Courseiva

CCNA Implementing a Virtual Private Cloud Questions

70 questions · Implementing a Virtual Private Cloud · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecthard

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Select 3 answers
A.Cloud NAT can be configured per subnet or per region.
B.Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.
C.Cloud NAT automatically assigns external IP addresses to instances.
D.Cloud NAT can be configured with a manual list of NAT IP addresses.
E.Cloud NAT supports both TCP and UDP protocols.
AnswersB, D, E

Without a default route, traffic cannot reach the internet.

Why this answer

Options B, D, and E are correct. Option B: Cloud NAT requires a default route (0.0.0.0/0) pointing to the internet gateway to forward traffic. Option D: You can specify a manual list of NAT IP addresses (static external IPs) for Cloud NAT to use.

Option E: Cloud NAT supports both TCP and UDP protocols for outbound connections. Option A is incorrect because Cloud NAT is configured per region, not per subnet; it applies to all subnets in the region that are enabled for NAT. Option C is incorrect because Cloud NAT does not assign external IPs to instances; it provides NAT for instances without external IPs.

Practice this question →
2
MCQmedium

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

A.The subnet routes are exported from VPC-B to VPC-A.
B.The BGP session status on the Cloud Router.
C.The MTU size of the instances.
D.The route tables for the peered network.
AnswerA

Correct. Subnet routes must be exported from VPC-B to VPC-A for peering to work. If not exported, instances in VPC-A cannot reach VPC-B.

Why this answer

VPC Network Peering requires that subnet routes be exported from the peered VPC. By default, subnet routes are automatically exported, but if the peering configuration was modified (e.g., exportSubnetRoutesWithPublicIp set to false), routes may not be exported. The engineer should verify that VPC-B exports its subnet routes to VPC-A.

Option B is incorrect because BGP is not used in VPC peering; Cloud Router is used for Cloud VPN or Dedicated Interconnect, not peering. Option C is incorrect because MTU mismatch is unlikely to cause complete lack of connectivity. Option D is incorrect because the route tables themselves are not the issue; the missing routes are due to export settings, not the presence of route tables.

Practice this question →
3
MCQmedium

A company needs to connect on-premises to Google Cloud with overlapping IP ranges. The on-premises network uses 10.0.0.0/16 and the VPC uses 10.0.0.0/16. What is the best approach?

A.Use Cloud NAT.
B.Use VPC peering.
C.Use Private Google Access.
D.Use Cloud VPN with source NAT on the on-premises side.
AnswerD

Source NAT allows overlapping IPs by translating them.

Why this answer

Cloud VPN with source NAT on the on-premises side translates overlapping addresses.

Practice this question →
4
MCQmedium

Refer to the exhibit. You have two VPCs, vpc-a and vpc-b, with VPC peering configured and custom route import/export enabled. An instance in subnet-a (10.0.1.2) cannot ping an instance in subnet-b (10.0.2.2) using internal IP. Firewall rules are default (deny all ingress). What is the required action?

A.Add a firewall rule allowing ICMP from 10.0.1.0/24 to 10.0.2.0/24.
B.Add a static route for the peer range.
C.Enable Private Google Access.
D.Create a Cloud VPN tunnel.
AnswerA

This rule allows the ping traffic between the subnets.

Why this answer

Even with peering, firewall rules are needed to allow traffic. Default deny all ingress blocks the ping.

Practice this question →
5
MCQmedium

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

A.Assign external IPs to non-NAT instances.
B.Use firewall rules to allow NAT for tagged instances.
C.Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.
D.Create separate subnets for NAT instances.
AnswerC

This is the standard method to select which instances are NATed.

Why this answer

Cloud NAT uses network tags to filter which instances use it.

Practice this question →
6
MCQhard

A large enterprise has a Google Cloud environment with multiple projects under an organization. They have a Shared VPC host project with a VPC named 'shared-vpc' that has subnets in us-central1 and europe-west1. Several service projects are attached to this host project. One service project, 'proj-analytics', has a Compute Engine instance 'vm-analytics' in us-central1 that needs to connect to a Cloud SQL PostgreSQL instance (private IP) also in us-central1, but within a different service project 'proj-db'. The Cloud SQL instance is configured with a private IP address 10.0.1.5 from a subnet in 'shared-vpc' (the same VPC). The vm-analytics instance has an internal IP 10.0.0.5 from a different subnet in 'shared-vpc'. The two subnets are in the same region, and there is a firewall rule allowing all traffic from 10.0.0.0/16 (the entire VPC range) to the Cloud SQL subnet. However, vm-analytics cannot connect to the Cloud SQL instance. The error on vm-analytics is 'Connection timed out'. There are no firewall rules blocking egress from vm-analytics. What is the most likely cause and solution?

A.Grant the service project's compute engine default service account the Compute Network User role on the host project.
B.Enable Private Google Access on the vm-analytics subnet.
C.Create a firewall rule in the host project allowing ingress from the service project's subnets to the Cloud SQL subnet.
D.Configure a Cloud Router in the service project to advertise routes to the Cloud SQL subnet.
AnswerA

Without this role, the service project's instances cannot use the VPC resources, including the VPC peering routes to Cloud SQL.

Why this answer

The most likely cause is that the service project's Compute Engine default service account lacks the necessary IAM permissions to use the Shared VPC network resources. The Cloud SQL instance with a private IP is accessible via the Shared VPC, but the service project's instances need the Compute Network User role on the host project to allow them to use the VPC network and its subnets. Without this role, the traffic from vm-analytics cannot reach the Cloud SQL private IP, resulting in a timeout.

Option A is correct because granting the Compute Network User role to the service project's default compute service account enables the necessary network access. Option B is incorrect because Private Google Access is for accessing Google APIs without external IPs, not for Cloud SQL private connectivity. Option C is unnecessary because firewall rules already allow traffic from the entire VPC range to the Cloud SQL subnet.

Option D is incorrect because Cloud Router is used for hybrid connectivity and dynamic routing, but the issue is IAM, not routing.

Practice this question →
7
MCQhard

An organization uses Shared VPC with multiple service projects. They want to allow a service project to create a VM in a subnet that belongs to the host project. The subnet has an IAM policy that grants the compute.instanceAdmin role to the service project's service account. However, the service project is unable to create VMs in that subnet. What is the most likely reason?

A.The subnet IAM policy does not include the service project's service account.
B.The subnet is out of IP addresses.
C.The service project does not have the compute.instanceAdmin role on itself.
D.The service project is missing the compute.networkUser role on the host project.
AnswerD

The compute.networkUser role on the host project is required for using Shared VPC networks. Its absence is the most likely cause.

Why this answer

In Shared VPC, a service project must have the compute.networkUser role on the host project to use its networks. Without this role, subnet-level IAM permissions (like compute.instanceAdmin) are ineffective because the service project cannot even access the network. Therefore, even though the subnet IAM may be correctly configured, the missing networkUser role prevents VM creation.

Option D is correct. Option A is incorrect because the subnet IAM policy is not the issue; the problem is at the host project level. Option B is incorrect because IP exhaustion would give a different error (e.g., IP space full), not a permission error.

Option C is incorrect because the service project's own IAM roles are irrelevant for accessing host project resources.

Practice this question →
8
MCQmedium

A company has a multi-region VPC with subnets in us-central1 (10.0.0.0/24) and europe-west1 (10.0.1.0/24). They have deployed a global Application Load Balancer (ALB) with backend services in both regions. The backends are instance groups with instances in each subnet. The ALB uses internal IP addresses from a subnet in each region for the backend services. The company wants to restrict access to the ALB so that only traffic from a specific list of external IP addresses (e.g., corporate VPN) can reach the load balancer. They have created a firewall rule allowing ingress from those IP addresses to the ALB's forwarding rule IP (which is a global IP). However, external traffic from allowed IPs is still being blocked. What is the most likely reason?

A.The firewall rule should be created with priority lower than 1000 to override default deny.
B.VPC firewall rules do not apply to global load balancer's frontend; use Cloud Armor with IP whitelist.
C.The firewall rule must allow ingress from the allowed IPs to the backend instance's internal IPs.
D.The firewall rule must be applied to the backend instances' tags, not the forwarding rule IP.
AnswerB

Global ALB traffic bypasses VPC firewall; Cloud Armor provides access control at the edge.

Why this answer

The Global Application Load Balancer (external) uses a global anycast IP that is part of Google's frontend infrastructure, not a VPC resource. VPC firewall rules apply only to traffic entering or leaving VPC network interfaces, such as VM instances or internal load balancers. Traffic to the global ALB's frontend IP is handled before it reaches the VPC, so VPC firewall rules cannot filter it.

To restrict access based on source IP addresses, you must use Cloud Armor security policies attached to the load balancer. Therefore, option B is correct. Option A is incorrect because priority is not the issue; firewall rules simply do not apply to the global frontend.

Option C and D are incorrect because they refer to backend instances, but the problem is at the frontend. Option B is the correct solution: use Cloud Armor with an IP whitelist.

Practice this question →
9
MCQhard

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

A.Deploy a global HTTP(S) Load Balancer with backend services in each region.
B.Use Cloud DNS with geo-routing to direct users to regional load balancers.
C.Set up Cloud NAT with multiple static IP addresses for each region.
D.Assign a global anycast IP address to all instances and use BGP to advertise it.
AnswerA

Global HTTP(S) LB uses anycast IP and proxies traffic to the closest region, reducing latency.

