961 questions total · 13pages · All types, answers revealed
Drag and drop the steps to set up a Private Service Connect for accessing Google APIs privately into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Private Service Connect involves creating an endpoint, assigning IP, setting DNS, and testing.
You are using Traffic Director with Envoy sidecars for a microservices application. You want to inject artificial delays into requests from service A to service B for testing purposes. Which Traffic Director feature should you use?
Fault injection adds delays or aborts to test resilience.
Why this answer
Traffic Director supports fault injection, which allows you to inject delays and abort requests into the traffic between services.
Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?
The producer publishes the service via a service attachment.
Why this answer
The producer (VPC-A) must create a Private Service Connect service attachment that publishes the service. This attachment is associated with a load balancer or a service. Option A is incorrect because the endpoint is created in the consumer VPC (VPC-B).
Option B is incorrect because VPC peering is not used with Private Service Connect (the services can be across organizations without peering). Option D is incorrect because Private Google Access is unrelated to publishing services.
A team is deploying a new service in a Compute Engine instance without an external IP in subnet-b. The service needs to access Google Cloud Storage using internal IPs. What must the team do to enable this?
Enables instances without external IP to reach Google APIs via internal IPs.
Why this answer
Private Google Access enables a Compute Engine instance without an external IP address to reach Google APIs and services (including Cloud Storage) over the internal VPC network using RFC 1918 addresses. By enabling this feature on subnet-b, the instance can access Cloud Storage via internal IPs without needing an external IP or NAT gateway. This is the correct and minimal configuration for the requirement.
How to eliminate wrong answers
Option A is wrong because assigning an external IP address would expose the instance to the internet, violating the requirement to use only internal IPs and introducing unnecessary security risk. Option B is wrong because moving the instance to subnet-a is not required; Private Google Access can be enabled on any subnet, including subnet-b, without moving resources. Option D is wrong because Cloud NAT is used for outbound internet access to non-Google services or for dynamic source IP translation, but Private Google Access directly provides internal IP access to Google APIs without NAT.
A company has two VPC networks connected via VPC Network Peering. They observe asymmetric routing causing connectivity issues. Which configuration is most likely to be the root cause?
This mismatch in next hops causes asymmetric routing.
Why this answer
Asymmetric routing in VPC peering often occurs when both sides have overlapping or conflicting routes, such as custom static routes that point to different next hops. VPC peering requires symmetric routing.
A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?
Secondary ranges must be specified at subnet creation.
Why this answer
In Google Cloud VPC, a subnet can have both a primary IP range and one or more secondary IP ranges, and these secondary ranges must be specified at subnet creation time. For a Kubernetes cluster, the secondary range for pods is required, and it cannot be added after the subnet is created; it must be defined during the initial subnet creation.
Exam trap
Google Cloud often tests the misconception that secondary IP ranges can be added to an existing subnet via an update, but in Google Cloud, they must be specified at subnet creation time and are immutable afterward.
How to eliminate wrong answers
Option B is wrong because Google Cloud does not allow adding a secondary IP range to an existing subnet after creation; secondary ranges must be specified at creation time. Option C is wrong because a single subnet can have both primary and secondary ranges, and creating two separate subnets would not associate the secondary range with the primary subnet as required by Kubernetes. Option D is wrong because auto mode subnets automatically assign primary ranges, but they do not automatically assign secondary ranges; secondary ranges must be explicitly defined, and auto mode does not solve the requirement for a specific primary range.
Which two of the following are prerequisites for configuring an HA VPN tunnel to an on-premises network? (Choose two.)
Cloud Router is required for BGP route exchange.
Why this answer
B is correct because an HA VPN tunnel uses dynamic routing via BGP to provide active-active or active-passive failover. A Cloud Router with BGP configured in the same region as the VPN gateway is required to exchange routes with the on-premises network, enabling automatic failover and load balancing across the two tunnels.
A company needs to connect their on-premises data center to Google Cloud with a consistent, high-availability connection that offers 99.99% availability SLA. The on-premises router supports VLAN tagging and BGP. They expect to burst up to 50 Gbps peak traffic. Which interconnect solution should they choose?
Dedicated Interconnect offers 99.99% SLA and supports multiple 10/40/100 Gbps connections.
Why this answer
Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, supporting up to 80 Gbps per connection (via 10 or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant links and BGP sessions. The on-premises router's support for VLAN tagging and BGP aligns perfectly with Dedicated Interconnect's requirements for 802.1Q VLANs and eBGP peering, making it the only option that meets the 50 Gbps burst requirement and high-availability SLA.
Exam trap
Google Cloud often tests the misconception that HA VPN can achieve high throughput by aggregating multiple tunnels, but in Google Cloud, each HA VPN tunnel is limited to 3 Gbps and cannot be combined to exceed that per-VPC limit, making it unsuitable for 50 Gbps bursts.
How to eliminate wrong answers
Option A is wrong because Cloud VPN with dynamic routing is limited to a maximum throughput of 3 Gbps per tunnel (using HA VPN) and does not offer a 99.99% SLA, making it insufficient for 50 Gbps peak traffic. Option C is wrong because Partner Interconnect relies on a third-party service provider's network, which introduces additional latency and typically offers a maximum of 10 Gbps per VLAN attachment, and its SLA is often lower than 99.99% due to the partner's infrastructure. Option D is wrong because HA VPN, while providing high availability with two tunnels, still caps at 3 Gbps per tunnel and cannot aggregate to 50 Gbps, and its SLA is 99.99% only for the VPN service itself, not the underlying bandwidth capacity.
Inbound server policy allows on-premises to resolve private zones; forwarding zone allows GCP to resolve on-premises.
Why this answer
Cloud DNS supports inbound server policies that allow on-premises DNS resolvers to forward queries for private zone names (e.g., `gcp.internal`) to Cloud DNS via the Cloud VPN. A forwarding zone in the VPC directs queries for on-premises hostnames (e.g., `corp.example.com`) to the on-premises DNS servers. This bidirectional resolution is achieved without exposing DNS to the internet, leveraging BGP for routing.
Exam trap
Google Cloud often tests the distinction between DNS peering (VPC-to-VPC) and DNS forwarding/inbound policies (VPC-to-on-premises), causing candidates to mistakenly choose peering for hybrid scenarios.
How to eliminate wrong answers
Option B is wrong because split-horizon DNS is a design pattern, not a Google Cloud architecture component; it does not provide the required integration between Cloud DNS and on-premises DNS over VPN. Option C is wrong because Cloud DNS peering zones only allow DNS resolution between VPCs within Google Cloud, not between a VPC and an on-premises network. Option D is wrong because DNS over HTTPS to Google Public DNS would only resolve public internet names, not private zone names or on-premises hostnames, and bypasses the VPN.
An organization wants to restrict which Google APIs can be accessed by resources in a specific VPC. They also want to prevent data exfiltration to unauthorized projects. Which Google Cloud service should they use?
Correct. VPC Service Controls define service perimeters to control API access and data exfiltration.
