from two different on-premises routers, totaling four sessions.

Why this answer

With a Dedicated Interconnect using two VLAN attachments in different edge availability domains (EADs), the recommended best practice for high availability is to establish two BGP sessions per VLAN attachment (one active and one redundant) on the same Cloud Router, resulting in four sessions total. However, the question asks 'how many BGP sessions should be established' and the correct answer acknowledges that it depends on the redundancy requirements; typically two per attachment for active-active, but if active-passive is acceptable, fewer sessions may suffice. This flexibility makes 'It depends' the most accurate choice.

Exam trap

The trap here is that candidates assume a fixed number of BGP sessions (e.g., two or four) without considering that the redundancy model (active-active vs. active-passive) dictates the session count, leading them to pick a definitive number rather than the flexible 'it depends' answer.

How to eliminate wrong answers

Option B is wrong because stating 'Four: two per VLAN attachment' is too rigid; while four sessions are common for active-active redundancy, the requirement may vary based on design choices (e.g., active-passive could use two sessions total). Option C is wrong because 'Two: one per VLAN attachment' assumes a single BGP session per attachment, which provides no redundancy and violates best practices for high availability across EADs. Option D is wrong because 'One: one session per Cloud Router' ignores the need for per-attachment BGP sessions and fails to account for the separate VLAN attachments in different EADs, which require distinct sessions to maintain path diversity.

Full explanation →
941
Multi-Selectmedium

You need to create a DNS routing policy that routes users in Europe to one IP and users in Asia to a different IP, with a fallback to a default IP if no match. Which THREE elements are required? (Choose 3)

Select 3 answers
A.A geo location (e.g., europe-west1)
B.A health check
C.A response policy
D.A default target (rrdata) for users not matching any geo
E.An IP address (rrdata) for each geo location
AnswersA, D, E

Geo location defines the region for routing.

Why this answer

A geo routing policy requires a geo location, an IP address (rrdata) for each geo, and a default target for unmatched locations.

Full explanation →
942
MCQeasy

A company is creating a new VPC to host a set of microservices on Compute Engine. The network architect wants to minimize operational overhead and allow automatic subnet creation as new regions are added. Which VPC mode should be used?

A.Shared VPC
B.VPC Network Peering
C.Auto mode VPC
D.Custom mode VPC
AnswerC

Auto mode creates subnets automatically in each region as Google Cloud adds them, minimizing overhead.

Why this answer

Auto mode VPCs automatically create subnets in each region as they become available, reducing operational overhead. Custom mode requires manual subnet creation.

Full explanation →
943
MCQmedium

A company has Compute Engine instances without external IPs in a VPC. They need to reach Google APIs such as Cloud Storage and BigQuery. Which configuration will meet this requirement with minimal cost and operational overhead?

A.Configure the subnet to have Private Google Access enabled. Ensure the instances have the appropriate DNS resolution for private.googleapis.com.
B.Set up a Squid proxy on a bastion host with an external IP and route all API traffic through it.
C.Create a Cloud NAT gateway in the same region and attach it to the VPC.
D.Assign external IPs to the instances and create firewall rules to allow traffic to Google APIs.
AnswerA

This enables instances to reach Google APIs via internal IPs without needing external IPs or NAT.

Why this answer

Private Google Access enables instances without external IPs to reach Google APIs using internal IPs via the default internet gateway or VPC peering. Configuring a Private Google Access enabled subnet is the simplest and cheapest option, as it does not require NAT or additional instances.

Full explanation →
944
MCQeasy

A company needs to resolve DNS queries from their Google Cloud VPC for on-premises hostnames (e.g., internal.mycompany.com). They have a Cloud VPN tunnel between GCP and on-premises. Which approach should they use?

A.Configure an outbound DNS forwarding policy with Cloud Router to forward queries to on-premises DNS servers.
B.Create a DNS forwarding zone in Cloud DNS that points to the on-premises DNS server IPs via the Cloud Router.
C.Create a Cloud DNS private zone and add A records for each on-premises host.
D.Set up a BIND server on a Compute Engine instance and configure it as a forwarder.
AnswerB

This is the correct method: forwarding zone sends queries for the specified domain to on-premises DNS servers.

Why this answer

Cloud DNS forwarding zones allow you to forward queries for a specific domain (e.g., internal.mycompany.com) to on-premises DNS servers via the VPN tunnel.