Why this answer

A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Exam trap

Google Cloud often tests the misconception that anycast IPs can be directly assigned to instances or that BGP-based anycast is a viable option in Google Cloud, when in fact only Google-managed load balancers can provide anycast IPs, and customers cannot advertise their own anycast prefixes.

How to eliminate wrong answers

Option B is wrong because Cloud DNS with geo-routing directs users to regional load balancers based on DNS resolution, but DNS-based routing cannot react to real-time network conditions or instance health, and traffic still traverses the public internet after DNS resolution, failing to fully utilize Google's global network. Option C is wrong because Cloud NAT provides outbound internet access for instances without public IPs and does not improve inbound user latency; it is used for egress traffic, not ingress load balancing. Option D is wrong because assigning a global anycast IP address directly to instances and using BGP to advertise it is not supported in Google Cloud; Google Cloud does not allow customers to advertise their own anycast IPs via BGP, and instances cannot share a single anycast IP without a load balancer.

Practice this question →
10
MCQmedium

A company is migrating from an on-premises data center to Google Cloud. They have set up a High-Availability VPN (with two tunnels) between their on-premises router and a Cloud VPN gateway in a VPC. They use static routing. The on-premises network uses RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the VPC uses 10.1.0.0/16. They have configured static routes in the VPC for the on-premises ranges pointing to the VPN gateway. However, they notice that traffic from on-premises to the VPC is intermittent: sometimes packets go through tunnel 1, sometimes through tunnel 2, and sometimes they drop. The on-premises router is configured to use both tunnels in an active-active mode with equal-cost multipath (ECMP). What is the most likely cause of the intermittent drops?

A.Increase the number of tunnels to four to distribute traffic better.
B.Change from static routing to dynamic routing (BGP) to allow the Cloud VPN gateway to advertise routes and avoid ECMP issues.
C.Set the on-premises router to active-passive mode using only one tunnel at a time.
D.Configure traffic selector policies on the VPN tunnels to ensure each tunnel only handles specific subnets.
AnswerB

BGP provides better control over path selection and is recommended for HA VPN with multiple tunnels.

Why this answer

The most likely cause of intermittent drops is that the on-premises router is using ECMP to distribute traffic across both VPN tunnels, but Cloud VPN with static routing does not support ECMP for incoming traffic. This can lead to out-of-order packets or drops for the same flow if packets arrive on different tunnels. Switching to dynamic routing with BGP allows the Cloud VPN gateway to establish BGP sessions over each tunnel, which enables proper route advertisement and ECMP support by creating a single logical interface.

BGP routing also allows the gateway to better handle path selection and failover, thus resolving the intermittent drops. Therefore, option B is correct.

Practice this question →
11
MCQmedium

Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?

A.Create a Cloud NAT.
B.Add a firewall rule to allow egress to 0.0.0.0/0.
C.Enable Private Google Access on the subnet.
D.Add a default route to the internet gateway.
AnswerC

The setting privateIpGoogleAccess is currently false; enabling it allows access to Google APIs.

Why this answer

The subnet has privateIpGoogleAccess set to false, which must be enabled for VMs without external IPs to access Google APIs via Private Google Access. Option C (Enable Private Google Access on the subnet) is the correct configuration. Option A (Cloud NAT) is for outbound internet to non-Google destinations, not for Google APIs.

Option B is not needed because egress to 0.0.0.0/0 is allowed by default. Option D is not missing; a default route exists as indicated by gatewayAddress.

Practice this question →
12
MCQmedium

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

A.Use a Shared VPC with separate subnets in different projects for each tier.
B.Use three separate VPCs for each tier and connect them using VPC peering.
C.Use a single VPC and connect the database tier via Cloud VPN to on-premises.
D.Use a single VPC with separate subnets for each tier and configure firewall rules to restrict traffic.
AnswerB

Separate VPCs provide full isolation; peering allows controlled communication.

Why this answer

Using three separate VPCs with VPC peering enforces strict network segmentation: the web tier VPC has a public subnet with an internet gateway, the application tier VPC is peered only to the web tier VPC (no internet gateway), and the database tier VPC is peered only to the application tier VPC (no public IPs). This design ensures that the database tier has no public IP addresses and is only reachable through the application tier, meeting all security requirements.

Exam trap

Google Cloud often tests the misconception that firewall rules alone can prevent public IP assignment, but the trap here is that firewall rules control traffic, not the existence of a public IP address on a resource; the database tier must have no public IP at all, which requires a VPC design that prohibits internet gateway routes.

How to eliminate wrong answers

Option A is wrong because Shared VPC with separate subnets in different projects still places all subnets within the same VPC, meaning the database tier could potentially be assigned a public IP (unless explicitly prevented) and traffic between tiers is not isolated at the VPC level, violating the 'no public IP' requirement. Option C is wrong because using a single VPC with Cloud VPN to on-premises does not address the requirement to isolate the database tier from the internet; the database tier would still reside in the same VPC as the web tier, and Cloud VPN is for hybrid connectivity, not for tier isolation. Option D is wrong because a single VPC with separate subnets and firewall rules does not prevent the database tier from having a public IP address (firewall rules control traffic, not IP assignment), and the database tier could still be assigned a public IP via an external IP address on its instances, which violates the explicit requirement.

Practice this question →
13
MCQhard

Refer to the exhibit. A VM in the my-vpc network is unable to reach an external HTTPS server. What is the most likely cause?

A.The deny-all-egress firewall rule blocks all outbound traffic.
B.The allow-custom-internal rule only allows inbound traffic.
C.No rule allows outbound traffic to port 443.
D.The default-allow-ssh rule has a low priority.
AnswerA

This egress deny rule with priority 1000 blocks all outbound traffic, including HTTPS.

Why this answer

The default VPC configuration includes a deny-all-egress firewall rule with the lowest priority (65535) that blocks all outbound traffic not explicitly allowed. Since no higher-priority rule permits outbound traffic to the external HTTPS server (port 443), the VM's HTTPS requests are dropped by this implicit deny rule, preventing connectivity.

Exam trap

Google Cloud often tests the misconception that a missing allow rule is the direct cause, rather than recognizing the explicit deny-all-egress rule with lowest priority as the actual blocking mechanism.

How to eliminate wrong answers

Option B is wrong because the allow-custom-internal rule (priority 1000) allows inbound and outbound traffic within the VPC using the 'custom' target tag, but it does not affect external HTTPS traffic; the issue is outbound, not inbound. Option C is wrong because while no rule explicitly allows outbound HTTPS, the deny-all-egress rule is the actual blocking mechanism—the absence of an allow rule alone does not cause the block; the explicit deny rule does. Option D is wrong because the default-allow-ssh rule (priority 65534) allows inbound SSH on port 22, but it has no relevance to outbound HTTPS traffic; priority only matters when rules conflict, and this rule does not apply to the egress direction or port 443.

Practice this question →
14
MCQmedium

A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?

A.The instances are using different service accounts, and the NAT is not configured to allow all.
B.The Cloud NAT's idle timeout is set too low, causing connections to be dropped.
C.The external API endpoint has a rate limit that is being hit by the NAT IP.
D.Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.
AnswerD

Port exhaustion affects VMs that make many outbound connections; increasing NAT IPs provides more ports.

Why this answer

Cloud NAT uses source network address translation (SNAT) and maps internal IPs to the NAT IP using ports. By default, Cloud NAT allocates a range of ports per VM. If the instances are making many connections, they may exhaust the allocated ports.

The symptom that only some instances fail suggests that the failing instances may have run out of ephemeral ports. Option D is correct: Increase the number of NAT IP addresses or increase the minimum ports per VM.

Practice this question →
15
Multi-Selecteasy

A company is designing a VPC routing strategy. Which three are valid route types in Google Cloud VPC? (Choose three.)

Select 3 answers
A.System-generated routes
B.Dynamic routes learned through BGP
C.VPN tunnel routes
D.Custom static routes
E.Peering routes
AnswersA, B, D

Created automatically for subnets and default internet gateway.

Why this answer

Options A, B, and D are correct. System-generated routes are created automatically for subnet ranges and default internet gateway. Custom static routes are manually defined by administrators.

Dynamic routes are learned through BGP from on-premises or other networks. Option C is incorrect because 'VPN tunnel routes' is not a distinct route type; VPN tunnels utilize either static routes or BGP for route advertisement. Option E is incorrect because 'Peering routes' are not a separate type; they are system-generated routes imported from peered VPCs.

Practice this question →
16
MCQeasy

Which of the following is a benefit of using Shared VPC?

A.Centralized network administration and separation from application projects.
B.Lower cost compared to VPC peering.
C.Automatic failover for applications.
D.Reduced latency between instances.
AnswerA

This is the primary benefit of Shared VPC.

Why this answer

Shared VPC allows centralized network administration with separation of application projects.

Practice this question →
17
MCQeasy

A company wants to connect two VPC networks using VPC Network Peering. What is required for this setup?

A.A Cloud VPN tunnel must be established.
B.Both VPCs must belong to the same organization.
C.The VPCs must have non-overlapping IP ranges.
D.Both VPCs must be in the same region.
AnswerC

Correct. The VPCs must have non-overlapping IP ranges to avoid routing conflicts and allow direct communication.