Why this answer
VPC Service Controls create service perimeters that restrict API access and prevent data exfiltration based on projects and VPCs.
A company is running workloads on Compute Engine instances without public IP addresses. They need to allow these instances to securely access the internet for software updates. Which Google Cloud service should be configured?
Cloud NAT enables outbound internet traffic from instances without public IPs.
Why this answer
Cloud NAT (Network Address Translation) allows Compute Engine instances without public IP addresses to initiate outbound connections to the internet for tasks like software updates. It translates the private IP addresses of the instances to a public IP address managed by Google Cloud, enabling secure outbound internet access without exposing the instances to inbound traffic.
Exam trap
Google Cloud often tests the distinction between Private Google Access (which only reaches Google APIs) and Cloud NAT (which provides full internet access), causing candidates to confuse the two when the requirement is for general internet connectivity like software updates.
How to eliminate wrong answers
Option A is wrong because Cloud VPN creates an encrypted tunnel to an on-premises network, not to the general internet; it does not provide outbound internet access for instances without public IPs. Option B is wrong because Private Google Access allows instances to reach Google APIs and services using private IPs, but it does not provide access to the broader internet for software updates. Option D is wrong because VPC Peering connects two VPC networks privately, but it does not provide internet access; it only enables communication between the peered networks.
A company has a Dedicated Interconnect connection from their on-premises data center to GCP. They have set up BGP sessions over VLAN attachments to peer with their VPC. Traffic from on-premises to GCP works, but return traffic from GCP to on-premises is dropped at the on-premises firewall. What is the most likely cause?
If the on-premises prefix is not advertised, GCP routes return traffic through the internet, causing asymmetric routing and firewall drops.
Why this answer
The most likely cause is that the on-premises router is not advertising the on-premises prefix to GCP via BGP. For return traffic from GCP to be routed correctly, GCP must learn the on-premises network prefix through a BGP advertisement from the on-premises router. Without this advertisement, GCP has no route to send traffic back, causing the firewall to drop the packets as they have no valid path.
How to eliminate wrong answers
Option A is wrong because the VLAN attachment can be in a different region than the GCP resources; traffic is routed through the VPC's global routing, and region mismatch does not cause return traffic to be dropped at the on-premises firewall. Option B is wrong because GCP firewall rules control traffic entering or leaving VM instances, not traffic that is already routed through the Dedicated Interconnect; the issue is at the on-premises side, not in GCP. Option C is wrong because MTU inconsistency would typically cause fragmentation issues or packet loss, not a complete drop of return traffic at the firewall; the firewall drop indicates a routing or prefix advertisement problem.
An organization wants to publish a private service using Private Service Connect (PSC) so that consumers in other VPCs can access it via private IPs. Which TWO resources are required on the producer side? (Choose TWO.)
The service attachment exposes the service to consumers.
Why this answer
To publish a service via PSC, the producer creates a service attachment on a regional internal load balancer (ILB) and also configures a private service connection (or simply the service attachment). The service attachment is associated with the ILB's forwarding rule.
An organization is migrating on-premises workloads to GCP. They need a dedicated, high-bandwidth connection with a 99.99% SLA. They have a co-location facility near a Google Cloud region. Which connectivity option should they choose?
Dedicated Interconnect provides direct, dedicated connections with a 99.99% SLA when using redundant links.
Why this answer
Dedicated Interconnect provides direct physical connections (10G or 100G links) between on-premises and Google's network, offering a 99.99% SLA when using redundant connections.
A company is deploying a global application on Google Cloud using Cloud Load Balancing. They want to serve traffic from multiple regions and require the lowest possible latency for users worldwide. The application serves HTTP traffic and uses a static IP address. Which load balancing solution should they use?
External HTTP(S) Load Balancer with Premium Tier uses Google's global network and anycast IP to direct users to the nearest backend, minimizing latency.
Why this answer
The External HTTP(S) Load Balancer with Premium Tier is correct because it uses Google's global anycast IP address to route user traffic to the nearest frontend, minimizing latency worldwide. Premium Tier leverages Google's global network backbone, ensuring traffic enters and exits at the closest Google edge point of presence (PoP) for HTTP(S) traffic, which is essential for a global application requiring low latency and a static IP.
Exam trap
Google Cloud often tests the misconception that any load balancer with 'HTTP(S)' in its name is automatically global, but the trap here is that only the External HTTP(S) Load Balancer with Premium Tier provides global anycast routing; the Internal and SSL Proxy variants are regional, and the Network Load Balancer is Layer 4 only.
How to eliminate wrong answers
Option A is wrong because a Network Load Balancer is a regional, passthrough load balancer that operates at Layer 4 (TCP/UDP) and does not support HTTP(S) traffic or global anycast IPs, making it unsuitable for global low-latency HTTP traffic. Option B is wrong because an Internal HTTP(S) Load Balancer is designed for internal VPC traffic within a single region and cannot serve traffic from the internet or use a public static IP. Option C is wrong because an SSL Proxy Load Balancer terminates SSL/TLS connections but is regional (not global) and does not provide the lowest possible latency for worldwide users compared to the Premium Tier's global anycast routing.
Which TWO of the following are benefits of using Cloud NAT?
This is the primary purpose of Cloud NAT.
Why this answer
Cloud NAT enables outbound connectivity from private instances that lack public IP addresses. It translates private source IPs to a single or a pool of external IPs, allowing instances to reach the internet while remaining unreachable from outside. This is essential for security and compliance in VPC networks.
A company uses VPC Service Controls with a service perimeter that includes Project A. They want to allow an external identity from Project B (outside the perimeter) to access a Cloud Storage bucket in Project A, but only during business hours. Which VPC Service Controls feature should they use?
Correct. Access levels can define time conditions, and ingress rules allow specified traffic from outside the perimeter.
Why this answer
VPC Service Controls use access levels (e.g., based on IP, time) and ingress rules to allow traffic from outside the perimeter. Ingress rules define which identities and resources can access perimeters.
Which THREE actions should you take to secure a VPC that hosts public-facing web applications?
Provides outbound connectivity without exposing VMs.
Why this answer
Cloud NAT enables outbound internet access for private VMs without assigning them public IP addresses, which reduces the attack surface. This is a secure alternative to direct internet access because it allows outbound connections initiated by the VMs while blocking unsolicited inbound traffic from the internet. It works by translating private IP addresses to a set of ephemeral public IPs managed by Google Cloud.
Exam trap
Google Cloud often tests the misconception that VPC Flow Logs are a security control that can block traffic, when in reality they are only a logging and monitoring feature, not an enforcement mechanism.
You run the command shown in the exhibit. Your on-premises network is connected to your VPC via a Cloud Router with two BGP sessions. You notice that your on-premises network receives routes for only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) but not for other subnets in the VPC. What is the most likely cause?
With advertiseMode CUSTOM, the router only advertises the explicitly listed ranges, ignoring ALL_SUBNETS unless it is the only group. The advertisedGroups includes ALL_SUBNETS but since mode is CUSTOM, only custom ranges are advertised.
