Courseiva

CCNA Pcne Configuring Services Questions

75 of 219 questions · Page 2/3 · Pcne Configuring Services topic · Answers revealed

Practice these questionsExam hubAll questions
76
Multi-Selecthard

A company uses Traffic Director with Envoy proxies to manage east-west traffic. They want to implement fault injection to test the resilience of their service mesh. Which TWO types of faults can they inject? (Choose two.)

Select 2 answers
A.Delay (add a fixed latency to matching requests)
B.Throttle (limit the rate of requests)
C.Abort (return a specified HTTP status code)
D.Retry (automatically retry failed requests)
E.Timeout (set a maximum time for a request to complete)
AnswersA, C

Delay adds a fixed latency to matching requests. This is a supported fault injection type in Traffic Director.

Why this answer

Traffic Director supports fault injection for abort (return an HTTP error) and delay (add latency). Throttle is not a supported fault injection type in Traffic Director; it is a rate-limiting feature that is not part of fault injection. Retry and Timeout are routing or circuit breaker features, not fault injection.

Therefore, the two correct answers are abort (C) and delay (A).

Practice this question →
77
MCQhard

An organization configures a Global external HTTP(S) Load Balancer with Cloud CDN. They notice that some users are getting stale content even after they have invalidated the cache for specific objects. What is the most likely reason?

A.The URL map is routing to the wrong backend
B.Invalidation requests are queued and take time to propagate globally
C.The objects were cached with a very long TTL
D.Cloud CDN does not support invalidation for backend buckets
AnswerB

Cache invalidation can take minutes to propagate to all edge locations.

Why this answer

Cache invalidation removes objects from cache but does not prevent new requests from being served stale content if the origin returns a 304 Not Modified or if there is a propagation delay. However, the most common cause is that the invalidation has not propagated to all edge caches yet.

Practice this question →
78
MCQmedium

A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?

A.Ingress rule: allow tcp:3306, source IP range 10.0.0.0/8, target tags 'db'
B.Ingress rule: allow tcp:3306, source tags 'web', target service account 'db-sa'
C.Egress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'
D.Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'
AnswerD

This rule only allows traffic from VMs with the specified service account to the tagged database VMs.

Why this answer

It defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.

Exam trap

Google Cloud often tests the distinction between ingress and egress rules in the context of service account filtering, and the trap here is that candidates may confuse the direction of traffic (thinking an egress rule on the web VMs is needed) or incorrectly mix source/target tags with service accounts, leading them to pick options that use IP ranges or mismatched attributes.

How to eliminate wrong answers

Option A is wrong because it uses a broad source IP range (10.0.0.0/8) instead of the specific service account, which would allow traffic from any VM in that IP range, not just those with the 'web-sa' service account, violating the principle of least privilege. Option B is wrong because it incorrectly uses source tags 'web' (which filter by network tag, not service account) and target service account 'db-sa' (which would apply the rule to VMs with that service account, not the database VM with tag 'db'), and it also specifies an ingress rule but the direction is correct; the main issue is the mismatch in filtering attributes. Option C is wrong because it defines an egress rule, but the requirement is to allow traffic from the web VMs to the database VM, which is an inbound connection to the database; egress rules control outbound traffic from the source, not inbound access to the target.

Practice this question →
79
MCQhard

You are using Cloud CDN with a backend bucket and want to cache all responses regardless of Cache-Control headers. Which cache mode should you set?

A.CACHE_ALL_STATIC
B.FORCE_CACHE_ALL
C.USE_ORIGIN_HEADERS
D.DISABLED
AnswerB

FORCE_CACHE_ALL caches all responses regardless of Cache-Control headers.

Why this answer

FORCE_CACHE_ALL overrides origin Cache-Control headers and caches all responses. CACHE_ALL_STATIC attempts to cache static content but respects Cache-Control. USE_ORIGIN_HEADERS respects origin headers.

Practice this question →
80
MCQmedium

You need to create a load balancer that distributes traffic across Compute Engine instances in multiple regions for a TCP application without SSL offload. The clients should connect to a single anycast IP. Which load balancer should you use?

A.External TCP/UDP Network Load Balancer
B.Global external TCP Proxy Load Balancer
C.Global external SSL Proxy Load Balancer
D.Internal TCP/UDP Load Balancer
AnswerB

Provides a single anycast IP for TCP traffic, supports multiple regions, and can be used without SSL offload.

Why this answer

Global external TCP Proxy Load Balancer provides a single anycast IP and handles TCP traffic without SSL offload (though it supports SSL offload optionally). It is the only global TCP load balancer that does not require SSL termination.

Practice this question →
81
MCQmedium

A financial services company needs to audit all VPC firewall rule changes in real time. They want to receive notifications whenever a rule is created, modified, or deleted. What is the most efficient way to achieve this?

A.Enable VPC Flow Logs and export them to BigQuery for analysis.
B.Use Cloud Logging with a filter on firewall rule updates and create a logs-based metric with an alert.
C.Enable VPC Firewall Rules Logging and send logs to Pub/Sub with a Cloud Function trigger.
D.Store Cloud Audit Logs in a Cloud Storage bucket and periodically check for changes.
AnswerB

Cloud Logging captures Admin Activity audit logs for firewall changes; a logs-based metric with alert policy provides real-time notification.

Why this answer

Cloud Logging can capture Admin Activity audit logs for firewall rule changes, and a logs-based metric with an alert provides real-time notifications. Option A is incorrect because VPC Flow Logs capture network traffic, not firewall rule changes. Option C is incorrect because VPC Firewall Rules Logging logs traffic hits, not rule configuration changes.

Option D is incorrect because storing Cloud Audit Logs in a bucket requires manual or periodic checking, which is not real-time.

Practice this question →
82
Multi-Selectmedium

A company needs to load balance TCP traffic without SSL termination for a gaming application where client IP preservation is critical. The backend is a group of Compute Engine instances. Which load balancer types meet these requirements? (Choose TWO.)

Select 2 answers
A.Regional External TCP/UDP Network Load Balancer
B.Global TCP Proxy Load Balancer
C.Regional Internal TCP/UDP Load Balancer
D.Global SSL Proxy Load Balancer
E.Global HTTPS Load Balancer
AnswersA, B

It is pass-through and preserves client IP by default.

Why this answer

Global TCP Proxy Load Balancer terminates SSL? Actually, TCP Proxy LB does not terminate SSL; it forwards TCP traffic but does not preserve client IP by default (uses Proxy Protocol). Regional External TCP/UDP Network Load Balancer is pass-through and preserves client IP. The Internal TCP/UDP LB is pass-through but internal.

For external TCP without SSL termination and client IP preservation, the best options are the Regional External TCP/UDP NLB (pass-through) and a Global TCP Proxy with Proxy Protocol enabled (which can preserve IP via Proxy Protocol).

Practice this question →
83
MCQmedium

A company wants to expose a globally distributed application using Cloud Run via a single anycast IP address, with SSL termination and content-based routing to different backend services. Which load balancer should they use?

A.Global External HTTPS Load Balancer
B.Global External SSL Proxy Load Balancer
C.Regional External HTTP(S) Load Balancer
D.Global External TCP Proxy Load Balancer
AnswerA

Correct: provides global anycast IP, SSL termination, URL map for content-based routing, and can use serverless NEGs for Cloud Run.

Why this answer

The Global External HTTPS Load Balancer provides a single anycast IP, SSL termination, and content-based routing via URL maps to backends like serverless NEGs pointing to Cloud Run.

Practice this question →
84
MCQhard

A company has deployed an external HTTPS load balancer with a Cloud CDN backend. The load balancer uses a managed SSL certificate. Recently, the company updated their DNS record to point to a different IP address of a new load balancer. After the change, some users are still being served from the old load balancer's cache. The network engineer has confirmed that the DNS TTL has expired. What is the most likely cause of this issue?

A.Cloud CDN cached responses from the old load balancer may still be served until their cache TTL expires.
B.The old load balancer's SSL certificate is still cached by clients.
C.The DNS change has not propagated globally despite the TTL expiring.
D.The old load balancer's IP address is still being served by Google's edge network due to anycast.
AnswerA

Cloud CDN caches content at edge locations; if the cache TTL has not expired, users may receive the old content even after DNS changes.

Why this answer

Cloud CDN caches content at Google's edge caches based on the cache-control headers or default cache TTL. When the DNS record is updated to point to a new load balancer, the old load balancer's cached responses may still be served from edge caches until their cache TTL expires, even after the DNS TTL has expired. This is because Cloud CDN caches are independent of DNS resolution and are governed by HTTP caching rules.

Exam trap

Google Cloud often tests the distinction between DNS TTL (which controls how long DNS records are cached by resolvers) and HTTP cache TTL (which controls how long content is cached by CDN edge nodes), leading candidates to incorrectly attribute the issue to DNS propagation rather than CDN cache expiration.

How to eliminate wrong answers

Option B is wrong because SSL certificates are not cached by clients in a way that would cause them to be served content from the old load balancer; certificate caching affects TLS handshake validation, not content delivery. Option C is wrong because the question explicitly states that the DNS TTL has expired, meaning the DNS change has propagated globally; the issue is not DNS propagation. Option D is wrong because Google's edge network uses anycast to route traffic to the nearest healthy load balancer IP, but the old load balancer's IP is no longer advertised once the DNS points to a new IP; anycast does not serve stale IPs.

Practice this question →
85
MCQmedium

A company has an on-premises data center connected to GCP via Cloud VPN with dynamic routing (BGP). Recently, connectivity to a specific subnet (10.1.0.0/16) in GCP became intermittent. The VPN tunnel is up, and BGP sessions are established. What is the most likely cause?