Why this answer

VPC Network Peering requires that the IP ranges of the peered networks do not overlap. Option C is correct. Option A is wrong because a Cloud VPN tunnel is not required for peering; peering is a direct connection.

Option B is wrong because VPCs can be in different organizations and still be peered. Option D is wrong because VPCs can be in different regions.

Practice this question →
18
MCQeasy

A company uses a VPC with two subnets: subnet-a (10.0.1.0/24) with VMs tagged 'web', and subnet-b (10.0.2.0/24) with VMs tagged 'db'. They have a Cloud VPN tunnel to an on-premises network (172.16.0.0/16). The VPN tunnel is up and BGP is exchanging routes. A custom route for 172.16.0.0/16 with next hop VPN gateway exists, but it has a tag 'web', meaning it applies only to VMs with the 'web' tag. VMs in subnet-a can reach on-premises, but VMs in subnet-b cannot. Which step should be taken to allow subnet-b VMs to reach on-premises?

A.Create a new route for 172.16.0.0/16 with priority 1000 and no tag.
B.Add the 'db' tag to the custom route.
C.Remove the tag from the existing route.
D.Add a firewall rule to allow egress traffic from subnet-b.
AnswerB

Adding the tag will make the route applicable to VMs in subnet-b, allowing them to reach on-premises.

Why this answer

The custom route for 172.16.0.0/16 is tagged with 'web', so it only applies to VMs that have the 'web' tag. Subnet-b VMs are tagged 'db', so they do not match the route and cannot reach on-premises. Adding the 'db' tag to the route makes it apply to both tagged groups, enabling connectivity for subnet-b VMs without affecting existing traffic.

Exam trap

Google Cloud often tests the misconception that firewall rules are the cause of connectivity issues when the real problem is route scope or tag-based route applicability, leading candidates to incorrectly choose a firewall-related option like D.

How to eliminate wrong answers

Option A is wrong because creating a new route with priority 1000 and no tag would introduce a lower-priority route that applies to all VMs, but the existing tagged route (default priority 1000) would still take precedence for 'web' VMs; however, the real issue is that the route must match the 'db' tag, and a new untagged route would work but is unnecessary and could cause confusion. Option C is wrong because removing the tag from the existing route would make it apply to all VMs, including 'db' VMs, but it would also remove the intended restriction for 'web' VMs, potentially breaking security or routing policy. Option D is wrong because the problem is a routing issue, not a firewall issue; egress firewall rules control packet filtering, not route selection, and subnet-b VMs already have implicit egress allowed unless explicitly blocked.

Practice this question →
19
Multi-Selectmedium

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Select 2 answers
A.Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.
B.Private Google Access enabled on the subnet where the VPN gateway resides.
C.Firewall rule allowing ingress from on-premises to 0.0.0.0/0.
D.Cloud NAT configured in the VPC.
E.A custom route in the VPC that sends traffic to 199.36.153.4/30 and 199.36.153.8/30 to the VPN tunnel.
AnswersB, E

This allows on-premises traffic to reach Google APIs via the VPN.

Why this answer

Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.

Exam trap

Google Cloud often tests the misconception that Cloud NAT is required for private access, but Private Google Access and custom routes to the 199.36.153.4/30 and 199.36.153.8/30 ranges are the correct components for on-premises private API access via Cloud VPN.

Practice this question →
20
MCQeasy

A small company has a single VPC with one subnet in us-central1 (10.0.1.0/24). They have a Compute Engine instance that needs to be reachable from the internet via HTTP (port 80) and HTTPS (port 443). The instance has an external IP address (ephemeral). They have created firewall rules allowing ingress on TCP 80 and 443 from 0.0.0.0/0, with target tags 'web-server'. The instance has been assigned the tag 'web-server'. However, external users report that they cannot access the instance's public IP on either port. The instance's OS firewall (iptables) is default allow. What is the most likely cause?

A.The instance's external IP is ephemeral and may have changed, so users should use the new IP or reserve a static IP.
B.The instance's OS firewall is blocking the traffic; check iptables.
C.The VPC needs a custom route for the internet gateway.
D.The firewall rules must be applied to the subnet, not the instance tag.
AnswerA

Ephemeral IPs can change, causing connectivity issues; a static IP is recommended.

Why this answer

The VPC automatically has a default route to the internet gateway, so no custom route is needed. Firewall rules with target tags 'web-server' are correctly applied to the instance with that tag. The instance's OS firewall (iptables) is default allow, so it is not blocking traffic.

The most likely cause is that the instance's external IP is ephemeral and may have changed after a stop/start operation. Users may be attempting to connect to the old IP address. To resolve this, the company should assign a static external IP to the instance.

Practice this question →
21
Drag & Dropmedium

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Cloud NAT requires a Cloud Router first. Then create NAT, assign IPs, and apply to subnets. Testing confirms internet access.

Practice this question →
22
MCQmedium

A company has a VPC with subnets in us-central1 and europe-west1. They want to deploy a Cloud NAT to allow VMs in both regions to access the internet. How many Cloud NAT gateways are needed?

A.None; Cloud NAT is not required for internet access.
B.One Cloud NAT gateway per subnet.
C.Two Cloud NAT gateways, one per region.
D.One Cloud NAT gateway covering both regions.
AnswerC

Correct. One Cloud NAT gateway is needed per region (us-central1 and europe-west1), so two gateways are required.

Why this answer

Cloud NAT is a regional resource; each region requires its own Cloud NAT gateway. A single gateway cannot cover multiple regions because Cloud NAT does not support global scope. For VMs in us-central1 and europe-west1 to access the internet, you need one Cloud NAT gateway per region, totaling two.

Therefore, option C is correct. Option A is incorrect because Cloud NAT is necessary for private VMs to reach the internet without external IP addresses. Option B is incorrect because Cloud NAT operates at the region level, not per subnet; a regional gateway serves all subnets in that region.

Option D is incorrect because Cloud NAT is regional, not global.

Exam trap

Candidates often mistakenly believe Cloud NAT is global or per-subnet. Remember: Cloud NAT is regional and one gateway covers all subnets in a region.

Practice this question →
23
Multi-Selectmedium

A company wants to establish a VPC peering connection between two VPCs in different projects. Which two steps are mandatory to create the peering connection?

Select 2 answers
A.Assign a public IP to the VMs in both VPCs.
B.Ensure the VPCs have non-overlapping subnet IP address ranges.
C.Create a peering connection from each project's VPC to the other.
D.Create a firewall rule allowing all traffic between the VPCs.
E.Configure a Cloud Router with BGP sessions.
AnswersB, C

Overlapping ranges cause routing conflicts and are not allowed in VPC peering.

Why this answer

VPC peering relies on private IP routing between the two VPCs. If the IP address ranges overlap, the VPC route tables cannot distinguish which VPC a packet belongs to, causing routing conflicts and preventing the peering connection from being established. Google Cloud requires that the VPCs have non-overlapping subnet CIDR blocks for successful peering.

Exam trap

Google Cloud often tests the misconception that firewall rules are mandatory for creating a VPC peering connection, but in reality, the peering is a network-layer connectivity setup that can exist without any firewall rules, which are only needed to allow traffic after the peering is active.

Practice this question →
24
MCQeasy

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

A.Custom mode subnet
B.Dynamic subnet
C.Legacy network
D.Auto mode subnet
AnswerD

Auto mode subnets automatically allocate IP ranges and expand as needed.

Why this answer

An auto mode subnet automatically creates subnets in each region and assigns IP address ranges from a predefined pool that can expand as you add more VM instances. This allows the subnet to grow without manual intervention, making it ideal for startups that need dynamic scaling.

Exam trap

Google Cloud often tests the distinction between auto mode and custom mode subnets, where candidates mistakenly think 'dynamic subnet' is a real option or assume custom mode can auto-expand, but only auto mode provides automatic regional subnet creation and growth.

How to eliminate wrong answers

Option A is wrong because a custom mode subnet requires manual IP range configuration and does not automatically expand; you must explicitly add new subnets or modify CIDR blocks. Option B is wrong because 'Dynamic subnet' is not a valid VPC subnet type in Google Cloud; the correct terms are auto mode and custom mode. Option C is wrong because a legacy network is a deprecated, flat network model that lacks VPC features like subnets, routing, and firewall rules, and cannot automatically grow with VM instances.

Practice this question →
25
Multi-Selecthard

A company has a VPC that is connected to an on-premises network via a Cloud VPN tunnel using dynamic routing (BGP). They have set up a Cloud Router with an advertised IP range of 10.0.0.0/8. The on-premises network advertises 172.16.0.0/12. They also have a custom static route in the VPC for 10.0.0.0/8 that points to a next-hop VPN tunnel (the same tunnel) with priority 100. Recently, they added a new subnet 10.1.0.0/24 in the VPC. Traffic from on-premises to 10.1.0.0/24 is not working. Which THREE steps should they take to troubleshoot and resolve the issue? (Choose 3.)

Select 3 answers
A.Change the static route priority to 1000 to match dynamic routes.
B.Verify that the Cloud Router is advertising the 10.1.0.0/24 subnet to on-premises.
C.Verify that the new subnet's range is allowed in the on-premises firewall and route tables.
D.Delete the static route for 10.0.0.0/8 and rely solely on dynamic routing.
E.Check the BGP session status between the Cloud Router and the on-premises router.
AnswersB, C, E

The Cloud Router may not automatically advertise new subnets unless configured to do so via custom advertisements.

