Courseiva

Google Professional Cloud Network Engineer (PCNE) — Questions 76–150

961 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 13

Page 3
76
MCQhard

A large enterprise has a Google Cloud environment with multiple projects under an organization. They have a Shared VPC host project with a VPC named 'shared-vpc' that has subnets in us-central1 and europe-west1. Several service projects are attached to this host project. One service project, 'proj-analytics', has a Compute Engine instance 'vm-analytics' in us-central1 that needs to connect to a Cloud SQL PostgreSQL instance (private IP) also in us-central1, but within a different service project 'proj-db'. The Cloud SQL instance is configured with a private IP address 10.0.1.5 from a subnet in 'shared-vpc' (the same VPC). The vm-analytics instance has an internal IP 10.0.0.5 from a different subnet in 'shared-vpc'. The two subnets are in the same region, and there is a firewall rule allowing all traffic from 10.0.0.0/16 (the entire VPC range) to the Cloud SQL subnet. However, vm-analytics cannot connect to the Cloud SQL instance. The error on vm-analytics is 'Connection timed out'. There are no firewall rules blocking egress from vm-analytics. What is the most likely cause and solution?

A.Grant the service project's compute engine default service account the Compute Network User role on the host project.
B.Enable Private Google Access on the vm-analytics subnet.
C.Create a firewall rule in the host project allowing ingress from the service project's subnets to the Cloud SQL subnet.
D.Configure a Cloud Router in the service project to advertise routes to the Cloud SQL subnet.
AnswerA

Without this role, the service project's instances cannot use the VPC resources, including the VPC peering routes to Cloud SQL.

Why this answer

The most likely cause is that the service project's Compute Engine default service account lacks the necessary IAM permissions to use the Shared VPC network resources. The Cloud SQL instance with a private IP is accessible via the Shared VPC, but the service project's instances need the Compute Network User role on the host project to allow them to use the VPC network and its subnets. Without this role, the traffic from vm-analytics cannot reach the Cloud SQL private IP, resulting in a timeout.

Option A is correct because granting the Compute Network User role to the service project's default compute service account enables the necessary network access. Option B is incorrect because Private Google Access is for accessing Google APIs without external IPs, not for Cloud SQL private connectivity. Option C is unnecessary because firewall rules already allow traffic from the entire VPC range to the Cloud SQL subnet.

Option D is incorrect because Cloud Router is used for hybrid connectivity and dynamic routing, but the issue is IAM, not routing.

Full explanation →
77
MCQhard

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

A.The Cloud VPN tunnel is down.
B.The MTU is set to 1500 on the VPN tunnel.
C.The instance's firewall is blocking ICMP.
D.The on-premises router is not advertising the return route via BGP, causing asymmetric routing.
AnswerD

Return traffic may take a different path, which GCP drops because it doesn't match the expected ingress interface.

Why this answer

For asymmetric routing, GCP may drop return traffic if it does not match the forwarding route. Cloud VPN supports dynamic routing (BGP) which advertises the on-premises prefix. However, if the on-premises router forwards return traffic through a different path (e.g., internet), GCP's firewall drops it because the return packet does not come via the VPN tunnel (asymmetric).

Full explanation →
78
MCQeasy

A company runs a private GKE cluster in us-central1. Pods need to access the internet for updates. Which configuration is required?

A.Add network tags to allow egress traffic.
B.Create a Cloud Router with BGP peering.
C.Enable Cloud NAT on the cluster's subnet.
D.Assign external IPs to the nodes.
AnswerC

Cloud NAT provides outbound internet access for private instances.

Why this answer

In a private GKE cluster, nodes do not have external IPs, so pods cannot reach the internet directly. Cloud NAT provides outbound connectivity by translating private IPs to a public IP, allowing pods to fetch updates while keeping the cluster private. This is the standard solution for outbound-only internet access from private GKE clusters.

Exam trap

Google Cloud often tests the misconception that private clusters can reach the internet via default routes or firewall rules alone, but the trap here is that without Cloud NAT or a public IP, private instances have no path to the internet because the VPC's default route only covers internal ranges.

How to eliminate wrong answers

Option A is wrong because network tags control firewall rules for ingress/egress traffic within a VPC, but they do not provide internet connectivity; without a public IP or NAT, egress traffic to the internet is still blocked. Option B is wrong because Cloud Router with BGP peering is used for dynamic routing between on-premises and GCP, not for providing internet access to private instances. Option D is wrong because assigning external IPs to nodes would expose them to the internet, defeating the purpose of a private cluster and violating security best practices; Cloud NAT is the correct approach to avoid public IPs on nodes.

Full explanation →
79
MCQmedium

An enterprise requires a hybrid connectivity solution that meets a 99.99% SLA. They plan to use Dedicated Interconnect. Which configuration satisfies the SLA requirement?

A.Two Partner Interconnect connections from different providers in the same metro area
B.Two Dedicated Interconnect connections in the same metro area with active-passive configuration
C.Single Dedicated Interconnect connection with two VLAN attachments
D.Two Dedicated Interconnect connections in different metro areas with active-active configuration
AnswerD

Two connections in different metro areas provide geographic redundancy and meet the 99.99% SLA.

Why this answer

Google's 99.99% SLA for Dedicated Interconnect requires two connections, each from a different metro area, configured for active-active or active-passive.

Full explanation →
80
MCQhard

An organization uses Shared VPC with multiple service projects. They want to allow a service project to create a VM in a subnet that belongs to the host project. The subnet has an IAM policy that grants the compute.instanceAdmin role to the service project's service account. However, the service project is unable to create VMs in that subnet. What is the most likely reason?

A.The subnet IAM policy does not include the service project's service account.
B.The subnet is out of IP addresses.
C.The service project does not have the compute.instanceAdmin role on itself.
D.The service project is missing the compute.networkUser role on the host project.
AnswerD

The compute.networkUser role on the host project is required for using Shared VPC networks. Its absence is the most likely cause.

Why this answer

In Shared VPC, a service project must have the compute.networkUser role on the host project to use its networks. Without this role, subnet-level IAM permissions (like compute.instanceAdmin) are ineffective because the service project cannot even access the network. Therefore, even though the subnet IAM may be correctly configured, the missing networkUser role prevents VM creation.

Option D is correct. Option A is incorrect because the subnet IAM policy is not the issue; the problem is at the host project level. Option B is incorrect because IP exhaustion would give a different error (e.g., IP space full), not a permission error.

Option C is incorrect because the service project's own IAM roles are irrelevant for accessing host project resources.

Full explanation →
81
Multi-Selectmedium

A company uses Cloud NAT for outbound internet access from private instances. They want to monitor for connection failures due to NAT resource exhaustion. Which two steps should they take? (Choose two.)

Select 2 answers
A.Enable Cloud NAT logging
B.Enable VPC Flow Logs on the subnet
C.Use Packet Mirroring to capture NAT traffic
D.Use Firewall Insights to check for blocked traffic
E.Set up log-based metrics and alerts on NAT logs
AnswersA, E

Correct: NAT logs record connection and allocation failures.

Why this answer

Enable Cloud NAT logging to capture connection and allocation failures. Set up alerts on NAT logs to detect failures. VPC Flow Logs do not capture NAT-specific failures.

Firewall Insights are for firewall rules. Packet Mirroring is not relevant.

Full explanation →
82
MCQeasy

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

A.Cloud VPN with multiple tunnels
B.Dedicated Interconnect
C.Partner Interconnect
D.HA VPN
AnswerB

Direct physical connection with high SLA and bandwidth.

Why this answer

Dedicated Interconnect is the correct choice because it provides a direct, private connection between your on-premises network and Google Cloud, supporting bandwidth up to 100 Gbps (via multiple 10 Gbps or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant attachments. This solution requires you to manage your own physical infrastructure in a Google colocation facility, meeting the organization's requirement for self-managed hardware.

Exam trap

Google Cloud often tests the distinction between Dedicated and Partner Interconnect, where candidates mistakenly choose Partner Interconnect because they overlook the requirement for the organization to manage its own physical infrastructure, assuming any 'Interconnect' option meets the SLA and bandwidth needs.

How to eliminate wrong answers

Option A is wrong because Cloud VPN with multiple tunnels is an internet-based, encrypted connection that does not offer an SLA of 99.99% availability (typically 99.9% at best) and cannot support bandwidth up to 100 Gbps due to per-tunnel throughput limits (e.g., 3 Gbps per tunnel for HA VPN). Option C is wrong because Partner Interconnect relies on a third-party service provider to manage the physical connection, which contradicts the requirement that the organization manages its own physical infrastructure in a Google colocation facility. Option D is wrong because HA VPN, while providing high availability, is still an internet-based VPN solution with a maximum throughput of 3 Gbps per tunnel and does not meet the 100 Gbps bandwidth requirement or the 99.99% SLA.

Full explanation →
83
MCQeasy

An engineer configured a Cloud Router with the above settings. The VPC network has subnets 10.1.0.0/16 and 10.2.0.0/16, as well as subnets 10.3.0.0/16 and 10.4.0.0/16. The on-premises router is only receiving routes for 10.1.0.0/16 and 10.2.0.0/16 but not for 10.3.0.0/16 and 10.4.0.0/16. What is the cause?

A.The BGP session is not established
B.The Cloud Router is in global routing mode, which does not advertise all subnets
C.The Cloud Router is set to custom advertisement mode, and the missing subnets are not included in the advertised IP ranges
D.The on-premises router has a filter that blocks the other routes
AnswerC

Custom mode requires explicit specification of ranges to advertise; only listed ranges are advertised.

Why this answer

When a Cloud Router is configured in custom advertisement mode, it only advertises the specific CIDR ranges explicitly listed in the 'Advertised IP ranges' field. Since the missing subnets (10.3.0.0/16 and 10.4.0.0/16) are not included in that list, they are not propagated via BGP to the on-premises router, even though they exist in the VPC.

Exam trap

Google Cloud often tests the distinction between default advertisement mode (which automatically advertises all VPC subnets) and custom advertisement mode (which requires explicit configuration), leading candidates to overlook the fact that missing routes are due to an incomplete custom list rather than a BGP session issue or routing mode setting.

How to eliminate wrong answers

Option A is wrong because if the BGP session were not established, the on-premises router would receive no routes at all, not just a subset. Option B is wrong because global routing mode (as opposed to regional routing mode) does not affect which subnets are advertised; it only controls the scope of route propagation within Google Cloud, not the BGP advertisement list. Option D is wrong because the question states the on-premises router is 'only receiving routes for 10.1.0.0/16 and 10.2.0.0/16', which matches the advertised IP ranges; a filter on the on-premises router would typically block all or specific routes, but the pattern here points to a missing advertisement on the Cloud Router side.

Full explanation →
84
Multi-Selecthard

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

Select 2 answers
A.Ensure Cloud NAT is enabled in each zone where instances are located
B.Check Cloud NAT logs for port exhaustion
C.Verify that the instances have external IP addresses assigned
D.Verify that the external service is not blocking the NAT IP addresses
E.Review the health check configuration for the NAT gateway
AnswersB, D

Port exhaustion can cause connection failures; Cloud NAT logs show when ports are depleted.

Why this answer

Cloud NAT logs can reveal port exhaustion, which occurs when the NAT gateway runs out of available source ports for connections. Since all instances share the same NAT IP addresses, high connection counts from some instances can exhaust ports, preventing others from establishing new outbound connections. Checking these logs helps identify whether port exhaustion is the root cause of the connectivity issue.

Exam trap

Google Cloud often tests the misconception that Cloud NAT must be zone-specific or that instances need external IPs for NAT to work, but the real trap is overlooking port exhaustion as a common failure mode when multiple instances share the same NAT gateway.

Full explanation →
85
MCQhard

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. Both connections are active and they want to use both simultaneously for load balancing traffic. They have configured two VLAN attachments each with a Cloud Router and BGP sessions. How should they configure BGP to achieve active-active load sharing?

A.Set different local preference values on the Google Cloud Router
B.Configure the on-premises router to enable ECMP for the BGP routes
C.Use AS path prepending on one connection to make it less preferred
D.Assign different MED values to each connection to influence preference
AnswerB

ECMP on the on-premises router allows it to use both paths equally.

