CCNA Pcne Configuring Services Questions — Page 1 of 3

MCQmedium

A company has an on-premises data center connected to GCP via Cloud Interconnect. They want to expose an on-premises service to internet clients through Google Cloud's global load balancer. Which type of network endpoint group should they use?

A.Zonal NEG

B.Internet NEG

C.Serverless NEG

D.Hybrid connectivity NEG

AnswerD

Correct: hybrid NEGs allow load balancing to on-premises endpoints via Interconnect or VPN.

Why this answer

Hybrid connectivity NEGs allow you to expose on-premises destinations via Cloud Interconnect or VPN to a load balancer.

Practice this question →

Drag & Dropmedium

Drag and drop the steps to set up a Google Cloud Armor security policy for a backend service into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Security policy creation involves defining rules, setting default action, and attaching to a backend service. Testing ensures correct enforcement.

Practice this question →

MCQmedium

A company wants to expose a set of internal services running on Compute Engine instances in a private VPC to other internal services using HTTP load balancing. They require L7 features like URL-based routing and SSL termination. Which load balancer should they use?

A.Regional Internal HTTP(S) Load Balancer

B.Global HTTPS Load Balancer

C.Internal TCP/UDP Load Balancer

D.Regional External HTTP(S) Load Balancer

AnswerA

Correct. It provides internal L7 load balancing.

Why this answer

Regional Internal HTTP(S) Load Balancer is an Envoy-based L7 load balancer for internal traffic, supporting URL maps and SSL termination.

Practice this question →

MCQhard

An organization uses Traffic Director with Envoy sidecars in GKE. They want to implement fault injection to test service resilience by injecting a 5-second delay into 10% of requests to a specific backend service. Which Traffic Director configuration resource should they use?

A.A backend service with outlier detection enabled

B.A network endpoint group with a health check that fails intermittently

C.A traffic splitting rule in the routing configuration

D.A fault injection policy in the TrafficDirectorRoute

AnswerD

Correct: Traffic Director allows fault injection via route rules in the routing configuration.

Why this answer

Traffic Director supports fault injection via the Envoy HTTP connection manager. The correct approach is to configure a TrafficDirectorRoute with a fault injection policy, which is part of the routing configuration.

Practice this question →

Multi-Selectmedium

A company is designing a global web application that must serve users worldwide with low latency. They plan to use a Global HTTPS Load Balancer with Cloud CDN. Which TWO features should they enable to further reduce latency for users connecting from various regions? (Choose two.)

Select 2 answers

A.Anycast IP address

B.Reserve a static IP address

C.Enable IAP for backend services

D.Cloud CDN with CDN Interconnect

E.Cloud Armor with rate limiting

AnswersA, D

Anycast allows users to connect to the nearest edge point, reducing latency.

Why this answer

CDN Interconnect provides dedicated connectivity to CDN caches, reducing latency. Anycast IP ensures users connect to the nearest edge location. Cloud Armor is security, not performance.

Practice this question →

MCQhard

A company uses Cloud DNS. They want to override DNS resolution for a specific domain (e.g., mycompany.com) to point to an internal IP for all queries originating from their VPC, while leaving all other domains unaffected. Which Cloud DNS feature should they use?

A.DNSSEC

B.A routing policy with a geo location rule

C.A response policy zone (RPZ)

D.A managed private zone

AnswerC

Correct: RPZ allows DNS overrides within the VPC.

Why this answer

Response Policy Zones (RPZ) allow you to create a local override zone that takes precedence over public DNS for specified domains within a VPC.

Practice this question →

Drag & Dropmedium

Drag and drop the steps to set up a Cloud Interconnect connection for dedicated on-premises connectivity into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Cloud Interconnect requires ordering, VLAN attachment, cross-connect, BGP, and verification.

Practice this question →

Multi-Selectmedium

A company wants to use Traffic Director to implement fault injection for testing service resilience. They want to inject delays and errors into a percentage of requests. Which two configurations are required? (Choose two.)

Select 2 answers

A.Enable Cloud Armor on the load balancer

B.Configure a fault injection policy in Traffic Director

C.Create a new backend service with different instance group

D.Configure a health check for the fault injection service

E.Apply a traffic splitting rule to direct a percentage of traffic to the fault injection policy

AnswersB, E

Fault injection policy defines delay and error percentages.

Why this answer

Traffic Director supports fault injection policies, which require a traffic splitting rule to apply the policy to a portion of traffic, and the fault injection filter config in Envoy.

Practice this question →

MCQmedium

You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?

A.The SSL policy is configured to require TLS 1.3 only.

B.The domain is not verified for the Google-managed certificate on the frontend.

C.The backend self-managed certificate is not signed by a public CA.

D.The backend service must use a Google-managed certificate as well.

AnswerB

Google-managed certificates require domain verification; if not verified, the certificate may not issue, causing mismatch.

Why this answer

When a Google-managed certificate is used on the frontend of an SSL proxy load balancer, the domain must be verified via DNS or a challenge file. If the domain is not verified, the certificate cannot be provisioned or validated, causing a mismatch between the certificate's Subject Alternative Names (SANs) and the domain clients are connecting to, resulting in SSL errors.

Exam trap

Google Cloud often tests the distinction between frontend and backend certificate validation, and candidates mistakenly think a backend certificate issue (like not being signed by a public CA) would cause frontend client errors, when in fact the frontend certificate mismatch is caused by domain verification failure for the Google-managed certificate.

How to eliminate wrong answers

Option A is wrong because requiring TLS 1.3 only does not cause a certificate mismatch; it would instead cause handshake failures for clients using older TLS versions. Option C is wrong because a backend self-managed certificate not signed by a public CA would cause backend SSL errors, not frontend client-side certificate mismatch errors. Option D is wrong because the backend service does not need to use a Google-managed certificate; it can use a self-managed certificate, and the frontend certificate mismatch is independent of the backend certificate type.

Practice this question →

MCQmedium

A company uses Cloud NAT for outbound internet access. Engineering notices that some VM instances fail to connect to external services during peak hours. The network engineer suspects port exhaustion. Which action would best mitigate this issue?

A.Change the NAT type from standard to public.

B.Enable TCP keepalive on the NAT gateway.

C.Reduce the number of NAT gateways in the region.

D.Increase the number of NAT IP addresses assigned to the NAT gateway.

AnswerD

More NAT IPs provide additional source ports, alleviating exhaustion.

Why this answer

Port exhaustion occurs when the NAT gateway runs out of available source ports to map outbound connections. Increasing the number of NAT IP addresses assigned to the gateway multiplies the available port range (each IP provides 64,512 ports), directly alleviating port exhaustion during peak traffic. This is the standard mitigation for port exhaustion in Cloud NAT.

Exam trap

Google Cloud often tests the misconception that reducing NAT gateways or changing NAT type solves port exhaustion, when the actual solution is increasing the number of NAT IP addresses to expand the available port range.

How to eliminate wrong answers

Option A is wrong because changing the NAT type from standard to public is not a valid concept in Cloud NAT; Cloud NAT is always public-facing, and this option reflects a misunderstanding of NAT types. Option B is wrong because TCP keepalive helps maintain idle connections but does not increase the port pool or prevent port exhaustion; it may even delay port release. Option C is wrong because reducing the number of NAT gateways in the region would decrease the total available port capacity, worsening port exhaustion rather than mitigating it.

Practice this question →

MCQmedium

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

A.HTTPS

B.TCP

C.HTTP

D.gRPC

AnswerD

gRPC health check is specifically designed to check gRPC service health.

Why this answer

Health checks support HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC. For gRPC backends, a gRPC health check is the most appropriate as it reflects the application health. The other protocols may not accurately indicate gRPC service health.

Practice this question →

MCQhard

An engineer wants to use Cloud DNS to override DNS responses for a specific domain within their VPC. Which feature should they use?

A.Private zone

B.Response policy zone (RPZ)

C.DNSSEC

D.Routing policy

AnswerB

Correct: RPZ allows custom DNS responses for domains.

Why this answer

Response policy zones (RPZ) allow overriding DNS responses for specified domains within a VPC.

Practice this question →

MCQeasy

A company has deployed an HTTP load balancer with a backend service configured to use an unmanaged instance group. Users report that traffic is not reaching the backend instances. The backend instances are healthy and have proper firewall rules allowing traffic from the load balancer. What step should the network engineer take to resolve the issue?

A.Configure a firewall rule to allow health check probes from the load balancer's health check ranges.

B.Enable HTTP health check on the backend service.

C.Assign an external IP address to each backend instance.

D.Add a route for the load balancer's IP range.

AnswerD

Correct. A missing route for the load balancer's IP range prevents traffic from reaching the backend instances. Adding the route resolves the issue.

