Knowledge + Practice

Google Professional Cloud Network Engineer (PCNE) — Questions 526–600

961 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 8 of 13

526

Multi-Selecthard

You are migrating an on-premises application to Google Cloud and need to connect it to Cloud Run services via a load balancer. The on-premises network uses a VPN to GCP. Which TWO components are required to route traffic from on-premises to a serverless NEG? (Choose 2)

Select 2 answers

A.Regional Internal HTTP(S) Load Balancer

B.Serverless NEG

C.Cloud Router

D.Hybrid connectivity NEG

E.Cloud VPN tunnel

AnswersA, B

Internal LB with serverless NEG can route internal traffic to Cloud Run.

Why this answer

A hybrid connectivity NEG is used to route traffic to on-premises backends. For traffic from on-premises to serverless, you need a serverless NEG and an internal load balancer that can route to it. The hybrid NEG is for the reverse direction.

Full explanation →

527

MCQeasy

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

A.Cloud VPN with dynamic routing (BGP)

B.Ha VPN with policy-based routing

C.Dedicated Interconnect with static routing

D.Partner Interconnect with BGP

AnswerC

Dedicated Interconnect supports configuring static routes for the VLAN attachment without needing BGP.

Why this answer

Dedicated Interconnect supports static routing, which is required because the on-premises router does not support BGP. This solution provides direct, private connectivity to a single Google Cloud VPC without relying on dynamic routing protocols, making it the correct choice for this scenario.

Exam trap

Google Cloud often tests the misconception that Cloud VPN or Partner Interconnect can operate without BGP, but in Google Cloud, all VPN and Partner Interconnect solutions require BGP for dynamic routing, while Dedicated Interconnect uniquely supports static routing.

How to eliminate wrong answers

Option A is wrong because Cloud VPN with dynamic routing requires BGP, which the on-premises router does not support. Option B is wrong because HA VPN with policy-based routing is not supported in Google Cloud; HA VPN uses route-based routing with BGP. Option D is wrong because Partner Interconnect requires BGP for routing, which is incompatible with the on-premises router's static routing limitation.

Full explanation →

528

MCQmedium

A company needs to connect multiple branch offices to GCP using Partner Interconnect. They need at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps. Which type of Partner Interconnect should they choose?

A.Single connection with 99.99% SLA

B.Single connection with 99.9% SLA

C.Classic VPN

D.Dual connection with 99.99% SLA

AnswerB

99.9% SLA meets the requirement and is typically sufficient for branch offices.

Why this answer

Partner Interconnect offers two SLA tiers: 99.9% for a single connection and 99.99% for dual connections. Since the requirement is at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps, a single connection with 99.9% SLA meets both criteria without the cost and complexity of dual connections.

Exam trap

The PCNE exam often tests the misconception that higher SLA numbers are always better, but the trap here is that the 99.99% SLA requires dual connections, which is overkill for a 99.9% requirement, and candidates may overlook the specific SLA tiers tied to connection redundancy.

How to eliminate wrong answers

Option A is wrong because a single connection with 99.99% SLA does not exist; the 99.99% SLA requires dual connections for redundancy. Option C is wrong because Classic VPN does not provide an SLA and typically offers lower bandwidth and reliability than Partner Interconnect, failing the 99.9% availability requirement. Option D is wrong because dual connections with 99.99% SLA exceed the minimum 99.9% requirement and add unnecessary cost and complexity; the question asks for the type that meets the requirement, not the highest SLA.

Full explanation →

529

MCQhard

A company uses Cloud Armor with an external HTTPS load balancer to protect their web application. They have a security policy 'my-policy' attached to the backend service. The policy includes an allow rule (priority 1000) for their corporate IP range (203.0.113.0/24) and a deny rule (priority 2000) for all other IPs. The company has an office at a remote location that uses a different IP range (198.51.100.0/24). Employees from the remote office report they cannot access the application. Meanwhile, employees from the corporate office (203.0.113.0/24) can access. The engineer checks the Cloud Armor policy and sees the rule configuration as shown. What is the most likely cause?

A.The rule evaluation order is wrong; the deny rule should have higher priority (lower number).

B.The remote office IP range is not included in an allow rule in the security policy.

C.The deny rule uses 'SRC_IPS_V2' which is an invalid expression.

D.The load balancer's frontend IP blocks traffic from certain geographic regions.

AnswerB

Only the corporate IP range is allowed; all others are denied by the default deny rule.

Why this answer

The remote office IP range (198.51.100.0/24) is not explicitly allowed by any rule in the security policy. The only allow rule (priority 1000) permits traffic from the corporate IP range (203.0.113.0/24), and the deny rule (priority 2000) blocks all other IPs. Since the remote office IPs are not covered by the allow rule, they are denied by default, which explains their inability to access the application.

Exam trap

Google Cloud often tests the misconception that a deny rule with a higher priority number (e.g., 2000) will override an allow rule with a lower priority number (e.g., 1000), but in reality, Cloud Armor evaluates rules in ascending priority order, so the allow rule is evaluated first and permits matching traffic before the deny rule is considered.

How to eliminate wrong answers

Option A is wrong because the rule evaluation order is correct: Cloud Armor evaluates rules from lowest priority number to highest, so the allow rule (priority 1000) is evaluated before the deny rule (priority 2000). Option C is wrong because 'SRC_IPS_V2' is a valid expression type in Cloud Armor for specifying IP ranges using CIDR notation, and its use does not cause the issue. Option D is wrong because the load balancer's frontend IP does not block traffic based on geographic regions; geographic blocking would require a separate Cloud Armor rule or a different configuration, and the problem statement does not indicate any such rule.

Full explanation →

530

MCQmedium

A company has deployed a global HTTP Load Balancer with Cloud CDN to serve content to users worldwide. They notice high egress costs from the origin region. What is the most cost-effective solution to reduce egress from the origin?

A.Enable Cloud CDN with general-purpose cache mode

B.Use Private Google Access

C.Increase the number of backend instances

D.Switch to a regional load balancer

AnswerA

Caching at edge reduces origin requests and egress.

Why this answer

Using Cloud CDN with a general-purpose cache mode caches content at Google's edge locations, reducing requests to the origin and lowering egress costs for served content.

Full explanation →

531

MCQmedium

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

A.The MTU is too small.

B.The firewall rules are blocking the traffic.

C.The VLAN attachment is down.

D.The BGP routes for that subnet are not advertised.

AnswerD

If the on-premises router does not advertise the subnet via BGP, the VPC will not know how to route traffic back.

Why this answer

The Dedicated Interconnect is up and the organization can ping instances in one subnet, which confirms that Layer 2 and basic Layer 3 connectivity (via the VLAN attachment) are working. However, the inability to reach a service on a different subnet within the same VPC indicates that the on-premises router does not have a route to that specific subnet. This is most likely because the BGP session is not advertising the prefix for that subnet, or the on-premises router is not receiving the route via BGP.

Without the route, traffic from on-premises to that subnet will be dropped.

Exam trap

Google Cloud often tests the misconception that firewall rules are the default cause of connectivity issues within a VPC, but here the key clue is that ping to one subnet works, isolating the problem to route advertisement rather than security policies.

How to eliminate wrong answers

Option A is wrong because MTU issues typically cause packet fragmentation problems or connectivity failures for large packets, not a complete inability to reach a different subnet while ping (which uses small packets) works. Option B is wrong because firewall rules in Google Cloud VPC are stateful and apply to all traffic; if ping to one subnet works, firewall rules are not blocking traffic to another subnet within the same VPC (assuming similar ingress/egress rules). Option C is wrong because if the VLAN attachment were down, the organization would not be able to ping any instances in the VPC at all, as the interconnect link would be non-functional.

Full explanation →

532

MCQeasy

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

A.Change the stack type of subnet-b to IPV4_IPV6.

B.Configure Cloud NAT in the region of subnet-b.

C.Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.

D.Enable Private Google Access on subnet-b.

AnswerD

Enabling Private Google Access allows VMs to reach Google APIs via internal IP.

Why this answer

Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Exam trap

Google Cloud often tests the distinction between enabling outbound internet access (Cloud NAT) and enabling private access to Google services (Private Google Access), leading candidates to mistakenly choose Cloud NAT when the requirement is specifically for private IP access to Google APIs.

How to eliminate wrong answers

Option A is wrong because changing the stack type to IPV4_IPV6 adds IPv6 support but does not enable private access to Google APIs; Private Google Access is independent of IP stack type. Option B is wrong because Cloud NAT provides outbound internet access for private VMs but does not route traffic to Google APIs via private IP; Cloud NAT uses external IPs for translation, not the private Google network path. Option C is wrong because a firewall rule allowing egress to 0.0.0.0/0 on port 443 would permit HTTPS traffic but does not enable the underlying routing needed for private Google API access; without Private Google Access, the traffic would still be dropped or sent via external IP.

Full explanation →

533

MCQeasy

Refer to the exhibit. A company has enabled Private Google Access on the subnet. What effect does this have on VMs in the subnet?

A.VMs can use external IPs to access Google services

B.VMs can access the internet using Cloud NAT

C.VMs can communicate with each other without firewall rules

D.VMs can access Google services using only internal IPs

AnswerD

Private Google Access enables access to Google APIs over internal IPs.

Why this answer

Private Google Access enables VMs in a subnet that have only internal IP addresses (RFC 1918) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through Google's internal network. The traffic is routed via the default internet gateway (which does not require an external IP on the VM) and uses a special 0.0.0.0/0 route with next hop 'default internet gateway' to reach Google's external IPs, but the VM itself never needs a public IP. This is why D is correct: VMs can access Google services using only internal IPs.

Exam trap

Google Cloud often tests the misconception that Private Google Access provides general internet access (like Cloud NAT) or that it requires VMs to have external IPs, when in fact it is strictly for Google APIs and services using internal-only VMs.

How to eliminate wrong answers

Option A is wrong because Private Google Access specifically allows VMs without external IPs to reach Google services; if a VM already has an external IP, it can reach Google services directly without needing Private Google Access. Option B is wrong because Cloud NAT is used to enable outbound internet connectivity for VMs without external IPs, but Private Google Access is a separate feature that only covers Google APIs and services, not general internet access. Option C is wrong because VM-to-VM communication within a subnet is governed by VPC firewall rules (ingress/egress), and Private Google Access has no effect on internal traffic between VMs.

