scenario questions

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

A developer wants to log all denied firewall rule events for security auditing purposes. What is the simplest way to achieve this without modifying existing firewall rules?

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

A company has an on-premises data center connected to GCP via Cloud Interconnect. They want to expose an on-premises service to internet clients through Google Cloud's global load balancer. Which type of network endpoint group should they use?

A network engineer sees the above output from a Cloud Router. There are two BGP peers from the on-premises router (10.0.0.1 and 10.0.0.2). Both learned the same route 10.1.0.0/16 from their respective peers. However, traffic from Google Cloud to 10.1.0.0/16 is only going through the first peer (10.0.0.1) and not load-balanced. What could be the reason?

A developer is configuring a Compute Engine VM to host a web server. They want to ensure that only HTTP (port 80) and HTTPS (port 443) traffic from the internet is allowed. Which firewall rule should they create?

A company is designing a multi-region application on GCP and wants to optimize egress costs. Which TWO of the following strategies will reduce cross-region egress costs? (Choose two.)

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Drag and drop the steps to set up a Google Cloud Armor security policy for a backend service into the correct order.

You are designing DNS resolution for a hybrid cloud. On-premises DNS servers must resolve GCP private VM hostnames, and GCP VMs must resolve on-premises hostnames. Which Cloud DNS feature should you use?

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

A network engineer wants to test whether a Compute Engine VM can reach a Cloud SQL instance in a different VPC network, considering firewall rules and VPC peering. Which Google Cloud tool should they use?

A company wants to expose a set of internal services running on Compute Engine instances in a private VPC to other internal services using HTTP load balancing. They require L7 features like URL-based routing and SSL termination. Which load balancer should they use?

An organization uses Traffic Director with Envoy sidecars in GKE. They want to implement fault injection to test service resilience by injecting a 5-second delay into 10% of requests to a specific backend service. Which Traffic Director configuration resource should they use?

An organization has multiple VPC networks and wants to allow traffic between them with fine-grained control over which VMs can communicate. Which solution should they implement?

A company wants to publish an internal service (e.g., a database) in their VPC so that consumers in other VPCs can connect to it privately via Private Service Connect (PSC). What must be created on the producer side?

A company wants to use BGP traffic engineering to control how traffic flows between GCP and their on-premises network over two Dedicated Interconnect connections. Which TWO BGP attributes can they use on Cloud Router? (Choose 2.)

A company is designing a global web application that must serve users worldwide with low latency. They plan to use a Global HTTPS Load Balancer with Cloud CDN. Which TWO features should they enable to further reduce latency for users connecting from various regions? (Choose two.)

A company uses Cloud DNS. They want to override DNS resolution for a specific domain (e.g., mycompany.com) to point to an internal IP for all queries originating from their VPC, while leaving all other domains unaffected. Which Cloud DNS feature should they use?

Drag and drop the steps to set up a Cloud Interconnect connection for dedicated on-premises connectivity into the correct order.

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

A company needs to connect on-premises to Google Cloud with overlapping IP ranges. The on-premises network uses 10.0.0.0/16 and the VPC uses 10.0.0.0/16. What is the best approach?

A company wants to use Traffic Director to implement fault injection for testing service resilience. They want to inject delays and errors into a percentage of requests. Which two configurations are required? (Choose two.)

A company has a VPC with a firewall rule that allows SSH (tcp:22) from 0.0.0.0/0. They want to restrict SSH access to only the public IP address of their Cloud VPN gateway. How should they modify the firewall rule?

You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?

An engineer needs to configure DNS resolution for a Compute Engine instance named "web-1" in zone us-central1-a of project my-project. What is the internal DNS name for this instance?

A company uses Cloud NAT for outbound internet access. Engineering notices that some VM instances fail to connect to external services during peak hours. The network engineer suspects port exhaustion. Which action would best mitigate this issue?

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

An organization wants to use Shared VPC but restrict access to certain subnets for specific service projects. Which GCP feature should they use?

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

An engineer wants to use Cloud DNS to override DNS responses for a specific domain within their VPC. Which feature should they use?

A company has multiple VPC networks in the same project, each with its own Cloud NAT configuration. They notice that traffic from a VM in VPC-A that has an external IP address is being NATed through the Cloud NAT gateway, but they only want Cloud NAT to be used for VMs without external IPs. What configuration ensures this?

A GCP environment has a VPC with a subnet that enables Private Google Access. Instances in that subnet can access Google APIs without external IPs. However, an instance cannot reach storage.googleapis.com from a private IP. Cloud NAT is configured for the subnet. What is the most likely reason for the failure?

Which THREE actions are required to configure a High-Availability Cloud VPN (HA VPN) with dynamic routing to an on-premises peer?

A company has deployed an HTTP load balancer with a backend service configured to use an unmanaged instance group. Users report that traffic is not reaching the backend instances. The backend instances are healthy and have proper firewall rules allowing traffic from the load balancer. What step should the network engineer take to resolve the issue?

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

A financial services company requires a dedicated, low-latency connection between their on-premises data center and Google Cloud. They need a 99.99% SLA and bandwidth of 10 Gbps. Which connectivity option should they choose?

Match each VPC firewall rule component to its description.

Your organization has an internal HTTP load balancer (ILB) in us-central1. The backend service is a managed instance group with a health check on port 8080. Recently, some instances are reported as unhealthy despite the application running fine. What is the most likely cause?

A company has two VPCs connected via VPC peering. They want resources in VPC A to be able to reach a service in VPC B that uses a custom static route. What must be configured on the VPC peering connection?

A company uses a shared VPC with multiple service projects. They want to connect their on-premises data center to the shared VPC through a Dedicated Interconnect. Where should they configure the Cloud Router and VLAN attachment?

An organization uses Dedicated Interconnect with VLAN attachments in multiple regions. They need to ensure that traffic from one region to another flows over the interconnect backbone instead of the internet. Which configuration is required?

A company has an application running on Compute Engine that needs to send traffic to a third-party SaaS service on the internet. The VMs have no external IPs. Which solution provides outbound connectivity with minimal configuration and allows source IP preservation?

Company A and Company B both have networks in Google Cloud. They want to connect their VPCs using VPC peering, but they have overlapping IP addresses. How can they resolve this?

A security team needs to block traffic from a specific geographic region (country) from reaching their HTTP Load Balancer. Additionally, they need to allow traffic from specific IP ranges that are known to be legitimate, even if they originate from that blocked region. Which THREE steps should they take? (Choose THREE.)

Your company has a Partner Interconnect connection via a service provider that offers Layer 3 connectivity. The provider assigns an IP address on the VLAN attachment. Which VLAN attachment type should you use when creating the attachment in Google Cloud?

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have already ordered a cross-connect from their co-location facility to a Google Point of Presence (PoP). What is the NEXT step to establish the connection?

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

A company is planning to connect multiple VPCs in different regions to their on-premises network using a single Dedicated Interconnect. Which TWO configurations are required to achieve this?

A company is using Traffic Director with Envoy sidecar proxies to manage traffic between microservices. They want to gradually shift 5% of traffic from version v1 to v2 of a service for testing. Which Traffic Director resource should they configure?

An organization has two VPCs in the same project: VPC-A and VPC-B. They want instances in VPC-A to reach Cloud Storage buckets without external IPs. What is the simplest solution?

A company wants to protect its HTTPS Load Balancer from DDoS attacks and common web application attacks like SQL injection and cross-site scripting (XSS). Which Google Cloud service should be used?

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

A company is deploying a global web application on Google Cloud. They need to serve traffic from the closest region to users, support both HTTP and HTTPS, and offload SSL/TLS termination at the load balancer. Which load balancing solution should they use?

Refer to the exhibit. A DNS managed zone is configured with private visibility and associated with a VPC network. A Compute Engine instance in a different VPC network tries to resolve 'test.example.com' but fails. What is the most likely reason?

A security team wants to serve private content through Cloud CDN but restrict access to only authorized users. They need to generate time-limited URLs that do not require users to log in. Which approach should they use?

Refer to the exhibit. You have two VPCs, vpc-a and vpc-b, with VPC peering configured and custom route import/export enabled. An instance in subnet-a (10.0.1.2) cannot ping an instance in subnet-b (10.0.2.2) using internal IP. Firewall rules are default (deny all ingress). What is the required action?

Which TWO are necessary components for setting up Dedicated Interconnect? (Choose two.)

You need to configure Cloud CDN to cache all content from a backend bucket, ignoring any Cache-Control headers sent by the origin. Which cache mode should you use?

A large multinational corporation uses a Shared VPC in Google Cloud with multiple service projects. They have a central Cloud NAT configured in the host project in the us-central1 region to provide internet egress for all VMs. Recently, the IT team added a new subnet (10.0.10.0/24) in a service project and deployed VMs there. All other VMs in the same project but in different subnets (e.g., 10.0.1.0/24) can reach the internet, but the new VMs in 10.0.10.0/24 cannot. The Cloud NAT gateway is configured in us-central1 with all IP ranges allowed. The VPC firewall rules allow egress traffic to the internet. The team verified that the VMs have a default route (0.0.0.0/0) with next-hop 'default-internet-gateway' and that the Cloud NAT router's NAT IPs are properly assigned. However, the new subnet's VMs are unable to connect to any external IP. The network engineer suspects that the Cloud NAT's NAT reservations might be the issue, but all NAT IPs are ephemeral. Further investigation shows that the Cloud Router used by Cloud NAT is advertising custom IP ranges via BGP to an on-premises router for a different use case. What is the most likely cause and solution?

A company wants to use Cloud DNS to resolve DNS queries from their on-premises network for a private zone that contains internal GCP resource names. They do not want to manage DNS servers on-premises. Which Cloud DNS feature should they use?

You are a cloud network engineer for a company that runs a web application on Compute Engine instances in a managed instance group (MIG) behind an external HTTP(S) load balancer. The backend instances are in a subnet with CIDR 10.0.2.0/24 and are tagged 'web-backend'. The health checks are configured to use TCP port 80. Recently, the security team added new firewall rules to restrict traffic, and now the health checks are failing. The current firewall rules (in order of priority) are: 1. Priority 100: Deny ingress from 0.0.0.0/0 to all instances (deny-all). 2. Priority 200: Allow ingress from 130.211.0.0/22 and 35.191.0.0/16 to instances with tag 'health-checked' on TCP port 80. 3. Priority 300: Allow ingress from 0.0.0.0/0 to instances with tag 'web-backend' on TCP port 80. The MIG instances are tagged 'web-backend' but not 'health-checked'. The health checks are failing. What is the most efficient course of action to fix the health checks while maintaining security?

Your company has a hybrid cloud architecture with two on-premises data centers: DC1 and DC2. Each DC is connected to Google Cloud via separate Cloud VPN tunnels (tunnel1 from DC1, tunnel2 from DC2) to a VPC in us-west1. The VPC has two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). DC1 has a subnet 192.168.1.0/24 and DC2 has 192.168.2.0/24. You configure BGP on both tunnels with the VPC dynamic routing, and each on-premises router advertises its local subnet. The VPC automatically imports the learned routes. You notice that traffic from DC1 to an instance in subnet-a (10.0.1.5) works, but traffic from DC2 to the same instance fails intermittently. Additionally, traffic from DC2 to DC1 (192.168.1.0/24) fails completely. You check the route tables and see that both tunnels have learned the routes for the remote subnets. What is the most likely cause and solution?

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Refer to the exhibit. The Cloud Router shows one BGP peer as ESTABLISHED and one as IDLE. The best routes show two routes to the same destination with different priorities. What is the most likely reason the IDLE peer is not establishing?

A developer wants to use Cloud CDN to cache content from a backend bucket. They want to cache all objects regardless of cache-control headers, but need to exclude certain URL patterns (e.g., /private/*) from caching. Which cache mode should they choose?

A service provider uses a Shared VPC with multiple service projects. The host project has a Cloud NAT configured for subnet 10.1.0.0/24 to provide outbound internet access to all service projects using that subnet. A new service project needs to use its own Cloud NAT for its VM instances in subnet 10.1.0.0/24 to meet compliance requirements. The network engineer attempts to create a Cloud NAT in the service project for that subnet but receives an error that the subnet already has a NAT gateway. What action should the engineer take to meet the compliance requirement?

A company uses High Availability VPN (HA VPN) with two tunnels and BGP to connect to an on-premises network. They notice traffic only flows through one tunnel. They want to ensure both tunnels are used simultaneously. What should they do?

An engineer needs to provide outbound internet access to Compute Engine instances that do not have external IP addresses. The solution must allow instances to access a specific set of external IPs only. What should the engineer configure?

Match each network troubleshooting command/tool to its function.

You are designing a multi-tier application where an internal HTTP(S) load balancer should route requests to a backend service based on the URL path (e.g., /api/* to one service, /web/* to another). Which component is essential for this routing?

A company wants to connect two VPC networks (vpc-a and vpc-b) that both reside in the same Google Cloud project. They need to ensure that all IP ranges in both VPCs can communicate using internal private IP addresses. Which solution should they implement?

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

A large enterprise has a Google Cloud environment with multiple projects under an organization. They have a Shared VPC host project with a VPC named 'shared-vpc' that has subnets in us-central1 and europe-west1. Several service projects are attached to this host project. One service project, 'proj-analytics', has a Compute Engine instance 'vm-analytics' in us-central1 that needs to connect to a Cloud SQL PostgreSQL instance (private IP) also in us-central1, but within a different service project 'proj-db'. The Cloud SQL instance is configured with a private IP address 10.0.1.5 from a subnet in 'shared-vpc' (the same VPC). The vm-analytics instance has an internal IP 10.0.0.5 from a different subnet in 'shared-vpc'. The two subnets are in the same region, and there is a firewall rule allowing all traffic from 10.0.0.0/16 (the entire VPC range) to the Cloud SQL subnet. However, vm-analytics cannot connect to the Cloud SQL instance. The error on vm-analytics is 'Connection timed out'. There are no firewall rules blocking egress from vm-analytics. What is the most likely cause and solution?

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

A company runs a private GKE cluster in us-central1. Pods need to access the internet for updates. Which configuration is required?

An enterprise requires a hybrid connectivity solution that meets a 99.99% SLA. They plan to use Dedicated Interconnect. Which configuration satisfies the SLA requirement?

An organization uses Shared VPC with multiple service projects. They want to allow a service project to create a VM in a subnet that belongs to the host project. The subnet has an IAM policy that grants the compute.instanceAdmin role to the service project's service account. However, the service project is unable to create VMs in that subnet. What is the most likely reason?

A company uses Cloud NAT for outbound internet access from private instances. They want to monitor for connection failures due to NAT resource exhaustion. Which two steps should they take? (Choose two.)

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

An engineer configured a Cloud Router with the above settings. The VPC network has subnets 10.1.0.0/16 and 10.2.0.0/16, as well as subnets 10.3.0.0/16 and 10.4.0.0/16. The on-premises router is only receiving routes for 10.1.0.0/16 and 10.2.0.0/16 but not for 10.3.0.0/16 and 10.4.0.0/16. What is the cause?

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. Both connections are active and they want to use both simultaneously for load balancing traffic. They have configured two VLAN attachments each with a Cloud Router and BGP sessions. How should they configure BGP to achieve active-active load sharing?

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

A company has a VPC with the above firewall rule applied. They have a VM instance with network tag 'web-server' that hosts a web server. Users report they cannot access the web server from the internet. What is the most likely cause?

Which Traffic Director feature ensures that a service does not receive more requests than it can handle by setting a maximum number of concurrent requests or connections?

A company wants to allow on-premises servers to access Google APIs and services through a Dedicated Interconnect without using public IPs. What should they configure?

A company has two HA VPN tunnels from on-premises to Google Cloud using two separate Cloud Routers for redundancy. The on-premises network uses BGP and advertises a default route to Google Cloud. The company wants to ensure that traffic from Google Cloud to on-premises prefers the primary Cloud Router over the secondary. Which configuration should be applied?

A company has a multi-region VPC with subnets in us-central1 (10.0.0.0/24) and europe-west1 (10.0.1.0/24). They have deployed a global Application Load Balancer (ALB) with backend services in both regions. The backends are instance groups with instances in each subnet. The ALB uses internal IP addresses from a subnet in each region for the backend services. The company wants to restrict access to the ALB so that only traffic from a specific list of external IP addresses (e.g., corporate VPN) can reach the load balancer. They have created a firewall rule allowing ingress from those IP addresses to the ALB's forwarding rule IP (which is a global IP). However, external traffic from allowed IPs is still being blocked. What is the most likely reason?

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

A company has deployed a Dedicated Interconnect with multiple VLAN attachments connected to a single Cloud Router. They want to influence inbound traffic from on-premises to Google Cloud to use a specific attachment for certain prefixes. Which BGP attribute can they manipulate on the on-premises router to achieve this?

An engineer needs to configure Cloud NAT with logging enabled to monitor traffic from a specific subnet. The NAT gateway uses automatic NAT IP allocation. The engineer wants to ensure that if a single VM uses many connections, it does not exhaust the available ports for other VMs. Which THREE settings should be configured? (Choose THREE.)

A network engineer notices unusual traffic patterns from a VM. They want to capture detailed information about each packet sent and received by the VM, including source and destination IPs, protocols, and ports. Which feature should they enable?

A customer reports that after setting up HA VPN, some on-premises subnets are not reachable from Google Cloud. The Cloud Router shows the missing routes. What is the most likely cause?

An engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They want to control which on-premises subnets are advertised to GCP. Which TWO methods can they use?

A company is migrating from an on-premises data center to Google Cloud. They have set up a High-Availability VPN (with two tunnels) between their on-premises router and a Cloud VPN gateway in a VPC. They use static routing. The on-premises network uses RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the VPC uses 10.1.0.0/16. They have configured static routes in the VPC for the on-premises ranges pointing to the VPN gateway. However, they notice that traffic from on-premises to the VPC is intermittent: sometimes packets go through tunnel 1, sometimes through tunnel 2, and sometimes they drop. The on-premises router is configured to use both tunnels in an active-active mode with equal-cost multipath (ECMP). What is the most likely cause of the intermittent drops?

An organization has deployed an internal TCP/UDP load balancer in their VPC. They need to ensure that the load balancer preserves the client IP address when forwarding traffic to backend instances. Which configuration is required?

Your company has a hybrid network architecture with two Cloud VPN tunnels (tunnel-a and tunnel-b) from an on-premises router to a Cloud VPN gateway in us-central1, and one Dedicated Interconnect connection from the same on-premises router to a VLAN attachment in us-east1. All connections use BGP to exchange routes. The on-premises router advertises the same CIDR block 10.0.0.0/8 to both VPN and Interconnect. Google Cloud routes for on-premises prefixes are learned via both paths with the same priority. You notice that traffic from Google Cloud VMs in us-central1 to on-premises destinations sometimes fails during periods of high load. Additionally, you observe ICMP redirects from the VMs. What is the most likely cause and recommended action?

An organization is planning a hybrid network between an on-premises data center and Google Cloud. They require a dedicated, high-bandwidth connection with 99.99% availability SLA and the ability to scale up to 100 Gbps. They have a co-location facility that is connected to a Google Cloud region. Which connectivity option should they choose?

A network engineer is troubleshooting a Cloud VPN tunnel that is not passing traffic. The tunnel status shows as established, and BGP sessions are up. However, traffic from an on-premises subnet (10.0.1.0/24) to a GCP subnet (192.168.1.0/24) is not working. What should the engineer check first?

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

A company uses Cloud DNS with a managed zone for example.com. They want to override DNS responses for a specific subdomain, mail.example.com, to point to an internal IP address when queried from within the VPC, but external queries should resolve normally. Which feature should they use?

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

A global application uses a global external HTTPS load balancer with backend NEGs in multiple regions. The content is static and must be cached at edge locations to reduce latency. Which GCP service should be enabled?

A company needs a hybrid connectivity solution with a bandwidth of 500 Mbps and a 99.9% SLA. They do not have a presence in a colocation facility that supports Dedicated Interconnect. Which GCP service should they use?

Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?

An organization has multiple VPC networks in a project and wants to centrally manage firewall rules across all networks using a single set of rules. Which approach should they take?

A company wants to securely connect an on-premises data center to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) that overlap with the VPC subnet (10.0.1.0/24). They need connectivity to specific workloads in the VPC without changing IP addresses on premises. What should they do?

A network engineer is setting up a Dedicated Interconnect with a 10 Gbps circuit. They need to achieve 99.99% availability SLA. Which of the following configurations meets the SLA requirements?

An organization has two Cloud VPN tunnels from the same on-premises router to a Cloud Router in Google Cloud. Both tunnels are using BGP, and the on-premises router is sending the same routes over both tunnels. The Cloud Router is configured to use 'route propagation' from a VPC network. Which of the following is true regarding route priority?

Refer to the exhibit. The Cloud Router is connected to two on-premises routers via dedicated interconnect. The on-premises routers advertise the same prefix 10.1.0.0/16. Which on-premises router's route will be preferred by Google Cloud for traffic destined to 10.1.0.0/24? (Assume equal AS path length and MED from on-premises.)

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

A Compute Engine instance is running a network appliance that requires multiple network interfaces. What is the primary purpose of attaching additional NICs (e.g., NIC1, NIC2) to the instance?

A company deploys a web application on Google Kubernetes Engine (GKE) with an Ingress resource handled by an external HTTPS load balancer. They want to enforce mutual TLS (mTLS) authentication where the load balancer verifies the client certificate and then passes the client's identity to the backend using a header. Which configuration should be used?

A company uses Shared VPC with multiple service projects. The security team wants to ensure that only specific service projects can create firewall rules that allow ingress traffic to the Shared VPC network. What is the best practice?