Why this answer

The load balancer sends traffic to backend instances using their internal IP addresses. If there is no route from the load balancer's frontend IP range to the subnet containing the backend instances, traffic will be dropped. Adding a route for the load balancer's IP range ensures that packets can reach the instances.

Since the problem states firewall rules are already proper, Option A (health check firewall rules) is unnecessary. Health checks are already configured (Option B is not needed). Instances do not require external IPs (Option C).

Therefore, the correct step is to add the missing route.

Exam trap

Candidates may mistakenly focus on health check firewall rules when the actual issue is a missing route for the load balancer's traffic.

Practice this question →

Multi-Selecthard

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

Select 3 answers

A.Check if the external service is blocking the Cloud NAT IP addresses.

B.Verify that the VPC firewall rules allow egress traffic from the instances.

C.Ensure that the VPC has a default route to the internet gateway.

D.Verify that the Cloud Router associated with Cloud NAT is healthy and has established BGP sessions.

E.Check the DNS resolution for the external service.

AnswersA, B, D

Some external services may block specific IP ranges, including NAT IPs.

Why this answer

Cloud NAT uses a set of public IP addresses for outbound traffic. If the external service has firewall rules or access control lists that block these specific IP addresses, the instances will be unable to reach it. Checking for IP-based blocking is a standard first step in troubleshooting connectivity issues through a NAT gateway.

Exam trap

Google Cloud often tests the misconception that DNS resolution is the primary cause of connectivity failures to external services, when in fact the issue is often at the network layer (e.g., IP blocking or firewall rules) rather than the application layer.

Practice this question →

MCQmedium

Your organization has an internal HTTP load balancer (ILB) in us-central1. The backend service is a managed instance group with a health check on port 8080. Recently, some instances are reported as unhealthy despite the application running fine. What is the most likely cause?

A.The health check firewall rule is configured for the same source range as the VPC internal traffic.

B.The internal load balancer is using a proxy protocol which changes the health check source IP.

C.The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).

D.The instances are preemptible and become unhealthy after 24 hours.

AnswerC

Correct. Health check probes originate from Google's IP ranges (35.191.0.0/16, 130.211.0.0/22). If these are not allowed in the firewall rule, health checks fail.

Why this answer

The most likely cause is that the firewall rule allowing health check probes does not include the required Google Cloud health check source IP ranges (35.191.0.0/16 and 130.211.0.0/22). For internal HTTP load balancers, the health check probes originate from these specific ranges, not from within the VPC. If the firewall rule only permits traffic from the VPC internal ranges, health checks will fail even if the application is running.

Option A is wrong because the health check source range is not the same as VPC internal traffic; it must be the GCP health check ranges. Option B is wrong because proxy protocol does not affect health check source IPs for internal load balancers. Option D is wrong because preemptible instances do not become unhealthy after 24 hours due to preemption; they are terminated, not marked unhealthy.

Practice this question →

MCQmedium

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

A.IP allowlist/denylist

B.Pre-configured WAF rules

C.Named IP address lists

D.Rate limiting

AnswerB

WAF rules include signatures for SQL injection and other common web attacks.

Why this answer

Pre-configured WAF rules in Cloud Armor include a SQL injection (SQLi) rule that inspects HTTP(S) request bodies, headers, and URIs for SQL injection patterns. This rule uses a set of signatures to detect and block malicious SQL queries, directly addressing the requirement to protect against SQL injection attacks on an external HTTP(S) load balancer.

Exam trap

Google Cloud often tests the misconception that IP-based controls (allowlist/denylist or named IP lists) can protect against application-layer attacks like SQL injection, but these features operate at Layer 3/4 and cannot inspect HTTP payloads.

How to eliminate wrong answers

Option A is wrong because IP allowlist/denylist only controls access based on source IP addresses and cannot inspect application-layer payloads for SQL injection patterns. Option C is wrong because Named IP address lists are simply a way to group IP addresses for use in firewall rules or allowlist/denylist policies, not a mechanism for content inspection. Option D is wrong because Rate limiting only restricts the number of requests from a client over a time window and does not analyze request content for SQL injection signatures.

Practice this question →

MCQhard

A company is using Traffic Director with Envoy sidecar proxies to manage traffic between microservices. They want to gradually shift 5% of traffic from version v1 to v2 of a service for testing. Which Traffic Director resource should they configure?

A.Define a weighted traffic split in the HTTP route rule of the Traffic Director route configuration

B.Use the Envoy runtime to dynamically adjust traffic percentages

C.Create a new backend service for v2 and set the traffic split in the backend service

D.Configure a weighted round-robin routing policy in Cloud DNS

AnswerA

Traffic Director uses route rules with weighted clusters to split traffic.

Why this answer

Traffic Director supports traffic splitting via weighted routing in the HTTP route configuration, not in the backend service. The traffic splitting is done at the routing level.

Practice this question →

MCQmedium

A company is deploying a global web application on Google Cloud. They need to serve traffic from the closest region to users, support both HTTP and HTTPS, and offload SSL/TLS termination at the load balancer. Which load balancing solution should they use?

A.Global SSL Proxy Load Balancer

B.Regional External HTTP(S) Load Balancer

C.Global HTTPS Load Balancer

D.Global TCP Proxy Load Balancer

AnswerC

The Global HTTPS LB provides SSL offload, anycast IP, and URL-based routing.

Why this answer

The Global HTTPS Load Balancer is a layer 7 proxy that can terminate SSL/TLS, route traffic based on URL maps, and serve users from the closest region via anycast IP. It supports both HTTP and HTTPS.

Practice this question →

MCQmedium

Refer to the exhibit. A DNS managed zone is configured with private visibility and associated with a VPC network. A Compute Engine instance in a different VPC network tries to resolve 'test.example.com' but fails. What is the most likely reason?

A.The zone is not set as authoritative for example.com.

B.The Cloud DNS name servers are not reachable from the instance.

C.The instance's VPC is not in the list of authorized networks.

D.The instance does not have the required IAM permissions.

AnswerC

The zone only resolves queries from vpc1; other VPCs are not authorized.

Why this answer

Private zones only respond to queries from authorized VPC networks. The instance is in a different VPC, so resolution fails.

Practice this question →

MCQhard

A security team wants to serve private content through Cloud CDN but restrict access to only authorized users. They need to generate time-limited URLs that do not require users to log in. Which approach should they use?

A.Use Cloud CDN signed URLs

B.Use IAM permissions on the bucket

C.Use Cloud CDN signed cookies

D.Enable Cloud CDN and set the bucket to public

AnswerA

Signed URLs provide time-limited access without user login.

Why this answer

Signed URLs allow generating time-limited URLs for private content without requiring user login. Signed cookies are for multiple URLs. Public buckets or IAM are not suitable.

Practice this question →

MCQeasy

You need to configure Cloud CDN to cache all content from a backend bucket, ignoring any Cache-Control headers sent by the origin. Which cache mode should you use?

A.USE_ORIGIN_HEADERS

B.CACHE_ALL_STATIC

C.DYNAMIC_MODE

D.FORCE_CACHE_ALL

AnswerD

Correct: forces caching regardless of origin headers.

Why this answer

FORCE_CACHE_ALL ignores origin headers and caches all responses for the specified TTL.

Practice this question →

MCQhard

Your company has a hybrid cloud architecture with two on-premises data centers: DC1 and DC2. Each DC is connected to Google Cloud via separate Cloud VPN tunnels (tunnel1 from DC1, tunnel2 from DC2) to a VPC in us-west1. The VPC has two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). DC1 has a subnet 192.168.1.0/24 and DC2 has 192.168.2.0/24. You configure BGP on both tunnels with the VPC dynamic routing, and each on-premises router advertises its local subnet. The VPC automatically imports the learned routes. You notice that traffic from DC1 to an instance in subnet-a (10.0.1.5) works, but traffic from DC2 to the same instance fails intermittently. Additionally, traffic from DC2 to DC1 (192.168.1.0/24) fails completely. You check the route tables and see that both tunnels have learned the routes for the remote subnets. What is the most likely cause and solution?

A.Create a new VPN tunnel from DC2 to a different VPC and use VPC peering.

B.Increase the MTU on the VPN tunnels to avoid fragmentation.

C.Configure each Cloud VPN tunnel with a separate Cloud Router and assign different BGP priorities to influence route selection, or use distinct regions for the VPN gateways.

D.Disable dynamic routing on both tunnels and use static routes instead.

AnswerC

Separate Cloud Routers allow fine-grained control over route priority, preventing asymmetric routing.

Why this answer

The issue is that both Cloud VPN tunnels are using the same Cloud Router, causing BGP to learn identical routes for the on-premises subnets from both tunnels. This leads to asymmetric routing and potential black-holing, especially when traffic from DC2 to DC1 or to subnet-a is routed via DC1's tunnel due to equal-cost multi-path (ECMP) or default BGP tie-breaking. By configuring separate Cloud Routers with different BGP priorities (MED or local preference), you can force traffic from each DC to use its own tunnel, ensuring symmetric routing and consistent connectivity.

