Knowledge + Practice

Google Professional Cloud Network Engineer (PCNE) — Questions 226–300

961 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 4 of 13

226

MCQmedium

Your company has a VPC with two subnets: 10.0.1.0/24 in us-central1 and 10.0.2.0/24 in us-east1. They have a Cloud VPN tunnel to the on-premises data center using dynamic routing (BGP). The Cloud Router was created in the us-central1 region with default settings. On-premises hosts can successfully communicate with instances in the 10.0.1.0/24 subnet, but cannot reach instances in the 10.0.2.0/24 subnet. All instances have appropriate firewall rules allowing traffic from on-premises. The BGP session is established and routes from on-premises are received in Cloud Router. What is the most likely reason for the issue?

A.Cloud Router by default only advertises subnets in its own region.

B.The firewall rules in us-east1 are blocking incoming traffic from on-premises.

C.The BGP session is down for the us-east1 region.

D.The VPN tunnel is only configured to route traffic for us-central1.

AnswerA

Subnets outside the router's region are not advertised unless 'Advertise all subnets' is enabled.

Why this answer

Cloud Router with default settings only advertises subnets that are in the same region as the Cloud Router itself. Since the Cloud Router was created in us-central1, it only advertises the 10.0.1.0/24 subnet to the on-premises BGP peer. The 10.0.2.0/24 subnet in us-east1 is not advertised, so on-premises hosts have no route to it, even though the BGP session is up and firewall rules are correct.

Exam trap

The trap here is that candidates assume Cloud Router automatically advertises all VPC subnets, but the default regional mode restricts advertisements to the router's own region, which is a common misconfiguration in multi-region VPN designs.

How to eliminate wrong answers

Option B is wrong because the question explicitly states that appropriate firewall rules allow traffic from on-premises, so firewall blocking is not the issue. Option C is wrong because the BGP session is established and routes from on-premises are received, indicating the session is up; Cloud Router does not have per-region BGP sessions. Option D is wrong because the VPN tunnel is a single tunnel using dynamic routing (BGP), and the tunnel itself does not filter which subnets are advertised; the Cloud Router's advertisement settings control route propagation.

Full explanation →

227

MCQeasy

A developer wants to SSH into a Compute Engine instance that has no public IP. Which service should they use?

A.Direct Peering.

B.Cloud NAT.

C.Identity-Aware Proxy (IAP) TCP forwarding.

D.Cloud VPN.

AnswerC

IAP allows SSH access without a public IP.

Why this answer

Identity-Aware Proxy (IAP) TCP forwarding allows secure, authenticated, and authorized SSH access to Compute Engine instances that have no public IP addresses. It works by establishing a tunnel through the IAP service, which proxies the SSH connection over HTTPS (port 443) to the instance's internal IP, eliminating the need for a public IP or bastion host.

Exam trap

Google Cloud often tests the misconception that Cloud NAT or Cloud VPN can provide inbound SSH access to private instances, but Cloud NAT is outbound-only and Cloud VPN requires a routable private IP and does not include IAM-based authentication, making IAP TCP forwarding the only correct choice for secure, authenticated SSH without a public IP.

How to eliminate wrong answers

Option A is wrong because Direct Peering is a network connectivity option that connects your on-premises network to Google Cloud via a direct physical connection, but it does not provide a mechanism for SSH access to instances without public IPs; it still requires routing and firewall rules, not a proxy service. Option B is wrong because Cloud NAT provides outbound internet connectivity for private instances (e.g., for software updates) but does not allow inbound SSH connections; it translates private IPs to a public IP for outbound traffic only. Option D is wrong because Cloud VPN creates an encrypted tunnel between your on-premises network and VPC, but it requires the instance to have a private IP reachable via VPN and does not provide the authentication or authorization layer that IAP TCP forwarding offers for SSH access.

Full explanation →

228

MCQhard

A company has two VPCs connected via VPC Network Peering. Traffic from an instance in VPC A to an instance in VPC B is failing. Connectivity Tests show that the expected route exists and firewall rules allow the traffic. What is a possible cause?

A.VPC Flow Logs are disabled

B.The MTU of the instances is set to 1500

C.The VPC peering is not in active state

D.Asymmetric routing due to conflicting routes

AnswerD

Asymmetric routing can break connections if the return path is different.

Why this answer

Asymmetric routing can occur when a packet goes from A to B via peering, but the return packet takes a different path (e.g., through a VPN) due to route priorities. This can result in dropped packets.

Full explanation →

229

MCQmedium

A network engineer is designing a VPC with custom subnet mode. They need to allocate IP addresses for three tiers: web (100 instances), app (200 instances), and db (50 instances). The VPC will be in the us-central1 region. Which subnet plan is most cost-effective and scalable?

A.Use one subnet per zone: us-central1-a: 10.0.0.0/22, us-central1-b: 10.0.4.0/22, us-central1-c: 10.0.8.0/22

B.Create two subnets: 10.0.1.0/24 (web+app) and 10.0.3.0/24 (db)

C.Create one subnet 10.0.0.0/20 and use network tags to isolate tiers via firewall rules

D.Create three subnets: 10.0.1.0/24 (web), 10.0.2.0/23 (app), 10.0.4.0/26 (db)

AnswerD

Adequate sizes, separate subnets provide security and flexibility.

Why this answer

It allocates IP addresses efficiently for each tier: a /24 (256 IPs) for web (100 instances), a /23 (512 IPs) for app (200 instances), and a /26 (64 IPs) for db (50 instances). This minimizes wasted IP space while providing room for growth, and using separate subnets per tier allows granular firewall rules and routing. In a custom VPC, this design is both cost-effective (no over-provisioning) and scalable (each tier can expand within its subnet).

Exam trap

Google Cloud often tests the misconception that larger subnets are always better for scalability, but the trap here is that over-provisioning IPs (e.g., /22 or /20) wastes address space and can lead to higher costs or management overhead, whereas right-sizing subnets per tier with room for growth is the most cost-effective and scalable approach.

How to eliminate wrong answers

Option A is wrong because using three /22 subnets (each with 1024 IPs) across three zones wastes significant IP address space for the given instance counts, and the question does not require zonal separation for tiers; this design is not cost-effective. Option B is wrong because combining web and app into a single /24 (256 IPs) cannot support 300 total instances (100 web + 200 app) without IP exhaustion, and the db /24 is also over-provisioned for 50 instances. Option C is wrong because a single /20 subnet (4096 IPs) is massively over-provisioned for only 350 instances, and while network tags can isolate traffic, they do not provide the subnet-level segmentation needed for scalable tier management; this design wastes IPs and is not cost-effective.

Full explanation →

230

Multi-Selectmedium

A company wants to set up a Regional Internal HTTP(S) Load Balancer to serve an internal web application. Which two components are required? (Choose two.)

Select 2 answers

A.Cloud CDN

B.An SSL certificate

C.An Envoy-based proxy

D.A global forwarding rule

E.Backend service with a NEG of type GCE_VM_IP_PORT or GCE_VM_IP

AnswersC, E

Correct: Internal HTTP(S) LB uses Envoy proxy.

Why this answer

Regional Internal HTTP(S) LB requires an Envoy-based proxy and a backend service with a NEG of type GCE_VM_IP_PORT or GCE_VM_IP.

Full explanation →

231

MCQeasy

A company wants to migrate a legacy application to Google Cloud that requires low-latency communication with on-premises databases. The application is latency-sensitive and must use private IP addresses only. Which hybrid connectivity solution should they choose?

A.Partner Interconnect

B.Cloud VPN

C.Carrier Peering

D.Direct Peering

AnswerA

Partner Interconnect provides dedicated, low-latency private connectivity.

Why this answer

Partner Interconnect is the correct choice because it provides a dedicated, high-bandwidth connection with low latency, supports private IP addresses, and meets the requirement for latency-sensitive communication with on-premises databases. Unlike other options, it offers a Service Level Agreement (SLA) for uptime and performance, ensuring consistent low-latency connectivity.

Exam trap

Google Cloud often tests the misconception that Cloud VPN is sufficient for low-latency requirements, but the trap here is that VPNs introduce encryption overhead and rely on the public internet, which cannot guarantee the low latency and private IP addressing needed for latency-sensitive applications.

How to eliminate wrong answers

Option B (Cloud VPN) is wrong because it uses the public internet with IPsec encryption, which introduces higher latency and jitter, making it unsuitable for latency-sensitive applications. Option C (Carrier Peering) is wrong because it provides connectivity to Google Cloud through a carrier's network but does not offer a private connection with guaranteed low latency or an SLA, and it may still traverse the public internet. Option D (Direct Peering) is wrong because it is designed for exchanging traffic between Google and a customer's network at an edge location, but it does not support private IP addresses and lacks an SLA, making it inappropriate for latency-sensitive hybrid connectivity.

Full explanation →

232

MCQmedium

Refer to the exhibit. Users report that HTTP (port 80) traffic is still reaching instances in my-vpc despite the deny-all rule. What is the most likely reason?

A.The allow-ssh rule has priority 1000 and is evaluated before the deny rule.

B.A default firewall rule allowing HTTP exists with a higher priority.

C.The deny-all rule does not specify target tags.

D.The deny-all rule has priority 2000, which is higher than the allow rule.

AnswerB

The default-allow-http rule (priority 1000) allows HTTP before the deny-all (priority 2000) is evaluated.

Why this answer

In Google Cloud Platform (GCP), firewall rules are evaluated in order of priority, with lower numbers having higher priority. The default-allow-http rule has a priority of 1000, which is higher (lower number) than the deny-all rule's priority of 2000. Therefore, HTTP traffic is allowed by the default rule before the deny rule is evaluated, causing HTTP traffic to still reach instances.

Exam trap

Google Cloud often tests the misconception that higher priority numbers mean higher precedence, but in GCP firewall rules, lower priority numbers are evaluated first, so a deny rule with a higher priority number (e.g., 2000) is actually evaluated after an allow rule with a lower priority number (e.g., 1000).

How to eliminate wrong answers

Option A is wrong because priority values in GCP firewall rules are evaluated with lower numbers having higher priority, not higher numbers; the allow-ssh rule (priority 1000) is actually evaluated before the deny rule (priority 2000), but it only permits SSH traffic, not HTTP. Option C is wrong because target tags are not required for a deny-all rule to function; a deny-all rule without target tags applies to all instances in the VPC, but it is still overridden by higher-priority allow rules. Option D is wrong because priority 2000 is lower (not higher) than priority 1000; the deny-all rule has a lower priority, meaning it is evaluated after the allow rule, so HTTP traffic is allowed first.

Full explanation →

233

Multi-Selecthard

A network engineer is configuring HA VPN between GCP and an on-premises network. They need to ensure that the VPN tunnels are established and BGP sessions are up. Which THREE steps are required? (Choose 3.)

