Knowledge + Practice

CCNA Pcne Configuring Services Questions

69 of 219 questions · Page 3/3 · Pcne Configuring Services topic · Answers revealed

Practice these questions Exam hub All questions

151

MCQmedium

An organization needs to set up a Regional Internal HTTPS Load Balancer for internal microservices. They want to use Envoy-based load balancing. Which backend type must the backend service use?

A.Instance group

B.Zonal NEG

C.Internet NEG

D.Hybrid connectivity NEG

AnswerB

The Regional Internal HTTP(S) LB uses zonal NEGs for backend endpoints.

Why this answer

A Regional Internal HTTP(S) Load Balancer uses Envoy-based load balancing and requires a backend service that is either a zonal NEG (with GCE VMs or containers) or a serverless NEG. For internal microservices, typically a zonal NEG of Compute Engine instances is used.

Practice this question →

152

MCQmedium

An engineer is configuring a Global SSL Proxy Load Balancer to terminate SSL for a non-HTTP TCP application. They want to minimize latency by allowing the load balancer to reuse connections to backends. Which setting should they adjust?

A.Use a regional TCP proxy load balancer instead

B.Increase the backend service timeout

C.Enable proxy protocol

D.Set the SSL policy to use modern ciphers

AnswerB

A larger timeout allows idle connections to be reused for subsequent requests.

Why this answer

Connection timeouts and idle timeouts allow reuse of connections. SSL policies are for versions and ciphers. Proxy protocol adds header but does not affect connection reuse.

Practice this question →

153

MCQeasy

A company is using Cloud DNS for private zone resolution within their VPC. They have a private zone for 'example.internal' and have attached it to the VPC. When they create a new Compute Engine VM and try to resolve 'myapp.example.internal', it fails. What is the most likely cause?

A.The private zone is not attached to the VPC

B.The VM's /etc/resolv.conf does not point to Cloud DNS

C.Firewall rule blocking DNS traffic (UDP 53) to the metadata server

D.The record 'myapp.example.internal' does not exist in the zone

AnswerD

Private zone is authoritative; records must be added explicitly.

Why this answer

The most likely cause of a resolution failure for a specific record is that the record does not exist in the private zone. The question states the zone is attached to the VPC, so the zone itself is accessible; the failure is specific to the record name. Cloud DNS will return an NXDOMAIN response if the record is not defined, even if the zone is properly configured.

Exam trap

Google Cloud often tests the misconception that DNS failures in a private zone are due to firewall rules or resolver configuration, when in fact the metadata server handles DNS transparently and the most common cause is a missing DNS record.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the private zone is attached to the VPC, so this is not the cause. Option B is wrong because Compute Engine VMs automatically have their /etc/resolv.conf configured to use the metadata server (169.254.169.254) which proxies DNS queries to Cloud DNS; manual configuration is not required. Option C is wrong because DNS traffic to the metadata server uses a special internal path that does not traverse standard firewall rules; UDP 53 to 169.254.169.254 is allowed by default and not blocked by VPC firewall rules.

Practice this question →

154

MCQmedium

A company wants to distribute traffic across multiple backend services based on the geographic location of the user. They are using an external HTTPS load balancer. Which routing configuration should they use?

A.Use a URL map with route rules that match on the Host header

B.Configure the load balancer with a weighted round-robin routing policy

C.Use a URL map with route rules that use a header matching condition based on Cloud Armor geo headers

D.Use Cloud DNS with geolocation routing policy to direct users to different load balancers

AnswerC

Cloud Armor security policies can insert geo headers, and URL map rules can match on those headers to route to different backends.

Why this answer

The URL map of a load balancer supports route rules. To route based on geographic location, you can use advanced traffic management with weighted routing based on origin region. However, the simplest approach is to use a multicloud or global load balancer with policies, but for a single load balancer, you can use a URL map with route rules that match based on request headers (like Cloud Armor geo headers) or use a backend bucket with CDN.

The most common method is to use a global load balancer with a URL map and route rules that include conditions based on geographic location using a pre-defined variable like {client_region}.

Practice this question →

155

MCQeasy

A company needs to map multiple domain names to different backend services on a single Global HTTPS Load Balancer. Which resource should they configure to direct traffic based on the requested hostname?

A.Backend service

B.Target proxy

C.SSL certificate

D.URL map

AnswerD

URL map maps hostnames and paths to backend services.

Why this answer

The URL map defines rules for routing based on hostnames and paths. SSL certificates are for termination, target proxies forward traffic, and backend services are the destination.

Practice this question →

156

MCQhard

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

A.Deploy a regional external HTTP(S) load balancer in each region and use Cloud CDN to cache content.

B.Use a global external HTTP(S) load balancer with an anycast IP and enable Cloud CDN.