Exam trap

Google Cloud often tests the misconception that VPN tunnels inherently provide symmetric routing, when in fact BGP route propagation without proper priority configuration can cause ECMP or suboptimal path selection, leading to intermittent failures.

How to eliminate wrong answers

Option A is wrong because creating a new VPN tunnel to a different VPC and using VPC peering adds unnecessary complexity and does not address the root cause of route conflict between the two tunnels; the problem is within the same VPC. Option B is wrong because increasing MTU addresses fragmentation issues, which would manifest as packet drops or performance degradation, not intermittent or complete connectivity failures for specific traffic flows. Option D is wrong because disabling dynamic routing and using static routes would remove the learned routes for remote subnets, breaking connectivity entirely, and would not resolve the asymmetric routing caused by BGP route propagation.

Practice this question →

MCQmedium

A developer wants to use Cloud CDN to cache content from a backend bucket. They want to cache all objects regardless of cache-control headers, but need to exclude certain URL patterns (e.g., /private/*) from caching. Which cache mode should they choose?

A.FORCE_CACHE_ALL

B.CACHE_ALL_STATIC

C.DISABLED

D.USE_ORIGIN_HEADERS

AnswerA

This mode caches all objects regardless of cache-control. To exclude specific paths, you would need additional configuration like separate backends.

Why this answer

Cloud CDN cache modes: FORCE_CACHE_ALL caches all content irrespective of origin headers; USE_ORIGIN_HEADERS respects cache-control; CACHE_ALL_STATIC is similar to FORCE_CACHE_ALL but for static content. To exclude certain paths, you need to set up cache key or use URL map routing to different backends. The question asks for cache mode; FORCE_CACHE_ALL will cache everything by default, but to exclude patterns, you need to configure cache key rules or separate backends.

However, the best answer among the options is FORCE_CACHE_ALL because it caches all objects, but the exclusion would require additional configuration. There is no "CACHE_ALL_EXCEPT" mode. Actually, the correct approach is to use a URL map with two backend buckets: one for public content with FORCE_CACHE_ALL, and one for private content with no CDN.

But among the cache modes, FORCE_CACHE_ALL is the one that ignores cache-control.

Practice this question →

MCQeasy

A service provider uses a Shared VPC with multiple service projects. The host project has a Cloud NAT configured for subnet 10.1.0.0/24 to provide outbound internet access to all service projects using that subnet. A new service project needs to use its own Cloud NAT for its VM instances in subnet 10.1.0.0/24 to meet compliance requirements. The network engineer attempts to create a Cloud NAT in the service project for that subnet but receives an error that the subnet already has a NAT gateway. What action should the engineer take to meet the compliance requirement?

A.Create a new Cloud NAT in the service project for the same subnet, overwriting the existing one.

B.Use VPC peering to connect the service project to a different network that has a Cloud NAT.

C.Implement a proxy instance with an external IP in the service project.

D.Remove the host project's NAT from the subnet and create a Cloud NAT in the service project for that subnet.

AnswerD

This removes the conflict and allows the service project to manage its own NAT.

Why this answer

A subnet can have only one NAT gateway associated. To allow the service project to use its own Cloud NAT for subnet 10.1.0.0/24, the host project's Cloud NAT must first be removed from that subnet. Then the service project can create its own Cloud NAT for the same subnet.

Option A is not possible due to the conflict. Option B (VPC peering) would not allow the service project to have its own NAT on the same subnet. Option C (proxy instance) introduces management overhead and is not a native solution.

Practice this question →

MCQmedium

You are designing a multi-tier application where an internal HTTP(S) load balancer should route requests to a backend service based on the URL path (e.g., /api/* to one service, /web/* to another). Which component is essential for this routing?

A.Cloud NAT

B.VPC peering

C.URL map

D.Firewall rules

AnswerC

Correct: URL maps define content-based routing.

Why this answer

The Internal HTTP(S) Load Balancer uses a URL map to define path-based routing rules to backend services.

Practice this question →

MCQeasy

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

A.Service attachment

B.Internal forwarding rule

C.Cloud VPN tunnel

D.Private Service Connect endpoint

AnswerD

The consumer creates an endpoint to connect to the producer's service.

Why this answer

When a consumer wants to connect to a managed SaaS application published via Private Service Connect (PSC), they must create a Private Service Connect endpoint in their own VPC. This endpoint is a regional resource that uses an internal IP address from the consumer's VPC and establishes a connection to the service attachment published by the provider. The endpoint effectively makes the SaaS service accessible as if it were a resource inside the consumer's VPC, without requiring public IPs or VPNs.

Exam trap

Google Cloud often tests the distinction between who creates which resource — candidates mistakenly think the consumer creates the service attachment (Option A) because they confuse it with the endpoint, but the service attachment is always created by the provider.

How to eliminate wrong answers

Option A is wrong because a service attachment is created by the service provider (the SaaS company) to publish their service, not by the consumer. Option B is wrong because an internal forwarding rule is used within a VPC to route traffic to a backend service (e.g., a load balancer), but it does not directly connect to a PSC service attachment; the PSC endpoint itself handles the forwarding. Option C is wrong because a Cloud VPN tunnel is used for site-to-site or remote access connectivity between on-premises networks and Google Cloud, not for connecting to a published PSC service.

Practice this question →

MCQeasy

A company runs a private GKE cluster in us-central1. Pods need to access the internet for updates. Which configuration is required?

A.Add network tags to allow egress traffic.

B.Create a Cloud Router with BGP peering.

C.Enable Cloud NAT on the cluster's subnet.

D.Assign external IPs to the nodes.

AnswerC

Cloud NAT provides outbound internet access for private instances.

Why this answer

In a private GKE cluster, nodes do not have external IPs, so pods cannot reach the internet directly. Cloud NAT provides outbound connectivity by translating private IPs to a public IP, allowing pods to fetch updates while keeping the cluster private. This is the standard solution for outbound-only internet access from private GKE clusters.

Exam trap

Google Cloud often tests the misconception that private clusters can reach the internet via default routes or firewall rules alone, but the trap here is that without Cloud NAT or a public IP, private instances have no path to the internet because the VPC's default route only covers internal ranges.

How to eliminate wrong answers

Option A is wrong because network tags control firewall rules for ingress/egress traffic within a VPC, but they do not provide internet connectivity; without a public IP or NAT, egress traffic to the internet is still blocked. Option B is wrong because Cloud Router with BGP peering is used for dynamic routing between on-premises and GCP, not for providing internet access to private instances. Option D is wrong because assigning external IPs to nodes would expose them to the internet, defeating the purpose of a private cluster and violating security best practices; Cloud NAT is the correct approach to avoid public IPs on nodes.

Practice this question →

Multi-Selecthard

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

Select 2 answers

A.Ensure Cloud NAT is enabled in each zone where instances are located

B.Check Cloud NAT logs for port exhaustion

C.Verify that the instances have external IP addresses assigned

D.Verify that the external service is not blocking the NAT IP addresses

E.Review the health check configuration for the NAT gateway

AnswersB, D

Port exhaustion can cause connection failures; Cloud NAT logs show when ports are depleted.

Why this answer

Cloud NAT logs can reveal port exhaustion, which occurs when the NAT gateway runs out of available source ports for connections. Since all instances share the same NAT IP addresses, high connection counts from some instances can exhaust ports, preventing others from establishing new outbound connections. Checking these logs helps identify whether port exhaustion is the root cause of the connectivity issue.

Exam trap

Google Cloud often tests the misconception that Cloud NAT must be zone-specific or that instances need external IPs for NAT to work, but the real trap is overlooking port exhaustion as a common failure mode when multiple instances share the same NAT gateway.

Practice this question →

MCQeasy

Which Traffic Director feature ensures that a service does not receive more requests than it can handle by setting a maximum number of concurrent requests or connections?

A.Traffic splitting

B.Circuit breakers

C.mTLS

D.Fault injection

AnswerB

Circuit breakers enforce limits on connections/requests to prevent overload.

Why this answer

Circuit breakers are used to limit the number of concurrent connections or requests to a service to prevent overload. Fault injection is for testing. Traffic splitting is for gradual rollouts. mTLS is for mutual TLS authentication.

Practice this question →

MCQeasy

A network engineer notices unusual traffic patterns from a VM. They want to capture detailed information about each packet sent and received by the VM, including source and destination IPs, protocols, and ports. Which feature should they enable?

A.Packet Mirroring

B.VPC Flow Logs

C.Cloud Audit Logs

D.Firewall Rules Logging

AnswerB

VPC Flow Logs sample and log network flows with metadata.