Full explanation →

534

Multi-Selectmedium

A company needs to connect their on-premises network to Google Cloud with high availability and load balancing across multiple tunnels. They plan to use HA VPN. Which TWO of the following are required to achieve active-active load balancing across multiple tunnels?

Select 2 answers

A.Use AS path prepending on one tunnel

B.Configure the on-premises router to enable ECMP

C.Use different MED values for each tunnel

D.Ensure the Cloud Router advertises the same routes with identical BGP attributes over all tunnels

E.Configure static routes instead of BGP

AnswersB, D

ECMP allows the router to use multiple equal-cost paths.

Why this answer

For active-active load balancing, Cloud Router BGP must advertise the same routes with identical attributes, and the on-premises router must support ECMP. Often, two tunnels are configured as a pair. The on-premises router must be configured to accept equal-cost routes.

Full explanation →

535

Multi-Selectmedium

You are deploying a microservices architecture on Google Kubernetes Engine (GKE) with Traffic Director for traffic management. You want to implement fault injection to test the resilience of your services. Which two types of fault injection does Traffic Director support? (Choose two.)

Select 2 answers

A.Delay

B.Abort

C.CPU exhaustion

D.Packet loss

E.Bandwidth throttling

AnswersA, B

Introduces latency in requests.

Why this answer

Traffic Director supports fault injection of delays and errors (aborts).

Full explanation →

536

Multi-Selecteasy

Which TWO statements about VPC peering are correct?

Select 2 answers

A.VPC peering allows traffic without firewall rules if both VPCs are in the same project.

B.VPC peering automatically exports custom routes.

C.VPC peering can only be established for VPCs in the same region.

D.VPC peering requires that all subnet CIDR ranges be unique across both VPCs.

E.VPC peering can be established between VPCs in different organizations.

AnswersD, E

Overlapping subnets are not allowed.

Why this answer

Peering can be across organizations and requires non-overlapping subnets.

Full explanation →

537

Multi-Selecteasy

A company is designing a VPC for a multi-tier web application. They need to ensure that the web servers can be reached from the internet, but the database servers should only be accessible from the web servers. Which three components should they use to achieve this? (Choose THREE.)

Select 3 answers

A.External IP addresses on the web servers

B.VPC Network Peering with a partner network

C.Shared VPC

D.Cloud NAT for database servers to access the internet

E.Firewall rules to restrict traffic between subnets

AnswersA, D, E

External IPs allow inbound internet traffic to web servers.

Why this answer

Firewall rules control traffic between tiers; Cloud NAT provides outbound internet for private instances; and external IPs allow inbound internet traffic to web servers.

Full explanation →

538

MCQeasy

You need to configure health checks for a backend service that uses gRPC for health checking. Which health check type should you use?

A.HTTP

B.TCP

C.gRPC

D.HTTPS

AnswerC

gRPC health checks use the gRPC protocol to probe the backend's health.

Why this answer

For gRPC health checks, the correct health check type is gRPC, which sends a gRPC HealthCheckRequest to the backend.

Full explanation →

539

MCQmedium

A company is setting up VPC peering between two VPCs. They need the peered VPC to be able to reach the entire subnets of their VPC, including those that may be added in the future. Which configuration is required?

A.Enable 'Export custom routes' on the peering connection

B.Create static routes in the peer VPC for each subnet

C.Use a VPN instead of VPC peering

D.Enable 'Import custom routes' on the peering connection

AnswerA

Exporting custom routes advertises all custom routes (including future subnets) to the peered VPC.

Why this answer

Exporting custom routes from the VPC ensures that any future subnets (which create custom routes) are advertised to the peer.

Full explanation →

540

MCQmedium

A network engineer needs to create a firewall rule that denies all inbound traffic to instances with the tag 'web-server' from source IP range 10.0.0.0/8. They also have an existing allow rule with priority 1000 that permits traffic from 10.0.0.0/8 to those instances. To ensure the deny rule takes precedence, what priority should the new rule have?

A.1000

B.0

C.500

D.2000

AnswerC

500 is lower than 1000, so the deny rule takes precedence.

Why this answer

In GCP firewall rules, lower priority numbers have higher precedence. To override an allow rule with priority 1000, the deny rule must have a priority lower than 1000.

Full explanation →

541

MCQhard

A network engineer has set up a Cloud Router with BGP for an HA VPN. The BGP session is flapping. Which log should be examined to diagnose the issue?

A.Firewall Rules logs

B.VPN tunnel logs

C.VPC Flow Logs

D.Cloud Router logs

AnswerD

Cloud Router logs BGP events, including session state changes and errors.

Full explanation →

542

MCQeasy

An organization needs to allow on-premises servers to resolve DNS names of GCP VM instances using RFC 1918 addresses. They have a Cloud VPN connection. Which DNS resolution approach should they implement?

A.Set up a public zone and use the instance's external IP for DNS

B.Configure Cloud DNS outbound server policy and forward from Cloud DNS to on-premises DNS

C.Use DNS peering with a private zone in the on-premises DNS

D.Configure Cloud DNS inbound server policy and set up forwarding from on-premises DNS to the Cloud DNS inbound endpoint

AnswerD

Enables on-premises to query Cloud DNS for private zones.

Why this answer

The on-premises servers need to resolve DNS names of GCP VM instances using RFC 1918 addresses over a Cloud VPN connection. Configuring a Cloud DNS inbound server policy creates a VPC-wide inbound DNS endpoint (using an internal IP address) that on-premises DNS servers can forward queries to. This allows the on-premises DNS to send DNS requests for GCP private zone records (e.g., `vm-instance.c.example.internal`) directly to the Cloud DNS inbound endpoint, which then resolves the private RFC 1918 addresses of the VM instances.

Exam trap

The trap here is that candidates confuse inbound and outbound server policies, often selecting Option B (outbound) because they think 'forwarding to on-premises' is needed, but the requirement is for on-premises to query GCP, which requires an inbound endpoint.

How to eliminate wrong answers

Option A is wrong because using a public zone and the instance's external IP would expose the DNS records to the internet and require public IP addresses, contradicting the requirement to use RFC 1918 addresses. Option B is wrong because Cloud DNS outbound server policy is used to forward DNS queries from GCP VPCs to on-premises DNS servers, not the reverse direction needed here. Option C is wrong because DNS peering is used to allow DNS resolution between two GCP VPCs or between a GCP VPC and a service producer network; it does not support forwarding from an on-premises DNS server to Cloud DNS.

Full explanation →

543

MCQhard

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

A.Cloud NAT

B.VPC peering

C.Cloud Router

D.VPC Flow Logs

AnswerC

Cloud Router manages BGP sessions for dynamic routing with VPN or Interconnect.

Why this answer

Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Exam trap

The trap here is that candidates confuse Cloud Router with Cloud NAT or VPC peering, thinking any 'cloud' component or 'peering' term implies connectivity, but only Cloud Router handles the BGP dynamic routing required for Cloud VPN.

How to eliminate wrong answers

Option A is wrong because Cloud NAT provides outbound internet access for private VMs, not connectivity between on-premises and VPC. Option B is wrong because VPC peering connects two VPCs within Google Cloud, not an on-premises network to a VPC. Option D is wrong because VPC Flow Logs capture network metadata for monitoring and troubleshooting, not routing or connectivity.

Full explanation →

544

Multi-Selectmedium

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Select 2 answers

A.Weighted round-robin

B.Geo routing policy

C.Failover policy

D.DNSSEC

E.Response policy zone

AnswersB, C

Geo routing directs users based on geographic location.

Why this answer

Geo routing policy directs traffic based on user location, and failover policy provides automatic failover to a backup if health check fails. Weighted round-robin distributes by weight, not location. DNSSEC is a security extension.

Full explanation →

545

MCQeasy

Refer to the exhibit. A Compute Engine instance has the network tags 'http-server' and 'ssh-server'. It also has a public IP address. Which of the following statements about traffic to this instance is true?

A.All traffic from the internet is denied because of the deny-all rule.

B.SSH traffic from the internet is allowed.

C.HTTP traffic from the internet is allowed.

D.HTTPS traffic from the internet is allowed.

AnswerC

The allow-http rule allows tcp:80 from 0.0.0.0/0 to tagged instances; the instance has http-server tag.

Why this answer

The instance has the network tag 'http-server', which is used by the default VPC firewall rule 'default-allow-http' to permit inbound TCP traffic on port 80 from any source (0.0.0.0/0). Since the instance also has a public IP address, HTTP traffic from the internet can reach it. The other tags and the public IP do not override this allow rule.

Exam trap

Google Cloud often tests the misconception that having a public IP address automatically opens all ports, or that a network tag alone (without a corresponding firewall rule) permits traffic on that port.

How to eliminate wrong answers

Option A is wrong because the implied deny-all rule only applies to traffic that is not explicitly allowed; the 'default-allow-http' rule explicitly permits HTTP traffic, so it is not denied. Option B is wrong because although the instance has the tag 'ssh-server', there is no default firewall rule that allows SSH traffic from the internet; the default-allow-ssh rule exists only if explicitly created, and the tag alone does not create a rule. Option D is wrong because HTTPS (port 443) is not allowed by any default rule associated with the 'http-server' tag; the default-allow-https rule would require a separate tag like 'https-server' or a custom rule.

Full explanation →

546

MCQmedium

A company is using Partner Interconnect to connect to Google Cloud. They notice that traffic from on-premises to GCP takes one path, but return traffic takes a different path, causing asymmetric routing. How can they resolve this?

A.Configure the same BGP ASN on both sides.

B.Apply BGP MED values to influence path selection.

C.Enable asymmetric routing mode on the Cloud Router.

D.Use different link-local addresses for each session.

AnswerB

MED allows you to indicate the preferred path for inbound traffic.

Why this answer

B is correct because applying BGP MED (Multi-Exit Discriminator) values allows you to influence the path selection for return traffic from Google Cloud to your on-premises network. By setting a lower MED value on one of the Partner Interconnect connections, you can make Google Cloud prefer that path for return traffic, thereby matching the forward path and resolving asymmetric routing. This is a standard BGP technique for controlling inbound traffic to an AS.

Exam trap

Google Cloud often tests the misconception that BGP ASN configuration or link-local addresses can fix routing asymmetry, when in fact only path-selection attributes like MED or AS path prepending can influence return traffic in a multi-homed BGP setup.