Why this answer

Equal-cost multipath (ECMP) requires that the routes from both connections have the same next-hop attribute and are learned via different BGP sessions. By default, Cloud Router advertises the same routes with the same MED and AS path. To enable ECMP, the on-premises router must be configured to accept multiple equal-cost paths.

The Cloud Router will automatically advertise routes with identical attributes when using separate VLAN attachments, and the on-premises router can then load balance.

Full explanation →
86
MCQmedium

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

A.VPC Network Peering
B.Shared VPC
C.Network Connectivity Center
D.Cloud VPN
AnswerC

NCC provides hub-and-spoke connectivity with transitive routing across VPCs and on-premises.

Why this answer

Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Full explanation →
87
MCQmedium

A company has a VPC with the above firewall rule applied. They have a VM instance with network tag 'web-server' that hosts a web server. Users report they cannot access the web server from the internet. What is the most likely cause?

A.The targetTags filter is incorrectly spelled; it should be 'webserver' instead of 'web-server'.
B.The firewall rule is disabled.
C.The VM instance does not have a public IP address.
D.The firewall rule priority is too high (1000), causing it to be overridden by a deny rule with lower priority.
E.The firewall rule does not allow traffic from the internet because sourceRanges is set to 0.0.0.0/0.
AnswerC

Without a public IP, the VM cannot be reached from the internet.

Why this answer

The most likely cause because a VM instance without a public IP address cannot receive traffic from the internet, regardless of firewall rules. Even with a firewall rule allowing ingress from 0.0.0.0/0, the traffic has no public IP to reach the VM. Option A is incorrect because sourceRanges 0.0.0.0/0 allows all sources.

Option B is incorrect because the firewall rule being disabled would prevent access, but there is no indication it is disabled. Option D is incorrect because priority 1000 is default, and a deny rule with lower priority (higher number) would not override it. Option E is incorrect because the targetTags filter 'web-server' matches the VM's tag.

Full explanation →
88
MCQeasy

Which Traffic Director feature ensures that a service does not receive more requests than it can handle by setting a maximum number of concurrent requests or connections?

A.Traffic splitting
B.Circuit breakers
C.mTLS
D.Fault injection
AnswerB

Circuit breakers enforce limits on connections/requests to prevent overload.

Why this answer

Circuit breakers are used to limit the number of concurrent connections or requests to a service to prevent overload. Fault injection is for testing. Traffic splitting is for gradual rollouts. mTLS is for mutual TLS authentication.

Full explanation →
89
MCQeasy

A company wants to allow on-premises servers to access Google APIs and services through a Dedicated Interconnect without using public IPs. What should they configure?

A.Enable Private Google Access on the VPC subnet.
B.Set up VPC Network Peering.
C.Configure Private Service Connect.
D.Configure Cloud Router with custom route advertisement.
AnswerA

This enables private access to Google APIs via the interconnect.

Why this answer

Private Google Access enables on-premises hosts connected via Dedicated Interconnect to reach Google APIs and services using internal IP addresses. When enabled on the VPC subnet, traffic destined for Google APIs is routed through the interconnect without needing public IPs, as the VPC uses its default routes and Cloud NAT-like functionality to forward requests to Google's internal addresses.

Exam trap

Google Cloud often tests the misconception that Private Service Connect or Cloud Router alone can provide private API access from on-premises, but the key requirement is enabling Private Google Access on the subnet to route API traffic through the interconnect without public IPs.

How to eliminate wrong answers

Option B is wrong because VPC Network Peering connects two VPC networks, not on-premises networks to Google APIs; it does not provide access to Google APIs from on-premises via interconnect. Option C is wrong because Private Service Connect is used to privately access managed services (e.g., Google APIs) from within a VPC using endpoints, but it does not extend that access to on-premises networks over Dedicated Interconnect without additional configuration like Private Google Access. Option D is wrong because Cloud Router with custom route advertisement manages dynamic routing (BGP) between on-premises and GCP, but it does not by itself enable access to Google APIs without public IPs; Private Google Access must be explicitly enabled on the subnet.

Full explanation →
90
MCQhard

A company has two HA VPN tunnels from on-premises to Google Cloud using two separate Cloud Routers for redundancy. The on-premises network uses BGP and advertises a default route to Google Cloud. The company wants to ensure that traffic from Google Cloud to on-premises prefers the primary Cloud Router over the secondary. Which configuration should be applied?

A.Set the primary Cloud Router's BGP IP as the next-hop for all routes on the secondary.
B.Set a lower MED on the primary Cloud Router's BGP session for the default route advertisement.
C.Set a higher LOCAL_PREF on the primary Cloud Router for the default route.
D.Set a shorter AS_PATH on the primary Cloud Router's BGP session.
AnswerC

Higher LOCAL_PREF makes the route more preferred for outbound traffic from Google Cloud.

Why this answer

LOCAL_PREF is a well-known mandatory BGP attribute that is used to influence outbound traffic from an AS. By setting a higher LOCAL_PREF on the primary Cloud Router for the default route, Google Cloud will prefer that path for traffic destined to on-premises, as LOCAL_PREF is evaluated before other attributes like AS_PATH and MED.

Exam trap

The trap here is that candidates often confuse MED (which influences inbound traffic) with LOCAL_PREF (which influences outbound traffic), leading them to incorrectly select Option B, thinking MED can control which path Google Cloud uses to send traffic to on-premises.

How to eliminate wrong answers

Option A is wrong because manually setting the primary Cloud Router's BGP IP as the next-hop on the secondary does not influence BGP path selection; BGP next-hop is used for reachability, not preference, and this configuration would not cause the primary to be preferred. Option B is wrong because MED is a multi-exit discriminator that influences inbound traffic to an AS, not outbound traffic from Google Cloud; it is used by the on-premises router to choose which path to use when multiple paths exist to the same prefix, not by Google Cloud. Option D is wrong because a shorter AS_PATH makes a route more preferred, but this attribute is typically manipulated on the on-premises side to influence Google Cloud's path selection; setting a shorter AS_PATH on the primary Cloud Router would not be effective because AS_PATH is prepended by the router advertising the route, and Google Cloud would see the same AS_PATH length from both routers if they are in the same AS.

Full explanation →
91
MCQmedium

A company has a multi-region VPC with subnets in us-central1 (10.0.0.0/24) and europe-west1 (10.0.1.0/24). They have deployed a global Application Load Balancer (ALB) with backend services in both regions. The backends are instance groups with instances in each subnet. The ALB uses internal IP addresses from a subnet in each region for the backend services. The company wants to restrict access to the ALB so that only traffic from a specific list of external IP addresses (e.g., corporate VPN) can reach the load balancer. They have created a firewall rule allowing ingress from those IP addresses to the ALB's forwarding rule IP (which is a global IP). However, external traffic from allowed IPs is still being blocked. What is the most likely reason?

A.The firewall rule should be created with priority lower than 1000 to override default deny.
B.VPC firewall rules do not apply to global load balancer's frontend; use Cloud Armor with IP whitelist.
C.The firewall rule must allow ingress from the allowed IPs to the backend instance's internal IPs.
D.The firewall rule must be applied to the backend instances' tags, not the forwarding rule IP.
AnswerB

Global ALB traffic bypasses VPC firewall; Cloud Armor provides access control at the edge.

Why this answer

The Global Application Load Balancer (external) uses a global anycast IP that is part of Google's frontend infrastructure, not a VPC resource. VPC firewall rules apply only to traffic entering or leaving VPC network interfaces, such as VM instances or internal load balancers. Traffic to the global ALB's frontend IP is handled before it reaches the VPC, so VPC firewall rules cannot filter it.

To restrict access based on source IP addresses, you must use Cloud Armor security policies attached to the load balancer. Therefore, option B is correct. Option A is incorrect because priority is not the issue; firewall rules simply do not apply to the global frontend.

Option C and D are incorrect because they refer to backend instances, but the problem is at the frontend. Option B is the correct solution: use Cloud Armor with an IP whitelist.

Full explanation →
92
MCQhard

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

A.Deploy a global HTTP(S) Load Balancer with backend services in each region.
B.Use Cloud DNS with geo-routing to direct users to regional load balancers.
C.Set up Cloud NAT with multiple static IP addresses for each region.
D.Assign a global anycast IP address to all instances and use BGP to advertise it.
AnswerA

Global HTTP(S) LB uses anycast IP and proxies traffic to the closest region, reducing latency.

Why this answer

A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Exam trap

Google Cloud often tests the misconception that anycast IPs can be directly assigned to instances or that BGP-based anycast is a viable option in Google Cloud, when in fact only Google-managed load balancers can provide anycast IPs, and customers cannot advertise their own anycast prefixes.

How to eliminate wrong answers

Option B is wrong because Cloud DNS with geo-routing directs users to regional load balancers based on DNS resolution, but DNS-based routing cannot react to real-time network conditions or instance health, and traffic still traverses the public internet after DNS resolution, failing to fully utilize Google's global network. Option C is wrong because Cloud NAT provides outbound internet access for instances without public IPs and does not improve inbound user latency; it is used for egress traffic, not ingress load balancing. Option D is wrong because assigning a global anycast IP address directly to instances and using BGP to advertise it is not supported in Google Cloud; Google Cloud does not allow customers to advertise their own anycast IPs via BGP, and instances cannot share a single anycast IP without a load balancer.

Full explanation →
93
MCQmedium

A company has deployed a Dedicated Interconnect with multiple VLAN attachments connected to a single Cloud Router. They want to influence inbound traffic from on-premises to Google Cloud to use a specific attachment for certain prefixes. Which BGP attribute can they manipulate on the on-premises router to achieve this?

A.AS_PATH
B.LOCAL_PREF
C.MED
D.Community tags
AnswerC

MED can be set on routes advertised from on-premises to Google Cloud, influencing which attachment is preferred for those prefixes.

Why this answer

The Multi-Exit Discriminator (MED) attribute is used to influence inbound traffic from on-premises to Google Cloud when multiple paths exist via a Dedicated Interconnect. By setting a lower MED value on the on-premises router for specific prefixes, the Cloud Router will prefer that attachment for those prefixes, as MED is compared first among paths from the same neighboring AS.

Exam trap

Google Cloud often tests the distinction between attributes that influence inbound vs. outbound traffic, and the trap here is that candidates confuse MED (inbound influence) with LOCAL_PREF (outbound influence) or AS_PATH prepending (outbound influence), assuming any attribute can be manipulated on the on-premises router to affect Google Cloud's path selection.

How to eliminate wrong answers

Option A is wrong because AS_PATH is used to influence outbound traffic from Google Cloud to on-premises by prepending AS numbers, not inbound traffic from on-premises to Google Cloud. Option B is wrong because LOCAL_PREF is a well-known mandatory attribute that is only used within a single AS to influence outbound traffic from the local router, and it is not exchanged between ASes, so it cannot be set on the on-premises router to affect Google Cloud's path selection. Option D is wrong because Community tags are used for tagging routes to trigger routing policies (like route filtering or preference) but do not directly influence path selection; they require explicit configuration on the receiving router to interpret them, unlike MED which is a standard BGP attribute compared automatically.

Full explanation →
94
Multi-Selecthard

An engineer needs to configure Cloud NAT with logging enabled to monitor traffic from a specific subnet. The NAT gateway uses automatic NAT IP allocation. The engineer wants to ensure that if a single VM uses many connections, it does not exhaust the available ports for other VMs. Which THREE settings should be configured? (Choose THREE.)

Select 3 answers
A.Set the minimum ports per VM to a reasonable value
B.Set the NAT IP allocation to manual
C.Enable logging on the NAT gateway
D.Enable endpoint-independent mapping
E.Set the maximum ports per VM to a reasonable value
AnswersA, B, E

This guarantees each VM gets a minimum number of ports.

Why this answer

To prevent port exhaustion, the engineer should enable manual port allocation to set limits, configure endpoint-independent mapping for UDP (not directly related to port exhaustion), and set a minimum ports per VM to guarantee each VM gets a baseline. Manual allocation allows setting a maximum number of ports per VM, which prevents a single VM from using all ports.

Full explanation →
95
MCQeasy

A network engineer notices unusual traffic patterns from a VM. They want to capture detailed information about each packet sent and received by the VM, including source and destination IPs, protocols, and ports. Which feature should they enable?