Why this answer
The Cloud Router's custom route advertisement configuration explicitly controls which routes are advertised to on-premises via BGP. If only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) are included in the custom advertisement, other VPC subnets will not be advertised, even if they exist. The exhibit shows that the on-premises network receives only those two ranges, which directly matches a custom advertisement setup rather than the default ALL_SUBNETS behavior.
Exam trap
The trap here is that candidates often assume BGP session establishment implies all routes are automatically exchanged, but Cloud Router's custom advertisement feature allows granular control over which prefixes are advertised, and the default ALL_SUBNETS behavior is not active when custom ranges are explicitly listed.
How to eliminate wrong answers
Option A is wrong because if the BGP interface IP addresses 169.254.x.x were unreachable, the BGP sessions would not establish at all, and no routes would be received—not just a subset. Option B is wrong because the BGP peer ASN 65001 is a private ASN commonly used in GCP Cloud Router configurations; if the on-premises router did not recognize it, the BGP session would fail to establish, again resulting in zero routes. Option C is wrong because if advertisedGroups included ALL_SUBNETS, the Cloud Router would advertise all VPC subnets by default; the router does not 'ignore' this setting due to misconfiguration—either it is set or it is not, and the observed behavior (only two ranges) indicates custom advertisement is in use.
A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between all services. Which component is responsible for issuing and distributing certificates to the Envoy proxies?
Traffic Director uses CAS or its own CA to issue and distribute certificates for mTLS.
Why this answer
Traffic Director integrates with Certificate Authority Service (CAS) or uses its own CA to issue certificates for mTLS. Envoy's SDS (Secret Discovery Service) can also be used, but Traffic Director manages the CA.
A company is using Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer has created a VLAN attachment of type PARTNER_PROVIDER in Google Cloud. What must the service provider do to complete the connection?
The pairing key is used by the service provider to complete the connection. This is the correct step.
Why this answer
For Partner Interconnect, the customer creates a VLAN attachment of type PARTNER (not PARTNER_PROVIDER) and gets a pairing key. The service provider uses this pairing key to connect their network to the customer's VLAN attachment. Therefore, the provider must provide the pairing key, not create a separate VLAN attachment.
Option B correctly states this.
A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?
Correct: Packet Mirroring clones traffic and forwards it to monitoring tools.
Why this answer
Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.
A company is designing a highly available hybrid network using HA VPN. They need to ensure that if one VPN tunnel fails, traffic automatically fails over to the other tunnel. Which TWO configurations are required? (Choose TWO.)
BGP allows dynamic routing and automatic failover when one tunnel goes down.
Firewall rules must allow traffic from the on-premises IP range to the VM's target tags or service account.
Why this answer
VPC firewall rules are the first line of defense for controlling traffic to GCE VMs. Even though the VPN tunnel is established, the default-deny ingress posture of GCP means that traffic from the on-premises subnet must be explicitly allowed by a VPC firewall rule. Without this rule, packets arriving via the tunnel are dropped before they ever reach the VM's network interface.
Exam trap
Google Cloud often tests the misconception that a working tunnel implies all traffic flows, but the trap here is that VPC firewall rules are independent of tunnel status and must be explicitly configured for the on-premises subnet as the source.
How to eliminate wrong answers
Option B is wrong because the VM's OS firewall is a secondary concern; the VPC firewall operates before traffic reaches the VM, so checking the OS firewall first would be premature. Option C is wrong because the tunnel is already established, which confirms that the pre-shared key is correct; a mismatched PSK would prevent the tunnel from coming up. Option D is wrong because Cloud Armor security policies apply to HTTP(S) load balancing and external traffic, not to traffic arriving through a VPN tunnel, which is internal to the VPC.
An enterprise uses Shared VPC with a host project and multiple service projects. A service project team wants to create a Cloud VPN tunnel to their on-premises network. What must the network team configure in the host project to allow this?
Correct configuration; the networking resources are in the host project.
Why this answer
In a Shared VPC setup, the VPN gateway and Cloud Router must reside in the host project's VPC because the host project owns the underlying network infrastructure. The service project can then use the VPN tunnel by being granted the `compute.networkUser` role on the host project, which allows it to create forwarding rules and use the VPN resources. This ensures that the VPN termination point is within the shared VPC network, enabling connectivity to on-premises networks.
How to eliminate wrong answers
Option A is wrong because the service project cannot create a VPN gateway directly in its own project using a VPC peered with the host project; VPC peering does not support Cloud VPN termination, and the VPN gateway must reside in the host project's VPC. Option C is wrong because Cloud VPN is fully supported with Shared VPC; Dedicated Interconnect is a separate, higher-bandwidth option, not a requirement. Option D is wrong because both the Cloud Router and the VPN gateway must be created in the host project, not split between projects; the service project cannot host the Cloud Router for a VPN tunnel terminating in the host project.
An engineer needs to verify that a Compute Engine instance can reach a specific IP address on the internet, considering firewall rules and routes. Which Network Intelligence Center tool should they use?
Connectivity Tests is designed for this purpose.
Why this answer
Connectivity Tests allow you to test reachability between a source and a destination, checking firewall rules, routes, and VPC peering configurations.
Refer to the exhibit. A Cloud VPN tunnel is configured with the above Cloud Router configuration. The on-premises BGP peer is at 169.254.0.2 with ASN 65001. The on-premises router is receiving the route 10.0.0.0/8 from the Cloud Router, but it is not receiving any of the specific subnets (e.g., 10.1.0.0/16) that exist in the VPC. What is the most likely cause?
Custom mode means only the listed ranges are advertised; VPC subnets are not included unless explicitly added.
Why this answer
The Cloud Router is configured with custom advertise mode, which means it only advertises the manually specified CIDR ranges to the on-premises BGP peer. Since the specific subnets (e.g., 10.1.0.0/16) are not included in the custom advertised ranges, the on-premises router receives only the explicitly listed 10.0.0.0/8 route, not the more specific subnets.
Exam trap
Google Cloud often tests the distinction between route advertisement control (custom vs. default mode) and route selection attributes (like priority/MED), leading candidates to incorrectly attribute missing routes to priority settings rather than advertisement configuration.
How to eliminate wrong answers
Option A is wrong because advertised_route_priority influences route selection (MED) but does not suppress route advertisement; routes are still sent regardless of priority value. Option C is wrong because if the BGP session were not established due to ASN mismatch, the on-premises router would not receive any routes at all, not just missing specific subnets. Option D is wrong because an incorrect on-premises peer ASN would prevent the BGP session from forming, which contradicts the fact that the on-premises router is already receiving the 10.0.0.0/8 route.
A company runs a global e-commerce platform with a monolithic application deployed on Compute Engine. They want to modernize by splitting the monolith into microservices running on Cloud Run and Cloud Functions, and expose them externally via a single anycast IP with Google-managed SSL certificates. Which load balancer should they use?
Correct. It supports serverless NEGs, global anycast IP, and Google-managed SSL certificates.