How to eliminate wrong answers

Option A is wrong because configuring the same BGP ASN on both sides would cause BGP to reject the session (eBGP requires different ASNs) or require allowas-in, which does not address asymmetric routing. Option C is wrong because Cloud Router does not have an 'asymmetric routing mode'; asymmetric routing is a network behavior, not a configurable mode on Cloud Router. Option D is wrong because using different link-local addresses for each session is a best practice for BGP session establishment but has no effect on path selection or routing symmetry.

Full explanation →

547

MCQeasy

Your company has two on-premises data centers, DC1 and DC2, each connected to a separate Google Cloud VPC via Dedicated Interconnect. Both VPCs are connected via VPC Network Peering. A new application deployed in VPC1 needs to communicate with a database in DC2. The database IP range is 10.0.0.0/16. You have configured firewall rules to allow the traffic. However, the application cannot reach the database. You have verified that routes for 10.0.0.0/16 exist in VPC1's route table with next hop to VPC Peering, and in VPC2's route table with next hop to the interconnect attachment. The BGP sessions on both interconnects are up. What is the most likely reason for the connectivity failure?

A.The route for 10.0.0.0/16 in VPC1 is not imported correctly from VPC Peering

B.VPC Network Peering does not support transitive routing through a peered VPC

C.BGP session on the interconnect between VPC2 and DC2 is down

D.Firewall rules in VPC2 are blocking traffic

AnswerB

VPC Peering does not allow a peered VPC to forward traffic to another network, breaking the path from VPC1 to DC2.

Why this answer

VPC Network Peering does not support transitive routing. In this topology, VPC1 is peered with VPC2, but traffic from VPC1 to DC2 must pass through VPC2 and then over the interconnect. Since VPC1's route for 10.0.0.0/16 points to the VPC peering as next hop, VPC1 expects the traffic to be forwarded directly to VPC2.

However, VPC2 cannot forward that traffic to DC2 because Google Cloud VPC peering does not allow a peered VPC to act as a transit hub; each VPC can only communicate directly with its peer, not with resources reachable through that peer. This is a fundamental limitation of VPC Network Peering, which is non-transitive.

Exam trap

The trap here is that candidates assume VPC peering behaves like a router or a traditional network switch, supporting transitive routing, when in fact Google Cloud VPC peering is strictly non-transitive and requires a separate peering or a dedicated interconnect for each VPC-to-on-premises path.

How to eliminate wrong answers

Option A is wrong because the route for 10.0.0.0/16 in VPC1 is correctly pointing to VPC Peering as the next hop, and the question states that routes exist, so import is not the issue. Option C is wrong because the BGP sessions on both interconnects are explicitly stated as up, so the interconnect between VPC2 and DC2 is functioning. Option D is wrong because firewall rules have been verified to allow the traffic, and the problem is at the routing layer, not the firewall layer.

Full explanation →

548

MCQhard

Refer to the exhibit. A network team has created this load balancer. Clients inside the VPC are unable to connect to the load balancer's IP address from a Compute Engine instance in the same VPC. What is the most likely cause?

A.The target HTTPS proxy is not properly configured to use a backend service.

B.The load balancer is configured with network tier STANDARD, which does not support internal traffic.

C.The load balancer is using INTERNAL_MANAGED scheme, which requires the clients to be in a different region.

D.The load balancer does not have a backend service configured.

AnswerB

Internal load balancers must use Premium Tier. Standard tier is for external load balancers only.

Why this answer

A load balancer configured with network tier STANDARD uses the Premium Tier's external IP addressing, which does not support internal traffic routing within the same VPC. Clients inside the VPC attempting to connect to the load balancer's IP address from a Compute Engine instance in the same VPC will fail because STANDARD tier IPs are designed for external internet-facing traffic and cannot be reached from within the VPC without a public IP and appropriate routing. The load balancer must use the Premium Tier (network tier PREMIUM) to support internal client traffic within the same VPC.

Exam trap

Google Cloud often tests the distinction between network tier STANDARD and PREMIUM, trapping candidates who assume all load balancer IPs are reachable from within the VPC regardless of tier, when in fact STANDARD tier IPs are external-only and require public internet routing.

How to eliminate wrong answers

Option A is wrong because the target HTTPS proxy configuration is unrelated to the client's inability to connect from within the same VPC; a misconfigured proxy would cause backend failures, not a connectivity failure from clients to the load balancer IP. Option C is wrong because INTERNAL_MANAGED scheme is specifically designed for internal load balancing within the same VPC and region, and clients in the same region can connect; the issue here is the network tier, not the scheme or region. Option D is wrong because the absence of a backend service would cause health check failures or 502 errors, not a complete inability for clients to reach the load balancer's IP address from within the VPC.

Full explanation →

549

MCQeasy

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

A.interconnect/vlan_attachment/outbound_bytes

B.interconnect/network/packet_drop_count

C.interconnect/link/operational_status

D.interconnect/network/received_bytes_count

AnswerC

This metric directly indicates whether the link is up, down, or degraded.

Why this answer

The metric 'interconnect/link/operational_status' provides the operational status of each interconnect link (e.g., operational, degraded).

Full explanation →

550

MCQeasy

An engineer needs to set up a VPN between an on-premises network and GCP. The on-premises VPN device does not support BGP and can only support static routing. Which VPN solution should the engineer choose?

A.Partner Interconnect

B.HA VPN

C.Classic VPN

D.Dedicated Interconnect

AnswerC

Classic VPN supports static routing and does not require BGP.

Why this answer

Classic VPN supports static routing (policy-based or route-based). HA VPN requires dynamic routing (BGP), and Partner Interconnect is a dedicated connection not a VPN.

Full explanation →

551

MCQmedium

A company uses an internal TCP/UDP load balancer to distribute traffic to a backend service. The backend instances are in an unmanaged instance group. Some instances fail health checks and are removed. What happens to existing connections to failed instances?

A.The load balancer drains existing connections before removing the instance.

B.Existing connections are seamlessly redirected to healthy instances.

C.Existing connections are terminated immediately.

D.The load balancer waits for all existing connections to close before removing the instance.

AnswerC

Internal TCP/UDP load balancers do not provide connection draining; connections are dropped.

Why this answer

When an instance in an unmanaged instance group fails a health check, the internal TCP/UDP load balancer immediately terminates all existing connections to that instance. This is because the load balancer does not support connection draining for unmanaged instance groups; it simply stops forwarding new traffic and drops existing flows to the failed instance. The abrupt termination occurs because the load balancer operates at Layer 4 and has no mechanism to gracefully close TCP connections or wait for application-level cleanup.

Exam trap

The trap here is that candidates often assume connection draining is always available for load balancers, but Google Cloud tests the distinction between managed and unmanaged instance groups, where unmanaged groups lack graceful connection termination features.

How to eliminate wrong answers

Option A is wrong because connection draining is a feature of managed instance groups (e.g., with Google Cloud's managed instance groups), not unmanaged instance groups; the load balancer does not drain connections for unmanaged groups. Option B is wrong because existing connections are not seamlessly redirected; TCP/UDP sessions are stateful and cannot be transparently moved to another instance without breaking the connection. Option D is wrong because the load balancer does not wait for connections to close; it removes the instance immediately upon health check failure, terminating all active connections.

Full explanation →

552

MCQeasy

You need to allow on-premises servers to access a Google Cloud VM's internal IP without using a public IP. The on-premises network is connected via Cloud VPN. What configuration is required on the Google Cloud side?

A.Configure Cloud NAT for the on-premises network.

B.Enable Private Google Access on the VPC subnet where the VM resides. [wrong]

C.Assign a global static external IP to the VM.

D.Configure Cloud DNS forwarding to the on-premises DNS servers.

AnswerB

Private Google Access allows on-premises to access Google APIs and services, not arbitrary VM internal IPs.

Why this answer

None of the provided options are correct. To allow on-premises servers to access a Google Cloud VM's internal IP over Cloud VPN, no special Google Cloud-side configuration is required beyond ensuring that the VPC subnet route is advertised to the on-premises network via Cloud Router and that firewall rules allow the traffic. Private Google Access is for accessing Google APIs, not VM internal IPs.

Cloud NAT is for outbound traffic. A global static external IP exposes the VM externally. Cloud DNS forwarding is for DNS resolution, not IP reachability.

Full explanation →

553

MCQhard

A request comes from IP 192.0.2.5, with origin region code 'US', and path '/admin/dashboard'. What will be the final action?

A.Deny by rule priority 1000.

B.Deny by rule priority 2000.

C.Deny by rule priority 3000.

D.Allow (default rule).

AnswerB

The request path starts with '/admin', matching rule 2000.

Why this answer

The request matches a rule with priority 2000 that denies traffic from IP 192.0.2.5 to path '/admin/dashboard' with origin region 'US'. Since Cloud Armor security policies evaluate rules in ascending priority order, rule 2000 is evaluated before rule 3000 and after rule 1000. Rule 1000 does not match (likely a different condition), so rule 2000 applies and denies the request.

Exam trap

Google Cloud often tests the misconception that rules are evaluated in descending priority order (e.g., 3000 before 2000) or that the default rule overrides explicit deny rules, when in fact the lowest numeric priority wins and evaluation stops at the first match.

How to eliminate wrong answers

Option A is wrong because priority 1000 is evaluated first but does not match the request (e.g., it might allow all traffic or match a different path/region), so it does not deny. Option C is wrong because priority 3000 is evaluated after priority 2000; once a match occurs at priority 2000, evaluation stops and rule 3000 is never reached. Option D is wrong because the default rule (allow) only applies if no higher-priority rule matches; here, rule 2000 matches and denies the request.

Full explanation →

554

MCQeasy

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

A.Create a custom route in the VPC pointing to the VPN appliance's internal IP.

B.Enable Private Google Access on the subnet hosting the VPN appliance.

C.Enable IP forwarding on the VPN appliance VM instance.

D.Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.

AnswerC

IP forwarding is required for the VM to act as a router.

Why this answer

A third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.

Exam trap

Google Cloud often tests the distinction between network-level configurations (routes, firewall rules) and instance-level capabilities (IP forwarding), trapping candidates who assume that creating a route or firewall rule alone is sufficient for a VM to act as a gateway.