A.Packet Mirroring
B.VPC Flow Logs
C.Cloud Audit Logs
D.Firewall Rules Logging
AnswerB

VPC Flow Logs sample and log network flows with metadata.

Why this answer

VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IPs, protocols, and ports. This feature is designed specifically for analyzing traffic patterns and troubleshooting connectivity issues at the network layer, making it the correct choice for the described requirement.

Exam trap

Google Cloud often tests the distinction between metadata logging (VPC Flow Logs) and full packet capture (Packet Mirroring), leading candidates to choose Packet Mirroring when only summary traffic information is needed.

How to eliminate wrong answers

Option A is wrong because Packet Mirroring copies the actual packet payload (full packet capture) for deep inspection, not just metadata like IPs and ports, and is typically used for security appliances or intrusion detection, not for lightweight traffic pattern analysis. Option C is wrong because Cloud Audit Logs record administrative actions and API calls (e.g., who created a VM), not network packet-level details such as IPs, protocols, or ports. Option D is wrong because Firewall Rules Logging logs only traffic that is allowed or denied by firewall rules, and it does not capture all packets sent/received by a VM; it is rule-centric, not interface-centric.

Full explanation →
96
MCQmedium

A customer reports that after setting up HA VPN, some on-premises subnets are not reachable from Google Cloud. The Cloud Router shows the missing routes. What is the most likely cause?

A.The VPN tunnel is down.
B.The on-premises router is not configured to advertise those subnets.
C.BGP route filters are blocking the advertisement of those subnets.
D.The shared secret is incorrect.
AnswerC

Route filters on the Cloud Router or on-premises router can selectively allow or deny routes.

Why this answer

The Cloud Router shows the missing routes, indicating that the VPN tunnel and BGP session are up, but the routes are not being installed. BGP route filters on the Cloud Router or on-premises router can explicitly block the advertisement of specific subnets, preventing them from being learned and installed in the routing table even though the BGP session is established.

Exam trap

The trap here is that candidates often assume missing routes are due to a tunnel or BGP session failure, but Cisco tests the distinction between routes being received (BGP table) versus being installed (routing table), which points to route filtering as the cause.

How to eliminate wrong answers

Option A is wrong because if the VPN tunnel were down, the Cloud Router would not show any routes from the on-premises side, and the BGP session would be down, not just missing specific subnets. Option B is wrong because the on-premises router not advertising those subnets would result in the Cloud Router not seeing those routes at all, but the question states the Cloud Router shows the missing routes, meaning they are present in the BGP updates but not installed. Option D is wrong because an incorrect shared secret would prevent the IPsec tunnel from establishing, causing the BGP session to fail entirely, not just filter specific subnets.

Full explanation →
97
Multi-Selectmedium

An engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They want to control which on-premises subnets are advertised to GCP. Which TWO methods can they use?

Select 2 answers
A.Change the Cloud Router ASN
B.Use route priority in the VPC
C.Set MED on the on-premises router
D.Apply BGP filters on the on-premises router to limit advertised prefixes
E.Configure custom learned routes on the Cloud Router
AnswersD, E

On-premises filters can restrict which prefixes are advertised to GCP.

Why this answer

Custom learned routes can be configured to filter prefixes, and BGP filters can be applied on the on-premises side.

Full explanation →
98
MCQmedium

A company is migrating from an on-premises data center to Google Cloud. They have set up a High-Availability VPN (with two tunnels) between their on-premises router and a Cloud VPN gateway in a VPC. They use static routing. The on-premises network uses RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the VPC uses 10.1.0.0/16. They have configured static routes in the VPC for the on-premises ranges pointing to the VPN gateway. However, they notice that traffic from on-premises to the VPC is intermittent: sometimes packets go through tunnel 1, sometimes through tunnel 2, and sometimes they drop. The on-premises router is configured to use both tunnels in an active-active mode with equal-cost multipath (ECMP). What is the most likely cause of the intermittent drops?

A.Increase the number of tunnels to four to distribute traffic better.
B.Change from static routing to dynamic routing (BGP) to allow the Cloud VPN gateway to advertise routes and avoid ECMP issues.
C.Set the on-premises router to active-passive mode using only one tunnel at a time.
D.Configure traffic selector policies on the VPN tunnels to ensure each tunnel only handles specific subnets.
AnswerB

BGP provides better control over path selection and is recommended for HA VPN with multiple tunnels.

Why this answer

The most likely cause of intermittent drops is that the on-premises router is using ECMP to distribute traffic across both VPN tunnels, but Cloud VPN with static routing does not support ECMP for incoming traffic. This can lead to out-of-order packets or drops for the same flow if packets arrive on different tunnels. Switching to dynamic routing with BGP allows the Cloud VPN gateway to establish BGP sessions over each tunnel, which enables proper route advertisement and ECMP support by creating a single logical interface.

BGP routing also allows the gateway to better handle path selection and failover, thus resolving the intermittent drops. Therefore, option B is correct.

Full explanation →
99
MCQhard

An organization has deployed an internal TCP/UDP load balancer in their VPC. They need to ensure that the load balancer preserves the client IP address when forwarding traffic to backend instances. Which configuration is required?

A.Configure the health check to use the client IP as source.
B.Enable Proxy Protocol on the load balancer.
C.Use a backend service with session affinity.
D.No configuration is needed; client IP is preserved by default.
AnswerD

Internal TCP/UDP LB is pass-through, so client IP is preserved automatically.

Why this answer

Internal TCP/UDP Load Balancers are pass-through load balancers (Layer 4). They preserve the client IP address by default because they forward packets directly without NAT. No special configuration is needed; the backend instances see the original source IP.

Full explanation →
100
MCQmedium

Your company has a hybrid network architecture with two Cloud VPN tunnels (tunnel-a and tunnel-b) from an on-premises router to a Cloud VPN gateway in us-central1, and one Dedicated Interconnect connection from the same on-premises router to a VLAN attachment in us-east1. All connections use BGP to exchange routes. The on-premises router advertises the same CIDR block 10.0.0.0/8 to both VPN and Interconnect. Google Cloud routes for on-premises prefixes are learned via both paths with the same priority. You notice that traffic from Google Cloud VMs in us-central1 to on-premises destinations sometimes fails during periods of high load. Additionally, you observe ICMP redirects from the VMs. What is the most likely cause and recommended action?

A.Configure BGP ASN prepending on the Cloud Router associated with the VPN tunnels to make the Interconnect path more preferred for on-premises traffic back to Google Cloud.
B.Create a second Cloud VPN gateway in us-east1 and establish a separate VPN tunnel from on-premises to that gateway to provide symmetric routing.
C.Enable source NAT on the Cloud VPN gateway so that VMs' source IPs are rewritten, preventing ICMP redirects.
D.Disable route propagation on the Cloud Router in us-east1 to force all traffic through the VPN tunnels.
AnswerA

ASN prepending makes the VPN path less desirable, causing return traffic to use the Interconnect connection, achieving symmetric routing.

Why this answer

The issue is asymmetric routing: traffic from Google Cloud VMs in us-central1 to on-premises destinations uses the Interconnect (us-east1) due to equal-cost multipath (ECMP) or routing decisions, but return traffic from on-premises may prefer the VPN tunnels (tunnel-a/tunnel-b) because BGP path selection (e.g., local preference, AS path length) is not influenced. This causes ICMP redirects and failures under load. Option A corrects this by using BGP ASN prepending on the Cloud Router for the VPN tunnels, artificially lengthening the AS path for routes learned via VPN, making the Interconnect path more preferred for return traffic, ensuring symmetric routing.

Exam trap

The trap here is that candidates confuse ICMP redirects with a NAT or firewall issue, rather than recognizing them as a classic symptom of asymmetric routing in a multi-homed BGP environment, and they overlook the simple BGP path manipulation technique of ASN prepending to enforce symmetric routing.

How to eliminate wrong answers

Option B is wrong because creating a second VPN gateway in us-east1 does not solve the asymmetric routing problem; it adds another path without influencing path preference, and the core issue is route selection, not geographic proximity. Option C is wrong because source NAT on the Cloud VPN gateway would break end-to-end IP connectivity and does not address the routing asymmetry; ICMP redirects are a symptom of asymmetric routing, not a source IP issue. Option D is wrong because disabling route propagation on the Cloud Router in us-east1 would remove the Interconnect route entirely, forcing all traffic through VPN tunnels, which defeats the purpose of using Dedicated Interconnect and may cause performance degradation or single-path failure.

Full explanation →
101
MCQmedium

An organization is planning a hybrid network between an on-premises data center and Google Cloud. They require a dedicated, high-bandwidth connection with 99.99% availability SLA and the ability to scale up to 100 Gbps. They have a co-location facility that is connected to a Google Cloud region. Which connectivity option should they choose?

A.HA VPN
B.Partner Interconnect
C.Dedicated Interconnect
D.Classic VPN
AnswerC

Dedicated Interconnect offers dedicated 10 Gbps or 100 Gbps links, supports up to 100 Gbps, and has a 99.99% SLA when deployed with redundant connections.

Why this answer

Dedicated Interconnect provides direct physical connections between on-premises and GCP, offering 10 Gbps or 100 Gbps per link, with a 99.99% SLA when configured with redundant links. It is the best fit for high-bandwidth, high-availability requirements when co-location is available.

Full explanation →
102
MCQmedium

A network engineer is troubleshooting a Cloud VPN tunnel that is not passing traffic. The tunnel status shows as established, and BGP sessions are up. However, traffic from an on-premises subnet (10.0.1.0/24) to a GCP subnet (192.168.1.0/24) is not working. What should the engineer check first?

A.Verify that the on-premises router is advertising the 10.0.1.0/24 prefix via BGP
B.Ensure that the Cloud Router is configured with the correct BGP ASN
C.Check that GCP has a static route for 10.0.1.0/24 pointing to the VPN tunnel
D.Check GCP firewall rules to allow ingress from 10.0.1.0/24
AnswerA

If the prefix is not advertised, GCP will not have a route to reach it.

Why this answer

Even though the VPN tunnel and BGP session are established, traffic may still fail if the on-premises router is not advertising the on-premises subnet (10.0.1.0/24) to GCP via BGP. Without this advertisement, GCP's Cloud Router has no route to reach that subnet, so return traffic from GCP to on-premises is dropped. The first step in troubleshooting is to verify that the on-premises BGP speaker is sending the correct prefix in its UPDATE messages.

Exam trap

Google Cloud often tests the misconception that a 'tunnel established' and 'BGP up' guarantee traffic flow, but the trap here is that route advertisement via BGP is a separate requirement that must be explicitly verified.

How to eliminate wrong answers

Option B is wrong because the BGP ASN on the Cloud Router is already configured correctly if the BGP session is up; an incorrect ASN would prevent the session from establishing. Option C is wrong because GCP does not require a static route for the on-premises subnet when using dynamic routing (BGP); the route is learned automatically via BGP from the on-premises router. Option D is wrong because firewall rules control ingress traffic into GCP, but if GCP has no route back to 10.0.1.0/24, traffic will be dropped before firewall rules are evaluated; the routing issue must be resolved first.

Full explanation →
103
MCQhard

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

A.Ingress rule: source 203.0.113.5/32, destination 169.254.0.1/32, tcp:22
B.Ingress rule: source 10.0.1.2/32, destination 203.0.113.5/32, tcp:22
C.Ingress rule: source 0.0.0.0/0, destination 203.0.113.5/32, tcp:22
D.Ingress rule: source 203.0.113.5/32, destination 10.0.1.2/32, tcp:22
AnswerD

Allows SSH from on-premises IP to the instance.

Why this answer

Firewall rules in GCP are stateful and applied at the instance level, not the VPN tunnel. The rule must allow ingress traffic from the on-premises source IP (203.0.113.5/32) to the Compute Engine instance's internal IP (10.0.1.2/32) on TCP port 22. The Cloud VPN and Cloud Router handle routing, but the firewall rule explicitly defines the allowed traffic flow.

Exam trap

The trap here is that candidates often confuse the direction of traffic in firewall rules, mistakenly thinking the on-premises IP should be the destination (as in Option B) or that the VPN tunnel's link-local address is the correct destination (as in Option A), when in fact the rule must match the actual source and destination IPs of the SSH session.