Select 3 answers

A.Create an HA VPN gateway with two interfaces and two external IPs.

B.Configure firewall rules to allow IKE traffic.

C.Set up Cloud NAT for internet access.

D.Create two VPN tunnels, one for each interface.

E.Create a Cloud Router to manage BGP sessions.

AnswersA, D, E

Required for HA VPN.

Why this answer

To establish HA VPN, you must create the VPN gateway with two interfaces and two external IPs, configure a Cloud Router to handle BGP, and create two VPN tunnels (one for each interface) with IKEv2 configuration. Pre-shared keys or certificates are part of tunnel configuration, but the key step is creating the tunnels.

Full explanation →

234

Multi-Selectmedium

You are configuring a Global External HTTPS Load Balancer. Which TWO components are required to route traffic to a Cloud Run service via a serverless NEG? (Select two.)

Select 2 answers

A.Serverless NEG

B.Backend service

C.Health check

D.Target proxy

E.URL map

AnswersA, B

Required: defines the Cloud Run service as a backend.

Why this answer

A serverless NEG is a backend that points to a Cloud Run service, and a backend service is needed to define health checks and other settings.

Full explanation →

235

MCQeasy

A company wants to connect two VPC networks using VPC Network Peering. What is required for this setup?

A.A Cloud VPN tunnel must be established.

B.Both VPCs must belong to the same organization.

C.The VPCs must have non-overlapping IP ranges.

D.Both VPCs must be in the same region.

AnswerC

Correct. The VPCs must have non-overlapping IP ranges to avoid routing conflicts and allow direct communication.

Why this answer

VPC Network Peering requires that the IP ranges of the peered networks do not overlap. Option C is correct. Option A is wrong because a Cloud VPN tunnel is not required for peering; peering is a direct connection.

Option B is wrong because VPCs can be in different organizations and still be peered. Option D is wrong because VPCs can be in different regions.

Full explanation →

236

MCQmedium

A company has a GKE cluster that needs to be accessed by pods and services. The cluster is deployed in a VPC with a primary subnet 10.0.0.0/16. To avoid IP exhaustion, they want to use separate IP ranges for pods and services. Which approach should they take?

A.Use a separate VPC for the GKE cluster with its own subnet.

B.Create secondary IP ranges on the subnet for pods and services.

C.Use the primary subnet range for pods and create a separate subnet for services.

D.Use alias IP ranges on the VM instances for pods and services.

AnswerB

Secondary ranges are the standard way to allocate IPs for GKE pods and services.

Why this answer

GKE supports secondary IP ranges for pods and services, which are defined on the subnet and allocated separately from the primary range.

Full explanation →

237

MCQhard

An engineer needs to create a firewall rule that applies only to instances with the tag 'web-server' in a specific VPC network. The rule should allow ingress from any source on TCP port 80. Which combination of fields must be set in the gcloud command?

A.--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-tags=web-server --source-tags=0.0.0.0/0

B.--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-tags=web-server --source-ranges=0.0.0.0/0

C.--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-service-accounts=web-server@project.iam.gserviceaccount.com

D.--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --source-tags=web-server

AnswerB

Correct. This applies the rule to instances with tag web-server, allowing TCP 80 from any source.

Why this answer

To target instances by tag, use --target-tags. For source, --source-ranges (any source: 0.0.0.0/0). For protocol/port, --allow tcp:80.

Network is specified with --network. Direction is implied by 'ingress'.

Full explanation →

238

MCQeasy

A company wants to connect an on-premises network to Google Cloud using Cloud VPN. The on-premises network has a single subnet and no dynamic routing capabilities. The company needs a simple, low-cost solution. Which VPN configuration should they choose?

A.Classic VPN with route-based configuration

B.HA VPN with dynamic routing (BGP)

C.HA VPN with static routing

D.Classic VPN with policy-based configuration

AnswerA

Classic VPN route-based supports static routing without BGP, ideal for simple setups.

Why this answer

Classic VPN with route-based configuration is the correct choice because the on-premises network lacks dynamic routing capabilities and requires a simple, low-cost solution. Route-based VPNs use static routes and do not require BGP, making them ideal for environments without dynamic routing support. Classic VPN is the legacy, lower-cost option compared to HA VPN, and route-based configuration allows traffic to be forwarded based on routing table entries rather than policy-based selectors.

Exam trap

Google Cloud often tests the misconception that HA VPN is always superior, but the trap here is that HA VPN is unnecessary and more expensive for a simple, single-subnet network without dynamic routing, leading candidates to overlook the simpler Classic VPN option.

How to eliminate wrong answers

Option B is wrong because HA VPN with dynamic routing (BGP) requires BGP support on the on-premises side, which the company does not have, and it is more complex and costly than needed. Option C is wrong because HA VPN with static routing, while technically possible, is overkill for a simple, low-cost solution; HA VPN is designed for high availability and incurs higher costs and complexity than Classic VPN. Option D is wrong because Classic VPN with policy-based configuration requires defining traffic selectors (source/destination subnets and protocols), which adds complexity and is less flexible than route-based configuration; route-based is simpler and more suitable for a single-subnet network.

Full explanation →

239

MCQmedium

A company wants to serve global static content from a Cloud Storage bucket. They need low latency worldwide and SSL termination at the edge. Which solution should they choose?

A.Use a TCP/UDP network load balancer with the bucket as backend.

B.Configure a global external HTTP(S) load balancer with a backend bucket.

C.Deploy an internal TCP/UDP load balancer with the bucket as backend.

D.Set up Cloud CDN directly on the bucket without a load balancer.

AnswerB

This provides global anycast IP, SSL termination, and integrates with Cloud CDN.

Why this answer

A global external HTTP(S) load balancer with a backend bucket is the correct choice because it provides SSL termination at the edge (using Google Front Ends) and routes traffic over Google's global network to the nearest Cloud Storage bucket, ensuring low latency worldwide. The HTTP(S) load balancer supports global anycast IP addresses and integrates natively with Cloud Storage backends, making it ideal for serving static content globally.

Exam trap

Google Cloud often tests the misconception that Cloud CDN alone can provide SSL termination at the edge, but in reality, Cloud CDN requires a load balancer (HTTP(S) or external) to terminate SSL and route traffic, as the bucket's native HTTPS endpoint does not offer edge-based SSL termination or global anycast IP.

How to eliminate wrong answers

Option A is wrong because a TCP/UDP network load balancer does not support SSL termination at the edge (it operates at Layer 4) and cannot use a Cloud Storage bucket as a backend (buckets require HTTP(S)-based backends). Option C is wrong because an internal TCP/UDP load balancer is designed for private VPC traffic within a region, not for global public content delivery, and lacks SSL termination and bucket backend support. Option D is wrong because Cloud CDN directly on a bucket without a load balancer does not provide SSL termination at the edge (SSL is handled by the bucket's default HTTPS endpoint, which is not edge-terminated) and lacks the global anycast IP and advanced routing of a global HTTP(S) load balancer.

Full explanation →

240

MCQhard

A company uses a Global HTTPS Load Balancer with Cloud CDN. They need to purge specific cached objects for all users immediately after a content update. Which method should they use?

A.Delete the objects from the backend bucket

B.Use signed URLs

C.Reduce TTL on the origin

D.Cache invalidation

AnswerD

Correct: cache invalidation immediately removes specified objects from cache.

Why this answer

Cache invalidation allows purging specific URLs or URL prefixes from Cloud CDN caches.

Full explanation →

241

MCQmedium

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have ordered a circuit from a telecom provider and need to complete the setup. Which of the following steps is required during the provisioning process?

A.Set up a VPN tunnel for redundancy.

B.Create a VLAN attachment in the Google Cloud Console.

C.Configure on-premises DNS forwarding to Cloud DNS.

D.Configure the Cloud Router BGP session before ordering the circuit.

AnswerB

The VLAN attachment is the logical connection between your on-premises network and Google Cloud.

Why this answer

When provisioning a Dedicated Interconnect, after the telecom provider has delivered the circuit to the meet-me room, you must create a VLAN attachment (formerly called a VLAN attachment or interconnect attachment) in the Google Cloud Console. This attachment defines the VLAN and the Cloud Router that will establish BGP peering with your on-premises router, making it the essential step to complete the Layer 2 and Layer 3 connectivity.

Exam trap

The PCNE exam often tests the misconception that you must configure the Cloud Router BGP session before the circuit is ordered, but in reality, the BGP session is configured after the VLAN attachment is created and the physical circuit is ready.

How to eliminate wrong answers

Option A is wrong because a VPN tunnel is not required for Dedicated Interconnect; while you can optionally set up a VPN as a backup for redundancy, it is not a required step during the provisioning process of the Dedicated Interconnect itself. Option C is wrong because configuring on-premises DNS forwarding to Cloud DNS is unrelated to the physical or logical setup of Dedicated Interconnect; DNS forwarding is a separate network service configuration. Option D is wrong because the Cloud Router BGP session cannot be configured before ordering the circuit; you must first have the VLAN attachment created and the circuit provisioned before you can configure BGP sessions on the Cloud Router.

Full explanation →

242

MCQeasy

An organization wants to distribute incoming HTTPS traffic across a set of Compute Engine instances in multiple regions, with SSL termination at the Google Cloud edge. They also need to protect against DDoS attacks at the edge. Which load balancing solution should they choose?

A.SSL Proxy Load Balancer

B.External TCP/UDP Network Load Balancer

C.Global External HTTP(S) Load Balancer

D.Regional External HTTP(S) Load Balancer

AnswerC

Correct. It provides global SSL termination and Cloud Armor integration.

Why this answer

Global HTTPS Load Balancer is an external, global, proxy-based load balancer that terminates SSL at the edge and integrates with Cloud Armor for DDoS protection. It distributes traffic across regions.

Full explanation →

243

MCQhard

A company uses Cloud VPN tunnels to connect multiple sites to Google Cloud. They have a primary and a backup tunnel for redundancy, each with a different Cloud Router (both in the same region). BGP sessions are established on both routers. The network team notices that during a failover test, traffic fails over to the backup tunnel but then after 30 seconds, the backup tunnel traffic stops and does not recover until the primary tunnel comes back. The engineer finds that the backup Cloud Router is advertising the same routes as the primary, but the backup tunnel's BGP session shows that the routes are being withdrawn after 30 seconds. Additionally, the BGP session remains established. What is the most likely cause?

A.The backup Cloud Router is configured with a lower MED value, causing the routes to be withdrawn.

B.The backup Cloud Router's BGP session is experiencing a keepalive timeout due to incorrect timers.

C.The backup tunnel is using a static routing method instead of dynamic BGP.

D.The backup tunnel's Cloud Router is in a different region, and the routes are not propagated globally.

AnswerB

Keepalive timer mismatch can cause the on-premises router to withdraw routes while the session remains established from Google's perspective.