Why this answer
The Global External HTTPS Load Balancer supports serverless NEGs for Cloud Run and Cloud Functions, provides an anycast IP, and offers Google-managed SSL certificates. The Regional External HTTPS LB is regional and does not provide global anycast. The Global SSL Proxy LB does not support serverless NEGs.
The Global TCP Proxy LB also does not support serverless NEGs.
Active-active BGP with multiple sessions is correct in concept, but using different ASNs is not recommended; same ASN should be used for all on-premises routers to avoid asymmetric routing.
Why this answer
Exam trap
The trap is that candidates may think any active-active BGP configuration is correct, but details like ASN assignment matter. Using different ASNs can lead to asymmetric routing, so the same ASN must be used.
How to eliminate wrong answers
Option A is wrong because active-passive BGP with a single session creates a single point of failure; if the session or tunnel fails, there is no automatic failover to another tunnel. Option C is wrong because policy-based routing does not integrate with BGP's dynamic route advertisement and withdrawal, making failover slower and less reliable in a multi-tunnel HA VPN setup. Option D is wrong because static routes require manual intervention or complex scripting to detect tunnel failure and switch routes, whereas BGP provides automatic failover through route withdrawal.
A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?
Correct: BigQuery enables efficient querying and analysis of large log datasets.
Why this answer
Load balancing logs can be exported to BigQuery for powerful SQL-based analysis and long-term retention.
A company wants to expose an on-premises HTTP server to internet clients through a Global HTTPS Load Balancer using a hybrid connectivity NEG. The on-prem server is reachable via a Cloud VPN tunnel. What must the engineer configure to ensure the load balancer can reach the on-prem endpoint?
A route is required so that packets from the load balancer reach the on-prem server via VPN.
Why this answer
Hybrid connectivity NEGs require a custom route that directs traffic to the on-prem network via the VPN tunnel. The load balancer's health check source ranges also need routes back. Firewall rules are necessary but not the primary routing requirement.
An organization has multiple VPCs in different projects that need to consume a common internal service hosted in a central project. The service runs on a set of Compute Engine instances with internal IPs. Which architecture allows the consumers to access the service using private IPs without VPC peering?
Private Service Connect is designed for this use case, providing private IP access without peering.
Why this answer
Private Service Connect allows you to publish internal services via Private Service Connect endpoints in consumer VPCs. Consumers access the service using internal IPs without needing VPC peering or VPNs. This is the recommended architecture for publishing and consuming internal services across projects.
Which TWO of the following are valid ways to target firewall rules in Google Cloud? (Select 2)
Service accounts allow identity-based targeting.
Why this answer
Firewall rules can target instances by network tags or by service accounts. Tags are key-value pairs, and service accounts provide identity-based targeting.
An organization needs to connect two VPCs in different regions using Google's backbone. What is the recommended solution?
VPC Peering connects VPCs using Google's private network.
Why this answer
VPC Peering uses Google's backbone to connect VPCs across regions without public internet.
An organization wants to direct traffic from a global load balancer to an on-premises data center using a hybrid connectivity NEG. Which connectivity option must be in place for this to work?
A Cloud VPN tunnel or Cloud Interconnect VLAN attachment is required to establish connectivity to on-premises.
A financial institution is setting up Dedicated Interconnect with Google Cloud. They have two on-premises routers (R1 and R2) each connected to a separate Google Cloud router via VLAN attachments in two different zones (us-central1-a and us-central1-b). The on-premises routers are configured with BGP, and they advertise the corporate prefix 10.0.0.0/8. Google Cloud routers are configured with custom route advertisements. After provisioning, you notice that traffic from some on-premises subnets to GCP experiences asymmetrical routing, causing packet drops. You verify that both BGP sessions are established and that both Cloud Routers have received the 10.0.0.0/8 route. What is the most likely cause of the asymmetrical routing?
Different local preferences cause one path to be preferred for return traffic, while forward traffic may take the other path, leading to asymmetry.
Why this answer
Asymmetrical routing in a dual-homed Dedicated Interconnect setup occurs when on-premises routers have different BGP local preference values for routes received from Google Cloud. Local preference is the first BGP attribute considered when selecting the best path outbound from the on-premises network. If R1 has a higher local preference for the GCP routes than R2, all outbound traffic from on-premises will prefer R1, while return traffic from GCP may arrive via either router (depending on GCP's routing), causing a mismatch in traffic paths and packet drops.
Exam trap
Google Cloud often tests the distinction between BGP attributes that influence inbound traffic (MED, AS-path prepend) versus outbound traffic (local preference), and the trap here is that candidates may incorrectly attribute asymmetrical routing to MED or MTU issues rather than recognizing that local preference mismatch on the on-premises side is the root cause of asymmetric outbound path selection.
How to eliminate wrong answers
Option B is wrong because using the same AS number on both on-premises routers would cause BGP loop prevention only if the routers are in the same AS and the Cloud Routers see the same AS path; however, Google Cloud allows multi-homing with the same ASN by using 'allowas-in' or 'as-path prepend', and this would not directly cause asymmetrical routing—it would more likely cause route rejection or path selection issues. Option C is wrong because mismatched MTU sizes on VLAN attachments would cause fragmentation or packet drops at the link layer, not asymmetrical routing; asymmetrical routing is a Layer 3 path selection issue, not a Layer 2 MTU mismatch. Option D is wrong because Cloud Router sets BGP metric (MED) attributes per VLAN attachment only when custom route advertisements are configured with specific MED values, but MED is used to influence inbound traffic from on-premises, not outbound; asymmetrical routing here is caused by outbound path selection differences on the on-premises side, not by GCP's MED settings.
This provides interface-level redundancy and achieves maximal availability with a single on-premises device.
Why this answer
It provides high availability by using a single Cloud VPN gateway with two interfaces, each with its own external IP, and two BGP sessions to the on-premises device. This configuration allows active/active failover: if one interface or BGP session fails, traffic automatically switches to the other, maximizing availability without requiring multiple regions.
Exam trap
Google Cloud often tests the misconception that high availability requires multiple regions or gateways, but the trap here is that a single HA VPN gateway with dual interfaces and dual BGP sessions provides sufficient redundancy for a single on-premises device, avoiding unnecessary complexity.
How to eliminate wrong answers
Option A is wrong because deploying two Cloud VPN gateways in different regions introduces unnecessary complexity and cost; regional failover is not needed when the on-premises side has a single VPN device, and HA VPN with two interfaces on a single gateway already provides sufficient availability. Option B is wrong because a single interface and single BGP session creates a single point of failure; if the interface or BGP session goes down, connectivity is lost, which does not maximize availability. Option D is wrong because using only one BGP session with two interfaces defeats the purpose of redundancy; the second interface would remain idle and not provide automatic failover, leaving a single point of failure in the control plane.
You are configuring a health check for a backend service that expects gRPC health probing. Which protocol should the health check use to verify gRPC service health?
Correct: gRPC health checks use the gRPC health protocol.
Why this answer
gRPC health checks use the gRPC protocol to query the standard gRPC health check endpoint.