Full explanation →
945
MCQhard

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

A.Use the gcloud compute backend-services update command with the --fault-injection flag.
B.Set a circuit breaker with a max pending requests threshold.
C.Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.
D.Create a backend service with connection draining and set the drain timeout.
AnswerC

Fault injection is configured in the route rule (via Envoy's fault filter) in Traffic Director.

Why this answer

Traffic Director uses Envoy's fault injection filter, configured via the Envoy xDS API or through GKE configuration. The correct approach is to apply a traffic policy with fault injection percentage. The other options are not valid Traffic Director features or do not achieve fault injection.

Full explanation →
946
MCQeasy

A company wants to enforce that all HTTPS load balancer traffic uses TLS 1.2 or higher. Which Google Cloud resource should they configure?

A.SSL certificate resource
B.SSL policy attached to the target HTTPS proxy
C.VPC firewall rule to block TLS 1.0/1.1
D.Identity-Aware Proxy (IAP)
AnswerB

SSL policy specifies minimum TLS version and ciphers.

Why this answer

An SSL policy in Google Cloud can be attached to a target HTTPS proxy to enforce minimum TLS version requirements, such as TLS 1.2 or higher. This policy directly controls the TLS handshake parameters at the load balancer level, ensuring that only clients supporting TLS 1.2 or above can establish HTTPS connections.

Exam trap

The trap here is that candidates often confuse SSL certificates (which only provide cryptographic material) with SSL policies (which enforce protocol and cipher restrictions), leading them to select the SSL certificate resource as the answer.

How to eliminate wrong answers

Option A is wrong because an SSL certificate resource only stores the certificate and private key for TLS termination; it does not enforce TLS protocol version restrictions. Option C is wrong because VPC firewall rules operate at the network layer (IP/port) and cannot inspect or enforce TLS protocol versions, which are part of the application layer handshake. Option D is wrong because Identity-Aware Proxy (IAP) provides access control based on identity and context, not TLS version enforcement; it does not replace the need for an SSL policy on the load balancer.

Full explanation →
947
Multi-Selectmedium

A company uses Shared VPC. They want to restrict which service project's VMs can use a specific subnet. Which TWO methods can achieve this? (Choose TWO.)

Select 2 answers
A.Use VPC network peering.
B.Use IAM roles on the subnet resource to grant 'compute.subnetUser' to specific service projects.
C.Use firewall rules to deny traffic from other service projects.
D.Use network tags on VMs and associate the subnet with those tags.
E.Use organizational policy constraints like 'compute.restrictVpcSubnetworks'.
AnswersB, E

This IAM role controls which projects can use the subnet.

Why this answer

IAM roles on a subnet resource allow you to grant the `compute.subnetUser` role to specific service projects, which controls which projects can create VM instances in that subnet. This is a direct method to restrict subnet usage within a Shared VPC environment, as the role grants permission to use the subnet without granting broader network access.

Exam trap

Google Cloud often tests the misconception that firewall rules or network tags can control subnet access, when in fact they only control traffic flow or VM-level attributes, not the authorization to use a subnet resource.

Full explanation →
948
MCQeasy

A company has an external HTTP(S) load balancer with a backend service pointing to an instance group in us-east1. They enable Cloud CDN to improve performance for global users. After enabling, they observe that users in Asia still experience high latency. They verify that the backend instances respond with Cache-Control headers that allow caching. What is the most likely reason for the high latency?

A.The cache TTL is too short.
B.Cloud CDN is not enabled on the correct backend.
C.The load balancer is a regional load balancer, not a global one.
D.The backend instances are in us-east1, too far from Asia.
AnswerC

Regional load balancers do not have global anycast IP, so users far away experience high latency.

Why this answer

An external HTTP(S) load balancer that is regional (e.g., a regional external HTTP(S) load balancer) cannot serve traffic globally with low latency; it is confined to a single region. Cloud CDN caches content at edge locations, but if the load balancer itself is regional, the cache points are also regional, so users in Asia still route to us-east1 for cache misses or even for cache hits if the edge is not globally distributed. Only a global external HTTP(S) load balancer (with a global anycast IP) can leverage Cloud CDN's global edge cache locations to serve users from the nearest point of presence.

Exam trap

The trap here is that candidates assume Cloud CDN automatically provides global low latency regardless of the load balancer type, but the exam tests the distinction between regional and global external HTTP(S) load balancers and their impact on CDN edge placement.

How to eliminate wrong answers

Option A is wrong because the cache TTL being too short would cause frequent cache misses but not inherently high latency for all users; it would increase origin load but not prevent caching entirely. Option B is wrong because Cloud CDN is enabled on the backend service, which is the correct place; the issue is not about enabling it on the wrong backend but about the load balancer type. Option D is wrong because while backend instances in us-east1 are far from Asia, Cloud CDN is designed to mitigate that distance by caching at edge locations; the high latency persists because the load balancer is regional, so the edge caches are also regional and not globally distributed.