Why this answer

The backup Cloud Router's BGP session remains established, but routes are withdrawn after 30 seconds. This is classic behavior of a BGP keepalive or hold timer mismatch: if the backup router expects a keepalive within a shorter interval than the peer sends, the hold timer expires, causing the router to withdraw all routes learned from that peer while keeping the TCP session alive (or re-establishing it). The 30-second interval matches the default BGP hold timer (90 seconds) divided by three, suggesting a timer misconfiguration on the backup router.

Exam trap

The trap here is that candidates assume route withdrawal always indicates a BGP session failure, but Google Cloud often tests the nuance that hold timer expiration can cause route withdrawal while the TCP session remains established (or quickly re-establishes), leading to the mistaken belief that the session is stable when routes are actually being withdrawn.

How to eliminate wrong answers

Option A is wrong because a lower MED value would influence route selection (preferring the lower MED), not cause route withdrawal; MED is a metric exchanged in UPDATE messages, not a trigger for withdrawing all routes. Option C is wrong because the question explicitly states BGP sessions are established on both routers, so the backup tunnel is using dynamic BGP, not static routing; static routing would not have BGP sessions or route withdrawals. Option D is wrong because both Cloud Routers are in the same region (as stated in the scenario), and even if they were in different regions, Cloud Router routes are propagated globally by default in Google Cloud; region mismatch does not cause route withdrawal.

Full explanation →

244

Multi-Selectmedium

Which TWO of the following are valid use cases for Cloud IDS? (Choose TWO)

Select 2 answers

A.Blocking malicious traffic at the network perimeter.

B.Inspecting traffic between an on-premises network and Google Cloud via Cloud VPN.

C.Replacing VPC firewall rules for access control.

D.Only inspecting traffic that is destined for the internet.

E.Detecting and alerting on malware spreading between VMs in the same VPC.

AnswersB, E

Cloud IDS can inspect traffic traversing VPN.

Why this answer

Cloud IDS (Intrusion Detection System) inspects traffic for threats like malware and policy violations. Option B is correct because Cloud IDS can inspect traffic traversing Cloud VPN, enabling east-west and hybrid traffic inspection between on-premises and Google Cloud networks, which is a key use case for detecting threats in encrypted VPN tunnels.

Exam trap

Google Cloud often tests the misconception that IDS can block traffic (like a firewall), but Cloud IDS is detection-only and requires separate mitigation tools like Cloud Armor or firewall rules for blocking.

Full explanation →

245

Multi-Selecthard

An organization is setting up a Dedicated Interconnect and wants to monitor the health and performance of the connection using Cloud Monitoring. Which THREE metrics are available for Dedicated Interconnect?

Select 3 answers

A.interconnect/network/received_bytes_count

B.interconnect/link/packet_loss

C.interconnect/link/operational_status

D.interconnect/network/traffic_drops

E.interconnect/vpn/tunnel_status

AnswersA, B, C

This metric tracks bytes received over the interconnect.

Why this answer

Cloud Monitoring provides several metrics for Dedicated Interconnect, including traffic volume (received_bytes_count), link operational status, and packet loss. VLAN attachment metrics are also available, but the question asks for interconnect metrics.

Full explanation →

246

Multi-Selectmedium

An engineer needs to configure a Compute Engine instance as a network appliance that routes traffic between two subnets within the same VPC. The instance must handle traffic for both subnets. Which TWO actions are required? (Choose TWO.)

Select 2 answers

A.Set the MTU to 1500 on both interfaces

B.Create a route with a next-hop of the instance's internal IP

C.Enable IP forwarding on the instance

D.Attach two network interfaces to the instance, one in each subnet

E.Assign external IPs to both interfaces

AnswersC, D

IP forwarding allows the instance to forward packets between interfaces.

Why this answer

To act as a router between subnets, the instance needs two network interfaces, each attached to a different subnet, and IP forwarding must be enabled so the kernel can forward packets between interfaces.

Full explanation →

247

Multi-Selectmedium

An engineer needs to allow HTTP health checks from the Google Cloud health checker IP ranges to a set of instances. Which two methods can be used to target the firewall rule correctly? (Choose two.)

Select 2 answers

A.Use source service accounts on the health checkers.

B.Use source tags on the health checkers.

C.Use target service accounts on the instances.

D.Use target tags on the instances.

E.Use instance names in the firewall rule.

AnswersC, D

Service accounts are also a valid target.

Why this answer

Firewall rules can target instances using tags or service accounts. The health checker IP ranges are well-known and can be used as source.

Full explanation →

248

MCQeasy

An organization uses Partner Interconnect to connect their on-premises network to Google Cloud. They are experiencing intermittent connectivity issues and suspect the partner service provider is causing the problem. Which Google Cloud tool or feature can help verify the connection status and performance from the Google Cloud side?

A.Cloud Router logs

B.Network Service Tiers

C.VPC flow logs

D.Cloud Interconnect monitoring

AnswerD

Cloud Interconnect monitoring provides metrics and alerts for interconnect attachments, including partner interconnects.

Why this answer

Cloud Interconnect monitoring provides detailed metrics and status information for Partner Interconnect connections, including VLAN attachment health, throughput, and packet loss. This tool allows you to verify connectivity and performance from the Google Cloud side, helping isolate issues that may originate from the partner service provider.

Exam trap

The trap here is that candidates confuse Cloud Router logs (which show BGP routing events) with the ability to monitor the underlying interconnect link status, but Cloud Interconnect monitoring is the correct tool for verifying physical/virtual circuit health and performance from Google's perspective.

How to eliminate wrong answers

Option A is wrong because Cloud Router logs capture BGP routing events and route advertisements, not the underlying physical or virtual circuit health or performance metrics of the interconnect. Option B is wrong because Network Service Tiers control the quality of service for internet egress traffic (Premium vs. Standard), not the monitoring or troubleshooting of dedicated interconnect links.

Option C is wrong because VPC flow logs record metadata about network flows within a VPC (e.g., source/destination IPs, ports, protocols), but they do not provide status or performance data for the interconnect connection itself.

Full explanation →

249

MCQeasy

A company uses a VPC with two subnets: subnet-a (10.0.1.0/24) with VMs tagged 'web', and subnet-b (10.0.2.0/24) with VMs tagged 'db'. They have a Cloud VPN tunnel to an on-premises network (172.16.0.0/16). The VPN tunnel is up and BGP is exchanging routes. A custom route for 172.16.0.0/16 with next hop VPN gateway exists, but it has a tag 'web', meaning it applies only to VMs with the 'web' tag. VMs in subnet-a can reach on-premises, but VMs in subnet-b cannot. Which step should be taken to allow subnet-b VMs to reach on-premises?

A.Create a new route for 172.16.0.0/16 with priority 1000 and no tag.

B.Add the 'db' tag to the custom route.

C.Remove the tag from the existing route.

D.Add a firewall rule to allow egress traffic from subnet-b.

AnswerB

Adding the tag will make the route applicable to VMs in subnet-b, allowing them to reach on-premises.

Why this answer

The custom route for 172.16.0.0/16 is tagged with 'web', so it only applies to VMs that have the 'web' tag. Subnet-b VMs are tagged 'db', so they do not match the route and cannot reach on-premises. Adding the 'db' tag to the route makes it apply to both tagged groups, enabling connectivity for subnet-b VMs without affecting existing traffic.

Exam trap

Google Cloud often tests the misconception that firewall rules are the cause of connectivity issues when the real problem is route scope or tag-based route applicability, leading candidates to incorrectly choose a firewall-related option like D.

How to eliminate wrong answers

Option A is wrong because creating a new route with priority 1000 and no tag would introduce a lower-priority route that applies to all VMs, but the existing tagged route (default priority 1000) would still take precedence for 'web' VMs; however, the real issue is that the route must match the 'db' tag, and a new untagged route would work but is unnecessary and could cause confusion. Option C is wrong because removing the tag from the existing route would make it apply to all VMs, including 'db' VMs, but it would also remove the intended restriction for 'web' VMs, potentially breaking security or routing policy. Option D is wrong because the problem is a routing issue, not a firewall issue; egress firewall rules control packet filtering, not route selection, and subnet-b VMs already have implicit egress allowed unless explicitly blocked.

Full explanation →

250

MCQmedium

A company has a VPC with a Cloud Router using BGP to advertise prefixes to an on-premises network. The BGP session keeps flapping. What is a likely cause?

A.There is an MTU mismatch causing packet drops

B.VPC Flow Logs are enabled on the subnet

C.The firewall rules are blocking BGP traffic

D.The Cloud Router is configured with the wrong ASN

AnswerA

Correct: MTU mismatch can cause BGP keepalive drops, leading to flapping.

Why this answer

MTU mismatch can cause packets to be dropped, leading to BGP session instability. Ensure consistent MTU across the path.

Full explanation →

251

MCQeasy

A company needs to resolve on-premises DNS names from Google Cloud VMs. They want to forward DNS queries for a specific domain (example.corp) to an on-premises DNS server. Which Cloud DNS feature should they use?

A.Private DNS zones

B.DNS peering

C.Inbound DNS policy

D.Outbound DNS forwarding (conditional forwarding)

AnswerD

This is the feature for forwarding specific domains to on-premises DNS.

Why this answer

Outbound DNS forwarding with conditional forwarding allows Cloud DNS to forward queries for a specific domain (example.corp) to an on-premises DNS server. This is the correct feature because it selectively routes DNS traffic based on the domain name, enabling resolution of private on-premises names from Google Cloud VMs without exposing the entire VPC network.

Exam trap

Google Cloud often tests the distinction between inbound and outbound DNS policies. Candidates may confuse the direction of DNS traffic and select Inbound DNS policy (Option C) instead of Outbound DNS forwarding.

How to eliminate wrong answers

Option A is wrong because Private DNS zones are used to manage DNS records within a VPC network, not to forward queries to external servers. Option B is wrong because DNS peering allows DNS resolution between two VPC networks, not forwarding to on-premises servers. Option C is wrong because Inbound DNS policy handles DNS queries coming into Google Cloud from on-premises, not outbound forwarding from Google Cloud to on-premises.

Full explanation →

252

Multi-Selectmedium

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Select 2 answers

A.Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.

B.Private Google Access enabled on the subnet where the VPN gateway resides.

C.Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

D.Cloud NAT configured in the VPC.

E.A custom route in the VPC that sends traffic to 199.36.153.4/30 and 199.36.153.8/30 to the VPN tunnel.

AnswersB, E

This allows on-premises traffic to reach Google APIs via the VPN.

Why this answer

Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.

Exam trap

Google Cloud often tests the misconception that Cloud NAT is required for private access, but Private Google Access and custom routes to the 199.36.153.4/30 and 199.36.153.8/30 ranges are the correct components for on-premises private API access via Cloud VPN.