C.Configure an internal TCP/UDP load balancer in each region with DNS-based geolocation routing.

D.Set up a global external TCP proxy load balancer with SSL termination at each backend.

AnswerB

Global load balancer uses anycast to route users to the nearest healthy backend automatically.

Why this answer

A global external HTTP(S) load balancer uses a single anycast IP address, which directs each user to the closest healthy backend based on the user's geographic location and backend health. Enabling Cloud CDN further reduces latency by caching content at Google's global edge locations, ensuring that static and dynamic content is served from the nearest point of presence.

Exam trap

Google Cloud often tests the distinction between global anycast-based load balancers and regional load balancers with DNS routing, where candidates mistakenly think that regional load balancers with Cloud CDN can achieve the same latency optimization as a global anycast load balancer.

How to eliminate wrong answers

Option A is wrong because regional external HTTP(S) load balancers do not provide a single anycast IP; they require separate IPs per region and rely on DNS-based routing, which cannot guarantee that traffic is always served from the nearest healthy backend without additional complexity and potential latency from DNS caching. Option C is wrong because internal TCP/UDP load balancers are designed for private VPC traffic within a region, not for global external user traffic, and DNS-based geolocation routing introduces latency and does not provide the same anycast-based proximity as a global load balancer. Option D is wrong because a global external TCP proxy load balancer operates at Layer 4 and does not support HTTP/HTTPS features like Cloud CDN, URL-based routing, or content caching, making it unsuitable for optimizing user experience for a web application.

Practice this question →

157

MCQmedium

An organization uses Cloud DNS with a managed zone for example.com. They want to block or override DNS queries for a specific malicious domain (malware.com) to return a sinkhole IP address. Which Cloud DNS feature should they use?

A.DNS forwarding

B.Response Policy Zone (RPZ)

C.DNS peering

D.Managed zone with DNSSEC

AnswerB

RPZ can override DNS responses for specified domains.

Why this answer

Response Policy Zones (RPZ) allow DNS administrators to override DNS responses for specific domains, such as redirecting malicious domains to a sinkhole.

Practice this question →

158

MCQeasy

A team needs to perform a health check for a gRPC backend service. Which health check type should they use?

A.HTTP health check

B.TCP health check

C.gRPC health check

D.SSL health check

AnswerC

gRPC health check uses the gRPC Health Checking Protocol to verify service health.

Why this answer

Cloud Load Balancing supports HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC health checks. For gRPC backends, the gRPC health check is the most appropriate.

Practice this question →

159

MCQmedium

Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?

A.Add a rate-based rule to limit the number of requests per second.

B.Create a rule with higher priority to allow the legitimate traffic before the WAF rule.

C.Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.

D.Enable TLS inspection for the load balancer to fully inspect encrypted traffic.

AnswerC

Reducing sensitivity reduces false positives.

Why this answer

The preconfigured WAF rule for SQL injection (sqli-stable) uses a default sensitivity level that may be too aggressive, causing false positives on legitimate traffic. By lowering the sensitivity level or excluding specific request attributes (e.g., headers, cookies, or URI paths), you can reduce false positives while still blocking actual SQL injection attempts. Cloud Armor allows fine-tuning of preconfigured rules via the `sensitivity` parameter and `exclude` lists, which is the correct approach here.

Exam trap

Google Cloud often tests the misconception that false positives from WAF rules are best handled by adding allow rules or rate limiting, rather than tuning the rule's sensitivity or exclusions, which is the proper Cloud Armor mechanism.

How to eliminate wrong answers

Option A is wrong because rate-based rules limit request frequency to mitigate DDoS or brute-force attacks, not to address false positives from a WAF rule that incorrectly flags legitimate SQL-like patterns. Option B is wrong because creating a higher-priority allow rule would bypass the WAF rule entirely for that traffic, defeating the purpose of SQL injection protection and potentially allowing actual attacks through. Option D is wrong because TLS inspection (e.g., using Cloud Armor with HTTPS load balancers) is already performed by default for encrypted traffic; the issue is not about decryption but about the WAF rule's sensitivity to benign SQL-like patterns.

Practice this question →

160

MCQmedium

A company wants to load balance TCP traffic (non-HTTP) across a group of Compute Engine instances in a single region, while preserving the client IP address. They also need to support session affinity based on client IP. Which load balancer should they choose?

A.Global SSL Proxy Load Balancer

B.Global TCP Proxy Load Balancer

C.Internal TCP/UDP Load Balancer

D.External TCP/UDP Network Load Balancer

AnswerD

Correct. It is pass-through, preserves client IP, and supports session affinity.

Why this answer

External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and supports session affinity. Other options either terminate connections or are HTTP-specific.