How to eliminate wrong answers

Option A is wrong because the destination 169.254.0.1/32 is a link-local address used for BGP peering between the Cloud Router and the VPN tunnel, not the Compute Engine instance; SSH traffic must reach the instance's internal IP. Option B is wrong because it reverses the source and destination: the on-premises host (203.0.113.5) is the source initiating SSH, not the destination, and the rule would incorrectly allow traffic from the instance to the on-premises host. Option C is wrong because it allows SSH from any source (0.0.0.0/0), which violates the requirement to restrict access to only the specific on-premises IP 203.0.113.5, creating a security risk.

Full explanation →
104
MCQhard

A company uses Cloud DNS with a managed zone for example.com. They want to override DNS responses for a specific subdomain, mail.example.com, to point to an internal IP address when queried from within the VPC, but external queries should resolve normally. Which feature should they use?

A.DNS Security Extensions (DNSSEC)
B.Private DNS zone
C.Response Policy Zone (RPZ)
D.Routing policy (weighted or geo)
AnswerC

Correct. RPZ can override DNS responses for specific domains within a VPC.

Why this answer

Response Policy Zones (RPZ) allow you to override DNS responses for specific domains based on the source network. This is used for DNS filtering or overriding.

Full explanation →
105
Multi-Selecthard

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

Select 2 answers
A.Enable Private Google Access on subnets that host instances without external IP addresses.
B.Configure firewall rules with stateful packet inspection disabled to maximize throughput.
C.Use VPC Service Controls to create a perimeter around the sensitive data stored in Cloud Storage and BigQuery.
D.Use VPC Network Peering to isolate the sensitive workloads from other projects.
E.Create a Cloud NAT gateway to filter inbound traffic from the internet.
AnswersA, C

This allows instances to access Google APIs over the internal network, reducing exposure to the internet.

Why this answer

Private Google Access allows VM instances that have only internal IP addresses (no external IPs) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through the Google Cloud network. This eliminates the need for an external IP address, reducing the attack surface and supporting a defense-in-depth strategy by keeping traffic within Google's internal infrastructure.

Exam trap

Google Cloud often tests the misconception that Cloud NAT can filter inbound traffic, but Cloud NAT is strictly an outbound proxy that does not inspect or filter inbound connections; inbound traffic must be controlled by firewall rules or Cloud Armor.

Full explanation →
106
MCQhard

A global application uses a global external HTTPS load balancer with backend NEGs in multiple regions. The content is static and must be cached at edge locations to reduce latency. Which GCP service should be enabled?

A.Cloud CDN
B.Cloud Storage
C.Cloud NAT
D.Cloud Memorystore
AnswerA

Provides edge caching for content.

Why this answer

Cloud CDN is the correct service because it leverages Google's global edge cache network to cache static content from an external HTTPS load balancer with backend NEGs. When enabled, Cloud CDN intercepts requests at edge locations and serves cached responses, reducing latency and offloading origin servers. This directly addresses the requirement to cache static content at edge locations for a global application.

Exam trap

The trap here is confusing Cloud CDN (edge caching) with Cloud Memorystore (backend caching) or Cloud Storage (origin storage), as candidates may think any caching service works at the edge, but only Cloud CDN integrates with the external HTTPS load balancer and Google's edge PoPs.

How to eliminate wrong answers

Option B (Cloud Storage) is wrong because Cloud Storage is a scalable object storage service, not a content delivery network; it can serve static content but does not provide edge caching without Cloud CDN enabled on the bucket. Option C (Cloud NAT) is wrong because Cloud NAT provides outbound internet connectivity for private instances, not inbound caching or content delivery. Option D (Cloud Memorystore) is wrong because Cloud Memorystore is a managed in-memory cache (Redis/Memcached) for backend caching, not an edge caching service; it operates within a VPC, not at Google's edge locations.

Full explanation →
107
MCQmedium

A company needs a hybrid connectivity solution with a bandwidth of 500 Mbps and a 99.9% SLA. They do not have a presence in a colocation facility that supports Dedicated Interconnect. Which GCP service should they use?

A.Classic VPN
B.HA VPN
C.Partner Interconnect
D.Dedicated Interconnect
AnswerC

Suitable for 500 Mbps, 99.9% SLA, no colocation needed.

Why this answer

Partner Interconnect provides connectivity through a supported service provider with bandwidth from 50 Mbps to 10 Gbps and offers 99.9% or 99.99% SLA. It does not require colocation facility access.

Full explanation →
108
MCQmedium

Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?

A.Create a Cloud NAT.
B.Add a firewall rule to allow egress to 0.0.0.0/0.
C.Enable Private Google Access on the subnet.
D.Add a default route to the internet gateway.
AnswerC

The setting privateIpGoogleAccess is currently false; enabling it allows access to Google APIs.

Why this answer

The subnet has privateIpGoogleAccess set to false, which must be enabled for VMs without external IPs to access Google APIs via Private Google Access. Option C (Enable Private Google Access on the subnet) is the correct configuration. Option A (Cloud NAT) is for outbound internet to non-Google destinations, not for Google APIs.

Option B is not needed because egress to 0.0.0.0/0 is allowed by default. Option D is not missing; a default route exists as indicated by gatewayAddress.

Full explanation →
109
MCQmedium

An organization has multiple VPC networks in a project and wants to centrally manage firewall rules across all networks using a single set of rules. Which approach should they take?

A.Use firewall rules with global scope
B.Create a single VPC network and use subnetting
C.Use hierarchical firewall policies at the folder level
D.Use shared VPC and apply firewall rules to the host project
AnswerC

Hierarchical firewall policies apply to all networks under a folder, enabling central management.

Why this answer

Firewall rules are per network. To centrally manage rules, you can use hierarchical firewall policies (part of VPC Firewall Policies) applied at the organization or folder level, which override network-specific rules.

Full explanation →
110
MCQmedium

A company wants to securely connect an on-premises data center to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) that overlap with the VPC subnet (10.0.1.0/24). They need connectivity to specific workloads in the VPC without changing IP addresses on premises. What should they do?

A.Use VPC Network Peering with a custom route exchange to filter the overlapping range.
B.Set up Dedicated Interconnect and configure BGP with the on-premises router, advertising a more specific prefix.
C.Use Cloud NAT and configure a firewall rule to allow traffic from the on-premises network.
D.Deploy Private Service Connect to expose the VPC workloads as endpoints accessible from on-premises.
AnswerD

Private Service Connect allows private connectivity without route overlap by using service attachments and endpoints.

Why this answer

Private Service Connect (PSC) allows on-premises clients to access specific VPC workloads via internal IP addresses (RFC 1918) without requiring VPC peering or VPN. PSC publishes the workloads as endpoints reachable through a Private Service Connect endpoint in the on-premises network, avoiding IP overlap by using a separate IP address range for the endpoint. This solution meets the requirement of not changing on-premises IPs while providing secure, targeted connectivity.

Exam trap

The trap here is that candidates assume BGP or more specific prefixes can overcome IP overlap, but without NAT or a proxy mechanism, overlapping routes cause routing conflicts that break connectivity.

How to eliminate wrong answers

Option A is wrong because VPC Network Peering requires non-overlapping IP ranges between the two networks; overlapping RFC 1918 addresses (10.0.0.0/8 vs 10.0.1.0/24) cannot be resolved by custom route exchange, as peering does not support NAT or address translation. Option B is wrong because Dedicated Interconnect with BGP does not solve IP overlap; even with a more specific prefix, the on-premises router would still have a conflicting route for 10.0.0.0/8, causing asymmetric routing or unreachability. Option C is wrong because Cloud NAT is designed for outbound internet traffic from VMs, not for inbound connectivity from on-premises networks; firewall rules cannot translate overlapping IPs or provide direct access to VPC workloads.

Full explanation →
111
MCQhard

A network engineer is setting up a Dedicated Interconnect with a 10 Gbps circuit. They need to achieve 99.99% availability SLA. Which of the following configurations meets the SLA requirements?

A.One 10 Gbps circuit and one VPN as backup
B.Two 10 Gbps circuits in different metro areas
C.Single 10 Gbps circuit in one metro area
D.Two 10 Gbps circuits in the same metro area
AnswerB

Two circuits in different metros meet the SLA requirement.

Why this answer

Google Cloud's 99.99% SLA for Dedicated Interconnect requires two connections from two different metro areas (redundant locations). Each connection must be 10 Gbps or more. Active-active or active-passive is acceptable, but the key is two circuits in different metros.

Full explanation →
112
MCQeasy

An organization has two Cloud VPN tunnels from the same on-premises router to a Cloud Router in Google Cloud. Both tunnels are using BGP, and the on-premises router is sending the same routes over both tunnels. The Cloud Router is configured to use 'route propagation' from a VPC network. Which of the following is true regarding route priority?

A.Cloud Router will use both tunnels for load balancing (ECMP) if the routes are identical
B.The tunnel with the lower local preference value will be used
C.The tunnel with the higher BGP MED value will be preferred
D.Only the tunnel with the lowest IP address will be used
AnswerA

With identical BGP routes (same prefix, next hop different, same MED and local preference), Cloud Router will install multiple paths and use ECMP.

Why this answer

When both BGP routes are identical in prefix, AS path, local preference, MED, and other attributes, Cloud Router uses ECMP (Equal-Cost Multi-Path) to load balance traffic across both Cloud VPN tunnels. Route propagation in the VPC network does not alter the BGP best-path selection; it simply injects the learned routes into the VPC routing table. Since the on-premises router advertises the same routes over both tunnels, Cloud Router treats them as equal-cost paths and distributes traffic across both tunnels.

Exam trap

The trap here is that candidates often assume BGP always selects a single best path and ignore that ECMP is enabled when routes are identical, leading them to incorrectly choose options that involve attribute-based tiebreakers like local preference or MED.

How to eliminate wrong answers

Option B is wrong because local preference is a BGP attribute used to influence outbound traffic from the Cloud Router's perspective, but when both tunnels receive the same local preference (default 100), it does not cause one tunnel to be preferred over the other. Option C is wrong because a higher BGP MED value makes a route less preferred, not more; MED is a metric used to influence inbound traffic from the on-premises side. Option D is wrong because Cloud Router does not use the tunnel's IP address as a tiebreaker; it uses BGP attributes and, if all attributes are equal, it will use ECMP rather than selecting a single tunnel.

Full explanation →
113
MCQmedium

Refer to the exhibit. The Cloud Router is connected to two on-premises routers via dedicated interconnect. The on-premises routers advertise the same prefix 10.1.0.0/16. Which on-premises router's route will be preferred by Google Cloud for traffic destined to 10.1.0.0/24? (Assume equal AS path length and MED from on-premises.)

A.The route with lower peer IP address
B.Both routes will be used equally (ECMP)
C.The route from peer with IP 169.254.0.1
D.The route from peer with IP 169.254.1.1
AnswerD

This peer has customLearnedRoutePriority 100, which is lower (more preferred).

Why this answer

Google Cloud Router uses the customLearnedRoutePriority attribute as a tiebreaker when two on-premises routers advertise the same prefix via separate VLAN attachments on Dedicated Interconnect, assuming equal AS path length and MED. The router with the lower customLearnedRoutePriority value is preferred. In this scenario, the peer 169.254.1.1 has a lower priority (e.g., 100) compared to 169.254.0.1's higher priority (e.g., 200).

Therefore, the route from peer 169.254.1.1 is selected.

Exam trap

A common pitfall is to assume that BGP uses the lowest neighbor IP address as a tiebreaker when AS path length and MED are equal. In Google Cloud, however, Cloud Router uses the customLearnedRoutePriority attribute (lower is preferred) for routes learned from different VLAN attachments on Dedicated Interconnect. The priority is configured per VLAN attachment and is independent of the peer IP.

Therefore, the correct answer is not based on the IP address; it depends on which VLAN attachment has the lower priority value. Candidates must recognize that the IP addresses given are just identifiers, and the tiebreaker is a non-standard BGP attribute specific to Google Cloud.