Why this answer

The issue is that traffic from on-premises to the new subnet 10.1.0.0/24 is not working. Since the VPC already has a Cloud VPN tunnel with dynamic routing (BGP) and a Cloud Router advertising 10.0.0.0/8, the new subnet 10.1.0.0/24 is more specific. Static routes with priority 100 for 10.0.0.0/8 do not override more specific dynamically learned routes; the most specific prefix wins.

Therefore, the most likely causes are: the Cloud Router is not advertising the new subnet to on-premises (B), the on-premises firewall or route tables do not allow 10.1.0.0/24 (C), or the BGP session between Cloud Router and on-premises router is down (E). Checking BGP session status (E) is a fundamental step. Deleting the static route (D) is unnecessary, and changing priority (A) is not relevant because dynamic routes already have higher priority and more specific routes are preferred regardless.

Thus, the correct steps are B, C, and E.

Practice this question →
26
MCQeasy

Refer to the exhibit. Instances in subnet-b cannot access the internet through Cloud NAT. What is the most likely reason?

A.The firewall rules in subnet-b block egress.
B.The NAT IP address pool is exhausted.
C.Subnet-b has overlapping subnets.
D.Subnet-b is not included in the Cloud NAT configuration.
AnswerD

The exhibit shows only subnet-a in the NAT, so subnet-b has no NAT.

Why this answer

The Cloud NAT configuration only includes subnet-a, so subnet-b is not NATed.

Practice this question →
27
MCQhard

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

A.Use VPC Network Peering between two different VPCs.
B.Place instances in different VPCs and use a VPN between them.
C.Place both instances in the same VPC, using internal IP addresses.
D.Assign external IP addresses to both instances and communicate over the internet.
AnswerC

Internal IPs stay within Google's network, providing lowest latency.

Why this answer

Placing both Compute Engine instances in the same VPC and using internal IP addresses ensures traffic stays within Google's private network backbone, bypassing any external gateways or internet hops. This configuration leverages Google's internal routing with sub-millisecond latency between zones in the same region, as traffic is forwarded at the hypervisor level without encapsulation or additional network hops.

Exam trap

Google Cloud often tests the misconception that VPC Network Peering provides equivalent latency to a single VPC, but the trap here is that peering adds a logical routing boundary and potential latency overhead, making a single VPC with internal IPs the only option for guaranteed sub-millisecond performance.

How to eliminate wrong answers

Option A is wrong because VPC Network Peering connects two separate VPCs, introducing an additional routing hop and potential latency from peering gateway processing, which cannot match the direct internal path within a single VPC. Option B is wrong because using a VPN between different VPCs adds encapsulation overhead (IPsec) and encryption processing, significantly increasing latency beyond sub-millisecond requirements. Option D is wrong because communicating over the internet via external IP addresses forces traffic through Google's external edge routers and the public internet, adding unpredictable latency and jitter, and is fundamentally slower than internal VPC routing.

Practice this question →
28
MCQmedium

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

A.Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.
B.Use Dedicated Interconnect with VLAN attachments to the SaaS provider.
C.Deploy a Classic VPN tunnel with policy-based routing.
D.Deploy a single Cloud VPN tunnel and use static routing.
AnswerA

This provides HA with automatic failover via BGP; Cloud Routers enable dynamic routing and fast convergence.

Why this answer

Deploying two Cloud VPN tunnels from two Cloud Routers with BGP sessions provides high availability and automatic failover. The two Cloud Routers in different zones ensure redundancy, and BGP (Border Gateway Protocol) dynamically advertises routes and detects tunnel failures, allowing traffic to automatically switch to the healthy tunnel without manual intervention. This meets the requirement for an IPsec VPN connection to a third-party SaaS provider that only supports IPsec VPN.

Exam trap

The trap here is that candidates often assume Dedicated Interconnect is always superior for high availability, but the question explicitly requires IPsec VPN, and Interconnect does not support IPsec VPN, making it an invalid choice despite its high availability features.

How to eliminate wrong answers

Option B is wrong because Dedicated Interconnect is a direct physical connection to Google Cloud, not an IPsec VPN, and the SaaS provider only supports IPsec VPN, making this incompatible. Option C is wrong because Classic VPN with policy-based routing does not support BGP and cannot provide automatic failover; it relies on static routing and manual intervention for failover, which does not meet the high availability requirement. Option D is wrong because a single Cloud VPN tunnel with static routing lacks redundancy and automatic failover; if the tunnel fails, traffic is dropped until manual recovery, violating the high availability requirement.

Practice this question →
29
MCQhard

Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?

A.Create a Private Service Connect endpoint in VPC-A.
B.Enable Private Google Access on the subnet where the service resides.
C.Create a Private Service Connect service attachment and publish the service.
D.Create a VPC peering connection with VPC-B.
AnswerC

The producer publishes the service via a service attachment.

Why this answer

The producer (VPC-A) must create a Private Service Connect service attachment that publishes the service. This attachment is associated with a load balancer or a service. Option A is incorrect because the endpoint is created in the consumer VPC (VPC-B).

Option B is incorrect because VPC peering is not used with Private Service Connect (the services can be across organizations without peering). Option D is incorrect because Private Google Access is unrelated to publishing services.

Practice this question →
30
MCQmedium

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

A.Create the subnet with primary range 10.0.2.0/24 and specify the secondary range at creation time.
B.Create the subnet with primary range 10.0.2.0/24 and then update it to add the secondary range.
C.Create two subnets: one with 10.0.2.0/24 for primary and another for the secondary range.
D.Create an auto mode subnet and let Google Cloud assign the secondary range automatically.
AnswerA

Secondary ranges must be specified at subnet creation.

Why this answer

In Google Cloud VPC, a subnet can have both a primary IP range and one or more secondary IP ranges, and these secondary ranges must be specified at subnet creation time. For a Kubernetes cluster, the secondary range for pods is required, and it cannot be added after the subnet is created; it must be defined during the initial subnet creation.

Exam trap

Google Cloud often tests the misconception that secondary IP ranges can be added to an existing subnet via an update, but in Google Cloud, they must be specified at subnet creation time and are immutable afterward.

How to eliminate wrong answers

Option B is wrong because Google Cloud does not allow adding a secondary IP range to an existing subnet after creation; secondary ranges must be specified at creation time. Option C is wrong because a single subnet can have both primary and secondary ranges, and creating two separate subnets would not associate the secondary range with the primary subnet as required by Kubernetes. Option D is wrong because auto mode subnets automatically assign primary ranges, but they do not automatically assign secondary ranges; secondary ranges must be explicitly defined, and auto mode does not solve the requirement for a specific primary range.

Practice this question →
31
MCQeasy

An organization needs to connect two VPCs in different regions using Google's backbone. What is the recommended solution?

A.Cloud VPN
B.Dedicated Interconnect
C.Cloud NAT
D.VPC Peering
AnswerD

VPC Peering connects VPCs using Google's private network.

Why this answer

VPC Peering uses Google's backbone to connect VPCs across regions without public internet.

Practice this question →
32
MCQeasy

A company has two VPC networks in the same project: 'vpc-a' (us-central1) and 'vpc-b' (us-east1). They are connected via VPC Network Peering. An instance in vpc-a can ping the internal IP of an instance in vpc-b, but cannot reach it on TCP port 8080. The firewall rule in vpc-b allows ingress from the peered network's subnets. What is the most likely cause?

A.The instance in vpc-b has a firewall rule that denies TCP port 8080 explicitly.
B.The subnet in vpc-a is in a different region, so peering does not support cross-region communication.
C.The firewall rule for port 8080 is missing or uses an incorrect target tag or service account.
D.The firewall rule in vpc-b must allow ingress from the entire CIDR of vpc-a's subnet, not just the peered network.
AnswerC

Since ICMP works but TCP 8080 does not, the specific firewall rule for port 8080 is likely missing or misconfigured.

Why this answer

Since ICMP (ping) works, VPC Network Peering is functioning correctly, and the firewall rule in vpc-b allows ingress from the peered network's subnets. The failure on TCP 8080 indicates a missing or misconfigured firewall rule specific to that port, possibly due to incorrect target tags or service accounts. Option D is incorrect because the rule already permits ingress from the peered subnets; the issue is that no rule explicitly allows TCP 8080.

Therefore, the most likely cause is that the firewall rule for port 8080 is missing or uses an incorrect target tag or service account, making option C correct.

Practice this question →
33
MCQmedium

A company wants to enable VPC Flow Logs for a subnet to troubleshoot connectivity issues. They have enabled flow logs with a sample rate of 1.0 and metadata annotation enabled. After a few hours, they notice that logs are being generated but they are missing flows from a specific application server to a database server in the same subnet. Both servers are Compute Engine instances with internal IPs only. What could be the cause?

A.The instances are using internal DNS names, and flow logs only capture traffic by IP address.
B.The sample rate of 1.0 means all flows are sampled, but metadata annotation may be causing some flows to be dropped.
C.Flow logs must be enabled on the VPC network, not just the subnet.
D.VPC Flow Logs do not capture traffic between instances in the same subnet because it does not traverse the VPC router.
AnswerD

Traffic within the same subnet is sent directly at layer 2, bypassing the router where flow logs are captured.