Why this answer

VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IPs, protocols, and ports. This feature is designed specifically for analyzing traffic patterns and troubleshooting connectivity issues at the network layer, making it the correct choice for the described requirement.

Exam trap

Google Cloud often tests the distinction between metadata logging (VPC Flow Logs) and full packet capture (Packet Mirroring), leading candidates to choose Packet Mirroring when only summary traffic information is needed.

How to eliminate wrong answers

Option A is wrong because Packet Mirroring copies the actual packet payload (full packet capture) for deep inspection, not just metadata like IPs and ports, and is typically used for security appliances or intrusion detection, not for lightweight traffic pattern analysis. Option C is wrong because Cloud Audit Logs record administrative actions and API calls (e.g., who created a VM), not network packet-level details such as IPs, protocols, or ports. Option D is wrong because Firewall Rules Logging logs only traffic that is allowed or denied by firewall rules, and it does not capture all packets sent/received by a VM; it is rule-centric, not interface-centric.

Practice this question →

MCQhard

An organization has deployed an internal TCP/UDP load balancer in their VPC. They need to ensure that the load balancer preserves the client IP address when forwarding traffic to backend instances. Which configuration is required?

A.Configure the health check to use the client IP as source.

B.Enable Proxy Protocol on the load balancer.

C.Use a backend service with session affinity.

D.No configuration is needed; client IP is preserved by default.

AnswerD

Internal TCP/UDP LB is pass-through, so client IP is preserved automatically.

Why this answer

Internal TCP/UDP Load Balancers are pass-through load balancers (Layer 4). They preserve the client IP address by default because they forward packets directly without NAT. No special configuration is needed; the backend instances see the original source IP.

Practice this question →

MCQhard

A company uses Cloud DNS with a managed zone for example.com. They want to override DNS responses for a specific subdomain, mail.example.com, to point to an internal IP address when queried from within the VPC, but external queries should resolve normally. Which feature should they use?

A.DNS Security Extensions (DNSSEC)

B.Private DNS zone

C.Response Policy Zone (RPZ)

D.Routing policy (weighted or geo)

AnswerC

Correct. RPZ can override DNS responses for specific domains within a VPC.

Why this answer

Response Policy Zones (RPZ) allow you to override DNS responses for specific domains based on the source network. This is used for DNS filtering or overriding.

Practice this question →

MCQmedium

A company wants to securely connect an on-premises data center to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) that overlap with the VPC subnet (10.0.1.0/24). They need connectivity to specific workloads in the VPC without changing IP addresses on premises. What should they do?

A.Use VPC Network Peering with a custom route exchange to filter the overlapping range.

B.Set up Dedicated Interconnect and configure BGP with the on-premises router, advertising a more specific prefix.

C.Use Cloud NAT and configure a firewall rule to allow traffic from the on-premises network.

D.Deploy Private Service Connect to expose the VPC workloads as endpoints accessible from on-premises.

AnswerD

Private Service Connect allows private connectivity without route overlap by using service attachments and endpoints.

Why this answer

Private Service Connect (PSC) allows on-premises clients to access specific VPC workloads via internal IP addresses (RFC 1918) without requiring VPC peering or VPN. PSC publishes the workloads as endpoints reachable through a Private Service Connect endpoint in the on-premises network, avoiding IP overlap by using a separate IP address range for the endpoint. This solution meets the requirement of not changing on-premises IPs while providing secure, targeted connectivity.

Exam trap

The trap here is that candidates assume BGP or more specific prefixes can overcome IP overlap, but without NAT or a proxy mechanism, overlapping routes cause routing conflicts that break connectivity.

How to eliminate wrong answers

Option A is wrong because VPC Network Peering requires non-overlapping IP ranges between the two networks; overlapping RFC 1918 addresses (10.0.0.0/8 vs 10.0.1.0/24) cannot be resolved by custom route exchange, as peering does not support NAT or address translation. Option B is wrong because Dedicated Interconnect with BGP does not solve IP overlap; even with a more specific prefix, the on-premises router would still have a conflicting route for 10.0.0.0/8, causing asymmetric routing or unreachability. Option C is wrong because Cloud NAT is designed for outbound internet traffic from VMs, not for inbound connectivity from on-premises networks; firewall rules cannot translate overlapping IPs or provide direct access to VPC workloads.

Practice this question →

MCQmedium

A company has a TCP-based application running on a group of Compute Engine VMs in us-central1. They need to provide a static internal IP address to clients within the VPC, while preserving the client source IP for logging. Which load balancer should they use?

A.Regional Internal HTTP(S) Load Balancer

B.Regional Internal TCP/UDP Load Balancer

C.Regional External TCP/UDP Network Load Balancer

D.Global Internal HTTP(S) Load Balancer

AnswerB

Correct. Pass-through L4 load balancer that preserves client IP.

Why this answer

The Regional Internal TCP/UDP Load Balancer is a pass-through load balancer that preserves client IP. It provides a static internal IP and operates at L4.

Practice this question →

MCQhard

A media company uses Cloud CDN with signed URLs to distribute premium video content. They need to revoke access for a specific user immediately. Which approach should they take?

A.Use Cloud CDN cache invalidation to remove the user's content

B.Add the user's IP address to a deny list in the load balancer

C.Delete the signed URL key that was used to sign the user's URL

D.Change the signing algorithm to SHA512

AnswerC

Deleting the key invalidates all URLs signed with that key, effectively revoking access.

Why this answer

Signed URLs are based on keys; to revoke access, you can either remove the key (invalidates all URLs signed with that key) or wait for expiration. There is no per-user revocation. The correct approach is to delete or disable the signing key, which invalidates all URLs signed with that key.

Practice this question →

MCQhard

A company is migrating on-premises DNS to Google Cloud. They have a hybrid network using Cloud VPN and want to resolve on-premises hostnames from Compute Engine instances without custom scripts. Which service should they use?

A.Use Cloud DNS inbound server policy to forward queries to on-premises DNS.

B.Create a forwarding zone in Cloud DNS and associate it with the VPC.

C.Enable Private Google Access on the VPC subnet.

D.Configure Cloud NAT to forward DNS queries to on-premises DNS servers.

AnswerA

Cloud DNS inbound server policy enables DNS queries from GCP to be forwarded to on-premises DNS servers via VPN or Interconnect.

Why this answer

Cloud DNS inbound server policy allows on-premises DNS servers to receive DNS queries from Compute Engine instances by creating a VPC-scoped policy that forwards queries to the IP addresses of on-premises DNS resolvers over Cloud VPN. This enables hybrid name resolution without custom scripts, as the policy automatically handles the forwarding of DNS requests from Google Cloud resources to the on-premises DNS infrastructure.

Exam trap

Google Cloud often tests the distinction between inbound and outbound DNS policies; the trap here is confusing the direction of DNS resolution, leading candidates to choose a forwarding zone (outbound) when the requirement is for Compute Engine to resolve on-premises hostnames (inbound).

How to eliminate wrong answers

Option B is wrong because a forwarding zone in Cloud DNS is used to forward queries from on-premises to Google Cloud, not the reverse; it resolves Google Cloud private DNS names from on-premises, not on-premises hostnames from Compute Engine. Option C is wrong because Private Google Access enables Compute Engine instances without external IPs to reach Google APIs and services, not to resolve on-premises hostnames. Option D is wrong because Cloud NAT is used for outbound internet connectivity from private instances, not for DNS query forwarding; it does not provide DNS resolution for on-premises hostnames.

Practice this question →

MCQhard

You are configuring a Regional Internal HTTP(S) Load Balancer for a service that must only be accessible from within a VPC. The backend is a zonal NEG of Compute Engine instances. The load balancer is not receiving traffic. What is a likely cause?

A.The zonal NEG is in a different zone than the forwarding rule

B.The health check is using TCP but the instances expect HTTP

C.The backend service is in a different region than the forwarding rule

D.The forwarding rule uses an external IP address

AnswerC

Backend service and forwarding rule must be in the same region.

Why this answer

Internal HTTP(S) LB requires an internal forwarding rule in the same region as the backend. The forwarding rule must use an internal IP address, and the backend service must be in the same region.

Practice this question →

Multi-Selectmedium

Which THREE factors should be considered when choosing between a global external HTTP(S) load balancer and a regional external HTTP(S) load balancer? (Choose 3.)

Select 3 answers

A.Support for multiple backend types (Compute Engine, GKE, serverless).

B.SSL termination at the edge (global) vs. at the backend (regional).

C.Ability to use health checks.

D.Integration with Cloud CDN.

E.Need for a single anycast IP address worldwide.

AnswersB, D, E

Global terminates SSL at the edge; regional terminates at the backend.