Practice this question →

161

MCQmedium

A company wants to route traffic to different backend services based on the geographic location of the client. Which Cloud DNS routing policy should they use?

A.Weighted round robin

B.Failover

C.Geolocation

D.Cloud CDN

AnswerC

Correct: geolocation routing routes traffic based on client location.

Why this answer

Geolocation routing policy directs traffic to different backends based on the geographic location of the DNS resolver.

Practice this question →

162

MCQeasy

A company has a VPC with subnet 10.1.0.0/24 in us-central1. They created a Cloud NAT gateway named 'nat-us-central1' attached to that subnet. During peak hours, many VM instances in the subnet cannot connect to the internet. The NAT configuration shows only one NAT IP. Firewall rules allow egress traffic, and health checks confirm the NAT gateway is functioning. What is the most likely cause of the failure?

A.The Cloud Router is missing or misconfigured.

B.The NAT gateway is not attached to the correct subnet.

C.An egress firewall rule blocks ICMP packets.

D.Port exhaustion due to insufficient NAT IP addresses.

AnswerD

One NAT IP provides limited source ports, easily exhausted by many concurrent connections.

Why this answer

With only one NAT IP address and many VM instances sharing it, the available source ports (65,535 per IP) are quickly exhausted during peak hours. Each concurrent outbound connection consumes a unique source port; once all ports are in use, new connections fail. This is a classic port exhaustion scenario, not a configuration or firewall issue.

Exam trap

Google Cloud often tests the misconception that firewall rules or router misconfiguration are the primary cause of connectivity failures, when in reality port exhaustion from insufficient NAT IPs is a common scaling issue in high-traffic environments.

How to eliminate wrong answers

Option A is wrong because Cloud NAT requires a Cloud Router for dynamic routing, but the question states the NAT gateway is functioning and health checks pass, indicating the router is present and correctly configured. Option B is wrong because the NAT gateway is explicitly attached to subnet 10.1.0.0/24, and health checks confirm it is working, so the attachment is correct. Option C is wrong because the firewall rules allow egress traffic, and ICMP is not required for general internet connectivity; the failure affects all protocols, not just ICMP.

Practice this question →

163

MCQhard

Refer to the exhibit. A Cloud Router has two BGP sessions. The first session is UP, the second is DOWN. What is the most likely cause for the second session being down?

A.The advertised route priority is too low.

B.The session initialization mode is set to PASSIVE.

C.The peer IP address 169.254.1.2 is not routable.

D.The BFD multiplier is too low (3).

AnswerB

If the peer is also PASSIVE, the session cannot establish. One side must be ACTIVE.

Why this answer

The second session has sessionInitializationMode set to PASSIVE. If the peer router is also configured as PASSIVE, the BGP session will never establish. The first session is ACTIVE, so it came up.

This is a common misconfiguration.

Practice this question →

164

Multi-Selectmedium

You need to configure a health check for a backend service that uses HTTP2. Which THREE settings must be configured correctly for the health check to work? (Select three.)

Select 3 answers

A.Request path

B.Protocol: HTTP2

C.Proxy protocol

D.SSL certificate

E.Port

AnswersA, B, E

Required: health check sends a request to a path.

Why this answer

For an HTTP2 health check, you need to specify the protocol (HTTP2), a port, and a request path.

Practice this question →

165

Multi-Selectmedium

A company is designing a hybrid network using Dedicated Interconnect. They want to configure BGP for load balancing across multiple VLAN attachments. Which TWO statements are correct?

Select 2 answers

A.You must create a separate Cloud Router for each VLAN attachment.

B.You can configure the Cloud Router to advertise the same IP prefixes over both VLAN attachments.

C.You should use BGP MED to load balance outbound traffic from Google Cloud.

D.You can use the same BGP ASN for both VLAN attachments.

E.Load balancing across VLAN attachments requires a single BGP session.

AnswersB, D

Advertising the same prefixes over multiple VLANs enables load balancing.

Why this answer

A Cloud Router can advertise the same IP prefixes over multiple VLAN attachments to enable load balancing. This allows Google Cloud to use ECMP (Equal-Cost Multi-Path) routing to distribute outbound traffic across the two VLAN attachments, as long as the BGP attributes (e.g., AS path length, MED) are equal.

Exam trap

Google Cloud often tests the misconception that BGP MED controls outbound traffic, but in reality, MED is a hint for inbound path selection, while outbound load balancing relies on equal BGP attributes and ECMP.

Practice this question →

166

MCQmedium

Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?

A.The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.

B.The on-premises server is not configured with a default gateway pointing to the on-premises gateway.

C.The Cloud VPN tunnel is not configured with an IKE version supported by the on-premises device.

D.A firewall rule on the GCP VPC is blocking ICMP traffic from 192.168.1.100.