A.The shared secret is misconfigured.
B.The VPN tunnel is flapping due to packet loss.
C.A firewall rule is blocking traffic from on-premises.
D.The Cloud Router is not advertising the correct subnet range to the on-premises router.
AnswerD

If the subnet is not advertised, on-premises traffic may not be routed correctly.

Why this answer

Since the VPN tunnel is up and BGP sessions are established, the issue is not with the tunnel or BGP peering itself. Intermittent connectivity to a specific subnet (10.1.0.0/16) while other subnets remain reachable strongly indicates a route advertisement problem. The Cloud Router must be configured to advertise the correct subnet range to the on-premises router via BGP; if it is not, the on-premises router will lack a route for that subnet, causing intermittent or no connectivity.

Exam trap

Google Cloud often tests the misconception that if the VPN tunnel and BGP session are up, all subnets must be reachable, but the trap is that route advertisement misconfiguration can cause selective subnet unreachability even when the control plane is healthy.

How to eliminate wrong answers

Option A is wrong because a misconfigured shared secret would prevent the VPN tunnel from establishing or cause it to fail authentication, but the tunnel is up and BGP sessions are established. Option B is wrong because tunnel flapping due to packet loss would cause the entire tunnel to go up and down, affecting all traffic, not just a specific subnet, and BGP sessions would also flap. Option C is wrong because a firewall rule blocking traffic from on-premises would cause consistent failure for all traffic from that source, not intermittent connectivity to a single subnet, and the tunnel and BGP being up suggests no such block at the network layer.

Practice this question →
86
MCQmedium

A company wants to use Cloud DNS to distribute traffic across multiple regional endpoints with failover: primary in us-central1, secondary in us-west1. If the primary health check fails, traffic should go to secondary. Which routing policy should they use?

A.Geolocation routing policy
B.Weighted round robin routing policy
C.Failover routing policy
D.Simple routing policy (A record)
AnswerC

Correct. Failover routing policy supports primary/backup with health checks.

Why this answer

Failover routing policy allows specifying primary and secondary targets with health checks. Geolocation and weighted round robin do not provide failover behavior.

Practice this question →
87
MCQmedium

A company wants to enable mTLS between microservices in a service mesh managed by Traffic Director. They have deployed Envoy sidecars. What must be configured to enforce mTLS?

A.An SSL policy on the load balancer
B.A VPC Service Controls perimeter
C.A Cloud Armor security policy
D.The mTLS mode in Traffic Director's mesh configuration
AnswerD

Correct: setting mTLS mode to strict enforces mTLS.

Why this answer

Traffic Director uses the mTLS mode in the Envoy configuration. The correct way is to set the tls_mode to STRICT in the TrafficDirector's mesh configuration.

Practice this question →
88
Multi-Selecthard

A company uses Traffic Director with Envoy sidecars. They want to implement traffic splitting to gradually migrate traffic from version v1 to v2 of a service. Which TWO resources must be configured? (Select two.)

Select 2 answers
A.Health check
B.Firewall rule
C.Cloud CDN cache key
D.TrafficDirectorRoute with traffic splitting rules
E.Backend service with weighted backends
AnswersD, E

Correct: the route rule specifies the percentage distribution.

Why this answer

Traffic splitting in Traffic Director is configured via routing rules (TrafficDirectorRoute) and backend services (or weighted backends).

Practice this question →
89
MCQeasy

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between services. Which configuration must be enabled?

A.Configure SSL certificates on each Envoy sidecar manually
B.Use Cloud NAT to hide internal IPs
C.Enable mTLS in the Traffic Director mesh configuration
D.Enable Cloud Armor on the service
AnswerC

Correct. Mesh TLS settings in Traffic Director enforce mTLS.

Why this answer

Traffic Director supports mTLS through the Mesh TLS configuration, which enforces TLS mutual authentication between sidecars.

Practice this question →
90
MCQhard

A company has a VPC with multiple subnets and uses Cloud VPN tunnels to connect to on-premises. They want to ensure that only traffic destined for on-premises is sent through the VPN tunnels; all other traffic should use the internet. Which route configuration should they implement?

A.Add a static route for 0.0.0.0/0 with next hop VPN gateway, and set a lower priority than the internet default route.
B.Use Cloud Router with BGP to exchange specific routes with on-premises, and keep the default internet route for other traffic.
C.Configure the Cloud VPN to advertise a default route to on-premises, and rely on local preference.
D.Use VPC Network Peering with the on-premises network and configure custom route exchange.
AnswerB

BGP-learned specific routes will override the default route for those destinations.

Why this answer

Using Cloud Router with BGP allows the VPC to dynamically learn specific routes from the on-premises network via the VPN tunnels. The default route (0.0.0.0/0) remains pointing to the internet gateway, so only traffic destined for the learned on-premises prefixes is sent through the VPN, while all other traffic uses the internet. This provides precise control without overriding the default route.

Exam trap

Google Cloud often tests the misconception that a default route (0.0.0.0/0) must be manipulated to direct traffic to on-premises, when in fact the correct approach is to use more specific routes learned via BGP to selectively direct only on-premises-destined traffic through the VPN.

How to eliminate wrong answers

Option A is wrong because adding a static route for 0.0.0.0/0 with next hop VPN gateway would send all traffic (including internet-bound) through the VPN, contradicting the requirement; setting a lower priority does not help because the VPN route would still be more specific than the default internet route only if it has a higher priority, but the question states 'lower priority' which would make it less preferred, but the real issue is that a 0.0.0.0/0 route to VPN would capture all traffic. Option C is wrong because configuring the Cloud VPN to advertise a default route to on-premises would cause on-premises to send all its traffic to the cloud, not the other way around, and does not control which cloud traffic uses the VPN. Option D is wrong because VPC Network Peering is used for connecting VPCs within Google Cloud, not for connecting to on-premises networks; it does not support VPN tunnels or on-premises connectivity.

Practice this question →
91
Multi-Selecthard

You are designing a global web application that uses Cloud Run for the backend and Cloud Storage for static assets. You need to serve content securely over HTTPS with a custom domain, using Cloud CDN for caching. Which resources must be created or configured? (Choose three.)

Select 3 answers
A.Zonal NEG for Cloud Run
B.SSL certificate resource
C.URL map
D.Identity-Aware Proxy (IAP)
E.Global external HTTP(S) load balancer
AnswersB, C, E

SSL certificate is required for HTTPS.

Why this answer

Global HTTPS LB with backend bucket (for GCS) and serverless NEG (for Cloud Run) is the architecture. SSL certificate is needed for HTTPS. IAP is for authentication, not required.

URL map is required for routing. Zonal NEG is not needed for Cloud Run.

Practice this question →
92
MCQmedium

A company has deployed a Global External Application Load Balancer with Premium Tier and enables Cloud CDN. Users in Europe report high latency, while users in the US have good performance. The backend is a regional NEG in us-west1. What is the most likely cause?

A.The load balancer is using Premium Tier, which routes to the nearest backend; the backend is only in us-west1.
B.Cloud CDN is not enabled on the load balancer.
C.The load balancer is using Standard Tier, which does not support global anycast.
D.The origin server is sending 'Cache-Control: private' headers, preventing Cloud CDN from caching.
AnswerD

Cloud CDN respects origin cache headers; private or no-store headers prevent caching, so all requests hit the backend.

Why this answer

Cloud CDN cannot cache responses that include a 'Cache-Control: private' header. This header instructs intermediate caches (including CDN nodes) not to store the response, forcing all requests to go to the origin server in us-west1. Users in Europe experience high latency because their requests must traverse the long distance to the US origin, while US users benefit from shorter paths.

Enabling Cloud CDN alone does not guarantee caching; the origin must also allow caching by omitting 'private' or setting appropriate 'Cache-Control: public' and 'max-age' directives.

Exam trap

Google Cloud often tests the misconception that enabling Cloud CDN automatically caches all content, when in reality the origin's cache-control headers dictate cacheability, and 'Cache-Control: private' is a common reason for CDN bypass.

How to eliminate wrong answers

Option A is wrong because Premium Tier uses Google's global anycast network to route traffic to the nearest frontend IP address, not to the nearest backend; the backend location does not affect routing to the load balancer's global IP. Option B is wrong because the question states Cloud CDN is enabled on the load balancer, so the issue is not that CDN is disabled. Option C is wrong because the question explicitly states Premium Tier is used, not Standard Tier; Standard Tier would route traffic regionally and could cause high latency for European users, but that is not the case here.

Practice this question →
93
MCQeasy

An engineer creates a Cloud NAT configuration as shown in the exhibit. The test-instance is created without an external IP address. However, the instance cannot reach the internet. What is the most likely cause?

A.The subnet subnet-a is in a region different from us-central1
B.The Cloud Router is not in the same zone as the instance
C.A firewall rule is blocking outbound traffic from the instance
D.Logging is enabled but not configured to send logs to Cloud Logging
AnswerA

Cloud NAT covers only subnets in the same region as the NAT router. If subnet-a is in another region, it is not covered.

Why this answer

Cloud NAT is a regional resource that applies to all instances within a given region. The exhibit shows subnet-a is in a different region than us-central1, so the NAT gateway cannot route traffic from instances in that subnet. Even though the instance is in us-central1, the subnet's region mismatch means the NAT configuration does not apply, leaving the instance without internet access.

Exam trap

Google Cloud often tests the misconception that Cloud NAT is zonal or that Cloud Router must be in the same zone as the instance, but the key trap here is that candidates overlook the regional scope of Cloud NAT and assume subnet location is irrelevant.