Why this answer

Regional external HTTP(S) load balancers terminate SSL at the backend (the backend service or instance), meaning the encrypted traffic must travel to the backend before decryption. Global external HTTP(S) load balancers terminate SSL at the edge (Google Front End), decrypting traffic at the closest point of presence and forwarding plaintext HTTP to the backend. This architectural difference impacts security, latency, and backend processing requirements, making it a key factor in choosing between the two.

Exam trap

Google Cloud often tests the misconception that SSL termination location is the same for both load balancer types, but the key distinction is that global terminates at the edge (GFE) and regional terminates at the backend, which directly affects security and performance decisions.

Practice this question →

MCQhard

An organization is deploying a Shared VPC with one host project and three service projects. Each service project has multiple VPC networks. They want to ensure that only the host project's network admin can create firewall rules affecting the shared VPC network. Which architecture satisfies this requirement?

A.Create the shared VPC network in the host project and grant the network admin IAM role only to host project users.

B.Use VPC Network Peering between each service project and the host project, and allow each service project admin to manage their own firewall rules.

C.Assign the network admin role to users in each service project for the shared VPC network.

D.Create separate VPC networks in each service project and use VPC Network Peering to interconnect them.

AnswerA

Shared VPC firewall rules are managed in the host project, and IAM restricts who can modify them.

Why this answer

In a Shared VPC architecture, the host project owns the shared VPC network, and only IAM roles granted in the host project can manage that network's resources. By creating the shared VPC network in the host project and granting the network admin IAM role exclusively to host project users, you ensure that only those users can create firewall rules for the shared VPC. Service project users cannot modify the shared network's firewall rules because they lack the necessary IAM permissions on the host project.

Exam trap

The trap here is that candidates often confuse VPC Network Peering with Shared VPC, assuming peering provides centralized management, when in fact peering only enables connectivity without any cross-project IAM control over firewall rules.

How to eliminate wrong answers

Option B is wrong because VPC Network Peering does not centralize firewall rule management; each peered network's admin can create firewall rules for their own network, and peering does not allow one side to control the other's firewall rules, so service project admins could still manage their own rules, violating the requirement. Option C is wrong because assigning the network admin role to users in each service project for the shared VPC network would give those service project users the ability to create firewall rules affecting the shared VPC, directly contradicting the requirement that only the host project's network admin can do so. Option D is wrong because creating separate VPC networks in each service project and using VPC Network Peering to interconnect them does not create a shared VPC; each service project would have full control over its own firewall rules, and peering does not centralize rule management, so the requirement is not met.

Practice this question →

MCQmedium

A company runs a microservices application on Google Kubernetes Engine (GKE) with an Envoy sidecar proxy for each service. They want to use Traffic Director to apply traffic policies such as traffic splitting between versions and fault injection. Which API does Traffic Director use to configure Envoy proxies?

A.Traffic Director xDS API

B.gRPC API

C.Kubernetes Ingress API

D.Cloud Endpoints API

AnswerA

xDS (Discovery Service) is the standard API used by Envoy to receive dynamic configuration.

Why this answer

Traffic Director implements the Envoy xDS (Discovery Service) APIs to dynamically configure Envoy sidecar proxies with routing, load balancing, and health checking policies.

Practice this question →

MCQmedium

An engineer is deploying a Regional External HTTP(S) Load Balancer to serve a web application on Compute Engine. They want to maintain the highest availability by automatically rerouting traffic away from unhealthy instances. Which additional configuration is required?

A.Enable connection draining on the backend service

B.Use a global load balancer instead

C.Configure a health check on the backend service

D.Set up a managed instance group with autoscaling

AnswerC

Health checks allow the load balancer to mark instances unhealthy and stop sending traffic.

Why this answer

Health checks are required to detect unhealthy instances. Without them, the load balancer will route traffic to any instance in the backend service. Autoscaling and managed instance groups are not mandatory for basic health checking but are recommended.

Practice this question →

MCQmedium

An engineer is configuring a Global HTTPS Load Balancer with a backend service that points to a serverless NEG for Cloud Functions. The health checks are failing. What is the most likely cause?

A.The health check path is incorrect

B.Serverless NEGs do not support health checks

C.The backend service is not associated with the correct URL map

D.The health check protocol is set to HTTP instead of HTTPS

AnswerB

Health checks are not supported for serverless NEGs. They must be disabled or omitted.

Why this answer

Serverless NEGs do not support health checks. The load balancer relies on the underlying Cloud Functions being healthy. Health checks must be disabled for serverless backends.

Practice this question →

MCQmedium

A company wants to expose a web application running on Cloud Run globally with a single anycast IP address, using HTTP(S) load balancing and Cloud CDN for static content. The application should be accessible at https://app.example.com. What is the correct configuration?

A.Create a global SSL Proxy load balancer with a Cloud Run backend bucket.

B.Create a global external HTTP(S) load balancer with a serverless NEG that points to the Cloud Run service.

C.Create a global TCP Proxy load balancer with a hybrid connectivity NEG.

D.Create a regional external HTTP(S) load balancer with a serverless NEG.

AnswerB

Global HTTPS LB with serverless NEG provides global anycast IP, CDN integration, and supports Cloud Run.

Why this answer

Global HTTPS LB with serverless NEG targeting Cloud Run is the best practice for globally exposing serverless workloads with CDN. The other options either lack CDN (SSL Proxy), are regional (regional LB), or use incorrect NEG type (hybrid NEG for on-prem).

Practice this question →

MCQeasy

You need to configure SSL certificates for a Global HTTPS Load Balancer. The certificate should be automatically provisioned and managed by Google. Which type of certificate should you use?

A.Google-managed certificate

B.Compute Engine instance certificate

C.Certificate Authority Service certificate

D.Self-managed certificate

AnswerA

Correct: Google manages provisioning and renewal.

Why this answer

Google-managed certificates are automatically provisioned and renewed for load balancers.

Practice this question →

MCQmedium

You need to migrate traffic gradually from an old version of a microservice to a new version using Traffic Director. You want to send 10% of traffic to the new version and 90% to the old version. Which configuration should you use?

A.Configure a weighted destination rule in the Envoy route with weights 9:1.

B.Create two separate backend services and use a URL map to distribute traffic.

C.Set circuit breaker thresholds to limit connections to the new version.

D.Use a health check to gradually remove the old version instances.

AnswerA

Traffic splitting is done via weighted destination rules in Envoy.

Why this answer

Traffic Director supports traffic splitting via weighted destination rules in the Envoy configuration. The correct approach is to specify weights for each service version in the route rule. Setting circuit breaker thresholds or using connection draining does not achieve traffic splitting.

Practice this question →

MCQmedium

A gaming company uses Cloud Armor with an external HTTP(S) load balancer to protect against DDoS attacks. They need to restrict access to the load balancer based on geographic region. What should they configure?

A.Geo-based routing policy on the backend service

B.A firewall rule that blocks IPs from certain countries

C.Geo-match custom rule in Cloud Armor

D.Use Cloud CDN with geo filtering

AnswerC

Cloud Armor rules can filter traffic based on geographic region (e.g., country or continent).

Why this answer

Cloud Armor supports geo-match custom rules that allow you to allow or deny traffic based on the geographic region of the client IP address. When attached to an external HTTP(S) load balancer, these rules are evaluated at the edge before traffic reaches the backend, providing effective geo-based access control against DDoS attacks.

Exam trap

Google Cloud often tests the distinction between Cloud Armor's security policies (which include geo-match rules) and backend service routing policies, leading candidates to confuse geo-based routing with geo-based access control.

How to eliminate wrong answers

Option A is wrong because geo-based routing policy on the backend service is used for directing traffic to different backends based on client location, not for blocking or allowing access at the edge. Option B is wrong because firewall rules operate at the VPC network level and cannot be applied directly to an external HTTP(S) load balancer; they would block traffic after it has already passed through the load balancer, which is ineffective for DDoS protection. Option D is wrong because Cloud CDN with geo filtering is a feature of Cloud CDN that restricts content delivery based on geography, but it does not provide the same granular access control or DDoS mitigation capabilities as Cloud Armor's geo-match rules.

Practice this question →

MCQhard

An organization has a Dedicated Interconnect with Cloud Router configured for BGP. The on-premises network advertises a prefix that overlaps with an existing VPC subnet. How does Google Cloud handle the overlapping prefix?

A.It accepts the prefix but static routes have higher priority.

B.It accepts the prefix and gives it higher priority than the VPC subnet.

C.It rejects the prefix and does not install a dynamic route for it.

D.It accepts the prefix and load balances traffic between the two locations.

AnswerC

Google Cloud rejects overlapping prefixes to maintain routing integrity.