Full explanation →

253

Multi-Selectmedium

A company wants to audit firewall rules for security best practices. They need to identify overly permissive rules (e.g., allowing all traffic from 0.0.0.0/0) and rules that are never used. Which two Google Cloud tools can help? (Choose two.)

Select 2 answers

A.Firewall Insights

B.Packet Mirroring

C.Cloud Armor

D.VPC Flow Logs

E.Connectivity Tests

AnswersA, D

Correct: Firewall Insights identifies overly permissive and shadowed rules.

Why this answer

Firewall Insights provides analytics on rule usage (including shadowed and overly permissive rules) and suggests improvements. VPC Flow Logs can be analyzed to see which firewall rules are matched by actual traffic, identifying unused rules. Connectivity Tests is for reachability testing, not auditing.

Packet Mirroring is for traffic capture. Cloud Armor is for WAF.

Full explanation →

254

MCQhard

Your company runs a multi-tier web application on Google Cloud. The frontend is in us-central1 (3 instances behind an external HTTP(S) Load Balancer), the backend is in us-west1 (3 instances behind an internal TCP/UDP Load Balancer). The frontend instances are in a managed instance group (MIG) with autoscaling based on CPU utilization. Recently, you noticed that during traffic spikes, the frontend instances' CPU utilization remains low, but the backend instances' CPU utilization spikes to 90% and causes timeouts. The application uses a synchronous REST API; the frontend instances make requests to the internal load balancer's IP. What should you do to resolve the backend scaling issue?

A.Create a backend service with the backend MIG and attach it to the internal TCP/UDP load balancer, enabling connection draining.

B.Configure the internal TCP/UDP load balancer with a health check that monitors CPU utilization and adjust the autoscaling metric of the backend MIG accordingly.

C.Replace the internal TCP/UDP load balancer with an internal HTTP(S) load balancer and configure the backend MIG to autoscale based on the load balancing serving capacity or request count.

D.Enable Cloud Armor on the external load balancer to rate-limit requests and prevent backend overload.

AnswerC

Internal HTTP(S) load balancer supports autoscaling based on request rate, allowing the backend to scale with traffic.

Why this answer

The internal TCP/UDP load balancer cannot provide request-level metrics (like requests per second) for autoscaling, as it operates at layer 4. Replacing it with an internal HTTP(S) load balancer (layer 7) allows the backend MIG to autoscale based on the load balancing serving capacity or request count, which directly correlates with the frontend's synchronous REST API calls. This resolves the backend CPU spike issue by scaling the backend instances before they become overloaded, rather than relying on CPU utilization which lags behind traffic spikes.

Exam trap

The trap here is that candidates assume CPU-based autoscaling is sufficient for all tiers, but Cisco tests the nuance that synchronous REST APIs require layer-7 load balancing to expose request-level metrics for proactive autoscaling, while layer-4 load balancers only provide connection-level metrics that lag behind traffic spikes.

How to eliminate wrong answers

Option A is wrong because connection draining only gracefully terminates existing connections during instance removal; it does not address the root cause of backend scaling during traffic spikes. Option B is wrong because the internal TCP/UDP load balancer's health check cannot monitor CPU utilization—health checks only verify instance responsiveness (e.g., TCP port check), and autoscaling metrics must be configured on the MIG itself, not on the load balancer. Option D is wrong because Cloud Armor rate-limiting on the external load balancer would throttle requests before they reach the frontend, but the issue is backend scaling; rate-limiting does not enable the backend to scale dynamically and could cause legitimate traffic to be dropped.

Full explanation →

255

MCQmedium

You need to route traffic to different backend services based on the URL path: /api/* goes to a Cloud Run service, /static/* goes to a Cloud Storage bucket, and /* goes to a Compute Engine instance group. Which component of the Global HTTPS Load Balancer should you configure?

A.Backend service

B.Target HTTP proxy

C.Health check

D.URL map

AnswerD

URL map contains path matchers and rules to route to different backends.

Why this answer

The URL map defines how requests are routed to backend services based on host and path rules.

Full explanation →

256

MCQmedium

A company is using Cloud NAT to provide outbound internet access for instances without external IPs. They notice that the NAT gateway is running out of ports for connections to a single external IP address. To minimize port exhaustion, what should the engineer configure?

A.Change the NAT port allocation to static.

B.Reduce the endpoint-independent mapping timeout.

C.Enable Cloud NAT logging to diagnose the issue.

D.Increase the number of NAT IP addresses assigned to the Cloud NAT gateway.

AnswerD

More NAT IPs provide more source ports, reducing contention.

Why this answer

Cloud NAT uses NAT IP addresses and ports. To increase capacity for connections to a single destination IP, you can either allocate more NAT IP addresses (which increases the number of ports) or use dynamic port allocation. Static port allocation is used for endpoints that require predictable source ports.

For minimizing exhaustion, adding more NAT IPs is the direct solution.

Full explanation →

257

MCQmedium

A company uses Dedicated Interconnect to connect their on-premises data center to Google Cloud. They have enabled Private Google Access on the VPC subnet to allow on-premises hosts to access Google APIs via private IPs over the interconnect. Performance tests show that throughput to Google APIs is lower than expected, and the interconnect link utilization is below 30%. What should they do to improve throughput?

A.Reduce the MTU on the interconnect to reduce packet loss.

B.Add another Dedicated Interconnect attachment.

C.Create a Private Service Connect endpoint for Google APIs with multiple IP addresses.

D.Enable Cloud NAT to provide multiple public IPs.

AnswerC

This provides multiple IPs, avoiding per-IP limits and improving throughput.

Why this answer

Private Google Access (PGA) uses the default Internet Gateway to route traffic to Google APIs, which can lead to throughput limitations due to source NAT and flow hashing constraints. Creating a Private Service Connect (PSC) endpoint for Google APIs with multiple IP addresses allows traffic to be load-balanced across multiple endpoints, improving throughput by enabling ECMP (Equal-Cost Multi-Path) routing over the Dedicated Interconnect, thus better utilizing the available bandwidth.

Exam trap

The trap here is that candidates assume low interconnect utilization means the link is underutilized and needs more capacity (Option B), when the real issue is a lack of multipathing to the destination, which is solved by creating multiple endpoints via Private Service Connect.

How to eliminate wrong answers

Option A is wrong because reducing the MTU on the interconnect would increase overhead and potentially cause fragmentation, not improve throughput; packet loss is not indicated by low utilization. Option B is wrong because adding another interconnect attachment does not address the bottleneck at the Google API access layer; the issue is not link capacity but how traffic is routed and load-balanced to Google APIs. Option D is wrong because Cloud NAT provides outbound connectivity to the internet, not to Google APIs via private IPs, and would not improve throughput over the existing Private Google Access configuration.

Full explanation →

258

MCQhard

A company is using a Global SSL Proxy Load Balancer to terminate SSL and forward traffic to a backend service on Compute Engine. They need to preserve the client IP address in the backend logs. What should they do?

A.Enable Cloud CDN with origin header forwarding.

B.Enable Proxy Protocol on the SSL proxy load balancer and configure the backend to parse it.

C.Use a TCP Proxy Load Balancer with the proxy protocol enabled.

D.Configure the backend service to use the X-Forwarded-For header.

AnswerB

Proxy Protocol is the standard way to pass client IP through load balancers that terminate SSL.

Why this answer

SSL Proxy Load Balancer terminates SSL and forwards traffic using TCP. It does not preserve the original client IP by default. To preserve the client IP, you must enable Proxy Protocol on the load balancer and configure the backend to accept Proxy Protocol headers.

Full explanation →

259

MCQhard

Refer to the exhibit. What is the purpose of the IP address 169.254.0.1 assigned to the Cloud Router interface?

A.It is the public IP address of the VPN gateway.

B.It is a private IP address for BGP peering with the on-premises router.

C.It is the management IP address of the Cloud Router.

D.It is a link-local IP address used for BGP sessions between the Cloud Router and the VPN gateway.

AnswerD

BGP uses link-local addresses (169.254.x.x) for peering.

Why this answer

The IP address 169.254.0.1 falls within the 169.254.0.0/16 range, which is reserved for link-local addressing (RFC 3927). In Google Cloud, Cloud Routers use link-local addresses for BGP sessions with VPN gateways (both HA VPN and Classic VPN). This address is not routable and is used exclusively for BGP peering between the Cloud Router and the VPN gateway, ensuring that the BGP session operates over the VPN tunnel without conflicting with other IP assignments.

Exam trap

Google Cloud often tests the distinction between link-local, private, and public IP addresses, and the trap here is that candidates see 'BGP peering' and assume a private IP is used, failing to recognize that GCP specifically uses link-local addresses from the 169.254.0.0/16 range for BGP sessions with VPN gateways.

How to eliminate wrong answers

Option A is wrong because 169.254.0.1 is not a public IP address; public IPs are globally routable and assigned by an ISP or cloud provider, whereas link-local addresses are non-routable and used only on a single link. Option B is wrong because 169.254.0.1 is not a private IP address (private ranges are 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); it is a link-local address, and while it is used for BGP peering, calling it 'private' is technically incorrect and misleading. Option C is wrong because the management IP address of a Cloud Router is not 169.254.0.1; Cloud Routers are managed via the Google Cloud API and console, and their management plane does not use link-local addressing.

Full explanation →

260

MCQeasy

An engineer is configuring a Google Compute Engine instance that needs to send traffic to the internet. The instance has no external IP address. Which service must be configured to allow this outbound connectivity?

A.Cloud NAT

B.Cloud VPN

C.VPC peering

D.Private Google Access

AnswerA

Cloud NAT enables outbound internet access for private instances.

Why this answer

Cloud NAT provides outbound internet connectivity for instances without external IPs. It translates private IPs to a public IP and allows instances to reach the internet.

Full explanation →

261

MCQhard

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

A.Configure multiple VLAN attachments on a single Cloud Router and rely on link aggregation

B.Deploy Cloud VPN tunnels as backup and configure static routes with lower priority

C.Configure VPC Network Peering between all data centers and Google Cloud

D.Use a Cloud Router with BGP and establish multiple BGP sessions over each Interconnect

AnswerD

BGP with ECMP allows automatic failover across multiple Interconnects.

Why this answer

Cloud Router with BGP enables dynamic routing, allowing multiple BGP sessions over each Cloud Interconnect. When one interconnect fails, BGP withdraws the affected routes, and traffic is automatically redistributed across the remaining BGP sessions without manual intervention. This meets the requirement for automatic failover and load balancing across the five 10 Gbps connections.

Exam trap

Google Cloud often tests the misconception that static routes or VPN tunnels can provide seamless automatic failover for high-bandwidth interconnects, but the correct approach requires dynamic BGP routing to react to link failures without manual intervention.

