Knowledge + Practice

Google Professional Cloud Network Engineer (PCNE) — Questions 151–225

961 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 3 of 13

151

MCQmedium

An engineer is configuring a Global HTTPS Load Balancer with a backend service that points to a serverless NEG for Cloud Functions. The health checks are failing. What is the most likely cause?

A.The health check path is incorrect

B.Serverless NEGs do not support health checks

C.The backend service is not associated with the correct URL map

D.The health check protocol is set to HTTP instead of HTTPS

AnswerB

Health checks are not supported for serverless NEGs. They must be disabled or omitted.

Why this answer

Serverless NEGs do not support health checks. The load balancer relies on the underlying Cloud Functions being healthy. Health checks must be disabled for serverless backends.

Full explanation →

152

MCQmedium

A company is using VPC Network Peering between two VPCs. They want to ensure that routes for a specific subnet in VPC A are exported to VPC B. However, VPC B should not export its routes to VPC A. What peering configuration should they set?

A.On VPC A's peering, enable 'Export selected custom routes' and specify the subnet; on VPC B's peering, disable all route export/import

B.On VPC B's peering, enable 'Import custom routes'; on VPC A's peering, disable 'Export custom routes'

C.Enable VPC Network Peering with default settings

D.On VPC A's peering, enable 'Export custom routes'; on VPC B's peering, disable 'Import custom routes'

AnswerB

This option enables import on VPC B's peering, allowing B to accept routes, but disables export on VPC A's peering, so A does not export the subnet. It is the only option that enables import on B.

Why this answer

VPC Network Peering consists of two separate peering connections: one from VPC A to VPC B and another from VPC B to VPC A. To ensure VPC B receives the specific subnet from VPC A, the import setting on VPC B's peering must be enabled to accept routes. Option B enables 'Import custom routes' on VPC B's peering, allowing B to import routes if they are exported by A.

However, it disables 'Export custom routes' on VPC A's peering, which means A will not export its routes. Among the options, only B ensures import is enabled on B, which is necessary for receiving routes. The other options either disable import on B or do not allow selective export.

While B does not fully meet the requirement, it is the closest correct configuration based on the available choices.

Full explanation →

153

Multi-Selecthard

Which THREE are true regarding Cloud HA VPN when used with dynamic routing (BGP)? (Choose three.)

Select 3 answers

A.Cloud HA VPN requires two Cloud Routers in the same region for redundancy.

B.Cloud HA VPN allows custom BGP timers.

C.Cloud HA VPN requires two interfaces per VPN gateway.

D.Cloud HA VPN BGP sessions use link-local addresses (169.254.x.x).

E.Cloud HA VPN supports using multiple tunnels for ECMP.

AnswersC, D, E

Each HA VPN gateway has two external interfaces for redundancy.

Why this answer

Cloud HA VPN requires two interfaces per VPN gateway to provide high availability and redundancy. Each gateway interface connects to a separate Cloud Router, enabling active-active failover and ensuring continuous connectivity if one interface or tunnel fails.

Exam trap

Google Cloud often tests the misconception that Cloud HA VPN requires multiple Cloud Routers for redundancy, when in fact it uses multiple interfaces on a single Cloud Router, and that custom BGP timers are allowed, whereas Google Cloud enforces fixed timers for stability.

Full explanation →

154

MCQmedium

A company wants to expose a web application running on Cloud Run globally with a single anycast IP address, using HTTP(S) load balancing and Cloud CDN for static content. The application should be accessible at https://app.example.com. What is the correct configuration?

A.Create a global SSL Proxy load balancer with a Cloud Run backend bucket.

B.Create a global external HTTP(S) load balancer with a serverless NEG that points to the Cloud Run service.

C.Create a global TCP Proxy load balancer with a hybrid connectivity NEG.

D.Create a regional external HTTP(S) load balancer with a serverless NEG.

AnswerB

Global HTTPS LB with serverless NEG provides global anycast IP, CDN integration, and supports Cloud Run.

Why this answer

Global HTTPS LB with serverless NEG targeting Cloud Run is the best practice for globally exposing serverless workloads with CDN. The other options either lack CDN (SSL Proxy), are regional (regional LB), or use incorrect NEG type (hybrid NEG for on-prem).

Full explanation →

155

MCQhard

Refer to the exhibit. A VM in the default VPC with IP 10.0.0.5 is unable to receive traffic from another VM in the same VPC with IP 10.0.1.5. The firewall rule shown is in place. What is the most likely reason?

A.The source range does not include 10.0.1.5

B.The rule only allows TCP but the traffic is UDP

C.The target service account does not match the VM's service account

D.The priority is too low

AnswerC

The rule only applies to VMs with the specified service account.

Why this answer

The firewall rule shown uses a target service account, which means it applies only to VM instances that are associated with that specific service account. If the VM at 10.0.0.5 has a different service account (or no service account) than the one specified in the rule, the rule will not apply to it, and traffic will be blocked by the implicit deny-all egress/ingress firewall rules. This is the most likely reason the VM cannot receive traffic from 10.0.1.5.

Exam trap

Google Cloud often tests the distinction between target tags and target service accounts, and the trap here is that candidates assume a firewall rule with a broad source range (0.0.0.0/0) will apply to all VMs, overlooking that the target service account field restricts which VMs the rule actually applies to.

How to eliminate wrong answers

Option A is wrong because the source range in the rule is 0.0.0.0/0, which includes all IP addresses, including 10.0.1.5. Option B is wrong because the rule specifies 'tcp' as the protocol, but the exhibit does not indicate that the traffic is UDP; the question states the VM is unable to receive traffic, and if the traffic were UDP, the rule would not match, but the most likely reason given the target service account mismatch is more specific. Option D is wrong because the priority is 1000, which is the default priority; while a lower numerical value means higher priority, a priority of 1000 is not 'too low' to override the implicit deny rules, and the issue is not about priority but about the rule not being applied to the VM due to service account mismatch.

Full explanation →

156

MCQmedium

A network engineer wants to capture all traffic to and from a specific Compute Engine instance for security analysis and forward it to an IDS appliance in another VPC. Which GCP service should they use?

A.VPC Flow Logs

B.Packet Mirroring

C.Firewall Rules Logging

D.Cloud NAT logging

AnswerB

Packet Mirroring forwards actual traffic for deep packet inspection.

Why this answer

Packet Mirroring clones traffic from a source instance and sends it to a collector (IDS appliance) in the same or different VPC. It is designed for security monitoring.

Full explanation →

157

MCQeasy

Which statement about Cloud Armor security policies is true?

A.They can be attached to any GCP resource, including Compute Engine instances.

B.They support both allow and deny actions for incoming requests.

C.They are evaluated after the firewall rules.

D.They cannot be used with internal load balancers.

AnswerB

Rules can allow or deny traffic based on conditions.

Why this answer

Cloud Armor security policies can be attached to HTTPS Load Balancers. They support rules with conditions like IP addresses, geographic regions, and preconfigured WAF rules. They also support rate limiting.

Full explanation →

158

MCQeasy

A company wants to connect their on-premises data center to Google Cloud using a site-to-site VPN with dynamic routing. Which protocol should they use for route exchange?

A.OSPF

B.Static routing

C.BGP

D.RIP

AnswerC

BGP is used for dynamic route exchange in Cloud VPN.

Why this answer

C is correct because Cloud VPN with dynamic routing requires BGP (Border Gateway Protocol) to exchange routes between the on-premises router and the Cloud Router. BGP is the only dynamic routing protocol supported by Google Cloud for site-to-site VPN tunnels, as it allows route advertisement, failover, and policy-based control over multiple tunnels.

Exam trap

The trap here is that candidates often assume OSPF or RIP are valid for dynamic routing in cloud VPNs because they are common in on-premises networks, but Google Cloud exclusively supports BGP for dynamic route exchange over site-to-site VPN tunnels.

How to eliminate wrong answers

Option A is wrong because OSPF is a link-state interior gateway protocol (IGP) that is not supported by Google Cloud VPN; Cloud VPN only supports BGP for dynamic route exchange. Option B is wrong because static routing does not provide dynamic route exchange; it requires manual configuration and cannot adapt to network changes or support failover across multiple tunnels. Option D is wrong because RIP is a distance-vector IGP that is not supported by Google Cloud VPN; it is outdated and lacks the scalability and policy control needed for cloud-to-on-premises connectivity.

Full explanation →

159

MCQhard

A company has two Dedicated Interconnects in different metro regions connecting to Google Cloud. They want to use BGP communities to influence Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises. Which community action can they apply on the on-premises routers?

A.Set BGP community 2:100 on routes to indicate MED change

B.Set BGP community 0:100 on routes to mark them as high preference

C.Set BGP community 79ba:100 on routes from the preferred interconnect

D.Set BGP community 79ba:101 on routes from the preferred interconnect

AnswerC

The community 79ba:100 (lowest RTT) is supported by Google's Cloud Router to influence route preference for outbound traffic.

Why this answer

Google Cloud uses 16-bit ASN format for BGP communities, and the well-known community 79ba:100 (equivalent to 31210:256 in decimal) is a Google-defined community that sets a higher local preference on routes received from the preferred interconnect. This influences Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises, as higher local preference is evaluated before MED or AS-path length.

Exam trap

Google Cloud often tests the specific Google-defined BGP community format (79ba:xxxx) and its meaning, so candidates may confuse it with standard 2-byte communities or assume any community value works, leading them to pick generic options like 2:100 or 0:100.

How to eliminate wrong answers

Option A is wrong because BGP community 2:100 is not a Google-defined community; Google uses communities in the 79ba:xxxx range (31210:xxxx decimal) for route preference, and MED is not directly set via communities in this context. Option B is wrong because community 0:100 is not a valid Google-defined community; Google uses 79ba:100 for high preference, and community 0:100 has no meaning in Google Cloud's BGP implementation. Option D is wrong because community 79ba:101 is used to set a medium preference (lower than 79ba:100), not the highest preference; using it would not make the preferred interconnect the most preferred path.

Full explanation →

160

MCQeasy

A network engineer wants to test reachability between a Compute Engine instance in VPC A and a Cloud SQL instance in VPC B, which are connected via VPC peering. Which Google Cloud tool should be used to check if firewall rules or routes are blocking traffic?