How to eliminate wrong answers

Option B is wrong because Cloud Router is a regional resource, not zonal, and does not need to be in the same zone as the instance; it only needs to be in the same region. Option C is wrong because the question states the instance cannot reach the internet, but no firewall rule is mentioned or implied; by default, VPC firewall rules allow outbound traffic, and the issue is specifically about NAT configuration. Option D is wrong because enabling logging is optional and does not affect the ability to reach the internet; it only controls whether NAT connection logs are sent to Cloud Logging.

Practice this question →
94
MCQhard

A multinational company has a Shared VPC environment with multiple service projects. They need to allow a specific service project to use its own Cloud DNS private zone that resolves to internal IPs in the Shared VPC. Which configuration ensures this without exposing the zone to other projects?

A.Create a private zone in the service project and use an inbound server policy.
B.Use VPC peering and allow the service project to manage DNS records.
C.Grant the service project access to the Shared VPC's private zone via IAM roles.
D.Create a DNS response policy in the Shared VPC host project and associate it with the service project's VPC.
AnswerD

Response policies enable selective DNS resolution for specific VPC networks.

Why this answer

DNS response policies allow you to control DNS resolution per VPC in a Shared VPC environment. By creating a response policy in the host project and associating it with the service project's VPC, you enable that service project to use its own private zone without exposing it to other projects. Option A is incorrect because an inbound server policy is used for on-premises DNS resolution, not for granting private zone access to a service project.

Option B is incorrect because VPC peering would allow the service project to manage DNS records, but it does not restrict access to the zone; moreover, peering is not the correct approach for selective DNS resolution in a Shared VPC. Option C is incorrect because granting IAM roles alone does not associate the private zone with a specific VPC; it would allow the service project to view or manage the zone, but the zone would still be visible to other projects with access.

Practice this question →
95
Matchingmedium

Match each network pricing model to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Data leaving Google Cloud to the internet

Data entering Google Cloud (typically free)

Data transferred between regions within Google Cloud

Global network with consistent performance, higher cost

Lower cost, uses ISP networks for some hops

Why these pairings

Correct matches: Egress charges for outbound data; Ingress is free; Cloud Interconnect charges by bandwidth; VPN charges hourly plus egress. Common confusions include swapping egress/ingress definitions and confusing Interconnect with VPN.

Practice this question →
96
MCQhard

A network engineer configures a Global external HTTP(S) Load Balancer with a serverless NEG backend pointing to Cloud Run. The load balancer returns 502 Bad Gateway errors. What is the most likely cause?

A.The URL map is misconfigured
B.The SSL certificate is expired
C.The serverless NEG is not supported for Cloud Run
D.The Cloud Run service has ingress set to 'internal'
AnswerD

If ingress is set to internal, the load balancer (external) cannot reach the service. It must be set to 'all' or use a VPC connector.

Why this answer

Serverless NEG for Cloud Run requires that the Cloud Run service is publicly accessible or that the ingress is set to allow all traffic. Additionally, the load balancer's health checks must pass. A common cause is that the Cloud Run service has ingress restricted to internal traffic only.

Practice this question →
97
MCQmedium

Your company uses Cloud DNS with a managed zone for example.com. You need to override DNS responses for a specific domain (e.g., internal.example.com) to point to an internal IP address. Which Cloud DNS feature should you use?

A.DNS forwarding zones
B.Response policies (RPZ)
C.Peering zones
D.Managed zones with private visibility
AnswerB

Response policies allow you to override DNS responses based on rules.

Why this answer

Cloud DNS response policies (RPZ) allow you to override DNS responses for domains within a VPC. You can create a response policy with rules that modify DNS responses for specified domains.

Practice this question →
98
Multi-Selecteasy

Which TWO of the following load balancer types can distribute traffic to backends in multiple regions?

Select 2 answers
A.Internal HTTP(S) Load Balancer
B.External HTTP(S) Load Balancer
C.Internal TCP/UDP Load Balancer
D.External TCP/UDP Load Balancer
E.External SSL Proxy Load Balancer
AnswersB, E

This global LB can route traffic to backends in various regions based on location.

Why this answer

The External HTTP(S) Load Balancer is a global load balancer that can distribute traffic to backends in multiple regions using anycast IP addresses and Google's global network. It supports cross-regional backend services, making it suitable for global applications.

Exam trap

Google Cloud often tests the misconception that all external load balancers are global, but the External TCP/UDP Load Balancer is regional unless explicitly configured as a global proxy load balancer, which is a separate type (SSL Proxy or TCP Proxy).

Practice this question →
99
MCQhard

A company uses Cloud NAT to allow private VMs to access the internet. They notice that some VMs are unable to reach a specific set of external IP addresses, but other VMs can. The firewall rules are correctly configured. What is the most likely cause?

A.The default route (0.0.0.0/0) is missing for the VPC.
B.The VPC firewall rules have a deny rule for the source IP range of the affected VMs.
C.The Cloud NAT gateway uses a static IP address that is not allowed by the external service's firewall.
D.The VMs have a tag that overrides the Cloud NAT routing.
AnswerC

If the external service restricts access by IP, only VMs using that NAT IP can connect.

Why this answer

Cloud NAT uses a source IP address (either a static IP you assign or an ephemeral IP from the NAT gateway's IP range) when translating outbound traffic from private VMs. If the external service's firewall only allows traffic from specific IP addresses, and the Cloud NAT gateway is using a static IP that is not on that allowlist, the affected VMs' traffic will be blocked. Other VMs might reach the service if they use a different NAT gateway or if the service's firewall permits their translated IP.

Exam trap

Google Cloud often tests the misconception that firewall rules within the VPC are the only cause of connectivity failures, when in reality external service firewalls or IP allowlists can block traffic after NAT translation.

How to eliminate wrong answers

Option A is wrong because the default route (0.0.0.0/0) is required for internet-bound traffic to be sent to the Cloud NAT gateway; if it were missing, no VM could reach the internet, not just a specific set of external IPs. Option B is wrong because the question states firewall rules are correctly configured, and a deny rule for the source IP range of the affected VMs would block all outbound traffic from those VMs, not just to a specific set of external IPs. Option D is wrong because VM tags do not override Cloud NAT routing; tags are used for firewall rule targeting or network tags, but Cloud NAT routing is determined by the VPC network and the NAT gateway's configuration, not by VM tags.

Practice this question →
100
MCQmedium

A company wants to use Cloud CDN to cache content from a backend bucket. They need to cache all objects, including those with cookies, to maximize performance. Which cache mode should they select?

A.CACHE_ALL_STATIC
B.USE_ORIGIN_HEADERS
C.CACHE_ALL
D.FORCE_CACHE_ALL
AnswerD

This mode forces caching of all responses, overriding any no-cache directives.

Why this answer

Cloud CDN cache modes: CACHE_ALL_STATIC caches static content based on cache directives, USE_ORIGIN_HEADERS respects origin headers, FORCE_CACHE_ALL forces caching for all responses regardless of headers. FORCE_CACHE_ALL is used to override origin headers and cache everything.

Practice this question →
101
MCQeasy

A company wants to expose a web application running on Compute Engine behind a global HTTPS load balancer with Cloud CDN enabled. They need to ensure that only authenticated users can access certain content. Which approach should they use?

A.Generate signed URLs or signed cookies for Cloud CDN.
B.Use Cloud Armor to restrict access by IP address.
C.Use Cloud IAP to authenticate users at the load balancer.
D.Configure the backend bucket with a custom header for authentication.
AnswerA

Signed URLs and signed cookies are the correct way to restrict access to private content served via Cloud CDN.

Why this answer

Cloud CDN supports signed URLs and signed cookies to restrict access to content. Signed URLs are used for individual files, while signed cookies work for multiple files. IAP is for access control at the load balancer level but not specifically for CDN content.

Practice this question →
102
MCQhard

A company has Compute Engine instances in a VPC that only have internal IP addresses. They need to access Google Cloud services like Cloud Storage and BigQuery. They also have on-premises servers that need to access the same instances via a Cloud VPN tunnel. What must be enabled for the instances to access Google APIs without public IPs?

A.Private Google Access
B.Cloud Router
C.VPC peering
D.Cloud NAT
AnswerA

Private Google Access enables access to Google APIs from internal IPs without public IPs.

Why this answer

Private Google Access enables Compute Engine instances that have only internal IP addresses (no external IPs) to reach Google APIs and services such as Cloud Storage and BigQuery. It works by routing traffic destined for Google API IP ranges through the default internet gateway, using the VPC's internal DNS resolution to map the API hostnames to Google's internal IP addresses, without requiring a public IP on the instance.

Exam trap

Google Cloud often tests the distinction between Cloud NAT (for general internet outbound) and Private Google Access (specifically for Google APIs), leading candidates to mistakenly choose Cloud NAT when the question explicitly requires access to Google services without public IPs.

How to eliminate wrong answers

Option B is wrong because Cloud Router is used for dynamic routing (BGP) between a VPC and an on-premises network over Cloud VPN or Dedicated Interconnect, not for enabling internal-only instances to reach Google APIs. Option C is wrong because VPC peering connects two VPC networks to exchange traffic, but it does not provide access to Google APIs for instances without public IPs; that requires Private Google Access on the subnet. Option D is wrong because Cloud NAT provides outbound internet connectivity for instances without public IPs, but it is designed for general internet access, not specifically for reaching Google APIs and services; Private Google Access is the correct feature for that purpose.