AnswerA

Without a return route, the on-premises server sends replies through the default route (likely internet), causing asymmetric routing and packet drop.

Why this answer

Since the VM can ping the on-premises gateway (192.168.1.1) but not the server (192.168.1.100), the VPN tunnel and BGP session are working, and GCP has the correct route. The issue is that the on-premises router is not advertising or does not have a route for the GCP subnet 10.0.1.0/24 pointing back to the VPN tunnel, so return traffic from the server to the VM is dropped. Without this route, the on-premises router cannot forward packets destined for 10.0.1.10 back through the VPN.

Exam trap

Google Cloud often tests the misconception that a successful ping to the remote gateway proves full bidirectional connectivity, but the trap here is that the gateway responds from its own IP stack, not from behind it, so a missing return route for the GCP subnet on the on-premises router breaks traffic to hosts beyond the gateway.

How to eliminate wrong answers

Option B is wrong because if the on-premises server lacked a default gateway pointing to the on-premises gateway, the server would not be able to reach any off-subnet destination, including the gateway itself, but the problem states the server is reachable from the gateway. Option C is wrong because an IKE version mismatch would prevent the VPN tunnel from establishing at all, yet the VM can ping the on-premises gateway, proving the tunnel is up and BGP is exchanging routes. Option D is wrong because the GCP firewall rule explicitly allows ingress from 192.168.1.0/24 to all VMs, and the VM can receive ICMP from the gateway (192.168.1.1), so a firewall block on 192.168.1.100 specifically is inconsistent with the rule and the successful ping from the gateway.

Practice this question →

167

MCQmedium

Refer to the exhibit. A VM with the 'ssh-allowed' tag is unreachable via SSH from the internet, while other VMs with the same tag work. What is the most likely cause?

A.A firewall rule with priority 500 denies ingress traffic to the VM's tag or IP range.

B.The rule source range is set to 0.0.0.0/0, which includes all internet IPs, so it should allow SSH.

C.The VM is in a different VPC that does not have the allow-ssh rule.

D.The firewall rule 'allow-ssh' has a higher priority (1000) than the implicit deny (65535), so it should work.

AnswerA

A higher priority deny rule can override the allow rule.

Why this answer

The most likely cause is that a firewall rule with priority 500 explicitly denies ingress traffic to the specific VM's tag or IP range, overriding the allow-ssh rule (which has a lower priority, i.e., a higher numerical value). In Google Cloud Platform (GCP), firewall rules are evaluated from lowest to highest priority number, and a deny rule with a lower priority number (e.g., 500) takes precedence over an allow rule with a higher priority number (e.g., 1000). This explains why other VMs with the same 'ssh-allowed' tag remain reachable, as they are not affected by the specific deny rule.

Exam trap

Google Cloud often tests the misconception that a higher priority number means higher priority, when in fact a lower priority number (e.g., 500) takes precedence over a higher one (e.g., 1000), causing candidates to overlook the effect of a deny rule with a lower priority number.

How to eliminate wrong answers

Option B is wrong because the source range 0.0.0.0/0 does allow all internet IPs, but the issue is that a higher-priority deny rule (priority 500) is blocking the traffic, not that the allow rule is misconfigured. Option C is wrong because if the VM were in a different VPC without the allow-ssh rule, no VM in that VPC would be reachable via SSH, but the question states that other VMs with the same tag work, implying they are in the same VPC. Option D is wrong because while the allow-ssh rule with priority 1000 is higher than the implicit deny (65535), a deny rule with a lower priority number (500) takes precedence over the allow rule, blocking the traffic.

Practice this question →

168

MCQhard

A company is using Traffic Director with Envoy sidecars to manage traffic between microservices. They want to inject faults to test service resilience. Which Traffic Director feature should they use?

A.Traffic splitting

B.Fault injection

C.Circuit breakers

D.mTLS

AnswerB

Correct: fault injection allows testing resilience by injecting delays or errors.

Why this answer

Fault injection is a feature of Traffic Director that allows injecting delays or abort errors into requests for testing.

Practice this question →

169

MCQhard

A company's application requires TLS termination at the load balancer, with backend instances in multiple regions running on Compute Engine. The backend instances must see the original client IP address. Which load balancer should be used?

A.Global external HTTPS load balancer

B.Regional external TCP/UDP Network Load Balancer

C.Global SSL Proxy load balancer

D.Regional internal HTTP(S) load balancer

AnswerC

Global SSL Proxy terminates TLS and can use Proxy Protocol to preserve client IP to backend instances.

Why this answer

Global SSL Proxy LB terminates TLS (SSL offload) and adds the Proxy Protocol header to preserve client IP. Global HTTPS LB does not support Proxy Protocol. NLB does not terminate TLS.

Internal LB is not external.