A.Connectivity Tests

B.Packet Mirroring

C.VPC Flow Logs

D.Firewall Insights

AnswerA

Correct: Connectivity Tests analyze the path between source and destination, considering firewall rules, routes, and peering.

Why this answer

Connectivity Tests in Network Intelligence Center allows you to define source and destination and checks configurations like firewall rules, routes, and VPC peering to determine if traffic can flow.

Full explanation →

161

MCQeasy

You need to configure SSL certificates for a Global HTTPS Load Balancer. The certificate should be automatically provisioned and managed by Google. Which type of certificate should you use?

A.Google-managed certificate

B.Compute Engine instance certificate

C.Certificate Authority Service certificate

D.Self-managed certificate

AnswerA

Correct: Google manages provisioning and renewal.

Why this answer

Google-managed certificates are automatically provisioned and renewed for load balancers.

Full explanation →

162

MCQeasy

You are designing a hybrid network using Cloud VPN with dynamic routing (BGP) to connect multiple on-premises sites to Google Cloud. What is a best practice to avoid asymmetric routing when you have multiple VPN tunnels from different on-premises routers?

A.Use static routes instead of BGP to have precise control over path selection

B.Use a different BGP ASN for each on-premises router to ensure uniqueness

C.Configure all on-premises routers with the same BGP ASN and enable ECMP on the Cloud Router

D.Disable ECMP on the Cloud Router to avoid multipath issues

AnswerC

Same ASN allows multiple sessions to be treated as redundant, and ECMP load balances traffic.

Why this answer

Using the same BGP ASN on all on-premises routers and enabling ECMP on the Cloud Router allows the Cloud Router to treat multiple BGP sessions as equal-cost paths. This prevents asymmetric routing by ensuring that return traffic can be load-balanced across any available tunnel, while the same ASN avoids BGP loop-prevention mechanisms that would otherwise reject routes from routers with different ASNs.

Exam trap

The trap here is that candidates mistakenly think different ASNs are required for redundancy, but in fact, using the same ASN is necessary to allow ECMP and avoid BGP loop prevention rejecting routes from multiple on-premises routers.

How to eliminate wrong answers

Option A is wrong because static routes lack dynamic failover and cannot adapt to topology changes, leading to potential black-holing or asymmetric routing when tunnels go down. Option B is wrong because using different BGP ASNs on each on-premises router would cause the Cloud Router to see each path as a separate eBGP route, and the BGP best-path selection would prefer one path over the other, preventing ECMP and potentially causing asymmetric routing. Option D is wrong because disabling ECMP forces the Cloud Router to select a single best path, which can still result in asymmetric routing if the selected path differs from the path used by the on-premises router for return traffic.

Full explanation →

163

MCQhard

A company uses Packet Mirroring to monitor traffic from a set of VMs. They want to ensure that mirrored traffic does not interfere with the production traffic. Which statement is correct?

A.Packet Mirroring uses a separate forwarding path and does not impact the performance of the monitored VMs.

B.If firewall rules block the mirrored traffic, the original traffic will also be blocked.

C.Packet Mirroring cannot capture traffic that is encrypted in transit.

D.Mirrored traffic is always sent over the same network path as the original traffic.

AnswerA

Mirroring is passive and does not affect the original traffic.

Why this answer

Packet Mirroring in Google Cloud (and similar platforms) operates by creating a separate, independent copy of the traffic at the virtual switch level, which is then forwarded to a collector destination without traversing the same network path as the original production traffic. This ensures that the mirrored traffic does not consume bandwidth or processing resources on the monitored VMs, and any issues with the mirroring pipeline (e.g., packet drops) have zero impact on the original traffic flow. The correct answer is A because the separate forwarding path guarantees no interference with production traffic.

Exam trap

Google Cloud often tests the misconception that mirrored traffic shares the same forwarding path as original traffic, leading candidates to incorrectly choose Option D, when in fact the entire purpose of mirroring is to use a separate path to avoid interference.

How to eliminate wrong answers

Option B is wrong because firewall rules apply to the original traffic path; mirrored traffic is a duplicate sent via a separate pipeline, so blocking the mirrored copy does not affect the original traffic. Option C is wrong because Packet Mirroring captures packets at Layer 2/3, including encrypted payloads (e.g., TLS), as it copies the entire packet regardless of encryption; it does not decrypt or inspect the content. Option D is wrong because mirrored traffic is explicitly sent over a different network path (e.g., via a separate VPC or tunnel) to avoid congestion or interference with the original traffic; it does not follow the same route.

Full explanation →

164

MCQmedium

An enterprise is planning a Dedicated Interconnect connection to GCP. They require 99.99% availability and expect to use multiple VLAN attachments. What is the minimum number of 10 Gbps links and VLAN attachments needed to meet the availability goal?

A.Two 10 Gbps links and one VLAN attachment

B.One 100 Gbps link and one VLAN attachment

C.Two 10 Gbps links and two VLAN attachments

D.One 10 Gbps link and one VLAN attachment

AnswerC

Two links in different edge availability domains with two VLAN attachments achieve 99.99% SLA.

Why this answer

To achieve 99.99% availability, Dedicated Interconnect requires at least two links (each 10 Gbps or 100 Gbps) in different edge availability domains, and at least two VLAN attachments.

Full explanation →

165

MCQmedium

A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?

A.The instances are using different service accounts, and the NAT is not configured to allow all.

B.The Cloud NAT's idle timeout is set too low, causing connections to be dropped.

C.The external API endpoint has a rate limit that is being hit by the NAT IP.

D.Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.

AnswerD

Port exhaustion affects VMs that make many outbound connections; increasing NAT IPs provides more ports.

Why this answer

Cloud NAT uses source network address translation (SNAT) and maps internal IPs to the NAT IP using ports. By default, Cloud NAT allocates a range of ports per VM. If the instances are making many connections, they may exhaust the allocated ports.

The symptom that only some instances fail suggests that the failing instances may have run out of ephemeral ports. Option D is correct: Increase the number of NAT IP addresses or increase the minimum ports per VM.

Full explanation →

166

MCQmedium

An organization uses Classic VPN with static routing to connect to GCP. They now need to add a new subnet in GCP and ensure on-premises traffic can reach it without manual updates. What should they do?

A.Add a static route for the new subnet on the Classic VPN tunnel

B.Use Cloud Router with the Classic VPN

C.Create a new Classic VPN tunnel for the new subnet

D.Convert the Classic VPN to HA VPN with dynamic routing (BGP)

AnswerD

HA VPN with BGP automatically advertises new subnets to on-premises, eliminating manual updates.

Why this answer

Classic VPN supports policy-based routing with static routes. To handle new subnets automatically, they should migrate to HA VPN with dynamic routing (BGP), which advertises routes via BGP.

Full explanation →

167

MCQmedium

A network engineer is configuring an HA VPN tunnel pair between an on-premises VPN device and Google Cloud. The engineer wants to use IKEv2 with pre-shared keys. After configuring both ends, the tunnels do not come up. The engineer sees 'IKE SA negotiation failed - no proposal chosen' in the logs. What is the most likely cause?

A.The encryption algorithm (e.g., AES256) or DH group (e.g., 14) does not match between the two ends.

B.The on-premises device is behind NAT and the VPN gateway does not support NAT traversal.

C.The IKE version on the on-premises device is set to IKEv1 while Cloud VPN expects IKEv2.

D.The pre-shared keys on both ends are different.

AnswerA

This is the classic cause of 'no proposal chosen' – the parameters for the IKE SA do not match.

Why this answer

This error typically indicates a mismatch in IKE proposal parameters such as encryption algorithm, integrity algorithm, DH group, or SA lifetime.

Full explanation →

168

MCQmedium

A company needs to connect on-premises to GCP using Dedicated Interconnect with a 10 Gbps link, and they require high availability. They plan to use a single VLAN attachment. What is the best design?

A.Deploy two interconnects with one VLAN attachment each.

B.Deploy one interconnect with one VLAN attachment and a VPN as backup.

C.Deploy one interconnect with one VLAN attachment and use static routing.

D.Deploy two VLAN attachments on the same interconnect with separate BGP sessions.

AnswerA

This provides physical diversity and HA.

Why this answer

For high availability with Dedicated Interconnect, you need two separate physical connections (interconnects) to avoid a single point of failure. Each interconnect must have its own VLAN attachment and BGP session to ensure that if one link fails, traffic can still flow over the other. A single VLAN attachment cannot provide redundancy because it is tied to one physical interconnect.

Exam trap

Google Cloud often tests the misconception that multiple VLAN attachments on the same physical interconnect provide high availability, but in reality, they share the same physical path and single point of failure.

How to eliminate wrong answers

Option B is wrong because using a VPN as backup introduces lower bandwidth and higher latency, and does not meet the requirement for high availability with a 10 Gbps link; the VPN would be a significant bottleneck. Option C is wrong because static routing lacks the automatic failover capabilities of BGP, and a single interconnect is still a single point of failure. Option D is wrong because deploying two VLAN attachments on the same interconnect does not provide physical redundancy; if the interconnect fails, both VLAN attachments go down.

Full explanation →

169

Multi-Selecteasy

A company is designing a VPC routing strategy. Which three are valid route types in Google Cloud VPC? (Choose three.)

Select 3 answers

A.System-generated routes

B.Dynamic routes learned through BGP

C.VPN tunnel routes

D.Custom static routes

E.Peering routes

AnswersA, B, D

Created automatically for subnets and default internet gateway.

Why this answer

Options A, B, and D are correct. System-generated routes are created automatically for subnet ranges and default internet gateway. Custom static routes are manually defined by administrators.

Dynamic routes are learned through BGP from on-premises or other networks. Option C is incorrect because 'VPN tunnel routes' is not a distinct route type; VPN tunnels utilize either static routes or BGP for route advertisement. Option E is incorrect because 'Peering routes' are not a separate type; they are system-generated routes imported from peered VPCs.

Full explanation →

170

MCQmedium

You need to migrate traffic gradually from an old version of a microservice to a new version using Traffic Director. You want to send 10% of traffic to the new version and 90% to the old version. Which configuration should you use?