Practice this question →
103
MCQmedium

You want to distribute traffic across multiple GKE clusters in different regions with automatic failover if a region becomes unhealthy. Which Cloud DNS routing policy should you use?

A.Failover
B.Simple (no policy)
C.Weighted round robin
D.Geolocation
AnswerA

Correct: failover routing policy automatically switches to healthy targets.

Why this answer

Failover routing policy allows you to set primary and secondary targets; DNS automatically responds with the secondary if the primary is unhealthy.

Practice this question →
104
MCQhard

You have a Cloud Router with the configuration shown. The on-premises network (ASN 65002) is not receiving any routes from Google Cloud. What is the most likely cause?

A.The BGP keepalive interval is set too low
B.The BGP session is not established
C.The router is in custom advertise mode but does not advertise the VPC subnets
D.The on-premises subnet 10.0.1.0/24 is not advertised
AnswerC

Custom mode overrides default; must explicitly advertise VPC subnets.

Why this answer

When a Cloud Router is configured in custom advertise mode, it only advertises the routes explicitly specified in the custom advertisement list. If the VPC subnets are not included in that list, the on-premises network will not receive any routes from Google Cloud, even if the BGP session is established. This is the most likely cause because the question states the on-premises network is not receiving any routes, which aligns with a missing custom advertisement rather than a session or timer issue.

Exam trap

Google Cloud often tests the misconception that a BGP session being 'Established' guarantees route exchange, but in Google Cloud's custom advertise mode, the session can be up while no routes are advertised due to missing custom advertisement configuration.

How to eliminate wrong answers

Option A is wrong because a low BGP keepalive interval (e.g., 10 seconds) would cause the session to flap or reset, not silently prevent route advertisement; the session would still exchange routes when up. Option B is wrong because if the BGP session were not established, the Cloud Router would show a state other than 'Established' (e.g., Idle, Active), and the question implies the session is up but no routes are received. Option D is wrong because the on-premises subnet 10.0.1.0/24 is a route that the on-premises router advertises to Google Cloud, not a route that Google Cloud advertises to on-premises; the issue is about routes from Google Cloud not being received, not about missing on-premises advertisements.

Practice this question →
105
MCQmedium

A company uses Traffic Director with Envoy sidecars for service mesh. They want to gradually shift traffic from version 1 to version 2 of a service, starting with 10% traffic to version 2. Which Traffic Director feature should they use?

A.Traffic splitting
B.Circuit breakers
C.Fault injection
D.mTLS authentication
AnswerA

Traffic splitting allows you to assign weights to different backends for gradual rollout.

Why this answer

Traffic Director supports traffic splitting via the service routing API (TrafficDirectorService). You can define weighted destinations in the routing rule to split traffic between versions.

Practice this question →
106
MCQhard

A company wants to use Cloud CDN to serve content from a custom origin that is not hosted on Google Cloud. They have enabled Cloud CDN with a backend bucket pointing to an external origin URL. However, content is not being cached. What is a likely reason?

A.The custom origin does not support HTTPS.
B.The origin is not configured in the backend bucket as an internet NEG.
C.The load balancer is a Global TCP Proxy, not HTTP.
D.The origin does not return Cache-Control or Expires headers.
AnswerD

Without caching headers, Cloud CDN will not cache unless FORCE_CACHE_ALL mode is enabled.

Why this answer

Cloud CDN with an external origin requires the origin to return explicit cache headers (Cache-Control or Expires) to enable caching. If the origin does not return caching headers, Cloud CDN will not cache the content. Force cache all mode can override this, but if not set, caching may not occur.

Practice this question →
107
MCQmedium

An engineer manages a global application using Global external HTTP(S) Load Balancer with URL map routing to multiple backend services. They want to enable Cloud CDN for the /images/* path. What is the correct way to enable CDN for that specific path?

A.Enable CDN on the backend service that serves /images/*
B.Use the gcloud compute url-maps add-path-matcher command with --cache-mode
C.Set a cache key header for /images/* in the URL map
D.Enable Cloud CDN at the load balancer level
AnswerA

Create a separate backend service for images with CDN enabled, and route /images/* to it via URL map.

Why this answer

To enable CDN for a specific path, you must create a backend bucket (or backend service with CDN enabled) and configure a URL map rule that routes the path /images/* to that backend. Enabling CDN on the backend service itself will apply to all paths served by that backend.

Practice this question →
108
MCQhard

You are using Traffic Director with Envoy sidecars for a microservices application. You want to inject artificial delays into requests from service A to service B for testing purposes. Which Traffic Director feature should you use?

A.Fault injection
B.Traffic splitting
C.Circuit breakers
D.Outlier detection
AnswerA

Fault injection adds delays or aborts to test resilience.

Why this answer

Traffic Director supports fault injection, which allows you to inject delays and abort requests into the traffic between services.

Practice this question →
109
MCQmedium

A company is migrating an on-premises DNS service to Cloud DNS. They want to resolve on-premises hostnames from GCP VMs and resolve Google Cloud private zone names from on-premises. They have a Cloud VPN with BGP. Which architecture should they implement?

A.Configure a Cloud DNS forwarding zone for on-premises names and a private zone for GCP names. Then create an inbound server policy for on-premises to query Cloud DNS.
B.Configure a split-horizon DNS with separate DNS servers for each environment.
C.Set up Cloud DNS peering zones between the VPC and on-premises.
D.Use DNS over HTTPS from on-premises to Google's public DNS.
AnswerA

Inbound server policy allows on-premises to resolve private zones; forwarding zone allows GCP to resolve on-premises.

Why this answer

Cloud DNS supports inbound server policies that allow on-premises DNS resolvers to forward queries for private zone names (e.g., `gcp.internal`) to Cloud DNS via the Cloud VPN. A forwarding zone in the VPC directs queries for on-premises hostnames (e.g., `corp.example.com`) to the on-premises DNS servers. This bidirectional resolution is achieved without exposing DNS to the internet, leveraging BGP for routing.

Exam trap

Google Cloud often tests the distinction between DNS peering (VPC-to-VPC) and DNS forwarding/inbound policies (VPC-to-on-premises), causing candidates to mistakenly choose peering for hybrid scenarios.

How to eliminate wrong answers

Option B is wrong because split-horizon DNS is a design pattern, not a Google Cloud architecture component; it does not provide the required integration between Cloud DNS and on-premises DNS over VPN. Option C is wrong because Cloud DNS peering zones only allow DNS resolution between VPCs within Google Cloud, not between a VPC and an on-premises network. Option D is wrong because DNS over HTTPS to Google Public DNS would only resolve public internet names, not private zone names or on-premises hostnames, and bypasses the VPN.

Practice this question →
110
MCQeasy

A company is running workloads on Compute Engine instances without public IP addresses. They need to allow these instances to securely access the internet for software updates. Which Google Cloud service should be configured?

A.Cloud VPN
B.Private Google Access
C.Cloud NAT
D.VPC Peering
AnswerC

Cloud NAT enables outbound internet traffic from instances without public IPs.

Why this answer

Cloud NAT (Network Address Translation) allows Compute Engine instances without public IP addresses to initiate outbound connections to the internet for tasks like software updates. It translates the private IP addresses of the instances to a public IP address managed by Google Cloud, enabling secure outbound internet access without exposing the instances to inbound traffic.

Exam trap

Google Cloud often tests the distinction between Private Google Access (which only reaches Google APIs) and Cloud NAT (which provides full internet access), causing candidates to confuse the two when the requirement is for general internet connectivity like software updates.

How to eliminate wrong answers

Option A is wrong because Cloud VPN creates an encrypted tunnel to an on-premises network, not to the general internet; it does not provide outbound internet access for instances without public IPs. Option B is wrong because Private Google Access allows instances to reach Google APIs and services using private IPs, but it does not provide access to the broader internet for software updates. Option D is wrong because VPC Peering connects two VPC networks privately, but it does not provide internet access; it only enables communication between the peered networks.

Practice this question →
111
MCQhard

A company has a Dedicated Interconnect connection from their on-premises data center to GCP. They have set up BGP sessions over VLAN attachments to peer with their VPC. Traffic from on-premises to GCP works, but return traffic from GCP to on-premises is dropped at the on-premises firewall. What is the most likely cause?

A.The VLAN attachment is in a different region than the GCP resources.
B.A GCP firewall rule is blocking the return traffic.
C.The MTU size is inconsistent between the on-premises router and GCP.
D.The on-premises router is not advertising the on-premises prefix to GCP via BGP.
AnswerD

If the on-premises prefix is not advertised, GCP routes return traffic through the internet, causing asymmetric routing and firewall drops.

Why this answer

The most likely cause is that the on-premises router is not advertising the on-premises prefix to GCP via BGP. For return traffic from GCP to be routed correctly, GCP must learn the on-premises network prefix through a BGP advertisement from the on-premises router. Without this advertisement, GCP has no route to send traffic back, causing the firewall to drop the packets as they have no valid path.

Exam trap

Google Cloud often tests the misconception that return traffic issues are caused by GCP firewall rules or MTU mismatches, when the actual root cause is a missing or incorrect BGP prefix advertisement from the on-premises side.

How to eliminate wrong answers

Option A is wrong because the VLAN attachment can be in a different region than the GCP resources; traffic is routed through the VPC's global routing, and region mismatch does not cause return traffic to be dropped at the on-premises firewall. Option B is wrong because GCP firewall rules control traffic entering or leaving VM instances, not traffic that is already routed through the Dedicated Interconnect; the issue is at the on-premises side, not in GCP. Option C is wrong because MTU inconsistency would typically cause fragmentation issues or packet loss, not a complete drop of return traffic at the firewall; the firewall drop indicates a routing or prefix advertisement problem.