Full explanation →
949
Multi-Selecthard

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Select 3 answers
A.Incorrect VLAN ID on the VLAN attachment
B.Mismatched BGP hold timer values
C.MTU mismatch causing packet fragmentation
D.Incorrect BGP password (MD5 authentication)
E.Duplicate AS number on the on-premises router
AnswersB, C, D

If the hold timers differ, the session may time out and flap.

Why this answer

BGP session flapping can be caused by mismatched parameters, MTU issues, or authentication problems.

Full explanation →
950
MCQeasy

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

A.Cloud NAT logging
B.VPC Flow Logs
C.Packet Mirroring
D.Traffic Director
AnswerB

VPC Flow Logs capture IP traffic metadata, enabling diagnosis of packet drops and latency issues.

Why this answer

VPC Flow Logs capture information about IP traffic going to and from network interfaces. They help diagnose packet drops and latency issues. Cloud NAT logging provides logs about NAT connections, not general traffic.

Packet Mirroring is for capturing and inspecting traffic for analysis, not for logging. Traffic Director is a service mesh control plane, not a traffic logging tool.

Full explanation →
951
Multi-Selectmedium

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Select 2 answers
A.NCC automatically propagates routes between all spokes.
B.NCC supports direct VPC-to-VPC peering without a hub.
C.NCC can only connect to on-premises networks via Dedicated Interconnect.
D.NCC requires all spokes to be in the same region.
E.NCC can connect VPCs from different projects as spokes.
AnswersA, E

NCC manages route propagation automatically in the hub.

Why this answer

NCC supports both VPC spokes and hybrid spokes (VPN/Interconnect). It does not support direct VPC-to-VPC peering; that's VPC peering. Route propagation is automatic within NCC.

Full explanation →
952
Multi-Selectmedium

Which THREE statements about Shared VPC are correct?

Select 3 answers
A.The Shared VPC admin role can be assigned to manage the host VPC network.
B.Service projects can use subnetworks from the host VPC.
C.The host project must be in the same organization as the service projects.
D.Service projects can delete subnets in the host VPC.
E.Service projects can create their own VPCs that peer with the host VPC.
AnswersA, B, C

The compute.xpnAdmin role allows management of Shared VPC.

Why this answer

Shared VPC allows service projects to use host VPC subnets, requires same organization, and can be managed via Shared VPC admin role.

Full explanation →
953
Multi-Selectmedium

You need to monitor the health and performance of a Dedicated Interconnect connection. Which THREE Cloud Monitoring metrics should you use? (Choose three.)

Select 3 answers
A.interconnect/network/received_bytes_count
B.interconnect/link/packets_dropped
C.interconnect/network/sent_packets_count
D.interconnect/link/operational_status
E.interconnect/link/latency
AnswersA, B, D

Monitors inbound traffic volume.

Why this answer

Key metrics include received bytes count (for traffic), operational status (link up/down), and packets dropped (indicates errors or congestion). These are standard interconnect metrics.

Full explanation →
954
MCQmedium

A company has a VPC with subnets in us-east1 and europe-west1. They have deployed a global external HTTP(S) load balancer with backend services in both regions. Users in Europe report high latency. What is the most likely cause?

A.Incorrect health check configuration causing backends to be marked unhealthy
B.Firewall rules blocking traffic from the load balancer's health check probes
C.The load balancer is not enabled for global access
D.Session affinity set to CLIENT_IP, causing sticky sessions to a distant backend
AnswerD

Traffic might be pinned to us-east1 even for European users.

Why this answer

CLIENT_IP session affinity causes the load balancer to hash the client's IP address to a specific backend instance. If a user in Europe is hashed to a backend in us-east1, all their requests will be forwarded to that distant region, resulting in high latency. This occurs even though a healthy backend exists in europe-west1, because the affinity overrides the load balancer's normal least-latency or proximity-based routing.

Exam trap

Google Cloud often tests the misconception that high latency is always caused by health check or firewall issues, when in fact session affinity can override geographic routing and force traffic to a distant backend.