How to eliminate wrong answers

Option A is wrong because Google Cloud Router does not use a lower peer IP address as a tiebreaker; it uses the higher peer IP address. Option B is wrong because ECMP is not applied when the same prefix is received from two different BGP peers on a Cloud Router; a single best path is selected based on deterministic tie-breaking rules. Option C is wrong because 169.254.0.1 is the lower link-local address, and the route from that peer would be rejected in favor of the route from the peer with the higher IP address (169.254.1.1).

Full explanation →
114
MCQmedium

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

A.Use a Shared VPC with separate subnets in different projects for each tier.
B.Use three separate VPCs for each tier and connect them using VPC peering.
C.Use a single VPC and connect the database tier via Cloud VPN to on-premises.
D.Use a single VPC with separate subnets for each tier and configure firewall rules to restrict traffic.
AnswerB

Separate VPCs provide full isolation; peering allows controlled communication.

Why this answer

Using three separate VPCs with VPC peering enforces strict network segmentation: the web tier VPC has a public subnet with an internet gateway, the application tier VPC is peered only to the web tier VPC (no internet gateway), and the database tier VPC is peered only to the application tier VPC (no public IPs). This design ensures that the database tier has no public IP addresses and is only reachable through the application tier, meeting all security requirements.

Exam trap

Google Cloud often tests the misconception that firewall rules alone can prevent public IP assignment, but the trap here is that firewall rules control traffic, not the existence of a public IP address on a resource; the database tier must have no public IP at all, which requires a VPC design that prohibits internet gateway routes.

How to eliminate wrong answers

Option A is wrong because Shared VPC with separate subnets in different projects still places all subnets within the same VPC, meaning the database tier could potentially be assigned a public IP (unless explicitly prevented) and traffic between tiers is not isolated at the VPC level, violating the 'no public IP' requirement. Option C is wrong because using a single VPC with Cloud VPN to on-premises does not address the requirement to isolate the database tier from the internet; the database tier would still reside in the same VPC as the web tier, and Cloud VPN is for hybrid connectivity, not for tier isolation. Option D is wrong because a single VPC with separate subnets and firewall rules does not prevent the database tier from having a public IP address (firewall rules control traffic, not IP assignment), and the database tier could still be assigned a public IP via an external IP address on its instances, which violates the explicit requirement.

Full explanation →
115
MCQhard

A Compute Engine instance is running a network appliance that requires multiple network interfaces. What is the primary purpose of attaching additional NICs (e.g., NIC1, NIC2) to the instance?

A.To provide failover if one NIC fails
B.To enable load balancing across interfaces
C.To increase network throughput
D.To separate traffic between different subnets or networks
AnswerD

Multiple NICs allow an instance to be on different VPC networks or subnets for traffic isolation.

Why this answer

Multiple NICs are used to separate traffic planes such as management, data, and control, and to route traffic through different subnets without relying on internal routing.

Full explanation →
116
MCQhard

A company deploys a web application on Google Kubernetes Engine (GKE) with an Ingress resource handled by an external HTTPS load balancer. They want to enforce mutual TLS (mTLS) authentication where the load balancer verifies the client certificate and then passes the client's identity to the backend using a header. Which configuration should be used?

A.Enable Client Certificate Validation on the HTTPS backend service and configure the backend to read the X-Forwarded-Client-Cert header.
B.Use an SSL policy with mTLS and set the backend service to require client certificates.
C.Use Cloud Armor with mTLS and configure a custom request header to include the client certificate.
D.Configure the GKE Ingress to use an SSL certificate and set the annotation for client certificate validation.
AnswerA

This is the correct method for mTLS with the HTTPS load balancer.

Why this answer

Google Cloud's external HTTPS load balancer supports mTLS by enabling Client Certificate Validation on the backend service. When enabled, the load balancer terminates TLS, validates the client certificate, and injects the client certificate details into the X-Forwarded-Client-Cert (XFCC) header, which the backend application can read to identify the client. This approach offloads certificate validation to the load balancer and passes identity via a standard header, meeting the requirement without modifying the GKE Ingress or backend application logic.

Exam trap

Google Cloud often tests the misconception that mTLS can be configured directly on the Ingress resource or via SSL policies, when in fact it requires enabling Client Certificate Validation on the backend service and using the XFCC header to pass client identity.

How to eliminate wrong answers

Option B is wrong because SSL policies on Google Cloud HTTPS load balancers do not support mTLS; they only configure TLS versions and cipher suites, not client certificate validation. Option C is wrong because Cloud Armor does not handle mTLS or client certificate validation; it provides WAF and DDoS protection, and cannot inject client certificate details into headers. Option D is wrong because GKE Ingress annotations do not support client certificate validation; the Ingress resource delegates to the load balancer, and client certificate validation must be configured on the backend service, not via Ingress annotations.

Full explanation →
117
MCQmedium

A company uses Shared VPC with multiple service projects. The security team wants to ensure that only specific service projects can create firewall rules that allow ingress traffic to the Shared VPC network. What is the best practice?

A.Grant the compute.securityAdmin role to a group with a condition that limits access to only the service projects that need it, using the resource.name condition.
B.Disable firewall rule creation by setting an organization policy constraint.
C.Grant the compute.securityAdmin role to a group at the organization level.
D.Grant the compute.securityAdmin role to the service project owners at the host project level.
AnswerA

IAM conditions allow fine-grained access control.

Why this answer

The compute.securityAdmin role allows users to create firewall rules, and by applying a condition on the resource.name, you can restrict this permission to only specific service projects. This ensures that only authorized service projects can create ingress firewall rules in the Shared VPC network, aligning with the security team's requirement.

Exam trap

Google Cloud often tests the misconception that granting roles at the organization level or to project owners is sufficient for granular control, but the trap here is that without IAM conditions, these broad grants allow all service projects to create firewall rules, failing the requirement for selective access.

How to eliminate wrong answers

Option B is wrong because disabling firewall rule creation with an organization policy constraint would block all firewall rule creation across the entire organization, which is too restrictive and not aligned with the requirement to allow specific service projects to create rules. Option C is wrong because granting the compute.securityAdmin role at the organization level would give all service projects the ability to create firewall rules, violating the security team's need to limit this capability to only specific projects. Option D is wrong because granting the compute.securityAdmin role to service project owners at the host project level would allow those owners to create firewall rules for the Shared VPC network, but it does not provide the granularity to restrict which service projects can do so, as it applies to all service projects owned by those users.

Full explanation →
118
MCQmedium

A company has a TCP-based application running on a group of Compute Engine VMs in us-central1. They need to provide a static internal IP address to clients within the VPC, while preserving the client source IP for logging. Which load balancer should they use?

A.Regional Internal HTTP(S) Load Balancer
B.Regional Internal TCP/UDP Load Balancer
C.Regional External TCP/UDP Network Load Balancer
D.Global Internal HTTP(S) Load Balancer
AnswerB

Correct. Pass-through L4 load balancer that preserves client IP.

Why this answer

The Regional Internal TCP/UDP Load Balancer is a pass-through load balancer that preserves client IP. It provides a static internal IP and operates at L4.

Full explanation →
119
MCQhard

An organization is using Shared VPC with 100 service projects. They want to allow each service project to manage its own Cloud NAT, but the network administration team wants to control the outbound IP addresses used. What is the best design?

A.Create a single Cloud NAT in the host project and share it
B.Use a NAT instance with an external IP in the host project and route traffic from service projects
C.Create Cloud NAT in each service project with the same external IPs
D.Use Private Google Access with Cloud NAT in the host project
AnswerC

Correct. Service projects can create their own Cloud NAT gateways using the same set of external IPs reserved in the host project, achieving both management autonomy and centralized IP control.

Why this answer

In Shared VPC, Cloud NAT can be created in each service project, using the same set of external IP addresses. This allows service projects to manage their own NAT gateways (e.g., configure NAT rules and logging) while the network administration team controls the outbound IPs by reserving the IP addresses in the host project. The IPs can be shared across multiple NAT gateways across different service projects, as long as they are in the same region and the IPs are allocated from a common pool in the host project.

Option A is wrong because a single Cloud NAT in the host project cannot be managed by service projects. Option B is wrong because a NAT instance does not allow service projects to manage their own Cloud NAT; it is a single instance managed centrally. Option D is wrong because Private Google Access is for accessing Google APIs privately, not for general outbound NAT.

Exam trap

A common misconception is that Cloud NAT must be created in the host project only. In reality, Cloud NAT can be created in service projects when using Shared VPC, and multiple NAT gateways can use the same external IP addresses, enabling both service project autonomy and centralized IP control.

How to eliminate wrong answers

Option A is wrong because a single Cloud NAT in the host project cannot be 'shared' across service projects; Cloud NAT is per-VPC network and per-region, and service projects would need to use the host project's NAT, which prevents them from managing their own Cloud NAT. Option C is wrong because creating Cloud NAT in each service project with the same external IPs is not possible—Cloud NAT assigns ephemeral or static IPs per NAT gateway, and multiple service projects cannot use identical external IPs without complex, unsupported configurations. Option D is wrong because Private Google Access with Cloud NAT in the host project only enables outbound connections to Google APIs and services, not general internet egress, and still does not allow service projects to manage their own Cloud NAT.

Full explanation →
120
MCQhard

A multinational company is migrating workloads to Google Cloud and requires a hybrid connectivity solution between their on-premises data centers in New York and London and Google Cloud regions us-central1 and europe-west1. Each data center has a pair of redundant border routers. The network team has set up a Dedicated Interconnect connection in each Google Cloud region, with two VLAN attachments per region (total 4 attachments). Each VLAN attachment is associated with a separate Cloud Router. The Cloud Routers in us-central1 are configured with BGP sessions to the on-premises routers in New York, and the Cloud Routers in europe-west1 peer with the London routers. The VPC is in 'global' dynamic routing mode. After deployment, traffic from on-premises London to Google Cloud in us-central1 takes a suboptimal path: it goes from London to us-central1 via the internet instead of using the Dedicated Interconnect in europe-west1 and then internal Google Cloud backbone. All BGP sessions are up, and routes are being exchanged. The on-premises routers are advertising all their subnets. The Cloud Routers are learning the on-premises prefixes. What is the most likely cause of this suboptimal routing?

A.The VPC subnets in us-central1 are using smaller prefixes that are not being summarized by the Cloud Router.
B.The on-premises London routers are not receiving routes for the VPC subnets in us-central1, so they send traffic via the internet.
C.The Cloud Router in europe-west1 is prepending AS path for routes coming from us-central1, making them less preferred.
D.The on-premises New York routers are setting a lower MED for routes to us-central1, causing London to deprefer them.
AnswerB

Cloud Router only sends routes for subnets in its own region to its BGP peers; global routing mode does not change this.

Why this answer

The on-premises London routers are not receiving routes for the VPC subnets in us-central1. Since the Cloud Routers in europe-west1 only peer with London, they must advertise the us-central1 VPC subnets to London via BGP. If those routes are missing, London has no path via the Dedicated Interconnect and falls back to the internet.

The VPC is in global dynamic routing mode, so Cloud Routers in both regions learn all VPC subnets, but the europe-west1 Cloud Router must explicitly advertise them to London.

Exam trap

The trap here is that candidates assume global dynamic routing automatically ensures all Cloud Routers advertise all VPC subnets to all on-premises peers, but in reality, each Cloud Router must be explicitly configured to advertise the prefixes it learns from the VPC to its BGP neighbors.

How to eliminate wrong answers

Option A is wrong because smaller prefixes are not the issue; Cloud Routers advertise the exact VPC subnet prefixes learned from the VPC, and summarization is not required for correct routing. Option C is wrong because AS path prepending would make routes less preferred, but the question states all BGP sessions are up and routes are being exchanged; prepending would not cause a complete absence of routes, only a preference change. Option D is wrong because MED is a metric used to influence inbound traffic from a single AS; New York routers setting a lower MED for us-central1 routes would not affect London's routing decisions, as MED is not transitive between different AS paths.

Full explanation →
121
MCQhard

Refer to the exhibit. A VM in the my-vpc network is unable to reach an external HTTPS server. What is the most likely cause?

A.The deny-all-egress firewall rule blocks all outbound traffic.
B.The allow-custom-internal rule only allows inbound traffic.
C.No rule allows outbound traffic to port 443.
D.The default-allow-ssh rule has a low priority.
AnswerA

This egress deny rule with priority 1000 blocks all outbound traffic, including HTTPS.