Why this answer

VPC Flow Logs capture IP traffic that traverses the VPC router. Traffic between two instances within the same subnet is forwarded at layer 2, without going through the router, so it is not captured by flow logs. This is why the flows from the application server to the database server are missing.

Option D correctly identifies this behavior.

Practice this question →
34
MCQeasy

Refer to the exhibit. A VM in the default VPC with tag 'internal' and IP 10.128.1.2 is unable to communicate with another VM with IP 10.132.0.3 and tag 'internal'. What is the most likely cause?

A.The rule only applies to ingress traffic.
B.The rule only allows TCP and UDP, not ICMP.
C.The rule priority is too low.
D.The source range 10.128.0.0/14 does not include 10.132.0.3.
AnswerD

The source range excludes 10.132.0.3, blocking return traffic.

Why this answer

The firewall rule shown allows ingress traffic from source range 10.128.0.0/14, which covers IP addresses from 10.128.0.0 to 10.131.255.255. The destination VM with IP 10.132.0.3 is outside this range (10.132.0.3 is in 10.132.0.0/16, not within 10.128.0.0/14). Therefore, traffic from the source VM (10.128.1.2) to the destination VM (10.132.0.3) is blocked because the destination IP is not allowed by the rule's source range.

Option D correctly identifies this. Option A is incorrect because the rule direction is ingress, which is correct for receiving traffic; the issue is the source range. Option B is incorrect because even though ICMP may be used, the fundamental problem is the IP range mismatch.

Option C is incorrect because priority 1000 is valid and does not cause blocking.

Practice this question →
35
Multi-Selecteasy

Which TWO statements about VPC peering are correct?

Select 2 answers
A.VPC peering allows traffic without firewall rules if both VPCs are in the same project.
B.VPC peering automatically exports custom routes.
C.VPC peering can only be established for VPCs in the same region.
D.VPC peering requires that all subnet CIDR ranges be unique across both VPCs.
E.VPC peering can be established between VPCs in different organizations.
AnswersD, E

Overlapping subnets are not allowed.

Why this answer

Peering can be across organizations and requires non-overlapping subnets.

Practice this question →
36
MCQhard

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

A.Cloud NAT
B.VPC peering
C.Cloud Router
D.VPC Flow Logs
AnswerC

Cloud Router manages BGP sessions for dynamic routing with VPN or Interconnect.

Why this answer

Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Exam trap

The trap here is that candidates confuse Cloud Router with Cloud NAT or VPC peering, thinking any 'cloud' component or 'peering' term implies connectivity, but only Cloud Router handles the BGP dynamic routing required for Cloud VPN.

How to eliminate wrong answers

Option A is wrong because Cloud NAT provides outbound internet access for private VMs, not connectivity between on-premises and VPC. Option B is wrong because VPC peering connects two VPCs within Google Cloud, not an on-premises network to a VPC. Option D is wrong because VPC Flow Logs capture network metadata for monitoring and troubleshooting, not routing or connectivity.

Practice this question →
37
MCQmedium

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

A.The VPCs use different routing modes.
B.The IAM permissions for the peering are missing.
C.The VPCs have overlapping subnet CIDR ranges.
D.The engineer forgot to add firewall rules to allow traffic from the peer range.
AnswerD

Firewall rules are required to allow ingress traffic from the peered network.

Why this answer

Default firewall rules deny all ingress, so even with peering, traffic is blocked unless allow rules are added.

Practice this question →
38
MCQeasy

A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?

A.Cloud NAT
B.Cloud VPN
C.Private Google Access
D.VPC Peering
AnswerA

Cloud NAT provides outbound internet access to instances without external IPs.

Why this answer

Cloud NAT allows instances without external IPs to access the internet. Other options are for different purposes.

Practice this question →
39
MCQeasy

A company wants to enable Private Google Access for an on-premises network connected via Cloud VPN. Which configuration step is required?

A.Enable Private Google Access on the VPC subnet that hosts the Cloud VPN gateway.
B.Enable VPC Flow Logs for the VPN tunnel.
C.Create a default route with next hop set to the internet gateway.
D.Configure a Cloud NAT gateway for the on-premises network.
AnswerA

Private Google Access allows on-premises hosts to use internal IP addresses for Google APIs.

Why this answer

Private Google Access must be enabled on the VPC subnet that hosts the Cloud VPN gateway. This allows on-premises hosts to use internal IPs to access Google APIs through the VPN tunnel. Option B is incorrect because VPC Flow Logs are for logging, not enabling access.

Option C is incorrect because a default route to the internet gateway is not required; traffic goes through the VPN. Option D is incorrect because Cloud NAT is for outbound internet from private instances, not for on-premises access.

Practice this question →
40
MCQeasy

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

A.The subnet IP range overlaps with the on-premises network.
B.The instance has IP forwarding disabled.
C.The default VPC does not have a default route to the internet.
D.The firewall rules in the VPC are blocking ingress traffic from the on-premises network.
AnswerD

Default firewall rules allow only certain ingress; ICMP from on-premises is not allowed by default.

Why this answer

By default, the default VPC includes firewall rules that allow outbound traffic but restrict inbound traffic. Even though the Cloud VPN tunnel is established, the VPC firewall rules block ingress traffic from the on-premises network (e.g., ICMP for ping). To allow communication, a firewall rule must explicitly permit ingress traffic from the on-premises IP range or the remote tunnel IP.

Exam trap

Google Cloud often tests the misconception that a configured VPN tunnel automatically allows all traffic, when in reality firewall rules (ingress) and routes must be explicitly configured to permit communication between VPC and on-premises networks.

How to eliminate wrong answers

Option A is wrong because subnet IP range overlap with the on-premises network would cause routing conflicts, but the question states the VPN tunnel is configured and the issue is connectivity, not routing table errors; overlapping ranges typically prevent tunnel establishment or cause asymmetric routing, not just ping failure. Option B is wrong because IP forwarding is only required when the instance acts as a gateway (e.g., NAT instance or VPN gateway), not for a standard instance initiating traffic to an on-premises server over a VPN tunnel; the instance can send packets without IP forwarding enabled. Option C is wrong because the default VPC always includes a default route (0.0.0.0/0) to the internet via the default internet gateway; this route is automatically created and does not affect VPN-based communication.

Practice this question →
41
MCQmedium

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

A.A default route to the internet must be created.
B.A Cloud NAT must be configured.
C.No additional configuration is needed.
D.The instances must have external IPs.
AnswerC

Private Google Access works out of the box once enabled on the subnet.

Why this answer

Private Google Access enables instances without external IPs to reach Google APIs using internal IPs. Once enabled on the subnet, Google automatically adds a private route for the Google API IP ranges, so no further configuration is required. Therefore, option C is correct.

Option A is incorrect because a default route to the internet would send traffic to the internet, not to Google APIs via private access. Option B is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.

Practice this question →
42
MCQhard

An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?

A.Firewall rules are scoped to a VPC, not to subnets.
B.The new subnet was created without enabling firewall rule enforcement.
C.The instances need to be recreated for the new rules to apply.
D.The firewall rules have a source or destination filter that excludes the new subnet's CIDR.
AnswerD

If a rule includes an IP range filter, it will only apply to traffic that matches that range.

Why this answer

In Google Cloud, firewall rules can include source or destination IP range filters. Even if target tags match, if the rule also specifies a source or destination range that does not include the new subnet's CIDR (192.168.1.0/24), the rule will not apply to instances in that subnet. Option A is incorrect because although firewall rules are scoped to the VPC, that does not explain the issue; the rules still apply to all subnets, but specific IP range filters can limit applicability.

Option B is incorrect because there is no concept of 'firewall rule enforcement' on subnets. Option C is incorrect because firewall rule changes apply immediately; instances do not need to be recreated.

Practice this question →
43
Matchingmedium

Match each Cloud Router BGP attribute to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Unique autonomous system number for the router

MED value to influence inbound traffic

IP address of the BGP peer

ASN of the BGP peer

Time between BGP keepalive messages

Why these pairings

The correct matches: ASN → local autonomous system number, BGP peer IP → on-premises router IP, Advertised route priority → MED value. Common confusions include swapping ASN with peer IP, and route priority with advertised IP ranges.

Practice this question →
44
MCQhard

A company uses Shared VPC with a host project and multiple service projects. A service project administrator wants to create a VM with an internal IP from a specific subnet in the host project. The operation fails with a permission error. What is the most likely missing permission?

A.resourcemanager.projects.get on the host project.
B.compute.subnetworks.use on the host project subnet.
C.compute.instances.create on the service project.
D.compute.networks.use on the host project VPC.
AnswerB

This permission grants use of a specific subnet.

Why this answer

To create a VM in a service project using a subnet from the host project, the service project administrator needs the compute.subnetworks.use permission on that specific subnet. This permission is granted through the roles/compute.networkUser role. Option A is incorrect because resourcemanager.projects.get is not related to subnet usage.

Option C is incorrect because compute.instances.create is for creating instances globally, but the missing permission is for using the subnet. Option D is incorrect because compute.networks.use is for using the VPC network, but the error is more specific to subnet use.