How to eliminate wrong answers

Option A is wrong because creating a custom route pointing to the VPN appliance's internal IP is necessary for directing traffic from VPC subnets to the on-premises network, but it is not the feature that must be enabled on the appliance itself; the question asks which feature must be enabled to allow the appliance to forward traffic, and that is IP forwarding. Option B is wrong because Private Google Access enables VMs without external IPs to reach Google APIs and services, but it has no role in forwarding traffic between VPC subnets and a VPN tunnel. Option D is wrong because firewall rules control which traffic is permitted to enter or leave the VPC, but they do not enable the VM to forward packets; without IP forwarding, the VM will not forward traffic even if firewall rules allow it.

Full explanation →

555

MCQhard

Refer to the exhibit. The Cloud Router is configured with custom BGP advertisements. The on-premises router receives only the two advertised ranges (10.1.0.0/24 and 10.2.0.0/24) but not the VPC subnets (e.g., 10.3.0.0/24). What is the most likely reason?

A.The on-premises router is configured to accept only prefixes longer than /24.

B.The advertised route priority of 100 is too high, causing the routes to be ignored.

C.The Cloud Router's custom advertisement includes both the ALL_SUBNETS group and the explicit ranges, so all subnets should be advertised.

D.The on-premises router is filtering routes based on the BGP community or AS path.

AnswerD

On-premises routers often have ingress filters that can drop routes.

Why this answer

Cloud Router custom advertisements can include BGP communities or AS-path attributes that the on-premises router may be filtering. If the on-premises router is configured to reject routes based on these attributes (e.g., only accepting routes with a specific community or AS-path length), it would drop the VPC subnet routes even if they are advertised. The scenario states that only the two explicitly advertised ranges are received, indicating a filtering mechanism on the on-premises side rather than a Cloud Router misconfiguration.

Exam trap

Google Cloud often tests the misconception that Cloud Router's custom advertisement configuration automatically overrides on-premises filtering, when in reality BGP attributes like communities and AS-path are the primary mechanisms for route filtering on the receiving side.

How to eliminate wrong answers

Option A is wrong because the on-premises router receiving /24 prefixes does not imply it filters longer prefixes; the VPC subnets (e.g., 10.3.0.0/24) are also /24, so prefix length filtering would not explain why they are missing. Option B is wrong because BGP route priority (MED or local preference) influences route selection among multiple paths, not whether a route is accepted or rejected; a priority of 100 is a default value and does not cause routes to be ignored. Option C is wrong because if the Cloud Router's custom advertisement includes both the ALL_SUBNETS group and explicit ranges, all VPC subnets should be advertised; the fact that only the explicit ranges are received points to a filtering issue on the on-premises side, not a Cloud Router configuration problem.

Full explanation →

556

Multi-Selectmedium

A company wants to expose an internal HTTP service running on Compute Engine instances to other VPCs in the same project using a load balancer. The load balancer must support HTTP path-based routing and preserve the client source IP. Which load balancer types meet these requirements? (Choose two.)

Select 2 answers

A.Internal TCP/UDP Load Balancer [wrong]

B.Global external HTTP(S) Load Balancer [wrong]

C.External HTTP(S) Load Balancer (regional) [CORRECT]

D.Internal HTTP(S) Load Balancer [CORRECT]

E.External TCP/UDP Network Load Balancer [wrong]

AnswersC, D

External HTTP(S) Load Balancer (regional) supports HTTP path-based routing and preserves client source IP. Correct.

Why this answer

Both the External HTTP(S) Load Balancer (regional) and the Internal HTTP(S) Load Balancer support HTTP path-based routing and preserve the client source IP via the X-Forwarded-For header. The External regional LB can be configured with a public IP, while the Internal LB uses a private IP within the VPC. Both are suitable for exposing an internal HTTP service to other VPCs in the same project, depending on whether internet access is needed.

Full explanation →

557

MCQmedium

An engineer is configuring a Cloud Router for HA VPN. They need to enable BGP on the VPN tunnels. Which BGP configuration is required for the Cloud Router to advertise the VPC subnets to the on-premises network?

A.Set up a VPC peering connection

B.Use static routes on the VPN tunnel

C.Create a custom route advertisement for each subnet

D.Configure the VPN gateway to advertise the subnets

AnswerC

Cloud Router can be configured with custom route advertisements to advertise specific VPC subnets to the on-premises network via BGP.

Why this answer

Cloud Router uses Border Gateway Protocol (BGP) to dynamically exchange routes with the on-premises network over HA VPN tunnels. By default, Cloud Router advertises only the VPC subnet ranges that are directly connected to the VPC network. To ensure all VPC subnets are advertised, you must create custom route advertisements for each subnet that needs to be reachable from on-premises.

This is done by configuring the Cloud Router with a custom advertisement mode and specifying the subnet CIDR ranges as custom advertised IP ranges.

Exam trap

A common misconception in Google Cloud is that the VPN gateway itself handles BGP route advertisements, when in fact it is the Cloud Router that acts as the BGP speaker and manages route exchange for HA VPN tunnels.

How to eliminate wrong answers

Option A is wrong because VPC peering is a separate connectivity mechanism used to connect two VPC networks, not to advertise routes to an on-premises network via VPN. Option B is wrong because static routes on the VPN tunnel would require manual configuration and maintenance for each subnet, and they do not leverage BGP's dynamic route exchange, which is required for HA VPN with Cloud Router. Option D is wrong because the VPN gateway itself does not handle BGP route advertisements; that responsibility lies with the Cloud Router, which is the BGP speaker in Google Cloud.

Full explanation →

558

MCQhard

A company with limited public IP addresses on-premises needs to connect to Google Cloud using Cloud VPN. They require high availability. Which solution should they implement?

A.Use NAT to map multiple private IPs to one public IP.

B.Use Classic VPN with a single tunnel.

C.Use HA VPN with two on-premises public IPs and two tunnels.

D.Use HA VPN with the same public IP for both tunnels.

AnswerC

HA VPN provides redundancy by supporting active-active or active-passive with separate endpoints.

Why this answer

HA VPN provides high availability by using two tunnels, each terminating on a separate on-premises VPN gateway with a unique public IP address. This ensures that if one on-premises public IP or tunnel fails, traffic can still flow through the other tunnel, meeting the high-availability requirement. Classic VPN (option B) does not support active-active failover, and using the same public IP for both tunnels (option D) creates a single point of failure at the on-premises side.

Exam trap

Google Cloud often tests the misconception that HA VPN can use the same on-premises public IP for both tunnels, but in reality, each tunnel must terminate on a separate on-premises device or interface with a unique public IP to achieve true high availability.

How to eliminate wrong answers

Option A is wrong because NAT is a method for translating private IPs to a public IP for outbound internet access, not a solution for establishing a highly available VPN connection to Google Cloud. Option B is wrong because Classic VPN uses a single tunnel and a single on-premises public IP, providing no redundancy or automatic failover, thus failing the high-availability requirement. Option D is wrong because HA VPN requires two distinct on-premises public IP addresses for the two tunnels; using the same public IP for both tunnels would create a single point of failure at the on-premises gateway, negating the high-availability benefit.

Full explanation →

559

MCQhard

A company has two VPCs in the same project, VPC-A and VPC-B. They have set up VPC peering between them. In VPC-A, there is a subnet 10.0.1.0/24. In VPC-B, there are subnets 10.0.2.0/24 and 10.0.3.0/24. A compute instance in VPC-A can ping an instance in VPC-B with IP 10.0.2.10, but fails to ping an instance in VPC-B with IP 10.0.3.10. All subnets are in the same region. Firewall rules allow all traffic between VPC-A and VPC-B. What is the most likely cause?

A.VPC-A has a static route to 10.0.3.0/24 that preempts the peering route.

B.The peering is not bidirectional; VPC-B is not exporting routes.

C.The firewall rules in VPC-B block ICMP from VPC-A to 10.0.3.0/24.

D.The subnet 10.0.3.0/24 was added after the peering, and the peering routes were not updated. Recreate the peering.

AnswerA

Static routes have higher priority than peering routes, causing traffic to go elsewhere.

Why this answer

VPC peering routes are automatically added to the route tables of both VPCs when the peering is established. However, if a more specific static route (e.g., to 10.0.3.0/24) exists in VPC-A, it will take precedence over the peering route due to longest prefix match routing. Since the instance in VPC-A can reach 10.0.2.10 but not 10.0.3.10, the most likely cause is that VPC-A has a static route that preempts the peering route for the 10.0.3.0/24 subnet.

Exam trap

The trap here is that candidates often assume VPC peering automatically works for all subnets in the peered VPC, forgetting that static routes with more specific prefixes can override peering routes, even when firewall rules are permissive.

How to eliminate wrong answers

Option B is wrong because VPC peering is bidirectional by default; both VPCs export and import routes unless explicitly configured otherwise, and the question does not indicate any custom export/import settings. Option C is wrong because the question explicitly states that firewall rules allow all traffic between VPC-A and VPC-B, so ICMP is not blocked. Option D is wrong because VPC peering routes are dynamically updated when subnets are added or removed; there is no need to recreate the peering, as route propagation is automatic.

Full explanation →

560

Multi-Selecteasy

An engineer needs to deploy a VM that acts as a internet gateway for other instances in the same VPC. The VM must have IP forwarding enabled and must be able to accept traffic on multiple NICs. Which TWO actions are required? (Choose 2)

Select 2 answers

A.Disable the VM's source/destination check.

B.Create firewall rules to allow traffic to the VM's NICs.

C.Enable IP forwarding on the VM instance.

D.Create a Cloud NAT gateway.

E.Assign an external IP to each NIC.

AnswersB, C

Must allow ingress traffic to be forwarded.

Why this answer

To use a VM as a gateway, IP forwarding must be enabled on the VM. Additionally, firewall rules must allow ingress traffic to the VM's NICs that will forward traffic. The VM itself must have routes pointing to it as next hop.

Full explanation →

561

MCQmedium

A company has a HA VPN gateway in Google Cloud with two tunnels to their on-premises router. They want to ensure that if one tunnel fails, all traffic automatically fails over to the other tunnel. What configuration is necessary on the on-premises router?

A.Use AS path prepending on the primary tunnel to make it preferred

B.Set a higher local preference on the primary tunnel

C.Configure the same MED value on both tunnels

D.Configure ECMP to load balance across both tunnels

AnswerB

Higher local preference makes a route more preferred, so setting it on the primary tunnel ensures it is used when available.