Why this answer

When a Dedicated Interconnect with Cloud Router receives a BGP advertisement for a prefix that overlaps with an existing VPC subnet, Google Cloud rejects the prefix and does not install a dynamic route for it. This is because VPC subnet routes always take precedence over dynamically learned routes, and accepting an overlapping prefix would create ambiguity in forwarding decisions. The Cloud Router enforces this behavior to maintain the integrity of the VPC's internal addressing.

Exam trap

The trap here is that candidates often assume BGP routes can override VPC subnet routes due to the dynamic nature of BGP, but Google Cloud enforces a strict priority hierarchy where VPC subnet routes are always preferred over any dynamically learned or static route.

How to eliminate wrong answers

Option A is wrong because static routes do not have higher priority than VPC subnet routes; VPC subnet routes are implicitly created and have the highest priority (0), while static routes have a priority of 1000. Option B is wrong because Google Cloud never gives a dynamically learned BGP route higher priority than a VPC subnet route; the VPC subnet route is always preferred. Option D is wrong because Google Cloud does not load balance traffic between overlapping prefixes; it rejects the overlapping prefix entirely to prevent routing conflicts.

Practice this question →

MCQeasy

What is the purpose of a Response Policy Zone (RPZ) in Cloud DNS?

A.To override DNS responses for specified domains (e.g., block or redirect)

B.To route traffic based on geographic location of the requester

C.To enable weighted round-robin load balancing for multiple IPs

D.To create private DNS zones within a VPC

AnswerA

RPZ allows overriding DNS responses for policy enforcement.

Why this answer

RPZ allows you to override DNS responses for specific domains, often used for security (malware filtering) or policy enforcement. It is not for routing traffic, private zones, or load balancing.

Practice this question →

MCQeasy

Which load balancer type preserves the client source IP address and can be used for TCP/UDP traffic on a specific port, passing traffic through to backend instances without proxy overhead?

A.Regional Internal TCP/UDP Load Balancer

B.Global External TCP Proxy Load Balancer

C.Regional External TCP/UDP Network Load Balancer

D.Global External HTTPS Load Balancer

AnswerC

Correct: pass-through LB preserves client IP.

Why this answer

The Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and handles TCP/UDP traffic.

Practice this question →

MCQmedium

A company wants to serve private content from Cloud CDN using signed URLs that expire after 1 hour. Which steps are required to enable this?

A.Set the cache mode to FORCE_CACHE_ALL and enable private access.

B.Pass the signing key in the X-Goog-Signed-URL header on each request.

C.Create a signing key in Cloud CDN, then generate signed URLs with expiration using that key.

D.Enable IAP on the backend and generate signed URLs using the IAP client ID.

AnswerC

Correct: signing keys are created in Cloud CDN, and signed URLs are generated client-side with the key.

Why this answer

Signed URLs require a signing key (created via Cloud CDN backend bucket configuration) and generating URLs programmatically with expiration. Enabling IAP is not required. The key is not passed in the header but as query parameters.

Just setting cache mode does not enable signed URLs.

Practice this question →

MCQhard

A large enterprise is migrating to Google Cloud and needs to establish connectivity between on-premises and VPCs in two different regions (us-east1 and europe-west1). They have a single Partner Interconnect connection at a co-location facility in New York. They want to use the same interconnect for both regions. Which configuration should they use?

A.Create two VLAN attachments, one for each region, over the same interconnect

B.Create one VLAN attachment and attach it to both VPCs

C.Use HA VPN over the interconnect to connect both regions

D.Create two Cloud VPN tunnels from on-prem to each VPC

AnswerA

VLAN attachments are regional; multiple can share same interconnect.

Why this answer

A is correct because a single Partner Interconnect connection can support multiple VLAN attachments, each associated with a different region. By creating two VLAN attachments over the same interconnect—one for us-east1 and one for europe-west1—the enterprise can route traffic from the on-premises network to both VPCs using the same physical link, leveraging Google Cloud's support for multiple VLAN attachments per interconnect.

Exam trap

Google Cloud often tests the misconception that a single VLAN attachment can serve multiple regions, but in Google Cloud, VLAN attachments are regional resources and cannot be shared across regions.

How to eliminate wrong answers

Option B is wrong because a VLAN attachment is a regional resource that can only be attached to a VPC in the same region; you cannot attach a single VLAN attachment to VPCs in two different regions. Option C is wrong because HA VPN over the interconnect is unnecessary and adds complexity; the interconnect already provides a dedicated, high-bandwidth connection, and using VPN over it would introduce encryption overhead and potential performance degradation without solving the multi-region requirement. Option D is wrong because Cloud VPN tunnels are typically used over the public internet or as a backup, not as a primary solution when a dedicated interconnect is available; moreover, using two VPN tunnels would bypass the interconnect's benefits of lower latency and higher reliability.

Practice this question →

Multi-Selectmedium

A company uses Cloud DNS with a managed zone for 'example.com'. They want to implement a failover routing policy so that if the primary health check fails, traffic is sent to a secondary IP. Which THREE resources need to be configured? (Choose three.)

Select 3 answers

A.A DNS record set of type A with a routing policy

B.A health check for the primary endpoint

C.A network tag on the Compute Engine instances

D.A load balancer to front the endpoints

E.A failover routing policy configured on the record set

AnswersA, B, E

The record set defines the DNS name and routing behavior.

Why this answer

To set up failover routing, you need a health check for the primary endpoint, a DNS record set with a routing policy that specifies the primary and secondary targets, and the routing policy configured with failover type. A network tag is not used in DNS. A load balancer is not required; failover routing can point directly to IP addresses.

Practice this question →

MCQeasy

You need to create a serverless Network Endpoint Group (NEG) to attach to a Global HTTPS Load Balancer backend for a Cloud Run service. Which command should you use?

A.gcloud compute backend-services create backend-name --load-balancing-scheme=EXTERNAL --protocol=HTTP --global

B.gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=serverless --cloud-run-service=my-service --region=us-central1

C.gcloud compute instance-groups unmanaged create neg-name --zone=us-central1-a

D.gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=gce-vm-ip-port --zone=us-central1-a

AnswerB

This creates a serverless NEG pointing to the Cloud Run service.

Why this answer

The correct command uses 'gcloud compute network-endpoint-groups create' with the '--network-endpoint-type=serverless' option and specifies the Cloud Run service via '--cloud-run-service'.

Practice this question →

MCQmedium

An organization wants to serve private content via Cloud CDN, ensuring that only authorized users can access cached objects. They need to generate time-limited access for specific URLs. Which method should they use?

A.Set the Cache-Control header to private

B.Use signed URLs with a private key

C.Use Cloud Armor to restrict access by IP

D.Use signed cookies to restrict access

AnswerB

Correct. Signed URLs provide time-limited access to specific URLs.

Why this answer

Signed URLs allow you to grant time-limited access to specific URLs. Signed cookies are for sets of URLs, and Cloud Armor is for WAF, not authorization.

Practice this question →

MCQeasy

A company wants to connect two VPCs in the same project using VPC Network Peering. Each VPC has non-overlapping subnets. What is the minimum number of peering connections required to enable full bidirectional communication?

A.One peering connection from VPC1 to VPC2.

B.Two peering connections from each VPC to the other (total four).

C.Two peering connections: one from VPC1 to VPC2, and one from VPC2 to VPC1.

D.A Shared VPC with subnetworks from both VPCs.

AnswerC

VPC peering is unidirectional, so two connections are needed for full mesh.

Why this answer

VPC Network Peering requires a peering connection to be established in each direction to enable full bidirectional communication. A single peering connection from VPC1 to VPC2 only allows VPC1 to initiate traffic to VPC2; for VPC2 to initiate traffic back to VPC1, a separate peering connection from VPC2 to VPC1 is needed. Therefore, two peering connections (one from each VPC to the other) are the minimum required.

Exam trap

The trap here is that candidates assume a single peering connection is sufficient because they think of it as a bidirectional link, but VPC Network Peering in Google Cloud requires explicit peering in each direction for full bidirectional traffic flow.

How to eliminate wrong answers

Option A is wrong because a single peering connection from VPC1 to VPC2 is unidirectional in terms of route propagation; without a reciprocal peering from VPC2 to VPC1, VPC2 cannot initiate traffic to VPC1. Option B is wrong because it suggests four connections, which is redundant; only two connections (one in each direction) are needed for full bidirectional communication. Option D is wrong because a Shared VPC is a different architecture that centralizes subnet management, not a method for peering two existing VPCs, and it does not replace the need for peering connections.

Practice this question →

MCQeasy

A company wants to expose a web application running on Cloud Run globally with the lowest latency and automatic SSL termination. Which load balancer should they use?

A.Regional Internal HTTP(S) Load Balancer

B.Global HTTPS Load Balancer

C.Regional External HTTP(S) Load Balancer

D.Global SSL Proxy Load Balancer

AnswerB

Correct choice: supports HTTP(S) traffic, serverless NEGs, global anycast, and SSL termination.