How to eliminate wrong answers

Option A is wrong because VLAN attachments on a single Cloud Router do not provide automatic failover; link aggregation (LAG) bundles multiple connections into a single logical link but does not redistribute traffic if one physical link fails—it only provides increased bandwidth and redundancy within the bundle, not across separate interconnects. Option B is wrong because Cloud VPN tunnels as backup with static routes require manual intervention or additional automation to fail over; static routes with lower priority do not dynamically react to interconnect failures, and VPN tunnels typically have lower bandwidth (e.g., 3 Gbps per tunnel) compared to 10 Gbps interconnects, making them unsuitable for seamless redistribution. Option C is wrong because VPC Network Peering is used for connecting VPC networks within Google Cloud, not for connecting on-premises data centers to Google Cloud; it does not support Cloud Interconnect or BGP-based dynamic routing for hybrid connectivity.

Full explanation →

262

MCQhard

A company uses Cloud Armor with WAF rules to protect an HTTPS load balancer. They notice that legitimate traffic from certain IPs is being blocked. How should they troubleshoot?

A.Check firewall rule logs.

B.Enable Packet Mirroring.

C.Review Cloud Armor security policy logs.

D.Use VPC Flow Logs.

AnswerC

Cloud Armor logs show exactly which rules matched and blocked traffic.

Why this answer

Cloud Armor security policy logs record the actions taken by WAF rules, including which requests were blocked and why. By reviewing these logs, you can identify the specific rule that is blocking legitimate traffic and adjust its configuration, such as modifying IP allowlists or threshold values.

Exam trap

Google Cloud often tests the distinction between different logging mechanisms (firewall logs, flow logs, WAF logs) to see if candidates understand which logs capture application-layer security policy decisions versus network-layer traffic metadata.

How to eliminate wrong answers

Option A is wrong because firewall rule logs apply to VPC firewall rules, which operate at the network layer (L3/L4) and are not involved in Cloud Armor WAF decisions at the application layer (L7). Option B is wrong because Packet Mirroring copies traffic for analysis but does not provide logs of WAF rule evaluations; it is used for network monitoring and troubleshooting, not for reviewing security policy actions. Option D is wrong because VPC Flow Logs capture metadata about IP traffic flows (e.g., source/destination, ports, protocols) but do not include information about Cloud Armor WAF rule matches or blocking decisions.

Full explanation →

263

Multi-Selecteasy

Which TWO of the following are valid methods to restrict access to a Compute Engine VM that has no external IP?

Select 2 answers

A.Using a NAT gateway to allow SSH from the internet.

B.Configuring a SOCKS proxy on a bastion host.

C.A Cloud VPN tunnel from an on-premises network.

D.Assigning an external IP and using firewall rules.

E.Identity-Aware Proxy (IAP) TCP forwarding.

AnswersC, E

VPN provides private connectivity from on-premises.

Why this answer

A Cloud VPN tunnel creates an encrypted, RFC-compliant IPsec tunnel between an on-premises network and a VPC, allowing on-premises hosts to reach the VM over its internal IP without requiring an external IP on the VM. Option E is correct because Identity-Aware Proxy (IAP) TCP forwarding uses the IAP service as a proxy to establish an SSH or RDP connection to a VM that has no external IP, by tunneling traffic through the IAP service using the `gcloud compute start-iap-tunnel` command.

Exam trap

Google Cloud often tests the misconception that a NAT gateway or a bastion host with a SOCKS proxy can provide inbound access to a private VM, when in fact NAT gateways only support outbound traffic and SOCKS proxies require the bastion to have an external IP and the VM to be reachable from the bastion, which does not satisfy the 'no external IP' constraint for the target VM itself.

Full explanation →

264

MCQhard

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

A.Configure Cloud NAT in each service project for on-prem access.

B.Use VPC peering between the host project and each service project.

C.Configure Cloud Router in the host project to advertise all subnets via BGP.

D.Create separate Interconnect VLAN attachments for each service project.

AnswerC

Cloud Router in the host project automatically includes subnets from all service projects in the Shared VPC.

Why this answer

In a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Exam trap

Google Cloud often tests the misconception that each service project needs its own interconnect or NAT configuration, but the key is that Shared VPC centralizes networking in the host project, so a single Cloud Router with BGP advertisement in the host project provides connectivity to all service project instances.

How to eliminate wrong answers

Option A is wrong because Cloud NAT provides outbound internet access for private instances, not inbound connectivity from on-premises networks; it does not establish routing between on-premises and VPC subnets. Option B is wrong because VPC peering is used for connectivity between separate VPC networks, but in Shared VPC, service projects do not have their own VPCs—they use the host project's VPC, so peering is unnecessary and would not provide the required routing. Option D is wrong because creating separate Interconnect VLAN attachments for each service project is unnecessary and does not solve the routing issue; the on-premises network needs a single BGP session to learn all subnets from the host project's VPC, not separate attachments per project.

Full explanation →

265

MCQhard

A company is connecting their on-premises network to GCP via Cloud Interconnect with VLAN attachments and BGP sessions. They want to prefer one attachment over the other for traffic to a specific prefix. Which BGP attribute should they use?

A.MED

B.AS path prepend

C.Weight

D.Local preference

AnswerA

Correct. MED influences inbound traffic selection.

Why this answer

Multi-Exit Discriminator (MED) is used to influence inbound traffic from a peer AS. Lower MED values are preferred.

Full explanation →

266

MCQmedium

An organization needs to serve a TCP-based application globally with low latency but without SSL termination. Which load balancer should they use?

A.Global HTTPS Load Balancer

B.Global SSL Proxy Load Balancer

C.Regional External TCP/UDP Network Load Balancer

D.Global TCP Proxy Load Balancer

AnswerD

Correct: TCP Proxy for non-SSL TCP traffic globally.

Why this answer

Global TCP Proxy Load Balancer is designed for non-SSL TCP traffic and provides global anycast IP.

Full explanation →

267

MCQmedium

A company is planning to migrate their on-premises application to Google Cloud. The application requires consistent high bandwidth and low latency to on-premises databases. They have a Dedicated Interconnect connection with a 10 Gbps link. To improve availability, they decide to add a second Interconnect connection. Which of the following is a best practice for configuring BGP sessions?

A.Configure two BGP sessions with the same ASN and MED values

B.Configure two BGP sessions, each on a separate connection, with different ASNs and MED values to influence path selection

C.Enable ECMP across the two connections with a single BGP session

D.Use a single BGP session across both connections

AnswerA

Correct. Using the same ASN and configuring MED values allows proper path selection and meets best practices for redundancy.

Why this answer

Using the same ASN for both BGP sessions is a best practice for Dedicated Interconnect redundancy. It ensures that the on-premises router treats both sessions as part of the same autonomous system, enabling consistent routing. MED (Multi-Exit Discriminator) values can then be used to influence path selection, allowing traffic engineering to prefer one connection over the other.

Option B is incorrect because using different ASNs is not recommended; it can cause suboptimal routing and complicates path selection. Options C and D are incorrect because each Interconnect connection requires its own BGP session; a single session across both connections is not supported, and ECMP with a single session is not possible.

Exam trap

A common trap is thinking that different ASNs should be used for redundancy, but Google Cloud recommends using the same ASN for both BGP sessions and differentiating path selection with MED values. Using different ASNs can lead to suboptimal routing and is not a best practice.

How to eliminate wrong answers

Option A is wrong because using the same ASN and MED values on both BGP sessions would cause the on-premises router to see them as equal-cost paths, potentially leading to suboptimal load balancing or failover behavior without the ability to influence path selection. Option C is wrong because ECMP across two connections with a single BGP session is not supported; each Dedicated Interconnect connection requires its own BGP session, and ECMP would require multiple sessions with equal route metrics. Option D is wrong because a single BGP session across both connections is not possible; BGP sessions are established per VLAN attachment or per connection, and a single session cannot span multiple physical links.

Full explanation →

268

MCQhard

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

A.The hybrid connectivity NEG is not supported with Traffic Director

B.The Cloud VPN tunnel is not established

C.Traffic Director requires mTLS for all hybrid endpoints

D.The on-premises firewall is blocking health check probes from Google Cloud

AnswerD

Health checks from Google Cloud must be allowed; if blocked, the NEG is marked unhealthy and traffic is not sent.

Why this answer

Hybrid connectivity NEGs require that the on-premises endpoint is reachable via a Cloud VPN or Interconnect. If Traffic Director cannot reach the endpoint, it might be due to missing firewall rules allowing health check probes or the NEG endpoint being misconfigured. The most common cause is that health checks are failing because the firewall rules on-premises are not allowing the health check source ranges.

Full explanation →

269

Multi-Selectmedium

Which three of the following are best practices for designing a highly available Dedicated Interconnect connection to Google Cloud? (Choose three.)

Select 3 answers

A.Use a single Cloud Router for both interconnect attachments.

B.Ensure that the on-premises routers are in different failure zones.

C.Configure both connections to use the same BGP session.

D.Use VLAN attachments in different regions to provide geographic redundancy.

E.Deploy two physical connections to different Google edge availability domains.

AnswersB, D, E

Diverse on-premises routers prevent single point of failure.

Why this answer

Deploying on-premises routers in different failure zones ensures that a single zone failure does not disrupt both BGP sessions. This aligns with Google Cloud's recommendation to use diverse failure domains for on-premises equipment to maintain high availability for Dedicated Interconnect.

Exam trap

The trap here is that candidates often assume a single Cloud Router or a single BGP session simplifies management, but this creates a single point of failure that violates high-availability design principles.

Full explanation →

270

MCQhard

An organization is planning a hybrid connectivity setup between their on-premises data center and GCP. They require a 99.99% SLA and want to use a single physical connection at 10 Gbps. Which connectivity option should they choose?

A.Dedicated Interconnect with a single 10 Gbps link and single VLAN attachment

B.Partner Interconnect with 10 Gbps link

C.HA VPN with two external IP addresses and four tunnels

D.Dedicated Interconnect with two 10 Gbps links (one active, one standby) and two VLAN attachments

AnswerC

Correct. HA VPN with two external IP addresses and four tunnels provides a 99.99% SLA. It uses a single logical connection over the internet and does not require physical circuits.

Why this answer

The customer requires a 99.99% SLA and wants to use a single physical connection at 10 Gbps. However, no physical connection option (Dedicated Interconnect or Partner Interconnect) can provide a 99.99% SLA with just one physical link—they require multiple links for redundancy. Therefore, the best option that meets the 99.99% SLA requirement without requiring multiple physical connections is HA VPN, which uses a logical VPN connection over the internet, not a physical one.

When configured with two external IP addresses and four tunnels, HA VPN achieves the 99.99% SLA. Thus, HA VPN is the only viable choice given the constraints.