A company has a TCP-based application running on a group of Compute Engine VMs in us-central1. They need to provide a static internal IP address to clients within the VPC, while preserving the client source IP for logging. Which load balancer should they use?

An organization is using Shared VPC with 100 service projects. They want to allow each service project to manage its own Cloud NAT, but the network administration team wants to control the outbound IP addresses used. What is the best design?

A multinational company is migrating workloads to Google Cloud and requires a hybrid connectivity solution between their on-premises data centers in New York and London and Google Cloud regions us-central1 and europe-west1. Each data center has a pair of redundant border routers. The network team has set up a Dedicated Interconnect connection in each Google Cloud region, with two VLAN attachments per region (total 4 attachments). Each VLAN attachment is associated with a separate Cloud Router. The Cloud Routers in us-central1 are configured with BGP sessions to the on-premises routers in New York, and the Cloud Routers in europe-west1 peer with the London routers. The VPC is in 'global' dynamic routing mode. After deployment, traffic from on-premises London to Google Cloud in us-central1 takes a suboptimal path: it goes from London to us-central1 via the internet instead of using the Dedicated Interconnect in europe-west1 and then internal Google Cloud backbone. All BGP sessions are up, and routes are being exchanged. The on-premises routers are advertising all their subnets. The Cloud Routers are learning the on-premises prefixes. What is the most likely cause of this suboptimal routing?

Refer to the exhibit. A VM in the my-vpc network is unable to reach an external HTTPS server. What is the most likely cause?

An organization is connecting their on-premises data center to GCP using Dedicated Interconnect with multiple VLAN attachments. They have configured Cloud Router with BGP sessions for each VLAN attachment. They notice that traffic from GCP to on-premises is not load-balanced across the attachments; instead, all traffic uses a single link. What is the most likely cause?

A media company uses Cloud CDN with signed URLs to distribute premium video content. They need to revoke access for a specific user immediately. Which approach should they take?

A company has a Shared VPC with a host project and several service projects. They want to allow a service project's Network Engineer to create and manage Cloud Load Balancers, but not modify other networking resources in the shared VPC. Which IAM role should be granted at the service project level?

A company has deployed a Cloud VPN tunnel using route-based VPN (using IKEv2) and has configured BGP on the tunnel. The tunnel is up, but the BGP session is not establishing. What is a likely cause?

A network engineer is troubleshooting an HA VPN setup between Google Cloud and an on-premises data center. The two tunnels are established, and BGP sessions are up on both tunnels. However, traffic from Google Cloud to the on-premises network is only using one tunnel, even though both BGP sessions are advertising the same routes. What is the most likely cause?

A company has two VPCs in the same project: vpc-a (10.0.0.0/8) and vpc-b (10.0.0.0/8). They plan to peer these VPCs using VPC Network Peering. Which two prerequisites are required for the peering to work? (Choose TWO.)

A company wants to allow instances in a VPC without external IPs to access Google APIs like BigQuery and Cloud Storage. Which configuration is required?

An organization wants to connect their on-premises network to Google Cloud using Partner Interconnect. Which of the following is a requirement that must be met before the partner can provision the connection?

A company is migrating on-premises DNS to Google Cloud. They have a hybrid network using Cloud VPN and want to resolve on-premises hostnames from Compute Engine instances without custom scripts. Which service should they use?

You are configuring a Regional Internal HTTP(S) Load Balancer for a service that must only be accessible from within a VPC. The backend is a zonal NEG of Compute Engine instances. The load balancer is not receiving traffic. What is a likely cause?

Your VPC has instances with internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. You need to ensure that DNS resolution works for instances in the same zone using short names (e.g., 'instance1'). Which condition must be met?

A company is planning to connect their on-premises data center to Google Cloud. They require high bandwidth (10 Gbps) and low latency for real-time data replication. They also want a cost-effective solution that supports burstable traffic. Which TWO connectivity options should they consider? (Choose TWO.)

Your company is deploying a multi-tier web application on Google Kubernetes Engine (GKE) with a regional cluster. You need to design network policies to allow traffic only from the frontend pods to the backend pods on port 8080. Which of the following is the most secure and recommended approach?

Which THREE factors should be considered when choosing between a global external HTTP(S) load balancer and a regional external HTTP(S) load balancer? (Choose 3.)

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They require high availability for the connection. Which TWO of the following are recommended by Google for achieving high availability? (Choose two.)

Which TWO are valid methods to allow on-premises traffic to reach Google Cloud resources that only have internal (private) IP addresses? (Choose two.)

A company has a Hybrid Connectivity setup using Cloud VPN with dynamic routing (BGP). They notice that traffic from their on-premises network to Google Cloud is intermittently dropping. The on-premises BGP speaker is sending routes with a higher local preference (200) than the Google Cloud router (default 100). What is the most likely cause of the intermittent drops?

An organization is deploying a Shared VPC with one host project and three service projects. Each service project has multiple VPC networks. They want to ensure that only the host project's network admin can create firewall rules affecting the shared VPC network. Which architecture satisfies this requirement?

An organization has multiple VPCs in Google Cloud that need to communicate with an on-premises network through a single Dedicated Interconnect. All VPCs are in the same project. What is the most efficient way to enable connectivity from all VPCs to on-premises?

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

An engineer is designing a hybrid network with a 10 Gbps Dedicated Interconnect. They require 99.99% availability for the connection. What is the minimum number of VLAN attachments and BGP sessions recommended?

A company uses Shared VPC with a host project and multiple service projects. They want to grant a team in a service project the ability to create and manage firewall rules that apply to the shared VPC's subnets. Which THREE IAM roles or permissions are needed? (Choose three.)

An engineer has multiple projects with overlapping IP ranges. They want to create a single Cloud NAT gateway to provide outbound internet access for instances in two different VPCs that are connected via VPC Network Peering. Is this possible?

A company runs a microservices application on Google Kubernetes Engine (GKE) with an Envoy sidecar proxy for each service. They want to use Traffic Director to apply traffic policies such as traffic splitting between versions and fault injection. Which API does Traffic Director use to configure Envoy proxies?

A company has a hybrid network with on-premises data center connected to Google Cloud via Dedicated Interconnect. They use Private Google Access for on-premises (on-premises hosts use the external IP addresses of Google APIs via the interconnect). However, they notice that traffic to certain Google APIs is being routed via the internet instead of the interconnect. What is a likely cause?

A company is designing a VPC for a multi-tier application. The web tier must be accessible from the internet, the app tier only from the web tier, and the db tier only from the app tier. Which combination of firewall rules is appropriate?

An engineer notices that some packets sent from a Compute Engine VM in GCP to an on-premises server via a VPN tunnel are being fragmented. The on-premises server is not receiving the fragmented packets. What is the most likely cause?

A company is setting up a Dedicated Interconnect connection between their on-premises network and Google Cloud. They have configured a VLAN attachment and assigned a Cloud Router with BGP sessions. They notice that traffic is being dropped intermittently. The BGP session status shows 'Established' but routes are not being exchanged consistently. What is the most likely cause?

An engineer is deploying a Regional External HTTP(S) Load Balancer to serve a web application on Compute Engine. They want to maintain the highest availability by automatically rerouting traffic away from unhealthy instances. Which additional configuration is required?

An engineer is configuring a Global HTTPS Load Balancer with a backend service that points to a serverless NEG for Cloud Functions. The health checks are failing. What is the most likely cause?

A company is using VPC Network Peering between two VPCs. They want to ensure that routes for a specific subnet in VPC A are exported to VPC B. However, VPC B should not export its routes to VPC A. What peering configuration should they set?

Which THREE are true regarding Cloud HA VPN when used with dynamic routing (BGP)? (Choose three.)

A company wants to expose a web application running on Cloud Run globally with a single anycast IP address, using HTTP(S) load balancing and Cloud CDN for static content. The application should be accessible at https://app.example.com. What is the correct configuration?

Refer to the exhibit. A VM in the default VPC with IP 10.0.0.5 is unable to receive traffic from another VM in the same VPC with IP 10.0.1.5. The firewall rule shown is in place. What is the most likely reason?

A network engineer wants to capture all traffic to and from a specific Compute Engine instance for security analysis and forward it to an IDS appliance in another VPC. Which GCP service should they use?

Which statement about Cloud Armor security policies is true?

A company wants to connect their on-premises data center to Google Cloud using a site-to-site VPN with dynamic routing. Which protocol should they use for route exchange?

A company has two Dedicated Interconnects in different metro regions connecting to Google Cloud. They want to use BGP communities to influence Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises. Which community action can they apply on the on-premises routers?

A network engineer wants to test reachability between a Compute Engine instance in VPC A and a Cloud SQL instance in VPC B, which are connected via VPC peering. Which Google Cloud tool should be used to check if firewall rules or routes are blocking traffic?

You need to configure SSL certificates for a Global HTTPS Load Balancer. The certificate should be automatically provisioned and managed by Google. Which type of certificate should you use?

You are designing a hybrid network using Cloud VPN with dynamic routing (BGP) to connect multiple on-premises sites to Google Cloud. What is a best practice to avoid asymmetric routing when you have multiple VPN tunnels from different on-premises routers?

A company uses Packet Mirroring to monitor traffic from a set of VMs. They want to ensure that mirrored traffic does not interfere with the production traffic. Which statement is correct?

An enterprise is planning a Dedicated Interconnect connection to GCP. They require 99.99% availability and expect to use multiple VLAN attachments. What is the minimum number of 10 Gbps links and VLAN attachments needed to meet the availability goal?

A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?

An organization uses Classic VPN with static routing to connect to GCP. They now need to add a new subnet in GCP and ensure on-premises traffic can reach it without manual updates. What should they do?

A network engineer is configuring an HA VPN tunnel pair between an on-premises VPN device and Google Cloud. The engineer wants to use IKEv2 with pre-shared keys. After configuring both ends, the tunnels do not come up. The engineer sees 'IKE SA negotiation failed - no proposal chosen' in the logs. What is the most likely cause?

A company needs to connect on-premises to GCP using Dedicated Interconnect with a 10 Gbps link, and they require high availability. They plan to use a single VLAN attachment. What is the best design?

A company is designing a VPC routing strategy. Which three are valid route types in Google Cloud VPC? (Choose three.)

You need to migrate traffic gradually from an old version of a microservice to a new version using Traffic Director. You want to send 10% of traffic to the new version and 90% to the old version. Which configuration should you use?

A company is using Partner Interconnect to connect their data center to Google Cloud. They notice that traffic from their on-premises network to a specific subnet in VPC is taking a suboptimal path. Which action should they take to influence the routing preference?

A network engineer needs to verify that traffic from a specific Compute Engine instance can reach a Cloud SQL database in a different VPC. Which Google Cloud tool should be used to test this reachability?

Which of the following is a benefit of using Shared VPC?

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

A gaming company uses Cloud Armor with an external HTTP(S) load balancer to protect against DDoS attacks. They need to restrict access to the load balancer based on geographic region. What should they configure?

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

A company is deploying a Global Cloud VPN with multiple tunnels from different Cloud Router instances to the same on-premises peer. The on-premises BGP speaker is configured with multiple peers. How should they configure the BGP ASN on the Cloud Routers to ensure optimal routing?

An organization has a Dedicated Interconnect with Cloud Router configured for BGP. The on-premises network advertises a prefix that overlaps with an existing VPC subnet. How does Google Cloud handle the overlapping prefix?

What is the purpose of a Response Policy Zone (RPZ) in Cloud DNS?

A company has multiple VPCs in different projects and wants to connect them all to a single on-premises data center using a hub-and-spoke model with Network Connectivity Center (NCC). Which THREE components are required for this setup?

A company has a VPC with a subnet in us-central1. They have several private Compute Engine instances (no external IP) that need to download updates from a public repository on the internet. The network engineer has created a Cloud NAT gateway in the same region and attached it to the subnet. However, the instances still cannot reach the internet. The engineer has confirmed that the Cloud NAT gateway is correctly configured and that the subnet's Private Google Access is not relevant for this traffic. What should the engineer check first to resolve the issue?

An organization has a hybrid network with multiple VPN tunnels connecting their on-premises network to Google Cloud. They use Cloud Router with BGP to propagate routes. They recently added a new subnet 192.168.100.0/24 in Google Cloud. On-premises devices can reach resources in the new subnet, but Google Cloud resources cannot initiate traffic to certain on-premises hosts in the 10.0.0.0/8 subnet. BGP sessions are all established. What is the most likely cause?

A company is deploying a multi-tier application on Google Cloud. The frontend tier runs in a managed instance group behind a global external HTTP(S) load balancer. The backend tier runs on Compute Engine instances in a different VPC subnet. The frontend instances must communicate with the backend instances using internal IP addresses only. Which configuration should the network engineer use?

An engineer runs the command above to check the status of a Dedicated Interconnect VLAN attachment. The state shows DEFECTIVE. The associated interconnect connection is in ACTIVE state. What is the most likely cause?

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

Which load balancer type preserves the client source IP address and can be used for TCP/UDP traffic on a specific port, passing traffic through to backend instances without proxy overhead?

A company with multiple VPCs in a Shared VPC environment wants to connect their on-premises network to all VPCs with high availability and minimal cost. They already have a Dedicated Interconnect. What is the most efficient solution?

A company is planning a hybrid cloud connectivity strategy with Google Cloud. They need high bandwidth (10 Gbps) and low latency. They also want to avoid internet transit. Which TWO connectivity options meet these requirements? (Choose 2.)

A company wants to serve private content from Cloud CDN using signed URLs that expire after 1 hour. Which steps are required to enable this?

An organization needs to deploy a multi-tier web application on Compute Engine. The web tier must be accessible from the internet, while the database tier must only be accessible from the web tier. The security team requires a defense-in-depth approach. Which THREE measures should be implemented? (Choose three.)

A financial services firm needs to connect their on-premises data center to Google Cloud VPC with 50 Gbps of bandwidth and latency under 5 ms. They are in a metropolitan area with a Google Cloud region. They require an SLA of 99.99% and need to support VLAN attachments to multiple VPCs. Which connectivity option should they choose?

A company has two Dedicated Interconnect connections in different metro areas to meet the 99.99% SLA. They want to ensure that traffic uses both connections in an active-active manner. Which three configurations are required? (Choose three.)

A large enterprise is migrating to Google Cloud and needs to establish connectivity between on-premises and VPCs in two different regions (us-east1 and europe-west1). They have a single Partner Interconnect connection at a co-location facility in New York. They want to use the same interconnect for both regions. Which configuration should they use?

A company has set up an HA VPN tunnel between their on-premises router and a Cloud Router in Google Cloud. The on-premises router establishes BGP sessions to both Cloud Router instances, but the routes learned from one Cloud Router instance are not being received. The other instance works fine. What is the most likely cause?

An organization has multiple GCP projects that need to share a common network infrastructure. They want to centralize network administration in a single project while allowing service projects to create their own resources in shared subnets. Which networking approach should they use?

A company uses Cloud DNS with a managed zone for 'example.com'. They want to implement a failover routing policy so that if the primary health check fails, traffic is sent to a secondary IP. Which THREE resources need to be configured? (Choose three.)

A company is planning a hybrid connectivity setup using HA VPN. They want to ensure high availability by using two Cloud VPN gateways. How many tunnels and external IP addresses are required for the HA VPN to achieve 99.99% SLA?

A network engineer is troubleshooting a VPN tunnel that is up but not passing traffic. The Cloud Router shows that BGP sessions are established, but routes are not being exchanged. Which two should the engineer check? (Choose two.)

Refer to the exhibit. What is the purpose of the --enable-private-ip-google-access flag?

Refer to the exhibit. An engineer is troubleshooting a dual-tunnel HA VPN. The BGP session on one interface is established (State/PfxRcd 1) but the other is stuck in Active state. What can cause this?

What is the default MTU for Compute Engine virtual machines?

A company wants to publish a service running on Compute Engine instances in their VPC so that consumers in other VPCs can access it via private IPs without needing VPC peering. Which service should they use?

A company is using Cloud VPN to connect to Google Cloud. They notice that traffic from their on-premises network to Google Cloud is not being routed correctly after a recent change. On the on-premises router, they verify that the BGP session is established and routes are received. Which step should they take next to troubleshoot?

An engineer notices that VPC Flow Logs are enabling on a subnet but only a fraction of traffic is logged. What is the most likely cause?

You need to create a serverless Network Endpoint Group (NEG) to attach to a Global HTTPS Load Balancer backend for a Cloud Run service. Which command should you use?

Which THREE components are part of a typical Cloud Hybrid Networking architecture?

A network engineer is configuring a route-based VPN tunnel between an on-premises network and Google Cloud using Cloud VPN. Which two statements are true about route-based VPN compared to policy-based VPN? (Choose two.)

A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?

A network engineer wants to restrict access to a Cloud Storage bucket from only a specific set of Compute Engine instances in a VPC. The instances have no external IPs. What is the most effective way to enforce this restriction?

An organization wants to connect its on-premises data center to Google Cloud using Dedicated Interconnect. They require 99.99% availability SLA. Which configuration meets this requirement?

Which VPC type allows you to specify custom IP ranges and regions for subnets during creation, and does not automatically create subnets in every region?

A company wants to reduce egress costs for traffic going to Google APIs (e.g., Cloud Storage, BigQuery) from Compute Engine instances. Which configuration should they use?

An organization needs to monitor and analyze firewall rule activity for security auditing. Which TWO actions should they take? (Choose TWO.)

An organization wants to serve private content via Cloud CDN, ensuring that only authorized users can access cached objects. They need to generate time-limited access for specific URLs. Which method should they use?

Which Google Cloud service allows you to create a hub-and-spoke topology for connecting on-premises networks and VPCs?

What is the maximum number of VLAN attachments that can be configured on a single 10 Gbps Dedicated Interconnect connection?

A company needs to connect three VPC networks in separate projects (two in the same organization, one in a different organization) to each other for private IP communication. Which TWO GCP solutions should they consider? (Choose 2.)

A company wants to connect two VPCs in the same project using VPC Network Peering. Each VPC has non-overlapping subnets. What is the minimum number of peering connections required to enable full bidirectional communication?

A company has a VPC with a subnet in us-central1 (10.0.0.0/16) and a Cloud VPN tunnel to an on-premises network (192.168.0.0/16). They also have a static route for 0.0.0.0/0 internet gateway. On-premises traffic to 10.0.0.0/16 is working. However, traffic from a GCE instance in the VPC to an on-premises IP 192.168.1.10 is timing out. What is the most likely cause?

An engineer needs to monitor the operational status of a Dedicated Interconnect link. Which Cloud Monitoring metric should they use?

A company wants to use BGP AS path prepending to influence traffic from Google Cloud to their on-premises network. They have two Dedicated Interconnect connections. Where should they configure the AS path prepending?

Refer to the exhibit. A network engineer is unable to SSH to instance-1 using IAP TCP forwarding. What is the most likely reason?

A company wants to optimize costs for egress traffic from Compute Engine instances to the internet. They are considering using Cloud CDN and Private Google Access. Which TWO statements correctly describe how these services can reduce egress costs?

A company wants to expose a web application running on Cloud Run globally with the lowest latency and automatic SSL termination. Which load balancer should they use?

An engineer configures a Global HTTPS Load Balancer with a backend service pointing to an instance group. The health check is set to HTTP on port 80, check interval 5s, timeout 5s, healthy threshold 1, unhealthy threshold 1. After deployment, instances are marked unhealthy despite the application responding correctly on port 80. What is the most likely cause?

Your company has a VPC with two subnets: 10.0.1.0/24 in us-central1 and 10.0.2.0/24 in us-east1. They have a Cloud VPN tunnel to the on-premises data center using dynamic routing (BGP). The Cloud Router was created in the us-central1 region with default settings. On-premises hosts can successfully communicate with instances in the 10.0.1.0/24 subnet, but cannot reach instances in the 10.0.2.0/24 subnet. All instances have appropriate firewall rules allowing traffic from on-premises. The BGP session is established and routes from on-premises are received in Cloud Router. What is the most likely reason for the issue?

A developer wants to SSH into a Compute Engine instance that has no public IP. Which service should they use?

A company has two VPCs connected via VPC Network Peering. Traffic from an instance in VPC A to an instance in VPC B is failing. Connectivity Tests show that the expected route exists and firewall rules allow the traffic. What is a possible cause?

A network engineer is designing a VPC with custom subnet mode. They need to allocate IP addresses for three tiers: web (100 instances), app (200 instances), and db (50 instances). The VPC will be in the us-central1 region. Which subnet plan is most cost-effective and scalable?

A company wants to set up a Regional Internal HTTP(S) Load Balancer to serve an internal web application. Which two components are required? (Choose two.)

A company wants to migrate a legacy application to Google Cloud that requires low-latency communication with on-premises databases. The application is latency-sensitive and must use private IP addresses only. Which hybrid connectivity solution should they choose?

Refer to the exhibit. Users report that HTTP (port 80) traffic is still reaching instances in my-vpc despite the deny-all rule. What is the most likely reason?

A network engineer is configuring HA VPN between GCP and an on-premises network. They need to ensure that the VPN tunnels are established and BGP sessions are up. Which THREE steps are required? (Choose 3.)

You are configuring a Global External HTTPS Load Balancer. Which TWO components are required to route traffic to a Cloud Run service via a serverless NEG? (Select two.)

A company wants to connect two VPC networks using VPC Network Peering. What is required for this setup?