After configuring Cloud VPN with dynamic routing (BGP), you notice that on-premises routes are not appearing in Google Cloud. BGP sessions are established but no prefixes are exchanged. Cloud Router logs show: 'No route advertisement received'. On-premises BGP configuration shows 'network 10.0.0.0/8' and 'neighbor 10.1.1.1 remote-as 65000'. What is the most likely cause?
BGP requires the network to be in the routing table, and 'activate' is needed to start sending updates.
Why this answer
The on-premises BGP configuration uses the 'network 10.0.0.0/8' command, which requires an exact match in the local routing table to be advertised. Without a route for 10.0.0.0/8 (e.g., a connected or static route), BGP will not advertise it. Additionally, the 'neighbor 10.1.1.1 activate' command is missing under BGP, which is required to enable the exchange of prefixes with that neighbor.
These two issues together prevent route advertisement to Google Cloud.
Exam trap
Google Cloud often tests the misconception that an established BGP session automatically implies route exchange, but candidates must remember that the 'network' command requires an exact routing table match and that 'neighbor activate' is needed under the address family to actually send prefixes.
How to eliminate wrong answers
Option B is wrong because BGP peers do not need to be in the same subnet; they only need Layer 3 reachability, which is confirmed by the established BGP session. Option C is wrong because the BGP session is already established, indicating that the Cloud Router's BGP peer IP is reachable from the on-premises router. Option D is wrong because an incorrect MD5 password would prevent the BGP session from establishing, but the session is up, so authentication is not the issue.
A company has two VPC networks in the same project: 'vpc-a' (us-central1) and 'vpc-b' (us-east1). They are connected via VPC Network Peering. An instance in vpc-a can ping the internal IP of an instance in vpc-b, but cannot reach it on TCP port 8080. The firewall rule in vpc-b allows ingress from the peered network's subnets. What is the most likely cause?
Since ICMP works but TCP 8080 does not, the specific firewall rule for port 8080 is likely missing or misconfigured.
Why this answer
Since ICMP (ping) works, VPC Network Peering is functioning correctly, and the firewall rule in vpc-b allows ingress from the peered network's subnets. The failure on TCP 8080 indicates a missing or misconfigured firewall rule specific to that port, possibly due to incorrect target tags or service accounts. Option D is incorrect because the rule already permits ingress from the peered subnets; the issue is that no rule explicitly allows TCP 8080.
Therefore, the most likely cause is that the firewall rule for port 8080 is missing or uses an incorrect target tag or service account, making option C correct.
A security team needs to capture all traffic to and from a specific Compute Engine instance for forensic analysis. They want to send the mirrored traffic to a third-party IDS appliance running on a separate VM in the same VPC. Which GCP feature should they use, and what is a key consideration?
Packet Mirroring copies all packets; collector must be in same VPC.
Why this answer
Packet Mirroring allows copying all traffic from a source instance (the mirrored instance) and sending it to a collector. A key consideration is that the collector must be in the same VPC network and must not be the same instance as the source.
A network engineer wants to monitor the operational status of a Dedicated Interconnect link using Cloud Monitoring. Which metric should they use to check if the physical link is up or down?
This metric reports the link status: 1 for up, 0 for down.
Why this answer
The metric `interconnect/link/operational_status` directly indicates whether the physical link is up (1) or down (0).
Logs of allocation failures for troubleshooting.
Why this answer
Cloud NAT provides two types of logs: NAT logs (connection information) and translation logs (allocation failures). Both are useful for monitoring and troubleshooting.
An engineer needs to configure Cloud Armor to block requests from a specific IP address (10.1.2.3) while allowing all other traffic. They create a security policy with a deny rule for that IP and an allow rule for all traffic. What priority should the deny rule have relative to the allow rule?
Correct. Lower priority number means higher precedence, so the deny rule is evaluated first.
Why this answer
In Cloud Armor, rules are evaluated from lowest to highest priority (lower number = higher priority). The deny rule must have a lower priority number than the allow rule to be evaluated first and block the IP before the allow rule applies. Typically, the allow-all rule has highest priority (e.g., 2147483647).
Which TWO statements about Cloud Router BGP are correct? (Choose two.)
Private ASN is commonly used.
Why this answer
Cloud Router can use a private ASN (64512-65534) for BGP peering, which is common when connecting to on-premises networks that do not require a public ASN. This allows flexibility in hybrid interconnectivity without needing to register a public ASN.
Exam trap
Google Cloud often tests the misconception that Cloud Router requires a public ASN or that it uses multi-hop eBGP by default, when in fact private ASNs are supported and single-hop eBGP is the default behavior.
A company is designing a hybrid network using Dedicated Interconnect. They want to achieve a 99.99% SLA for availability. Which THREE configurations are required to meet this SLA?
Each VLAN attachment provides a logical path.
A company wants to enable VPC Flow Logs for a subnet to troubleshoot connectivity issues. They have enabled flow logs with a sample rate of 1.0 and metadata annotation enabled. After a few hours, they notice that logs are being generated but they are missing flows from a specific application server to a database server in the same subnet. Both servers are Compute Engine instances with internal IPs only. What could be the cause?
Traffic within the same subnet is sent directly at layer 2, bypassing the router where flow logs are captured.
Why this answer
VPC Flow Logs capture IP traffic that traverses the VPC router. Traffic between two instances within the same subnet is forwarded at layer 2, without going through the router, so it is not captured by flow logs. This is why the flows from the application server to the database server are missing.
Option D correctly identifies this behavior.
An organization wants to prevent data exfiltration from a project that uses Google Cloud Storage and BigQuery. They need to restrict access to these services from only the authorized VPC networks. Which service should they use?
VPC Service Controls create perimeters to protect data.
Why this answer
VPC Service Controls allow creating a service perimeter around GCP services (like Cloud Storage and BigQuery) to restrict data access to only authorized VPCs and projects. This prevents data exfiltration.
A startup is setting up a new GCP project and needs to create a VPC that will have predictable IP ranges for future peering with other VPCs. They do not anticipate needing to grow the network beyond the initial IP range. Which VPC type should they choose?
Custom mode VPC provides full control over subnet IP ranges, avoiding overlap for peering.
Why this answer
Custom mode VPCs allow you to define your own subnets with specific IP ranges. Auto mode VPCs automatically create subnets in every region, which can cause IP overlap when peering. For controlled, predictable IP ranges, custom mode is appropriate.
Which IP address type in Google Cloud can communicate with the internet but is not reachable from the internet?
Internal IP addresses are private and not directly reachable from the internet.
An organization has a hybrid network with multiple BGP sessions between on-premises and GCP. They want to influence outbound traffic from GCP to prefer a specific path. Which BGP attribute should they adjust on the Cloud Router?
Local Preference influences outbound traffic from GCP by setting a preference for paths within the AS. A higher Local Preference on a Cloud Router session makes GCP prefer that path for outbound traffic. This is the correct attribute.