Practice this question →

170

Multi-Selecteasy

Which TWO configurations can enable VM instances without external IPs to access the internet? (Choose TWO.)

Select 2 answers

A.Direct peering with Google

B.VPC peering with a network that has Cloud NAT

C.Private Google Access

D.Using a proxy instance with an external IP

E.Cloud NAT

AnswersB, E

Through VPC peering, VMs can use the NAT of the peered network for outbound traffic.

Why this answer

Cloud NAT (Option E) provides source network address translation for VMs in a subnet, enabling outbound internet access without external IPs. VPC peering with a network that has Cloud NAT (Option B) allows VMs to use the NAT of the peered network for internet access. Option A (Direct peering with Google) only provides connectivity to Google services, not the full internet.

Option C (Private Google Access) only grants access to Google APIs. Option D (Using a proxy instance with an external IP) is possible but not a native Google Cloud service and requires manual configuration.

Practice this question →

171

Multi-Selectmedium

Which TWO are best practices for securing a VPC network? (Choose 2.)

Select 2 answers

A.Use VPC Network Peering to connect to other projects.

B.Create a VPC with default firewall rules.

C.Enable Private Google Access on all subnets.

D.Use firewall rules to restrict ingress traffic to only necessary ports and IPs.

E.Enable VPC Flow Logs to monitor traffic patterns.

AnswersD, E

This minimizes attack surface.

Why this answer

Firewall rules are the primary mechanism for controlling ingress traffic in a VPC. By restricting traffic to only necessary ports and source IPs, you minimize the attack surface and enforce the principle of least privilege. This is a fundamental security best practice for network segmentation and access control.

Exam trap

Google Cloud often tests the misconception that default firewall rules are secure or that enabling features like Private Google Access or VPC Peering directly improve VPC security, when in fact they serve different purposes and can introduce risks if not configured correctly.

Practice this question →

172

Multi-Selecthard

Which THREE of the following are requirements for VPC Network Peering?

Select 3 answers

A.The VPCs must have non-overlapping subnet IP ranges.

B.Peering supports transitive routing.

C.Routes are automatically exchanged.

D.You need IAM permissions to establish the peering.

E.The VPCs must be in the same project.

AnswersA, C, D

Overlapping IP ranges cannot be peered due to routing conflicts.

Why this answer

VPC Network Peering requires non-overlapping subnet IP ranges to prevent routing conflicts and ensure that traffic is correctly directed between the peered VPCs. Overlapping CIDR blocks would cause ambiguous routing, as the same IP address could exist in both VPCs, making it impossible for the VPC routers to determine the correct destination.

Exam trap

Google Cloud often tests the misconception that VPC Network Peering supports transitive routing, but the correct behavior is that peering is non-transitive and each pair must be explicitly configured.

Practice this question →

173

MCQmedium

You need to invalidate Cloud CDN cached content for specific URLs after updating files in Cloud Storage. Which command should you use?

A.gcloud compute cdn-cache invalidate

B.gcloud compute backend-buckets update

C.gcloud compute url-maps invalidate-cdn-cache

D.gcloud compute ssl-certificates update

AnswerC

Correct command to invalidate CDN cache for a URL map.

Why this answer

gcloud compute url-maps invalidate-cdn-cache invalidates CDN cache for a specific URL map. gcloud compute ssl-certificates is for certificates. gcloud compute backend-buckets update is for updating backend bucket configuration. gcloud compute cdn-cache invalidate does not exist.

Practice this question →

174

MCQmedium

A global HTTPS load balancer is configured with a backend service that points to a serverless NEG for Cloud Run services. Some requests are failing with 502 errors. What is a likely cause?

A.The SSL certificate is expired.

B.The Cloud Run service requires IAP authentication.

C.The health check is misconfigured for serverless NEGs.

D.The serverless NEG is in a different region than the load balancer's forwarding rule.

AnswerD

For a global load balancer, the serverless NEG must be in a supported region and the load balancer must be configured to route to that region.

Why this answer

Serverless NEGs require the load balancer to be in the same region as the Cloud Run service, or use a global external load balancer with serverless NEGs in multiple regions. A 502 error often indicates connectivity issues, such as the load balancer not being able to reach the backend due to missing network endpoint group or incorrect region.

Practice this question →

175

Multi-Selectmedium

A cloud engineer is configuring a Global External HTTPS Load Balancer with a backend service that targets a Cloud Run service via a serverless NEG. They want to enable Cloud CDN and set cache behavior to cache all responses regardless of origin headers. Which THREE steps are required? (Choose three.)

Select 3 answers

A.Configure a cache key policy that includes the query string

B.Generate a signed URL key

C.Set the cache mode to FORCE_CACHE_ALL on the backend service

D.Create a backend bucket instead of a backend service

E.Enable Cloud CDN on the backend service

AnswersA, C, E

Often needed to ensure proper caching per request, though not always required; but recommended.