A.Configure a weighted destination rule in the Envoy route with weights 9:1.

B.Create two separate backend services and use a URL map to distribute traffic.

C.Set circuit breaker thresholds to limit connections to the new version.

D.Use a health check to gradually remove the old version instances.

AnswerA

Traffic splitting is done via weighted destination rules in Envoy.

Why this answer

Traffic Director supports traffic splitting via weighted destination rules in the Envoy configuration. The correct approach is to specify weights for each service version in the route rule. Setting circuit breaker thresholds or using connection draining does not achieve traffic splitting.

Full explanation →

171

MCQmedium

A company is using Partner Interconnect to connect their data center to Google Cloud. They notice that traffic from their on-premises network to a specific subnet in VPC is taking a suboptimal path. Which action should they take to influence the routing preference?

A.Use route priorities on the Cloud Router for the learned routes.

B.Change the VLAN attachment's mode to active-active.

C.Set a lower cost on the Cloud Router interface for the preferred VLAN attachment.

D.Configure BGP MED values on the on-premises router for the prefixes advertised to the Cloud Router.

AnswerD

MED influences the Cloud Router's path selection, giving preference to lower MED.

Why this answer

BGP MED (Multi-Exit Discriminator) is the standard mechanism for influencing inbound traffic path selection when multiple connections exist between two autonomous systems. By setting a lower MED value on the on-premises router for prefixes advertised to the Cloud Router, the on-premises network can signal Google Cloud to prefer that specific VLAN attachment for traffic destined to the subnet, thereby correcting the suboptimal path.

Exam trap

The trap here is that candidates often confuse influencing inbound vs. outbound traffic and incorrectly choose options that affect Cloud Router's outbound path selection (like route priorities or interface cost) instead of using BGP MED to influence the on-premises router's advertisement.

How to eliminate wrong answers

Option A is wrong because route priorities on Cloud Router affect the selection among multiple learned routes for the same prefix within Google Cloud, but they do not influence the path that on-premises routers use to send traffic into Google Cloud; route priorities are for outbound traffic from Google Cloud. Option B is wrong because changing the VLAN attachment's mode to active-active affects high availability and load balancing of traffic across multiple attachments, but it does not influence routing preference or path selection for inbound traffic. Option C is wrong because setting a lower cost on the Cloud Router interface influences the outbound traffic path from Google Cloud to on-premises (via BGP cost metrics), not the inbound path from on-premises to Google Cloud; the question concerns traffic from on-premises to a subnet in VPC, which is inbound to Google Cloud.

Full explanation →

172

MCQmedium

A network engineer needs to verify that traffic from a specific Compute Engine instance can reach a Cloud SQL database in a different VPC. Which Google Cloud tool should be used to test this reachability?

A.Connectivity Tests

B.Cloud Monitoring

C.Network Topology

D.VPC Flow Logs

AnswerA

Connectivity Tests specifically verify reachability and identify blocking rules.

Why this answer

Network Intelligence Center Connectivity Tests allow you to check reachability between source and destination, analyzing firewall rules, routes, and VPC peering. It can pinpoint where traffic is blocked.

Full explanation →

173

MCQeasy

Which of the following is a benefit of using Shared VPC?

A.Centralized network administration and separation from application projects.

B.Lower cost compared to VPC peering.

C.Automatic failover for applications.

D.Reduced latency between instances.

AnswerA

This is the primary benefit of Shared VPC.

Why this answer

Shared VPC allows centralized network administration with separation of application projects.

Full explanation →

174

MCQhard

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

A.The SLA requires two circuits in different metro areas for failover.

B.The on-premises router is not configured to use the passive connection.

C.The passive connection is in a different metro area, causing higher latency.

D.The passive VLAN attachment does not have BGP session configured with Cloud Router.

AnswerD

Without BGP session, the passive connection has no routes to receive traffic. The VLAN attachment must be created and a BGP session established, even if the routes are less preferred via MED.

Why this answer

For failover to work with active-passive, the passive connection must have its own VLAN attachment and Cloud Router BGP session with the same routes, but with a higher MED value to be less preferred. If the VLAN attachment is not created, there is no path.

Full explanation →

175

MCQmedium

A gaming company uses Cloud Armor with an external HTTP(S) load balancer to protect against DDoS attacks. They need to restrict access to the load balancer based on geographic region. What should they configure?

A.Geo-based routing policy on the backend service

B.A firewall rule that blocks IPs from certain countries

C.Geo-match custom rule in Cloud Armor

D.Use Cloud CDN with geo filtering

AnswerC

Cloud Armor rules can filter traffic based on geographic region (e.g., country or continent).

Why this answer

Cloud Armor supports geo-match custom rules that allow you to allow or deny traffic based on the geographic region of the client IP address. When attached to an external HTTP(S) load balancer, these rules are evaluated at the edge before traffic reaches the backend, providing effective geo-based access control against DDoS attacks.

Exam trap

Google Cloud often tests the distinction between Cloud Armor's security policies (which include geo-match rules) and backend service routing policies, leading candidates to confuse geo-based routing with geo-based access control.

How to eliminate wrong answers

Option A is wrong because geo-based routing policy on the backend service is used for directing traffic to different backends based on client location, not for blocking or allowing access at the edge. Option B is wrong because firewall rules operate at the VPC network level and cannot be applied directly to an external HTTP(S) load balancer; they would block traffic after it has already passed through the load balancer, which is ineffective for DDoS protection. Option D is wrong because Cloud CDN with geo filtering is a feature of Cloud CDN that restricts content delivery based on geography, but it does not provide the same granular access control or DDoS mitigation capabilities as Cloud Armor's geo-match rules.

Full explanation →

176

MCQmedium

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

A.Cloud VPN

B.VPC peering

C.Network Connectivity Center

D.Cloud Router

AnswerC

Correct. NCC provides hub-and-spoke connectivity.

Why this answer

Network Connectivity Center (NCC) uses a hub-and-spoke model to connect on-premises networks and VPCs.

Full explanation →

177

MCQmedium

A company is deploying a Global Cloud VPN with multiple tunnels from different Cloud Router instances to the same on-premises peer. The on-premises BGP speaker is configured with multiple peers. How should they configure the BGP ASN on the Cloud Routers to ensure optimal routing?

A.Use different private ASNs for each Cloud Router to differentiate the tunnels.

B.Use the same private ASN for all Cloud Routers in the same region.

C.Assign a unique public ASN to each Cloud Router.

D.Use the same ASN across all Cloud Routers globally.

AnswerB

Same private ASN ensures the on-premises router treats all Cloud Router peers from the same region as one entity, preventing loops and allowing ECMP.

Why this answer

Using the same private ASN on all Cloud Routers in the same region allows the on-premises BGP speaker to treat multiple tunnels from that region as a single BGP session, enabling load balancing and failover without creating BGP path selection issues. This approach aligns with Google Cloud's recommendation for redundant VPN tunnels, where the same ASN ensures the on-premises router sees the Cloud Routers as a single BGP peer, simplifying routing policy and avoiding unnecessary AS path prepending.

Exam trap

The trap here is that candidates often assume each BGP session needs a unique ASN for redundancy, but in Google Cloud's multi-tunnel VPN design, using the same ASN within a region is required to enable proper load balancing and failover without causing BGP path selection conflicts.

How to eliminate wrong answers

Option A is wrong because using different private ASNs for each Cloud Router would cause the on-premises BGP speaker to treat each tunnel as a separate BGP session, potentially leading to suboptimal routing due to AS path length differences and preventing effective load balancing. Option C is wrong because assigning a unique public ASN to each Cloud Router is unnecessary and wasteful; private ASNs (64512-65534) are sufficient for internal BGP peering, and public ASNs are typically reserved for internet-facing connections, not internal hybrid interconnectivity. Option D is wrong because using the same ASN across all Cloud Routers globally can cause BGP to reject routes from multiple peers with the same ASN if the on-premises router has BGP multi-hop or loop prevention enabled, and it does not account for regional routing policies or failover scenarios where distinct regional ASNs are beneficial.

Full explanation →

178

MCQhard

An organization has a Dedicated Interconnect with Cloud Router configured for BGP. The on-premises network advertises a prefix that overlaps with an existing VPC subnet. How does Google Cloud handle the overlapping prefix?

A.It accepts the prefix but static routes have higher priority.

B.It accepts the prefix and gives it higher priority than the VPC subnet.

C.It rejects the prefix and does not install a dynamic route for it.

D.It accepts the prefix and load balances traffic between the two locations.

AnswerC

Google Cloud rejects overlapping prefixes to maintain routing integrity.

Why this answer

When a Dedicated Interconnect with Cloud Router receives a BGP advertisement for a prefix that overlaps with an existing VPC subnet, Google Cloud rejects the prefix and does not install a dynamic route for it. This is because VPC subnet routes always take precedence over dynamically learned routes, and accepting an overlapping prefix would create ambiguity in forwarding decisions. The Cloud Router enforces this behavior to maintain the integrity of the VPC's internal addressing.

Exam trap

The trap here is that candidates often assume BGP routes can override VPC subnet routes due to the dynamic nature of BGP, but Google Cloud enforces a strict priority hierarchy where VPC subnet routes are always preferred over any dynamically learned or static route.

How to eliminate wrong answers

Option A is wrong because static routes do not have higher priority than VPC subnet routes; VPC subnet routes are implicitly created and have the highest priority (0), while static routes have a priority of 1000. Option B is wrong because Google Cloud never gives a dynamically learned BGP route higher priority than a VPC subnet route; the VPC subnet route is always preferred. Option D is wrong because Google Cloud does not load balance traffic between overlapping prefixes; it rejects the overlapping prefix entirely to prevent routing conflicts.

Full explanation →

179

MCQeasy

What is the purpose of a Response Policy Zone (RPZ) in Cloud DNS?

A.To override DNS responses for specified domains (e.g., block or redirect)

B.To route traffic based on geographic location of the requester

C.To enable weighted round-robin load balancing for multiple IPs

D.To create private DNS zones within a VPC

AnswerA

RPZ allows overriding DNS responses for policy enforcement.