Practice this question →
45
MCQhard

A financial services company is deploying a multi-tier application in a custom VPC with three subnets: web (10.0.1.0/24), app (10.0.2.0/24), and db (10.0.3.0/24). They use a Cloud VPN with dynamic routing (BGP) to connect to their on-premises data center (10.1.0.0/16). The on-premises network administrator reports that traffic from the web tier (10.0.1.0/24) to on-premises is working, but traffic from the app tier (10.0.2.0/24) to on-premises is failing. The company uses an Identity-Aware Proxy (IAP) for SSH access. The following configurations are in place: - Cloud Router advertises all VPC subnets via BGP. - On-premises router advertises 10.1.0.0/16. - Firewall rules allow all traffic from 10.0.0.0/16 to 10.1.0.0/16. - The app tier instances have a network tag 'app-tier' and a service account 'app-sa@project.iam.gserviceaccount.com'. - There is a firewall rule with priority 1000 that denies egress from tags 'app-tier' to 10.1.0.0/16. What is the most likely cause of the failure?

A.The service account 'app-sa' does not have permissions to send traffic through the VPN.
B.IAP is blocking traffic from the app tier because it is not configured for that subnet.
C.A firewall egress rule with priority 1000 denies traffic from instances with tag 'app-tier' to 10.1.0.0/16.
D.The Cloud Router is not advertising the 10.0.2.0/24 subnet to on-premises.
AnswerC

This deny rule explicitly blocks the traffic, overriding any lower-priority allow rules.

Why this answer

The firewall egress rule with priority 1000 explicitly denies traffic from instances tagged 'app-tier' to the on-premises network (10.1.0.0/16). Since firewall rules are evaluated in order of priority (lower numbers are higher priority), and this rule has a relatively low priority number, it will override any higher-numbered (lower priority) allow rules. The fact that web tier traffic works confirms that routing and VPN are functional, isolating the issue to the egress deny rule targeting the app tier.

Exam trap

Google Cloud often tests the misconception that service accounts or IAP control network-level traffic, when in reality firewall rules and routing are the only mechanisms that govern packet flow between VPC subnets and on-premises networks.

How to eliminate wrong answers

Option A is wrong because service accounts do not control network traffic permissions; they control API authorization via IAM roles, not packet-level routing or firewall decisions. Option B is wrong because IAP is used for SSH/RDP access and does not block general application traffic between subnets and on-premises; it operates at the application layer for administrative access, not at the network layer for inter-VPC or VPN traffic. Option D is wrong because the Cloud Router advertises all VPC subnets via BGP, and the web tier (10.0.1.0/24) works, proving that the app subnet (10.0.2.0/24) is also advertised; otherwise, web traffic would also fail.

Practice this question →
46
MCQeasy

A company wants to deploy a web application with a public-facing load balancer and a private backend. The backend instances must not have external IPs. Which statement about the VPC configuration is correct?

A.Cloud NAT must be configured for the backend subnet.
B.The backend subnet must have a default route to the internet.
C.Private Google Access must be enabled on the backend subnet.
D.No additional configuration is required beyond creating the subnet.
AnswerD

As long as the backend instances are in the same VPC as the load balancer, they can receive traffic from the load balancer without any additional configuration like NAT or Private Google Access.

Why this answer

Instances without external IPs can still receive traffic from a public load balancer. No additional configuration such as NAT or Private Google Access is needed. Option A is incorrect because Cloud NAT provides outbound internet access, not required for load balancer traffic.

Option B is incorrect because the backend subnet does not need a default route to the internet; the load balancer uses internal routing. Option C is incorrect because Private Google Access is for accessing Google APIs, not for load balancer traffic.

Practice this question →
47
MCQmedium

A company is designing a Shared VPC architecture for multiple projects. The host project hosts three VPC networks: 'prod', 'staging', 'dev'. Each service project needs access to a specific network. Some service projects require access to multiple networks. The security team wants to minimize the number of firewall rules and use IAM for centralized control. Which approach meets these requirements?

A.Attach each service project to one host project network and use IAM roles to grant access to specific subnets in other networks with a cross-project service account.
B.Use VPC Network Peering between each service project's VPC and the host project's networks.
C.Create a separate host project for each environment and attach service projects accordingly.
D.Create a single VPC network that encompasses all environments, and use subnet-level firewall rules to isolate environments.
AnswerA

This allows service projects to access multiple networks by using IAM on subnets and service accounts, minimizing firewall rules.

Why this answer

In Shared VPC, a service project can only be attached to one VPC network per host project. To provide access to multiple VPC networks, you can use IAM roles such as compute.networkUser on specific subnets across different host projects or use a cross-project service account. Option A allows each service project to be attached to one network and then grants IAM permissions to access subnets in other networks, meeting the requirement to minimize firewall rules and use IAM for centralized control.

Option B (VPC peering) does not provide centralized IAM control. Option C (separate host projects) increases management overhead. Option D (single VPC) defeats the purpose of isolation.

Practice this question →
48
MCQhard

Refer to the exhibit. You are troubleshooting an on-premises to Cloud VPN connection with dynamic routing. The BGP session is CONNECTED, but no routes are received from the on-premises router. What is the most likely cause?

A.The firewall rules are blocking BGP traffic.
B.The on-premises router is not configured to advertise routes.
C.The VPN tunnel is down.
D.The cloud router is not advertising any routes.
AnswerB

Since the BGP session is CONNECTED but no routes received, the on-premises side is not advertising.

Why this answer

The BGP session is up, but routesReceived is 0, indicating the on-premises router is not advertising routes.

Practice this question →
49
MCQmedium

A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?

A.The on-premises network does not have a route back to the VPC subnet.
B.A firewall rule is blocking ingress traffic from the on-premises network.
C.The BGP session is down.
D.The Cloud Router is not configured.
AnswerA

Return traffic requires a route on-premises pointing to the VPN gateway.

Why this answer

The most likely cause is that the on-premises network lacks a route back to the VPC subnet. For Cloud VPN, return traffic from the on-premises server must have a route pointing to the on-premises VPN gateway to reach the VM. Without this route, packets are dropped, causing asymmetric routing.

Option B is incorrect because firewall rules affect all traffic, not just the return path. Option C is incorrect because if the BGP session were down, no connectivity would exist at all. Option D is incorrect because Cloud Router is used for dynamic routing, but a missing return route would still cause the issue even with static routes.

Practice this question →
50
Multi-Selectmedium

A company has a VPC with three tiers: web, app, and db. They want to enforce that only the web tier can communicate with the app tier on TCP port 8080, and only the app tier can communicate with the db tier on TCP port 3306. All instances are in the same region but different subnets. Which TWO firewall rules should be created? (Choose 2.)

Select 2 answers
A.An ingress rule on the db tier instances with tag 'db' allowing TCP 3306 from instances with tag 'app'.
B.An egress rule on the web instances with tag 'web' allowing TCP 8080 to the app subnet.
C.An egress rule on the web subnet allowing TCP 8080 to any destination.
D.An ingress rule on the app tier instances with tag 'app' allowing TCP 8080 from instances with tag 'web'.
E.An ingress rule on the web subnet allowing TCP 8080 from the app subnet.
AnswersA, D

This ensures only app tier can reach db tier on port 3306.

Why this answer

To control traffic between tiers, ingress firewall rules should be applied to the destination instances using target tags. For web-to-app (TCP 8080), place an ingress rule on app instances (tag 'app') allowing TCP 8080 from source tag 'web' (Option D). For app-to-db (TCP 3306), place an ingress rule on db instances (tag 'db') allowing TCP 3306 from source tag 'app' (Option A).

Option B is an egress rule on web, which controls outbound traffic but does not prevent other sources from reaching app. Option C allows traffic to any destination, violating the principle of least privilege. Option E incorrectly places an ingress rule on the web subnet, but the web tier should be the source, not the destination. Therefore, the correct answers are A and D.

Practice this question →
51
MCQhard

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

A.Move all resources to a single region, such as us-central1, and use a single VPC.
B.Set up a Cloud VPN tunnel with Cloud Router and use BGP to advertise routes between the two regions.
C.Create a VPC peering connection between the frontend and backend VPCs.
D.Enable Cloud CDN on the backend load balancer to cache database responses.
AnswerA

Correct. Consolidating all resources to a single region eliminates cross-region latency, reducing database query times and simplifying the network.

Why this answer

The latency issue stems from inter-region communication between the backend and Cloud SQL database. By moving all resources to a single region (us-central1), you eliminate cross-region traffic entirely, reducing latency to the minimum possible within that region. This is the most cost-effective solution as it avoids any additional networking costs and simplifies the architecture.

While it may require a redesign of the MIGs, it directly addresses the root cause of high latency. Option B (Cloud VPN) adds a VPN tunnel over the Google backbone, which would introduce extra latency and cost without solving the underlying routing issue within the same VPC. Option C (VPC peering) is irrelevant since the resources are already in the same VPC.

Option D (Cloud CDN) is designed for caching static content, not database queries, and would not reduce latency for dynamic database traffic.

Exam trap

Google Cloud often tests the misconception that Cloud VPN with BGP can optimize routing within the same VPC, but the trap here is that VPN is for connecting separate networks, not for enhancing internal routing. The real solution is consolidation to a single region.

How to eliminate wrong answers

Option A is wrong because moving all resources to a single region would eliminate the multi-region architecture, potentially increasing latency for users in other regions and violating the requirement to minimize latency between regions while maintaining the existing deployment. Option C is wrong because VPC peering connects two separate VPCs, but the frontend and backend are already in the same VPC (custom subnet mode 10.0.0.0/16), so peering is unnecessary and does not address routing optimization between regions. Option D is wrong because Cloud CDN caches static content at edge locations, not database query responses, and it cannot reduce latency for dynamic database queries that require real-time access to Cloud SQL.