Practice this question →
112
MCQmedium

A company is deploying a global application on Google Cloud using Cloud Load Balancing. They want to serve traffic from multiple regions and require the lowest possible latency for users worldwide. The application serves HTTP traffic and uses a static IP address. Which load balancing solution should they use?

A.Network Load Balancer
B.Internal HTTP(S) Load Balancer
C.SSL Proxy Load Balancer
D.External HTTP(S) Load Balancer with Premium Tier
AnswerD

External HTTP(S) Load Balancer with Premium Tier uses Google's global network and anycast IP to direct users to the nearest backend, minimizing latency.

Why this answer

The External HTTP(S) Load Balancer with Premium Tier is correct because it uses Google's global anycast IP address to route user traffic to the nearest frontend, minimizing latency worldwide. Premium Tier leverages Google's global network backbone, ensuring traffic enters and exits at the closest Google edge point of presence (PoP) for HTTP(S) traffic, which is essential for a global application requiring low latency and a static IP.

Exam trap

Google Cloud often tests the misconception that any load balancer with 'HTTP(S)' in its name is automatically global, but the trap here is that only the External HTTP(S) Load Balancer with Premium Tier provides global anycast routing; the Internal and SSL Proxy variants are regional, and the Network Load Balancer is Layer 4 only.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer is a regional, passthrough load balancer that operates at Layer 4 (TCP/UDP) and does not support HTTP(S) traffic or global anycast IPs, making it unsuitable for global low-latency HTTP traffic. Option B is wrong because an Internal HTTP(S) Load Balancer is designed for internal VPC traffic within a single region and cannot serve traffic from the internet or use a public static IP. Option C is wrong because an SSL Proxy Load Balancer terminates SSL/TLS connections but is regional (not global) and does not provide the lowest possible latency for worldwide users compared to the Premium Tier's global anycast routing.

Practice this question →
113
Multi-Selectmedium

Which TWO of the following are benefits of using Cloud NAT?

Select 2 answers
A.Supports static IP addresses for all instances
B.Enables outbound traffic from instances without public IPs
C.Allows fine-grained control over source IP addresses
D.Provides inbound port forwarding
E.Automatically scales with the number of instances
AnswersB, C

This is the primary purpose of Cloud NAT.

Why this answer

Cloud NAT enables outbound connectivity from private instances that lack public IP addresses. It translates private source IPs to a single or a pool of external IPs, allowing instances to reach the internet while remaining unreachable from outside. This is essential for security and compliance in VPC networks.

Exam trap

Google Cloud often tests the misconception that Cloud NAT provides inbound connectivity or static IPs per instance, when in fact it is strictly outbound and uses a shared pool of IPs.

Practice this question →
114
Multi-Selecthard

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

Select 3 answers
A.Assign public IP addresses to all VMs for direct internet access
B.Use Cloud NAT to allow outbound internet access without public IPs
C.Enable VPC Flow Logs to block malicious traffic
D.Enable Cloud Armor to protect against DDoS and application attacks
E.Use Private Google Access for VMs that need to access Google APIs
AnswersB, D, E

Provides outbound connectivity without exposing VMs.

Why this answer

Cloud NAT enables outbound internet access for private VMs without assigning them public IP addresses, which reduces the attack surface. This is a secure alternative to direct internet access because it allows outbound connections initiated by the VMs while blocking unsolicited inbound traffic from the internet. It works by translating private IP addresses to a set of ephemeral public IPs managed by Google Cloud.

Exam trap

Google Cloud often tests the misconception that VPC Flow Logs are a security control that can block traffic, when in reality they are only a logging and monitoring feature, not an enforcement mechanism.

Practice this question →
115
MCQhard

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between all services. Which component is responsible for issuing and distributing certificates to the Envoy proxies?

A.Envoy's built-in certificate management
B.Secret Manager
C.Google Cloud Certificate Authority Service
D.Cloud KMS
AnswerC

Traffic Director uses CAS or its own CA to issue and distribute certificates for mTLS.

Why this answer

Traffic Director integrates with Certificate Authority Service (CAS) or uses its own CA to issue certificates for mTLS. Envoy's SDS (Secret Discovery Service) can also be used, but Traffic Director manages the CA.

Practice this question →
116
MCQmedium

A company runs a global e-commerce platform with a monolithic application deployed on Compute Engine. They want to modernize by splitting the monolith into microservices running on Cloud Run and Cloud Functions, and expose them externally via a single anycast IP with Google-managed SSL certificates. Which load balancer should they use?

A.Global TCP Proxy Load Balancer
B.Regional External HTTPS Load Balancer
C.Global SSL Proxy Load Balancer
D.Global External HTTPS Load Balancer
AnswerD

Correct. It supports serverless NEGs, global anycast IP, and Google-managed SSL certificates.

Why this answer

The Global External HTTPS Load Balancer supports serverless NEGs for Cloud Run and Cloud Functions, provides an anycast IP, and offers Google-managed SSL certificates. The Regional External HTTPS LB is regional and does not provide global anycast. The Global SSL Proxy LB does not support serverless NEGs.

The Global TCP Proxy LB also does not support serverless NEGs.

Practice this question →
117
MCQhard

A company wants to expose an on-premises HTTP server to internet clients through a Global HTTPS Load Balancer using a hybrid connectivity NEG. The on-prem server is reachable via a Cloud VPN tunnel. What must the engineer configure to ensure the load balancer can reach the on-prem endpoint?

A.Use a global TCP proxy load balancer instead
B.Configure a firewall rule allowing health check ranges to the on-prem server
C.Create a static route in VPC pointing to the VPN tunnel for the on-prem IP
D.Deploy a proxy VM in the VPC to forward traffic to on-prem
AnswerC

A route is required so that packets from the load balancer reach the on-prem server via VPN.

Why this answer

Hybrid connectivity NEGs require a custom route that directs traffic to the on-prem network via the VPN tunnel. The load balancer's health check source ranges also need routes back. Firewall rules are necessary but not the primary routing requirement.

Practice this question →
118
MCQeasy

An organization wants to direct traffic from a global load balancer to an on-premises data center using a hybrid connectivity NEG. Which connectivity option must be in place for this to work?

A.Dedicated Interconnect without VLAN attachments
B.Cloud VPN or Cloud Interconnect
C.Direct peering with Google
D.VPC Network Peering
AnswerB

A Cloud VPN tunnel or Cloud Interconnect VLAN attachment is required to establish connectivity to on-premises.

Why this answer

Hybrid connectivity NEGs require a Cloud VPN tunnel or Cloud Interconnect VLAN attachment to connect GCP to on-premises. The NEG points to endpoints reachable over that connection.

Practice this question →
119
MCQmedium

You are configuring a health check for a backend service that expects gRPC health probing. Which protocol should the health check use to verify gRPC service health?

A.HTTPS
B.TCP
C.gRPC
D.HTTP
AnswerC

Correct: gRPC health checks use the gRPC health protocol.

Why this answer

gRPC health checks use the gRPC protocol to query the standard gRPC health check endpoint.

Practice this question →
120
MCQhard

A network engineer is configuring a global HTTPS load balancer with Cloud CDN. They want to cache responses based on the request origin, query parameters, and user agent. Which cache key configuration should they use?

A.Use the default cache key, which includes host, scheme, and URL
B.Set cache mode to CACHE_ALL_STATIC and enable query string whitelist
C.Enable custom cache keys and include the origin header, query string, and user-agent header
D.Create a signed URL to include the required parameters
AnswerC

Custom cache keys allow specifying which parameters to include.

Why this answer

Custom cache keys allow inclusion of specific request headers, query parameters, and other attributes. The other options are either not valid or insufficient.

Practice this question →
121
MCQmedium

A company has a global e-commerce platform using a Global HTTPS Load Balancer with Cloud CDN. They want to serve private content, such as user-specific PDFs, with CDN caching while ensuring only authorized users can access it. Which method should they use?

A.Use Cloud Armor to restrict access by IP address
B.Enable IAM permissions on the backend bucket and restrict access to only authenticated users
C.Use Cloud CDN signed URLs or signed cookies
D.Set the cache mode to FORCE_CACHE_ALL and use a token in the URL
AnswerC

Signed URLs/cookies allow access control with CDN caching.

Why this answer

Signed URLs or signed cookies allow you to grant time-limited access to private content cached on Cloud CDN. They are the recommended way to serve private content via CDN.

Practice this question →
122
MCQhard

A media streaming company uses Cloud CDN with signed URLs to protect content. They want to invalidate cached content for a specific file after a security incident. The file is stored in a Cloud Storage bucket and the CDN cache key includes the URL. They run: gcloud compute url-maps invalidate-cdn-cache URL_MAP --path "/videos/incident.mp4". The invalidation succeeds but the old content is still served. What is the most likely reason?

A.The Cloud CDN cache key does not include query parameters, so the invalidation should work.
B.The Cache-Control header on the object is set to public, max-age=31536000.
C.The invalidation path does not match the cache key because signed URLs include query parameters.
D.The Cloud Storage bucket requires object versioning to be enabled for invalidation.
AnswerC

With signed URLs, each request has unique query strings, so the cache key varies.

Why this answer

Cloud CDN's cache key for signed URLs includes the query parameters (e.g., `?Expires=...&Signature=...`). The invalidation command specifies only the path `/videos/incident.mp4`, which does not match the full cache key that includes the query string. As a result, the invalidation does not purge the cached entry for the signed URL, and the old content continues to be served.