Why this answer

The default VPC configuration includes a deny-all-egress firewall rule with the lowest priority (65535) that blocks all outbound traffic not explicitly allowed. Since no higher-priority rule permits outbound traffic to the external HTTPS server (port 443), the VM's HTTPS requests are dropped by this implicit deny rule, preventing connectivity.

Exam trap

Google Cloud often tests the misconception that a missing allow rule is the direct cause, rather than recognizing the explicit deny-all-egress rule with lowest priority as the actual blocking mechanism.

How to eliminate wrong answers

Option B is wrong because the allow-custom-internal rule (priority 1000) allows inbound and outbound traffic within the VPC using the 'custom' target tag, but it does not affect external HTTPS traffic; the issue is outbound, not inbound. Option C is wrong because while no rule explicitly allows outbound HTTPS, the deny-all-egress rule is the actual blocking mechanism—the absence of an allow rule alone does not cause the block; the explicit deny rule does. Option D is wrong because the default-allow-ssh rule (priority 65534) allows inbound SSH on port 22, but it has no relevance to outbound HTTPS traffic; priority only matters when rules conflict, and this rule does not apply to the egress direction or port 443.

Full explanation →
122
MCQhard

An organization is connecting their on-premises data center to GCP using Dedicated Interconnect with multiple VLAN attachments. They have configured Cloud Router with BGP sessions for each VLAN attachment. They notice that traffic from GCP to on-premises is not load-balanced across the attachments; instead, all traffic uses a single link. What is the most likely cause?

A.Cloud Router's BGP is not configured for multipath; it selects only one best path per prefix.
B.The on-premises router is not advertising the same routes over all BGP sessions.
C.The VLAN attachments have different bandwidths, causing BGP to prefer the higher bandwidth link.
D.The BGP keepalive timers are misconfigured, causing session flapping.
AnswerA

BGP multipath must be enabled to load-balance across multiple equal-cost paths.

Why this answer

Cloud Router uses BGP to exchange routes with the on-premises router. By default, BGP selects only a single best path per prefix based on the lowest MED, weight, local preference, AS-path length, or IGP metric. Without BGP multipath enabled (e.g., 'maximum-paths' or 'bgp multipath' configuration), Cloud Router will not load-balance traffic across multiple VLAN attachments even if multiple equal-cost paths are available.

This causes all traffic to egress through a single link.

Exam trap

The trap here is that candidates often assume BGP automatically load-balances across multiple equal-cost paths, but BGP requires explicit multipath configuration to enable ECMP; otherwise, it selects only one best path per prefix.

How to eliminate wrong answers

Option B is wrong because if the on-premises router were not advertising the same routes over all BGP sessions, Cloud Router would not see multiple paths at all, but the question states that traffic is not load-balanced across the attachments, implying multiple paths are received but not used equally. Option C is wrong because BGP does not consider link bandwidth in its path selection algorithm; bandwidth is not a standard BGP attribute, and Cloud Router does not use bandwidth to influence path preference. Option D is wrong because misconfigured BGP keepalive timers would cause session flapping and intermittent connectivity, not a consistent failure to load-balance across stable sessions.

Full explanation →
123
MCQhard

A media company uses Cloud CDN with signed URLs to distribute premium video content. They need to revoke access for a specific user immediately. Which approach should they take?

A.Use Cloud CDN cache invalidation to remove the user's content
B.Add the user's IP address to a deny list in the load balancer
C.Delete the signed URL key that was used to sign the user's URL
D.Change the signing algorithm to SHA512
AnswerC

Deleting the key invalidates all URLs signed with that key, effectively revoking access.

Why this answer

Signed URLs are based on keys; to revoke access, you can either remove the key (invalidates all URLs signed with that key) or wait for expiration. There is no per-user revocation. The correct approach is to delete or disable the signing key, which invalidates all URLs signed with that key.

Full explanation →
124
MCQhard

A company has a Shared VPC with a host project and several service projects. They want to allow a service project's Network Engineer to create and manage Cloud Load Balancers, but not modify other networking resources in the shared VPC. Which IAM role should be granted at the service project level?

A.Project Editor (roles/editor)
B.Compute Network Admin (roles/compute.networkAdmin)
C.Compute Load Balancer Admin (roles/compute.loadBalancerAdmin)
D.Compute Security Admin (roles/compute.securityAdmin)
AnswerC

This role specifically targets load balancer management.

Why this answer

The Compute Load Balancer Admin role (roles/compute.loadBalancerAdmin) grants permissions to create, update, and delete load balancers. The Network Admin role (roles/compute.networkAdmin) would allow modifying other network resources, which is not desired.

Full explanation →
125
MCQhard

A company has deployed a Cloud VPN tunnel using route-based VPN (using IKEv2) and has configured BGP on the tunnel. The tunnel is up, but the BGP session is not establishing. What is a likely cause?

A.The BGP IP addresses are not reachable over the tunnel
B.IKE version mismatch
C.The pre-shared key is incorrect
D.The Cloud Router is not configured
AnswerA

Even if the tunnel is up, if the BGP IPs are misconfigured or not routed, BGP won't establish.

Why this answer

For route-based VPN tunnels, BGP peering requires that the Cloud VPN gateway and the on-premises router can reach each other's BGP IP addresses. The BGP IPs are typically link-local addresses derived from the tunnel's interface. If the BGP session is not establishing, common issues include incorrect BGP IP configuration, firewall rules blocking BGP (port 179), or the tunnel not passing traffic correctly.

Full explanation →
126
MCQhard

A network engineer is troubleshooting an HA VPN setup between Google Cloud and an on-premises data center. The two tunnels are established, and BGP sessions are up on both tunnels. However, traffic from Google Cloud to the on-premises network is only using one tunnel, even though both BGP sessions are advertising the same routes. What is the most likely cause?

A.The on-premises router is sending different BGP metrics (MED) for the same route on the two BGP sessions.
B.The Cloud Router is not configured for dynamic routing.
C.One of the IPsec tunnels is in a dead state.
D.The on-premises router is setting a higher local preference on one route.
AnswerA

If MED differs, Cloud Router will prefer lower MED, leading to single-path use.

Why this answer

When both BGP sessions are up and advertising the same routes, but traffic only uses one tunnel, the most likely cause is that the on-premises router is sending different Multi-Exit Discriminator (MED) values for the same route on the two BGP sessions. MED is a metric that influences inbound traffic to an AS; a lower MED value is preferred. If one tunnel's BGP update carries a lower MED, Google Cloud's Cloud Router will select that path for all traffic, even though both tunnels are functional.

Exam trap

Google Cloud often tests the distinction between BGP attributes that influence inbound vs. outbound traffic; the trap here is that candidates may confuse MED (inbound metric) with local preference (outbound metric) and incorrectly select Option D, not realizing that local preference set by the on-premises router is not sent to Google Cloud's eBGP peer.

How to eliminate wrong answers

Option B is wrong because Cloud Router is explicitly configured for dynamic routing in an HA VPN setup (BGP sessions are up), so the issue is not a lack of dynamic routing configuration. Option C is wrong because the question states both tunnels are established and BGP sessions are up, so neither IPsec tunnel is in a dead state. Option D is wrong because local preference is used to influence outbound traffic from an AS, not inbound traffic to the on-premises network; Google Cloud's Cloud Router would not consider local preference set by the on-premises router, as local preference is typically only propagated within an AS and not sent to eBGP peers.

Full explanation →
127
Multi-Selecthard

A company has two VPCs in the same project: vpc-a (10.0.0.0/8) and vpc-b (10.0.0.0/8). They plan to peer these VPCs using VPC Network Peering. Which two prerequisites are required for the peering to work? (Choose TWO.)

Select 2 answers
A.The VPCs must have non-overlapping IP CIDR ranges.
B.At least one VM must exist in each VPC before peering.
C.Firewall rules must allow traffic between the peered VPCs.
D.The project must have a Shared VPC host project configured.
E.Both VPCs must be in custom mode.
AnswersA, C

Overlapping IP ranges prevent VPC peering from working.

Why this answer

For VPC peering, the CIDR ranges must not overlap. Additionally, the 'export custom routes' and 'import custom routes' flags must be set correctly if custom routes are needed; but the basic requirement is no overlapping subnets. Also, VMs must have firewall rules allowing traffic.

Full explanation →
128
MCQeasy

A company wants to allow instances in a VPC without external IPs to access Google APIs like BigQuery and Cloud Storage. Which configuration is required?

A.Create a VPC peering with the Google APIs VPC
B.Enable Private Google Access on the subnet
C.Assign external IPs to all instances
D.Configure a Cloud NAT gateway in the region
AnswerB

Private Google Access is a subnet-level setting that allows instances without external IPs to reach Google APIs via internal IP addresses.

Why this answer

Private Google Access enables instances without external IPs to reach Google APIs via internal IP addresses using the private.googleapis.com (199.36.153.8/30) or restricted.googleapis.com (199.36.153.4/30) VIPs. It must be enabled per subnet.

Full explanation →
129
MCQeasy

An organization wants to connect their on-premises network to Google Cloud using Partner Interconnect. Which of the following is a requirement that must be met before the partner can provision the connection?

A.The organization must purchase a cross-connect at a colocation facility.
B.The organization must have a Dedicated Interconnect connection already set up.
C.The organization must have a VLAN attachment created and share the pairing key.
D.The organization must have a Cloud Router configured with BGP sessions.
AnswerC

The VLAN attachment and pairing key are required for the partner to provision.

Why this answer

Partner Interconnect requires the customer to create a VLAN attachment in their Google Cloud project and share the generated pairing key with the service provider. The partner uses this key to provision the connection on their side, ensuring the correct mapping to the customer's VPC. Without the VLAN attachment and pairing key, the partner cannot establish the Layer 2 circuit.

Exam trap

Google Cloud often tests the distinction between the prerequisites for Partner Interconnect versus Dedicated Interconnect, trapping candidates who confuse the cross-connect requirement (Dedicated) with the VLAN attachment and pairing key requirement (Partner).

How to eliminate wrong answers

Option A is wrong because purchasing a cross-connect at a colocation facility is a requirement for Dedicated Interconnect, not Partner Interconnect, where the partner manages the physical infrastructure. Option B is wrong because Dedicated Interconnect is a separate product and is not a prerequisite for Partner Interconnect; they are independent connectivity options. Option D is wrong because a Cloud Router with BGP sessions is configured after the VLAN attachment is created and the partner provisions the connection, not as a prerequisite before provisioning.

Full explanation →
130
MCQhard

A company is migrating on-premises DNS to Google Cloud. They have a hybrid network using Cloud VPN and want to resolve on-premises hostnames from Compute Engine instances without custom scripts. Which service should they use?

A.Use Cloud DNS inbound server policy to forward queries to on-premises DNS.
B.Create a forwarding zone in Cloud DNS and associate it with the VPC.
C.Enable Private Google Access on the VPC subnet.
D.Configure Cloud NAT to forward DNS queries to on-premises DNS servers.
AnswerA

Cloud DNS inbound server policy enables DNS queries from GCP to be forwarded to on-premises DNS servers via VPN or Interconnect.

Why this answer

Cloud DNS inbound server policy allows on-premises DNS servers to receive DNS queries from Compute Engine instances by creating a VPC-scoped policy that forwards queries to the IP addresses of on-premises DNS resolvers over Cloud VPN. This enables hybrid name resolution without custom scripts, as the policy automatically handles the forwarding of DNS requests from Google Cloud resources to the on-premises DNS infrastructure.

Exam trap

Google Cloud often tests the distinction between inbound and outbound DNS policies; the trap here is confusing the direction of DNS resolution, leading candidates to choose a forwarding zone (outbound) when the requirement is for Compute Engine to resolve on-premises hostnames (inbound).

How to eliminate wrong answers

Option B is wrong because a forwarding zone in Cloud DNS is used to forward queries from on-premises to Google Cloud, not the reverse; it resolves Google Cloud private DNS names from on-premises, not on-premises hostnames from Compute Engine. Option C is wrong because Private Google Access enables Compute Engine instances without external IPs to reach Google APIs and services, not to resolve on-premises hostnames. Option D is wrong because Cloud NAT is used for outbound internet connectivity from private instances, not for DNS query forwarding; it does not provide DNS resolution for on-premises hostnames.