Why this answer
To influence outbound traffic from GCP (i.e., which path GCP uses to send traffic to on-premises), the correct BGP attribute is Local Preference. Local Preference is an attribute that influences the outbound path selection within the local AS. On Cloud Router, setting a higher Local Preference for a specific BGP session makes GCP prefer that path for outbound traffic.
MED, on the other hand, is used to influence inbound traffic to GCP by telling neighboring ASes which path to prefer.
Exam trap
A common mistake is confusing MED with Local Preference. MED influences how neighboring ASes choose paths for inbound traffic to GCP, while Local Preference influences outbound path selection from GCP. For controlling outbound traffic, adjust Local Preference on the Cloud Router.
How to eliminate wrong answers
Option B (Local Preference) is wrong because Local Preference is used to influence outbound traffic from the local AS (i.e., which path GCP uses to send traffic out), not to influence how other ASes route traffic into GCP; it is an attribute exchanged only within an AS, not advertised to neighbors. Option C (Next hop) is wrong because the Next hop attribute simply indicates the IP address of the next router to reach a destination; modifying it does not influence path selection preference for outbound traffic from GCP. Option D (AS Path prepend) is wrong because AS Path prepend makes a path less preferred by artificially lengthening the AS_PATH, which is used to influence inbound traffic from other ASes, but it is not the primary attribute for influencing outbound traffic from GCP; MED is more granular and directly controls path selection at the multi-exit point.
A company needs a dedicated, low-latency connection from their on-premises data center to GCP with a 10 Gbps capacity. They require the highest availability and service level agreement (SLA). Which connectivity option should they choose?
Dedicated Interconnect provides dedicated, low-latency connection with high SLA.
Why this answer
Dedicated Interconnect provides a direct, private connection between the on-premises data center and GCP with 10 Gbps capacity. By using two connections to different meet-me rooms, the company achieves the highest availability and meets the 99.99% SLA, as this eliminates single points of failure at the physical layer and within a single facility.
Exam trap
Google Cloud often tests the misconception that Partner Interconnect can match the SLA of Dedicated Interconnect, but the key trap is that Partner Interconnect's SLA is limited to the partner's network and does not cover the entire path from on-premises to GCP.
How to eliminate wrong answers
Option A is wrong because Carrier Peering uses a shared connection over the public internet, does not offer a 10 Gbps dedicated capacity, and provides no SLA for availability or latency. Option C is wrong because Partner Interconnect relies on a third-party provider's network, which introduces additional latency and does not offer the same 99.99% SLA as Dedicated Interconnect; two VLAN attachments from different providers still depend on the partner's infrastructure. Option D is wrong because Cloud VPN uses encrypted tunnels over the public internet, cannot guarantee 10 Gbps throughput (typically limited to ~3 Gbps per tunnel), and provides no SLA for latency or availability.
A company wants to resolve DNS queries from their on-premises network for Google Cloud private zones (e.g., example.internal) without duplicating DNS data. Which Cloud DNS feature should they use?
Inbound server policy enables on-premises resolvers to forward queries to Cloud DNS.
Why this answer
Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS for resolution of private zones. This avoids the need to replicate zone data on-premises.
A company has deployed a network appliance (e.g., firewall) as a Compute Engine instance with two NICs: NIC0 for management and NIC1 for data traffic. The appliance must forward traffic from instances in subnet A to subnet B. The engineer has enabled IP forwarding on the appliance. What additional configuration is required on the VPC for the appliance to route traffic between subnets?
This custom route directs traffic to the appliance for forwarding.
Why this answer
For a Compute Engine instance to forward traffic between subnets, it must act as a router. The VPC needs a custom route that sends traffic destined for subnet B to the appliance's IP (or NIC) as the next hop. Without this route, the VPC's default routing will deliver traffic directly between subnets, bypassing the appliance.
Also, the appliance's NIC1 must be in the same VPC and the firewall rules must allow the traffic.
Which THREE are valid considerations when planning IP address ranges for VPCs that will be connected via VPC Peering and Cloud VPN? (Choose 3)
Leaving space avoids renumbering later.
Why this answer
Avoid overlapping ranges, use RFC 1918 addresses, and ensure unique ranges for each subnet.
A network engineer is configuring BGP on a Cloud Router for a Dedicated Interconnect. They want to apply traffic engineering to prefer one path over another for inbound traffic from on-premises to GCP. Which THREE BGP attributes can be used to influence this inbound traffic? (Choose three.)
Communities can affect route preference (e.g., prepend to peers) and influence inbound traffic.
Why this answer
MED (metric) is the primary attribute to influence inbound traffic. AS path prepending (adding AS numbers) makes a path less preferred. Communities (like no-export) can control route propagation and thus influence path selection.
A company wants to apply consistent firewall rules across all projects in an organization. They need to block all traffic to ports 22 and 3389 from the internet to any VMs in any project. Which approach is most scalable and maintainable?
Hierarchical policies apply to all projects under the org, ensuring consistency.
Why this answer
Hierarchical firewall policies allow you to define firewall rules at the organization or folder level that apply to all VPCs under that node. This ensures consistency and avoids duplication across projects. The policy is evaluated before VPC firewall rules.
Which TWO of the following are true regarding VPC Network Peering? (Choose TWO.)
Overlapping IP ranges are not allowed in VPC peering.
Why this answer
VPC Network Peering requires that the subnet IP ranges of the peered VPCs do not overlap. Overlapping ranges would cause routing conflicts and ambiguous destination addresses, as GCP uses the subnet CIDR blocks to determine the next hop for traffic. If two VPCs have overlapping ranges, packets cannot be reliably forwarded to the correct destination, breaking the peering connection.
Exam trap
Google Cloud often tests the misconception that VPC Network Peering supports transitive routing or dynamic route exchange, leading candidates to select options B or C, when in fact peering is strictly non-transitive and only exchanges subnet and static routes.
A company has two Dedicated Interconnect connections to two separate Google Cloud regions for redundancy. They use Cloud Router with BGP to exchange routes. They want to ensure that traffic from on-premises to a specific VPC in us-central1 uses only the interconnect to us-central1, and the other interconnect is used only as a backup. How can they achieve this?
Correct. By setting a lower MED on the on-premises router for routes from the us-central1 interconnect, traffic will prefer that path.
Why this answer
Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to a specific entry point. By setting a lower MED value on the on-premises router for the routes advertised via the us-central1 interconnect, the on-premises network will prefer that path for traffic destined to the VPC in us-central1. The other interconnect will only be used if the preferred path fails, providing the desired active/backup behavior.
Exam trap
Candidates often mistakenly believe that Google Cloud can influence inbound path selection via BGP communities or custom route advertisements, but these affect outbound traffic from Google Cloud. For inbound path selection, the on-premises router must set a lower MED value on the preferred interconnect.
How to eliminate wrong answers
Option B is wrong because BGP communities on Google Cloud are used to tag routes for controlling route advertisement or applying routing policies within Google's network, not to influence path selection from on-premises; the on-premises router must set the MED or other attributes. Option C is wrong because AS path prepending makes a path longer (less preferred), which would cause the on-premises router to prefer the other interconnect, not the us-central1 one. Option D is wrong because Cloud Router's custom route advertisements control which routes are advertised to on-premises, not how on-premises selects among multiple paths; path selection is determined by BGP attributes on the on-premises side.