Practice this question →
52
MCQmedium

A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?

A.The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.
B.Cloud NAT is enabled.
C.Firewall rules allow ingress from on-premises IPs.
D.The on-premises router is advertising the route via BGP.
AnswerA

Correct. A custom route with the correct next-hop VPN tunnel interface ensures traffic to 10.1.0.0/16 goes through the intended tunnel.

Why this answer

A custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface is required to force traffic to go through that specific tunnel. Option B is incorrect because Cloud NAT is for outbound internet access, not routing to on-premises. Option C is incorrect because firewall rules control access but not routing.

Option D is incorrect because on-premises BGP advertisement is for routes from on-premises to Google Cloud, not for directing traffic within Google Cloud.

Practice this question →
53
MCQhard

A security team wants to restrict which Google services can be accessed from their VPC without external IPs. They use Private Google Access. What should they use to block access to specific services?

A.VPC Service Controls
B.Firewall rules blocking destination IPs
C.Cloud NAT with a specific IP range
D.Private Google Access with restricted VIPs
AnswerA

This service creates perimeters to control access to Google services.

Why this answer

VPC Service Controls allows creating security perimeters that restrict access to services.

Practice this question →
54
MCQeasy

Your company has a VPC with a single subnet in us-central1 (10.0.1.0/24). You have a managed instance group (MIG) of web servers (10.0.1.2-10.0.1.10) and a standalone database instance (10.0.1.100). The web servers need to communicate with the database on TCP port 3306. You have configured a firewall rule allowing ingress from 10.0.1.0/24 to 10.0.1.100 on tcp:3306. However, the web servers cannot connect to the database. You verified that the database is running and listening on port 3306, and that the web servers can ping the database. What should you do to resolve the issue?

A.Create a custom route from the web servers to the database.
B.Check the database instance's OS-level firewall (e.g., iptables) and ensure it allows traffic on port 3306 from the web servers.
C.Add a network tag 'db' to the database instance and update the firewall rule to target 'db'.
D.Configure the firewall rule to use the database's service account as the target.
AnswerB

The VPC firewall allows traffic, but the OS firewall on the database may be blocking the connection.

Why this answer

The firewall rule is correctly configured at the VPC level to allow ingress from the web servers' subnet to the database on TCP port 3306. Since the web servers can ping the database, network connectivity exists, but the application-layer connection fails. This indicates the database instance's OS-level firewall (e.g., iptables on Linux) is blocking the port, as cloud VPC firewall rules and guest OS firewalls operate independently.

Exam trap

Google Cloud often tests the distinction between cloud-level firewall rules and guest OS firewalls, leading candidates to overcomplicate the solution with network tags or routes when the issue is a simple OS-level block.

How to eliminate wrong answers

Option A is wrong because custom routes control packet forwarding paths, not firewall filtering; the web servers and database are in the same subnet, so no routing is needed. Option C is wrong because network tags are used to apply firewall rules to specific instances, but the existing rule already allows traffic from the entire subnet (10.0.1.0/24) to the database IP, so tags are unnecessary and would not fix an OS-level block. Option D is wrong because service accounts are used for authentication and authorization to Google Cloud APIs, not for controlling network traffic within a VPC; firewall rules cannot target service accounts.

Practice this question →
55
Multi-Selectmedium

Which THREE of the following are benefits of using VPC Flow Logs?

Select 3 answers
A.Compliance and audit requirements.
B.Troubleshooting connectivity issues.
C.Detecting DDoS attacks.
D.Reducing network latency.
E.Real-time network monitoring.
AnswersA, B, C

Flow logs provide records of network traffic for compliance.

Why this answer

VPC Flow Logs capture network traffic metadata, which can be used for compliance auditing (A), troubleshooting connectivity issues (B), and analyzing traffic patterns to detect DDoS attacks (C). Option D is incorrect because flow logs do not reduce latency; they only log data. Option E is incorrect because flow logs are not real-time; there is a delay in log delivery.

Practice this question →
56
Multi-Selecthard

A company has VPC peering between two VPC networks. They want to ensure that traffic from VPC A to VPC B can use a custom route in VPC A that points to a next-hop appliance in VPC A. Which TWO conditions must be met?

Select 2 answers
A.VPC B must have a route back to VPC A.
B.VPC peering must be set up with 'export custom routes' enabled from VPC A.
C.The appliance must be in the same region as VPC A.
D.The appliance must have a firewall rule allowing traffic from VPC B.
E.VPC A must have a route with destination inside VPC B and next-hop set to the appliance.
AnswersB, E

Export of custom routes is required for the peer to see and use them.

Why this answer

Required because custom routes must be exported from VPC A to VPC B via peering. This allows VPC B to learn the route and send return traffic back through the same appliance, ensuring bidirectional communication via the appliance. Without exporting custom routes, VPC B would send return traffic directly via the peering connection, bypassing the appliance.

Option E is required because VPC A must have a route that specifies the destination inside VPC B and sets the next-hop to the appliance. This route is what directs the traffic from VPC A to VPC B through the appliance. Options A, C, and D are not necessary for the forward path: VPC B does not need a route back (the return path is handled via export), the appliance can be in any region (it just needs connectivity), and a firewall rule on the appliance is needed but is not a condition specific to using the custom route via peering.

Practice this question →
57
Multi-Selecthard

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Select 3 answers
A.Service projects
B.Host project
C.Cloud VPN
D.VPC peering
E.Shared VPC
AnswersA, B, E

Service projects consume Shared VPC networks.

Why this answer

A is correct because service projects in a Shared VPC architecture allow each project to host its own resources (e.g., Compute Engine instances) while maintaining separate firewall rules and security policies. This enables centralized network administration via the host project while giving each project autonomy over its own firewall configurations, meeting the requirement for multiple projects with independent firewall rules.

Exam trap

Google Cloud often tests the distinction between connectivity solutions (Cloud VPN, VPC peering) and network administration models (Shared VPC), leading candidates to mistakenly choose VPC peering for multi-project setups when Shared VPC is required for centralized control with per-project firewall rules.

Practice this question →
58
Multi-Selectmedium

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Select 2 answers
A.Configure Cloud NAT for the VPC.
B.Assign an external IP address to the VM.
C.Enable Private Google Access on the subnet.
D.Assign a static internal IP address to the VM.
E.Create a firewall rule to allow ingress on TCP port 80 from 0.0.0.0/0.
AnswersB, E

An external IP allows the VM to be reachable from the internet.

Why this answer

A VM must have an external (public) IP address assigned to be directly reachable from the internet. Without an external IP, the VM cannot receive inbound traffic initiated from outside the VPC, even with proper firewall rules. This is a fundamental requirement for internet-facing workloads in Google Cloud.

Exam trap

Google Cloud often tests the misconception that Cloud NAT or Private Google Access can substitute for an external IP when allowing inbound internet traffic, but these services only support outbound or API-specific connectivity, not inbound internet access.

Practice this question →
59
Multi-Selectmedium

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

Select 2 answers
A.Ingress rule with source IP range of the company's public IPs and allow tcp:443
B.Ingress rule with source IP range 0.0.0.0/0 and allow tcp:80
C.Ingress rule with source IP range of the company's public IPs and allow tcp:80
D.Ingress rule with source tag 'web' and allow tcp:80
E.Ingress rule with destination IP range 0.0.0.0/0 and allow tcp:80
AnswersA, C

Restricts HTTPS traffic to company IPs.

Why this answer

Options A and C are correct. Ingress firewall rules with source IP ranges limited to the company's known public IPs on ports 443 (HTTPS) and 80 (HTTP) ensure that only traffic from those IPs can access the web server instances. Option B is incorrect because source range 0.0.0.0/0 allows all IPs, which does not restrict to known IPs.

Option D is incorrect because source tags identify target instances, not source IPs. Option E is incorrect because ingress rules use source IP ranges, not destination IP ranges, to restrict incoming traffic.

Practice this question →
60
MCQhard

A company uses VPC Flow Logs for traffic analysis. They notice that logs are missing for a specific Compute Engine instance that handles high traffic. The subnet has Flow Logs enabled. What is the most likely reason?

A.The instance is using Private Google Access.
B.Flow Logs are sampled and may drop high-throughput traffic.
C.The instance's network interface has an external IP.
D.The instance is in a different region from the log sink.
AnswerB

Flow Logs sample traffic, and at high throughput, sampling rate may be reduced or logs dropped.

Why this answer

VPC Flow Logs use sampling; high throughput can lead to sampling reduction or dropped logs.

Practice this question →
61
MCQmedium

An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?

A.The advertised route from the on-premises router is a default route.
B.The MTU size of the VPN tunnel.
C.The Cloud VPN gateway is assigned an external IP address.
D.The firewall rules in the VPC allowing incoming traffic from the on-premises CIDR.
AnswerD

Firewall rules control inbound traffic; without an allow rule, traffic is denied.