How to eliminate wrong answers

Option A is wrong because incorrect health checks would cause backends to be marked unhealthy, leading to 502 errors or failover to healthy backends, not consistently high latency to a distant region. Option B is wrong because firewall rules blocking health check probes would also cause backends to be marked unhealthy, not sustained high latency; the load balancer would stop sending traffic to those backends. Option C is wrong because global external HTTP(S) load balancers are inherently global by design; there is no 'global access' toggle to enable—they always route traffic to the closest healthy backend based on the client's location and backend capacity.

Full explanation →
955
MCQeasy

A company uses Cloud NAT to enable outbound connectivity for private VMs. They notice that some VMs are not able to reach a specific external IP range. The VMs have no tags or service accounts. What is the most likely cause?

A.Cloud NAT requires each VM to have a unique external IP address.
B.The VMs need a default route pointing to the NAT gateway.
C.A static route must be created for the external IP range via the NAT gateway.
D.The VMs might be in a different subnet than the one where Cloud NAT is configured.
AnswerD

This is correct. Cloud NAT is configured per subnet. If VMs are in a different subnet without Cloud NAT, they cannot use it for outbound connectivity.

Why this answer

The most likely cause is that the VMs are in a subnet that does not have Cloud NAT configured. Cloud NAT is configured on a per-subnet basis, and only VMs in subnets with Cloud NAT enabled can use it for outbound traffic. Option A is incorrect because Cloud NAT does not require each VM to have a unique external IP; it uses a pool of NAT IPs.

Option B is incorrect because VMs already have a default route (0.0.0.0/0) via the default internet gateway, and Cloud NAT works with that route; there is no need for a route pointing to the NAT gateway. Option C is incorrect because no static route is needed for specific external IP ranges; Cloud NAT uses the default route and performs source NAT for all outbound traffic.

Exam trap

A common mistake is to assume that a static route for the external IP range is necessary when Cloud NAT seems to block specific addresses. However, Cloud NAT uses the default route, and the actual issue is often that the VMs are in a subnet without Cloud NAT configured.

Full explanation →
956
MCQeasy

A security engineer wants to allow SSH access to a VM that has no external IP. The VM is in a VPC with IAP configured. What is the simplest way to enable secure SSH without a bastion host?

A.Use Identity-Aware Proxy (IAP) TCP forwarding with the gcloud compute start-iap-tunnel command.
B.Create a VPN tunnel to the VPC and SSH over the VPN.
C.Configure a SOCKS proxy on a bastion host.
D.Assign an external IP to the VM and use a firewall rule to restrict access.
AnswerA

IAP TCP forwarding provides secure access without external IPs.

Why this answer

Identity-Aware Proxy (IAP) TCP forwarding allows secure SSH access to a VM without an external IP by tunneling traffic through the IAP service. The `gcloud compute start-iap-tunnel` command establishes an encrypted tunnel from your local machine to the VM via the IAP proxy, using the VM's internal IP and port 22. This eliminates the need for a bastion host or public IP while leveraging IAP's identity-based access controls.

Exam trap

Google Cloud often tests the misconception that IAP is only for web-based access (HTTP/HTTPS) and not for TCP forwarding, causing candidates to overlook the `gcloud compute start-iap-tunnel` command as a valid solution for SSH without a bastion host.

How to eliminate wrong answers

Option B is wrong because creating a VPN tunnel adds unnecessary complexity and cost, and it does not leverage IAP which is already configured in the VPC; it also requires additional VPN gateway setup. Option C is wrong because configuring a SOCKS proxy on a bastion host contradicts the requirement of 'without a bastion host' and introduces an extra hop and management overhead. Option D is wrong because assigning an external IP directly exposes the VM to the internet, violating the security intent of having no external IP and requiring firewall rules that could be misconfigured.

Full explanation →
957
MCQmedium

Refer to the exhibit. A VM in the default VPC with an internal IP 10.0.1.2 tries to SSH (tcp:22) from a host at 10.0.2.5. What is the result?

A.The traffic is denied because the source IP is not in the same subnet as the VM.
B.The traffic is denied because the deny-ssh rule has a lower priority number and blocks all SSH traffic.
C.The traffic is denied due to the implicit deny rule at the end.
D.The traffic is allowed because it matches the allow-internal rule.
AnswerD

allow-internal allows all traffic from 10.0.0.0/8.

Why this answer

In Google Cloud VPC, firewall rules are stateful and evaluated based on priority (lower priority number = higher priority). The default VPC includes an 'allow-internal' rule (priority 65534) that allows all TCP traffic from any source in the 10.0.0.0/8 range. Since the source IP (10.0.2.5) is within 10.0.0.0/8 and the destination VM (10.0.1.2) is also in that range, the SSH traffic matches this allow rule.