Why this answer

RPZ allows you to override DNS responses for specific domains, often used for security (malware filtering) or policy enforcement. It is not for routing traffic, private zones, or load balancing.

Full explanation →

180

Multi-Selecthard

A company has multiple VPCs in different projects and wants to connect them all to a single on-premises data center using a hub-and-spoke model with Network Connectivity Center (NCC). Which THREE components are required for this setup?

Select 3 answers

A.NCC hub

B.Cloud NAT

C.Spokes (VPCs or on-prem networks)

D.Cloud Router

E.VPC peering between spokes

AnswersA, C, D

Correct. The hub is the central point of connectivity.

Why this answer

NCC requires a hub, spokes (VPC spokes or on-prem spokes via interconnect/VPN), and a Cloud Router for dynamic routing.

Full explanation →

181

MCQeasy

A company has a VPC with a subnet in us-central1. They have several private Compute Engine instances (no external IP) that need to download updates from a public repository on the internet. The network engineer has created a Cloud NAT gateway in the same region and attached it to the subnet. However, the instances still cannot reach the internet. The engineer has confirmed that the Cloud NAT gateway is correctly configured and that the subnet's Private Google Access is not relevant for this traffic. What should the engineer check first to resolve the issue?

A.Verify that the default route (0.0.0.0/0) is present in the VPC route table pointing to the internet gateway.

B.Confirm that the Cloud NAT router is configured with the correct network and subnet.

C.Ensure that the Cloud NAT gateway has a static external IP.

D.Check that the firewall rules allow egress traffic for the instances to the internet.

AnswerA

The default route is essential for internet-bound traffic to be routed to the NAT gateway.

Why this answer

Even with a properly configured Cloud NAT, instances require a default route (0.0.0.0/0) in the VPC route table that points to the internet gateway (IGW) to direct outbound traffic to the internet. Cloud NAT translates private IPs to public IPs, but it does not create the route; the route must exist for packets to leave the VPC. Without this route, traffic from the instances to 0.0.0.0/0 will be dropped, as there is no next-hop to forward packets to the internet.

Exam trap

Google Cloud often tests the misconception that Cloud NAT alone provides internet connectivity, but the trap here is that candidates overlook the fundamental requirement of a default route in the VPC route table, assuming NAT configuration is sufficient for outbound traffic.

How to eliminate wrong answers

Option B is wrong because the engineer has already confirmed that the Cloud NAT gateway is correctly configured with the correct network and subnet, so re-checking this is redundant and not the first step. Option C is wrong because Cloud NAT does not require a static external IP; it can use a dynamic IP or a pool of IPs, and the absence of a static IP does not prevent internet access. Option D is wrong because firewall rules are stateful in Google Cloud; if egress traffic is not explicitly blocked by a firewall rule (default allow egress), it is permitted, so checking firewall rules is not the primary issue when the route is missing.

Full explanation →

182

MCQhard

An organization has a hybrid network with multiple VPN tunnels connecting their on-premises network to Google Cloud. They use Cloud Router with BGP to propagate routes. They recently added a new subnet 192.168.100.0/24 in Google Cloud. On-premises devices can reach resources in the new subnet, but Google Cloud resources cannot initiate traffic to certain on-premises hosts in the 10.0.0.0/8 subnet. BGP sessions are all established. What is the most likely cause?

A.The VPC firewall rules are blocking outbound traffic from the new subnet.

B.The on-premises firewall is blocking traffic initiated from the 192.168.100.0/24 subnet because it is not in the permitted list.

C.There is a route conflict between the 192.168.100.0/24 route and an existing route in the on-premises routing table.

D.The on-premises BGP router is not advertising the 10.0.0.0/8 network because a mask mismatch.

AnswerB

On-premises firewalls often have stateful inspection; new subnet traffic may not be allowed.

Why this answer

The issue is that on-premises hosts in 10.0.0.0/8 can be reached from the new Google Cloud subnet (192.168.100.0/24) because BGP routes are propagated, but return traffic initiated from on-premises hosts is blocked by the on-premises firewall. Since BGP sessions are established and routes are exchanged, the problem is not routing but stateful firewall filtering: the on-premises firewall likely has a rule that permits traffic from known subnets but does not include 192.168.100.0/24, so return packets for connections initiated from Google Cloud are dropped.

Exam trap

Google Cloud often tests the distinction between routing (BGP/route tables) and firewall filtering, leading candidates to incorrectly blame route advertisement or VPC firewall rules when the actual issue is a missing permit entry in the on-premises firewall for the new subnet.

How to eliminate wrong answers

Option A is wrong because VPC firewall rules control traffic entering or leaving Google Cloud resources, but the problem states that on-premises devices can reach the new subnet, so outbound traffic from the new subnet is not blocked; the issue is with traffic initiated from Google Cloud to on-premises. Option C is wrong because a route conflict would cause asymmetric routing or unreachability in both directions, but on-premises devices can reach the new subnet, and BGP sessions are established, so there is no route conflict. Option D is wrong because a mask mismatch would prevent the on-premises BGP router from advertising 10.0.0.0/8, but the problem states BGP sessions are all established and on-premises devices can reach the new subnet, implying the 10.0.0.0/8 route is present in Google Cloud; the issue is with return traffic filtering, not route advertisement.

Full explanation →

183

MCQmedium

A company is deploying a multi-tier application on Google Cloud. The frontend tier runs in a managed instance group behind a global external HTTP(S) load balancer. The backend tier runs on Compute Engine instances in a different VPC subnet. The frontend instances must communicate with the backend instances using internal IP addresses only. Which configuration should the network engineer use?

A.Use Cloud NAT to allow the frontend to reach the backend via the internet.

B.Use an internal TCP/UDP load balancer in the backend VPC and configure the frontend to send traffic to the load balancer's internal IP.

C.Place both frontend and backend instances in the same VPC but different subnets, and use firewall rules to allow traffic.

D.Set up VPC Network Peering between the frontend VPC and the backend VPC.

AnswerD

VPC peering enables private IP communication across VPCs without requiring external IPs or gateways, meeting the requirement of internal-only communication.

Why this answer

VPC Network Peering allows two separate VPC networks to communicate using internal IP addresses without traversing the internet or requiring a VPN. Since the frontend and backend are in different VPCs (implied by the need for peering), peering enables direct internal IP connectivity between the frontend instances and the backend instances, satisfying the requirement for internal-only communication.

Exam trap

The trap here is that candidates may assume placing instances in the same VPC (Option C) is the simplest solution, but the question explicitly implies the frontend and backend are in separate VPCs, making VPC Network Peering the correct choice for internal IP communication across VPCs.

How to eliminate wrong answers

Option A is wrong because Cloud NAT is used to allow outbound internet access from instances without external IPs, not for internal communication between VPCs; it would force traffic over the internet, violating the internal IP requirement. Option B is wrong because an internal TCP/UDP load balancer is used to distribute traffic within the same VPC or across peered VPCs, but it does not establish connectivity between separate VPCs on its own; peering is still required for the frontend to reach the load balancer's internal IP. Option C is wrong because placing instances in the same VPC but different subnets would work for internal communication, but the question states the frontend and backend are in different VPCs (implied by the need for a solution), so this option does not apply to the given architecture.

Full explanation →

184

MCQmedium

An engineer runs the command above to check the status of a Dedicated Interconnect VLAN attachment. The state shows DEFECTIVE. The associated interconnect connection is in ACTIVE state. What is the most likely cause?

A.The VLAN ID is already in use on a different attachment on the same interconnect

B.The Cloud Router is not configured with a BGP session for this attachment

C.The maximum number of VLAN attachments for this interconnect has been exceeded

D.The data center power is down

AnswerA

Duplicate VLAN IDs cause the attachment to be DEFECTIVE.

Why this answer

A Dedicated Interconnect VLAN attachment showing DEFECTIVE state while the interconnect connection itself is ACTIVE indicates a configuration conflict at the VLAN level. The most common cause is that the VLAN ID specified for this attachment is already allocated to another VLAN attachment on the same interconnect, as VLAN IDs must be unique per interconnect. This conflict prevents the attachment from establishing proper Layer 2 connectivity, resulting in a DEFECTIVE state.

Exam trap

Google Cloud often tests the distinction between Layer 2 attachment health and Layer 3 BGP session status — candidates mistakenly assume a BGP misconfiguration causes the attachment to be DEFECTIVE, but the attachment state is independent of BGP and reflects only the VLAN-level connectivity.

How to eliminate wrong answers

Option B is wrong because a missing BGP session on the Cloud Router would cause the BGP session to be down or not established, but the VLAN attachment state would still be ACTIVE (or PENDING) — the attachment itself is a Layer 2 construct and does not depend on BGP configuration for its operational state. Option C is wrong because exceeding the maximum number of VLAN attachments would result in a failure to create the attachment or an error during provisioning, not a DEFECTIVE state on an already-created attachment; the attachment would either be rejected or show a different error. Option D is wrong because a data center power outage would affect the interconnect connection itself, causing it to go DOWN or UNAVAILABLE, not remain ACTIVE while only the VLAN attachment shows DEFECTIVE.

Full explanation →

185

MCQhard

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

A.VPC Flow Logs are not enabled

B.One VPC has a more specific route that overrides the peering route

C.The MTU is mismatched between the VPCs

D.Firewall rules are blocking the return traffic

AnswerB

Correct: If one VPC has a more specific route (e.g., via VPN) for the other VPC's subnet, return traffic may go that way, causing asymmetry.

Why this answer

If both VPCs have routes to each other via different paths (e.g., one using peering and the other using a VPN), traffic may take asymmetric paths. VPC peering does not support transitive routing, but misconfigured routes can cause asymmetry.

Full explanation →

186

MCQeasy

Which load balancer type preserves the client source IP address and can be used for TCP/UDP traffic on a specific port, passing traffic through to backend instances without proxy overhead?

A.Regional Internal TCP/UDP Load Balancer

B.Global External TCP Proxy Load Balancer

C.Regional External TCP/UDP Network Load Balancer

D.Global External HTTPS Load Balancer

AnswerC

Correct: pass-through LB preserves client IP.

Why this answer

The Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and handles TCP/UDP traffic.