A company has a GKE cluster that needs to be accessed by pods and services. The cluster is deployed in a VPC with a primary subnet 10.0.0.0/16. To avoid IP exhaustion, they want to use separate IP ranges for pods and services. Which approach should they take?

An engineer needs to create a firewall rule that applies only to instances with the tag 'web-server' in a specific VPC network. The rule should allow ingress from any source on TCP port 80. Which combination of fields must be set in the gcloud command?

A company wants to connect an on-premises network to Google Cloud using Cloud VPN. The on-premises network has a single subnet and no dynamic routing capabilities. The company needs a simple, low-cost solution. Which VPN configuration should they choose?

A company wants to serve global static content from a Cloud Storage bucket. They need low latency worldwide and SSL termination at the edge. Which solution should they choose?

A company uses a Global HTTPS Load Balancer with Cloud CDN. They need to purge specific cached objects for all users immediately after a content update. Which method should they use?

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have ordered a circuit from a telecom provider and need to complete the setup. Which of the following steps is required during the provisioning process?

An organization wants to distribute incoming HTTPS traffic across a set of Compute Engine instances in multiple regions, with SSL termination at the Google Cloud edge. They also need to protect against DDoS attacks at the edge. Which load balancing solution should they choose?

A company uses Cloud VPN tunnels to connect multiple sites to Google Cloud. They have a primary and a backup tunnel for redundancy, each with a different Cloud Router (both in the same region). BGP sessions are established on both routers. The network team notices that during a failover test, traffic fails over to the backup tunnel but then after 30 seconds, the backup tunnel traffic stops and does not recover until the primary tunnel comes back. The engineer finds that the backup Cloud Router is advertising the same routes as the primary, but the backup tunnel's BGP session shows that the routes are being withdrawn after 30 seconds. Additionally, the BGP session remains established. What is the most likely cause?

Which TWO of the following are valid use cases for Cloud IDS? (Choose TWO)

An organization is setting up a Dedicated Interconnect and wants to monitor the health and performance of the connection using Cloud Monitoring. Which THREE metrics are available for Dedicated Interconnect?

An engineer needs to configure a Compute Engine instance as a network appliance that routes traffic between two subnets within the same VPC. The instance must handle traffic for both subnets. Which TWO actions are required? (Choose TWO.)

An engineer needs to allow HTTP health checks from the Google Cloud health checker IP ranges to a set of instances. Which two methods can be used to target the firewall rule correctly? (Choose two.)

An organization uses Partner Interconnect to connect their on-premises network to Google Cloud. They are experiencing intermittent connectivity issues and suspect the partner service provider is causing the problem. Which Google Cloud tool or feature can help verify the connection status and performance from the Google Cloud side?

A company uses a VPC with two subnets: subnet-a (10.0.1.0/24) with VMs tagged 'web', and subnet-b (10.0.2.0/24) with VMs tagged 'db'. They have a Cloud VPN tunnel to an on-premises network (172.16.0.0/16). The VPN tunnel is up and BGP is exchanging routes. A custom route for 172.16.0.0/16 with next hop VPN gateway exists, but it has a tag 'web', meaning it applies only to VMs with the 'web' tag. VMs in subnet-a can reach on-premises, but VMs in subnet-b cannot. Which step should be taken to allow subnet-b VMs to reach on-premises?

A company has a VPC with a Cloud Router using BGP to advertise prefixes to an on-premises network. The BGP session keeps flapping. What is a likely cause?

A company needs to resolve on-premises DNS names from Google Cloud VMs. They want to forward DNS queries for a specific domain (example.corp) to an on-premises DNS server. Which Cloud DNS feature should they use?

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

A company wants to audit firewall rules for security best practices. They need to identify overly permissive rules (e.g., allowing all traffic from 0.0.0.0/0) and rules that are never used. Which two Google Cloud tools can help? (Choose two.)

Your company runs a multi-tier web application on Google Cloud. The frontend is in us-central1 (3 instances behind an external HTTP(S) Load Balancer), the backend is in us-west1 (3 instances behind an internal TCP/UDP Load Balancer). The frontend instances are in a managed instance group (MIG) with autoscaling based on CPU utilization. Recently, you noticed that during traffic spikes, the frontend instances' CPU utilization remains low, but the backend instances' CPU utilization spikes to 90% and causes timeouts. The application uses a synchronous REST API; the frontend instances make requests to the internal load balancer's IP. What should you do to resolve the backend scaling issue?

You need to route traffic to different backend services based on the URL path: /api/* goes to a Cloud Run service, /static/* goes to a Cloud Storage bucket, and /* goes to a Compute Engine instance group. Which component of the Global HTTPS Load Balancer should you configure?

A company is using Cloud NAT to provide outbound internet access for instances without external IPs. They notice that the NAT gateway is running out of ports for connections to a single external IP address. To minimize port exhaustion, what should the engineer configure?

A company uses Dedicated Interconnect to connect their on-premises data center to Google Cloud. They have enabled Private Google Access on the VPC subnet to allow on-premises hosts to access Google APIs via private IPs over the interconnect. Performance tests show that throughput to Google APIs is lower than expected, and the interconnect link utilization is below 30%. What should they do to improve throughput?

A company is using a Global SSL Proxy Load Balancer to terminate SSL and forward traffic to a backend service on Compute Engine. They need to preserve the client IP address in the backend logs. What should they do?

Refer to the exhibit. What is the purpose of the IP address 169.254.0.1 assigned to the Cloud Router interface?

An engineer is configuring a Google Compute Engine instance that needs to send traffic to the internet. The instance has no external IP address. Which service must be configured to allow this outbound connectivity?

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

A company uses Cloud Armor with WAF rules to protect an HTTPS load balancer. They notice that legitimate traffic from certain IPs is being blocked. How should they troubleshoot?

Which TWO of the following are valid methods to restrict access to a Compute Engine VM that has no external IP?

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

A company is connecting their on-premises network to GCP via Cloud Interconnect with VLAN attachments and BGP sessions. They want to prefer one attachment over the other for traffic to a specific prefix. Which BGP attribute should they use?

An organization needs to serve a TCP-based application globally with low latency but without SSL termination. Which load balancer should they use?

A company is planning to migrate their on-premises application to Google Cloud. The application requires consistent high bandwidth and low latency to on-premises databases. They have a Dedicated Interconnect connection with a 10 Gbps link. To improve availability, they decide to add a second Interconnect connection. Which of the following is a best practice for configuring BGP sessions?

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

Which three of the following are best practices for designing a highly available Dedicated Interconnect connection to Google Cloud? (Choose three.)

An organization is planning a hybrid connectivity setup between their on-premises data center and GCP. They require a 99.99% SLA and want to use a single physical connection at 10 Gbps. Which connectivity option should they choose?

Which TWO network services are required to enable private Google access for on-premises hosts using a Dedicated Interconnect connection? (Choose two.)

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Refer to the exhibit. A user within the perimeter project '111111111111' tries to access BigQuery from a VM that has an external IP address. The request is denied. What is the most likely reason?

What is the internal DNS name format for a Compute Engine instance named 'web-server' in the 'us-central1-a' zone within the project 'my-project'?

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

A company is migrating to Google Cloud and needs to connect their on-premises data center to a VPC using Cloud VPN with dynamic routing (BGP). They want high availability and automatic failover. Which THREE components are required? (Choose THREE.)

An engineer has configured a firewall rule with priority 1000 that allows ingress traffic on TCP port 443 from source IP range 10.0.0.0/8. Another rule with priority 500 denies ingress on TCP port 443 from source IP 10.0.1.0/24. What will happen to traffic from 10.0.1.5 destined to the instance on port 443?

A company has set up a Cloud VPN with dynamic routing (BGP) between their on-premises network (AS 65001) and Google Cloud (AS 64514). They are using Cloud Router with a regional dynamic routing mode. The on-premises router is advertising a subnet 10.1.0.0/16. The Google Cloud VPC has subnet 10.2.0.0/16 in the same region as the Cloud Router. Both subnets are unique. The connection has been working for months. However, after a recent maintenance window, the on-premises router started experiencing BGP flapping with the Cloud Router. The Cloud Router logs show 'BGP notification sent: Hold timer expired'. The on-premises router logs show similar errors. The network team has verified that the VPN tunnel is established and stable. What is the most likely cause of the BGP flapping?

A company is experiencing packet loss between two Compute Engine instances in different zones within the same region. They suspect MTU issues. Which three actions should they take to diagnose and resolve? (Choose three.)

An organization runs a stateful TCP application on a group of Compute Engine instances in us-central1. Clients must connect to the service using a single anycast IP address, and the load balancer must preserve the client source IP address. Which load balancing option meets these requirements?

A company uses hierarchical firewall policies at the organization level. They need to allow SSH (TCP 22) access from a specific range 10.0.0.0/8 to all VMs, but a child folder has a policy that denies all ingress traffic. Which rule priority ordering ensures SSH access is allowed?

A network engineer needs to ensure that Compute Engine instances without external IP addresses can access Google APIs such as BigQuery and Cloud Storage. Which feature should be enabled on the subnet where the instances reside?

You are setting up Partner Interconnect with a service provider that offers both Layer 2 and Layer 3 options. Your on-premises network uses BGP to exchange routes. Which THREE statements are true about the connectivity types? (Choose three.)

A network engineer is troubleshooting BGP session flaps between a Cloud Router and an on-premises router. The Cloud Router logs show that the session goes down and up repeatedly every few minutes. What is the most common cause of such flapping?

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

A company has deployed a Cloud Armor security policy with the following rules: Rule 1: allow from IP range 10.0.0.0/8 (priority 1000); Rule 2: deny from all (priority 2000). What will be the action for traffic from IP 10.1.1.1?

A small company has a single VPC with one subnet in us-central1 (10.0.1.0/24). They have a Compute Engine instance that needs to be reachable from the internet via HTTP (port 80) and HTTPS (port 443). The instance has an external IP address (ephemeral). They have created firewall rules allowing ingress on TCP 80 and 443 from 0.0.0.0/0, with target tags 'web-server'. The instance has been assigned the tag 'web-server'. However, external users report that they cannot access the instance's public IP on either port. The instance's OS firewall (iptables) is default allow. What is the most likely cause?

Which TWO of the following are required when setting up an internal TCP/UDP load balancer (ILB) in a shared VPC environment?

A company wants to use Cloud CDN to accelerate content delivery globally. Which TWO of the following are valid cache key components that can be configured in Cloud CDN? (Choose 2)

An engineer has set up a Dedicated Interconnect with a VLAN attachment and a Cloud Router BGP session. They can ping the on-premises gateway IP but cannot reach an on-premises subnet 10.0.0.0/24 from a GCE instance. The on-premises router is advertising the subnet via BGP. What is the most likely cause?

Which TWO of the following are valid reasons to use a Shared VPC architecture?

A company hosts a web application on Cloud Run and wants to serve content from a Cloud Storage bucket for static assets. They plan to use a global HTTPS load balancer with a URL map to route requests. Which backend type should they configure for the static content?

A company uses an external HTTP Load Balancer with Cloud Armor. They want to log all requests that are blocked by Cloud Armor security policies for compliance auditing. What should they enable?

A company has deployed Dedicated Interconnect with a 10 Gbps connection. They are experiencing packet loss when transferring large files. The on-premises MTU is set to 1500. What is the maximum MTU that can be set on the Cloud Router interface to avoid fragmentation?

A company is deploying Cloud DNS to enable on-premises resources to resolve Google Cloud private zone names. Which TWO resources are required for this setup?

An organization needs to prevent exfiltration of data from a Cloud Storage bucket to external IPs. The bucket is accessed by Compute Engine instances in a VPC. The instances need to read and write data to the bucket but should not be able to copy data to external networks. Which combination of controls meets this requirement?

An engineer is planning IP address ranges for two VPCs that will be connected via VPC peering. One VPC uses 10.1.0.0/16 and the other uses 10.2.0.0/16. They also plan to use HA VPN to an on-premises network using 10.0.0.0/8. Which IP range assignment could cause a conflict?

A company has deployed an HA VPN gateway in Google Cloud to connect to their on-premises network. They have configured two tunnels with IKEv2 and BGP. One tunnel is established, but the second tunnel is not coming up. What could be a likely cause?

A company wants to expose a web application running on Cloud Run to the internet with a single global IP address, SSL termination, and Cloud CDN. Which load balancer should they use?

A company uses Traffic Director with Envoy proxies to manage east-west traffic. They want to implement fault injection to test the resilience of their service mesh. Which TWO types of faults can they inject? (Choose two.)

An organization has a Shared VPC with several service projects. They want to restrict which service projects can create firewall rules in the host project. What should they do?

A company wants to publish a custom internal service running in their VPC so that consumers in other VPCs can access it using private IP addresses. Which service should they use?

An engineer needs to set up DNS resolution for on-premises resources from Google Cloud. They want to resolve a custom domain (e.g., corp.example.com) using on-premises DNS servers. Which Cloud DNS feature should they use?

A company wants to restrict access to Google Cloud APIs from a specific VPC network so that only the Google APIs listed in the VPC Service Controls perimeter can be accessed. Which configuration should be used?

An organization configures a Global external HTTP(S) Load Balancer with Cloud CDN. They notice that some users are getting stale content even after they have invalidated the cache for specific objects. What is the most likely reason?

A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?

You are using Cloud CDN with a backend bucket and want to cache all responses regardless of Cache-Control headers. Which cache mode should you set?

A company wants to use HA VPN with route-based VPN. Which VPN configuration option must be enabled?

Which THREE of the following are required to use Private Google Access for on-premises hosts through a Cloud VPN or Interconnect? (Choose THREE)

Which THREE components are required to set up a Cloud VPN with dynamic routing (BGP) between an on-premises network and Google Cloud?

An organization wants to migrate legacy on-premises applications to Google Cloud but must maintain low-latency connectivity for real-time data synchronization. The on-premises data center is in a colocation facility that is not directly served by Google Cloud. Which hybrid connectivity option is most cost-effective while meeting the latency requirement?

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

You are configuring an HA VPN tunnel between GCP and on-premises. The on-premises VPN device only supports IKEv1 and static routing. Which of the following is true regarding this setup?

An engineer is troubleshooting high latency between a Compute Engine instance in us-central1 and an instance in europe-west1. Which tool can show per-region latency and packet loss?

A customer has established a Dedicated Interconnect, but traffic from on-premises to Google Cloud is still using the internet path instead of the interconnect. What is the most likely cause?

A startup wants to minimize costs for their development VPC. They have a few VMs that need occasional internet access for updates. What is the most cost-effective approach?

You need to create a load balancer that distributes traffic across Compute Engine instances in multiple regions for a TCP application without SSL offload. The clients should connect to a single anycast IP. Which load balancer should you use?

A company uses Cloud DNS private zones for their internal network. They have multiple projects and want to resolve DNS names from one project's private zone in another project. Which feature should they use?

A network engineer notices asymmetric routing between two VPCs connected via VPC peering. Traffic from VPC A to VPC B flows correctly, but return traffic from VPC B to VPC A drops. What is the most likely cause?

An organization wants to enforce that only instances with specific service accounts can be accessed via SSH (TCP 22) from the internet. Which two attributes should be used in the firewall rule to achieve this? (Choose two.)

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth up to 10 Gbps. Which connectivity option should they choose?

An engineer is troubleshooting a VPC Network Peering connection between two VPCs. The peering is established, but traffic from VPC A to VPC B is not reaching a specific subnet. Both VPCs have custom routes. What is the most likely cause?

A financial services company needs to audit all VPC firewall rule changes in real time. They want to receive notifications whenever a rule is created, modified, or deleted. What is the most efficient way to achieve this?

An organization has a VPC with multiple subnets and Cloud NAT configured for outbound internet access. They need to analyze which instances are using the most egress bandwidth to optimize costs. Which approach is most effective?

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

A company needs to load balance TCP traffic without SSL termination for a gaming application where client IP preservation is critical. The backend is a group of Compute Engine instances. Which load balancer types meet these requirements? (Choose TWO.)

A company wants to expose a globally distributed application using Cloud Run via a single anycast IP address, with SSL termination and content-based routing to different backend services. Which load balancer should they use?

Match each Google Cloud Armor feature to its description.

What is the default MTU for Compute Engine instances on Google Cloud?

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Which Network Intelligence Center tool provides a visual representation of your VPC network, including instances, subnets, firewall rules, and routes?

A company has a VPC with a subnet in us-central1. They launched a Compute Engine instance named "app-server" in that subnet without an external IP. They need the instance to be able to download updates from the internet. Which two steps must be taken?

A company has deployed an external HTTPS load balancer with a Cloud CDN backend. The load balancer uses a managed SSL certificate. Recently, the company updated their DNS record to point to a different IP address of a new load balancer. After the change, some users are still being served from the old load balancer's cache. The network engineer has confirmed that the DNS TTL has expired. What is the most likely cause of this issue?

A company has an on-premises data center connected to GCP via Cloud VPN with dynamic routing (BGP). Recently, connectivity to a specific subnet (10.1.0.0/16) in GCP became intermittent. The VPN tunnel is up, and BGP sessions are established. What is the most likely cause?

A company wants to resolve DNS queries from their on-premises network for a privately hosted zone in Google Cloud (e.g., example.internal). They also want on-premises DNS servers to resolve GCP internal VM hostnames. Which two Cloud DNS features should they implement? (Choose TWO.)

A company is designing a hybrid network with Partner Interconnect. They need to ensure high availability and meet a 99.99% SLA. Which TWO actions should they take?

A company has a VPC with subnets in us-east1 and us-west1. They have established a Cloud VPN tunnel to their on-premises network through a Cloud Router in us-east1. They want to ensure that traffic from on-premises to resources in us-west1 uses the VPN tunnel and not the public internet. What must be configured?

A company wants to use Cloud DNS to distribute traffic across multiple regional endpoints with failover: primary in us-central1, secondary in us-west1. If the primary health check fails, traffic should go to secondary. Which routing policy should they use?

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

An organization is migrating a legacy application to GCP. The application requires static routing and does not support BGP. Which VPN option should they use?

Which THREE of the following are valid use cases for VPC Service Controls?

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

A company wants to enable mTLS between microservices in a service mesh managed by Traffic Director. They have deployed Envoy sidecars. What must be configured to enforce mTLS?

A company has a VPC with subnets in us-central1 and europe-west1. They want to deploy a Cloud NAT to allow VMs in both regions to access the internet. How many Cloud NAT gateways are needed?

An organization is experiencing high latency on their Partner Interconnect connection. Which TWO tools or features can they use to diagnose the issue from within Google Cloud? (Choose two.)

A company needs to connect multiple VPCs in different projects and regions to a common hub VPC for centralized inspection. They want to avoid complex mesh peering configurations. Which service should they use?

A company has a VPC with subnets in us-east1 and europe-west1. They need low-latency communication between instances in these regions using private IPs only. Which solution should they use?

Based on the exhibit, what is the purpose of Cloud Router's BGP configuration?

A company uses Traffic Director with Envoy sidecars. They want to implement traffic splitting to gradually migrate traffic from version v1 to v2 of a service. Which TWO resources must be configured? (Select two.)

Refer to the exhibit. A network engineer configured a Cloud Router to advertise the on-premises subnet 10.0.0.0/8 to the VPC. However, traffic from VPC instances to 10.0.0.0/8 is being dropped. What is the most likely issue?

A company wants to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have ordered a 10 Gbps connection and plan to use a single VLAN attachment. How many Cloud Router interfaces are required for a single VLAN attachment with active/active BGP?

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between services. Which configuration must be enabled?

An organization is designing IP address planning for hybrid connectivity. They have three VPCs (Prod, Dev, Test) that will be peered with each other and also connected to an on-premises network via Cloud VPN. Which practice should they follow to avoid IP address overlap?

A company has a VPC with multiple subnets and uses Cloud VPN tunnels to connect to on-premises. They want to ensure that only traffic destined for on-premises is sent through the VPN tunnels; all other traffic should use the internet. Which route configuration should they implement?

A network engineer needs to design a VPC network for a global application that will have Compute Engine instances in multiple regions. The instances need to communicate with each other using internal IP addresses. What is the simplest way to enable this communication?

You are deploying a third-party network appliance (e.g., firewall) in a GCP VPC. The appliance requires multiple network interfaces for traffic isolation. You create a VM with three NICs in different subnets. What is a key consideration for routing traffic through the appliance?

An organization has two Dedicated Interconnect connections in an active-passive configuration. They want to make the passive connection active for maintenance. What should they do to fail over traffic?

A network engineer is setting up a HA VPN between GCP and an on-premises network. They want to use route-based VPN with dynamic routing. Which two resources must be created together to form a functional HA VPN tunnel?

A customer is configuring a route-based IPsec VPN tunnel to Google Cloud. On their on-premises router, they must specify traffic selectors (proxy IDs). What should they set the local and remote traffic selectors to?

A company wants to connect two VPCs in different GCP projects so that they can exchange traffic using internal IP addresses. They do not need centralized management or transitive routing between the VPCs. Which GCP networking feature should they use?

A company uses Cloud NAT with a static NAT IP address. They notice that connections from their instances are failing after a few minutes. What is the most likely cause?

A global company has multiple on-premises data centers connected to Google Cloud via separate Dedicated Interconnects. Each on-premises site advertises the same IP prefix for a critical application. They want to ensure that traffic from Google Cloud to that prefix is load-balanced across the two interconnects and also provide automatic failover. Which configuration on Cloud Router meets this requirement?

A company wants to establish a VPC peering connection between two VPCs in different projects. Which two steps are mandatory to create the peering connection?

An organization needs to connect three GCP VPCs (VPC-A, VPC-B, VPC-C) so that all VPCs can communicate with each other. They want a solution that is transitive and does not require full mesh peering. Which TWO approaches meet these requirements?