Full explanation →
131
MCQhard

You are configuring a Regional Internal HTTP(S) Load Balancer for a service that must only be accessible from within a VPC. The backend is a zonal NEG of Compute Engine instances. The load balancer is not receiving traffic. What is a likely cause?

A.The zonal NEG is in a different zone than the forwarding rule
B.The health check is using TCP but the instances expect HTTP
C.The backend service is in a different region than the forwarding rule
D.The forwarding rule uses an external IP address
AnswerC

Backend service and forwarding rule must be in the same region.

Why this answer

Internal HTTP(S) LB requires an internal forwarding rule in the same region as the backend. The forwarding rule must use an internal IP address, and the backend service must be in the same region.

Full explanation →
132
MCQmedium

Your VPC has instances with internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. You need to ensure that DNS resolution works for instances in the same zone using short names (e.g., 'instance1'). Which condition must be met?

A.Custom DNS must be configured via Cloud DNS.
B.The VPC must have Private Google Access enabled.
C.The instances must be in the same zone and VPC network.
D.The instance must have a network tag 'dns-enabled'.
AnswerC

Internal DNS resolves short names only for instances in the same zone and network.

Why this answer

Google Cloud internal DNS automatically resolves short names for instances within the same zone and network. The instance must be in the same zone and VPC network. No additional configuration is needed as long as instances are in the same zone.

Full explanation →
133
Multi-Selectmedium

A company is planning to connect their on-premises data center to Google Cloud. They require high bandwidth (10 Gbps) and low latency for real-time data replication. They also want a cost-effective solution that supports burstable traffic. Which TWO connectivity options should they consider? (Choose TWO.)

Select 2 answers
A.Classic VPN (route-based VPN)
B.Cloud VPN (IPsec VPN)
C.Partner Interconnect
D.Dedicated Interconnect
E.Direct Peering
AnswersC, D

Offers flexible bandwidth up to 10 Gbps or more via supported partners, with pay-as-you-go pricing suitable for burstable traffic.

Why this answer

Partner Interconnect (Option C) is correct because it provides dedicated, high-bandwidth connections (up to 10 Gbps per circuit) with low latency, suitable for real-time data replication, and supports burstable traffic through a service provider's network, offering a cost-effective alternative to Dedicated Interconnect for enterprises that need flexibility without full physical infrastructure ownership.

Exam trap

Google Cloud often tests the misconception that Cloud VPN or Classic VPN can meet high-bandwidth, low-latency requirements because they are 'VPNs,' but the trap is that these options lack the dedicated physical infrastructure and SLAs needed for real-time replication, whereas Interconnect options provide guaranteed performance.

Full explanation →
134
MCQmedium

Your company is deploying a multi-tier web application on Google Kubernetes Engine (GKE) with a regional cluster. You need to design network policies to allow traffic only from the frontend pods to the backend pods on port 8080. Which of the following is the most secure and recommended approach?

A.Define a Kubernetes NetworkPolicy that allows ingress to backend pods from frontend pods on port 8080.
B.Configure Private Service Connect to restrict access to backend pods.
C.Create VPC firewall rules to allow ingress from frontend pods to backend pods on port 8080.
D.Use Cloud Armor security policies to restrict traffic to backend pods.
AnswerA

NetworkPolicy is the native Kubernetes mechanism for pod-level traffic control.

Why this answer

A Kubernetes NetworkPolicy is the native and most secure way to control pod-to-pod traffic within a GKE cluster. By defining an ingress rule that allows traffic only from frontend pods (selected via pod labels) to backend pods on TCP port 8080, you enforce micro-segmentation at the pod level, which is the recommended practice for multi-tier applications. This approach works regardless of the underlying node or VPC configuration and is fully integrated with GKE's network policies engine (Calico or Cilium).

Exam trap

The trap here is that candidates often confuse VPC firewall rules (which control traffic at the node level) with Kubernetes NetworkPolicy (which controls traffic at the pod level), leading them to choose option C, even though pod IPs are ephemeral and not directly manageable via VPC firewall rules.

How to eliminate wrong answers

Option B is wrong because Private Service Connect is used to expose managed services privately to VPC networks, not to restrict pod-to-pod traffic within a cluster. Option C is wrong because VPC firewall rules operate at the node/VM level, not at the pod level, and cannot distinguish between individual pods running on the same node; they also cannot enforce label-based selection. Option D is wrong because Cloud Armor is a web application firewall (WAF) that protects external HTTP(S) load balancers, not internal pod-to-pod traffic within a GKE cluster.

Full explanation →
135
Multi-Selectmedium

Which THREE factors should be considered when choosing between a global external HTTP(S) load balancer and a regional external HTTP(S) load balancer? (Choose 3.)

Select 3 answers
A.Support for multiple backend types (Compute Engine, GKE, serverless).
B.SSL termination at the edge (global) vs. at the backend (regional).
C.Ability to use health checks.
D.Integration with Cloud CDN.
E.Need for a single anycast IP address worldwide.
AnswersB, D, E

Global terminates SSL at the edge; regional terminates at the backend.

Why this answer

Regional external HTTP(S) load balancers terminate SSL at the backend (the backend service or instance), meaning the encrypted traffic must travel to the backend before decryption. Global external HTTP(S) load balancers terminate SSL at the edge (Google Front End), decrypting traffic at the closest point of presence and forwarding plaintext HTTP to the backend. This architectural difference impacts security, latency, and backend processing requirements, making it a key factor in choosing between the two.

Exam trap

Google Cloud often tests the misconception that SSL termination location is the same for both load balancer types, but the key distinction is that global terminates at the edge (GFE) and regional terminates at the backend, which directly affects security and performance decisions.

Full explanation →
136
Multi-Selectmedium

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They require high availability for the connection. Which TWO of the following are recommended by Google for achieving high availability? (Choose two.)

Select 2 answers
A.Use a single Dedicated Interconnect with double the bandwidth
B.Connect to two different edge availability domains in the same POP
C.Order connections from two different service providers
D.Order two Dedicated Interconnect connections in the same metro
E.Connect to two different Interconnect locations (POPs)
AnswersD, E

Two connections provide link redundancy, even in the same metro.

Why this answer

Google recommends ordering two Dedicated Interconnect connections in the same metro to provide link-level redundancy. Option E is correct because connecting to two different Interconnect locations (POPs) provides site-level redundancy, protecting against a single POP failure. Together, these two approaches ensure high availability for the hybrid connection.

Exam trap

The trap here is that candidates often confuse 'high availability' with 'increased bandwidth' (Option A) or think that connecting to two edge availability domains in the same POP (Option B) is sufficient, when Google actually requires diversity at the POP level for full high availability.

Full explanation →
137
Multi-Selectmedium

Which TWO are valid methods to allow on-premises traffic to reach Google Cloud resources that only have internal (private) IP addresses? (Choose two.)

Select 2 answers
A.Set up Cloud VPN or Interconnect and configure proper routing and firewall rules.
B.Assign public IP addresses to the resources and use firewall rules to allow on-premises traffic.
C.Use Cloud NAT to allow inbound connections from on-premises.
D.Use the default internet gateway route for the VPC.
E.Configure Private Google Access for on-premises hosts.
AnswersA, E

VPN/Interconnect provide direct connectivity to private IPs from on-premises.

Why this answer

Cloud VPN or Interconnect creates a secure, private connection between on-premises and Google Cloud VPCs. By configuring proper routing (e.g., custom static routes or BGP) and firewall rules, on-premises traffic can reach internal-only IP addresses without needing public IPs, as the traffic traverses the private network path.

Exam trap

Google Cloud often tests the misconception that Cloud NAT can handle inbound connections, but it only supports outbound SNAT/DNAT for outbound traffic, not inbound-initiated connections from on-premises.

Full explanation →
138
MCQmedium

A company has a Hybrid Connectivity setup using Cloud VPN with dynamic routing (BGP). They notice that traffic from their on-premises network to Google Cloud is intermittently dropping. The on-premises BGP speaker is sending routes with a higher local preference (200) than the Google Cloud router (default 100). What is the most likely cause of the intermittent drops?

A.AS path prepending is causing route flapping
B.Asymmetric routing is causing traffic to be dropped by stateful firewalls
C.Cloud Router is not configured for ECMP
D.The BGP MED attribute is misconfigured
AnswerB

Higher local preference can cause asymmetric routing, leading to stateful firewall drops.

Why this answer

The on-premises BGP speaker is sending routes with a higher local preference (200) than the default on Cloud Router (100). This makes the on-premises route preferred for return traffic from Google Cloud, but the forward traffic from on-premises may still use the Cloud VPN tunnel. This asymmetry causes stateful firewalls (e.g., on-premises firewall or Google Cloud firewall) to drop packets that do not match an existing session, leading to intermittent drops.

Exam trap

Google Cloud often tests the misconception that BGP attributes like local preference only affect inbound traffic, when in fact local preference influences outbound path selection from the router's perspective, and a mismatch between on-premises and cloud can cause asymmetric routing that stateful firewalls drop.

How to eliminate wrong answers

Option A is wrong because AS path prepending is used to influence inbound route selection by artificially lengthening the AS path, not to cause route flapping; route flapping is typically due to unstable BGP sessions or route withdrawals, not local preference manipulation. Option C is wrong because ECMP (Equal-Cost Multi-Path) is unrelated to the issue; the problem is asymmetric routing due to local preference mismatch, not load balancing across multiple paths. Option D is wrong because MED (Multi-Exit Discriminator) is used to influence inbound traffic from a neighboring AS, not outbound path selection within the same AS; the local preference mismatch is the direct cause of the asymmetry.

Full explanation →
139
MCQhard

An organization is deploying a Shared VPC with one host project and three service projects. Each service project has multiple VPC networks. They want to ensure that only the host project's network admin can create firewall rules affecting the shared VPC network. Which architecture satisfies this requirement?

A.Create the shared VPC network in the host project and grant the network admin IAM role only to host project users.
B.Use VPC Network Peering between each service project and the host project, and allow each service project admin to manage their own firewall rules.
C.Assign the network admin role to users in each service project for the shared VPC network.
D.Create separate VPC networks in each service project and use VPC Network Peering to interconnect them.
AnswerA

Shared VPC firewall rules are managed in the host project, and IAM restricts who can modify them.

Why this answer

In a Shared VPC architecture, the host project owns the shared VPC network, and only IAM roles granted in the host project can manage that network's resources. By creating the shared VPC network in the host project and granting the network admin IAM role exclusively to host project users, you ensure that only those users can create firewall rules for the shared VPC. Service project users cannot modify the shared network's firewall rules because they lack the necessary IAM permissions on the host project.

Exam trap

The trap here is that candidates often confuse VPC Network Peering with Shared VPC, assuming peering provides centralized management, when in fact peering only enables connectivity without any cross-project IAM control over firewall rules.

How to eliminate wrong answers

Option B is wrong because VPC Network Peering does not centralize firewall rule management; each peered network's admin can create firewall rules for their own network, and peering does not allow one side to control the other's firewall rules, so service project admins could still manage their own rules, violating the requirement. Option C is wrong because assigning the network admin role to users in each service project for the shared VPC network would give those service project users the ability to create firewall rules affecting the shared VPC, directly contradicting the requirement that only the host project's network admin can do so. Option D is wrong because creating separate VPC networks in each service project and using VPC Network Peering to interconnect them does not create a shared VPC; each service project would have full control over its own firewall rules, and peering does not centralize rule management, so the requirement is not met.

Full explanation →
140
MCQmedium

An organization has multiple VPCs in Google Cloud that need to communicate with an on-premises network through a single Dedicated Interconnect. All VPCs are in the same project. What is the most efficient way to enable connectivity from all VPCs to on-premises?

A.Create a separate Interconnect for each VPC
B.Create a single VLAN attachment and use it for all VPCs
C.Create a Cloud Router per VPC, each with its own VLAN attachment on the same Interconnect
D.Use VPC Network Peering to connect VPCs and attach one VPC to Interconnect
AnswerC

Each VPC gets its own Cloud Router and VLAN attachment, allowing all to use the same Interconnect.