Exam trap

Google Cloud often tests the misconception that cache invalidation by path alone will work for all cached objects, ignoring that signed URLs or query parameters can create distinct cache entries that require matching the full cache key.

How to eliminate wrong answers

Option A is wrong because the cache key does include query parameters when signed URLs are used, so the invalidation path must match the full cache key. Option B is wrong because a long `max-age` only affects how long the object is cached by the browser or intermediate caches, not Cloud CDN's ability to invalidate its own cache; invalidation overrides any cache-control directives. Option D is wrong because object versioning is not required for CDN cache invalidation; Cloud CDN invalidates based on the cache key, not on object versions.

Practice this question →
123
Multi-Selecthard

A network engineer is troubleshooting a global HTTPS load balancer that is not serving traffic to some users. The load balancer has a backend service with a zonal NEG in us-central1-a. Users report intermittent 502 errors. Which two checks should the engineer perform? (Choose two.)

Select 2 answers
A.Verify that the health check for the backend service is passing
B.Increase the size of the instance group
C.Disable HTTP/2 on the backend
D.Ensure Cloud CDN is enabled
E.Check that the SSL certificate matches the domain name
AnswersA, E

Unhealthy backends cause 502 errors.

Why this answer

Common causes for 502 errors include health check failures and mismatched SSL certificates. Check that the health check passes and that the SSL certificate covers the domain.

Practice this question →
124
MCQhard

A company uses Cloud CDN to serve content. They need to generate signed URLs to allow temporary access to premium content. They have set up a signing key. Which command correctly generates a signed URL for the object /video.mp4 in a bucket served by a load balancer?

A.gcloud compute sign-url --key-name mykey --expires 2024-12-31T23:59:59Z https://example.com/video.mp4
B.gcloud compute url-maps sign-url --key-name mykey https://example.com/video.mp4
C.gsutil signurl --key-name mykey https://example.com/video.mp4
D.gcloud storage sign-url --key-name mykey --expires 2024-12-31T23:59:59Z https://example.com/video.mp4
AnswerA

Correct: sign-url with --key-name and --expires.

Why this answer

The gcloud compute sign-url command is used to sign URLs for Cloud CDN. It requires the --key-name and --expires flags.

Practice this question →
125
Multi-Selecthard

You are migrating an on-premises application to Google Cloud and need to connect it to Cloud Run services via a load balancer. The on-premises network uses a VPN to GCP. Which TWO components are required to route traffic from on-premises to a serverless NEG? (Choose 2)

Select 2 answers
A.Regional Internal HTTP(S) Load Balancer
B.Serverless NEG
C.Cloud Router
D.Hybrid connectivity NEG
E.Cloud VPN tunnel
AnswersA, B

Internal LB with serverless NEG can route internal traffic to Cloud Run.

Why this answer

A hybrid connectivity NEG is used to route traffic to on-premises backends. For traffic from on-premises to serverless, you need a serverless NEG and an internal load balancer that can route to it. The hybrid NEG is for the reverse direction.

Practice this question →
126
MCQhard

A company uses Cloud Armor with an external HTTPS load balancer to protect their web application. They have a security policy 'my-policy' attached to the backend service. The policy includes an allow rule (priority 1000) for their corporate IP range (203.0.113.0/24) and a deny rule (priority 2000) for all other IPs. The company has an office at a remote location that uses a different IP range (198.51.100.0/24). Employees from the remote office report they cannot access the application. Meanwhile, employees from the corporate office (203.0.113.0/24) can access. The engineer checks the Cloud Armor policy and sees the rule configuration as shown. What is the most likely cause?

A.The rule evaluation order is wrong; the deny rule should have higher priority (lower number).
B.The remote office IP range is not included in an allow rule in the security policy.
C.The deny rule uses 'SRC_IPS_V2' which is an invalid expression.
D.The load balancer's frontend IP blocks traffic from certain geographic regions.
AnswerB

Only the corporate IP range is allowed; all others are denied by the default deny rule.

Why this answer

The remote office IP range (198.51.100.0/24) is not explicitly allowed by any rule in the security policy. The only allow rule (priority 1000) permits traffic from the corporate IP range (203.0.113.0/24), and the deny rule (priority 2000) blocks all other IPs. Since the remote office IPs are not covered by the allow rule, they are denied by default, which explains their inability to access the application.

Exam trap

Google Cloud often tests the misconception that a deny rule with a higher priority number (e.g., 2000) will override an allow rule with a lower priority number (e.g., 1000), but in reality, Cloud Armor evaluates rules in ascending priority order, so the allow rule is evaluated first and permits matching traffic before the deny rule is considered.

How to eliminate wrong answers

Option A is wrong because the rule evaluation order is correct: Cloud Armor evaluates rules from lowest priority number to highest, so the allow rule (priority 1000) is evaluated before the deny rule (priority 2000). Option C is wrong because 'SRC_IPS_V2' is a valid expression type in Cloud Armor for specifying IP ranges using CIDR notation, and its use does not cause the issue. Option D is wrong because the load balancer's frontend IP does not block traffic based on geographic regions; geographic blocking would require a separate Cloud Armor rule or a different configuration, and the problem statement does not indicate any such rule.

Practice this question →
127
MCQeasy

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

A.Change the stack type of subnet-b to IPV4_IPV6.
B.Configure Cloud NAT in the region of subnet-b.
C.Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.
D.Enable Private Google Access on subnet-b.
AnswerD

Enabling Private Google Access allows VMs to reach Google APIs via internal IP.

Why this answer

Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Exam trap

Google Cloud often tests the distinction between enabling outbound internet access (Cloud NAT) and enabling private access to Google services (Private Google Access), leading candidates to mistakenly choose Cloud NAT when the requirement is specifically for private IP access to Google APIs.

How to eliminate wrong answers

Option A is wrong because changing the stack type to IPV4_IPV6 adds IPv6 support but does not enable private access to Google APIs; Private Google Access is independent of IP stack type. Option B is wrong because Cloud NAT provides outbound internet access for private VMs but does not route traffic to Google APIs via private IP; Cloud NAT uses external IPs for translation, not the private Google network path. Option C is wrong because a firewall rule allowing egress to 0.0.0.0/0 on port 443 would permit HTTPS traffic but does not enable the underlying routing needed for private Google API access; without Private Google Access, the traffic would still be dropped or sent via external IP.

Practice this question →
128
Multi-Selectmedium

You are deploying a microservices architecture on Google Kubernetes Engine (GKE) with Traffic Director for traffic management. You want to implement fault injection to test the resilience of your services. Which two types of fault injection does Traffic Director support? (Choose two.)

Select 2 answers
A.Delay
B.Abort
C.CPU exhaustion
D.Packet loss
E.Bandwidth throttling
AnswersA, B

Introduces latency in requests.

Why this answer

Traffic Director supports fault injection of delays and errors (aborts).

Practice this question →
129
MCQeasy

You need to configure health checks for a backend service that uses gRPC for health checking. Which health check type should you use?

A.HTTP
B.TCP
C.gRPC
D.HTTPS
AnswerC

gRPC health checks use the gRPC protocol to probe the backend's health.

Why this answer

For gRPC health checks, the correct health check type is gRPC, which sends a gRPC HealthCheckRequest to the backend.

Practice this question →
130
Multi-Selectmedium

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Select 2 answers
A.Weighted round-robin
B.Geo routing policy
C.Failover policy
D.DNSSEC
E.Response policy zone
AnswersB, C

Geo routing directs users based on geographic location.

Why this answer

Geo routing policy directs traffic based on user location, and failover policy provides automatic failover to a backup if health check fails. Weighted round-robin distributes by weight, not location. DNSSEC is a security extension.

Practice this question →
131
MCQeasy

Refer to the exhibit. A Compute Engine instance has the network tags 'http-server' and 'ssh-server'. It also has a public IP address. Which of the following statements about traffic to this instance is true?

A.All traffic from the internet is denied because of the deny-all rule.
B.SSH traffic from the internet is allowed.
C.HTTP traffic from the internet is allowed.
D.HTTPS traffic from the internet is allowed.
AnswerC

The allow-http rule allows tcp:80 from 0.0.0.0/0 to tagged instances; the instance has http-server tag.

Why this answer

The instance has the network tag 'http-server', which is used by the default VPC firewall rule 'default-allow-http' to permit inbound TCP traffic on port 80 from any source (0.0.0.0/0). Since the instance also has a public IP address, HTTP traffic from the internet can reach it. The other tags and the public IP do not override this allow rule.

Exam trap

Google Cloud often tests the misconception that having a public IP address automatically opens all ports, or that a network tag alone (without a corresponding firewall rule) permits traffic on that port.

How to eliminate wrong answers

Option A is wrong because the implied deny-all rule only applies to traffic that is not explicitly allowed; the 'default-allow-http' rule explicitly permits HTTP traffic, so it is not denied. Option B is wrong because although the instance has the tag 'ssh-server', there is no default firewall rule that allows SSH traffic from the internet; the default-allow-ssh rule exists only if explicitly created, and the tag alone does not create a rule. Option D is wrong because HTTPS (port 443) is not allowed by any default rule associated with the 'http-server' tag; the default-allow-https rule would require a separate tag like 'https-server' or a custom rule.

Practice this question →
132
MCQhard

Refer to the exhibit. A network team has created this load balancer. Clients inside the VPC are unable to connect to the load balancer's IP address from a Compute Engine instance in the same VPC. What is the most likely cause?

A.The target HTTPS proxy is not properly configured to use a backend service.
B.The load balancer is configured with network tier STANDARD, which does not support internal traffic.
C.The load balancer is using INTERNAL_MANAGED scheme, which requires the clients to be in a different region.
D.The load balancer does not have a backend service configured.
AnswerB

Internal load balancers must use Premium Tier. Standard tier is for external load balancers only.