Full explanation →

187

MCQhard

A company with multiple VPCs in a Shared VPC environment wants to connect their on-premises network to all VPCs with high availability and minimal cost. They already have a Dedicated Interconnect. What is the most efficient solution?

A.Set up Cloud VPN with dynamic routing to each VPC.

B.Create an HA VPN gateway for each VPC and peer with on-prem.

C.Use the existing Dedicated Interconnect to create multiple VLAN attachments, one per VPC.

D.Provision a new Partner Interconnect for each VPC.

AnswerC

VLAN attachments allow a single interconnect to connect multiple VPCs efficiently.

Why this answer

A Dedicated Interconnect can support multiple VLAN attachments (each with a separate VLAN ID and BGP session) to connect to different VPCs in a Shared VPC environment. This approach leverages the existing physical connection, provides high availability through redundant attachments, and minimizes cost by avoiding additional circuits or VPN tunnels.

Exam trap

Google Cloud often tests the misconception that a single Dedicated Interconnect can only connect to one VPC, leading candidates to incorrectly choose VPN-based solutions or additional interconnects.

How to eliminate wrong answers

Option A is wrong because Cloud VPN with dynamic routing would require separate tunnels to each VPC, increasing complexity and cost, and it does not utilize the existing Dedicated Interconnect, which is already paid for. Option B is wrong because creating an HA VPN gateway for each VPC duplicates effort and cost; the Dedicated Interconnect can handle multiple VPCs via VLAN attachments without needing separate VPN gateways. Option D is wrong because provisioning a new Partner Interconnect for each VPC would incur significant additional expense and is unnecessary when the existing Dedicated Interconnect can be extended with VLAN attachments.

Full explanation →

188

Multi-Selectmedium

A company is planning a hybrid cloud connectivity strategy with Google Cloud. They need high bandwidth (10 Gbps) and low latency. They also want to avoid internet transit. Which TWO connectivity options meet these requirements? (Choose 2.)

Select 2 answers

A.CDN Interconnect

B.Partner Interconnect

C.Dedicated Interconnect

D.Direct Peering

E.Cloud VPN

AnswersB, C

Provides high bandwidth via a service provider without internet.

Why this answer

Dedicated Interconnect provides direct, high-bandwidth (up to 80 Gbps per circuit) physical connection with low latency, not over the internet. Partner Interconnect also provides high bandwidth via a service provider, often at 1 Gbps or 10 Gbps, and is not internet-based. VPN uses the internet and does not guarantee bandwidth or low latency.

Full explanation →

189

MCQmedium

A company wants to serve private content from Cloud CDN using signed URLs that expire after 1 hour. Which steps are required to enable this?

A.Set the cache mode to FORCE_CACHE_ALL and enable private access.

B.Pass the signing key in the X-Goog-Signed-URL header on each request.

C.Create a signing key in Cloud CDN, then generate signed URLs with expiration using that key.

D.Enable IAP on the backend and generate signed URLs using the IAP client ID.

AnswerC

Correct: signing keys are created in Cloud CDN, and signed URLs are generated client-side with the key.

Why this answer

Signed URLs require a signing key (created via Cloud CDN backend bucket configuration) and generating URLs programmatically with expiration. Enabling IAP is not required. The key is not passed in the header but as query parameters.

Just setting cache mode does not enable signed URLs.

Full explanation →

190

Multi-Selecthard

An organization needs to deploy a multi-tier web application on Compute Engine. The web tier must be accessible from the internet, while the database tier must only be accessible from the web tier. The security team requires a defense-in-depth approach. Which THREE measures should be implemented? (Choose three.)

Select 3 answers

A.Place web and database instances in the same subnet to minimize latency

B.Use firewall rules to allow ingress from the web subnet to the database subnet on the database port (e.g., 3306)

C.Create separate subnets for web and database tiers

D.Assign external IPs to database instances for easy maintenance

E.Use firewall rules to allow ingress from the internet to the web subnet on port 80/443

AnswersB, C, E

This restricts database access to only the web tier.

Why this answer

Defense-in-depth includes using separate subnets, firewall rules, and possibly service accounts. Tags help target rules. Using separate subnets isolates tiers.

Firewall rules control traffic between tiers. Using service accounts can further restrict access.

Full explanation →

191

MCQhard

A financial services firm needs to connect their on-premises data center to Google Cloud VPC with 50 Gbps of bandwidth and latency under 5 ms. They are in a metropolitan area with a Google Cloud region. They require an SLA of 99.99% and need to support VLAN attachments to multiple VPCs. Which connectivity option should they choose?

A.Direct Peering

B.Dedicated Interconnect

C.Cloud VPN with multiple tunnels and ECMP

D.Partner Interconnect

AnswerB

Dedicated Interconnect provides up to 100 Gbps per circuit, low latency, 99.99% SLA, and supports multiple VLAN attachments to different VPCs.

Why this answer

Dedicated Interconnect is the correct choice because it provides direct, private connections between the on-premises data center and Google Cloud VPC, supporting up to 80 Gbps per interconnect (via 8 x 10 Gbps links) and offering a 99.99% SLA when configured with redundant links. It supports VLAN attachments (VLANs) to multiple VPCs, enabling segmentation across different environments, and meets the sub-5 ms latency requirement within a metropolitan area with a Google Cloud region.

Exam trap

Google Cloud often tests the misconception that Cloud VPN with ECMP can scale to high bandwidths like 50 Gbps, but in reality, Cloud VPN is limited to 3 Gbps per tunnel and aggregate throughput is constrained by the underlying internet path and encryption overhead.

How to eliminate wrong answers

Option A (Direct Peering) is wrong because it is an ISP-based peering arrangement that does not offer an SLA, does not support VLAN attachments to multiple VPCs, and typically provides best-effort bandwidth without guaranteed 50 Gbps or sub-5 ms latency. Option C (Cloud VPN with multiple tunnels and ECMP) is wrong because Cloud VPN is limited to 3 Gbps per tunnel (even with ECMP, aggregate bandwidth is capped at ~10 Gbps) and does not meet the 50 Gbps requirement; it also lacks a 99.99% SLA. Option D (Partner Interconnect) is wrong because it relies on a third-party service provider, which introduces additional latency and does not guarantee the sub-5 ms latency or the 99.99% SLA that Dedicated Interconnect offers directly.

Full explanation →

192

Multi-Selecthard

A company has two Dedicated Interconnect connections in different metro areas to meet the 99.99% SLA. They want to ensure that traffic uses both connections in an active-active manner. Which three configurations are required? (Choose three.)

Select 3 answers

A.Configure BGP on both VLAN attachments with equal MED values.

B.Create a single VLAN attachment shared across both connections.

C.Set the VLAN attachments to use static routing instead of BGP.

D.Attach both VLAN attachments to the same Cloud Router.

E.Create two VLAN attachments, one for each connection.

AnswersA, D, E

Equal MED allows ECMP to distribute traffic across both connections.

Why this answer

For active-active, you need two VLAN attachments (one per connection), both attached to the same Cloud Router, and you must configure BGP on both attachments with the same route preferences (e.g., equal MED) to enable ECMP.

Full explanation →

193

MCQhard

A large enterprise is migrating to Google Cloud and needs to establish connectivity between on-premises and VPCs in two different regions (us-east1 and europe-west1). They have a single Partner Interconnect connection at a co-location facility in New York. They want to use the same interconnect for both regions. Which configuration should they use?

A.Create two VLAN attachments, one for each region, over the same interconnect

B.Create one VLAN attachment and attach it to both VPCs

C.Use HA VPN over the interconnect to connect both regions

D.Create two Cloud VPN tunnels from on-prem to each VPC

AnswerA

VLAN attachments are regional; multiple can share same interconnect.

Why this answer

A is correct because a single Partner Interconnect connection can support multiple VLAN attachments, each associated with a different region. By creating two VLAN attachments over the same interconnect—one for us-east1 and one for europe-west1—the enterprise can route traffic from the on-premises network to both VPCs using the same physical link, leveraging Google Cloud's support for multiple VLAN attachments per interconnect.

Exam trap

Google Cloud often tests the misconception that a single VLAN attachment can serve multiple regions, but in Google Cloud, VLAN attachments are regional resources and cannot be shared across regions.

How to eliminate wrong answers

Option B is wrong because a VLAN attachment is a regional resource that can only be attached to a VPC in the same region; you cannot attach a single VLAN attachment to VPCs in two different regions. Option C is wrong because HA VPN over the interconnect is unnecessary and adds complexity; the interconnect already provides a dedicated, high-bandwidth connection, and using VPN over it would introduce encryption overhead and potential performance degradation without solving the multi-region requirement. Option D is wrong because Cloud VPN tunnels are typically used over the public internet or as a backup, not as a primary solution when a dedicated interconnect is available; moreover, using two VPN tunnels would bypass the interconnect's benefits of lower latency and higher reliability.

Full explanation →

194

MCQmedium

A company has set up an HA VPN tunnel between their on-premises router and a Cloud Router in Google Cloud. The on-premises router establishes BGP sessions to both Cloud Router instances, but the routes learned from one Cloud Router instance are not being received. The other instance works fine. What is the most likely cause?

A.The tunnel is in a failed state

B.The on-premises router has incorrect ASN configured for that BGP session

C.The on-premises router has a firewall blocking BGP updates only on one IP address

D.The Cloud Router is set to advertisement mode 'Custom' and does not advertise all subnets

AnswerC

Correct. A firewall blocking BGP updates on one IP address can prevent route reception while allowing session establishment, because the firewall may be configured to block certain traffic after the initial handshake, or it may block the data plane for that specific IP.

Why this answer

The most likely cause is a firewall blocking BGP updates only on one IP address. In Google Cloud HA VPN, each Cloud Router instance uses a separate BGP IP address for the two tunnels. If a firewall on the on-premises router is blocking BGP traffic (TCP port 179) to one of these IP addresses but not the other, BGP sessions can establish (since session establishment uses a different mechanism or the firewall rule is applied incorrectly to the data plane), but BGP updates carrying routes may be dropped.

This explains why one session receives routes while the other does not. An incorrect ASN would prevent BGP session establishment entirely, which contradicts the stem that states BGP sessions are established. Similarly, a failed tunnel would prevent session establishment, and advertisement mode 'Custom' would affect both sessions equally.