A company is setting up HA VPN to connect an on-premises network to a single GCP region. They want to achieve 99.99% SLA. Which three steps are required? (Choose THREE.)

An organization has a project with multiple VPCs. They need to know the maximum number of firewall rules allowed per VPC. Where should they look?

A company has deployed a web application behind an External HTTP(S) Load Balancer with Cloud Armor. They want to restrict access to a specific URL path /admin to only users from a specific IP range (198.51.100.0/24). The engineer creates a Cloud Armor security policy with two rules: Rule 1 (priority 1000) with match expression "request.path == '/admin' && inIpRange(source.ip, '198.51.100.0/24')" and action "allow". Rule 2 (priority 2147483647) with match "request.path == '/admin'" and action "deny". After testing, users from the allowed IP range receive a 403 error when accessing /admin. The Cloud Armor logs show that the request was denied. The engineer confirms that the policy is attached to the backend service and that the source IP in the logs matches the allowed range. What is the most likely cause of the denial?

Refer to the exhibit. A Cloud Armor security policy with the shown rules is applied to an HTTPS load balancer. Users from IP 10.0.1.1 are reporting they cannot access the website. What is the issue?

A network engineer needs to design a DNS architecture for a hybrid cloud environment. The requirements: on-premises hosts must resolve GCP private zone names, and GCP instances must resolve on-premises DNS names. Which TWO Cloud DNS features should they use?

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

Which TWO of the following are valid methods to reduce latency between users in Europe and a GCP-hosted application?

You are designing a global web application that uses Cloud Run for the backend and Cloud Storage for static assets. You need to serve content securely over HTTPS with a custom domain, using Cloud CDN for caching. Which resources must be created or configured? (Choose three.)

A company has two HA VPN tunnels between GCP and on-premises. They want to use both tunnels simultaneously for load balancing traffic. Which BGP feature should they configure on the Cloud Router to achieve equal-cost multipath (ECMP)?

An organization has multiple VPCs in the same project. They want to apply consistent firewall rules to all VPCs at the project level. What is the most efficient way to achieve this?

A company wants to prevent data exfiltration from a Google Cloud Storage bucket that contains sensitive data. They plan to use VPC Service Controls. Which two steps are necessary to implement this? (Choose two.)

A company uses Shared VPC with a host project and several service projects. They want to allow only a specific team to create subnets in the host project, and another team to use those subnets in their service projects. Which IAM roles should be assigned?

A company has two VPCs in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). They want to allow SSH from VPC-A to instances in VPC-B. The network admin creates a firewall rule with source range 10.0.0.0/16 and protocol tcp:22, but connectivity fails. What is the most likely cause?

Refer to the exhibit. A request arrives with User-Agent 'GoodBot' and path '/admin'. What action does Cloud Armor take?

An organization has a global web application deployed behind an External HTTPS Load Balancer. They want to reduce egress costs for users in Europe who are served from the same region. The application is already using Cloud CDN. Which additional action will MOST effectively reduce egress costs for these users?

A company has deployed a Global External Application Load Balancer with Premium Tier and enables Cloud CDN. Users in Europe report high latency, while users in the US have good performance. The backend is a regional NEG in us-west1. What is the most likely cause?

Refer to the exhibit. A Cloud VPN tunnel is configured between an on-premises router and Google Cloud. The BGP session is not established. The on-premises router shows 'Connection refused'. What is the most likely cause?

A company has a VPC that is connected to an on-premises network via a Cloud VPN tunnel using dynamic routing (BGP). They have set up a Cloud Router with an advertised IP range of 10.0.0.0/8. The on-premises network advertises 172.16.0.0/12. They also have a custom static route in the VPC for 10.0.0.0/8 that points to a next-hop VPN tunnel (the same tunnel) with priority 100. Recently, they added a new subnet 10.1.0.0/24 in the VPC. Traffic from on-premises to 10.1.0.0/24 is not working. Which THREE steps should they take to troubleshoot and resolve the issue? (Choose 3.)

A company has a GKE cluster with pods and services that need IP addresses. They want to plan IP address space to avoid overlapping with on-premises networks. Which GCP feature allows reserving separate IP ranges for GKE pods and services?

Refer to the exhibit. Instances in subnet-b cannot access the internet through Cloud NAT. What is the most likely reason?

A company needs to connect multiple on-premises sites and multiple GCP VPCs in a hub-and-spoke topology using Google Cloud. Which service provides a centralized hub for managing such connectivity?

An engineer creates a Cloud NAT configuration as shown in the exhibit. The test-instance is created without an external IP address. However, the instance cannot reach the internet. What is the most likely cause?

A company has a GKE cluster with pods and services that need to communicate with on-premises resources over a VPN. The on-premises firewall requires the source IP of the pods to be from a specific range. Which secondary IP ranges should be configured on the VPC subnet?

Your company has a Dedicated Interconnect between on-premises and Google Cloud. After a maintenance window, some routes are missing from the on-premises side. On the Cloud Router, you see that the BGP session status is 'ESTABLISHED'. However, the route table on the on-premises router does not contain any of the VPC subnets. What is the most likely cause?

A multinational company has a Shared VPC environment with multiple service projects. They need to allow a specific service project to use its own Cloud DNS private zone that resolves to internal IPs in the Shared VPC. Which configuration ensures this without exposing the zone to other projects?

A company is deploying a global HTTP load balancer with a backend service that spans multiple regions. The backend instances are in a managed instance group. They want to use Cloud CDN to cache content. What is the minimal set of configurations required on the backend bucket or instance group to enable Cloud CDN?

A network engineer needs to create a private Google Kubernetes Engine (GKE) cluster with a secondary IP range for pods and another for services. They must ensure the pod CIDR does not conflict with any VPC subnets or on-premises ranges. Which step is essential during cluster creation?

Match each network pricing model to its description.

A company is designing a network architecture with multiple VPCs and on-premises connectivity via Cloud VPN. They want to avoid IP address conflicts and ensure secure communication. Which three best practices should they follow? (Choose three.)

A company wants to connect two VPCs in different GCP projects so that they can communicate using internal IP addresses. The VPCs have overlapping IP ranges. Which approach allows connectivity without changing existing IP addresses?

An engineer is deploying a network appliance (e.g., a firewall) in a VPC. The appliance needs to handle traffic between different subnets. How many network interfaces should the appliance VM have, and why?

A network engineer is troubleshooting a Cloud VPN gateway that is not establishing a VPN tunnel with an on-premises device. The engineer checks the Cloud VPN gateway logs and sees the error 'IKE SA negotiation failed due to mismatched authentication method'. What is the most likely cause?

A company uses Cloud NAT for outbound internet access. They want to ensure that all connections from their VMs use a predictable public IP address for whitelisting with third-party services. Which TWO configurations should be applied? (Choose two.)

A security team wants to block traffic from specific geographic regions (e.g., Country A) to their HTTP(S) load balancer. Which Google Cloud service should they use?

An organization has Compute Engine instances in a VPC without external IP addresses. They need to allow these instances to access Google Cloud Storage buckets but not the internet. What should they configure?

An organization has multiple VPCs in different regions that need to connect to a single on-premises data center via Dedicated Interconnect. They want to minimize cost and complexity. What is the recommended architecture?

A network engineer configures a Global external HTTP(S) Load Balancer with a serverless NEG backend pointing to Cloud Run. The load balancer returns 502 Bad Gateway errors. What is the most likely cause?

A company is migrating its on-premises data center to Google Cloud. They currently have a Cloud VPN tunnel with dynamic routing (BGP) connecting their on-premises router (ASN 65001) to a Cloud Router in us-central1 (ASN 64512). The on-premises network uses IP range 10.0.0.0/8, and the Google Cloud VPC uses 172.16.0.0/12. After migration, they notice intermittent connectivity issues: traffic from on-premises to a new VM (172.16.1.2) is sometimes dropped, while other VMs in the same subnet work fine. The VM 172.16.1.2 is fine when accessed from other Google Cloud VMs. The team suspects asymmetric routing. Investigation shows that the on-premises router receives two routes for 172.16.1.2/32: one with next-hop as the Cloud VPN tunnel and another with next-hop as the internet (default route). No custom route advertisements are configured on the Cloud Router. The VPC has a default route (0.0.0.0/0) pointing to the internet gateway. What should the network engineer do to resolve the issue without breaking other connectivity?

Refer to the exhibit. A BGP session between a Cloud Router and an on-premises router is not establishing. The Cloud Router logs show 'BGP_OPEN_MSG_ERROR: unsupported capability'. What is the most likely issue?

A company has a Shared VPC setup with a host project and several service projects. They want to grant a service project's network admin the ability to create VM instances using a specific subnet from the host project. Which IAM role should they assign at the subnet level?

A network engineer is investigating packet loss between two GCP regions using the Performance Dashboard. The dashboard shows high packet loss but no corresponding latency increase. What is the most likely cause of this packet loss?

A company uses VPC Network Peering between VPC-A (project X) and VPC-B (project Y). They want resources in VPC-A to reach resources in VPC-B, but also need VPC-A to reach an on-premises network connected to VPC-B via Dedicated Interconnect. Which two steps must be configured?

A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)

Your company uses Cloud DNS with a managed zone for example.com. You need to override DNS responses for a specific domain (e.g., internal.example.com) to point to an internal IP address. Which Cloud DNS feature should you use?

Which THREE of the following are benefits of using hierarchical firewall policies? (Select 3)

You are troubleshooting an HA VPN connection between Google Cloud and on-premises. The tunnels appear as 'UP' but no routes are exchanged. The Cloud Router logs show 'BGP session state: IDLE'. What is the most likely cause?

An organization wants to publish an internal web service running on Compute Engine to consumers in different VPCs. The service must be accessible via private IPs without VPC peering. Which THREE components are required to set this up using Private Service Connect?

Which TWO of the following load balancer types can distribute traffic to backends in multiple regions?

A financial company requires encrypted traffic between on-premise and GCP. They have strict compliance requiring that encryption keys are managed on-premise and rotated every 30 days. Which connectivity solution should they use?

Drag and drop the steps to configure Cloud Router with BGP for on-premises connectivity into the correct order.

A company wants to connect on-premise to GCP via Cloud VPN with dynamic routing. They have two on-prem routers for redundancy. Which configuration ensures automatic failover?

A company wants to analyze VPC Flow Logs to identify the top talkers (source IPs) generating the most traffic to their web servers. They have enabled VPC Flow Logs on the subnet. Where should they export the logs for cost-effective querying and analysis?

An organization has multiple projects and wants to apply a consistent set of firewall rules across all VPC networks in the organization. Which approach should they use?

A company needs to resolve DNS queries for a private zone (e.g., corp.example.com) from multiple GCP projects that are not in the same organization. Which Cloud DNS feature should they use?

You are troubleshooting a failing HA VPN tunnel between GCP and on-premises. The tunnel status shows 'Tunnel is down' in Cloud Console. Which TWO steps should you take to diagnose the issue? (Choose two.)

A company is designing a hybrid network with Cloud VPN. Which TWO best practices should they follow? (Choose TWO.)

A company has two VPC networks connected via VPC peering. They notice asymmetric routing: traffic from Network A to Network B follows one path, but return traffic from B to A takes a different path. This is causing connectivity issues for stateful firewalls. What is the likely cause?

A company needs to design a split-horizon DNS solution where internal queries resolve to private IPs and external queries resolve to public IPs for the same domain. Which TWO services or configurations should they use?

A company plans to connect an on-premises network to Google Cloud using HA VPN with dynamic routing (BGP). The on-premises side supports BGP and has two independent routers for redundancy. The company wants to ensure failover within seconds if one tunnel goes down. Which configuration meets this requirement?

A company wants to connect their VPC to an on-premises network using Cloud VPN. They need to ensure that traffic from Google Cloud to on-premises uses a specific route only when the primary path is available, and otherwise fails over to a backup path. Which configuration should they use?

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Which TWO statements are true about VPC Network Peering? (Choose 2)

A Compute Engine instance has multiple network interfaces. Which interface is considered the primary (NIC0)?

An organization has a Dedicated Interconnect with one VLAN attachment. They want to add a second VLAN attachment on the same interconnect circuit for additional capacity. What is the correct approach?

A network engineer is configuring a Cloud VPN tunnel with route-based VPN and BGP. The tunnel is established, but the Cloud Router does not learn any routes from the on-premises peer. What is the most likely cause?

You have a Cloud NAT gateway configured in a region with 256 available ports. You allocate static NAT ports to a specific VM for outbound connections. What is the minimum number of ports you should allocate to ensure the VM can handle 500 concurrent connections?

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

An organization wants to implement a hub-and-spoke network topology in Google Cloud using VPC Network Peering. The hub VPC hosts shared services and the spoke VPCs host application workloads. They need to ensure that spokes can communicate with each other through the hub. Which additional configuration is required?

A company uses Cloud NAT to allow private VMs to access the internet. They notice that some VMs are unable to reach a specific set of external IP addresses, but other VMs can. The firewall rules are correctly configured. What is the most likely cause?

A company is designing a VPC network to support multiple projects that require isolation but also need to communicate with a shared services project. Which approach should the company use to minimize administrative overhead while ensuring isolation?

A company is planning to migrate to Google Cloud and needs to design a VPC network for a multi-tier application (web, app, database). Which THREE best practices should they follow? (Choose THREE.)

A company wants to use AS path prepending to influence traffic from Google Cloud to their on-premises network to prefer one Dedicated Interconnect connection over another. How should they configure AS path prepending?

A company wants to use Cloud CDN to cache content from a backend bucket. They need to cache all objects, including those with cookies, to maximize performance. Which cache mode should they select?

An engineer is configuring a Compute Engine instance with multiple network interfaces for use as a network appliance. Which interface is considered the primary interface for default routes and instance metadata?

A company wants to expose a web application running on Compute Engine behind a global HTTPS load balancer with Cloud CDN enabled. They need to ensure that only authenticated users can access certain content. Which approach should they use?

Which THREE components are required to set up a Partner Interconnect connection?

A company has Compute Engine instances in a VPC that only have internal IP addresses. They need to access Google Cloud services like Cloud Storage and BigQuery. They also have on-premises servers that need to access the same instances via a Cloud VPN tunnel. What must be enabled for the instances to access Google APIs without public IPs?

A developer wants to enable VPC Flow Logs on a subnet to capture metadata about IP traffic. They want to reduce costs by logging only a sample of traffic. What is the default sampling rate for VPC Flow Logs?

You want to distribute traffic across multiple GKE clusters in different regions with automatic failover if a region becomes unhealthy. Which Cloud DNS routing policy should you use?

You have a Cloud Router with the configuration shown. The on-premises network (ASN 65002) is not receiving any routes from Google Cloud. What is the most likely cause?

A company is using Cloud NAT to allow private VMs to access the internet. They want to troubleshoot connectivity failures and analyze connection attempts that were dropped due to NAT resource exhaustion. What should they enable?

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

A company has two Dedicated Interconnect circuits in different metro areas to meet the 99.99% SLA. They have configured active-active mode. During a test, they intentionally bring down one circuit. They expect traffic to continue using the other circuit, but they notice packet loss during the failover. What could be the cause?

A company uses Traffic Director with Envoy sidecars for service mesh. They want to gradually shift traffic from version 1 to version 2 of a service, starting with 10% traffic to version 2. Which Traffic Director feature should they use?

A company wants to use Cloud CDN to serve content from a custom origin that is not hosted on Google Cloud. They have enabled Cloud CDN with a backend bucket pointing to an external origin URL. However, content is not being cached. What is a likely reason?

An engineer manages a global application using Global external HTTP(S) Load Balancer with URL map routing to multiple backend services. They want to enable Cloud CDN for the /images/* path. What is the correct way to enable CDN for that specific path?

Drag and drop the steps to set up a Private Service Connect for accessing Google APIs privately into the correct order.

You are using Traffic Director with Envoy sidecars for a microservices application. You want to inject artificial delays into requests from service A to service B for testing purposes. Which Traffic Director feature should you use?

Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?

A team is deploying a new service in a Compute Engine instance without an external IP in subnet-b. The service needs to access Google Cloud Storage using internal IPs. What must the team do to enable this?

A company has two VPC networks connected via VPC Network Peering. They observe asymmetric routing causing connectivity issues. Which configuration is most likely to be the root cause?

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

Which two of the following are prerequisites for configuring an HA VPN tunnel to an on-premises network? (Choose two.)

A company needs to connect their on-premises data center to Google Cloud with a consistent, high-availability connection that offers 99.99% availability SLA. The on-premises router supports VLAN tagging and BGP. They expect to burst up to 50 Gbps peak traffic. Which interconnect solution should they choose?

A company is migrating an on-premises DNS service to Cloud DNS. They want to resolve on-premises hostnames from GCP VMs and resolve Google Cloud private zone names from on-premises. They have a Cloud VPN with BGP. Which architecture should they implement?

An organization wants to restrict which Google APIs can be accessed by resources in a specific VPC. They also want to prevent data exfiltration to unauthorized projects. Which Google Cloud service should they use?

A company is running workloads on Compute Engine instances without public IP addresses. They need to allow these instances to securely access the internet for software updates. Which Google Cloud service should be configured?

A company has a Dedicated Interconnect connection from their on-premises data center to GCP. They have set up BGP sessions over VLAN attachments to peer with their VPC. Traffic from on-premises to GCP works, but return traffic from GCP to on-premises is dropped at the on-premises firewall. What is the most likely cause?

An organization wants to publish a private service using Private Service Connect (PSC) so that consumers in other VPCs can access it via private IPs. Which TWO resources are required on the producer side? (Choose TWO.)

An organization is migrating on-premises workloads to GCP. They need a dedicated, high-bandwidth connection with a 99.99% SLA. They have a co-location facility near a Google Cloud region. Which connectivity option should they choose?

A company is deploying a global application on Google Cloud using Cloud Load Balancing. They want to serve traffic from multiple regions and require the lowest possible latency for users worldwide. The application serves HTTP traffic and uses a static IP address. Which load balancing solution should they use?

Which TWO of the following are benefits of using Cloud NAT?

A company uses VPC Service Controls with a service perimeter that includes Project A. They want to allow an external identity from Project B (outside the perimeter) to access a Cloud Storage bucket in Project A, but only during business hours. Which VPC Service Controls feature should they use?

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

You run the command shown in the exhibit. Your on-premises network is connected to your VPC via a Cloud Router with two BGP sessions. You notice that your on-premises network receives routes for only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) but not for other subnets in the VPC. What is the most likely cause?

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between all services. Which component is responsible for issuing and distributing certificates to the Envoy proxies?

A company is using Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer has created a VLAN attachment of type PARTNER_PROVIDER in Google Cloud. What must the service provider do to complete the connection?

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

A company is designing a highly available hybrid network using HA VPN. They need to ensure that if one VPN tunnel fails, traffic automatically fails over to the other tunnel. Which TWO configurations are required? (Choose TWO.)

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

An enterprise uses Shared VPC with a host project and multiple service projects. A service project team wants to create a Cloud VPN tunnel to their on-premises network. What must the network team configure in the host project to allow this?

An engineer needs to verify that a Compute Engine instance can reach a specific IP address on the internet, considering firewall rules and routes. Which Network Intelligence Center tool should they use?

Refer to the exhibit. A Cloud VPN tunnel is configured with the above Cloud Router configuration. The on-premises BGP peer is at 169.254.0.2 with ASN 65001. The on-premises router is receiving the route 10.0.0.0/8 from the Cloud Router, but it is not receiving any of the specific subnets (e.g., 10.1.0.0/16) that exist in the VPC. What is the most likely cause?

A company runs a global e-commerce platform with a monolithic application deployed on Compute Engine. They want to modernize by splitting the monolith into microservices running on Cloud Run and Cloud Functions, and expose them externally via a single anycast IP with Google-managed SSL certificates. Which load balancer should they use?

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?

A company wants to expose an on-premises HTTP server to internet clients through a Global HTTPS Load Balancer using a hybrid connectivity NEG. The on-prem server is reachable via a Cloud VPN tunnel. What must the engineer configure to ensure the load balancer can reach the on-prem endpoint?

An organization has multiple VPCs in different projects that need to consume a common internal service hosted in a central project. The service runs on a set of Compute Engine instances with internal IPs. Which architecture allows the consumers to access the service using private IPs without VPC peering?

Which TWO of the following are valid ways to target firewall rules in Google Cloud? (Select 2)

An organization needs to connect two VPCs in different regions using Google's backbone. What is the recommended solution?

An organization wants to direct traffic from a global load balancer to an on-premises data center using a hybrid connectivity NEG. Which connectivity option must be in place for this to work?

A financial institution is setting up Dedicated Interconnect with Google Cloud. They have two on-premises routers (R1 and R2) each connected to a separate Google Cloud router via VLAN attachments in two different zones (us-central1-a and us-central1-b). The on-premises routers are configured with BGP, and they advertise the corporate prefix 10.0.0.0/8. Google Cloud routers are configured with custom route advertisements. After provisioning, you notice that traffic from some on-premises subnets to GCP experiences asymmetrical routing, causing packet drops. You verify that both BGP sessions are established and that both Cloud Routers have received the 10.0.0.0/8 route. What is the most likely cause of the asymmetrical routing?

An enterprise uses HA VPN to connect their on-premises network to Google Cloud. The on-premises side has a single VPN device that supports BGP. They want to maximize availability. What is the recommended Google Cloud configuration?

You are configuring a health check for a backend service that expects gRPC health probing. Which protocol should the health check use to verify gRPC service health?