Why this answer

Global HTTPS Load Balancer supports serverless NEGs for Cloud Run and provides global anycast IP, automatic SSL, and integration with Cloud CDN.

Practice this question →

MCQhard

An engineer configures a Global HTTPS Load Balancer with a backend service pointing to an instance group. The health check is set to HTTP on port 80, check interval 5s, timeout 5s, healthy threshold 1, unhealthy threshold 1. After deployment, instances are marked unhealthy despite the application responding correctly on port 80. What is the most likely cause?

A.The health check is using HTTPS but the instance expects HTTP

B.The unhealthy threshold is set too high

C.The health check is not configured with a host header

D.The health check timeout is equal to the check interval

AnswerD

Timeout (5s) equals interval (5s); timeout must be less than interval.

Why this answer

With timeout equal to check interval, the health check may not have enough time to complete before the next check starts, causing failures. The timeout should be less than the interval.

Practice this question →

Multi-Selectmedium

A company wants to set up a Regional Internal HTTP(S) Load Balancer to serve an internal web application. Which two components are required? (Choose two.)

Select 2 answers

A.Cloud CDN

B.An SSL certificate

C.An Envoy-based proxy

D.A global forwarding rule

E.Backend service with a NEG of type GCE_VM_IP_PORT or GCE_VM_IP

AnswersC, E

Correct: Internal HTTP(S) LB uses Envoy proxy.

Why this answer

Regional Internal HTTP(S) LB requires an Envoy-based proxy and a backend service with a NEG of type GCE_VM_IP_PORT or GCE_VM_IP.

Practice this question →

Multi-Selectmedium

You are configuring a Global External HTTPS Load Balancer. Which TWO components are required to route traffic to a Cloud Run service via a serverless NEG? (Select two.)

Select 2 answers

A.Serverless NEG

B.Backend service

C.Health check

D.Target proxy

E.URL map

AnswersA, B

Required: defines the Cloud Run service as a backend.

Why this answer

A serverless NEG is a backend that points to a Cloud Run service, and a backend service is needed to define health checks and other settings.

Practice this question →

MCQmedium

A company wants to serve global static content from a Cloud Storage bucket. They need low latency worldwide and SSL termination at the edge. Which solution should they choose?

A.Use a TCP/UDP network load balancer with the bucket as backend.

B.Configure a global external HTTP(S) load balancer with a backend bucket.

C.Deploy an internal TCP/UDP load balancer with the bucket as backend.

D.Set up Cloud CDN directly on the bucket without a load balancer.

AnswerB

This provides global anycast IP, SSL termination, and integrates with Cloud CDN.

Why this answer

A global external HTTP(S) load balancer with a backend bucket is the correct choice because it provides SSL termination at the edge (using Google Front Ends) and routes traffic over Google's global network to the nearest Cloud Storage bucket, ensuring low latency worldwide. The HTTP(S) load balancer supports global anycast IP addresses and integrates natively with Cloud Storage backends, making it ideal for serving static content globally.

Exam trap

Google Cloud often tests the misconception that Cloud CDN alone can provide SSL termination at the edge, but in reality, Cloud CDN requires a load balancer (HTTP(S) or external) to terminate SSL and route traffic, as the bucket's native HTTPS endpoint does not offer edge-based SSL termination or global anycast IP.

How to eliminate wrong answers

Option A is wrong because a TCP/UDP network load balancer does not support SSL termination at the edge (it operates at Layer 4) and cannot use a Cloud Storage bucket as a backend (buckets require HTTP(S)-based backends). Option C is wrong because an internal TCP/UDP load balancer is designed for private VPC traffic within a region, not for global public content delivery, and lacks SSL termination and bucket backend support. Option D is wrong because Cloud CDN directly on a bucket without a load balancer does not provide SSL termination at the edge (SSL is handled by the bucket's default HTTPS endpoint, which is not edge-terminated) and lacks the global anycast IP and advanced routing of a global HTTP(S) load balancer.

Practice this question →

MCQhard

A company uses a Global HTTPS Load Balancer with Cloud CDN. They need to purge specific cached objects for all users immediately after a content update. Which method should they use?

A.Delete the objects from the backend bucket

B.Use signed URLs

C.Reduce TTL on the origin

D.Cache invalidation

AnswerD

Correct: cache invalidation immediately removes specified objects from cache.

Why this answer

Cache invalidation allows purging specific URLs or URL prefixes from Cloud CDN caches.

Practice this question →

MCQeasy

An organization wants to distribute incoming HTTPS traffic across a set of Compute Engine instances in multiple regions, with SSL termination at the Google Cloud edge. They also need to protect against DDoS attacks at the edge. Which load balancing solution should they choose?

A.SSL Proxy Load Balancer

B.External TCP/UDP Network Load Balancer

C.Global External HTTP(S) Load Balancer

D.Regional External HTTP(S) Load Balancer

AnswerC

Correct. It provides global SSL termination and Cloud Armor integration.

Why this answer

Global HTTPS Load Balancer is an external, global, proxy-based load balancer that terminates SSL at the edge and integrates with Cloud Armor for DDoS protection. It distributes traffic across regions.

Practice this question →

MCQhard

Your company runs a multi-tier web application on Google Cloud. The frontend is in us-central1 (3 instances behind an external HTTP(S) Load Balancer), the backend is in us-west1 (3 instances behind an internal TCP/UDP Load Balancer). The frontend instances are in a managed instance group (MIG) with autoscaling based on CPU utilization. Recently, you noticed that during traffic spikes, the frontend instances' CPU utilization remains low, but the backend instances' CPU utilization spikes to 90% and causes timeouts. The application uses a synchronous REST API; the frontend instances make requests to the internal load balancer's IP. What should you do to resolve the backend scaling issue?

A.Create a backend service with the backend MIG and attach it to the internal TCP/UDP load balancer, enabling connection draining.

B.Configure the internal TCP/UDP load balancer with a health check that monitors CPU utilization and adjust the autoscaling metric of the backend MIG accordingly.

C.Replace the internal TCP/UDP load balancer with an internal HTTP(S) load balancer and configure the backend MIG to autoscale based on the load balancing serving capacity or request count.

D.Enable Cloud Armor on the external load balancer to rate-limit requests and prevent backend overload.

AnswerC

Internal HTTP(S) load balancer supports autoscaling based on request rate, allowing the backend to scale with traffic.

Why this answer

The internal TCP/UDP load balancer cannot provide request-level metrics (like requests per second) for autoscaling, as it operates at layer 4. Replacing it with an internal HTTP(S) load balancer (layer 7) allows the backend MIG to autoscale based on the load balancing serving capacity or request count, which directly correlates with the frontend's synchronous REST API calls. This resolves the backend CPU spike issue by scaling the backend instances before they become overloaded, rather than relying on CPU utilization which lags behind traffic spikes.

Exam trap

The trap here is that candidates assume CPU-based autoscaling is sufficient for all tiers, but Cisco tests the nuance that synchronous REST APIs require layer-7 load balancing to expose request-level metrics for proactive autoscaling, while layer-4 load balancers only provide connection-level metrics that lag behind traffic spikes.

How to eliminate wrong answers

Option A is wrong because connection draining only gracefully terminates existing connections during instance removal; it does not address the root cause of backend scaling during traffic spikes. Option B is wrong because the internal TCP/UDP load balancer's health check cannot monitor CPU utilization—health checks only verify instance responsiveness (e.g., TCP port check), and autoscaling metrics must be configured on the MIG itself, not on the load balancer. Option D is wrong because Cloud Armor rate-limiting on the external load balancer would throttle requests before they reach the frontend, but the issue is backend scaling; rate-limiting does not enable the backend to scale dynamically and could cause legitimate traffic to be dropped.

Practice this question →

MCQmedium

You need to route traffic to different backend services based on the URL path: /api/* goes to a Cloud Run service, /static/* goes to a Cloud Storage bucket, and /* goes to a Compute Engine instance group. Which component of the Global HTTPS Load Balancer should you configure?

A.Backend service

B.Target HTTP proxy

C.Health check

D.URL map

AnswerD

URL map contains path matchers and rules to route to different backends.

Why this answer

The URL map defines how requests are routed to backend services based on host and path rules.

Practice this question →

MCQhard

A company is using a Global SSL Proxy Load Balancer to terminate SSL and forward traffic to a backend service on Compute Engine. They need to preserve the client IP address in the backend logs. What should they do?

A.Enable Cloud CDN with origin header forwarding.

B.Enable Proxy Protocol on the SSL proxy load balancer and configure the backend to parse it.

C.Use a TCP Proxy Load Balancer with the proxy protocol enabled.