Exam trap

The trap is assuming that a physical connection is necessary to achieve a 99.99% SLA. HA VPN can meet the same SLA with proper redundancy over the internet, and it uses a single logical connection type.

How to eliminate wrong answers

Option A is wrong because a single 10 Gbps link with a single VLAN attachment provides only a 99.9% SLA, not 99.99%, and lacks the required redundancy. Option B is wrong because Partner Interconnect does not offer a 99.99% SLA; its SLA is typically 99.9% and depends on the partner's infrastructure, not Google's direct physical connection. Option C is wrong because HA VPN with two external IP addresses and four tunnels provides a 99.99% SLA for VPN but uses the public internet, not a dedicated physical connection, and the question explicitly requires a single physical connection at 10 Gbps, which HA VPN does not provide.

Full explanation →

271

Multi-Selectmedium

Which TWO network services are required to enable private Google access for on-premises hosts using a Dedicated Interconnect connection? (Choose two.)

Select 2 answers

A.Cloud Router with BGP

B.Cloud NAT

C.VPC Flow Logs

D.Private Service Access (PSA) / Private Google Access for on-premises

E.Cloud VPN

AnswersA, D

Cloud Router is needed to exchange routes and enable private access.

Why this answer

Cloud Router with BGP is required because Dedicated Interconnect uses BGP sessions between the on-premises router and Google's edge router to exchange routes. Without BGP, the on-premises network cannot advertise or receive the routes necessary for private Google access, such as the 199.36.153.4/30 or 199.36.153.8/30 ranges used for Private Google Access for on-premises.

Exam trap

Google Cloud often tests the misconception that Cloud NAT is needed for private access, but the trap here is that Cloud NAT is for outbound internet from VMs, while Private Google Access for on-premises uses BGP-advertised IP ranges and does not involve NAT.

Full explanation →

272

Multi-Selectmedium

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Select 3 answers

A.Cloud NAT gateway

B.URL map

C.Target TCP proxy

D.Backend service (pointing to the GKE NEG)

E.SSL certificate (Google-managed)

AnswersB, D, E

URL map routes incoming requests to backends.

Why this answer

To achieve this, you need a backend service (or backend bucket) for the service, a URL map to route requests, and an SSL certificate for the custom domain. The load balancer itself is the target proxy.

Full explanation →

273

MCQeasy

Refer to the exhibit. A user within the perimeter project '111111111111' tries to access BigQuery from a VM that has an external IP address. The request is denied. What is the most likely reason?

A.The VPC Accessible Services restriction requires that the request originate from an internal IP address or through VPC-controlled access.

B.BigQuery is not listed in the restricted services, so it is blocked.

C.The user does not meet the access level conditions defined in 'trusted_ips'.

D.The VM's project is not in the resources list.

AnswerA

With vpcAccessibleServices enabled, requests from external IPs are blocked unless allowed.

Why this answer

The VPC Accessible Services restriction, when enabled, forces all traffic to Google APIs to use internal IP addresses or VPC-controlled access (such as Private Google Access or Private Service Connect). Since the VM has an external IP address and the request is denied, the most likely reason is that this restriction is in place, requiring the request to originate from an internal IP or through a VPC endpoint, not from a public external IP.

Exam trap

Google Cloud often tests the distinction between network-level restrictions (VPC Accessible Services) and identity/access-level conditions (Access Context Manager), causing candidates to confuse the 'trusted_ips' condition with IP-based network restrictions.

How to eliminate wrong answers

Option B is wrong because BigQuery is a supported service for VPC Accessible Services; it is not blocked by default, and the restriction only applies to services listed in the 'restricted services' list, but BigQuery is typically allowed unless explicitly restricted. Option C is wrong because the 'trusted_ips' access level condition applies to Identity-Aware Proxy (IAP) or Access Context Manager policies, not to VPC Accessible Services; the question describes a network-level restriction, not an identity or access level condition. Option D is wrong because the VM's project being in the resources list is irrelevant to VPC Accessible Services; the restriction applies to all projects in the perimeter unless the VM uses internal IP or VPC-controlled access.

Full explanation →

274

MCQeasy

What is the internal DNS name format for a Compute Engine instance named 'web-server' in the 'us-central1-a' zone within the project 'my-project'?

A.web-server.c.my-project.internal

B.web-server.us-central1.internal

C.web-server.my-project.internal

D.web-server.us-central1-a.c.my-project.internal

AnswerD

This is the correct format: instance name, zone, 'c', project ID, 'internal'.

Why this answer

Compute Engine instances get an internal DNS name in the format: [instance_name].[zone].c.[project_id].internal. For example, web-server.us-central1-a.c.my-project.internal.

Full explanation →

275

Multi-Selecteasy

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

Select 2 answers

A.Verify that the on-premises network has IAM permissions to access instances

B.Confirm that the subnet routes for the instance IP ranges are present in the VPC

C.Verify that VPC firewall rules allow traffic from the on-premises subnets

D.Ensure that the VLAN attachment IP is in the same subnet as the instances

E.Check that BGP sessions are established between Cloud Router and on-premises router

AnswersB, C

Routes must exist for return traffic.

Why this answer

For on-premises traffic to reach Compute Engine instances over Dedicated Interconnect, the VPC must have a subnet route (either automatically created or custom static/dynamic route) that matches the instance IP ranges. Without this route, packets from the on-premises network will be dropped by the VPC router, even if the VLAN attachment is reachable.

Exam trap

Google Cloud often tests the misconception that pinging the VLAN attachment IP confirms end-to-end connectivity to instances, but in reality it only confirms BGP session health and Layer 3 reachability to the Cloud Router interface, not the VPC routing or firewall rules required for instance access.

Full explanation →

276

Multi-Selecthard

A company is migrating to Google Cloud and needs to connect their on-premises data center to a VPC using Cloud VPN with dynamic routing (BGP). They want high availability and automatic failover. Which THREE components are required? (Choose THREE.)

Select 3 answers

A.Cloud Router with BGP enabled

B.A single VPN tunnel

C.Two Cloud VPN gateways (HA VPN)

D.VPC Network Peering

E.Two VPN tunnels, each connected to a different gateway

AnswersA, C, E

Cloud Router exchanges routes via BGP.

Why this answer

For HA VPN with dynamic routing, you need two VPN gateways (HA), Cloud Router for BGP, and two tunnels (one to each gateway) for redundancy. A single tunnel would be a single point of failure.

Full explanation →

277

MCQmedium

An engineer has configured a firewall rule with priority 1000 that allows ingress traffic on TCP port 443 from source IP range 10.0.0.0/8. Another rule with priority 500 denies ingress on TCP port 443 from source IP 10.0.1.0/24. What will happen to traffic from 10.0.1.5 destined to the instance on port 443?

A.The traffic is allowed because allow rules override deny rules

B.The traffic is allowed because the allow rule covers a broader range

C.The traffic is denied only if the instance has a tag matching the deny rule

D.The traffic is denied because the deny rule has higher priority

AnswerD

Correct. The deny rule (priority 500) has higher priority than the allow rule (priority 1000).

Why this answer

Firewall rules are evaluated by priority (lower number = higher priority). Rule with priority 500 (deny) takes precedence over priority 1000 (allow). So traffic from 10.0.1.5 is denied.

Full explanation →

278

MCQmedium

A company has set up a Cloud VPN with dynamic routing (BGP) between their on-premises network (AS 65001) and Google Cloud (AS 64514). They are using Cloud Router with a regional dynamic routing mode. The on-premises router is advertising a subnet 10.1.0.0/16. The Google Cloud VPC has subnet 10.2.0.0/16 in the same region as the Cloud Router. Both subnets are unique. The connection has been working for months. However, after a recent maintenance window, the on-premises router started experiencing BGP flapping with the Cloud Router. The Cloud Router logs show 'BGP notification sent: Hold timer expired'. The on-premises router logs show similar errors. The network team has verified that the VPN tunnel is established and stable. What is the most likely cause of the BGP flapping?

A.The VPN tunnel's MTU is set to 1500 bytes, but BGP packets are larger and are being fragmented.

B.The Cloud Router's BGP keepalive interval is set to 30 seconds, while the on-premises router is using 10 seconds.

C.The on-premises router's BGP hold timer is set to 30 seconds, but the Cloud Router's hold timer is set to 180 seconds.

D.The on-premises router is advertising too many routes, causing the Cloud Router to run out of memory.

AnswerC

If the remote side sends keepalives less frequently than the local hold timer, the session drops.

Why this answer

The BGP hold timer defines the maximum time a router waits to receive a keepalive or update message from a peer before declaring the session dead. When the on-premises router uses a hold timer of 30 seconds and the Cloud Router uses 180 seconds, the on-premises router expects keepalives every 10 seconds (one-third of hold time). If the Cloud Router sends keepalives at its own negotiated interval (e.g., 60 seconds based on its hold timer), the on-premises router will not receive them within its 30-second window, causing it to send a 'Hold timer expired' notification and flap the BGP session.

The VPN tunnel remains stable because the issue is at the BGP session layer, not the underlying tunnel.

Exam trap

Google Cloud often tests the misconception that BGP flapping is always caused by VPN tunnel instability, but here the tunnel is stable and the issue is specifically a BGP hold timer mismatch, which is a common misconfiguration when connecting to cloud providers with fixed BGP timers.

How to eliminate wrong answers

Option A is wrong because BGP packets are typically small (keepalives are 19 bytes, updates rarely exceed 1500 bytes) and fragmentation is handled by IP, not a common cause of hold timer expiry. Option B is wrong because BGP keepalive intervals are derived from the negotiated hold timer (one-third of hold time), not independently configured; mismatched keepalive intervals would be overridden by the hold timer negotiation. Option D is wrong because advertising too many routes would cause memory or CPU issues, not a 'Hold timer expired' error; the Cloud Router would log route limit or memory errors instead.

Full explanation →

279

Multi-Selecthard

A company is experiencing packet loss between two Compute Engine instances in different zones within the same region. They suspect MTU issues. Which three actions should they take to diagnose and resolve? (Choose three.)

Select 3 answers

A.Verify that the network path between instances does not have a smaller MTU (e.g., VPN or load balancer)

B.Enable Cloud NAT to reduce packet size

C.Check the MTU configuration on the instances (default 1460)

D.Use VPC Flow Logs to check for packet drops

E.Capture packets using tcpdump on the instances to look for fragmentation

AnswersA, C, E

Correct: Path MTU discovery can reveal smaller MTUs along the path.

Why this answer

Check the MTU settings on the instances (default 1460 for GCP). Use packet capture to see if fragmentation is occurring. Ensure that the path MTU is consistent (e.g., between VMs and any load balancers).

VPC Flow Logs do not show MTU. Cloud NAT is not relevant. Connectivity Tests do not test MTU.