A company has a VPC with subnets in us-central1 and europe-west1. They need to allow Compute Engine instances in us-central1 (without external IPs) to access Google Cloud Storage buckets in the US multi-region. They also need to ensure the traffic does not traverse the public internet. Which TWO configurations are required? (Choose TWO.)
IAM permissions are required to access Cloud Storage; Private Google Access only provides connectivity.
Why this answer
Private Google Access allows instances without external IPs to reach Google APIs. It must be enabled on the subnet. Additionally, the DNS name for Google APIs must resolve to the private IP ranges (199.36.153.4/30 for restricted.googleapis.com) or use the default private Google access IPs.
For Cloud Storage, the restricted.googleapis.com VIP is used for Private Google Access if the project is in a VPC Service Controls perimeter; otherwise, the default private Google access IPs work. However, to ensure traffic does not go over the public internet, Private Google Access is sufficient as Google's internal network is used. The second required configuration is to enable Private Google Access on the subnet.
No additional DNS changes are needed if using the default DNS (the private Google access IPs are returned automatically).
Refer to the exhibit. A VM in the default VPC with tag 'internal' and IP 10.128.1.2 is unable to communicate with another VM with IP 10.132.0.3 and tag 'internal'. What is the most likely cause?
The source range excludes 10.132.0.3, blocking return traffic.
Why this answer
The firewall rule shown allows ingress traffic from source range 10.128.0.0/14, which covers IP addresses from 10.128.0.0 to 10.131.255.255. The destination VM with IP 10.132.0.3 is outside this range (10.132.0.3 is in 10.132.0.0/16, not within 10.128.0.0/14). Therefore, traffic from the source VM (10.128.1.2) to the destination VM (10.132.0.3) is blocked because the destination IP is not allowed by the rule's source range.
Option D correctly identifies this. Option A is incorrect because the rule direction is ingress, which is correct for receiving traffic; the issue is the source range. Option B is incorrect because even though ICMP may be used, the fundamental problem is the IP range mismatch.
Option C is incorrect because priority 1000 is valid and does not cause blocking.
A company has deployed Cloud HA VPN between their on-premises network and Google Cloud. They have two tunnels from the on-premises VPN appliance to the HA VPN gateway. The on-premises appliance uses a single public IP address for both tunnels, while the Cloud VPN gateway uses two different public IPs. BGP sessions are established over both tunnels, and the Cloud Router is configured with 'active/active' mode. The network team notices that all outbound traffic from Google Cloud to on-premises is using only one of the two tunnels, even though both tunnels are up. BGP metrics are identical for routes received over both sessions. What is the most likely cause?
Even if routes are identical, ECMP may not work if the next hop is the same; Cloud Router uses flow-based hashing that may not balance in this case.
Why this answer
Cloud Router uses the BGP peer IP address as part of the ECMP hash key. When both BGP sessions originate from the same on-premises public IP (the single IP used for both tunnels), Cloud Router sees them as the same peer and does not load-balance across them. Even though the tunnels use different Cloud VPN gateway IPs, the BGP sessions share a common peer IP, which prevents ECMP from being enabled.
Exam trap
Google Cloud often tests the misconception that ECMP requires different tunnel endpoints or different BGP metrics, when the actual requirement is that the BGP peer IP addresses must be unique for the Cloud Router to treat the sessions as separate multipath candidates.
How to eliminate wrong answers
Option A is wrong because BGP hold timers affect session stability, not route preference; identical BGP metrics mean the routes are equally preferred, and differing hold timers would not cause one tunnel to be exclusively used. Option B is wrong because ECMP can work with a single on-premises IP if the Cloud Router sees distinct BGP peer IPs; the issue is that the peer IP is the same for both sessions, not that the on-premises appliance must use two IPs. Option D is wrong because active/active mode is the correct configuration for ECMP; active/standby would intentionally use only one tunnel, which is not the desired behavior here.
A network engineer is configuring a global HTTPS load balancer with Cloud CDN. They want to cache responses based on the request origin, query parameters, and user agent. Which cache key configuration should they use?
Custom cache keys allow specifying which parameters to include.
Why this answer
Custom cache keys allow inclusion of specific request headers, query parameters, and other attributes. The other options are either not valid or insufficient.
A company has a global e-commerce platform using a Global HTTPS Load Balancer with Cloud CDN. They want to serve private content, such as user-specific PDFs, with CDN caching while ensuring only authorized users can access it. Which method should they use?
Signed URLs/cookies allow access control with CDN caching.
Why this answer
Signed URLs or signed cookies allow you to grant time-limited access to private content cached on Cloud CDN. They are the recommended way to serve private content via CDN.
A company is planning to connect their on-premises data center to Google Cloud using a Dedicated Interconnect. They require 20 Gbps of total bandwidth and want to achieve the highest SLA. What is the minimum number of 10 Gbps connections needed?
Two 10 Gbps links provide 20 Gbps total and meet the 99.99% SLA with redundancy.
Why this answer
Dedicated Interconnect offers 10 Gbps or 100 Gbps per link. To achieve 20 Gbps, at least two 10 Gbps links are needed. For the highest SLA (99.99%), two connections are required (one must be redundant).
ping and traceroute are the standard tools for testing connectivity.
A company currently uses a site-to-site Cloud VPN (IPsec) to connect their on-premises network to a VPC. Due to growing bandwidth demands, they plan to migrate to Partner Interconnect using a supported service provider. They have ordered a 1 Gbps connection and the provider has indicated the VLAN attachment is ready. After creating the VLAN attachment and pairing it with a Cloud Router, the on-premises router sees the BGP session come up, but no traffic is forwarded over the interconnect. The Cloud VPN is still operational. What step is most likely missing?
Without explicitly setting a lower metric, the route from the VPN might be preferred; lowering the metric makes the interconnect the preferred path.
Why this answer
When both a Cloud VPN and a Partner Interconnect are connected to the same VPC, the Cloud Router will have multiple BGP routes for the same destination prefixes. By default, the VPN BGP session may have a lower MED (Multi-Exit Discriminator) or a higher local preference, causing traffic to prefer the VPN path. Lowering the MED on the VLAN attachment's BGP session makes the interconnect route more preferred, allowing traffic to be forwarded over the interconnect without deleting the VPN.
How to eliminate wrong answers
Option A is wrong because VPC firewall rules are stateful and apply to traffic entering or leaving VM instances, not to the VLAN attachment itself; the attachment is a Layer 2/3 construct that does not require a dedicated firewall rule. Option B is wrong because firewall rules in the VPC already exist for the on-premises IP ranges if the VPN was working; the issue is routing, not firewall filtering. Option D is wrong because deleting the Cloud VPN tunnel and gateway is unnecessary and disruptive; the correct approach is to adjust BGP path selection (e.g., MED) to prefer the interconnect route while keeping the VPN as a backup.