Exam trap

Candidates often assume that BGP session establishment guarantees route exchange. In Google Cloud HA VPN, each tunnel has a separate BGP IP address; a firewall blocking updates on one IP can prevent route reception while sessions remain up. This distinction is commonly tested.

How to eliminate wrong answers

Option A is wrong because a failed tunnel would prevent both BGP sessions from working, not just one, and the question states the other instance works fine. Option C is wrong because a firewall blocking BGP updates on only one IP address would typically affect both TCP port 179 traffic and BGP session establishment, but the symptom here is routes not being received, not session failure, and a firewall would likely block the entire session. Option D is wrong because the Cloud Router's advertisement mode being set to 'Custom' would affect both BGP sessions equally, not selectively cause one to not receive routes while the other works.

Full explanation →

195

MCQmedium

An organization has multiple GCP projects that need to share a common network infrastructure. They want to centralize network administration in a single project while allowing service projects to create their own resources in shared subnets. Which networking approach should they use?

A.Multi-NIC instances in a single project

B.Shared VPC

C.VPC peering between all projects

D.Network Connectivity Center

AnswerB

Shared VPC enables a host project to share subnets with service projects, with centralized network administration.

Why this answer

Shared VPC allows a host project to share subnets with service projects, with IAM controls for centralized administration.

Full explanation →

196

Multi-Selectmedium

A company uses Cloud DNS with a managed zone for 'example.com'. They want to implement a failover routing policy so that if the primary health check fails, traffic is sent to a secondary IP. Which THREE resources need to be configured? (Choose three.)

Select 3 answers

A.A DNS record set of type A with a routing policy

B.A health check for the primary endpoint

C.A network tag on the Compute Engine instances

D.A load balancer to front the endpoints

E.A failover routing policy configured on the record set

AnswersA, B, E

The record set defines the DNS name and routing behavior.

Why this answer

To set up failover routing, you need a health check for the primary endpoint, a DNS record set with a routing policy that specifies the primary and secondary targets, and the routing policy configured with failover type. A network tag is not used in DNS. A load balancer is not required; failover routing can point directly to IP addresses.

Full explanation →

197

MCQmedium

A company is planning a hybrid connectivity setup using HA VPN. They want to ensure high availability by using two Cloud VPN gateways. How many tunnels and external IP addresses are required for the HA VPN to achieve 99.99% SLA?

A.2 external IPs, 4 tunnels

B.4 external IPs, 4 tunnels

C.2 external IPs, 2 tunnels

D.1 external IP, 2 tunnels

AnswerA

Correct. Two gateways with two tunnels each.

Why this answer

HA VPN uses two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP to provide a 99.99% SLA.

Full explanation →

198

Multi-Selectmedium

A network engineer is troubleshooting a VPN tunnel that is up but not passing traffic. The Cloud Router shows that BGP sessions are established, but routes are not being exchanged. Which two should the engineer check? (Choose two.)

Select 2 answers

A.Ensure that the firewall rules in the VPC allow traffic from the on-premises IP ranges.

B.Verify that the Cloud Router is using the correct ASN.

C.Verify that the on-premises VPN device is advertising the correct networks to Cloud Router.

D.Check that the Cloud VPN gateway has the correct pre-shared key configured.

E.Confirm that the VLAN attachment is of type PARTNER_PROVIDER.

AnswersA, C

Even with routes, firewall rules must permit the traffic.

Why this answer

Common issues: incorrect firewall rules blocking the traffic, or the route advertisements are not configured correctly (e.g., not advertising the correct prefixes).

Full explanation →

199

MCQmedium

Refer to the exhibit. What is the purpose of the --enable-private-ip-google-access flag?

A.Enables the subnet to be used for Cloud VPN tunnels.

B.Allows external traffic to reach VMs using private IPs.

C.Enables Cloud NAT on this subnet.

D.Allows VMs to access Google APIs without requiring an external IP.

AnswerD

Private Google Access enables this.

Why this answer

The `--enable-private-ip-google-access` flag, when set to `true` on a subnet, allows VM instances in that subnet to reach Google APIs and services (e.g., Cloud Storage, BigQuery) using their private IP addresses, without requiring an external (public) IP. This works by routing traffic through Google's internal network to the Google API frontend, bypassing the public internet.

Exam trap

Google Cloud often tests the misconception that this flag enables Cloud NAT or provides general internet access, when in fact it only provides access to Google APIs and services, not arbitrary public IPs.

How to eliminate wrong answers

Option A is wrong because Cloud VPN tunnels are configured on the VPC network level or via a Cloud Router, not enabled by a subnet-level flag; the flag does not affect VPN functionality. Option B is wrong because external traffic cannot reach VMs using private IPs without a mechanism like a load balancer or Cloud NAT; this flag controls outbound access from VMs to Google APIs, not inbound external access. Option C is wrong because Cloud NAT is a separate resource configured on a Cloud Router, not enabled by a subnet flag; this flag provides direct private access to Google APIs, not NAT-based internet access.

Full explanation →

200

MCQhard

Refer to the exhibit. An engineer is troubleshooting a dual-tunnel HA VPN. The BGP session on one interface is established (State/PfxRcd 1) but the other is stuck in Active state. What can cause this?

A.The on-premises router does not have a BGP configuration for the second peer IP address (169.254.x.x).

B.The Cloud Router is using the same BGP identifier for both sessions, causing a conflict.

C.The on-premises router is configured with BGP MD5 authentication that only matches the first peer.

D.The MTU on the second tunnel is not matching between the two ends.

AnswerA

If the on-premises router is not expecting a connection from the second peer IP, it will not respond, leaving the Cloud Router in Active state.

Why this answer

In a dual-tunnel HA VPN, each tunnel uses a separate BGP session with its own peer IP address (typically from the 169.254.x.x link-local range). If the on-premises router only has a BGP neighbor statement for the first peer IP, it will ignore incoming BGP packets from the second peer. The Cloud Router sees the session stuck in Active state because it is sending BGP OPEN messages but never receiving a response, as the on-premises router is not listening on that IP.

Exam trap

Google Cloud often tests the distinction between BGP session states — Active specifically means the TCP connection is not being completed by the remote end, often due to missing neighbor configuration or ACL blocking, not authentication or MTU issues.

How to eliminate wrong answers

Option B is wrong because using the same BGP identifier (router-id) for both sessions is allowed in BGP; it does not cause a session to remain in Active state — it may cause a warning or minor issue but not a stuck Active. Option C is wrong because MD5 authentication mismatch would cause the session to fail authentication and likely show a state of Idle or Connect, not Active; Active means the router is listening for a TCP connection that never completes. Option D is wrong because MTU mismatch does not prevent BGP session establishment; it would cause packet fragmentation or drops after the session is up, not keep it in Active state.

Full explanation →

201

MCQeasy

What is the default MTU for Compute Engine virtual machines?

A.1400

B.1500

C.8896

D.1460

AnswerD

1460 is correct; Compute Engine VMs use an MTU of 1460 bytes by default.

Why this answer

Compute Engine instances use an MTU of 1460 bytes by default (the Ethernet maximum 1500 minus the IP/GRE overhead for tunneling). Some instance types support jumbo frames (MTU 8896).

Full explanation →

202

MCQmedium

A company wants to publish a service running on Compute Engine instances in their VPC so that consumers in other VPCs can access it via private IPs without needing VPC peering. Which service should they use?

A.VPC peering

B.Private Service Connect

C.Cloud VPN

D.Cloud NAT

AnswerB

PSC enables publishing services accessible via private endpoints across VPCs.

Why this answer

Private Service Connect allows a producer to publish a service via a private endpoint that consumers can access from their own VPCs without peering.

Full explanation →

203

MCQmedium

A company is using Cloud VPN to connect to Google Cloud. They notice that traffic from their on-premises network to Google Cloud is not being routed correctly after a recent change. On the on-premises router, they verify that the BGP session is established and routes are received. Which step should they take next to troubleshoot?

A.Verify that the routes learned via BGP are being propagated to the VPC network by examining Cloud Router details

B.Check the on-premises firewall logs

C.Disable and re-enable the VPN tunnel

D.Check the tunnel status in Cloud Console

AnswerA

Routes learned via BGP must be propagated to the VPC. Cloud Router shows advertised and learned routes.

Why this answer

Since the BGP session is established and routes are received on the on-premises router, the issue is likely that those routes are not being propagated into the VPC network. Cloud Router acts as the BGP speaker for the VPC; even if the VPN tunnel is up and BGP peering is successful, the learned routes must be advertised into the VPC’s routing tables. Verifying Cloud Router details (e.g., using `gcloud compute routers get-status` or checking the Cloud Console) confirms whether the routes are being accepted and propagated, which directly addresses the routing failure.

Exam trap

Google Cloud often tests the misconception that a working BGP session and tunnel status guarantee correct routing, but the real failure point is the propagation of learned routes into the VPC’s routing tables, which requires explicit verification of Cloud Router’s learned routes and advertisements.

How to eliminate wrong answers

Option B is wrong because on-premises firewall logs would only show dropped or allowed packets at the on-premises side, but the problem is about route propagation within Google Cloud, not packet filtering. Option C is wrong because disabling and re-enabling the VPN tunnel is a disruptive, brute-force action that does not diagnose the root cause of route propagation; the tunnel and BGP session are already established. Option D is wrong because checking the tunnel status in Cloud Console only confirms the VPN tunnel is up, but the tunnel is already established and BGP is up, so this provides no insight into why routes are not being used in the VPC.

Full explanation →

204

MCQmedium

An engineer notices that VPC Flow Logs are enabling on a subnet but only a fraction of traffic is logged. What is the most likely cause?

A.The log export filter is too restrictive

B.Default sampling rate of 50% is applied

C.The subnet has an insufficient sampling rate set to 0.5

D.Flow Logs only log TCP traffic

AnswerB

Default sampling rate is 50%, so half the flows are logged.

Why this answer

VPC Flow Logs use sampling by default (50%) to reduce cost and volume. This means only half of the flows are logged.