Why this answer

To force cache all, you set cache mode to FORCE_CACHE_ALL. You also need to enable Cloud CDN on the backend service and set the appropriate cache key policy. Signed URL key is not required for basic caching.

The URL map is not modified for caching.

Practice this question →

176

MCQeasy

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

A.It eliminates the need for SSL certificates.

B.It provides DDoS protection only.

C.It increases compute instance capacity.

D.It reduces latency by serving content from edge locations.

AnswerD

Content is cached at edges closer to users, reducing round-trip time.

Why this answer

Cloud CDN caches content at Google's global edge locations, which are geographically closer to end users. By serving static content from these edge caches instead of the origin HTTP load balancer, the request latency is significantly reduced because the data travels a shorter distance over the network.

Exam trap

Google Cloud often tests the misconception that CDN replaces security features like SSL or DDoS protection, but the trap here is that candidates confuse caching benefits with infrastructure scaling or security capabilities.

How to eliminate wrong answers

Option A is wrong because Cloud CDN does not eliminate the need for SSL certificates; the origin load balancer still requires an SSL certificate to terminate HTTPS, and the CDN can use Google-managed certificates for edge termination. Option B is wrong because while Cloud CDN can absorb some volumetric attacks through caching, it is not a dedicated DDoS protection service; Google Cloud Armor is the primary DDoS protection solution. Option C is wrong because Cloud CDN does not increase compute instance capacity; it offloads requests from the origin, reducing the load on backend instances, but does not add compute resources.

Practice this question →

177

MCQmedium

A company has a Global SSL Proxy Load Balancer handling HTTPS traffic. They want to offload SSL decryption to the load balancer and forward encrypted traffic to backends. Which backend protocol should they use?

AnswerD

Correct: SSL Proxy forwards traffic using SSL to backends.

Why this answer

Global SSL Proxy LB terminates SSL and forwards traffic using SSL (TCP with SSL) to backends, allowing end-to-end encryption.

Practice this question →

178

MCQmedium

A company has deployed a web application on Compute Engine instances in a VPC with subnet 10.1.0.0/20. The instances need to access an external API that whitelists IP addresses. The company uses Cloud NAT to provide outbound connectivity. The API integration tests are failing, and the operations team suspects that the source IP addresses seen by the API are not consistent. What is the most likely cause and solution?

A.Cloud NAT is configured with endpoint-independent mapping; change to endpoint-dependent mapping to ensure consistent source IP.

B.Cloud NAT is configured with dynamic port allocation; use static port allocation instead.

C.Cloud NAT is using a manual NAT IP address that is not assigned to the instances; assign the NAT IP to the instances as an alias IP range.

D.Cloud NAT is configured with a default rule that does not include the subnet; add a custom NAT rule that specifically includes subnet 10.1.0.0/20.

AnswerD

If the subnet is not in a NAT rule, instances may not use NAT or use different NAT IPs, causing inconsistent source IPs. Adding the subnet ensures consistent NAT IP usage.

Why this answer

If Cloud NAT's default rule does not include the subnet 10.1.0.0/20, instances in that subnet will not have their outbound traffic translated through the NAT gateway, causing them to use their ephemeral public IPs (if any) or fail to reach the external API. Adding a custom NAT rule that explicitly includes the subnet ensures all outbound traffic from those instances uses the consistent NAT IP address that the API whitelist expects.

Exam trap

The trap here is that candidates assume Cloud NAT automatically applies to all subnets in the VPC, but in reality, the default rule must explicitly include the subnet, and if it is removed or not configured, traffic from that subnet will not be NATed.

How to eliminate wrong answers

Option A is wrong because endpoint-independent mapping (which preserves the same source IP and port for all sessions to a given destination) actually provides consistency; endpoint-dependent mapping would change the source IP per destination, causing inconsistency. Option B is wrong because dynamic port allocation is the default and does not affect source IP consistency; static port allocation is used for specific port forwarding rules, not for ensuring a consistent source IP. Option C is wrong because a manual NAT IP address is assigned to the Cloud NAT gateway, not to the instances; assigning it as an alias IP range to instances would bypass Cloud NAT and use the instance's own IP, defeating the purpose of NAT.

Practice this question →

179

MCQhard

A company uses Cloud CDN with an external HTTP(S) load balancer. They have two origin server groups: a primary in us-central1 and a backup in europe-west1. They want traffic directed to the primary unless it is unhealthy, in which case traffic should fail over to the backup. Which configuration is required?

A.Create a Cloud CDN with two origins and enable failover in the CDN settings.

B.Use a TCP/UDP network load balancer with two target pools.