Why this answer

For failover, the on-premises router should prefer one tunnel over the other using BGP attributes like local preference or AS path prepending. Typically, one tunnel is primary and the other is backup. Both tunnels should be established with BGP sessions, and the on-premises router should learn the same routes from both, but with different local preference values to determine the primary path.

Full explanation →

562

MCQmedium

An organization wants to consume a third-party SaaS service via a private endpoint in their VPC, using Private Service Connect. Which type of Private Service Connect endpoint should they create?

A.PSC producer endpoint

B.PSC consumer endpoint (forwarding rule)

C.Cloud VPN tunnel

D.VPC peering connection

AnswerB

Consumers create a forwarding rule targeting the service attachment to access the service privately via an internal IP.

Why this answer

Private Service Connect allows consumers to create endpoints in their VPC to access managed services. For accessing a third-party service published via PSC, the consumer creates a PSC endpoint (also known as a PSC forwarding rule) that targets the service attachment of the publisher.

Full explanation →

563

MCQeasy

A company wants to expose a global web application with HTTP/HTTPS load balancing, SSL termination, and Cloud CDN. They need to route requests to different backend services based on the URL path (e.g., /api/* to a Cloud Run service, /static/* to a Cloud Storage bucket, and /* to a managed instance group). Which GCP load balancing product should they use?

A.SSL Proxy Load Balancer

B.Global external HTTP(S) Load Balancer

C.Internal TCP/UDP Load Balancer

D.External TCP/UDP Network Load Balancer

AnswerB

Correct – supports URL map routing, SSL, Cloud CDN, and multiple backend types including serverless NEG and backend buckets.

Why this answer

Global external HTTPS Load Balancer supports URL-based routing via URL maps, can terminate SSL, integrate with Cloud CDN, and route to different backends (including serverless NEG for Cloud Run and backend buckets for Cloud Storage).

Full explanation →

564

MCQmedium

A company is using Dedicated Interconnect to connect their on-premises network to Google Cloud. They have two VLAN attachments configured, each with a separate Cloud Router with active/active BGP. They want to ensure that traffic from their on-premises network to Google Cloud uses both attachments equally. Which configuration should they implement?

A.Set the same MED value on both on-premises BGP peers, and ensure the AS path length is identical.

B.Configure local preference on the Cloud Router to prefer one attachment, and rely on the other for backup.

C.Configure a single BGP session on one Cloud Router and use static routing for the other attachment.

D.Set a higher MED value on one on-premises peer to deprefer that attachment.

AnswerA

Equal MED and AS path length enables ECMP, balancing traffic across both attachments.

Why this answer

Setting the same MED (Multi-Exit Discriminator) value on both on-premises BGP peers ensures that Google Cloud's Cloud Routers, which are configured with active/active BGP, will see both paths as equally preferred. When the AS path length is also identical, the BGP best-path selection algorithm on the Cloud Routers will load-balance traffic across both VLAN attachments, achieving equal utilization. This is the standard method for enabling equal-cost multipath (ECMP) over Dedicated Interconnect with multiple attachments.

Exam trap

The trap here is that candidates often assume MED is only for influencing inbound traffic from Google Cloud to on-premises, but in this scenario, the MED values are set on the on-premises peers to influence how Google Cloud selects the return path, and equal MED is required for ECMP to work.

How to eliminate wrong answers

Option B is wrong because configuring local preference to prefer one attachment would make that attachment the primary path and the other a backup, which directly contradicts the requirement for equal traffic distribution. Option C is wrong because using a single BGP session on one Cloud Router with static routing on the other attachment would not allow dynamic load balancing; static routes lack the BGP attributes needed for equal-cost multipath, and the second attachment would only be used as a failover. Option D is wrong because setting a higher MED value on one on-premises peer would deprefer that attachment, making it less preferred and preventing equal traffic distribution; MED is a metric that influences path selection, and unequal values break ECMP.

Full explanation →

565

MCQhard

A company uses a Shared VPC with a host project and multiple service projects. They have deployed Cloud NAT in the host project's network to provide internet access for service project instances. The Cloud NAT is configured to use a network tag 'nat'. Instances in service projects that have the tag 'nat' can reach the internet. A new service project is added and its instances are created with the same tag 'nat' in a subnet in europe-west1. However, these instances cannot reach the internet. Other service project instances with the tag 'nat' in us-central1 work fine. The Cloud NAT is deployed in us-central1. What is the most likely cause?

A.The Cloud NAT's UDP timeout is too short.

B.The firewall rules in the host project block traffic from the new service project's subnets.

C.The Cloud NAT is not in the same region as the new service project's instances.

D.The new service project's instances are not tagged with 'nat'.

AnswerC

Cloud NAT only works for instances in its region.

Why this answer

Cloud NAT is a regional resource; it only provides outbound internet access to instances within the same region. Since the Cloud NAT is deployed in us-central1, instances in europe-west1 cannot use it, regardless of their network tag. The instances in the new service project must have a Cloud NAT deployed in europe-west1 to reach the internet.

Exam trap

The trap here is that candidates assume Cloud NAT is a global resource or that network tags alone ensure connectivity, overlooking the critical regional scope of Cloud NAT and the fact that it must be deployed in the same region as the instances it serves.

How to eliminate wrong answers

Option A is wrong because UDP timeout settings affect the duration of NAT connections, not the ability to establish them across regions; a short timeout would cause dropped idle connections, not a complete lack of internet access. Option B is wrong because firewall rules in the host project control traffic at the network level, but Cloud NAT operates at the regional level and does not require explicit firewall rules for NAT traffic; the issue is regional mismatch, not firewall blocking. Option D is wrong because the question explicitly states the new instances are created with the same tag 'nat', so the tag is present; the problem is regional, not tag-related.

Full explanation →

566

Multi-Selectmedium

A company is migrating from an on-premises data center to Google Cloud. They have a legacy TCP application that must preserve client IP addresses when load balanced. They also need SSL termination for a different web application. Which TWO load balancers should they consider? (Choose two.)

Select 2 answers

A.Global SSL Proxy Load Balancer

B.Global TCP Proxy Load Balancer

C.Regional Internal HTTP(S) Load Balancer

D.Global HTTPS Load Balancer

E.Regional External TCP/UDP Network Load Balancer

AnswersA, E

Provides SSL termination for TCP traffic.

Why this answer

Regional External TCP/UDP Network Load Balancer preserves client IP (pass-through). Global SSL Proxy Load Balancer provides SSL termination for TCP applications (non-HTTP).

Full explanation →

567

MCQeasy

A company has Compute Engine instances without external IPs that need to access the internet for updates. They do not want any inbound traffic. What is the best design?

A.Configure Cloud NAT and rely on default firewall rules.

B.Configure Cloud NAT and add firewall rules to allow only necessary egress and deny all ingress.

C.Configure Cloud NAT and add a firewall rule to allow all egress traffic.

D.Configure Cloud NAT and add a firewall rule to deny all ingress and egress.

AnswerB

Meets both outbound access and inbound blocking requirements.

Why this answer

Cloud NAT provides outbound internet connectivity for instances without external IPs, and the explicit firewall rules ensure only necessary egress traffic is allowed while denying all ingress, meeting the requirement of no inbound traffic. Default firewall rules allow some ingress (e.g., ICMP), so they must be overridden with a deny-all-ingress rule to fully block inbound traffic.

Exam trap

The trap here is that candidates assume default firewall rules are sufficient for security, but they actually allow some ingress (e.g., ICMP from internal ranges), so a deny-all-ingress rule is necessary to fully block inbound traffic.

How to eliminate wrong answers

Option A is wrong because default firewall rules allow certain ingress traffic (e.g., ICMP from RFC 1918 ranges), which violates the 'no inbound traffic' requirement. Option C is wrong because allowing all egress traffic is overly permissive and does not follow the principle of least privilege; the question implies only necessary egress (e.g., updates) should be allowed. Option D is wrong because denying all egress traffic would block the outbound updates the instances need, defeating the purpose of Cloud NAT.

Full explanation →

568

Multi-Selectmedium

Which TWO statements are true about VPC Network Peering?

Select 2 answers

A.Each VPC can have up to 25 peerings by default

B.Peered VPCs can communicate using RFC 1918 IP addresses without the need for VPN or Interconnect

C.Firewall rules in one VPC are automatically applied to the peered VPC

D.VPC peering incurs additional cost beyond standard egress charges

E.Custom static routes are automatically exchanged between peered VPCs

AnswersA, B

Default limit is 25 peerings per VPC.

Why this answer

The default limit for VPC Network Peering per VPC is 25, as documented in Google Cloud's quotas and limits. This is a soft limit that can be increased by requesting a quota adjustment, but by default, each VPC can have up to 25 peerings. Option B is correct because VPC Network Peering allows direct communication between VPCs using RFC 1918 private IP addresses without requiring VPN tunnels or Cloud Interconnect, as the peering connection uses Google's internal network infrastructure.

Exam trap

The trap here is that candidates often assume firewall rules or custom routes are automatically shared across peered VPCs, but Google Cloud explicitly requires separate firewall rule management and manual route exchange configuration for custom routes.

Full explanation →

569

Multi-Selecthard

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

Select 2 answers

A.Check the MTU size on the VPN tunnel or interconnect.

B.Delete and recreate the VLAN attachment.

C.Revert all BGP routes to static routes.

D.Verify BGP timers and hold time settings.

E.Increase the bandwidth of the interconnect.

AnswersA, D

MTU mismatches can cause packet loss and BGP session drops.

Why this answer

An MTU mismatch on the VPN tunnel or interconnect can cause packet fragmentation or drops, leading to BGP session flapping. Cloud Router uses Google's internal infrastructure, and if the MTU is set too low, large BGP update packets may be silently discarded, triggering hold timer expiry and session resets. Checking and adjusting the MTU ensures that BGP packets can traverse the path without fragmentation.

Exam trap

Google Cloud often tests the misconception that increasing bandwidth or recreating attachments resolves BGP flapping, when in fact the issue is typically related to MTU mismatches or BGP timer misconfigurations that affect session stability.

Full explanation →

570

MCQmedium

A company has a Dedicated Interconnect connection with a VLAN attachment in their GCP VPC. They want to use BGP to exchange routes with their on-premises router. Which GCP resource must be configured to establish the BGP session?

A.Cloud Router

B.VPC peering

C.Network Connectivity Center

D.Cloud VPN gateway

AnswerA

Cloud Router is used for BGP sessions with on-premises routers over Interconnect or VPN.