Full explanation →

205

MCQeasy

You need to create a serverless Network Endpoint Group (NEG) to attach to a Global HTTPS Load Balancer backend for a Cloud Run service. Which command should you use?

A.gcloud compute backend-services create backend-name --load-balancing-scheme=EXTERNAL --protocol=HTTP --global

B.gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=serverless --cloud-run-service=my-service --region=us-central1

C.gcloud compute instance-groups unmanaged create neg-name --zone=us-central1-a

D.gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=gce-vm-ip-port --zone=us-central1-a

AnswerB

This creates a serverless NEG pointing to the Cloud Run service.

Why this answer

The correct command uses 'gcloud compute network-endpoint-groups create' with the '--network-endpoint-type=serverless' option and specifies the Cloud Run service via '--cloud-run-service'.

Full explanation →

206

Multi-Selecteasy

Which THREE components are part of a typical Cloud Hybrid Networking architecture?

Select 3 answers

A.VPC

B.Cloud Router

C.Cloud Interconnect

D.Cloud CDN

E.Cloud VPN

AnswersB, C, E

Manages BGP sessions for dynamic routing between on-prem and GCP.

Why this answer

Cloud Router is a core component of Cloud Hybrid Networking because it enables dynamic route exchange between a GCP VPC and an on-premises network using BGP. It works with Cloud VPN or Cloud Interconnect to automatically learn and propagate routes, eliminating the need for static route management.

Exam trap

Google Cloud often tests the misconception that a VPC itself is a hybrid networking component, but candidates must remember that hybrid connectivity requires dedicated services like Cloud VPN, Cloud Interconnect, or Cloud Router to bridge the VPC with external networks.

Full explanation →

207

Multi-Selectmedium

A network engineer is configuring a route-based VPN tunnel between an on-premises network and Google Cloud using Cloud VPN. Which two statements are true about route-based VPN compared to policy-based VPN? (Choose two.)

Select 2 answers

A.Route-based VPNs automatically route traffic based on the routing table entries.

B.Route-based VPNs are less flexible than policy-based VPNs for traffic selection.

C.Route-based VPNs support dynamic routing protocols like BGP.

D.Route-based VPNs require static routes to be configured manually.

E.Route-based VPNs require separate security policies for each traffic flow.

AnswersA, C

Traffic is sent through the tunnel if the destination matches a route that points to the tunnel.

Why this answer

Route-based VPNs use routing tables (like BGP) to determine which traffic is sent through the tunnel, and they support dynamic routing protocols like BGP.

Full explanation →

208

MCQhard

A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?

A.Enable MACsec on the Dedicated Interconnect

B.Enable TLS encryption on all applications

C.Use Cloud VPN over the internet instead of Dedicated Interconnect

D.Establish an IPsec VPN tunnel over the Dedicated Interconnect

AnswerA

Provides link-layer encryption with minimal overhead.

Why this answer

MACsec (IEEE 802.1AE) provides Layer 2 encryption on the Dedicated Interconnect link itself, encrypting all traffic between the on-premises router and the Google Cloud edge router without requiring any changes to applications or additional VPN gateways. This meets the encryption requirement with minimal overhead and complexity because MACsec operates transparently at the data link layer, adding negligible latency and no per-packet processing overhead compared to IPsec or TLS.

Exam trap

Google Cloud often tests the misconception that IPsec VPNs are the only way to encrypt traffic over a dedicated connection, but MACsec is the correct choice when the requirement is to minimize overhead and complexity because it operates at Layer 2 with hardware offload.

How to eliminate wrong answers

Option B is wrong because TLS encryption must be implemented per application, requiring application-level changes and configuration, which adds significant complexity and does not encrypt all data in transit (e.g., non-HTTP traffic). Option C is wrong because using Cloud VPN over the internet introduces higher latency, lower reliability, and more operational overhead than Dedicated Interconnect, and it does not leverage the existing dedicated connection. Option D is wrong because establishing an IPsec VPN tunnel over Dedicated Interconnect adds unnecessary encapsulation and encryption overhead at Layer 3, increasing complexity and reducing throughput compared to MACsec's hardware-accelerated Layer 2 encryption.

Full explanation →

209

MCQmedium

A network engineer wants to restrict access to a Cloud Storage bucket from only a specific set of Compute Engine instances in a VPC. The instances have no external IPs. What is the most effective way to enforce this restriction?

A.Assign a unique service account to the instances and use IAM conditions to allow the service account access to the bucket only when connecting from the VPC network.

B.Enable Private Google Access on the subnet and use VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.

C.Configure a firewall rule that allows egress traffic to the Cloud Storage API only from the instances' subnet.

D.Create an IAM condition that restricts access based on the instance's internal IP address range.

AnswerB

VPC Service Controls provide a security perimeter around Google APIs, restricting access from unauthorized networks.

Why this answer

Using Private Google Access with Private Service Connect allows instances to reach Google APIs via internal IPs. By using VPC Service Controls, you can create a service perimeter that restricts access to the Cloud Storage bucket from the specific VPC and projects. This provides a defense-in-depth approach.

Full explanation →

210

MCQmedium

An organization wants to connect its on-premises data center to Google Cloud using Dedicated Interconnect. They require 99.99% availability SLA. Which configuration meets this requirement?

A.A single 10Gbps Dedicated Interconnect connection with one VLAN attachment and one BGP session

B.A single 100Gbps Dedicated Interconnect connection with two VLAN attachments and two BGP sessions

C.Two 10Gbps Dedicated Interconnect connections, each with its own VLAN attachment and BGP session, from the same provider

D.Two Partner Interconnect connections with 99.9% SLA each

AnswerC

Two redundant connections are required for 99.99% SLA.

Why this answer

Dedicated Interconnect offers 99.99% SLA when you have two separate physical connections (each 10Gbps or 100Gbps) from the same provider, each with its own VLAN attachment and BGP session, and they are configured in a redundant manner.

Full explanation →

211

MCQeasy

Which VPC type allows you to specify custom IP ranges and regions for subnets during creation, and does not automatically create subnets in every region?

A.Custom mode VPC

B.Auto mode VPC

C.Legacy Network

D.Shared VPC

AnswerA

Custom mode gives full control over subnet creation and IP ranges.

Why this answer

Custom mode VPCs let you define subnets manually. Auto mode creates a subnet per region automatically.

Full explanation →

212

MCQmedium

A company wants to reduce egress costs for traffic going to Google APIs (e.g., Cloud Storage, BigQuery) from Compute Engine instances. Which configuration should they use?

A.Use VPC Flow Logs to monitor traffic

B.Assign external IPs to the instances

C.Enable Private Google Access on the subnet

D.Set up Cloud NAT for the instances

AnswerC

Correct: Private Google Access routes traffic to Google APIs via internal IPs, free of egress charges.

Why this answer

Private Google Access allows instances without external IPs to reach Google APIs over the internal network, avoiding internet egress charges.

Full explanation →

213

Multi-Selectmedium

An organization needs to monitor and analyze firewall rule activity for security auditing. Which TWO actions should they take? (Choose TWO.)

Select 2 answers

A.Enable Cloud NAT logging.

B.Enable VPC Flow Logs on all subnets.

C.Enable firewall rules logging for the rules to monitor.

D.Use Packet Mirroring to capture all traffic.

E.Export logs from Cloud Logging to BigQuery.

AnswersC, E

Firewall rules logging logs allow/deny events.

Why this answer

Enable firewall rules logging for rules of interest. Export logs to BigQuery for analysis. Cloud Logging captures the logs, and BigQuery allows complex queries.

Full explanation →

214

MCQmedium

An organization wants to serve private content via Cloud CDN, ensuring that only authorized users can access cached objects. They need to generate time-limited access for specific URLs. Which method should they use?

A.Set the Cache-Control header to private

B.Use signed URLs with a private key

C.Use Cloud Armor to restrict access by IP

D.Use signed cookies to restrict access

AnswerB

Correct. Signed URLs provide time-limited access to specific URLs.

Why this answer

Signed URLs allow you to grant time-limited access to specific URLs. Signed cookies are for sets of URLs, and Cloud Armor is for WAF, not authorization.

Full explanation →

215

MCQeasy

Which Google Cloud service allows you to create a hub-and-spoke topology for connecting on-premises networks and VPCs?

A.Cloud VPN

B.Network Connectivity Center

C.VPC Network Peering

D.Cloud Interconnect

AnswerB

NCC is designed for hub-and-spoke connectivity.

Why this answer

Network Connectivity Center (NCC) provides a hub-and-spoke model to interconnect on-premises networks and VPCs centrally.

Full explanation →

216

MCQeasy

What is the maximum number of VLAN attachments that can be configured on a single 10 Gbps Dedicated Interconnect connection?

A.16

B.4

C.2

D.8

AnswerD

8 VLAN attachments per 10 Gbps interconnect.

Why this answer

A single 10 Gbps Dedicated Interconnect connection supports a maximum of 8 VLAN attachments. This limit is defined by Google Cloud's interconnect architecture, where each VLAN attachment consumes a portion of the 10 Gbps bandwidth and is mapped to a unique VLAN ID. The 8-attachment cap ensures predictable performance and avoids oversubscription on the physical link.

Exam trap

The trap here is that candidates often confuse the VLAN attachment limit for Dedicated Interconnect with the higher limits of Partner Interconnect or assume the limit scales linearly with bandwidth, leading them to select 16 or 2 instead of the correct 8.

How to eliminate wrong answers

Option A is wrong because 16 VLAN attachments exceed the maximum of 8 for a 10 Gbps Dedicated Interconnect; this limit is not configurable and is enforced by Google Cloud's resource allocation model. Option B is wrong because 4 VLAN attachments is too low; while a 10 Gbps interconnect can support up to 8 attachments, 4 is not the maximum and reflects a misunderstanding of the scaling limits. Option C is wrong because 2 VLAN attachments is far below the actual limit; this misconception might arise from confusing Dedicated Interconnect with Partner Interconnect, which has different attachment limits per connection.

Full explanation →

217

Multi-Selectmedium

A company needs to connect three VPC networks in separate projects (two in the same organization, one in a different organization) to each other for private IP communication. Which TWO GCP solutions should they consider? (Choose 2.)