D.Configure the backend service to use the X-Forwarded-For header.

AnswerB

Proxy Protocol is the standard way to pass client IP through load balancers that terminate SSL.

Why this answer

SSL Proxy Load Balancer terminates SSL and forwards traffic using TCP. It does not preserve the original client IP by default. To preserve the client IP, you must enable Proxy Protocol on the load balancer and configure the backend to accept Proxy Protocol headers.

Practice this question →

MCQhard

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

A.Configure Cloud NAT in each service project for on-prem access.

B.Use VPC peering between the host project and each service project.

C.Configure Cloud Router in the host project to advertise all subnets via BGP.

D.Create separate Interconnect VLAN attachments for each service project.

AnswerC

Cloud Router in the host project automatically includes subnets from all service projects in the Shared VPC.

Why this answer

In a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Exam trap

Google Cloud often tests the misconception that each service project needs its own interconnect or NAT configuration, but the key is that Shared VPC centralizes networking in the host project, so a single Cloud Router with BGP advertisement in the host project provides connectivity to all service project instances.

How to eliminate wrong answers

Option A is wrong because Cloud NAT provides outbound internet access for private instances, not inbound connectivity from on-premises networks; it does not establish routing between on-premises and VPC subnets. Option B is wrong because VPC peering is used for connectivity between separate VPC networks, but in Shared VPC, service projects do not have their own VPCs—they use the host project's VPC, so peering is unnecessary and would not provide the required routing. Option D is wrong because creating separate Interconnect VLAN attachments for each service project is unnecessary and does not solve the routing issue; the on-premises network needs a single BGP session to learn all subnets from the host project's VPC, not separate attachments per project.

Practice this question →

MCQmedium

An organization needs to serve a TCP-based application globally with low latency but without SSL termination. Which load balancer should they use?

A.Global HTTPS Load Balancer

B.Global SSL Proxy Load Balancer

C.Regional External TCP/UDP Network Load Balancer

D.Global TCP Proxy Load Balancer

AnswerD

Correct: TCP Proxy for non-SSL TCP traffic globally.

Why this answer

Global TCP Proxy Load Balancer is designed for non-SSL TCP traffic and provides global anycast IP.

Practice this question →

MCQhard

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

A.The hybrid connectivity NEG is not supported with Traffic Director

B.The Cloud VPN tunnel is not established

C.Traffic Director requires mTLS for all hybrid endpoints

D.The on-premises firewall is blocking health check probes from Google Cloud

AnswerD

Health checks from Google Cloud must be allowed; if blocked, the NEG is marked unhealthy and traffic is not sent.

Why this answer

Hybrid connectivity NEGs require that the on-premises endpoint is reachable via a Cloud VPN or Interconnect. If Traffic Director cannot reach the endpoint, it might be due to missing firewall rules allowing health check probes or the NEG endpoint being misconfigured. The most common cause is that health checks are failing because the firewall rules on-premises are not allowing the health check source ranges.

Practice this question →

Multi-Selectmedium

Which TWO network services are required to enable private Google access for on-premises hosts using a Dedicated Interconnect connection? (Choose two.)

Select 2 answers

A.Cloud Router with BGP

B.Cloud NAT

C.VPC Flow Logs

D.Private Service Access (PSA) / Private Google Access for on-premises

E.Cloud VPN

AnswersA, D

Cloud Router is needed to exchange routes and enable private access.

Why this answer

Cloud Router with BGP is required because Dedicated Interconnect uses BGP sessions between the on-premises router and Google's edge router to exchange routes. Without BGP, the on-premises network cannot advertise or receive the routes necessary for private Google access, such as the 199.36.153.4/30 or 199.36.153.8/30 ranges used for Private Google Access for on-premises.

Exam trap

Google Cloud often tests the misconception that Cloud NAT is needed for private access, but the trap here is that Cloud NAT is for outbound internet from VMs, while Private Google Access for on-premises uses BGP-advertised IP ranges and does not involve NAT.

Practice this question →

Multi-Selectmedium

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Select 3 answers

A.Cloud NAT gateway

B.URL map

C.Target TCP proxy

D.Backend service (pointing to the GKE NEG)

E.SSL certificate (Google-managed)

AnswersB, D, E

URL map routes incoming requests to backends.

Why this answer

To achieve this, you need a backend service (or backend bucket) for the service, a URL map to route requests, and an SSL certificate for the custom domain. The load balancer itself is the target proxy.

Practice this question →

MCQmedium

An organization runs a stateful TCP application on a group of Compute Engine instances in us-central1. Clients must connect to the service using a single anycast IP address, and the load balancer must preserve the client source IP address. Which load balancing option meets these requirements?

A.External TCP/UDP Network Load Balancer

B.Internal TCP/UDP Load Balancer

C.Global external TCP Proxy Load Balancer

D.Global external HTTP(S) Load Balancer

AnswerC

The Global external TCP Proxy Load Balancer provides a single anycast IP address and can preserve the client IP address using Proxy Protocol, making it suitable for stateful TCP applications that require both anycast and source IP preservation.

Why this answer

The Global external TCP Proxy Load Balancer provides a single anycast IP address that clients can connect to from anywhere. While it terminates the TCP connection, it can be configured to forward the client's IP address to the backend using Proxy Protocol (e.g., HAProxy protocol). This allows the backend to see the original client source IP, meeting the requirement for a stateful TCP application.

The other options either do not provide anycast IP or cannot preserve the source IP.

Exam trap

Candidates often select the External TCP/UDP Network Load Balancer because it preserves client IP natively, but it is a regional load balancer and does not provide a single anycast IP. The Global external TCP Proxy provides anycast IP and can preserve client IP via Proxy Protocol.

Practice this question →

Multi-Selectmedium

Which TWO of the following are required when setting up an internal TCP/UDP load balancer (ILB) in a shared VPC environment?

Select 2 answers

A.A health check must be configured for the backend service.

B.A firewall rule must allow traffic from the proxy-only subnet.

C.The forwarding rule's IP address must be from the host project's subnet.

D.The load balancer forwarding rule must be in the same region as the backend instances.

E.Global routing must be enabled in the VPC.

AnswersA, D

Health checks are required to determine instance health.

Why this answer

Correct answers: A and D. A: A health check is mandatory for an internal TCP/UDP load balancer (ILB) backend service to determine instance health. D: The ILB forwarding rule must be in the same region as the backend instances because ILB is a regional load balancer.

B: Incorrect. ILB does not use proxy-only subnets; firewall rules for proxy-only subnets are required only for load balancers that use Envoy proxies (e.g., HTTP(S) LB). C: Incorrect.

While the forwarding rule's IP address is taken from a subnet in the shared VPC (owned by the host project), this is not a separate requirement; the critical requirement is that the forwarding rule and backends are in the same region. E: Incorrect. Global routing is not needed for ILB; it operates within a single region.

Practice this question →

Multi-Selectmedium

A company wants to use Cloud CDN to accelerate content delivery globally. Which TWO of the following are valid cache key components that can be configured in Cloud CDN? (Choose 2)

Select 2 answers

A.Client IP address

B.Query string parameters

C.Protocol (HTTP/HTTPS)

D.Request headers (e.g., Accept-Language)

E.Client port

AnswersB, C

Query string parameters can be included (all, specified, or excluded).

Why this answer

Cloud CDN allows you to configure cache keys based on protocol, host, query string parameters, and headers. IP address and client port are not configurable cache key components.

Practice this question →

MCQmedium

A company hosts a web application on Cloud Run and wants to serve content from a Cloud Storage bucket for static assets. They plan to use a global HTTPS load balancer with a URL map to route requests. Which backend type should they configure for the static content?

A.Backend bucket (Cloud Storage bucket)

B.Serverless NEG (Cloud Run)

C.Zonal NEG (Compute Engine)

D.Internet NEG (external endpoint)

AnswerA

Correct. Backend buckets serve static content from Cloud Storage.

Why this answer

Backend buckets are used to serve content from Cloud Storage buckets via a load balancer. Serverless NEGs are for Cloud Run/Functions, not Cloud Storage.

Practice this question →

MCQeasy

A company wants to expose a web application running on Cloud Run to the internet with a single global IP address, SSL termination, and Cloud CDN. Which load balancer should they use?

A.External TCP/UDP Network Load Balancer

B.Global External HTTP(S) Load Balancer

C.Global TCP Proxy Load Balancer

D.Regional External HTTP(S) Load Balancer

AnswerB

Correct. Supports serverless NEGs for Cloud Run, global IP, SSL, and CDN.

Why this answer

The Global HTTPS Load Balancer supports serverless backends via serverless NEG, provides SSL termination, Cloud CDN integration, and a single global IP address. The others are either regional or not suitable for serverless backends.

Practice this question →