After configuring Cloud VPN with dynamic routing (BGP), you notice that on-premises routes are not appearing in Google Cloud. BGP sessions are established but no prefixes are exchanged. Cloud Router logs show: 'No route advertisement received'. On-premises BGP configuration shows 'network 10.0.0.0/8' and 'neighbor 10.1.1.1 remote-as 65000'. What is the most likely cause?

A company has two VPC networks in the same project: 'vpc-a' (us-central1) and 'vpc-b' (us-east1). They are connected via VPC Network Peering. An instance in vpc-a can ping the internal IP of an instance in vpc-b, but cannot reach it on TCP port 8080. The firewall rule in vpc-b allows ingress from the peered network's subnets. What is the most likely cause?

A security team needs to capture all traffic to and from a specific Compute Engine instance for forensic analysis. They want to send the mirrored traffic to a third-party IDS appliance running on a separate VM in the same VPC. Which GCP feature should they use, and what is a key consideration?

A network engineer wants to monitor the operational status of a Dedicated Interconnect link using Cloud Monitoring. Which metric should they use to check if the physical link is up or down?

An engineer needs to monitor Cloud NAT gateway usage for cost allocation and troubleshooting. Which TWO types of logs should they enable? (Choose TWO.)

An engineer needs to configure Cloud Armor to block requests from a specific IP address (10.1.2.3) while allowing all other traffic. They create a security policy with a deny rule for that IP and an allow rule for all traffic. What priority should the deny rule have relative to the allow rule?

Which TWO statements about Cloud Router BGP are correct? (Choose two.)

A company is designing a hybrid network using Dedicated Interconnect. They want to achieve a 99.99% SLA for availability. Which THREE configurations are required to meet this SLA?

A company wants to enable VPC Flow Logs for a subnet to troubleshoot connectivity issues. They have enabled flow logs with a sample rate of 1.0 and metadata annotation enabled. After a few hours, they notice that logs are being generated but they are missing flows from a specific application server to a database server in the same subnet. Both servers are Compute Engine instances with internal IPs only. What could be the cause?

An organization wants to prevent data exfiltration from a project that uses Google Cloud Storage and BigQuery. They need to restrict access to these services from only the authorized VPC networks. Which service should they use?

A startup is setting up a new GCP project and needs to create a VPC that will have predictable IP ranges for future peering with other VPCs. They do not anticipate needing to grow the network beyond the initial IP range. Which VPC type should they choose?

Which IP address type in Google Cloud can communicate with the internet but is not reachable from the internet?

An organization has a hybrid network with multiple BGP sessions between on-premises and GCP. They want to influence outbound traffic from GCP to prefer a specific path. Which BGP attribute should they adjust on the Cloud Router?

A company needs a dedicated, low-latency connection from their on-premises data center to GCP with a 10 Gbps capacity. They require the highest availability and service level agreement (SLA). Which connectivity option should they choose?

A company wants to resolve DNS queries from their on-premises network for Google Cloud private zones (e.g., example.internal) without duplicating DNS data. Which Cloud DNS feature should they use?

A company has deployed a network appliance (e.g., firewall) as a Compute Engine instance with two NICs: NIC0 for management and NIC1 for data traffic. The appliance must forward traffic from instances in subnet A to subnet B. The engineer has enabled IP forwarding on the appliance. What additional configuration is required on the VPC for the appliance to route traffic between subnets?

Which THREE are valid considerations when planning IP address ranges for VPCs that will be connected via VPC Peering and Cloud VPN? (Choose 3)

A network engineer is configuring BGP on a Cloud Router for a Dedicated Interconnect. They want to apply traffic engineering to prefer one path over another for inbound traffic from on-premises to GCP. Which THREE BGP attributes can be used to influence this inbound traffic? (Choose three.)

A company wants to apply consistent firewall rules across all projects in an organization. They need to block all traffic to ports 22 and 3389 from the internet to any VMs in any project. Which approach is most scalable and maintainable?

Which TWO of the following are true regarding VPC Network Peering? (Choose TWO.)

A company has two Dedicated Interconnect connections to two separate Google Cloud regions for redundancy. They use Cloud Router with BGP to exchange routes. They want to ensure that traffic from on-premises to a specific VPC in us-central1 uses only the interconnect to us-central1, and the other interconnect is used only as a backup. How can they achieve this?

A company has a VPC with subnets in us-central1 and europe-west1. They need to allow Compute Engine instances in us-central1 (without external IPs) to access Google Cloud Storage buckets in the US multi-region. They also need to ensure the traffic does not traverse the public internet. Which TWO configurations are required? (Choose TWO.)

Refer to the exhibit. A VM in the default VPC with tag 'internal' and IP 10.128.1.2 is unable to communicate with another VM with IP 10.132.0.3 and tag 'internal'. What is the most likely cause?

A company has deployed Cloud HA VPN between their on-premises network and Google Cloud. They have two tunnels from the on-premises VPN appliance to the HA VPN gateway. The on-premises appliance uses a single public IP address for both tunnels, while the Cloud VPN gateway uses two different public IPs. BGP sessions are established over both tunnels, and the Cloud Router is configured with 'active/active' mode. The network team notices that all outbound traffic from Google Cloud to on-premises is using only one of the two tunnels, even though both tunnels are up. BGP metrics are identical for routes received over both sessions. What is the most likely cause?

A network engineer is configuring a global HTTPS load balancer with Cloud CDN. They want to cache responses based on the request origin, query parameters, and user agent. Which cache key configuration should they use?

A company has a global e-commerce platform using a Global HTTPS Load Balancer with Cloud CDN. They want to serve private content, such as user-specific PDFs, with CDN caching while ensuring only authorized users can access it. Which method should they use?

A company is planning to connect their on-premises data center to Google Cloud using a Dedicated Interconnect. They require 20 Gbps of total bandwidth and want to achieve the highest SLA. What is the minimum number of 10 Gbps connections needed?

A network engineer needs to test connectivity after setting up a Dedicated Interconnect VLAN attachment and BGP session. Which tool should they use to verify that Google Cloud can reach an on-premises IP address?

A company currently uses a site-to-site Cloud VPN (IPsec) to connect their on-premises network to a VPC. Due to growing bandwidth demands, they plan to migrate to Partner Interconnect using a supported service provider. They have ordered a 1 Gbps connection and the provider has indicated the VLAN attachment is ready. After creating the VLAN attachment and pairing it with a Cloud Router, the on-premises router sees the BGP session come up, but no traffic is forwarded over the interconnect. The Cloud VPN is still operational. What step is most likely missing?

A company uses Shared VPC with multiple service projects. They want to ensure that only specific service projects can use the Cloud NAT configured in the host project. What should they do?

An enterprise is evaluating connectivity options to Google Cloud. They have moderate bandwidth requirements (up to 1 Gbps) and need high availability. Which two of the following are appropriate solutions? (Choose two.)

A company has an HTTP Load Balancer that distributes traffic to a backend service consisting of Compute Engine instance groups. They need to block traffic from specific geographic regions and also rate-limit requests from any IP. Which THREE Cloud Armor features should they configure?

A media streaming company uses Cloud CDN with signed URLs to protect content. They want to invalidate cached content for a specific file after a security incident. The file is stored in a Cloud Storage bucket and the CDN cache key includes the URL. They run: gcloud compute url-maps invalidate-cdn-cache URL_MAP --path "/videos/incident.mp4". The invalidation succeeds but the old content is still served. What is the most likely reason?

A network engineer is troubleshooting a global HTTPS load balancer that is not serving traffic to some users. The load balancer has a backend service with a zonal NEG in us-central1-a. Users report intermittent 502 errors. Which two checks should the engineer perform? (Choose two.)

A company is designing a secure multi-VPC architecture in Google Cloud. They have three VPCs: Production, Staging, and Shared Services. The Shared Services VPC hosts a Cloud NAT for outbound internet access and a set of managed instance groups. The Production and Staging VPCs are peered to the Shared Services VPC. The company wants to ensure that: (1) instances in Staging cannot initiate connections to instances in Production, (2) instances in Production cannot initiate connections to instances in Staging, (3) all VPCs can communicate with Shared Services, and (4) traffic between VPCs must be inspected by a firewall appliance in Shared Services. Which TWO actions should the company take?

A company uses Cloud CDN to serve content. They need to generate signed URLs to allow temporary access to premium content. They have set up a signing key. Which command correctly generates a signed URL for the object /video.mp4 in a bucket served by a load balancer?

A company wants to provide outbound internet access to Compute Engine instances without external IPs, while minimizing IP address consumption. Which Cloud NAT feature should be used to achieve minimal static IP usage?

You are migrating an on-premises application to Google Cloud and need to connect it to Cloud Run services via a load balancer. The on-premises network uses a VPN to GCP. Which TWO components are required to route traffic from on-premises to a serverless NEG? (Choose 2)

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

A company needs to connect multiple branch offices to GCP using Partner Interconnect. They need at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps. Which type of Partner Interconnect should they choose?

A company uses Cloud Armor with an external HTTPS load balancer to protect their web application. They have a security policy 'my-policy' attached to the backend service. The policy includes an allow rule (priority 1000) for their corporate IP range (203.0.113.0/24) and a deny rule (priority 2000) for all other IPs. The company has an office at a remote location that uses a different IP range (198.51.100.0/24). Employees from the remote office report they cannot access the application. Meanwhile, employees from the corporate office (203.0.113.0/24) can access. The engineer checks the Cloud Armor policy and sees the rule configuration as shown. What is the most likely cause?

A company has deployed a global HTTP Load Balancer with Cloud CDN to serve content to users worldwide. They notice high egress costs from the origin region. What is the most cost-effective solution to reduce egress from the origin?

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

Refer to the exhibit. A company has enabled Private Google Access on the subnet. What effect does this have on VMs in the subnet?

A company needs to connect their on-premises network to Google Cloud with high availability and load balancing across multiple tunnels. They plan to use HA VPN. Which TWO of the following are required to achieve active-active load balancing across multiple tunnels?

You are deploying a microservices architecture on Google Kubernetes Engine (GKE) with Traffic Director for traffic management. You want to implement fault injection to test the resilience of your services. Which two types of fault injection does Traffic Director support? (Choose two.)

Which TWO statements about VPC peering are correct?

A company is designing a VPC for a multi-tier web application. They need to ensure that the web servers can be reached from the internet, but the database servers should only be accessible from the web servers. Which three components should they use to achieve this? (Choose THREE.)

You need to configure health checks for a backend service that uses gRPC for health checking. Which health check type should you use?

A company is setting up VPC peering between two VPCs. They need the peered VPC to be able to reach the entire subnets of their VPC, including those that may be added in the future. Which configuration is required?

A network engineer needs to create a firewall rule that denies all inbound traffic to instances with the tag 'web-server' from source IP range 10.0.0.0/8. They also have an existing allow rule with priority 1000 that permits traffic from 10.0.0.0/8 to those instances. To ensure the deny rule takes precedence, what priority should the new rule have?

A network engineer has set up a Cloud Router with BGP for an HA VPN. The BGP session is flapping. Which log should be examined to diagnose the issue?

An organization needs to allow on-premises servers to resolve DNS names of GCP VM instances using RFC 1918 addresses. They have a Cloud VPN connection. Which DNS resolution approach should they implement?

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Refer to the exhibit. A Compute Engine instance has the network tags 'http-server' and 'ssh-server'. It also has a public IP address. Which of the following statements about traffic to this instance is true?

A company is using Partner Interconnect to connect to Google Cloud. They notice that traffic from on-premises to GCP takes one path, but return traffic takes a different path, causing asymmetric routing. How can they resolve this?

Your company has two on-premises data centers, DC1 and DC2, each connected to a separate Google Cloud VPC via Dedicated Interconnect. Both VPCs are connected via VPC Network Peering. A new application deployed in VPC1 needs to communicate with a database in DC2. The database IP range is 10.0.0.0/16. You have configured firewall rules to allow the traffic. However, the application cannot reach the database. You have verified that routes for 10.0.0.0/16 exist in VPC1's route table with next hop to VPC Peering, and in VPC2's route table with next hop to the interconnect attachment. The BGP sessions on both interconnects are up. What is the most likely reason for the connectivity failure?

Refer to the exhibit. A network team has created this load balancer. Clients inside the VPC are unable to connect to the load balancer's IP address from a Compute Engine instance in the same VPC. What is the most likely cause?

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

An engineer needs to set up a VPN between an on-premises network and GCP. The on-premises VPN device does not support BGP and can only support static routing. Which VPN solution should the engineer choose?

A company uses an internal TCP/UDP load balancer to distribute traffic to a backend service. The backend instances are in an unmanaged instance group. Some instances fail health checks and are removed. What happens to existing connections to failed instances?

You need to allow on-premises servers to access a Google Cloud VM's internal IP without using a public IP. The on-premises network is connected via Cloud VPN. What configuration is required on the Google Cloud side?

A request comes from IP 192.0.2.5, with origin region code 'US', and path '/admin/dashboard'. What will be the final action?

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

Refer to the exhibit. The Cloud Router is configured with custom BGP advertisements. The on-premises router receives only the two advertised ranges (10.1.0.0/24 and 10.2.0.0/24) but not the VPC subnets (e.g., 10.3.0.0/24). What is the most likely reason?

A company wants to expose an internal HTTP service running on Compute Engine instances to other VPCs in the same project using a load balancer. The load balancer must support HTTP path-based routing and preserve the client source IP. Which load balancer types meet these requirements? (Choose two.)

An engineer is configuring a Cloud Router for HA VPN. They need to enable BGP on the VPN tunnels. Which BGP configuration is required for the Cloud Router to advertise the VPC subnets to the on-premises network?

A company with limited public IP addresses on-premises needs to connect to Google Cloud using Cloud VPN. They require high availability. Which solution should they implement?

A company has two VPCs in the same project, VPC-A and VPC-B. They have set up VPC peering between them. In VPC-A, there is a subnet 10.0.1.0/24. In VPC-B, there are subnets 10.0.2.0/24 and 10.0.3.0/24. A compute instance in VPC-A can ping an instance in VPC-B with IP 10.0.2.10, but fails to ping an instance in VPC-B with IP 10.0.3.10. All subnets are in the same region. Firewall rules allow all traffic between VPC-A and VPC-B. What is the most likely cause?

An engineer needs to deploy a VM that acts as a internet gateway for other instances in the same VPC. The VM must have IP forwarding enabled and must be able to accept traffic on multiple NICs. Which TWO actions are required? (Choose 2)

A company has a HA VPN gateway in Google Cloud with two tunnels to their on-premises router. They want to ensure that if one tunnel fails, all traffic automatically fails over to the other tunnel. What configuration is necessary on the on-premises router?

An organization wants to consume a third-party SaaS service via a private endpoint in their VPC, using Private Service Connect. Which type of Private Service Connect endpoint should they create?

A company wants to expose a global web application with HTTP/HTTPS load balancing, SSL termination, and Cloud CDN. They need to route requests to different backend services based on the URL path (e.g., /api/* to a Cloud Run service, /static/* to a Cloud Storage bucket, and /* to a managed instance group). Which GCP load balancing product should they use?

A company is using Dedicated Interconnect to connect their on-premises network to Google Cloud. They have two VLAN attachments configured, each with a separate Cloud Router with active/active BGP. They want to ensure that traffic from their on-premises network to Google Cloud uses both attachments equally. Which configuration should they implement?

A company uses a Shared VPC with a host project and multiple service projects. They have deployed Cloud NAT in the host project's network to provide internet access for service project instances. The Cloud NAT is configured to use a network tag 'nat'. Instances in service projects that have the tag 'nat' can reach the internet. A new service project is added and its instances are created with the same tag 'nat' in a subnet in europe-west1. However, these instances cannot reach the internet. Other service project instances with the tag 'nat' in us-central1 work fine. The Cloud NAT is deployed in us-central1. What is the most likely cause?

A company is migrating from an on-premises data center to Google Cloud. They have a legacy TCP application that must preserve client IP addresses when load balanced. They also need SSL termination for a different web application. Which TWO load balancers should they consider? (Choose two.)

A company has Compute Engine instances without external IPs that need to access the internet for updates. They do not want any inbound traffic. What is the best design?

Which TWO statements are true about VPC Network Peering?

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

A company has a Dedicated Interconnect connection with a VLAN attachment in their GCP VPC. They want to use BGP to exchange routes with their on-premises router. Which GCP resource must be configured to establish the BGP session?

A company is designing hybrid connectivity between on-premises and GCP. The on-premises network has multiple VPN gateways that support BGP. They require high availability with an SLA of 99.99% and want to use Cloud VPN. Which TWO configurations are required? (Choose two.)

A network engineer notices that VPC Flow Logs show connections from a Compute Engine instance to an IP address that should have been blocked by firewall rules. What is the most likely cause?

A company is deploying a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They require 99.99% availability for the interconnect. Which two actions must they take to meet this SLA?

A company wants to migrate an on-premises application that uses IPsec VPN tunnels to Google Cloud. They need to ensure encrypted connectivity between the on-premises network and a VPC. Which GCP service should they use?

An organization is connecting their on-premises data center to Google Cloud via Partner Interconnect. The partner offers both Layer 2 and Layer 3 connectivity options. The organization wants to manage their own BGP sessions and IP addressing. Which connectivity option should they choose?

A security engineer wants to monitor and analyze traffic to a load-balanced web application. Which TWO services can provide detailed logs of HTTP requests and responses?

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

A network engineer is configuring HA VPN between an on-premises network and GCP. They have created two external VPN gateways in GCP (one per region) and two Cloud Routers. How many IKEv2 tunnels and BGP sessions are required to achieve the 99.99% SLA?

A company uses VPC Service Controls to protect a managed service (e.g., BigQuery) within a service perimeter. Developers need to access the service from an on-premises network via a Cloud VPN tunnel with a specific IP address. However, access is being denied. What is the most likely cause?

A company wants to connect their on-premises network to Google Cloud using a VPN with high availability and 99.99% SLA. They have two Cloud VPN gateways, each with two external IP addresses. Which configuration best meets the high availability requirement?

Which TWO steps are required to set up a Cloud VPN with dynamic routing (BGP)? (Choose 2.)

Refer to the exhibit. A network engineer reviews the firewall rules in a VPC. What is the most significant security concern?

A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?

An organization is using Cloud VPN with dynamic routing and wants to improve failover time between two VPN tunnels. Which THREE configuration changes can help reduce failover time?

A company is using a Classic VPN with static routing to connect to GCP. They need to add a new subnet in GCP and make it reachable from on-premises without manual configuration changes on-premises. What is the limitation of Classic VPN in this scenario?

A network engineer is troubleshooting connectivity from a Compute Engine instance in subnet-a to a Google Cloud Storage bucket. The instance has no external IP address. Based on the exhibit, what is the most likely cause of the connectivity issue?

Which THREE factors should be considered when designing a Cloud VPN for high availability? (Choose 3.)

A company wants to use Cloud DNS with a failover routing policy. They have two IP addresses serving the same application: primary in us-east1 and secondary in us-west1. They want traffic to go to primary unless health check fails, then fail over to secondary. Which configuration is required?

A company is planning a hybrid connectivity solution with 200 Gbps total bandwidth between their data center and Google Cloud. They need the highest SLA and lowest latency. Which combination of services would meet these requirements?

A developer needs to store a TLS certificate for use with a load balancer. Which Google Cloud service is used to create and manage SSL certificates?

A company is experiencing periodic packet loss between two Compute Engine instances in the same region but different zones. They have enabled VPC Flow Logs and see that the flows are marked with 'RTT' latency. Which THREE actions should they take to diagnose the issue? (Choose three.)

Which TWO of the following are benefits of using Shared VPC?

A startup is migrating a two-tier application to GCP. The web tier must be accessible from the internet, and the database tier must only be accessible from the web tier. Which network design should be used?

A network engineer is troubleshooting connectivity issues with VPC Flow Logs. Which TWO statements about VPC Flow Logs are correct? (Choose TWO)

A company has multiple projects that each need their own administrative control but must share a common VPC network. Which networking solution should they use?

What is the default MTU for packets sent between VMs within the same VPC network in Google Cloud?

A developer wants to configure Cloud DNS for split-horizon DNS where internal queries resolve to private IPs and external queries resolve to public IPs. Which TWO steps should they take?

A large organization uses Shared VPC with hundreds of projects. They want to implement fine-grained access control for SSH access to Compute Engine instances using IAP TCP forwarding. They have created a custom IAM role with the necessary permissions (iap.tunnel.dest, iap.tunnel.getIamPolicy, compute.instances.use) and granted it to a group of developers. The developers have also been granted the iap.tunnelUser role on the project. However, when they try to use `gcloud compute ssh --tunnel-through-iap instance-name`, they get a permission error: "Permission 'iap.tunnel.dest' denied on resource 'projects/project/zones/zone/instances/instance'". The network admin has verified that the custom role includes the required permissions and that the developers are members of the group with the role. What is the most likely missing configuration?

A company wants to use Cloud CDN to serve private content to authenticated users only. Which feature should they use?

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. They want to achieve a 99.99% SLA. What is the minimum requirement?

A company has two VPCs (Prod and Dev) that are peered. Both VPCs have routes to an on-premises network via separate Cloud VPN tunnels. The on-prem network has routes to both VPCs. The Dev VPC recently added a subnet that overlaps with an on-prem subnet. What is the likely impact on the Prod VPC?

A company wants to resolve DNS queries from their on-premises DNS servers for a private zone hosted in Cloud DNS. They also need GCP resources to resolve on-premises hostnames. Which combination of Cloud DNS features should they configure?