Why this answer

A Cloud Router is required to establish BGP sessions over VLAN attachments. The Cloud Router manages BGP peers and route advertisements.

Full explanation →

571

Multi-Selectmedium

A company is designing hybrid connectivity between on-premises and GCP. The on-premises network has multiple VPN gateways that support BGP. They require high availability with an SLA of 99.99% and want to use Cloud VPN. Which TWO configurations are required? (Choose two.)

Select 2 answers

A.Static routing

B.Two Cloud VPN gateways

C.One Cloud VPN gateway with two interfaces

D.Policy-based VPN

E.Four IKEv2 tunnels with BGP

AnswersB, E

HA VPN uses two gateways for redundancy.

Why this answer

HA VPN provides 99.99% SLA with two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP. Two Cloud VPN gateways and four tunnels are needed.

Full explanation →

572

MCQmedium

A network engineer notices that VPC Flow Logs show connections from a Compute Engine instance to an IP address that should have been blocked by firewall rules. What is the most likely cause?

A.The firewall rule has a lower priority than a deny rule.

B.The instance is using an external IP.

C.VPC Flow Logs are inaccurate.

D.The firewall rule is not applied to the instance's network tag.

AnswerD

If the instance doesn't have the required tag, the firewall rule doesn't apply.

Why this answer

If a firewall rule is not applied to the instance's network tag, the rule will not affect that instance. In Google Cloud, firewall rules can target instances by specifying target tags; if the rule's target tag does not match the instance's tag, the rule is not enforced on that instance, allowing traffic that should have been blocked.

Exam trap

Google Cloud often tests the misconception that firewall rules are automatically applied to all instances in a VPC, when in reality they must be explicitly associated via target tags or service accounts, and candidates may overlook the tag mismatch as the root cause.

How to eliminate wrong answers

Option A is wrong because a lower priority number means higher priority in Google Cloud firewall rules (priority 1000 is higher than 2000), so a deny rule with a lower priority number would take precedence over an allow rule with a higher priority number; the scenario describes traffic that should have been blocked, implying the allow rule is incorrectly allowing it, not that a deny rule is being overridden. Option B is wrong because using an external IP does not bypass firewall rules; firewall rules in Google Cloud are stateful and apply to all traffic regardless of whether the instance uses an internal or external IP, as they operate at the VPC network level. Option C is wrong because VPC Flow Logs are accurate; they capture metadata about network flows and are not prone to inaccuracies that would show connections that do not actually occur—they reflect actual traffic seen by the network.

Full explanation →

573

MCQmedium

A company is deploying a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They require 99.99% availability for the interconnect. Which two actions must they take to meet this SLA?

A.Order two 10 Gbps circuits in different metro areas

B.Order four 10 Gbps circuits in the same metro area

C.Order a single 10 Gbps circuit

D.Order two 10 Gbps circuits in the same metro area

AnswerA

Two circuits in different metro areas provide geo-redundancy, meeting the 99.99% SLA requirement.

Why this answer

To achieve 99.99% availability for Dedicated Interconnect, you need two connections with at least 10 Gbps each, placed in different metropolitan areas (different metro zones). This provides redundancy even if a whole metro area fails.

Full explanation →

574

MCQmedium

A company wants to migrate an on-premises application that uses IPsec VPN tunnels to Google Cloud. They need to ensure encrypted connectivity between the on-premises network and a VPC. Which GCP service should they use?

A.Cloud Router

B.Cloud Interconnect

C.VPC Network

D.Cloud VPN

AnswerD

Provides IPsec VPN connectivity.

Why this answer

Cloud VPN (D) is the correct service because it securely extends an on-premises network to a Google Cloud VPC over the public internet using IPsec VPN tunnels. It provides encrypted connectivity that matches the existing IPsec-based architecture, ensuring data confidentiality and integrity between the two sites.

Exam trap

The trap here is that candidates confuse Cloud Router (a routing protocol component) with the actual VPN connectivity service, or assume Cloud Interconnect is required for encryption, when in fact Cloud Interconnect offers no native encryption and relies on separate IPsec overlays.

How to eliminate wrong answers

Option A is wrong because Cloud Router is a BGP-based dynamic routing component that exchanges routes between a Cloud VPN tunnel and a VPC, not a connectivity service itself. Option B is wrong because Cloud Interconnect provides dedicated, high-bandwidth physical connections between on-premises and Google Cloud, but it does not inherently include IPsec encryption; encryption would require an additional overlay. Option C is wrong because VPC Network is the virtual network container within Google Cloud that defines subnets, routes, and firewall rules, not a service that establishes encrypted tunnels to on-premises networks.

Full explanation →

575

MCQmedium

An organization is connecting their on-premises data center to Google Cloud via Partner Interconnect. The partner offers both Layer 2 and Layer 3 connectivity options. The organization wants to manage their own BGP sessions and IP addressing. Which connectivity option should they choose?

A.Any Layer option because they can manage BGP regardless

B.Layer 2 connectivity

C.Neither; they must use Dedicated Interconnect

D.Layer 3 connectivity

AnswerB

Layer 2 gives the customer control over BGP sessions and IP addressing.

Why this answer

With Layer 2, the service provider delivers a transparent VLAN, and the customer manages the BGP session with Google Cloud Router. Layer 3 would mean the partner manages the routing, which is not desired here.

Full explanation →

576

Multi-Selectmedium

A security engineer wants to monitor and analyze traffic to a load-balanced web application. Which TWO services can provide detailed logs of HTTP requests and responses?

Select 2 answers

A.HTTP Load Balancer access logs

B.Cloud NAT logging

C.VPC Flow Logs

D.Firewall Rules logging

E.Cloud Armor request logs

AnswersA, E

HLB access logs show request/response details.

Why this answer

HTTP Load Balancer access logs capture request details. Cloud Armor request logs provide additional security insights. VPC Flow Logs and Firewall logs do not provide HTTP-level details.

Full explanation →

577

MCQmedium

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

A.The VPCs use different routing modes.

B.The IAM permissions for the peering are missing.

C.The VPCs have overlapping subnet CIDR ranges.

D.The engineer forgot to add firewall rules to allow traffic from the peer range.

AnswerD

Firewall rules are required to allow ingress traffic from the peered network.

Why this answer

Default firewall rules deny all ingress, so even with peering, traffic is blocked unless allow rules are added.

Full explanation →

578

MCQhard

A network engineer is configuring HA VPN between an on-premises network and GCP. They have created two external VPN gateways in GCP (one per region) and two Cloud Routers. How many IKEv2 tunnels and BGP sessions are required to achieve the 99.99% SLA?

A.Four tunnels, four BGP sessions

B.Two tunnels, two BGP sessions

C.Four tunnels, two BGP sessions

D.Two tunnels, four BGP sessions

AnswerA

Four tunnels (two per gateway) with four BGP sessions meet the 99.99% SLA.

Why this answer

HA VPN requires four tunnels (two per gateway) and four BGP sessions (one per tunnel) to achieve 99.99% SLA.

Full explanation →

579

MCQmedium

A company uses VPC Service Controls to protect a managed service (e.g., BigQuery) within a service perimeter. Developers need to access the service from an on-premises network via a Cloud VPN tunnel with a specific IP address. However, access is being denied. What is the most likely cause?

A.The project containing the VPN tunnel is not in the same perimeter.

B.The VM instances in the perimeter do not have public IP addresses.

C.The on-premises source IP is not included in the allowed external IP addresses list in the perimeter.

D.The Cloud VPN tunnel is not using IKEv2.

AnswerC

VPC Service Controls can restrict by source IP; the on-prem IP must be allowed.

Why this answer

VPC Service Controls enforce access to managed services like BigQuery by restricting which source IPs can reach the service. When accessing from on-premises via Cloud VPN, the source IP seen by the service is the on-premises client's IP, not the VPN gateway's IP. If that on-premises source IP is not explicitly added to the allowed external IP addresses list in the service perimeter, access is denied, even though the VPN tunnel is established.

Exam trap

Google Cloud often tests the misconception that placing the VPN tunnel's project inside the service perimeter or using a specific IKE version is required, when the real issue is that VPC Service Controls evaluate the source IP of the original client, not the VPN gateway, and that IP must be explicitly allowed.

How to eliminate wrong answers

Option A is wrong because the VPN tunnel is a network resource, not a managed service; VPC Service Controls perimeters apply to projects containing the managed service (e.g., BigQuery), not to the project hosting the VPN tunnel. Option B is wrong because VPC Service Controls do not require VM instances to have public IPs; the perimeter controls access based on identity and source IP, not the presence of public IPs on VMs. Option D is wrong because Cloud VPN tunnels support both IKEv1 and IKEv2; the IKE version does not affect VPC Service Controls access decisions, which operate at the application layer.

Full explanation →

580

MCQeasy

A company wants to connect their on-premises network to Google Cloud using a VPN with high availability and 99.99% SLA. They have two Cloud VPN gateways, each with two external IP addresses. Which configuration best meets the high availability requirement?

A.Deploy two Cloud VPN gateways, each with one tunnel to one on-premises VPN device

B.Deploy two Cloud VPN gateways, each with two tunnels to two separate on-premises VPN devices

C.Deploy one Cloud VPN gateway with two tunnels to two separate on-premises VPN devices

D.Deploy one Cloud VPN gateway with one tunnel to one on-premises VPN device

AnswerB

Provides redundancy at both ends; meets 99.99% SLA.

Why this answer

It meets the 99.99% SLA requirement by deploying two Cloud VPN gateways, each with two tunnels to two separate on-premises VPN devices. This configuration provides both gateway-level redundancy and tunnel-level redundancy, ensuring that if one gateway, tunnel, or on-premises device fails, traffic can failover to another tunnel. Google Cloud's HA VPN requires at least two tunnels per gateway to achieve the 99.99% SLA, and using two separate on-premises devices eliminates the single point of failure on the customer side.

Exam trap

The trap here is that candidates often assume two gateways with one tunnel each is sufficient for high availability, but they overlook the requirement for two tunnels per gateway to meet the 99.99% SLA, as well as the need for two separate on-premises devices to avoid a single point of failure on the customer side.