Why this answer

A load balancer configured with network tier STANDARD uses the Premium Tier's external IP addressing, which does not support internal traffic routing within the same VPC. Clients inside the VPC attempting to connect to the load balancer's IP address from a Compute Engine instance in the same VPC will fail because STANDARD tier IPs are designed for external internet-facing traffic and cannot be reached from within the VPC without a public IP and appropriate routing. The load balancer must use the Premium Tier (network tier PREMIUM) to support internal client traffic within the same VPC.

Exam trap

Google Cloud often tests the distinction between network tier STANDARD and PREMIUM, trapping candidates who assume all load balancer IPs are reachable from within the VPC regardless of tier, when in fact STANDARD tier IPs are external-only and require public internet routing.

How to eliminate wrong answers

Option A is wrong because the target HTTPS proxy configuration is unrelated to the client's inability to connect from within the same VPC; a misconfigured proxy would cause backend failures, not a connectivity failure from clients to the load balancer IP. Option C is wrong because INTERNAL_MANAGED scheme is specifically designed for internal load balancing within the same VPC and region, and clients in the same region can connect; the issue here is the network tier, not the scheme or region. Option D is wrong because the absence of a backend service would cause health check failures or 502 errors, not a complete inability for clients to reach the load balancer's IP address from within the VPC.

Practice this question →
133
MCQmedium

A company uses an internal TCP/UDP load balancer to distribute traffic to a backend service. The backend instances are in an unmanaged instance group. Some instances fail health checks and are removed. What happens to existing connections to failed instances?

A.The load balancer drains existing connections before removing the instance.
B.Existing connections are seamlessly redirected to healthy instances.
C.Existing connections are terminated immediately.
D.The load balancer waits for all existing connections to close before removing the instance.
AnswerC

Internal TCP/UDP load balancers do not provide connection draining; connections are dropped.

Why this answer

When an instance in an unmanaged instance group fails a health check, the internal TCP/UDP load balancer immediately terminates all existing connections to that instance. This is because the load balancer does not support connection draining for unmanaged instance groups; it simply stops forwarding new traffic and drops existing flows to the failed instance. The abrupt termination occurs because the load balancer operates at Layer 4 and has no mechanism to gracefully close TCP connections or wait for application-level cleanup.

Exam trap

The trap here is that candidates often assume connection draining is always available for load balancers, but Google Cloud tests the distinction between managed and unmanaged instance groups, where unmanaged groups lack graceful connection termination features.

How to eliminate wrong answers

Option A is wrong because connection draining is a feature of managed instance groups (e.g., with Google Cloud's managed instance groups), not unmanaged instance groups; the load balancer does not drain connections for unmanaged groups. Option B is wrong because existing connections are not seamlessly redirected; TCP/UDP sessions are stateful and cannot be transparently moved to another instance without breaking the connection. Option D is wrong because the load balancer does not wait for connections to close; it removes the instance immediately upon health check failure, terminating all active connections.

Practice this question →
134
MCQeasy

You need to allow on-premises servers to access a Google Cloud VM's internal IP without using a public IP. The on-premises network is connected via Cloud VPN. What configuration is required on the Google Cloud side?

A.Configure Cloud NAT for the on-premises network.
B.Enable Private Google Access on the VPC subnet where the VM resides. [wrong]
C.Assign a global static external IP to the VM.
D.Configure Cloud DNS forwarding to the on-premises DNS servers.
AnswerB

Private Google Access allows on-premises to access Google APIs and services, not arbitrary VM internal IPs.

Why this answer

None of the provided options are correct. To allow on-premises servers to access a Google Cloud VM's internal IP over Cloud VPN, no special Google Cloud-side configuration is required beyond ensuring that the VPC subnet route is advertised to the on-premises network via Cloud Router and that firewall rules allow the traffic. Private Google Access is for accessing Google APIs, not VM internal IPs.

Cloud NAT is for outbound traffic. A global static external IP exposes the VM externally. Cloud DNS forwarding is for DNS resolution, not IP reachability.

Practice this question →
135
MCQhard

Refer to the exhibit. The Cloud Router is configured with custom BGP advertisements. The on-premises router receives only the two advertised ranges (10.1.0.0/24 and 10.2.0.0/24) but not the VPC subnets (e.g., 10.3.0.0/24). What is the most likely reason?

A.The on-premises router is configured to accept only prefixes longer than /24.
B.The advertised route priority of 100 is too high, causing the routes to be ignored.
C.The Cloud Router's custom advertisement includes both the ALL_SUBNETS group and the explicit ranges, so all subnets should be advertised.
D.The on-premises router is filtering routes based on the BGP community or AS path.
AnswerD

On-premises routers often have ingress filters that can drop routes.

Why this answer

Cloud Router custom advertisements can include BGP communities or AS-path attributes that the on-premises router may be filtering. If the on-premises router is configured to reject routes based on these attributes (e.g., only accepting routes with a specific community or AS-path length), it would drop the VPC subnet routes even if they are advertised. The scenario states that only the two explicitly advertised ranges are received, indicating a filtering mechanism on the on-premises side rather than a Cloud Router misconfiguration.

Exam trap

Google Cloud often tests the misconception that Cloud Router's custom advertisement configuration automatically overrides on-premises filtering, when in reality BGP attributes like communities and AS-path are the primary mechanisms for route filtering on the receiving side.

How to eliminate wrong answers

Option A is wrong because the on-premises router receiving /24 prefixes does not imply it filters longer prefixes; the VPC subnets (e.g., 10.3.0.0/24) are also /24, so prefix length filtering would not explain why they are missing. Option B is wrong because BGP route priority (MED or local preference) influences route selection among multiple paths, not whether a route is accepted or rejected; a priority of 100 is a default value and does not cause routes to be ignored. Option C is wrong because if the Cloud Router's custom advertisement includes both the ALL_SUBNETS group and explicit ranges, all VPC subnets should be advertised; the fact that only the explicit ranges are received points to a filtering issue on the on-premises side, not a Cloud Router configuration problem.

Practice this question →
136
Multi-Selectmedium

A company wants to expose an internal HTTP service running on Compute Engine instances to other VPCs in the same project using a load balancer. The load balancer must support HTTP path-based routing and preserve the client source IP. Which load balancer types meet these requirements? (Choose two.)

Select 2 answers
A.Internal TCP/UDP Load Balancer [wrong]
B.Global external HTTP(S) Load Balancer [wrong]
C.External HTTP(S) Load Balancer (regional) [CORRECT]
D.Internal HTTP(S) Load Balancer [CORRECT]
E.External TCP/UDP Network Load Balancer [wrong]
AnswersC, D

External HTTP(S) Load Balancer (regional) supports HTTP path-based routing and preserves client source IP. Correct.

Why this answer

Both the External HTTP(S) Load Balancer (regional) and the Internal HTTP(S) Load Balancer support HTTP path-based routing and preserve the client source IP via the X-Forwarded-For header. The External regional LB can be configured with a public IP, while the Internal LB uses a private IP within the VPC. Both are suitable for exposing an internal HTTP service to other VPCs in the same project, depending on whether internet access is needed.

Practice this question →
137
MCQeasy

A company wants to expose a global web application with HTTP/HTTPS load balancing, SSL termination, and Cloud CDN. They need to route requests to different backend services based on the URL path (e.g., /api/* to a Cloud Run service, /static/* to a Cloud Storage bucket, and /* to a managed instance group). Which GCP load balancing product should they use?

A.SSL Proxy Load Balancer
B.Global external HTTP(S) Load Balancer
C.Internal TCP/UDP Load Balancer
D.External TCP/UDP Network Load Balancer
AnswerB

Correct – supports URL map routing, SSL, Cloud CDN, and multiple backend types including serverless NEG and backend buckets.

Why this answer

Global external HTTPS Load Balancer supports URL-based routing via URL maps, can terminate SSL, integrate with Cloud CDN, and route to different backends (including serverless NEG for Cloud Run and backend buckets for Cloud Storage).

Practice this question →
138
Multi-Selectmedium

A company is migrating from an on-premises data center to Google Cloud. They have a legacy TCP application that must preserve client IP addresses when load balanced. They also need SSL termination for a different web application. Which TWO load balancers should they consider? (Choose two.)

Select 2 answers
A.Global SSL Proxy Load Balancer
B.Global TCP Proxy Load Balancer
C.Regional Internal HTTP(S) Load Balancer
D.Global HTTPS Load Balancer
E.Regional External TCP/UDP Network Load Balancer
AnswersA, E

Provides SSL termination for TCP traffic.

Why this answer

Regional External TCP/UDP Network Load Balancer preserves client IP (pass-through). Global SSL Proxy Load Balancer provides SSL termination for TCP applications (non-HTTP).

Practice this question →
139
Multi-Selecteasy

Which TWO steps are required to set up a Cloud VPN with dynamic routing (BGP)? (Choose 2.)

Select 2 answers
A.Configure a static route for the remote network.
B.Create a Cloud NAT for outbound access.
C.Create a VPN gateway and a VPN tunnel.
D.Create firewall rules to allow traffic from the remote network.
E.Create a Cloud Router in the same region as the VPN gateway.
AnswersC, E

The VPN gateway terminates the tunnel.