A company wants to protect its HTTP(S) Load Balancer from layer 7 attacks, including SQL injection and cross-site scripting (XSS). Which TWO Google Cloud services or features should be used together? (Choose TWO.)

A company uses a Shared VPC host project with three service projects: Prod, Staging, and Dev. All service projects have similar network requirements except that Prod requires Private Google Access to access Google APIs from VM instances without external IP addresses. The network team creates a single subnet in the Shared VPC with Private Google Access enabled. However, Staging and Dev teams report that their VMs cannot reach external IP addresses on the internet because the subnet's route has a next hop of default internet gateway. What is the most cost-effective solution that meets all requirements?

An organization uses Cloud DNS private zones for internal service discovery. They want to override DNS responses for a specific domain (e.g., 'internal.example.com') to block access to malicious domains and redirect certain queries to a different IP for compliance. Which Cloud DNS feature should they use?

A company is planning a hybrid connectivity strategy between their on-premises data center and GCP. They require at least 99.9% availability and are open to using a third-party service provider. Which TWO options meet these requirements? (Choose TWO.)

A company has a Cloud VPN tunnel with dynamic routing (BGP) connecting their on-premises network to a VPC in us-central1. They recently added a new subnet (10.2.0.0/16) to the VPC. The on-premises network still cannot reach resources in the new subnet. The Cloud Router BGP session is established and routes from on-prem are being received. What is the most likely cause?

An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?

A company wants to cache static content globally to reduce latency for their users. They are using a Global HTTPS Load Balancer with a backend bucket. Which Cloud CDN cache mode should they use?

A company runs a web application on Compute Engine instances without external IPs. They need to ensure the instances can access Google APIs (e.g., Cloud Storage) and also provide outbound internet access for software updates. Which two features should be configured? (Choose two.)

Which THREE of the following are requirements for setting up a Dedicated Interconnect connection to Google Cloud? (Choose three.)

A developer wants to use Cloud CDN to cache content from an external origin backend. Which TWO configurations are required to set this up? (Choose two.)

A company has a VPC with several subnets and wants to force traffic between two specific subnets (A and B) to be inspected by a third-party firewall appliance in a separate subnet (C). The firewall has source/destination check disabled. What is the best way to route traffic from A to B through C?

A company wants to enable Private Google Access for an on-premises network connected via Cloud VPN. Which configuration step is required?

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

An engineer wants to use Traffic Director to split traffic between two versions of a microservice running on Compute Engine with Envoy sidecars. They want to send 10% of traffic to the new version. Which configuration should they apply?

Your company has a Dedicated Interconnect with two VLAN attachments (vlan-attachment-a and vlan-attachment-b) connected to two different Edge Availability Domains (EADs) in the us-central1 region. Both attachments are associated with a single Cloud Router named 'cr-us-central1'. On-premises, you have two routers (rtr-a and rtr-b) each connected to one VLAN attachment via BGP. The Cloud Router has four BGP sessions: rtr-a (vlan-a), rtr-a (vlan-b), rtr-b (vlan-a), rtr-b (vlan-b) — a full mesh for redundancy. All sessions are established and routes are exchanged. Recently, you added a new on-premises subnet 192.168.100.0/24 and advertised it via BGP from both on-premises routers. However, Google Cloud instances in the VPC cannot reach this subnet. Other on-premises subnets (e.g., 10.0.0.0/8) are reachable. The Cloud Router route table for 'cr-us-central1' shows multiple entries for 192.168.100.0/24, each with different next hops but all with status 'stacked'. There are no BGP route filters configured. What is the most likely cause of the issue?

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

An on-premises router uses BGP ASN 64512. The Cloud Router is also configured with ASN 64512. When the BGP peering is established, what behavior is expected?

An engineer has configured an HA VPN tunnel between an on-premises network and Google Cloud. The tunnel status shows as established, but traffic is not flowing. The engineer checks the Cloud Router BGP session and sees it is in the Active state. What is the most likely cause?

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

An organization is deploying a global application and wants to use an Internal Load Balancer (ILB) across multiple regions. What is the correct configuration?

A company wants to use Cloud DNS response policy zones (RPZ) to override DNS responses for a set of internal domains. They need to ensure that only specific VPC networks can use these overrides. Which three steps are required? (Choose three.)

Drag and drop the steps to create a VPC with custom subnet mode in Google Cloud into the correct order.

A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?

Your company uses Network Connectivity Center (NCC) to manage multiple on-premises sites connected via Cloud VPN and Partner Interconnect. You create a NCC hub and attach spokes (VPN tunnels and VLAN attachments). Traffic between two on-premises sites (Site A and Site B) should flow through Google Cloud. However, traffic is not passing between the sites. What is the most likely cause?

An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?

Drag and drop the steps to configure a global external HTTP(S) load balancer in Google Cloud into the correct order.

While configuring a health check for a backend service, an engineer notices that the health check is failing even though the instances are healthy. The health check is HTTP on port 80 with a request path of /health. The instances respond to curl http://localhost:80/health with 200 OK. What is a likely cause?

A company uses an HTTPS load balancer with SSL certificates. They want to ensure only strong cipher suites are accepted. Which Google Cloud service should they use to enforce this?

An organization needs to set up a Regional Internal HTTPS Load Balancer for internal microservices. They want to use Envoy-based load balancing. Which backend type must the backend service use?

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect using VLAN attachments. They have set up a Cloud Router with BGP to exchange routes. The on-premises network advertises a prefix 10.0.0.0/8, and Google Cloud advertises the VPC's subnet ranges (10.0.0.0/24 and 10.0.1.0/24). After configuration, on-premises hosts cannot reach the Google Cloud instances in those subnets. The engineer checks the BGP session status and it is established. The Cloud Router shows that the on-premises prefix is learned, and the on-premises router shows that the specific /24 prefixes are received. However, traffic from on-premises to the Google Cloud subnets is not working. What is the most likely cause?

A company has multiple GCP projects that need to resolve DNS queries for a private zone (e.g., example.internal) that is hosted in a central project. They want to avoid copying zone data. Which TWO features can be used to achieve this? (Choose TWO.)

Which TWO of the following could cause a Dedicated Interconnect BGP session to go to the 'IDLE' state?

A company is planning to use Partner Interconnect to connect their on-premises network to GCP. Which TWO of the following are characteristics of Partner Interconnect?

A company wants to restrict access to Google Cloud Storage from a specific VPC only, using VPC Service Controls. Which TWO components are required to create a service perimeter? (Choose two.)

A company wants to resolve on-premises DNS names from Google Cloud VMs. They have a Cloud DNS private zone for their domain and on-premises DNS servers at IP 10.1.1.1 and 10.1.1.2. Which Cloud DNS feature should they use?

A company is using Cloud VPN with BGP to connect their on-premises network to Google Cloud. They have two VPN tunnels from two different on-premises VPN gateways to a single Cloud VPN gateway. They notice that during maintenance on one on-premises gateway, traffic fails over to the other tunnel, but after the maintenance, traffic does not fail back. What is the most likely cause?

A company has a VPC with three subnets and multiple firewall rules. They want to ensure that the most specific firewall rule takes precedence when there is a conflict. What is the default evaluation order of firewall rules?

A company uses VPC Flow Logs to analyze traffic patterns. They notice that the logs show only 50% of the actual flows. What is the most likely cause?

An engineer is configuring a Global SSL Proxy Load Balancer to terminate SSL for a non-HTTP TCP application. They want to minimize latency by allowing the load balancer to reuse connections to backends. Which setting should they adjust?

Match each Cloud Router BGP attribute to its function.

A large enterprise has a multi-site on-premises network with two data centers (DC1 and DC2) connected via a private WAN. They are migrating critical applications to Google Cloud and have established a Dedicated Interconnect at each data center, each with a single VLAN attachment (vlan-attachment-1 from DC1, vlan-attachment-2 from DC2) connected to a single VPC network in us-central1. Each VLAN attachment uses a separate Cloud Router (router-us-central1-dc1 and router-us-central1-dc2) with BGP sessions advertising the same on-premises prefixes. The VPC has auto-mode subnet ranges. They notice that traffic from Google Cloud to on-premises is flowing only through DC1, and when DC1's interconnect fails, traffic fails over to DC2, but after DC1 recovers, traffic does not return to DC1. The on-premises routers are advertising the same prefixes with equal MED values. What is the most likely cause and the best corrective action?

A large enterprise has multiple on-premises data centers connected to Google Cloud via a combination of Dedicated Interconnect and Cloud VPN. They have a VPC with subnets in us-east1 and us-west1. The on-premises network advertises a prefix 10.0.0.0/8 to both Cloud Routers (each in different regions) via BGP. The Cloud Routers are configured with 'global' dynamic routing mode. The network team notices that traffic from Google Cloud instances in us-west1 to on-premises destinations in 10.0.0.0/8 is always taking the path to the closest on-premises data center (west coast) even though the west coast data center is currently under high load, causing performance degradation. The east coast data center is underutilized. They want to influence the path selection so that the west coast instances prefer the east coast data center during peak times. They are using BGP. What is the most effective method to achieve this?

A company is planning to connect multiple VPCs in different projects to a common on-premises network using a hub-and-spoke topology. They want to use Network Connectivity Center (NCC). Which TWO components are required to set up this topology?

A company uses Shared VPC with a host project and multiple service projects. A service project administrator wants to create a VM with an internal IP from a specific subnet in the host project. The operation fails with a permission error. What is the most likely missing permission?

A financial services company is deploying a multi-tier application in a custom VPC with three subnets: web (10.0.1.0/24), app (10.0.2.0/24), and db (10.0.3.0/24). They use a Cloud VPN with dynamic routing (BGP) to connect to their on-premises data center (10.1.0.0/16). The on-premises network administrator reports that traffic from the web tier (10.0.1.0/24) to on-premises is working, but traffic from the app tier (10.0.2.0/24) to on-premises is failing. The company uses an Identity-Aware Proxy (IAP) for SSH access. The following configurations are in place: - Cloud Router advertises all VPC subnets via BGP. - On-premises router advertises 10.1.0.0/16. - Firewall rules allow all traffic from 10.0.0.0/16 to 10.1.0.0/16. - The app tier instances have a network tag 'app-tier' and a service account 'app-sa@project.iam.gserviceaccount.com'. - There is a firewall rule with priority 1000 that denies egress from tags 'app-tier' to 10.1.0.0/16. What is the most likely cause of the failure?

A large e-commerce company has a hybrid cloud setup with a Dedicated Interconnect between their on-premises data center in Dallas and Google Cloud us-central1 region. They have a single VLAN attachment with a Cloud Router that uses BGP to exchange routes. The on-premises network uses 10.0.0.0/8, and Google Cloud VPC uses 172.16.0.0/16. They recently deployed a new application in us-west1 that uses IP range 172.17.0.0/16. They created a VPC peering between the us-central1 VPC and the us-west1 VPC. On-premises users can reach the us-central1 workloads but cannot reach the us-west1 application. There are no firewall rules blocking traffic. The on-premises router has a default route pointing to the Interconnect. What is the most likely cause of the issue?

What is the internal DNS name format for a Compute Engine instance named 'web-server' in zone 'us-central1-a' within project 'my-project'?

A company wants to reduce outbound data transfer costs from Compute Engine to the internet. Which TWO strategies are effective?

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They notice that traffic from Google Cloud to on-premises is not using the VPN tunnel but instead going through the internet. They have verified that the VPN tunnel is up and BGP sessions are established. Which configuration issue is most likely causing this behavior?

A company is using Cloud DNS for private zone resolution within their VPC. They have a private zone for 'example.internal' and have attached it to the VPC. When they create a new Compute Engine VM and try to resolve 'myapp.example.internal', it fails. What is the most likely cause?

A company wants to distribute traffic across multiple backend services based on the geographic location of the user. They are using an external HTTPS load balancer. Which routing configuration should they use?

An organization wants to design IP addresses for their GCP VPC that will be peered with an on-premises network using 10.0.0.0/8. Which subnet IP range should they avoid to prevent overlap?

A company needs to map multiple domain names to different backend services on a single Global HTTPS Load Balancer. Which resource should they configure to direct traffic based on the requested hostname?

A company wants to deploy a web application with a public-facing load balancer and a private backend. The backend instances must not have external IPs. Which statement about the VPC configuration is correct?

A company is using Partner Interconnect with a service provider that requires the use of VLAN attachments. Which type of VLAN attachment should they create in Google Cloud to use the partner's connection?

A company has a Partner Interconnect connection (Layer 2) with a service provider. They need to configure BGP sessions on their on-premises router and Google Cloud Router. The engineer creates a VLAN attachment of type PARTNER. However, the BGP session does not come up. What is the most likely reason?

An organization runs a web application on Compute Engine behind a regional external HTTP(S) load balancer. They need to log HTTP request details (e.g., user-agent, status codes) to BigQuery for analysis. Which logging feature should they enable?

A company is designing a hybrid network between their on-premises data center and Google Cloud. They need high availability for traffic between the two environments and want to use Cloud VPN with dynamic routing. Which configuration ensures that if one VPN tunnel fails, traffic automatically fails over to the other tunnel without manual intervention?

Which THREE of the following are requirements for implementing a Global External HTTP(S) Load Balancer with an external backend?

A company is designing a Shared VPC architecture for multiple projects. The host project hosts three VPC networks: 'prod', 'staging', 'dev'. Each service project needs access to a specific network. Some service projects require access to multiple networks. The security team wants to minimize the number of firewall rules and use IAM for centralized control. Which approach meets these requirements?

A company wants to ensure that Compute Engine instances in a VPC can resolve internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. What is required for this to work?

A company deploys a web application behind a global external HTTP(S) load balancer and wants to protect against SQL injection attacks. Which Google Cloud security product should they use?

An organization needs DNS resolution for on-premises hosts to resolve GCP private zone names (e.g., myinstance.gcp.internal). They have Cloud DNS private zones in GCP. Which Cloud DNS feature should they configure to forward queries from on-premises to GCP?

A company has a VPC with 200 custom routes and wants to set up VPC peering with another VPC. The VPC peering quota limits the number of routes per VPC. What should the engineer do to avoid hitting the quota?

A company wants to allow HTTP traffic from the internet to a web server running on a Compute Engine VM in a VPC. The web server should only be accessible on port 80. Which firewall rule should be created?

Refer to the exhibit. A project has the IAM policy shown. Alice is trying to delete a VPC firewall rule but receives a permission error. What is the most likely reason?

A company has set up a route-based HA VPN tunnel between Google Cloud and their on-premises network. They are experiencing packet loss and need to troubleshoot. Which logs or metrics would provide the MOST relevant information to diagnose the issue?

An organization needs to protect a web application behind an HTTPS Load Balancer from SQL injection attacks. They want to use a managed WAF solution. Which Google Cloud service should they configure?

A company wants to deploy an HTTP application on Compute Engine instances in us-east1 and europe-west1, and use a global external HTTP(S) load balancer. How should they configure the backend?

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Which TWO of the following are advantages of using the Premium Tier of Google Cloud's Network Service Tiers? (Choose TWO.)

Which Cloud DNS zone type is used to resolve DNS names for resources within a VPC network, and is not accessible from the internet?

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Which TWO statements about VPC Network Peering are correct?

Refer to the exhibit. You are troubleshooting an on-premises to Cloud VPN connection with dynamic routing. The BGP session is CONNECTED, but no routes are received from the on-premises router. What is the most likely cause?

A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?

Match each Google Cloud interconnect or peering type to its description.

Which TWO statements about VPC Network Peering are correct? (Choose TWO.)

A company uses Identity-Aware Proxy (IAP) to secure access to Compute Engine VMs. Users report that they can SSH into some VMs but not others, even though they have the IAP-secured Tunnel User role. Both VMs are in the same project and have the same network tags. What is the most likely reason?

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

An organization uses Cloud DNS with a managed zone for example.com. They want to block or override DNS queries for a specific malicious domain (malware.com) to return a sinkhole IP address. Which Cloud DNS feature should they use?

An organization wants to mirror all traffic from a set of Compute Engine instances to a third-party IDS appliance running on a separate instance in the same VPC. The IDS appliance must receive a copy of both ingress and egress traffic without impacting production traffic. Which Google Cloud service should they use?

A company uses Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer needs to establish BGP peering between the on-premises router and Cloud Router. What must be created in Google Cloud to enable this?

A company needs to connect multiple on-premises sites to Google Cloud using a single Cloud VPN gateway. What is the recommended approach?

A team needs to perform a health check for a gRPC backend service. Which health check type should they use?

A team has deployed Compute Engine instances with internal IPs only. They need to allow these instances to download updates from specific external IP ranges. Which action should they take?

Match each VPC networking concept to its definition.

A company uses Shared VPC to grant separate teams access to subnets in a host project. They want to allow Team A to create VM instances in subnet-1, but not delete the subnet itself. Which IAM role should be granted to Team A on subnet-1?

A company has a VPC with three tiers: web, app, and db. They want to enforce that only the web tier can communicate with the app tier on TCP port 8080, and only the app tier can communicate with the db tier on TCP port 3306. All instances are in the same region but different subnets. Which TWO firewall rules should be created? (Choose 2.)

A company is deploying a hybrid cloud solution using Partner Interconnect. They have ordered a 1 Gbps connection from a partner at a colocation facility. The on-premises network uses a 10 Gbps link to the colo, and the partner provides a single 1 Gbps connection to Google Cloud. The company wants to connect two separate VPC networks in Google Cloud (production and development) to their on-premises network. Each VPC requires 500 Mbps of dedicated bandwidth. The company also needs high availability for the connection. What should they do?

Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

An organization needs low-latency connectivity between their on-premises data center and Google Cloud, supporting up to 20 Gbps throughput. They already have a Partner Interconnect connection but need to increase capacity. Which two actions should they take? (Choose two.)

Match each Google Cloud networking service to its primary function.

A network engineer needs to configure firewall rules to allow health checks from Google Cloud's health check systems to a backend service. Which two source IP ranges should they allow? (Choose two.)

A company uses Cloud Armor to protect its HTTP(S) load balancer. They need to block requests from a specific geographic region and also apply a rate limiting rule. What is the correct order of evaluation for Cloud Armor security policies?

A large enterprise uses hierarchical firewall policies across multiple VPCs. They have an organization policy that requires all VPCs to block SSH from the internet. However, a development team needs SSH from a specific external IP range for a building. How can they create a firewall rule that allows that range without violating the organization policy?

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth of at least 10 Gbps. Which connectivity option meets these requirements?

A company wants to load balance TCP traffic (non-HTTP) across a group of Compute Engine instances in a single region, while preserving the client IP address. They also need to support session affinity based on client IP. Which load balancer should they choose?

An organization wants to use Cloud DNS to resolve queries for a custom domain 'example.internal' across multiple projects in the same organization. They have a private zone in project A and want project B to be able to resolve records in that zone. Which feature should they use?

A network engineer is troubleshooting high latency between two VM instances in different GCP regions. Which TWO tools can help identify packet loss and latency issues? (Choose TWO.)

You need to configure firewall rules to allow HTTP (TCP 80) traffic from the internet to instances in a VPC. The instances are in different subnets and have a network tag 'web-server'. You want to minimize the number of rules. Which rule configuration is correct?

A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?

A company wants to route traffic to different backend services based on the geographic location of the client. Which Cloud DNS routing policy should they use?

A company is designing a hub-and-spoke VPC architecture in Google Cloud. The hub VPC hosts a set of shared services, including a third-party firewall appliance (NGFW) in a managed instance group behind a TCP load balancer. Spoke VPCs need to send traffic to the hub's internal TCP load balancer IP (10.0.0.10) for inspection. The firewall appliance inspects traffic and forwards it to the final destination. The network team notices that traffic from one spoke to the load balancer is being dropped. They have verified that VPC peering is established, routes are propagated, and firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

A security team wants to restrict which Google services can be accessed from their VPC without external IPs. They use Private Google Access. What should they use to block access to specific services?

A company has a VPC with subnet 10.1.0.0/24 in us-central1. They created a Cloud NAT gateway named 'nat-us-central1' attached to that subnet. During peak hours, many VM instances in the subnet cannot connect to the internet. The NAT configuration shows only one NAT IP. Firewall rules allow egress traffic, and health checks confirm the NAT gateway is functioning. What is the most likely cause of the failure?

A company needs to advertise a specific prefix from their on-premises network to GCP via Cloud Router. They do not want to advertise all connected networks. What should they configure on the Cloud Router's BGP peer?

A company has two Dedicated Interconnect connections from different metro areas to their GCP VPC. They want to use both connections actively (active-active load balancing) without manual intervention. Which TWO configurations are required to achieve this? (Choose two.)

Your company has a VPC with a single subnet in us-central1 (10.0.1.0/24). You have a managed instance group (MIG) of web servers (10.0.1.2-10.0.1.10) and a standalone database instance (10.0.1.100). The web servers need to communicate with the database on TCP port 3306. You have configured a firewall rule allowing ingress from 10.0.1.0/24 to 10.0.1.100 on tcp:3306. However, the web servers cannot connect to the database. You verified that the database is running and listening on port 3306, and that the web servers can ping the database. What should you do to resolve the issue?

A network engineer configured a hierarchical firewall policy at the organization level with a priority 100 rule that denies all ingress traffic. At the folder level, a policy with priority 110 allows ingress from a specific IP range. At the VPC level, a network firewall policy with priority 90 allows ingress from a different IP range. Which traffic will be allowed?

Which THREE of the following are benefits of using VPC Flow Logs?