If a deny-ssh rule were present with a lower priority number (e.g., 1000), it would take precedence over the allow-internal rule. However, no such deny rule is specified in the question, so the traffic is allowed because it matches the allow-internal rule.

Exam trap

A common misconception in Google Cloud is that VPC firewall rules are evaluated in order (like ACLs), but they are actually evaluated by priority number (lower number = higher priority). In this question, the allow-internal rule (priority 65534) matches the traffic. If a more specific deny rule existed (e.g., priority 1000), it would take precedence.

Since no such deny rule is present, the traffic is allowed. Another trap is assuming the implicit deny blocks traffic, but implicit deny only applies if no allow rule matches.

How to eliminate wrong answers

Option A is wrong because the source IP (10.0.2.5) is in a different subnet (10.0.2.0/24) than the VM (10.0.1.0/24), but security group rules in a VPC are not subnet-aware; they evaluate based on IP addresses or CIDR blocks, not subnet membership. Option B is wrong because there is no explicit 'deny-ssh' rule with a lower priority number in the default VPC; the exhibit shows only an allow-internal rule, and security group rules are evaluated as a whole (all allow rules are checked first, then implicit deny). Option C is wrong because the implicit deny rule only applies if no explicit allow rule matches; here, the traffic matches the allow-internal rule, so the implicit deny is not triggered.

Full explanation →
958
MCQmedium

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

A.DNS peering
B.Inbound DNS policy
C.Outbound DNS forwarding zone
D.Private zone with DNS forwarding
AnswerB

Inbound DNS policy creates a forwarding IP that on-premises resolvers can use to query Cloud DNS private zones.

Why this answer

Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Full explanation →
959
Multi-Selectmedium

An organization wants to reduce egress costs for data sent from Compute Engine instances to users worldwide. Which TWO approaches should they consider? (Choose TWO.)

Select 2 answers
A.Enable Private Google Access to avoid internet egress for Google APIs.
B.Deploy instances in multiple regions closer to users.
C.Use global load balancers instead of regional load balancers.
D.Use Cloud CDN to cache content at Google's edge locations.
E.Use Premium Tier networking to route traffic over Google's network.
AnswersB, D

Regional deployment reduces cross-region and internet egress costs.

Why this answer

Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network routes traffic over Google's network, which may not reduce egress cost but improves performance; however, Standard Tier egress is cheaper than Premium Tier for internet egress. For reducing costs, Cloud CDN and using Standard Tier (if acceptable) can help.

But among the options, Cloud CDN and placing instances in multiple regions (to serve users locally) reduce egress.

Full explanation →
960
MCQmedium

A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?

A.Modify the existing deny rule to include an exception for the VPN IP in the source IP field.
B.Delete the deny rule and create a single rule that denies all IPs except the VPN IP using the 'except' option.
C.Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.
D.Change the priority of the existing deny rule to 1 and create an allow rule with priority 2 for the VPN IP.
AnswerC

This allow rule has higher priority (lower number) than the deny rule, so traffic from the VPN IP will be allowed before the deny rule applies.

Why this answer

Firewall rules are evaluated in order of priority (lower number = higher priority). The deny rule at priority 1000 will deny all IPs. To allow the VPN IP, a higher priority (lower number) allow rule must be created for that specific IP, before the deny rule is evaluated.

The correct approach is to create an allow rule with priority 100 (or any lower number) for source IP 203.0.0.0/8 (or the specific IP) targeting web-server.

Full explanation →
961
Multi-Selectmedium

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Select 2 answers
A.Verify the BGP session status on the Cloud Router.
B.Check the MTU configuration on the on-premises router.
C.Verify the physical interconnect location and cable connections.
D.Review the VLAN attachment status in the Google Cloud Console.
E.Review the Cloud NAT configuration for the VPC network.
AnswersA, D

Correct. BGP session flapping can cause intermittent connectivity.

Why this answer

BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Exam trap

The trap here is that candidates often confuse physical layer issues (Option C) with logical layer problems, but the question specifies a single VLAN attachment, which points to a logical configuration error rather than a physical interconnect fault.

Full explanation →
Page 12

Page 13 of 13

All pages

12345678910111213

Practice PCNE by domain

Target a specific domain to shore up weak areas.

Configuring Network ServicesManaging, Monitoring, and Optimising Network OperationsImplementing Hybrid InterconnectivityDesigning, Planning, and Prototyping a GCP NetworkImplementing VPC InstancesImplementing network securityImplementing a Virtual Private Cloud
See all domains with question counts →