Why this answer

A Cloud VPN requires both a VPN gateway (the GCP-side endpoint for encrypted traffic) and a VPN tunnel (the actual IPSec tunnel configuration that defines the remote peer IP, shared secret, and IKE parameters). Option E is correct because dynamic routing with BGP mandates a Cloud Router in the same region as the VPN gateway to exchange BGP routes with the on-premises router; the Cloud Router advertises the VPC subnets and learns remote prefixes via BGP sessions over the tunnel.

Exam trap

Google Cloud often tests the misconception that firewall rules are part of the VPN setup process, but they are a separate security control applied after the VPN infrastructure is created; the trap here is confusing prerequisite security policies with the actual configuration steps for the VPN gateway, tunnel, and BGP routing.

Practice this question →
140
MCQmedium

A company wants to use Cloud DNS with a failover routing policy. They have two IP addresses serving the same application: primary in us-east1 and secondary in us-west1. They want traffic to go to primary unless health check fails, then fail over to secondary. Which configuration is required?

A.Create a geo routing policy with us-east1 as primary and us-west1 as secondary
B.Use a response policy to override the DNS response
C.Create a failover routing policy with primary and secondary targets, each associated with a health check
D.Create two A records with weighting 100 and 0
AnswerC

Failover policy uses health checks to determine active target.

Why this answer

Cloud DNS failover routing policy requires health checks to be attached to the routing policy. The primary and secondary targets are defined under the policy.

Practice this question →
141
MCQeasy

A developer needs to store a TLS certificate for use with a load balancer. Which Google Cloud service is used to create and manage SSL certificates?

A.Secret Manager
B.Certificate Manager
C.Cloud IAM
D.Cloud KMS
AnswerB

Correct. Certificate Manager is used to create, manage, and deploy SSL certificates.

Why this answer

Certificate Manager is the service for managing SSL/TLS certificates for load balancers. Cloud KMS is for encryption keys, Secret Manager for secrets, and Cloud IAM for access control.

Practice this question →
142
MCQmedium

A company wants to use Cloud CDN to serve private content to authenticated users only. Which feature should they use?

A.Cache invalidation
B.IAM roles on the backend bucket
C.Cloud Armor
D.Signed URLs
AnswerD

Correct: signed URLs and signed cookies allow time-limited access to private content.

Why this answer

Signed URLs or signed cookies allow Cloud CDN to serve private content by requiring a valid signature for access.

Practice this question →
143
MCQhard

An organization uses Cloud DNS private zones for internal service discovery. They want to override DNS responses for a specific domain (e.g., 'internal.example.com') to block access to malicious domains and redirect certain queries to a different IP for compliance. Which Cloud DNS feature should they use?

A.DNSSEC
B.Routing policies (weighted round robin, geolocation, failover)
C.Response Policies (RPZ)
D.Cloud DNS peering
AnswerC

Correct. RPZ allows overriding DNS responses to block or redirect queries.

Why this answer

Cloud DNS Response Policies (RPZ) allow overriding DNS responses based on policy rules. They can be used to block domains (by returning NXDOMAIN or redirecting to a sink IP) or to reroute queries to alternative IPs. Routing policies are for authoritative zones to control traffic distribution, not for overriding responses.

DNSSEC ensures authenticity but does not override DNS responses. Peering is for querying other zones, not overriding.

Practice this question →
144
MCQmedium

A company wants to cache static content globally to reduce latency for their users. They are using a Global HTTPS Load Balancer with a backend bucket. Which Cloud CDN cache mode should they use?

A.None: Cloud CDN cannot be used with backend buckets
B.USE_ORIGIN_HEADERS
C.CACHE_ALL_STATIC
D.FORCE_CACHE_ALL
AnswerC

Correct: caches static content automatically based on file type and response headers.

Why this answer

CACHE_ALL_STATIC caches static content based on file extension and response headers, which is suitable for a backend bucket serving static files.

Practice this question →
145
Multi-Selecteasy

A developer wants to use Cloud CDN to cache content from an external origin backend. Which TWO configurations are required to set this up? (Choose two.)

Select 2 answers
A.A backend service or backend bucket with the origin defined
B.A custom domain mapped to the load balancer
C.A global static IP address
D.A Global External HTTPS Load Balancer with Internet NEG
E.Cloud CDN enabled on the backend service or backend bucket
AnswersA, E

Required to define the origin from which Cloud CDN fetches content.

Why this answer

To use Cloud CDN with an external origin, you need a backend service or backend bucket that points to the origin, and enable Cloud CDN on that backend. A Global External HTTPS Load Balancer with Internet NEG is not required; Cloud CDN can be used with external backends via backend service. A custom domain is not required for Cloud CDN to work, though often used.

Practice this question →
146
MCQmedium

An engineer wants to use Traffic Director to split traffic between two versions of a microservice running on Compute Engine with Envoy sidecars. They want to send 10% of traffic to the new version. Which configuration should they apply?

A.Create a weighted backend service with versionA weight 90 and versionB weight 10
B.Use HTTP load balancer URL map to route 10% of requests
C.Configure a firewall rule to drop 10% of traffic to versionA
D.Deploy versionB in a different region and use geo-routing
AnswerA

Correct. Traffic Director supports weighted routing.

Why this answer

Traffic Director uses traffic splitting rules with weight percentages. The backend service or routing rule allows assigning weights to different versions.

Practice this question →
147
MCQeasy

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

A.Configure an alias IP range on the VM's network interface.
B.Assign an ephemeral external IP and configure a firewall rule.
C.Reserve a static internal IP address in the same region and subnetwork.
D.Use a regional internal IP address with auto-delete set to false.
AnswerC

Static internal IPs are reserved and persist until released.

Why this answer

A static internal IP address is reserved within a specific region and subnetwork, ensuring the IP persists even after the VM is stopped or deleted. This meets the requirement for a fixed internal address that remains available for reassignment to the same or a different VM in the same subnet. Ephemeral IPs are released on VM stop/delete, and external IPs are not relevant for internal-only communication.

Exam trap

The trap here is that candidates confuse 'ephemeral' with 'persistent' or assume that stopping a VM preserves the internal IP, but GCP releases ephemeral internal IPs on stop/delete unless explicitly reserved as a static internal IP.

How to eliminate wrong answers

Option A is wrong because an alias IP range is used to assign multiple IP addresses to a single network interface for container or multi-service workloads, but it does not provide a persistent static IP that survives VM deletion. Option B is wrong because an ephemeral external IP is a public, temporary address that is released when the VM is stopped or deleted, and a firewall rule does not affect IP persistence. Option D is wrong because there is no 'auto-delete' property for internal IP addresses; the correct mechanism to make an internal IP persistent is to reserve a static internal IP address, and the term 'regional internal IP address' is ambiguous without the reservation step.

Practice this question →
148
Multi-Selecthard

A company wants to use Cloud DNS response policy zones (RPZ) to override DNS responses for a set of internal domains. They need to ensure that only specific VPC networks can use these overrides. Which three steps are required? (Choose three.)

Select 3 answers
A.Create a forwarding zone for the overridden domains
B.Enable DNSSEC on the response policy zone
C.Bind the response policy zone to the desired VPC networks
D.Add DNS overrides (rules) to the response policy zone
E.Create a response policy zone
AnswersC, D, E

RPZ is applied per VPC network.

Why this answer

To use RPZ, you must create the response policy zone, bind it to the target VPC network(s), and ensure that the DNS queries from those VPCs use Cloud DNS. Additionally, you may need to configure the resolver. The correct steps: create the RPZ, bind it to VPC networks, and specify the DNS overrides (rules).

Practice this question →
149
MCQhard

Your company uses Network Connectivity Center (NCC) to manage multiple on-premises sites connected via Cloud VPN and Partner Interconnect. You create a NCC hub and attach spokes (VPN tunnels and VLAN attachments). Traffic between two on-premises sites (Site A and Site B) should flow through Google Cloud. However, traffic is not passing between the sites. What is the most likely cause?

A.The on-premises routers need static routes pointing to the Google Cloud VPC for inter-site traffic.
B.The VPN spokes do not have custom dynamic route exchange enabled, so routes from Site A are not advertised to Site B.
C.Network Connectivity Center does not support Cloud VPN as a spoke type.
D.The NCC hub must be in the same VPC network as the sites' VPCs.
AnswerB

NCC requires route exchange to be enabled on spokes to propagate routes.

Why this answer

The most likely cause is that custom dynamic route exchange is not enabled on the VPN spokes. By default, NCC does not advertise routes between VPN spokes unless you explicitly enable custom dynamic route exchange. Without this, routes from Site A are not propagated to Site B, preventing inter-site traffic through Google Cloud.

Option A is incorrect because NCC uses dynamic routing, so static routes to the VPC are unnecessary. Option B is correct because it correctly identifies the need for custom dynamic route exchange to advertise routes between spokes. Option C is incorrect because NCC fully supports Cloud VPN as a spoke type.

Option D is incorrect because the NCC hub is a global resource and does not need to reside in the same VPC as the sites' VPCs.

Practice this question →
150
MCQhard

While configuring a health check for a backend service, an engineer notices that the health check is failing even though the instances are healthy. The health check is HTTP on port 80 with a request path of /health. The instances respond to curl http://localhost:80/health with 200 OK. What is a likely cause?

A.Firewall rules are blocking traffic from health check ranges
B.The backend service is not using an instance group
C.The health check protocol should be HTTPS
D.The health check interval is too long
AnswerA

Correct. Health check ranges must be allowed by firewall.

Why this answer

Health checks originate from Google's health check systems, which use source IP ranges. A firewall rule must allow traffic from those ranges. Other options are not as likely.

Practice this question →
← PreviousPage 2 of 3 · 219 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Pcne Configuring Services questions.

Start 20-question session