A company is deploying a Dedicated Interconnect with a 10 Gbps circuit to Google Cloud. They need to ensure high availability. Which configuration is required by Google Cloud to meet the high availability SLA?

An organization is considering using Partner Interconnect to connect to Google Cloud. They want the service provider to manage the BGP sessions. Which TWO configurations must they choose? (Choose TWO.)

A company needs to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have a service level agreement that requires 99.99% availability for the connection. What is the minimum number of VLAN attachments they must provision, and how should they be configured to meet this SLA?

A company wants to protect its external HTTPS load balancer from SQL injection and cross-site scripting attacks. Which Google Cloud service should they use?

A network engineer is setting up a Dedicated Interconnect between an on-premises network and Google Cloud. After the circuit is ordered and the physical connection is established at the co-location facility, what is the first step to configure the interconnect inside GCP?

A startup is deploying its first application on Google Cloud and needs to create a VPC network. They want to avoid manual subnet planning and prefer that Google automatically creates subnets in each region as they expand. Which VPC type should they choose?

Your organization uses Cloud DNS for private DNS resolution within GCP. You need to enable on-premises DNS servers to resolve GCP private zone names (e.g., myinstance.internal.example.com). Which TWO resources must you configure? (Choose two.)

A startup is creating a new VPC for their production environment. They want to minimize management overhead and plan to use multiple regions. Which VPC type should they choose?

A company is setting up HA VPN between GCP and on-premises. They want 99.99% SLA. Which TWO configurations are required? (Choose 2)

An engineer configures an HA VPN with two tunnels to an on-premises network using IKEv2 and pre-shared keys. After configuration, the tunnels show as established, but no traffic flows. The Cloud Router BGP sessions are not established. The on-premises firewall logs show IKE packets are being sent but no response. What is the most likely cause?

An organization needs to restrict access to Google Cloud APIs such that only traffic from a specific set of VMs inside a VPC can reach the APIs, and all other traffic (including from other VPCs) must be denied. The VMs do not have external IPs. Which combination of services should they use?

You have set up a Dedicated Interconnect with two VLAN attachments (each 10 Gbps) and configured ECMP on the Cloud Router. You observe that traffic from on-premises to a specific VM is only using one attachment. What is the most likely cause?

When setting up a Partner Interconnect, which Google Cloud resource is used to connect to the partner's network?

Refer to the exhibit. A Cloud Router has two BGP sessions. The first session is UP, the second is DOWN. What is the most likely cause for the second session being down?

A company wants to analyze VPC Flow Logs to understand which external IPs are generating the most outbound traffic. What is the most scalable way to store and query these logs?

A company needs to connect their on-premises data center to Google Cloud using a VPN with high availability. They have two VPN appliances on-premises in different locations. What is the best design on the GCP side?

An organization wants to restrict data exfiltration from a GCP project. They need to prevent users from copying data to external cloud storage services like AWS S3, but allow access to Google Cloud Storage. Which VPC Service Controls (VPC-SC) configuration should they use?

What is the default Maximum Transmission Unit (MTU) for Compute Engine virtual machines?

You need to configure a health check for a backend service that uses HTTP2. Which THREE settings must be configured correctly for the health check to work? (Select three.)

A company is deploying a new application across three VPCs in the same project, using Shared VPC. The security team wants to restrict traffic such that only the frontend subnet (10.0.1.0/24) can send traffic to the backend subnet (10.0.2.0/24) on TCP port 8080. The backend instances have the service account 'backend-sa@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations achieve this goal?

A company uses Shared VPC to centralize network management. The host project contains subnets for production and development environments. Which two statements accurately describe the capabilities of Shared VPC? (Choose TWO.)

An engineer needs to plan IP address ranges for a new GCP environment that will connect to an on-premises network via Dedicated Interconnect. The on-premises network uses 10.0.0.0/8. The GCP VPC must support GKE pods and services and future expansion. Which THREE best practices should the engineer follow? (Choose three.)

Which TWO factors should be considered when selecting a Google Cloud region for deploying a globally distributed application to minimize latency for users?

An organization uses a hierarchical firewall policy at the organization level with a deny-all egress rule (priority 100). They also have a VPC-level firewall rule allowing egress to a specific external IP (priority 1000). Will traffic to that external IP be allowed?

A network engineer is troubleshooting connectivity between an on-premises network and Google Cloud. The on-premises router has two BGP sessions configured for redundancy with a Cloud Router. The engineer runs the command above. Which issue does the output indicate?

A company is designing a hybrid network using Dedicated Interconnect. They want to configure BGP for load balancing across multiple VLAN attachments. Which TWO statements are correct?

A company has a Dedicated Interconnect with one 10 Gbps connection. They need high availability for critical workloads. Which design is the best practice according to Google Cloud recommendations?

An organization needs to reduce egress costs for a global application serving users worldwide. The application serves static content from Compute Engine instances. Which action is most cost-effective?

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

Which TWO of the following methods can be used to encrypt traffic between VPC networks?

A company wants to establish a dedicated physical connection between their on-premises network and Google Cloud. They need a 10 Gbps connection and are willing to manage the circuit and colocation facility themselves. Which Google Cloud service should they use?

A company is experiencing a BGP session flap between Cloud Router and an on-premises router. Which THREE actions should the engineer take to diagnose the issue?

A company uses Identity-Aware Proxy (IAP) to secure access to a group of Compute Engine instances running a web application. The instances have no external IP addresses and are accessed via IAP TCP forwarding. Recently, the security team discovered that some users can access the instances directly via SSH from other instances within the same VPC, bypassing IAP. What is the most effective way to ensure all SSH access goes through IAP?

A company has VPC peering between two VPC networks. They want to ensure that traffic from VPC A to VPC B can use a custom route in VPC A that points to a next-hop appliance in VPC A. Which TWO conditions must be met?

An organization is using Cloud CDN to deliver content globally. Which of the following is a primary benefit of using Cloud CDN?

Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?

Refer to the exhibit. A VM with the 'ssh-allowed' tag is unreachable via SSH from the internet, while other VMs with the same tag work. What is the most likely cause?

An organization is designing a hybrid connectivity architecture using Cloud Router and BGP. They need to advertise a specific prefix from an on-premises network to GCP, and they want to control the route priority. Which two BGP features should they configure? (Choose TWO.)

A company is using Traffic Director with Envoy sidecars to manage traffic between microservices. They want to inject faults to test service resilience. Which Traffic Director feature should they use?

An organization needs to design a hybrid connectivity solution with 99.99% availability for a mission-critical application. They have a co-location facility near a GCP region. Which THREE components are required to meet this SLA?

An organization has a VPC with several subnets and wants to monitor firewall rule usage to identify rules that are overly permissive (e.g., allowing all traffic from 0.0.0.0/0). Which Google Cloud service provides this insight?

A company is using a global external HTTP(S) load balancer to serve traffic from multiple regions. They notice high egress costs for traffic served to users in Asia. What change could reduce costs?

A company wants to restrict access to Google Cloud APIs from a specific set of VMs based on the VM's service account. Which type of firewall rule target should be used?

A company is hitting the quota for number of firewall rules per VPC network. They need to add more rules without requesting a quota increase. Which approach can reduce the number of rules?

Which TWO of the following are benefits of using Cloud Interconnect over Cloud VPN for hybrid connectivity? (Choose two.)

A company's application requires TLS termination at the load balancer, with backend instances in multiple regions running on Compute Engine. The backend instances must see the original client IP address. Which load balancer should be used?

A startup is setting up their first GCP VPC. They want minimal manual configuration and need subnets in multiple regions. Which VPC creation mode should they use, and why?

A company has a Cloud VPN between their on-premises network and Google Cloud. They want to ensure that traffic flows symmetrically, meaning that traffic from Google Cloud to on-premises uses the same VPN tunnel as traffic from on-premises to Google Cloud. Which best practice should they implement?

A network engineer has configured a Dedicated Interconnect with a VLAN attachment and Cloud Router. BGP sessions are up and routes are exchanged. However, traffic from a specific on-premises subnet is not reaching a VPC instance. The route table shows a custom static route with priority 1000 for that subnet pointing to a VPN tunnel, and a BGP learned route with priority 100 for the same subnet via Interconnect. What is the most likely reason for the traffic not using the Interconnect route?

A company wants to allow on-premises DNS servers to resolve Google Cloud private VM names. They need to configure a Google-managed forwarding server IP. Which Cloud DNS feature should they use?

Which TWO configurations can enable VM instances without external IPs to access the internet? (Choose TWO.)

An organization needs to create a VPC that automatically creates subnets in every region as new regions become available. Which VPC type should they use?

A company is designing a Shared VPC environment with a host project and several service projects. Which two steps are required to allow a service project team to create Compute Engine instances with internal IP addresses from a shared subnet?

A Cloud VPN with dynamic routing (BGP) is established between an on-premises network and Google Cloud. The on-premises BGP router is advertising a default route (0.0.0.0/0). The Cloud Router in Google Cloud is receiving this route, but network traffic from Google Cloud VMs to the internet is not being routed through the VPN. Which THREE troubleshooting steps should you take? (Choose three.)

Which TWO are best practices for securing a VPC network? (Choose 2.)

A company uses Network Connectivity Center (NCC) to connect multiple on-premises sites and VPCs. They have a hub in us-central1 and spokes including two on-premises networks and three VPCs. Which two statements about NCC are accurate? (Choose TWO.)

A company currently uses Cloud VPN with dynamic routing to connect to Google Cloud. They want to migrate to Dedicated Interconnect without downtime. Which THREE steps should they take to achieve a seamless migration? (Choose three.)

Which THREE of the following are requirements for VPC Network Peering?

An organization has two VPCs, VPC-A and VPC-B, in the same project. They need to allow communication between instances in these VPCs without using the public internet. The solution must support dynamic routes and be non-transitive. What should they configure?

A network engineer is troubleshooting BGP route propagation between an on-premises network and a GCP VPC via Cloud Router. The on-premises router is advertising a specific subnet (10.1.0.0/16), but GCP is not receiving the route. Cloud Router BGP sessions are established. Which configuration could be the issue?

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

You need to invalidate Cloud CDN cached content for specific URLs after updating files in Cloud Storage. Which command should you use?

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

A network engineer wants to test whether a VM in VPC A can reach a VM in VPC B that is connected via VPC peering. The engineer suspects that firewall rules or routes are blocking traffic. Which Google Cloud service should they use to test the path and identify the blocking rule?

A company wants to protect its HTTP(S) Load Balancer against DDoS attacks and common web exploits like SQL injection and cross-site scripting. Which Google Cloud service should they use?

An organization uses HA VPN with dynamic routing and active-active BGP sessions. One tunnel fails, but traffic continues to flow through the other tunnel. However, they notice increased latency. What is the most likely explanation?

A global HTTPS load balancer is configured with a backend service that points to a serverless NEG for Cloud Run services. Some requests are failing with 502 errors. What is a likely cause?

A company wants to deploy a network appliance (e.g., firewall) on a Compute Engine instance that requires inspecting traffic between two VPCs. The instance must have interfaces in both VPCs. Which three configurations are required? (Choose three.)

A company wants to use Cloud DNS to resolve queries for a private zone (e.g., example.internal) from multiple VPCs in the same project. They need to ensure that instances in all VPCs can resolve the zone. What is the simplest approach?

A company is deploying a GKE cluster with Dataplane V2 and wants to enforce micro-segmentation using network policies. They also need to monitor policy violations. What should they do?

A network engineer is troubleshooting a failing HA VPN tunnel. They need to view VPN gateway logs to identify the issue. Which Google Cloud service should they use to access the logs?

A cloud engineer is configuring a Global External HTTPS Load Balancer with a backend service that targets a Cloud Run service via a serverless NEG. They want to enable Cloud CDN and set cache behavior to cache all responses regardless of origin headers. Which THREE steps are required? (Choose three.)

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

A company has a Global SSL Proxy Load Balancer handling HTTPS traffic. They want to offload SSL decryption to the load balancer and forward encrypted traffic to backends. Which backend protocol should they use?

A company has deployed a web application on Compute Engine instances in a VPC with subnet 10.1.0.0/20. The instances need to access an external API that whitelists IP addresses. The company uses Cloud NAT to provide outbound connectivity. The API integration tests are failing, and the operations team suspects that the source IP addresses seen by the API are not consistent. What is the most likely cause and solution?

A company uses Cloud CDN with an external HTTP(S) load balancer. They have two origin server groups: a primary in us-central1 and a backup in europe-west1. They want traffic directed to the primary unless it is unhealthy, in which case traffic should fail over to the backup. Which configuration is required?

Which Cloud DNS routing policy should you use to direct users to the nearest healthy backend based on their geographic location?

You need to distribute incoming TCP traffic to a set of Compute Engine instances in the same region while preserving the client IP address. The load balancer must be used for non-HTTP(S) workloads. Which load balancer should you choose?

A company wants to restrict access to Google Cloud Storage so that only traffic originating from a specific VPC network is allowed. They also need to prevent data exfiltration to other VPCs. Which two services should they use? (Choose two.)

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.0.0.0/16). They want to establish VPC Network Peering between them. What is the outcome?

A network engineer runs the gcloud command above for a Cloud NAT configured in us-central1. The VPC has 20 instances without external IPs in us-central1. They notice that only three instances have NAT mappings displayed. What could explain this?

A company needs to ensure that all traffic between GCP VMs in different regions is encrypted in transit. What is the recommended approach?

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They have two VLAN attachments (vlan-100 and vlan-200) connected to two separate Cloud Routers in the same region. Each Cloud Router has a BGP session with the on-premises router. The on-premises router advertises the same prefixes (10.0.0.0/8) over both sessions. In Google Cloud, they have workloads in two different VPCs: VPC-A and VPC-B. They want traffic to VPC-A to use vlan-100, and traffic to VPC-B to use vlan-200. Cloud Router 1 is attached to VPC-A, Cloud Router 2 is attached to VPC-B. Currently, traffic from on-premises to VPC-A sometimes goes through vlan-200, causing asymmetric routing. What configuration change should they make to ensure traffic is symmetric?

A large enterprise has two on-premises data centers (DC1 and DC2) connected to Google Cloud via two separate VPN tunnels to the same VPC. Each tunnel terminates on a different Cloud VPN gateway (gateway1 in us-east1, gateway2 in us-west1). The on-premises routers advertise the same CIDR 172.16.0.0/12 from both DCs. Cloud Router is configured with BGP and uses default route priority. You notice that after a failover event where one tunnel goes down, traffic continues to flow, but there is a significant increase in latency for traffic coming from GCP to on-premises. You verify that both tunnels have re-established. What is the most likely cause of the increased latency?

A company has a single VPC with subnets in us-central1 and europe-west1. They have Compute Engine instances in both subnets that need to communicate with each other. The security team wants to ensure that only specific instances in us-central1 can connect to a database instance in europe-west1 on port 3306. Currently, the default firewall rules allow all internal traffic (priority 65535). The network engineer first creates a new ingress firewall rule to allow TCP traffic on port 3306 from instances with the network tag 'app' to instances with the tag 'db', with priority 1000. Then, to enforce the restriction, they delete the default allow internal rule (priority 65535). However, after applying the changes, the app instances (tagged 'app') in us-central1 cannot connect to the database instance (tagged 'db') in europe-west1. The engineer verifies that the tags are correctly applied to the instances. What is the most likely cause of the connectivity failure?

A company is using Traffic Director with Envoy sidecars. They want to enable mutual TLS (mTLS) between services. Which two steps are required? (Choose two.)

An engineer needs to provide outbound internet access to a set of Compute Engine instances that do not have external IP addresses. The instances are in a VPC subnet with a Cloud NAT configured. However, the instances still cannot reach the internet. The engineer verified that Cloud NAT is configured on the same region and VPC as the instances. What is the most likely cause?

A company wants to set up a hybrid network with HA VPN between an on-premises network and GCP. They need a 99.99% SLA. Which THREE conditions must be met to achieve this SLA?

A company wants to use Cloud Armor to block traffic from a specific IP range (198.51.100.0/24) and also apply rate limiting. Which TWO components are needed? (Select 2)

A company has a VPC with a subnet in us-central1. Compute Engine instances in that subnet have no external IPs but need to reach the internet for software updates. The engineer configured Cloud NAT with the default settings. However, instances fail to reach the internet. What is the most likely cause?

Match each Cloud Load Balancing type to its description.

A company is using Cloud Interconnect with multiple VLAN attachments. They want to implement traffic shaping to prioritize real-time traffic over bulk transfers. Which THREE actions should they take?

A company needs private connectivity between its on-premises data center and Google Cloud with consistent low latency and high throughput. The on-premises location is close to a Google Cloud point of presence that supports Dedicated Interconnect. The company expects to use more than 10 Gbps of bandwidth in the near future. Which connectivity solution should they choose?

An organization has multiple VPCs in a Shared VPC setup. They want to allow only certain service projects to use a specific subnet in the host project. What should they configure?

A developer wants to create a GKE cluster with a separate subnet for pods and services to avoid IP address exhaustion. What type of secondary IP ranges should they configure on the VPC subnet?

An organization wants to allow only certain users to access a service published via Private Service Connect. They need to restrict access based on the source VPC network. What should they use?

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

A company wants to serve static content from a Cloud Storage bucket and dynamic content from Compute Engine VMs behind a single external URL. Which GCP feature allows this configuration?

Which TWO considerations are important when designing a VPC peering strategy between multiple projects in Google Cloud?

A company is using Partner Interconnect with a service provider that offers Layer 3 connectivity. The service provider manages the BGP sessions. The engineer needs to create a VLAN attachment on the Google side. Which attachment type should they choose?

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

An engineer is configuring Dedicated Interconnect between an on-premises data center and Google Cloud. Cloud Router is set up with BGP sessions. The BGP session remains in Idle state. Which of the following is the most likely cause?

An organization has a VPC with multiple subnets. They want to log all outbound connections from instances to the internet for compliance. They also want to use a cost-effective solution that doesn't require a proxy. Which three components are needed? (Choose three.)

An organization uses Cloud CDN to serve static content from a backend bucket. They want to ensure that content is always served from the edge regardless of cache-control headers from the origin. Which cache mode should they set?

A company has a VPC with subnets in us-central1 and europe-west1. They create a Private Service Connect endpoint for a managed service in us-central1. Can Compute Engine instances in europe-west1 access the endpoint?

A company has a Hybrid Connectivity setup using Cloud VPN with BGP. They want to migrate to Dedicated Interconnect for better performance. During the migration, they need to avoid downtime. Which THREE steps should they take?

A network engineer wants to see a real-time graphical representation of the topology of their VPC network, including instances, subnets, and load balancers. Which Network Intelligence Center tool should they use?

A developer needs to create a GKE cluster that uses a secondary IP range for pods and another for services. During VPC subnet creation, they set a primary IP range and two secondary ranges. Which flag must be used when creating the subnet to specify the pods range?

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

A company wants to forward DNS queries from their on-premises network to Google Cloud for resolution of private zone names. Which configuration is required?

An engineer is troubleshooting outbound connectivity from a Compute Engine instance that has no external IP. The instance needs to reach an external service on the internet. Cloud NAT is configured on the VPC network. However, the instance cannot connect. What is the most likely cause?

A security team wants to enforce a policy that blocks all egress traffic to the internet from a specific set of VMs across multiple projects in an organization. The policy should be centrally managed and override VPC-level firewall rules. Which approach should they use?

A company is using Partner Interconnect to connect their on-premises network to Google Cloud. They need to choose between Layer 2 and Layer 3 connectivity options offered by the service provider. Which statement correctly describes the difference between Layer 2 and Layer 3 connectivity in Partner Interconnect?

A network engineer is setting up HA VPN between an on-premises network and a GCP VPC. They have configured two Cloud VPN gateways in GCP, each with two interfaces, and four tunnels. They are using BGP with Cloud Router. However, only one of the four tunnels is established. What is the most likely cause?

A company is using Partner Interconnect with a 2 Gbps VLAN attachment. They notice that throughput is only about 500 Mbps during peak hours. They have verified that the on-premises link is not saturated. What is the most likely cause?

A company uses VPC Flow Logs for traffic analysis. They notice that logs are missing for a specific Compute Engine instance that handles high traffic. The subnet has Flow Logs enabled. What is the most likely reason?

Which THREE components are required to set up Identity-Aware Proxy (IAP) for TCP forwarding to a VM?

A financial services company is deploying a new payment processing application in Google Cloud. The architecture consists of: a VPC named 'payment-vpc' with subnet 'payment-subnet' (10.1.0.0/16), a managed instance group (MIG) of backend servers in payment-subnet, an internal TCP load balancer (ILB) with IP 10.1.0.10 distributing traffic to the MIG, and a Cloud NAT for outbound internet access. The application must communicate with an external payment gateway over TLS. The security policy requires that all outbound traffic from the backend servers to the internet must egress through a single, centralized Cloud NAT instance to allow traffic inspection. To meet this requirement, the network team has configured: a Cloud Router, a Cloud NAT gateway named 'payment-nat' in payment-vpc, and a default route (0.0.0.0/0, next hop: default internet gateway) in payment-vpc. They have also configured VPC firewall rules to allow outbound HTTPS traffic. During testing, the backend servers cannot connect to the external payment gateway. The team has verified that the Cloud NAT is properly configured and that the VPC firewall rules allow egress traffic. What is the most likely cause of the connectivity failure?

An organization needs to route traffic to a group of Compute Engine VM instances in the same zone for a high-throughput TCP application. The solution must preserve the client source IP address and support connection draining. Which load balancer type meets these requirements?

A company is using Cloud Router with BGP for connectivity to an on-premises network via Partner Interconnect. The BGP session is flapping. Which THREE actions should the engineer take to diagnose the issue?