Select 2 answers

A.Cloud Interconnect

B.VPC Network Peering hub-and-spoke topology

C.Shared VPC

D.VPC Network Peering

E.Cloud VPN with dynamic routing

AnswersD, E

VPC Network Peering directly connects two VPCs and supports cross-organization peering. A full mesh of peerings can connect all three VPCs, making it a valid solution.

Why this answer

Options D and E are correct for connecting three VPC networks in separate projects, including across organizations. VPC Network Peering (D) directly connects VPCs, allowing private IP communication, but it is non-transitive, so a full mesh of peerings is required for all three VPCs to communicate. Cloud VPN with dynamic routing (E) can also be used to create routed connections between VPCs via Cloud Routers, enabling private IP communication even across organizations, though it involves more overhead.

Option B (hub-and-spoke topology) is incorrect because VPC peering is non-transitive; spokes cannot communicate through the hub without additional routing, so a hub-and-spoke design alone does not enable full connectivity among all three VPCs. Shared VPC (C) is limited to projects within the same organization, and Cloud Interconnect (A) is designed for on-premises to VPC connections, not VPC-to-VPC.

Exam trap

Candidates often assume hub-and-spoke VPC peering allows all spokes to communicate, but peering is non-transitive. For three VPCs to talk, either a full mesh of peerings or a routed solution like Cloud VPN is needed.

Full explanation →

218

MCQeasy

A company wants to connect two VPCs in the same project using VPC Network Peering. Each VPC has non-overlapping subnets. What is the minimum number of peering connections required to enable full bidirectional communication?

A.One peering connection from VPC1 to VPC2.

B.Two peering connections from each VPC to the other (total four).

C.Two peering connections: one from VPC1 to VPC2, and one from VPC2 to VPC1.

D.A Shared VPC with subnetworks from both VPCs.

AnswerC

VPC peering is unidirectional, so two connections are needed for full mesh.

Why this answer

VPC Network Peering requires a peering connection to be established in each direction to enable full bidirectional communication. A single peering connection from VPC1 to VPC2 only allows VPC1 to initiate traffic to VPC2; for VPC2 to initiate traffic back to VPC1, a separate peering connection from VPC2 to VPC1 is needed. Therefore, two peering connections (one from each VPC to the other) are the minimum required.

Exam trap

The trap here is that candidates assume a single peering connection is sufficient because they think of it as a bidirectional link, but VPC Network Peering in Google Cloud requires explicit peering in each direction for full bidirectional traffic flow.

How to eliminate wrong answers

Option A is wrong because a single peering connection from VPC1 to VPC2 is unidirectional in terms of route propagation; without a reciprocal peering from VPC2 to VPC1, VPC2 cannot initiate traffic to VPC1. Option B is wrong because it suggests four connections, which is redundant; only two connections (one in each direction) are needed for full bidirectional communication. Option D is wrong because a Shared VPC is a different architecture that centralizes subnet management, not a method for peering two existing VPCs, and it does not replace the need for peering connections.

Full explanation →

219

MCQhard

A company has a VPC with a subnet in us-central1 (10.0.0.0/16) and a Cloud VPN tunnel to an on-premises network (192.168.0.0/16). They also have a static route for 0.0.0.0/0 internet gateway. On-premises traffic to 10.0.0.0/16 is working. However, traffic from a GCE instance in the VPC to an on-premises IP 192.168.1.10 is timing out. What is the most likely cause?

A.Cloud NAT is not configured for the VPC

B.Missing a custom static route in the VPC for destination 192.168.0.0/16 with next hop VPN gateway

C.The VPN tunnel is down and BGP session is not established

D.Firewall rule does not allow inbound traffic from on-premises to the instance

AnswerB

Without this route, traffic is sent to the internet instead of the VPN.

Why this answer

The VPC has a default route (0.0.0.0/0) pointing to the internet gateway, but no specific route for the on-premises network (192.168.0.0/16). Without a custom static route with next hop set to the VPN gateway, traffic from the GCE instance to 192.168.1.10 will be forwarded to the internet gateway instead of the VPN tunnel, causing a timeout.

Exam trap

The trap here is that candidates assume a working VPN tunnel automatically routes traffic in both directions, but GCP requires explicit static routes for each destination network behind the VPN, even when the tunnel itself is up.

How to eliminate wrong answers

Option A is wrong because Cloud NAT is used to enable outbound internet access for private instances, not for routing traffic to on-premises networks over a VPN; the issue here is routing, not NAT. Option C is wrong because the question states that on-premises traffic to 10.0.0.0/16 is working, which confirms the VPN tunnel and BGP session are established and functional. Option D is wrong because the problem is traffic from the GCE instance to on-premises, not inbound traffic to the instance; firewall rules for inbound traffic would not affect outbound traffic initiated by the instance.

Full explanation →

220

MCQmedium

An engineer needs to monitor the operational status of a Dedicated Interconnect link. Which Cloud Monitoring metric should they use?

A.interconnect/attachment/operational_status

B.interconnect/network/sent_bytes_count

C.interconnect/link/operational_status

D.interconnect/network/received_bytes_count

AnswerC

This metric shows the operational state of the link.

Why this answer

The metric interconnect/link/operational_status reflects if the link is up or down, exactly what is needed to monitor the link status.

Full explanation →

221

MCQhard

A company wants to use BGP AS path prepending to influence traffic from Google Cloud to their on-premises network. They have two Dedicated Interconnect connections. Where should they configure the AS path prepending?

A.On the Cloud Router BGP session.

B.In the VLAN attachment configuration.

C.On the on-premises router by adding extra AS numbers to the AS path.

D.In the Cloud Router as a route policy with set as-path prepend.

AnswerC

AS path prepending is done on the on-premises side to affect inbound traffic from GCP.

Why this answer

AS path prepending is configured on the on-premises router when advertising routes to Google Cloud. The router adds extra AS numbers to make a path less preferred.

Full explanation →

222

MCQeasy

Refer to the exhibit. A network engineer is unable to SSH to instance-1 using IAP TCP forwarding. What is the most likely reason?

A.IAP TCP forwarding is not enabled for the project.

B.The instance does not have the 'ssh-iap' tag that the firewall rule applies to.

C.The instance's service account does not have the necessary IAP permissions.

D.SSH keys are not configured on the instance.

AnswerB

The firewall rule only applies to instances with tag 'ssh-iap'.

Why this answer

The exhibit shows a firewall rule that allows IAP TCP forwarding traffic from the IAP source range (35.235.240.0/20) to instances with the network tag 'ssh-iap'. Since instance-1 lacks this tag, the firewall rule does not apply, and SSH traffic from IAP is blocked. Without the tag, the instance's firewall policy drops the forwarded TCP connections, preventing SSH access.

Exam trap

Google Cloud often tests the distinction between IAM permissions (who can initiate the tunnel) and firewall rules (what traffic is allowed to reach the instance), leading candidates to incorrectly choose IAM-related options when the real issue is a missing network tag on the instance.

How to eliminate wrong answers

Option A is wrong because IAP TCP forwarding is enabled at the project level by default when IAP is activated; the exhibit does not indicate it is disabled, and the issue is specifically about the instance not matching the firewall rule's target tag. Option C is wrong because the instance's service account permissions for IAP (e.g., roles/iap.tunnelResourceAccessor) control authorization to initiate the tunnel, not the firewall rule that allows the forwarded traffic to reach the instance; the problem here is a network-level filter, not IAM. Option D is wrong because SSH keys are required for authentication once the SSH connection reaches the instance, but the failure occurs before that stage—the firewall is dropping the traffic, so SSH keys are irrelevant to the connectivity issue.

Full explanation →

223

Multi-Selecthard

A company wants to optimize costs for egress traffic from Compute Engine instances to the internet. They are considering using Cloud CDN and Private Google Access. Which TWO statements correctly describe how these services can reduce egress costs?

Select 2 answers

A.Cloud CDN reduces egress costs by serving cached content from edge locations closer to users.

B.Cloud CDN requires a global load balancer to function.

C.Private Google Access eliminates the need for a NAT gateway.

D.Cloud CDN eliminates all egress costs for cached content.

E.Private Google Access reduces egress costs by allowing VMs to access Google APIs using internal IPs, avoiding internet egress charges.

AnswersA, E

Correct: CDN reduces origin egress.

Why this answer

Cloud CDN caches content at edge locations, reducing the amount of egress from the origin. Private Google Access allows VMs with internal IPs to access Google APIs without using public IPs, thus avoiding internet egress charges for API calls.

Full explanation →

224

MCQeasy

A company wants to expose a web application running on Cloud Run globally with the lowest latency and automatic SSL termination. Which load balancer should they use?

A.Regional Internal HTTP(S) Load Balancer

B.Global HTTPS Load Balancer

C.Regional External HTTP(S) Load Balancer

D.Global SSL Proxy Load Balancer

AnswerB

Correct choice: supports HTTP(S) traffic, serverless NEGs, global anycast, and SSL termination.

Why this answer

Global HTTPS Load Balancer supports serverless NEGs for Cloud Run and provides global anycast IP, automatic SSL, and integration with Cloud CDN.

Full explanation →

225

MCQhard

An engineer configures a Global HTTPS Load Balancer with a backend service pointing to an instance group. The health check is set to HTTP on port 80, check interval 5s, timeout 5s, healthy threshold 1, unhealthy threshold 1. After deployment, instances are marked unhealthy despite the application responding correctly on port 80. What is the most likely cause?

A.The health check is using HTTPS but the instance expects HTTP

B.The unhealthy threshold is set too high

C.The health check is not configured with a host header

D.The health check timeout is equal to the check interval

AnswerD

Timeout (5s) equals interval (5s); timeout must be less than interval.

Why this answer

With timeout equal to check interval, the health check may not have enough time to complete before the next check starts, causing failures. The timeout should be less than the interval.

Full explanation →

Page 3 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCNE by domain

Target a specific domain to shore up weak areas.

Configuring Network Services Managing, Monitoring, and Optimising Network Operations Implementing Hybrid Interconnectivity Designing, Planning, and Prototyping a GCP Network Implementing VPC Instances Implementing network security Implementing a Virtual Private Cloud

See all domains with question counts →