Full explanation →

280

MCQmedium

An organization runs a stateful TCP application on a group of Compute Engine instances in us-central1. Clients must connect to the service using a single anycast IP address, and the load balancer must preserve the client source IP address. Which load balancing option meets these requirements?

A.External TCP/UDP Network Load Balancer

B.Internal TCP/UDP Load Balancer

C.Global external TCP Proxy Load Balancer

D.Global external HTTP(S) Load Balancer

AnswerC

The Global external TCP Proxy Load Balancer provides a single anycast IP address and can preserve the client IP address using Proxy Protocol, making it suitable for stateful TCP applications that require both anycast and source IP preservation.

Why this answer

The Global external TCP Proxy Load Balancer provides a single anycast IP address that clients can connect to from anywhere. While it terminates the TCP connection, it can be configured to forward the client's IP address to the backend using Proxy Protocol (e.g., HAProxy protocol). This allows the backend to see the original client source IP, meeting the requirement for a stateful TCP application.

The other options either do not provide anycast IP or cannot preserve the source IP.

Exam trap

Candidates often select the External TCP/UDP Network Load Balancer because it preserves client IP natively, but it is a regional load balancer and does not provide a single anycast IP. The Global external TCP Proxy provides anycast IP and can preserve client IP via Proxy Protocol.

Full explanation →

281

MCQhard

A company uses hierarchical firewall policies at the organization level. They need to allow SSH (TCP 22) access from a specific range 10.0.0.0/8 to all VMs, but a child folder has a policy that denies all ingress traffic. Which rule priority ordering ensures SSH access is allowed?

A.Folder allow rule priority 100, folder deny rule priority 200.

B.Remove the folder deny rule and use network firewall rules.

C.Organization allow rule priority 200, folder deny rule priority 100.

D.Organization allow rule priority 100, folder deny rule priority 200.

AnswerD

Priority 100 is higher (lower number) than 200, so allow overrides deny.

Why this answer

Hierarchical firewall rules have priorities; higher priority (lower number) wins. To override a deny-all, the allow rule must have a lower priority number than the deny rule. The organization policy can have a lower priority than the folder policy, but the folder's deny-all would block.

The organization's allow rule must have higher priority (lower number) than the folder's deny rule.

Full explanation →

282

MCQeasy

A network engineer needs to ensure that Compute Engine instances without external IP addresses can access Google APIs such as BigQuery and Cloud Storage. Which feature should be enabled on the subnet where the instances reside?

A.Private Service Connect

B.VPC Service Controls

C.Private Google Access

D.Cloud NAT

AnswerC

Correct. Private Google Access enables instances without external IPs to reach Google APIs through internal IPs.

Why this answer

Private Google Access allows instances without external IPs to reach Google APIs using private IP addresses. It is enabled per subnet.

Full explanation →

283

Multi-Selecthard

You are setting up Partner Interconnect with a service provider that offers both Layer 2 and Layer 3 options. Your on-premises network uses BGP to exchange routes. Which THREE statements are true about the connectivity types? (Choose three.)

Select 3 answers

A.Layer 3 connectivity requires a VLAN attachment of type PARTNER_PROVIDER

B.With Layer 2 connectivity, you must configure BGP sessions between your on-premises router and Cloud Router

C.Both connectivity types support dynamic routing with BGP

D.With Layer 3 connectivity, the service provider manages BGP peering with your Cloud Router

E.Layer 2 connectivity requires a VLAN attachment of type PARTNER_PROVIDER

AnswersB, C, D

With Layer 2 connectivity, you manage BGP sessions between on-premises router and Cloud Router. This statement is correct.

Why this answer

In Google Cloud Partner Interconnect, Layer 2 connectivity provides a transparent VLAN extension, requiring you to configure and manage your own BGP sessions between your on-premises router and a Cloud Router (option B correct). Layer 3 connectivity offloads BGP management to the service provider, who peers with your Cloud Router (option D correct). Both connectivity types support dynamic routing with BGP (option C correct).

Option A is incorrect because Layer 3 uses a VLAN attachment of type PARTNER, not PARTNER_PROVIDER. Option E is incorrect because Layer 2 uses a VLAN attachment of type PARTNER, not PARTNER_PROVIDER.

Exam trap

Candidates often confuse the attachment types (PARTNER vs PARTNER_PROVIDER) and who manages BGP sessions, incorrectly assuming that Layer 3 connectivity requires direct BGP configuration on the Cloud Router.

Full explanation →

284

MCQhard

A network engineer is troubleshooting BGP session flaps between a Cloud Router and an on-premises router. The Cloud Router logs show that the session goes down and up repeatedly every few minutes. What is the most common cause of such flapping?

A.There is a firewall rule blocking BGP port 179

B.The VLAN attachment is misconfigured

C.The on-premises router is experiencing high CPU load

D.The Cloud Router's BGP timer values are too low

AnswerC

High CPU can cause delayed keepalives, leading to hold timer expiry and flapping.

Why this answer

BGP session flaps often occur due to hold timer expiration caused by network congestion, high CPU on either router, or packet loss. The most common cause in GCP is when the on-premises router does not process keepalives fast enough due to high CPU or memory pressure.

Full explanation →

285

MCQmedium

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

A.Remove the deny rule for that region and rely on other security measures

B.Add a new allow rule for that region with a lower priority number than the deny rule

C.Remove all rules and add a single allow rule for the legitimate region

D.Reorder the rules so that the deny rule is at the bottom of the list

AnswerB

Lower priority number means higher precedence, so the allow rule will be evaluated first.

Why this answer

Cloud Armor security rules are evaluated in order of priority, where a lower priority number means higher precedence. To allow traffic from a specific region that is currently blocked by a deny rule, you must add an allow rule with a lower priority number (e.g., 100) than the deny rule (e.g., 1000). This ensures the allow rule is evaluated first, permitting the legitimate traffic before the deny rule can block it, while the deny rule still protects against attacks from other regions.

Exam trap

Google Cloud often tests the misconception that reordering rules in the list (like moving the deny rule to the bottom) changes evaluation order, but Cloud Armor strictly uses priority numbers, not list order, to determine which rule is evaluated first.

How to eliminate wrong answers

Option A is wrong because simply removing the deny rule for that region would leave the region unprotected against attacks, as there would be no rule to block malicious traffic from that region. Option C is wrong because removing all rules and adding a single allow rule for the legitimate region would remove all other security protections, leaving the load balancer vulnerable to attacks from other regions and sources. Option D is wrong because reordering rules so that the deny rule is at the bottom does not change the evaluation order; Cloud Armor uses priority numbers, not list order, and the deny rule would still block the traffic if its priority is higher (lower number) than any allow rule for that region.

Full explanation →

286

MCQmedium

A company has deployed a Cloud Armor security policy with the following rules: Rule 1: allow from IP range 10.0.0.0/8 (priority 1000); Rule 2: deny from all (priority 2000). What will be the action for traffic from IP 10.1.1.1?

A.Deny

B.Error: conflicting rules

C.Allow

D.Depends on the default rule

AnswerC

The allow rule with higher priority (1000) matches first, so traffic is allowed.

Why this answer

Cloud Armor evaluates rules in priority order (lower number = higher priority). Rule 1 matches and allows the traffic, so Rule 2 is not evaluated.

Full explanation →

287

MCQeasy

A small company has a single VPC with one subnet in us-central1 (10.0.1.0/24). They have a Compute Engine instance that needs to be reachable from the internet via HTTP (port 80) and HTTPS (port 443). The instance has an external IP address (ephemeral). They have created firewall rules allowing ingress on TCP 80 and 443 from 0.0.0.0/0, with target tags 'web-server'. The instance has been assigned the tag 'web-server'. However, external users report that they cannot access the instance's public IP on either port. The instance's OS firewall (iptables) is default allow. What is the most likely cause?

A.The instance's external IP is ephemeral and may have changed, so users should use the new IP or reserve a static IP.

B.The instance's OS firewall is blocking the traffic; check iptables.

C.The VPC needs a custom route for the internet gateway.

D.The firewall rules must be applied to the subnet, not the instance tag.

AnswerA

Ephemeral IPs can change, causing connectivity issues; a static IP is recommended.

Why this answer

The VPC automatically has a default route to the internet gateway, so no custom route is needed. Firewall rules with target tags 'web-server' are correctly applied to the instance with that tag. The instance's OS firewall (iptables) is default allow, so it is not blocking traffic.

The most likely cause is that the instance's external IP is ephemeral and may have changed after a stop/start operation. Users may be attempting to connect to the old IP address. To resolve this, the company should assign a static external IP to the instance.

Full explanation →

288

Multi-Selectmedium

Which TWO of the following are required when setting up an internal TCP/UDP load balancer (ILB) in a shared VPC environment?

Select 2 answers

A.A health check must be configured for the backend service.

B.A firewall rule must allow traffic from the proxy-only subnet.

C.The forwarding rule's IP address must be from the host project's subnet.

D.The load balancer forwarding rule must be in the same region as the backend instances.

E.Global routing must be enabled in the VPC.

AnswersA, D

Health checks are required to determine instance health.

Why this answer

Correct answers: A and D. A: A health check is mandatory for an internal TCP/UDP load balancer (ILB) backend service to determine instance health. D: The ILB forwarding rule must be in the same region as the backend instances because ILB is a regional load balancer.

B: Incorrect. ILB does not use proxy-only subnets; firewall rules for proxy-only subnets are required only for load balancers that use Envoy proxies (e.g., HTTP(S) LB). C: Incorrect.

While the forwarding rule's IP address is taken from a subnet in the shared VPC (owned by the host project), this is not a separate requirement; the critical requirement is that the forwarding rule and backends are in the same region. E: Incorrect. Global routing is not needed for ILB; it operates within a single region.

Full explanation →

289

Multi-Selectmedium

A company wants to use Cloud CDN to accelerate content delivery globally. Which TWO of the following are valid cache key components that can be configured in Cloud CDN? (Choose 2)

Select 2 answers

A.Client IP address

B.Query string parameters

C.Protocol (HTTP/HTTPS)

D.Request headers (e.g., Accept-Language)

E.Client port

AnswersB, C

Query string parameters can be included (all, specified, or excluded).

Why this answer

Cloud CDN allows you to configure cache keys based on protocol, host, query string parameters, and headers. IP address and client port are not configurable cache key components.

Full explanation →

290

MCQmedium

An engineer has set up a Dedicated Interconnect with a VLAN attachment and a Cloud Router BGP session. They can ping the on-premises gateway IP but cannot reach an on-premises subnet 10.0.0.0/24 from a GCE instance. The on-premises router is advertising the subnet via BGP. What is the most likely cause?

A.The VLAN attachment is in the wrong region

B.The GCE instance does not have a route to the on-premises subnet

C.The on-premises firewall is blocking ICMP

D.The on-premises router is not using the correct BGP AS number

AnswerB

If the Cloud Router is not advertising the on-premises subnet correctly, or custom route propagation is not enabled, the VPC may lack a route to 10.0.0.0/24.