How to eliminate wrong answers

Option A is wrong because deploying two Cloud VPN gateways each with only one tunnel to one on-premises VPN device creates a single point of failure on the on-premises side; if that single on-premises device fails, connectivity is lost, and the 99.99% SLA cannot be met. Option C is wrong because deploying only one Cloud VPN gateway, even with two tunnels to two on-premises devices, lacks gateway-level redundancy; if the single gateway fails, all tunnels go down, violating the high availability requirement. Option D is wrong because a single Cloud VPN gateway with a single tunnel to a single on-premises device provides no redundancy at any layer, making it impossible to achieve any meaningful SLA.

Full explanation →

581

Multi-Selecteasy

Which TWO steps are required to set up a Cloud VPN with dynamic routing (BGP)? (Choose 2.)

Select 2 answers

A.Configure a static route for the remote network.

B.Create a Cloud NAT for outbound access.

C.Create a VPN gateway and a VPN tunnel.

D.Create firewall rules to allow traffic from the remote network.

E.Create a Cloud Router in the same region as the VPN gateway.

AnswersC, E

The VPN gateway terminates the tunnel.

Why this answer

A Cloud VPN requires both a VPN gateway (the GCP-side endpoint for encrypted traffic) and a VPN tunnel (the actual IPSec tunnel configuration that defines the remote peer IP, shared secret, and IKE parameters). Option E is correct because dynamic routing with BGP mandates a Cloud Router in the same region as the VPN gateway to exchange BGP routes with the on-premises router; the Cloud Router advertises the VPC subnets and learns remote prefixes via BGP sessions over the tunnel.

Exam trap

Google Cloud often tests the misconception that firewall rules are part of the VPN setup process, but they are a separate security control applied after the VPN infrastructure is created; the trap here is confusing prerequisite security policies with the actual configuration steps for the VPN gateway, tunnel, and BGP routing.

Full explanation →

582

MCQeasy

Refer to the exhibit. A network engineer reviews the firewall rules in a VPC. What is the most significant security concern?

A.There is no deny rule.

B.RDP is allowed from 10.0.0.0/8.

C.SSH is allowed from any source.

D.Firewall rules are not in order.

AnswerC

0.0.0.0/0 includes all public IPs, which is insecure.

Why this answer

Allowing SSH (TCP/22) from any source (0.0.0.0/0) exposes the VPC instances to brute-force attacks, unauthorized access, and potential compromise. This violates the principle of least privilege and is a critical security misconfiguration in a VPC firewall rule.

Exam trap

Google Cloud often tests the misconception that a missing explicit deny rule is a security risk, but in GCP VPC, the implicit deny at the end of the rule evaluation makes an explicit deny unnecessary unless you need to override a higher-priority allow rule.

How to eliminate wrong answers

Option A is wrong because VPC firewall rules are implicitly deny-all at the end; a missing explicit deny rule is not a security concern as long as allow rules are properly scoped. Option B is wrong because RDP from 10.0.0.0/8 is a private RFC 1918 range, which is acceptable for internal administrative access and does not represent a significant security concern. Option D is wrong because VPC firewall rules are evaluated based on priority numbers, not order of creation; the lowest priority number wins, and there is no requirement for rules to be in a specific sequence.

Full explanation →

583

MCQeasy

A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?

A.Cloud NAT

B.Cloud VPN

C.Private Google Access

D.VPC Peering

AnswerA

Cloud NAT provides outbound internet access to instances without external IPs.

Why this answer

Cloud NAT allows instances without external IPs to access the internet. Other options are for different purposes.

Full explanation →

584

Multi-Selectmedium

An organization is using Cloud VPN with dynamic routing and wants to improve failover time between two VPN tunnels. Which THREE configuration changes can help reduce failover time?

Select 3 answers

A.Set a lower BGP MED value on the primary tunnel

B.Increase the BGP keepalive interval to reduce overhead

C.Configure BGP timers with lower values for faster detection

D.Add static routes with a higher priority than BGP routes

E.Use multiple VPN tunnels with equal BGP metrics

AnswersA, C, E

Lower MED makes the primary path preferred, allowing faster fallback.

Why this answer

Lowering the BGP Multi-Exit Discriminator (MED) value on the primary tunnel makes it more preferred by the BGP best-path selection process. When the primary tunnel fails, BGP withdraws the route, and the backup tunnel (with a higher MED) is immediately used without waiting for timers to expire. This reduces failover time by ensuring the backup path is already known and only needs to be selected upon withdrawal.

Exam trap

Google Cloud often tests the misconception that increasing keepalive intervals improves performance, when in fact it delays failure detection and increases failover time.

Full explanation →

585

MCQhard

A company is using a Classic VPN with static routing to connect to GCP. They need to add a new subnet in GCP and make it reachable from on-premises without manual configuration changes on-premises. What is the limitation of Classic VPN in this scenario?

A.Classic VPN does not support IKEv2

B.Classic VPN supports BGP, so routes are automatically advertised

C.Classic VPN requires manual route updates on-premises

D.Classic VPN cannot be used with multiple subnets

AnswerC

Since Classic VPN uses static routing, new GCP subnets require adding static routes on-premises.

Why this answer

Classic VPN with static routing requires manual route updates; dynamic routing (BGP) is needed for automatic route advertisement.

Full explanation →

586

MCQhard

A network engineer is troubleshooting connectivity from a Compute Engine instance in subnet-a to a Google Cloud Storage bucket. The instance has no external IP address. Based on the exhibit, what is the most likely cause of the connectivity issue?

A.The subnet purpose is PRIVATE, which blocks Google APIs.

B.Private Google Access is disabled on the subnet.

C.The subnet CIDR range is too small.

D.Flow logs are disabled, so traffic is not logged.

AnswerB

Private Google Access must be enabled for instances without external IPs to access Google APIs.

Why this answer

The instance has no external IP address, so it must use Private Google Access to reach Google APIs and services like Cloud Storage. Private Google Access is enabled at the subnet level; if it is disabled, the instance cannot route traffic to the Google API VIPs through the default route (0.0.0.0/0) without a NAT gateway or external IP. Option B correctly identifies this as the most likely cause.

Exam trap

The trap here is that candidates may assume a private subnet inherently blocks all external traffic, but Private Google Access is a separate, optional subnet setting that must be explicitly enabled for instances without external IPs to reach Google APIs.

How to eliminate wrong answers

Option A is wrong because the subnet purpose PRIVATE does not block Google APIs; it simply means the subnet is used for internal VPC traffic, and Private Google Access can still be enabled on it. Option C is wrong because the CIDR range size does not affect connectivity to Google APIs; it only limits the number of IP addresses available for instances. Option D is wrong because flow logs are a monitoring feature that capture metadata about traffic, but disabling them does not prevent connectivity; they are not required for traffic to flow.

Full explanation →

587

Multi-Selecthard

Which THREE factors should be considered when designing a Cloud VPN for high availability? (Choose 3.)

Select 3 answers

A.Enable BGP for dynamic routing

B.Deploy VPN gateways in different regions

C.Use two tunnels from each VPN gateway

D.Use static routes for failover

E.Use a single Cloud Router for simplicity

AnswersA, B, C

BGP allows automatic route advertisement and failover.

Why this answer

Enabling BGP (Border Gateway Protocol) for dynamic routing is correct because it allows the Cloud VPN to automatically detect and route around failures. BGP exchanges route information between the on-premises router and the Cloud Router, enabling dynamic failover and load balancing across multiple tunnels. Without BGP, you would rely on static routes, which cannot adapt to network changes and require manual intervention during a failure.

Exam trap

The trap here is that candidates often think static routes with a higher metric can provide failover, but they fail to realize that static routes cannot dynamically detect a tunnel failure unless combined with a health check mechanism, which is not as reliable or fast as BGP's built-in path selection and withdrawal.

Full explanation →

588

MCQmedium

A company wants to use Cloud DNS with a failover routing policy. They have two IP addresses serving the same application: primary in us-east1 and secondary in us-west1. They want traffic to go to primary unless health check fails, then fail over to secondary. Which configuration is required?

A.Create a geo routing policy with us-east1 as primary and us-west1 as secondary

B.Use a response policy to override the DNS response

C.Create a failover routing policy with primary and secondary targets, each associated with a health check

D.Create two A records with weighting 100 and 0

AnswerC

Failover policy uses health checks to determine active target.

Why this answer

Cloud DNS failover routing policy requires health checks to be attached to the routing policy. The primary and secondary targets are defined under the policy.

Full explanation →

589

MCQhard

A company is planning a hybrid connectivity solution with 200 Gbps total bandwidth between their data center and Google Cloud. They need the highest SLA and lowest latency. Which combination of services would meet these requirements?

A.Two 100 Gbps Dedicated Interconnect connections

B.One 100 Gbps Dedicated Interconnect and one 100 Gbps Partner Interconnect

C.Twenty 10 Gbps Dedicated Interconnect connections

D.Four 50 Gbps Partner Interconnect connections

AnswerA

Two 100 Gbps connections provide 200 Gbps bandwidth and meet the highest SLA (99.99%) and lowest latency.

Why this answer

Dedicated Interconnect provides up to 100 Gbps per link. To achieve 200 Gbps, they need two 100 Gbps connections. Two connections provide redundancy and the 99.99% SLA.

Full explanation →

590

MCQeasy

A developer needs to store a TLS certificate for use with a load balancer. Which Google Cloud service is used to create and manage SSL certificates?

A.Secret Manager

B.Certificate Manager

C.Cloud IAM

D.Cloud KMS

AnswerB

Correct. Certificate Manager is used to create, manage, and deploy SSL certificates.

Why this answer

Certificate Manager is the service for managing SSL/TLS certificates for load balancers. Cloud KMS is for encryption keys, Secret Manager for secrets, and Cloud IAM for access control.

Full explanation →

591

Multi-Selecthard

A company is experiencing periodic packet loss between two Compute Engine instances in the same region but different zones. They have enabled VPC Flow Logs and see that the flows are marked with 'RTT' latency. Which THREE actions should they take to diagnose the issue? (Choose three.)

Select 3 answers

A.Check the Performance Dashboard for packet loss between the two zones

B.Analyze VPC Flow Logs for RTT latency values to identify congestion

C.Verify that the firewall rules are not blocking ICMP

D.Review the CPU utilization of both instances

E.Check BGP session status on the Cloud Router

AnswersA, B, D

Shows if there is underlying network packet loss.

Why this answer

VPC Flow Logs provide RTT latency for TCP flows. Analyzing the RTT values can indicate congestion. Checking the Performance Dashboard can show packet loss between zones.