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They want to prioritize traffic from on-premises to GCP over one VPN tunnel when multiple tunnels are available. Which BGP attribute should they configure on their on-premises router?

An on-premises DNS server is configured to forward queries for a private zone in GCP. They set up inbound DNS forwarding from on-prem to GCP using Cloud DNS forwarding. What must be configured on the VPC?

Which TWO of the following are required steps to set up a Dedicated Interconnect?

A company runs a Kubernetes cluster on GKE with a VPC-native cluster (alias IP ranges). They have pods that need to communicate with on-premises services via a Cloud VPN tunnel. Which networking configuration is required to enable pod-to-on-premises communication?

You need to allow instances with network tag 'db' in subnet-a to only accept connections on TCP port 3306 from instances with network tag 'app' in subnet-b. Which TWO firewall rules should you create? (Choose 2)

A company is deploying an internal HTTP application on Compute Engine instances. The application must be load-balanced across multiple instances in different regions, but only accessible from within the same VPC. Which load balancer type meets these requirements?

An organization is deploying a Global HTTPS Load Balancer with Cloud Armor and Cloud CDN. They want to ensure that only requests with a valid signed cookie can access private content. Which three steps are required? (Choose THREE.)

A company wants to analyze firewall rule effectiveness by identifying rules that are never hit or are shadowed. Which Network Intelligence Center tool should be used?

A company is designing a hybrid connectivity solution between an on-premises data center and Google Cloud. They have a high bandwidth requirement of 20 Gbps and need a service level agreement (SLA) of 99.99% availability. Which connectivity option should they choose?

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They have deployed Compute Engine instances that need to communicate with an on-premises database via a Cloud VPN tunnel using BGP. The on-premises network advertises the database subnet 192.168.0.0/16. The instances can reach the database for a few minutes after reboot, but then connectivity drops. The Cloud VPN logs show no errors. The BGP session remains established. What is the most likely issue?

A company needs to connect multiple on-premises sites and cloud VPCs in a hub-and-spoke topology using a fully managed service. Which Google Cloud service should they use?

A company has a Cloud VPN tunnel to on-premises. They want on-premises clients to resolve private DNS names in the VPC. Which service should they configure?

An engineer needs to configure a Cloud Router for a VPN tunnel to an on-premises network. The on-premises BGP ASN is 64512. Which ASN should the engineer assign to the Cloud Router?

A Dedicated Interconnect VLAN attachment is in ACTIVE state. The Cloud Router has learned routes from on-premises, and the on-premises router has learned routes from GCP. However, traffic from on-premises to a GCP VM fails. What should the engineer check first?

Which TWO statements about HA VPN are correct?

An organization uses Cloud DNS with a managed zone for internal resolution. They want to implement a failover routing policy so that if the primary health-checked endpoint is unhealthy, traffic is directed to a secondary endpoint. Which THREE steps are required? (Choose three.)

An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?

An engineer needs to set up a firewall rule that allows health check probes from Google Cloud's health check ranges (130.211.0.0/22 and 35.191.0.0/16) to a backend instance group. The rule should apply only to instances with the 'backend' network tag. What is the correct configuration?

An organization wants to connect multiple on-premises sites to multiple VPCs in GCP using a hub-and-spoke model. Which GCP service provides a centralized hub for managing such connectivity?

An engineer runs 'gcloud compute networks peerings list' and sees state 'INACTIVE' for a peering connection. Which is the most likely cause?

You are configuring Cloud Router for BGP sessions with an on-premises router. You need to ensure that the on-premises network can reach Google Cloud services using the advertiser’s IP addresses. Which option should you configure on the Cloud Router?

Which THREE components are required when configuring an internal TCP/UDP load balancer? (Choose THREE.)

Which THREE factors can affect the throughput of a Cloud VPN tunnel? (Choose three.)

You are deploying a new internal HTTP(S) load balancer for a microservice that runs on Compute Engine instances within the same region. The load balancer must be accessible only from within the VPC network. Which components are required? (Choose two.)

Which TWO network services can be used to provide secure connectivity between a VPC and an on-premises data center without traversing the public internet? (Choose two.)

A network engineer notices unexpected traffic being allowed through a VPC firewall rule. They want to analyze the logs to identify the source and destination. What is the best way to enable detailed logging for firewall rules?

A network engineer is configuring a Cloud Router for BGP peering with an on-premises router over a VPN tunnel. The on-premises router uses 169.254.x.x link-local addresses. Which BGP peer IP should the engineer use in the Cloud Router configuration?

A company wants to serve private content over Cloud CDN with access control. They need to generate time-limited URLs that allow users to download files from Cloud Storage. Which TWO methods can they use? (Choose two.)

A security team wants to capture and analyze all DNS queries from their Compute Engine instances to detect potential data exfiltration. They have enabled VPC Flow Logs. Which TWO additional steps should they take to capture DNS query details?

A company is planning IP address ranges for a new VPC that will be peered with an existing VPC (10.1.0.0/16) and connected to an on-premises network (172.16.0.0/12). Which three considerations should they follow to avoid IP overlap? (Choose THREE.)

An organization needs to connect two VPCs in different projects so that all subnets can communicate using internal IPs, but the connection must not be transitive (i.e., VPC A cannot use VPC B's connection to reach VPC C). Which GCP networking feature should they use?

A company is designing a hybrid network using HA VPN with two external IP VPN gateways and four IKEv2 tunnels with BGP dynamic routing. They want to maintain connectivity during a zonal failure. What is the minimum number of Cloud VPN gateways needed in GCP?

A company wants to connect two VPCs in the same region so that they can communicate using internal IP addresses without transiting the internet. They have no overlapping IP ranges. Which GCP networking feature should they use?

A company requires a dedicated connection from their on-premises data center to Google Cloud with a guaranteed SLA of 99.99% and bandwidth starting at 10 Gbps. Which connectivity option meets these requirements?

A company has an on-premises data center connected to Google Cloud via Dedicated Interconnect. They have a VPC with subnets in us-central1 and us-west1. They want compute instances in us-central1 to access Google APIs (e.g., Cloud Storage) without traversing the internet, but the on-premises network must also be able to access those APIs via the interconnect. They have configured Private Google Access (PGA) on all subnets. However, on-premises users report that they cannot access Cloud Storage buckets using the private IP of a forward proxy in us-central1 (the proxy is configured to use the default internet gateway for egress). What is the most likely reason?

Your organization has a site-to-site Cloud VPN connection between an on-premises network with CIDR 10.0.0.0/8 and a VPC in us-central1 with subnet 192.168.1.0/24. The VPN tunnel is established, but you cannot reach a Compute Engine instance with internal IP 192.168.1.10 from a server on-premises with IP 10.0.0.50. Cloud VPN logs show no errors. On-premises firewall rules allow all outbound traffic. What is the most likely cause of the problem?

A small company is moving their on-premises application to Google Cloud. They have a single on-premises office with a small router that supports IPsec VPN. They need a simple and low-cost connectivity solution that provides encryption and a consistent experience. They anticipate low bandwidth needs (under 100 Mbps). They also want the ability to use BGP for dynamic routing to avoid manual route updates. Which Google Cloud service should they use?

An engineer wants to allow traffic from a specific service account to a Compute Engine instance. Which firewall rule option should they use for the source?

A developer wants to allow HTTP (port 80) traffic from the internet to a set of Compute Engine instances that have a tag "web-server". Which firewall rule should they create?

A company is planning a hybrid cloud architecture with GCP. They need a dedicated, high-bandwidth connection from their on-premises data center to GCP with 99.99% SLA and the ability to scale beyond 10 Gbps. Which connection type should they choose?

An organization wants to allow on-premises hosts to connect to a Cloud SQL instance privately without traversing the public internet. They have a Cloud VPN tunnel set up. What additional step is required?

To enable DNSSEC for a Cloud DNS managed zone, what must be configured?

A DevOps team is configuring a VPC with a subnet in us-east1. They need to allow a specific VM (source IP 10.0.1.2) to access a database VM (destination IP 10.0.2.3) on port 3306, but only from that specific source. All other traffic should be denied. Which firewall rule configuration should they use?

An organization wants to connect their on-premises network to Google Cloud using a Dedicated Interconnect. They have ordered a circuit from a network service provider and need to determine the correct co-location facility to connect to. Which factor is most critical when selecting a co-location facility?

A network engineer is setting up Dedicated Interconnect and sees the output above. What does the 'encryption: IPSEC' field indicate about this VLAN attachment?

A company uses Shared VPC with multiple service projects. The network admin wants to restrict access to certain Compute Engine instances so that only specific service accounts can SSH into them. What is the best practice to achieve this?

A company wants to resolve DNS queries for a private zone (e.g., example.internal) from multiple service projects using the same host project's Cloud DNS private zone. Which feature should they use?

A multinational corporation has deployed a multi-region application on Google Kubernetes Engine (GKE) clusters in us-central1 and europe-west1. The application serves global users and requires low-latency access to a shared database hosted on Cloud SQL in us-central1. The network team has configured Cloud VPN tunnels between each region and the on-premises data center for administrative access. The application instances in europe-west1 are experiencing high latency when connecting to the Cloud SQL instance in us-central1. The team wants to reduce latency without migrating the database. The team has already verified that the Cloud SQL instance has private IP enabled and is peered to a shared VPC that spans both regions. The GKE clusters are in the same shared VPC. What should the team do?

A company is setting up HA VPN between GCP and an on-premises network. They need to configure two VPN tunnels for high availability. Which of the following is required for the HA VPN gateway?

A company has enabled VPC Flow Logs on a subnet with the default sample rate. They notice that only 50% of flows are being logged. What is the most likely reason?

A security team wants to capture all traffic from a Compute Engine instance for intrusion detection. Which service should be used to copy traffic to a third-party IDS appliance running on another instance?

A company has multiple on-premises networks connected to a Cloud VPN hub in GCP. Each on-premises site uses BGP to advertise its prefixes. The security team wants to ensure that only specific prefixes from each site are accepted into the VPC routes. What should they configure?

A company is designing IP address plans for multiple VPCs that will be connected via VPC Network Peering and to an on-premises network via HA VPN with dynamic routing. Which three practices should be followed to avoid IP address conflicts?

Which TWO situations are most appropriate for using Partner Interconnect instead of Dedicated Interconnect?

A developer wants to create a VM that can communicate with all Google APIs without requiring an external IP address. Which configuration is necessary?

An engineer configures a Cloud Router with BGP to advertise a custom learned route for 10.0.0.0/8 to an on-premises router. The on-premises router also receives the same prefix from another path with a lower MED. Which route will the on-premises router prefer?

A company uses Shared VPC with multiple service projects. They need to allow certain service projects to create internal load balancers (ILBs) that are accessible from all projects in the organization. What is the best practice?

A company wants to create a new VPC for a production environment. They need predictable IP addresses and want to avoid any automatic subnet creation. Which type of VPC should they use?

A network engineer configured a Cloud Router with the BGP configuration shown. The on-premises router (AS 64512) is peering with the Cloud Router (AS 65001) over a Dedicated Interconnect VLAN attachment. The engineer notices that traffic from on-premises to Google Cloud is not being routed via this interconnect as expected. What is the most likely cause?

A network engineer is designing a Google Cloud network for a financial services company that requires strict compliance with PCI DSS. They need to isolate development, staging, and production environments. Which approach should they use to meet these requirements?

A company has a VPC with multiple subnets. They want to restrict traffic between two specific subnets (10.0.1.0/24 and 10.0.2.0/24) while allowing all other traffic. They create a firewall rule with priority 1000 denying ingress from 10.0.1.0/24 to 10.0.2.0/24. However, traffic is still allowed. What is the most likely reason?

An organization has multiple VPCs in different projects that need to share subnets to create a common network segment. They want central control over network administration while allowing individual project teams to deploy resources. Which approach should they use?

Refer to the exhibit. An engineer has configured HA VPN with two tunnels (tunnel-a and tunnel-b) to an on-premises network. The BGP session for peer-b is in IDLE state. What is the most likely cause?

An engineer is configuring a Global HTTPS Load Balancer with a serverless NEG pointing to Cloud Run. The deployment fails with a health check error. What is the most likely cause?

A company wants to connect its on-premises data center to Google Cloud. They have a single VPN appliance on-premises and need high availability for the connection. Which architecture provides the most cost-effective high availability solution?

An organization has two VPC networks in different Google Cloud organizations. They need to allow private IP communication between instances in these VPCs without using public IPs or VPNs. Which solution should they use?

A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC flow logs show traffic being dropped. Firewall rules are correctly configured. Which TWO actions should the engineer take to identify the cause?

A company has Compute Engine instances without external IP addresses that need to access external APIs. The instances are in multiple zones within a region, and each zone has a subnet. The company wants a cost-effective and highly available solution that does not require manual failover. What should they do?

Refer to the exhibit. A company uses a Cloud Router with two BGP sessions for an HA VPN to on-premises. Traffic is not flowing correctly to the on-premises network. What is the most likely issue?

An engineer is troubleshooting a VPC Network Peering connection between VPC-A and VPC-B. They have verified that the peering is active. However, an instance in VPC-A cannot reach an instance in VPC-B using its internal IP. Both VPCs have firewall rules allowing the traffic. What is the most likely cause?

A company has two VPC networks (VPC-A and VPC-B) in the same project. They are connected via VPC peering. VPC-A contains an internal TCP load balancer with IP 10.1.2.3 serving on port 80. VPC-B needs to access this load balancer. The network engineer has verified that the firewall rules allow traffic from VPC-B to the load balancer's IP and port. However, instances in VPC-B cannot connect to 10.1.2.3:80. What is the most likely reason for this failure?

A company uses Cloud VPN with dynamic routing (BGP). The on-premises network advertises a prefix that overlaps with a subnet in the VPC. Which TWO actions can resolve this conflict? (Choose TWO.)

An organization wants to connect two VPCs in different projects so that they can communicate using private IPs. The connection must not be transitive. Which solution meets these requirements?

Which TWO configurations provide high availability for Dedicated Interconnect? (Choose two.)

Which THREE statements about VPC Flow Logs are correct?

A company is designing an HA VPN to connect their on-premises data center to Google Cloud VPC. The on-premises router supports two independent interfaces with public IPs. They want to achieve 99.99% availability for the VPN connection, understanding that HA VPN uses two tunnels and two Cloud Router instances. Which configuration meets this goal?

An organization has multiple VPCs in different projects that need to resolve DNS names across projects. They want to use Cloud DNS without creating a separate managed zone for each VPC. Which feature should they use?

A company wants to allow traffic to a specific set of Compute Engine instances only from a single management instance that uses a service account. The management instance has the service account 'sa-mgmt@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations can achieve this? (Choose TWO.)

A company has a VPC with a single subnet in us-central1 (10.0.0.0/24). They have a Compute Engine instance running a database that uses an internal IP address 10.0.0.10. They need to ensure that this database instance can be accessed by a legacy on-premises application via a Cloud VPN tunnel. The on-premises network uses 192.168.0.0/16. They have set up a HA VPN gateway with two tunnels and BGP routing. The Cloud Router is configured to advertise the subnet 10.0.0.0/24. On the on-premises side, the router receives the route for 10.0.0.0/24 and has a static route for 10.0.0.0/24 pointing to the VPN tunnel. However, the on-premises application cannot reach the database. The application's server can ping the on-premises gateway, but not the database IP. The database instance's OS firewall allows all traffic from 0.0.0.0/0. What is the most likely cause?

A network engineer is designing a VPC in Google Cloud with multiple subnets across different regions. The application requires low-latency communication between instances in the same region but not across regions. Which VPC network configuration should be used?

Which GCP service provides a dedicated, low-latency connection from an on-premises data center to Google Cloud?

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Match each Cloud DNS record type to its use.

A network engineer is configuring Cloud Router for Dedicated Interconnect. The on-premises router is advertising a route to 10.1.0.0/16. The engineer wants to ensure that Google Cloud always prefers this route over other routes learned from different on-premises routers. Which BGP attribute should be set on the on-premises router?

Which Google Cloud hybrid connectivity option can be configured without using BGP?

A network engineer is using Connectivity Tests to diagnose a reachability issue between two instances in the same VPC but different subnets. The test indicates that traffic is denied by firewall rules. However, the engineer cannot find any firewall rule denying the traffic. What is a possible explanation?

An enterprise is using a 10 Gbps Dedicated Interconnect between their on-premises data center and Google Cloud. They measure throughput and find it is only 5 Gbps even though there is no congestion. The on-premises router is configured with a single VLAN attachment. What is the most likely cause?

An engineer needs to provide outbound internet access to a set of Compute Engine instances that have only internal IP addresses. The instances must use a static IP address for outbound traffic. Which solution should they implement?

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

A network engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but different subnets (us-east1 and europe-west1). The engineer suspects an MTU issue. What is the default MTU for traffic within Google Cloud, and what MTU should the engineer expect when packets traverse the internet?

A developer needs to create a subnet for GKE pods that will be used by a cluster. They need to specify a secondary IP range for pods. What is the purpose of the 'purpose' field when creating a subnet?

A company needs to cache API responses that are dynamic but cacheable for short periods. They want to use Cloud CDN with a Global HTTPS Load Balancer. Which three settings should they configure?

A team is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They need to set up BGP sessions. Which of the following is a required parameter when creating a BGP peer on the Cloud Router?

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

A network engineer is designing a hybrid cloud architecture connecting an on-premises data center to Google Cloud via Dedicated Interconnect. The on-premises network uses BGP for dynamic routing. The engineer needs to configure Cloud Router to exchange routes with the on-premises router. Which two configuration steps are required? (Choose two.)

A developer wants to use Cloud CDN to cache static assets from an external origin (not a GCP bucket). Which backend type supports this?

A company has two VPC networks in the same project: Network A (hosting a private zone for 'example.internal.') and Network B. They are connected via VPC peering. The network engineer created a DNS peering zone in Network B for 'example.internal.' pointing to Network A. However, instances in Network B cannot resolve 'host.example.internal.' which is defined in Network A's private zone. The engineer verified that the peering zone is active and the networks are properly peered. What is the most likely reason for the resolution failure?

An organization needs to distribute incoming traffic across multiple GCE instances in the same region while preserving the client IP address. Which load balancer should they use?

A company wants to ensure that only traffic from specific source IP ranges can reach a Cloud Load Balancer. How should they enforce this?

A company uses Traffic Director with Envoy sidecars to manage traffic in their service mesh. They want to perform canary deployments where 10% of traffic goes to the new version and 90% to the stable version. Which TWO Traffic Director resources should they configure? (Choose two.)

A company wants to run a DNS resolution service for their hybrid cloud environment. They need on-premises servers to resolve GCP private VM hostnames, and GCP VMs to resolve on-premises hostnames. Which Google Cloud service should they use?

A company uses Cloud NAT to allow private instances to reach the internet. They notice that egress traffic from Compute Engine VMs is intermittently failing. The VMs are in us-central1-a and use the default VPC network. Cloud NAT is configured with a single NAT IP address. What is the most likely cause?

A startup is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose a service to the internet using a load balancer that provides SSL termination and supports WebSocket. Which type of Service should they use?

Which Google Cloud service provides a managed Envoy proxy control plane for traffic management, including traffic splitting and fault injection, in a service mesh?

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

You need to create a DNS routing policy that routes users in Europe to one IP and users in Asia to a different IP, with a fallback to a default IP if no match. Which THREE elements are required? (Choose 3)

A company is creating a new VPC to host a set of microservices on Compute Engine. The network architect wants to minimize operational overhead and allow automatic subnet creation as new regions are added. Which VPC mode should be used?

A company has Compute Engine instances without external IPs in a VPC. They need to reach Google APIs such as Cloud Storage and BigQuery. Which configuration will meet this requirement with minimal cost and operational overhead?

A company needs to resolve DNS queries from their Google Cloud VPC for on-premises hostnames (e.g., internal.mycompany.com). They have a Cloud VPN tunnel between GCP and on-premises. Which approach should they use?

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

A company wants to enforce that all HTTPS load balancer traffic uses TLS 1.2 or higher. Which Google Cloud resource should they configure?

A company uses Shared VPC. They want to restrict which service project's VMs can use a specific subnet. Which TWO methods can achieve this? (Choose TWO.)

A company has an external HTTP(S) load balancer with a backend service pointing to an instance group in us-east1. They enable Cloud CDN to improve performance for global users. After enabling, they observe that users in Asia still experience high latency. They verify that the backend instances respond with Cache-Control headers that allow caching. What is the most likely reason for the high latency?

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Which THREE statements about Shared VPC are correct?

You need to monitor the health and performance of a Dedicated Interconnect connection. Which THREE Cloud Monitoring metrics should you use? (Choose three.)

A company has a VPC with subnets in us-east1 and europe-west1. They have deployed a global external HTTP(S) load balancer with backend services in both regions. Users in Europe report high latency. What is the most likely cause?

A company uses Cloud NAT to enable outbound connectivity for private VMs. They notice that some VMs are not able to reach a specific external IP range. The VMs have no tags or service accounts. What is the most likely cause?

A security engineer wants to allow SSH access to a VM that has no external IP. The VM is in a VPC with IAP configured. What is the simplest way to enable secure SSH without a bastion host?

Refer to the exhibit. A VM in the default VPC with an internal IP 10.0.1.2 tries to SSH (tcp:22) from a host at 10.0.2.5. What is the result?

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

An organization wants to reduce egress costs for data sent from Compute Engine instances to users worldwide. Which TWO approaches should they consider? (Choose TWO.)

A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)