Why this answer

The first thing to check is the VPC firewall rules because even if BGP routes are exchanged and the tunnel is up, traffic can be blocked by firewall rules if there is no ingress rule allowing traffic from the on-premises CIDR. The tunnel being established and BGP session up indicates Layer 3 connectivity, but Layer 4 filtering via firewall rules can still block traffic. Option A is incorrect: a default route advertised from on-premises is fine as long as the route is learned and points to the correct next hop.

Option B is incorrect: MTU issues would typically cause fragmentation problems, not complete inability to reach instances. Option C is incorrect: the Cloud VPN gateway must have an external IP for the tunnel to be established; if it were missing, the tunnel wouldn't be up.

Practice this question →
62
MCQhard

An engineer runs 'gcloud compute networks peerings list' and sees state 'INACTIVE' for a peering connection. Which is the most likely cause?

A.The subnet CIDR ranges overlap.
B.The IAM permissions for the peer are insufficient.
C.The dynamic routing mode differs.
D.The firewall rules are missing.
AnswerA

Overlapping subnets result in an INACTIVE peering state.

Why this answer

Overlapping subnet CIDRs cause the peering to be INACTIVE.

Practice this question →
63
MCQhard

A company has an on-premises data center connected to Google Cloud via Dedicated Interconnect. They have a VPC with subnets in us-central1 and us-west1. They want compute instances in us-central1 to access Google APIs (e.g., Cloud Storage) without traversing the internet, but the on-premises network must also be able to access those APIs via the interconnect. They have configured Private Google Access (PGA) on all subnets. However, on-premises users report that they cannot access Cloud Storage buckets using the private IP of a forward proxy in us-central1 (the proxy is configured to use the default internet gateway for egress). What is the most likely reason?

A.Private Google Access is not supported on subnets in us-central1.
B.The forward proxy must use an external IP address to use Private Google Access.
C.There is a custom static route for 199.36.153.4/30 (Google API VIP) that points to the interconnect, overriding the default route for the proxy's outbound traffic.
D.The on-premises network must be configured with a default route pointing to the internet.
AnswerC

A custom route for the Google API VIP would cause the proxy to route traffic to on-premises instead of using the internet gateway, breaking PGA for the proxy.

Why this answer

Private Google Access (PGA) allows instances with only internal IPs to reach Google APIs via the default internet gateway (0.0.0.0/0 route). However, if a more specific static route exists for the Google API IP range (199.36.153.4/30) that points to the interconnect, traffic from the forward proxy to Google APIs will be routed to the on-premises network instead of the internet. Since the proxy is in us-central1 and uses its VPC routing, the custom route overrides the default route, preventing the proxy from reaching Google APIs.

Option C correctly identifies this misconfiguration.

Practice this question →
64
MCQeasy

A developer wants to create a VM that can communicate with all Google APIs without requiring an external IP address. Which configuration is necessary?

A.Configure a Cloud NAT.
B.Add a firewall rule to allow egress to 0.0.0.0/0.
C.Set up VPC peering with the Google APIs service producer.
D.Enable Private Google Access on the subnet.
AnswerD

Private Google Access allows VMs without external IPs to reach Google APIs.

Why this answer

To enable a VM to communicate with Google APIs without an external IP, Private Google Access must be enabled on the subnet. This allows instances with only internal IPs to reach Google APIs and services through Google's internal network. Option A (Cloud NAT) provides internet access for non-Google destinations, not specifically for Google APIs.

Option B (firewall rule to 0.0.0.0/0) would allow egress to the internet, but the VM still needs an external IP if Private Google Access is not enabled. Option C (VPC peering) is used to connect VPCs, not to access Google APIs. Therefore, Option D is correct.

Practice this question →
65
MCQhard

Refer to the exhibit. A company uses a Cloud Router with two BGP sessions for an HA VPN to on-premises. Traffic is not flowing correctly to the on-premises network. What is the most likely issue?

A.The advertised route priority is too low.
B.The BGP session with vpn-tunnel-2 is down, causing asymmetric routing.
C.The keepalive interval is too high.
D.The ASN 65000 is private and not allowed.
AnswerB

A down BGP session can disrupt proper route advertisement and traffic flow.

Why this answer

The exhibit shows that vpn-tunnel-2's BGP session is in a state other than 'established' (likely down), while vpn-tunnel-1 is established. A down BGP session on one tunnel can cause asymmetric routing or loss of connectivity, especially if traffic is sent over the down tunnel. Option B correctly identifies this.

Option A is incorrect because the advertised route priority (MED) of 100 is not the issue; the problem is the session state. Option C is incorrect because keepalive interval 20 seconds is standard. Option D is incorrect because private ASN 65000 is allowed in Cloud Router BGP configurations.

Practice this question →
66
Multi-Selecthard

Which THREE statements about VPC Flow Logs are correct?

Select 3 answers
A.Flow logs support sampling with a configurable interval.
B.Flow logs can be sent to BigQuery for analysis.
C.Flow logs record traffic to and from external IP addresses only.
D.Flow logs are enabled by default for all subnets.
E.VPC Flow Logs are enabled at the subnet level.
AnswersA, B, E

Sampling interval can be set to 5 seconds (default) or 1 minute.

Why this answer

Flow logs are subnet-level, can be sent to BigQuery, and support configurable sampling.

Practice this question →
67
MCQhard

A company has a VPC with a single subnet in us-central1 (10.0.0.0/24). They have a Compute Engine instance running a database that uses an internal IP address 10.0.0.10. They need to ensure that this database instance can be accessed by a legacy on-premises application via a Cloud VPN tunnel. The on-premises network uses 192.168.0.0/16. They have set up a HA VPN gateway with two tunnels and BGP routing. The Cloud Router is configured to advertise the subnet 10.0.0.0/24. On the on-premises side, the router receives the route for 10.0.0.0/24 and has a static route for 10.0.0.0/24 pointing to the VPN tunnel. However, the on-premises application cannot reach the database. The application's server can ping the on-premises gateway, but not the database IP. The database instance's OS firewall allows all traffic from 0.0.0.0/0. What is the most likely cause?

A.The database instance's OS firewall is blocking the traffic despite the setting.
B.The VPC firewall rules are blocking ingress from on-premises; add a rule allowing traffic from 192.168.0.0/16 to the database IP.
C.The Cloud Router is not advertising the specific database IP 10.0.0.10, only the subnet 10.0.0.0/24.
D.The BGP session is not establishing properly; check the shared secret and IP addresses.
AnswerB

By default, VPC firewall denies ingress; an explicit allow rule is needed.

Why this answer

The issue is likely that the VPC firewall rules are blocking ingress traffic from the on-premises network. Even though the database OS firewall is permissive, the VPC firewall must allow ingress from the on-premises IP range (192.168.0.0/16) to the database's IP. Option B is correct: Create a firewall rule allowing ingress from 192.168.0.0/16 to 10.0.0.10 on the required port.

Practice this question →
68
Multi-Selectmedium

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Select 1 answer
A.Set up VPC peering between the VPCs in each region.
B.Set up Cloud VPN or Dedicated Interconnect between the two VPCs.
C.Create firewall rules allowing all traffic from the other region's subnet CIDR.
D.Configure instances to use external IP addresses for cross-region communication.
E.Use a shared VPC to connect both regions.
AnswersC

Correct. Firewall rules are required to allow traffic between instances. By default, firewall rules may restrict traffic, so rules allowing the desired communication must be created.

Why this answer

In Google Cloud, a VPC is a global resource. Subnets are regional, but they all belong to the same VPC. Instances in different regions within the same VPC can communicate using internal IP addresses automatically over Google's global network, without needing VPC peering, VPN, or Dedicated Interconnect.

The only requirement is that firewall rules permit the traffic. Therefore, the necessary action is to create firewall rules (Option C). Options A and B are for connecting separate VPCs, which is not the scenario here.

Options D and E are incorrect because using external IPs would traverse the internet, and Shared VPC is for sharing subnets across projects, not for connecting regions.

Exam trap

Candidates may assume that cross-region communication requires additional connectivity like VPC peering or VPN, but Google Cloud's global VPC allows instances in different regions to communicate privately by default using internal IPs. The real trap is forgetting that firewall rules must allow the traffic, not that a Layer 3 connection is needed.

Practice this question →
69
MCQeasy

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

A.Cloud NAT logging
B.VPC Flow Logs
C.Packet Mirroring
D.Traffic Director
AnswerB

VPC Flow Logs capture IP traffic metadata, enabling diagnosis of packet drops and latency issues.

Why this answer

VPC Flow Logs capture information about IP traffic going to and from network interfaces. They help diagnose packet drops and latency issues. Cloud NAT logging provides logs about NAT connections, not general traffic.

Packet Mirroring is for capturing and inspecting traffic for analysis, not for logging. Traffic Director is a service mesh control plane, not a traffic logging tool.

Practice this question →
70
Multi-Selectmedium

Which THREE statements about Shared VPC are correct?

Select 3 answers
A.The Shared VPC admin role can be assigned to manage the host VPC network.
B.Service projects can use subnetworks from the host VPC.
C.The host project must be in the same organization as the service projects.
D.Service projects can delete subnets in the host VPC.
E.Service projects can create their own VPCs that peer with the host VPC.
AnswersA, B, C

The compute.xpnAdmin role allows management of Shared VPC.

Why this answer

Shared VPC allows service projects to use host VPC subnets, requires same organization, and can be managed via Shared VPC admin role.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Implementing a Virtual Private Cloud questions.

Start 20-question session