Checking instance CPU metrics can reveal if one instance is overwhelmed. Checking firewall rules is less likely to cause intermittent loss; firewall rules either block or allow. Checking BGP sessions is irrelevant for intra-region traffic.

Full explanation →

592

Multi-Selecteasy

Which TWO of the following are benefits of using Shared VPC?

Select 2 answers

A.Enhanced security through VPC Service Perimeters

B.Automatic cross-project routing

C.Centralized firewall rule management

D.Reduced IP address usage

E.Separation of network and application teams

AnswersB, C

Service project VMs automatically communicate using host project's routes.

Why this answer

Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling automatic cross-project routing. This is because all subnets in the host project are directly reachable from any service project attached to that host, without needing additional VPC peering or VPN tunnels. Option B is correct because this inherent routing simplifies network connectivity and reduces administrative overhead.

Exam trap

Google Cloud often tests the misconception that Shared VPC inherently provides security features like VPC Service Perimeters, when in fact those are separate controls; the trap here is confusing the administrative separation of network and application teams as a direct benefit of Shared VPC, rather than recognizing that the core technical benefit is automatic cross-project routing and centralized firewall rule management.

Full explanation →

593

MCQeasy

A startup is migrating a two-tier application to GCP. The web tier must be accessible from the internet, and the database tier must only be accessible from the web tier. Which network design should be used?

A.Place web servers in a public subnet with external IPs, database in a private subnet, and add a firewall rule allowing traffic from web subnet to database

B.Place both tiers in separate VPCs and use VPC peering with no firewall rules

C.Place both tiers in the same subnet and configure firewall rules to restrict database access

D.Place web servers in a private subnet with Cloud NAT for outbound, database in the same private subnet

AnswerA

This design provides proper segmentation and security.

Why this answer

It places the web servers in a public subnet with external IPs, allowing direct internet access, while the database resides in a private subnet with no external IP, enforcing isolation. A firewall rule (ingress on the database subnet) explicitly permits traffic from the web subnet’s CIDR range, typically on the database port (e.g., TCP 3306 for MySQL), ensuring the database is reachable only from the web tier. This design follows GCP’s best practice of using VPC firewall rules to control east-west traffic between subnets.

Exam trap

Google Cloud often tests the misconception that placing resources in the same subnet automatically allows isolation via firewall rules, but in GCP, firewall rules are applied at the instance level (via tags or service accounts) and cannot restrict traffic between instances in the same subnet without additional tagging, leading candidates to incorrectly choose Option C.

How to eliminate wrong answers

Option B is wrong because placing both tiers in separate VPCs with VPC peering and no firewall rules would allow unrestricted traffic between the VPCs (peering does not impose default deny), violating the requirement that the database be accessible only from the web tier. Option C is wrong because placing both tiers in the same subnet would give the database the same network access as the web servers, making it impossible to restrict database access to only the web tier using subnet-level firewall rules (firewall rules in GCP are applied at the subnet or instance level, but same-subnet traffic is not easily isolated without complex per-instance tags). Option D is wrong because placing web servers in a private subnet with Cloud NAT only provides outbound internet access, not inbound; the web tier would not be accessible from the internet, failing the requirement that the web tier must be internet-accessible.

Full explanation →

594

Multi-Selecthard

A network engineer is troubleshooting connectivity issues with VPC Flow Logs. Which TWO statements about VPC Flow Logs are correct? (Choose TWO)

Select 2 answers

A.VPC Flow Logs capture only egress traffic.

B.VPC Flow Logs only capture traffic that is allowed by firewall rules.

C.VPC Flow Logs can be used to diagnose overly permissive firewall rules.

D.VPC Flow Logs capture all packets for every flow in the VPC.

E.VPC Flow Logs do not capture traffic that is generated by GCP health checks.

AnswersC, E

By analyzing logs, you can see allowed traffic and identify rules that are too broad.

Why this answer

VPC Flow Logs capture metadata about accepted and rejected traffic, including traffic that is allowed by overly permissive firewall rules. By analyzing the logs, you can identify flows that should have been blocked, revealing rules that are too broad in scope (e.g., allowing all traffic from 0.0.0.0/0). This diagnostic capability directly helps tighten security posture.

Exam trap

Google Cloud often tests the misconception that VPC Flow Logs capture every packet or only allowed traffic, when in reality they sample flows and log both accepted and rejected traffic, making options B and D common traps.

Full explanation →

595

MCQeasy

A company has multiple projects that each need their own administrative control but must share a common VPC network. Which networking solution should they use?

A.Create a single VPC in one project and grant all users access to that project.

B.Create separate VPCs for each project and connect via Cloud VPN.

C.Use Shared VPC with the host project and attach service projects.

D.Create a VPC in each project and peer them all together.

AnswerC

Provides centralized network management with per-project resource control.

Why this answer

Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling centralized control of the network while maintaining administrative isolation for each project. The host project owns the VPC and firewall rules, and service projects can use subnets within that VPC, meeting the requirement for separate administrative control with a shared network.

Exam trap

The trap here is that candidates often confuse VPC peering (Option D) with Shared VPC, not realizing that peering does not allow a single common VPC network and lacks centralized administrative control, while Shared VPC is designed exactly for this use case.

How to eliminate wrong answers

Option A is wrong because granting all users access to a single project eliminates administrative isolation, as all users would have project-level permissions, not per-project control. Option B is wrong because creating separate VPCs and connecting via Cloud VPN introduces complexity, latency, and bandwidth limitations, and does not provide a single common VPC network; it creates multiple networks that are bridged. Option D is wrong because VPC peering does not support transitive routing and requires non-overlapping CIDR ranges, making it unsuitable for a shared network with multiple projects that need to communicate through a common VPC; it also does not allow centralized firewall or subnet management.

Full explanation →

596

MCQeasy

What is the default MTU for packets sent between VMs within the same VPC network in Google Cloud?

A.8970 bytes

B.1400 bytes

C.1460 bytes

D.1500 bytes

AnswerC

Google's internal network uses 1460-byte MTU to allow for encapsulation.

Full explanation →

597

Multi-Selecteasy

A developer wants to configure Cloud DNS for split-horizon DNS where internal queries resolve to private IPs and external queries resolve to public IPs. Which TWO steps should they take?

Select 2 answers

A.Set up DNS peering between the zones.

B.Configure the private zone with a VPC network binding.

C.Use DNS forwarding to on-premises servers.

D.Create a public managed zone for the domain.

E.Create a private managed zone for the domain.

AnswersD, E

Handles external queries.

Why this answer

Split-horizon DNS is achieved by having a private zone for internal resolution and a public zone for external resolution, both authoritative for the same domain.

Full explanation →

598

MCQhard

A large organization uses Shared VPC with hundreds of projects. They want to implement fine-grained access control for SSH access to Compute Engine instances using IAP TCP forwarding. They have created a custom IAM role with the necessary permissions (iap.tunnel.dest, iap.tunnel.getIamPolicy, compute.instances.use) and granted it to a group of developers. The developers have also been granted the iap.tunnelUser role on the project. However, when they try to use `gcloud compute ssh --tunnel-through-iap instance-name`, they get a permission error: "Permission 'iap.tunnel.dest' denied on resource 'projects/project/zones/zone/instances/instance'". The network admin has verified that the custom role includes the required permissions and that the developers are members of the group with the role. What is the most likely missing configuration?

A.The developers need the `iap.tunnel` resource-level permission on the IAP TCP forwarding resource.

B.IAP TCP forwarding is not enabled for the project or VPC.

C.The instances do not have the required network tags for IAP.

D.The developers need the `compute.instances.osLogin` permission.

AnswerB

IAP TCP forwarding must be explicitly enabled at the project level. If not enabled, the permission check fails.

Why this answer

IAP TCP forwarding requires the IAP API to be enabled on the project and the service to be activated for the VPC. Without this, the IAP proxy cannot intercept and forward TCP traffic to the instance, even if the IAM permissions are correctly assigned. The error 'Permission 'iap.tunnel.dest' denied' typically occurs when the IAP TCP forwarding service itself is not enabled, as the permission check fails at the service level before evaluating the IAM role.

Exam trap

The trap here is that candidates assume the error is due to missing IAM permissions or instance configuration, when in fact the IAP TCP forwarding service must be explicitly enabled at the project level, which is a prerequisite often forgotten in Shared VPC environments.

How to eliminate wrong answers

Option A is wrong because 'iap.tunnel.dest' is already a resource-level permission on the instance, not a separate 'iap.tunnel' resource; IAP TCP forwarding uses resource-level permissions on the Compute Engine instance, not a distinct IAP resource. Option C is wrong because network tags are used for firewall rules, not for IAP TCP forwarding; IAP works through the IAP proxy and does not require specific tags on instances. Option D is wrong because 'compute.instances.osLogin' is for OS Login authentication, not for IAP TCP forwarding; the error is about IAP tunnel permissions, not OS-level access.

Full explanation →

599

MCQmedium

A company wants to use Cloud CDN to serve private content to authenticated users only. Which feature should they use?

A.Cache invalidation

B.IAM roles on the backend bucket

C.Cloud Armor

D.Signed URLs

AnswerD

Correct: signed URLs and signed cookies allow time-limited access to private content.

Why this answer

Signed URLs or signed cookies allow Cloud CDN to serve private content by requiring a valid signature for access.

Full explanation →

600

MCQmedium

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. They want to achieve a 99.99% SLA. What is the minimum requirement?

A.One Dedicated Interconnect connection with two VLAN attachments.

B.Two Dedicated Interconnect connections from different metro areas, configured for redundancy.

C.One Dedicated Interconnect and one Partner Interconnect.

D.Two Dedicated Interconnect connections in the same metro area.

AnswerB

Diverse metro areas ensure independence and meet SLA requirements.

Why this answer

To meet the 99.99% SLA, you need at least two connections that are diverse (different metro areas) and configured in active-active or active-passive mode. This ensures redundancy if one fails.

Full explanation →

Page 8 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCNE by domain

Target a specific domain to shore up weak areas.

Configuring Network Services Managing, Monitoring, and Optimising Network Operations Implementing Hybrid Interconnectivity Designing, Planning, and Prototyping a GCP Network Implementing VPC Instances Implementing network security Implementing a Virtual Private Cloud

See all domains with question counts →