A company uses Shared VPC with multiple service projects. They want to ensure that only specific service projects can use the Cloud NAT configured in the host project. What should they do?
This is the standard method to restrict Cloud NAT usage.
Why this answer
Cloud NAT can be restricted to specific VMs using network tags. By configuring the Cloud NAT gateway in the host project with a specific network tag, and then assigning that tag only to the VM instances in authorized service projects, only those tagged VMs can use the NAT gateway. This ensures that only specific service projects (via their tagged VMs) can leverage the Cloud NAT, while all other VMs in the shared VPC are excluded.
Exam trap
The trap here is that candidates often assume IAM is the correct way to restrict access to a Cloud NAT resource, but Cloud NAT does not have an IAM resource—it is a regional service that is controlled via network tags or subnet-level configuration, not IAM permissions.
How to eliminate wrong answers
Option B is wrong because firewall rules control traffic flow (allow/deny) based on IP addresses, ports, and protocols, but they cannot restrict which VMs can use a Cloud NAT gateway; Cloud NAT operates at the network address translation layer, not at the firewall rule level. Option C is wrong because VPC Service Controls are designed to protect data exfiltration by controlling access to Google Cloud APIs and services, not to manage which VMs can use a Cloud NAT gateway within a shared VPC. Option D is wrong because Cloud NAT does not have its own IAM resource; IAM roles on the Cloud NAT resource do not exist—Cloud NAT is a regional resource that is automatically used by VMs in the VPC, and access is controlled via network tags or subnet-level configuration, not IAM.
An enterprise is evaluating connectivity options to Google Cloud. They have moderate bandwidth requirements (up to 1 Gbps) and need high availability. Which two of the following are appropriate solutions? (Choose two.)
HA VPN provides up to 1.5 Gbps per tunnel and high availability with BGP.
Why this answer
HA VPN (High-Availability VPN) uses two tunnels to two separate Cloud VPN gateways, providing automatic failover and meeting the 99.99% SLA when configured with dynamic routing (BGP). This solution supports up to 3 Gbps per tunnel pair, easily covering the 1 Gbps requirement, and uses the public internet without needing physical cross-connects.
Exam trap
Google Cloud often tests the misconception that any VPN with 'HA' in the name is automatically suitable for high availability, but the trap here is that Classic VPN (option D) lacks redundancy and BGP, while HA VPN (option A) is the correct choice; candidates may also incorrectly assume Dedicated Interconnect (option E) is always better, ignoring the bandwidth requirement and cost efficiency.
A company has an HTTP Load Balancer that distributes traffic to a backend service consisting of Compute Engine instance groups. They need to block traffic from specific geographic regions and also rate-limit requests from any IP. Which THREE Cloud Armor features should they configure?
Limits the number of requests from a source IP to prevent abuse.
Why this answer
Cloud Armor security policies allow you to create rules with conditions. To block regions, use geoblocking by specifying source regions. To rate-limit, use rate limiting rules.
Custom rules can also be used to combine conditions. Pre-configured WAF rules (like XSS, SQLi) are for web application attacks, not region blocking or rate limiting.
A media streaming company uses Cloud CDN with signed URLs to protect content. They want to invalidate cached content for a specific file after a security incident. The file is stored in a Cloud Storage bucket and the CDN cache key includes the URL. They run: gcloud compute url-maps invalidate-cdn-cache URL_MAP --path "/videos/incident.mp4". The invalidation succeeds but the old content is still served. What is the most likely reason?
With signed URLs, each request has unique query strings, so the cache key varies.
Why this answer
Cloud CDN's cache key for signed URLs includes the query parameters (e.g., `?Expires=...&Signature=...`). The invalidation command specifies only the path `/videos/incident.mp4`, which does not match the full cache key that includes the query string. As a result, the invalidation does not purge the cached entry for the signed URL, and the old content continues to be served.
Exam trap
Google Cloud often tests the misconception that cache invalidation by path alone will work for all cached objects, ignoring that signed URLs or query parameters can create distinct cache entries that require matching the full cache key.
How to eliminate wrong answers
Option A is wrong because the cache key does include query parameters when signed URLs are used, so the invalidation path must match the full cache key. Option B is wrong because a long `max-age` only affects how long the object is cached by the browser or intermediate caches, not Cloud CDN's ability to invalidate its own cache; invalidation overrides any cache-control directives. Option D is wrong because object versioning is not required for CDN cache invalidation; Cloud CDN invalidates based on the cache key, not on object versions.
A network engineer is troubleshooting a global HTTPS load balancer that is not serving traffic to some users. The load balancer has a backend service with a zonal NEG in us-central1-a. Users report intermittent 502 errors. Which two checks should the engineer perform? (Choose two.)
Unhealthy backends cause 502 errors.
Why this answer
Common causes for 502 errors include health check failures and mismatched SSL certificates. Check that the health check passes and that the SSL certificate covers the domain.
A company is designing a secure multi-VPC architecture in Google Cloud. They have three VPCs: Production, Staging, and Shared Services. The Shared Services VPC hosts a Cloud NAT for outbound internet access and a set of managed instance groups. The Production and Staging VPCs are peered to the Shared Services VPC. The company wants to ensure that: (1) instances in Staging cannot initiate connections to instances in Production, (2) instances in Production cannot initiate connections to instances in Staging, (3) all VPCs can communicate with Shared Services, and (4) traffic between VPCs must be inspected by a firewall appliance in Shared Services. Which TWO actions should the company take?
Cloud VPN between spoke and hub VPCs enables transitive routing, allowing the hub to forward traffic between spokes and route through a firewall appliance.
Why this answer
To achieve transitive routing between the spoke VPCs through the hub Shared Services VPC, Cloud VPN is required because VPC peering is non-transitive. Option B correctly establishes VPN connections between each spoke and the hub to enable transit. Option C is incorrect because a static route in a spoke VPC cannot use the firewall appliance's internal IP (which is in the hub VPC) as a next hop; the next hop must be a resource in the same VPC, such as a VPN tunnel.
Therefore, the only correct action from the given options is B. (Note: The question asks for two actions, but only one option is technically valid; this may indicate an issue with the question design.)
Exam trap
Candidates may mistakenly think that VPC peering with custom route export (Option E) enables transitive routing through a hub, but Google Cloud explicitly does not support transitive peering. Cloud VPN or Network Connectivity Center is required for hub-and-spoke transit.
A company uses Cloud CDN to serve content. They need to generate signed URLs to allow temporary access to premium content. They have set up a signing key. Which command correctly generates a signed URL for the object /video.mp4 in a bucket served by a load balancer?
Correct: sign-url with --key-name and --expires.
Why this answer
The gcloud compute sign-url command is used to sign URLs for Cloud CDN. It requires the --key-name and --expires flags.
Correct. Dynamic allocation shares ports from a pool, minimizing the number of NAT IPs needed.
Why this answer
Practice PCNE by domain
Target a specific domain to shore up weak areas.