C.Configure a weighted round-robin with primary weight 100 and backup weight 0, and change weights manually.

D.Create a backend service with two backends (primary and failover) and a failover policy that marks the primary as failover when unhealthy.

AnswerD

This is the correct architecture for failover across origins.

Why this answer

Cloud CDN with an external HTTP(S) load balancer uses a backend service that can contain multiple backends (e.g., instance groups or NEGs) with a failover policy. When the primary backend is marked as unhealthy by the health check, the load balancer automatically routes traffic to the failover backend. This configuration meets the requirement without manual intervention.

Exam trap

The trap here is that candidates confuse Cloud CDN's origin settings with backend service failover policies, assuming CDN itself handles failover, when in fact failover is a property of the backend service used by the external HTTP(S) load balancer.

How to eliminate wrong answers

Option A is wrong because Cloud CDN does not have a built-in failover setting for origins; failover is configured at the backend service level, not within CDN settings. Option B is wrong because a TCP/UDP network load balancer uses target pools and does not support HTTP(S) traffic or failover policies between backends in different regions. Option C is wrong because weighted round-robin requires manual weight changes to fail over, which does not provide automatic failover based on health checks.

Practice this question →

180

MCQeasy

Which Cloud DNS routing policy should you use to direct users to the nearest healthy backend based on their geographic location?

A.Failover

B.Geolocation

C.Weighted round robin

D.Response policy

AnswerB

Routes traffic based on the DNS resolver's geographic location.

Why this answer

Geolocation routing policy directs traffic based on the user's geographic location. Weighted round robin distributes by weight, failover is for primary/backup.

Practice this question →

181

MCQeasy

You need to distribute incoming TCP traffic to a set of Compute Engine instances in the same region while preserving the client IP address. The load balancer must be used for non-HTTP(S) workloads. Which load balancer should you choose?

A.Global TCP Proxy Load Balancer

B.Regional External TCP/UDP Network Load Balancer

C.Global HTTPS Load Balancer

D.Regional Internal TCP/UDP Load Balancer

AnswerB

This is a pass-through LB for TCP/UDP that preserves client IP.

Why this answer

Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and works for TCP/UDP traffic.

Practice this question →

182

Multi-Selecthard

A company is using Traffic Director with Envoy sidecars. They want to enable mutual TLS (mTLS) between services. Which two steps are required? (Choose two.)

Select 2 answers

A.Enable mTLS in Traffic Director configuration

B.Deploy a service mesh with Istio

C.Configure Envoy sidecars with certificates

D.Use a Global HTTPS Load Balancer

E.Set up Cloud DNS

AnswersA, C

Correct: mTLS must be enabled in Traffic Director.

Why this answer

To enable mTLS, you need to enable mTLS in Traffic Director and configure Envoy sidecars with certificates.

Practice this question →

183

Matchingmedium

Match each Cloud Load Balancing type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Global, proxy-based, for HTTP/S traffic from internet

Regional, pass-through, for traffic within VPC

Regional, proxy-based, for non-HTTP/S internet traffic

Regional, proxy-based, for internal HTTP/S traffic

Global, terminates SSL, for non-HTTPS SSL traffic

Why these pairings

The correct matches are: External HTTP(S) Load Balancer handles internet HTTP/HTTPS traffic; Internal TCP/UDP Load Balancer handles internal TCP/UDP traffic. Common confusions include mixing external/internal roles and protocol support.

Practice this question →

184

MCQeasy

A company wants to serve static content from a Cloud Storage bucket and dynamic content from Compute Engine VMs behind a single external URL. Which GCP feature allows this configuration?

A.URL map

B.Traffic Director

C.Cloud CDN

D.Cloud DNS

AnswerA

Correct: URL map routes traffic to different backends based on URL path.

Why this answer

URL map in the Global HTTPS Load Balancer can route requests to different backends (backend bucket for static, backend service for dynamic) based on URL path.

Practice this question →

185

Multi-Selectmedium

Which TWO considerations are important when designing a VPC peering strategy between multiple projects in Google Cloud?

Select 2 answers

A.Peering is transitive by default

B.Subnet IP ranges in peered VPCs must not overlap

C.Firewall rules in one VPC automatically apply to peered VPCs

D.VPC peering can only be used within the same project

E.Custom routes can be exchanged between peered VPCs if configured

AnswersB, E

Overlapping ranges cause routing issues.

Why this answer

VPC peering requires that subnet IP ranges in peered VPCs do not overlap. This is a fundamental constraint of VPC peering in Google Cloud: if two VPCs have overlapping CIDR blocks, routes cannot be exchanged unambiguously, and the peering connection will fail to establish or will cause routing conflicts. Overlapping ranges would break the ability to route traffic correctly between the VPCs, as there would be no way to determine which subnet a packet should be delivered to.