Why this answer

Each VPC requires its own Cloud Router and VLAN attachment to establish a dedicated BGP session over the same Dedicated Interconnect. This allows multiple VPCs in the same project to share a single physical interconnect while maintaining separate Layer 3 routing domains. A single VLAN attachment cannot be shared across VPCs, as each attachment is associated with exactly one Cloud Router and one VPC.

Exam trap

The trap here is that candidates assume a single VLAN attachment can be shared across multiple VPCs, but in Google Cloud, each VLAN attachment is a per-VPC resource that requires its own Cloud Router and BGP session.

How to eliminate wrong answers

Option A is wrong because creating a separate Interconnect for each VPC is unnecessary and cost-inefficient; a single Dedicated Interconnect can support multiple VLAN attachments. Option B is wrong because a single VLAN attachment is tied to one Cloud Router and one VPC; it cannot be used directly by multiple VPCs. Option D is wrong because VPC Network Peering does not extend the Interconnect connectivity; peering only allows communication between VPCs, but the on-premises network would still only be reachable from the VPC that has the VLAN attachment, unless additional routing is configured.

Full explanation →
141
MCQmedium

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

A.Cloud NAT
B.Private Google Access
C.VPC Service Controls
D.IAM Conditions
AnswerC

VPC Service Controls enforce perimeters around APIs to prevent data exfiltration.

Why this answer

VPC Service Controls allow you to create service perimeters that restrict access to Google Cloud APIs and prevent data exfiltration.

Full explanation →
142
MCQmedium

An engineer is designing a hybrid network with a 10 Gbps Dedicated Interconnect. They require 99.99% availability for the connection. What is the minimum number of VLAN attachments and BGP sessions recommended?

A.2 VLAN attachments, 4 BGP sessions
B.2 VLAN attachments, 2 BGP sessions (one per attachment)
C.2 VLAN attachments, 1 BGP session
D.1 VLAN attachment, 1 BGP session
AnswerB

Two attachments on redundant links provide 99.99% availability.

Why this answer

To achieve 99.99% availability, you need at least 2 VLAN attachments (each on different physical links) and 2 BGP sessions. For higher SLAs, use 2 attachments and 4 BGP sessions.

Full explanation →
143
Multi-Selecthard

A company uses Shared VPC with a host project and multiple service projects. They want to grant a team in a service project the ability to create and manage firewall rules that apply to the shared VPC's subnets. Which THREE IAM roles or permissions are needed? (Choose three.)

Select 3 answers
A.compute.firewalls.create permission on the host project
B.compute.firewalls.delete permission on the service project
C.Compute Security Admin (roles/compute.securityAdmin) on the host project
D.compute.firewalls.update permission on the host project
E.Compute Network Admin (roles/compute.networkAdmin) on the service project
AnswersA, C, D

Explicit permission is needed to create firewall rules.

Why this answer

To manage firewall rules on a shared VPC, the user needs compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete permissions, which are included in the Compute Security Admin role (roles/compute.securityAdmin) at the host project level. Additional roles may be needed depending on organization policies.

Full explanation →
144
MCQhard

An engineer has multiple projects with overlapping IP ranges. They want to create a single Cloud NAT gateway to provide outbound internet access for instances in two different VPCs that are connected via VPC Network Peering. Is this possible?

A.No, each VPC must have its own Cloud NAT gateway
B.Yes, by enabling 'NAT support' on the VPC peering connection
C.No, but you can use a single instance with an external IP as a NAT instance
D.Yes, by configuring the Cloud NAT gateway in one VPC and adding a route in the peered VPC with next hop as the NAT gateway
AnswerA

Cloud NAT is per VPC and per region. It cannot be shared across VPCs, even with peering.

Why this answer

Cloud NAT is a regional resource that belongs to a single VPC network and router. It cannot be shared across VPCs via peering. Each VPC needs its own Cloud NAT gateway.

Peering does not allow using the other VPC's NAT.

Full explanation →
145
MCQmedium

A company runs a microservices application on Google Kubernetes Engine (GKE) with an Envoy sidecar proxy for each service. They want to use Traffic Director to apply traffic policies such as traffic splitting between versions and fault injection. Which API does Traffic Director use to configure Envoy proxies?

A.Traffic Director xDS API
B.gRPC API
C.Kubernetes Ingress API
D.Cloud Endpoints API
AnswerA

xDS (Discovery Service) is the standard API used by Envoy to receive dynamic configuration.

Why this answer

Traffic Director implements the Envoy xDS (Discovery Service) APIs to dynamically configure Envoy sidecar proxies with routing, load balancing, and health checking policies.

Full explanation →
146
MCQhard

A company has a hybrid network with on-premises data center connected to Google Cloud via Dedicated Interconnect. They use Private Google Access for on-premises (on-premises hosts use the external IP addresses of Google APIs via the interconnect). However, they notice that traffic to certain Google APIs is being routed via the internet instead of the interconnect. What is a likely cause?

A.On-premises DNS is not configured to resolve Google API hostnames to the Private Google Access IP address range (199.36.153.4/30).
B.Firewall rules in the VPC are blocking the private API traffic.
C.Cloud NAT is not configured for the on-premises subnet.
D.VPC Flow Logs are not enabled, causing routing misconfiguration.
AnswerA

Without proper DNS, traffic goes to public IPs.

Why this answer

Private Google Access for on-premises requires on-premises DNS to resolve Google API hostnames to the specific IP range 199.36.153.4/30. If DNS resolution returns the public IP addresses instead, traffic will be routed over the internet rather than through the Dedicated Interconnect, even though the interconnect is available. This is because the on-premises hosts will use the public IPs and follow their default route to the internet.

Exam trap

Google Cloud often tests the misconception that firewall rules or Cloud NAT are the primary cause of routing failures in hybrid connectivity, when the real issue is DNS resolution not returning the correct private IP range for Private Google Access.

How to eliminate wrong answers

Option B is wrong because firewall rules in the VPC control traffic that has already entered Google Cloud; they do not affect how on-premises hosts route traffic before it reaches the interconnect. Option C is wrong because Cloud NAT is used for outbound traffic from Google Cloud VPC instances to the internet, not for on-premises traffic accessing Google APIs via Private Google Access. Option D is wrong because VPC Flow Logs are a monitoring feature that captures metadata about network flows; they do not cause or resolve routing misconfigurations.

Full explanation →
147
MCQeasy

A company is designing a VPC for a multi-tier application. The web tier must be accessible from the internet, the app tier only from the web tier, and the db tier only from the app tier. Which combination of firewall rules is appropriate?

A.Ingress allow from web to app, ingress allow from app to db, no rule for web
B.Ingress allow from 0.0.0.0/0 to web, ingress allow from web subnets to app, ingress allow from app subnets to db
C.Ingress allow from 0.0.0.0/0 to web, ingress allow from all subnets to app, ingress allow from app to db
D.Ingress allow from web to app, ingress allow from web to db, ingress allow from app to db
AnswerB

Correctly restricts access at each tier.

Why this answer

It follows the principle of least privilege for a multi-tier VPC. The web tier must be accessible from the internet (0.0.0.0/0) on ingress, the app tier must only accept ingress from the web tier subnets, and the db tier must only accept ingress from the app tier subnets. This ensures that each tier is isolated and only reachable from the immediate upstream tier, which is a fundamental security best practice for multi-tier architectures in Google Cloud.

Exam trap

The trap here is that candidates often confuse 'ingress allow from web to app' with 'ingress allow from web subnets to app', forgetting that firewall rules must specify source CIDR ranges (e.g., subnet IPs) rather than just the tier name, and they may also incorrectly allow direct web-to-db access, thinking it simplifies connectivity without realizing it breaks the isolation requirement.

How to eliminate wrong answers

Option A is wrong because it lacks an ingress rule allowing traffic from the internet (0.0.0.0/0) to the web tier, making the web tier inaccessible from the internet, which violates the requirement. Option C is wrong because it allows ingress from 'all subnets' to the app tier, which would permit traffic from the db tier or other subnets to the app tier, breaking the isolation requirement that the app tier should only be reachable from the web tier. Option D is wrong because it includes an ingress rule allowing traffic from the web tier directly to the db tier, which bypasses the app tier and violates the requirement that the db tier should only be accessible from the app tier.

Full explanation →
148
MCQmedium

An engineer notices that some packets sent from a Compute Engine VM in GCP to an on-premises server via a VPN tunnel are being fragmented. The on-premises server is not receiving the fragmented packets. What is the most likely cause?

A.The VM's MTU is set to 1500
B.Cloud NAT is not configured
C.The VPN tunnel is using UDP encapsulation
D.The on-premises firewall is dropping ICMP
AnswerA

VMs with MTU 1500 may generate packets too large after VPN encapsulation, causing fragmentation. The correct step is to set MTU to 1460 or lower.

Why this answer

GCP uses an MTU of 1460 bytes on VMs, while the internet standard is 1500. If the VPN encapsulates packets, the additional overhead reduces effective MTU. Fragmentation may occur but is often problematic.

The issue is typically due to an MTU mismatch, and setting the VM's MTU to 1460 or lower (e.g., 1400) ensures no fragmentation.

Full explanation →
149
MCQmedium

A company is setting up a Dedicated Interconnect connection between their on-premises network and Google Cloud. They have configured a VLAN attachment and assigned a Cloud Router with BGP sessions. They notice that traffic is being dropped intermittently. The BGP session status shows 'Established' but routes are not being exchanged consistently. What is the most likely cause?

A.Bidirectional Forwarding Detection (BFD) is not enabled on the BGP session
B.The on-premises firewall is blocking BGP port 179
C.The Cloud Router has reached the maximum number of routes
D.The MTU on the VLAN attachment is set too low
AnswerA

Without BFD, BGP may remain Established while the data plane is down, causing dropped traffic.

Why this answer

When BFD is not enabled on a BGP session, the BGP keepalive timers (typically 60 seconds) are used to detect failures, which can cause intermittent traffic drops because BGP does not detect link failures quickly enough. With BFD enabled (default interval of 300ms), failures are detected in sub-seconds, preventing route flapping and ensuring consistent route exchange. The 'Established' BGP state with inconsistent route exchange is a classic symptom of BFD being absent, as routes may be withdrawn and re-advertised due to transient link issues that BGP alone cannot react to fast enough.

Exam trap

Google Cloud often tests the misconception that a BGP session in 'Established' state guarantees stable route exchange, but the trap here is that BFD is required for fast failure detection in cloud interconnect scenarios, and its absence causes intermittent route flapping that does not break the BGP session itself.

How to eliminate wrong answers

Option B is wrong because if the on-premises firewall were blocking BGP port 179, the BGP session would never reach the 'Established' state; it would remain in 'Active' or 'Idle'. Option C is wrong because the Cloud Router maximum route limit (1000 routes by default, expandable) would cause routes to be rejected, not intermittent exchange; the BGP session would still show 'Established' but routes would be missing entirely, not inconsistently exchanged. Option D is wrong because a low MTU on the VLAN attachment would cause packet fragmentation or drops for large packets, but BGP route exchange uses small packets (typically 4096 bytes max for BGP updates) and would not cause intermittent route exchange; MTU issues manifest as connectivity failures for data traffic, not BGP route flapping.

Full explanation →
150
MCQmedium

An engineer is deploying a Regional External HTTP(S) Load Balancer to serve a web application on Compute Engine. They want to maintain the highest availability by automatically rerouting traffic away from unhealthy instances. Which additional configuration is required?

A.Enable connection draining on the backend service
B.Use a global load balancer instead
C.Configure a health check on the backend service
D.Set up a managed instance group with autoscaling
AnswerC

Health checks allow the load balancer to mark instances unhealthy and stop sending traffic.

Why this answer

Health checks are required to detect unhealthy instances. Without them, the load balancer will route traffic to any instance in the backend service. Autoscaling and managed instance groups are not mandatory for basic health checking but are recommended.

Full explanation →
Page 1

Page 2 of 13

Page 3

All pages

12345678910111213

Practice PCNE by domain

Target a specific domain to shore up weak areas.

Configuring Network ServicesManaging, Monitoring, and Optimising Network OperationsImplementing Hybrid InterconnectivityDesigning, Planning, and Prototyping a GCP NetworkImplementing VPC InstancesImplementing network securityImplementing a Virtual Private Cloud
See all domains with question counts →