Why this answer

The GCE instance can ping the on-premises gateway IP because the Cloud Router has a BGP session and the gateway IP is directly reachable via the VLAN attachment. However, to reach the on-premises subnet 10.0.0.0/24, the GCE VPC needs a route for that subnet pointing to the Cloud Router as the next hop. Without an automatically propagated or manually configured route in the VPC, traffic from the GCE instance to 10.0.0.0/24 will be dropped, even though the on-premises router is advertising the subnet via BGP.

Exam trap

The PCNE exam often tests the misconception that BGP route advertisement alone ensures reachability, but in Google Cloud, the VPC route table must explicitly include the learned prefix via dynamic route propagation or a static route.

How to eliminate wrong answers

Option A is wrong because the VLAN attachment region must match the Cloud Router region for the BGP session to establish; if it were in the wrong region, the BGP session would not come up and the engineer could not ping the on-premises gateway IP. Option C is wrong because the engineer can already ping the on-premises gateway IP, which demonstrates that ICMP is not blocked by the on-premises firewall; the issue is specifically with reaching a different subnet. Option D is wrong because if the on-premises router were using the wrong BGP AS number, the BGP session would not establish, and the engineer could not ping the on-premises gateway IP or receive any route advertisements.

Full explanation →

291

Multi-Selecteasy

Which TWO of the following are valid reasons to use a Shared VPC architecture?

Select 2 answers

A.To reduce latency by placing resources in the same region within a single VPC

B.To improve network connectivity between different organizational units without using VPN or peering

C.To prevent individual projects from creating their own VPCs and force them to use a common VPC

D.To allow a central network team to manage VPC resources while allowing application teams to deploy resources in separate projects

E.To reduce egress costs by having all resources in one VPC

AnswersC, D

Controls VPC creation via IAM.

Why this answer

A Shared VPC architecture allows an organization to enforce that individual projects cannot create their own VPCs; instead, they must use a common VPC that is centrally managed. This is achieved by designating a host project that contains the shared VPC network, and attaching service projects to it, which prevents the service projects from having their own independent VPC networks.

Exam trap

Google Cloud often tests the misconception that Shared VPC reduces latency or egress costs, when in fact its primary benefits are centralized network management and policy enforcement, not performance or cost optimization.

Full explanation →

292

MCQmedium

A company hosts a web application on Cloud Run and wants to serve content from a Cloud Storage bucket for static assets. They plan to use a global HTTPS load balancer with a URL map to route requests. Which backend type should they configure for the static content?

A.Backend bucket (Cloud Storage bucket)

B.Serverless NEG (Cloud Run)

C.Zonal NEG (Compute Engine)

D.Internet NEG (external endpoint)

AnswerA

Correct. Backend buckets serve static content from Cloud Storage.

Why this answer

Backend buckets are used to serve content from Cloud Storage buckets via a load balancer. Serverless NEGs are for Cloud Run/Functions, not Cloud Storage.

Full explanation →

293

MCQmedium

A company uses an external HTTP Load Balancer with Cloud Armor. They want to log all requests that are blocked by Cloud Armor security policies for compliance auditing. What should they enable?

A.Cloud Armor request logs

B.VPC Flow Logs

C.Load balancer access logs

D.Firewall rule logging

AnswerA

Cloud Armor request logs record details of requests evaluated by security policies.

Why this answer

Cloud Armor request logs capture details about requests that are allowed or blocked by security policies. Enabling these logs provides the required auditing.

Full explanation →

294

MCQmedium

A company has deployed Dedicated Interconnect with a 10 Gbps connection. They are experiencing packet loss when transferring large files. The on-premises MTU is set to 1500. What is the maximum MTU that can be set on the Cloud Router interface to avoid fragmentation?

A.1460 bytes

B.1500 bytes

C.1400 bytes

D.8896 bytes

AnswerB

Must match the on-premises MTU to avoid fragmentation.

Why this answer

Dedicated Interconnect uses VLAN attachments that encapsulate packets with an additional 4-byte 802.1Q VLAN tag and a 4-byte outer Ethernet header. With an on-premises MTU of 1500 bytes, the maximum payload that can traverse the interconnect without fragmentation is 1500 bytes, because the interconnect path supports jumbo frames up to 1440 bytes for the payload after overhead, but the Cloud Router interface MTU must match the on-premises MTU to avoid fragmentation. Setting the Cloud Router MTU to 1500 bytes ensures that packets are not fragmented at the router, as the interconnect handles the encapsulation overhead transparently.

Exam trap

Google Cloud often tests the misconception that the Cloud Router MTU must be reduced to account for VLAN encapsulation overhead, but in Google Cloud Dedicated Interconnect, the Cloud Router MTU should match the on-premises MTU because the interconnect handles the additional headers transparently.

How to eliminate wrong answers

Option A is wrong because 1460 bytes assumes an additional 40-byte overhead (e.g., IPsec or GRE tunnel), but Dedicated Interconnect does not add such overhead; the VLAN tag is only 4 bytes and is handled by the interconnect, not the Cloud Router MTU. Option C is wrong because 1400 bytes is an arbitrary low value that would cause unnecessary fragmentation and performance degradation, as the actual path supports 1500-byte packets without issue. Option D is wrong because 8896 bytes is the maximum MTU for Google Cloud's jumbo frame support, but the on-premises MTU is 1500, so setting the Cloud Router MTU higher would cause fragmentation when packets exceed the on-premises limit.

Full explanation →

295

Multi-Selecteasy

A company is deploying Cloud DNS to enable on-premises resources to resolve Google Cloud private zone names. Which TWO resources are required for this setup?

Select 2 answers

A.VPC peering

B.Inbound DNS policy

C.Cloud Router

D.On-premises DNS server configuration to forward to the inbound IP

E.Outbound DNS forwarding zone

AnswersB, D

Inbound DNS policy provides a forwarding IP for on-premises to query GCP DNS.

Why this answer

To allow on-premises DNS queries to reach Google Cloud private zones, you need an inbound DNS policy that creates a forwarding IP address in a VPC, and you need to configure on-premises DNS servers to forward those queries to that IP. A forwarding zone is used for the opposite direction (GCP to on-premises).

Full explanation →

296

MCQhard

An organization needs to prevent exfiltration of data from a Cloud Storage bucket to external IPs. The bucket is accessed by Compute Engine instances in a VPC. The instances need to read and write data to the bucket but should not be able to copy data to external networks. Which combination of controls meets this requirement?

A.Use Cloud Armor with a WAF rule to block outbound traffic.

B.Configure VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.

C.Set up Private Google Access and restrict IAM permissions to the bucket.

D.Use Cloud NAT with a firewall rule that denies all egress except to Google APIs.

AnswerB

This prevents data from leaving the perimeter, including copying to external networks.

Why this answer

VPC Service Controls create a service perimeter that restricts data movement between Google services and external networks. Within the perimeter, data can flow between authorized services. IAM conditions can further restrict access based on context.

This is the primary method to prevent data exfiltration from Google Cloud-managed services.

Full explanation →

297

MCQmedium

An engineer is planning IP address ranges for two VPCs that will be connected via VPC peering. One VPC uses 10.1.0.0/16 and the other uses 10.2.0.0/16. They also plan to use HA VPN to an on-premises network using 10.0.0.0/8. Which IP range assignment could cause a conflict?

A.Conflict between the two VPCs (10.1.0.0/16 and 10.2.0.0/16)

B.Conflict between VPC1 (10.1.0.0/16) and on-premises (10.0.0.0/8)

C.No conflict; all ranges are non-overlapping

D.Conflict between on-premises (10.0.0.0/8) and both VPCs

AnswerD

10.0.0.0/8 encompasses both 10.1.0.0/16 and 10.2.0.0/16, causing overlap.

Why this answer

The on-premises range 10.0.0.0/8 overlaps with both VPC ranges; VPC peering and VPN both require non-overlapping ranges.

Full explanation →

298

MCQmedium

A company has deployed an HA VPN gateway in Google Cloud to connect to their on-premises network. They have configured two tunnels with IKEv2 and BGP. One tunnel is established, but the second tunnel is not coming up. What could be a likely cause?

A.IKE version is set to IKEv1 on one side

B.The pre-shared keys are mismatched between the two tunnels

C.The second tunnel's peer IP is unreachable

D.BGP timers are inconsistent

AnswerB

A common pitfall is using different PSKs for each tunnel; they must match on both sides.

Why this answer

Common issues include mismatched pre-shared keys or IKE versions. Since the first tunnel works, the configuration is mostly correct, but the second tunnel may have a different pre-shared key or PSK mismatch. Incorrect IKE version is less likely because both tunnels use the same gateway.

BGP timers are usually consistent. Cloud VPN logs would help identify the root cause.

Full explanation →

299

MCQeasy

A company wants to expose a web application running on Cloud Run to the internet with a single global IP address, SSL termination, and Cloud CDN. Which load balancer should they use?

A.External TCP/UDP Network Load Balancer

B.Global External HTTP(S) Load Balancer

C.Global TCP Proxy Load Balancer

D.Regional External HTTP(S) Load Balancer

AnswerB

Correct. Supports serverless NEGs for Cloud Run, global IP, SSL, and CDN.

Why this answer

The Global HTTPS Load Balancer supports serverless backends via serverless NEG, provides SSL termination, Cloud CDN integration, and a single global IP address. The others are either regional or not suitable for serverless backends.

Full explanation →

300

Multi-Selecthard

A company uses Traffic Director with Envoy proxies to manage east-west traffic. They want to implement fault injection to test the resilience of their service mesh. Which TWO types of faults can they inject? (Choose two.)

Select 2 answers

A.Delay (add a fixed latency to matching requests)

B.Throttle (limit the rate of requests)

C.Abort (return a specified HTTP status code)

D.Retry (automatically retry failed requests)

E.Timeout (set a maximum time for a request to complete)

AnswersA, C

Delay adds a fixed latency to matching requests. This is a supported fault injection type in Traffic Director.

Why this answer

Traffic Director supports fault injection for abort (return an HTTP error) and delay (add latency). Throttle is not a supported fault injection type in Traffic Director; it is a rate-limiting feature that is not part of fault injection. Retry and Timeout are routing or circuit breaker features, not fault injection.

Therefore, the two correct answers are abort (C) and delay (A).

Full explanation →

Page 4 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCNE by domain

Target a specific domain to shore up weak areas.

Configuring Network Services Managing, Monitoring, and Optimising Network Operations Implementing Hybrid Interconnectivity Designing, Planning, and Prototyping a GCP Network Implementing VPC Instances Implementing network security Implementing a Virtual Private Cloud

See all domains with question counts →