Exam trap

Google Cloud often tests the misconception that VPC peering is transitive by default, leading candidates to incorrectly select Option A, when in fact transitivity must be explicitly engineered.

Practice this question →

186

MCQmedium

An organization uses Cloud CDN to serve static content from a backend bucket. They want to ensure that content is always served from the edge regardless of cache-control headers from the origin. Which cache mode should they set?

A.USE_ORIGIN_HEADERS

B.ENABLE_CACHE

C.FORCE_CACHE_ALL

D.CACHE_ALL_STATIC

AnswerC

Forces caching of all content regardless of origin headers.

Why this answer

FORCE_CACHE_ALL mode forces Cloud CDN to cache all content, ignoring origin cache directives. CACHE_ALL_STATIC caches based on file type, USE_ORIGIN_HEADERS respects origin headers.

Practice this question →

187

MCQhard

A company has a VPC with subnets in us-central1 and europe-west1. They create a Private Service Connect endpoint for a managed service in us-central1. Can Compute Engine instances in europe-west1 access the endpoint?

A.Yes, if they use a global load balancer in front of the endpoint.

B.No, unless the VPC is peered with another VPC that contains the endpoint.

C.Yes, because the endpoint is accessible from any region in the VPC.

D.No, because the endpoint is only accessible from the same region.

AnswerD

Private Service Connect endpoints are regional; instances must be in the same region to access the endpoint.

Why this answer

Private Service Connect (PSC) endpoints are regional resources. An endpoint created in us-central1 is only accessible from Compute Engine instances within the same region (us-central1) of the VPC. Instances in europe-west1 cannot directly reach the endpoint because traffic would need to cross regional boundaries, which PSC does not support for producer endpoints.

Option D correctly identifies this regional restriction.

Exam trap

The trap here is that candidates assume a VPC is a global construct and therefore any resource within it is globally accessible, but Google Cloud tests the specific regional nature of Private Service Connect endpoints, which are not globally routable within the VPC without additional configuration.

How to eliminate wrong answers

Option A is wrong because a global load balancer does not extend the regional scope of a PSC endpoint; the endpoint itself remains regional, and the load balancer would still need to forward traffic to the endpoint in us-central1, which does not change the regional access limitation. Option B is wrong because VPC peering does not enable cross-region access to a PSC endpoint; the endpoint is tied to the region where it is created, and peering does not override that regional constraint. Option C is wrong because PSC endpoints are not globally accessible within a VPC; they are regional resources, and instances in other regions cannot reach them directly without additional constructs like inter-region VPC peering or VPN, which still do not make the endpoint itself global.

Practice this question →

188

MCQmedium

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

A.CACHE_ALL_STATIC

B.USE_ORIGIN_HEADERS

C.None of the above

D.FORCE_CACHE_ALL

AnswerB

This mode caches only if the origin's Cache-Control headers allow caching.

Why this answer

USE_ORIGIN_HEADERS mode respects the origin's Cache-Control headers. Only objects with Cache-Control: public or similar will be cached.

Practice this question →

189

MCQeasy

A company wants to forward DNS queries from their on-premises network to Google Cloud for resolution of private zone names. Which configuration is required?

A.DNS peering

B.DNS inbound server policy

C.DNS forwarding zone

D.Managed private zone

AnswerB

DNS inbound server policy allows on-premises resolvers to forward queries to Cloud DNS over VPN/Interconnect.

Why this answer

A DNS inbound server policy allows an on-premises DNS resolver to forward queries to Google Cloud, enabling resolution of private zone names. This policy creates a forwarding path from on-premises to Cloud DNS using a specific inbound endpoint, which is required for hybrid cloud DNS resolution.

Exam trap

The trap here is that candidates confuse the direction of DNS forwarding—assuming a forwarding zone (which sends queries from Cloud to on-premises) is the same as an inbound policy (which receives queries from on-premises)—and overlook that the question specifies forwarding from on-premises to Google Cloud.

How to eliminate wrong answers

Option A is wrong because DNS peering is used to enable resolution between two Google Cloud VPC networks, not for forwarding queries from an on-premises network. Option C is wrong because a DNS forwarding zone is a Cloud DNS configuration that forwards queries from Google Cloud to an on-premises resolver, not the reverse direction required here. Option D is wrong because a managed private zone only hosts DNS records within Google Cloud and does not provide any mechanism to receive or forward queries from external networks.

Practice this question →

190

MCQmedium

An organization needs to route traffic to a group of Compute Engine VM instances in the same zone for a high-throughput TCP application. The solution must preserve the client source IP address and support connection draining. Which load balancer type meets these requirements?

A.Regional external HTTP(S) load balancer

B.Global TCP Proxy load balancer

C.Global external HTTP(S) load balancer

D.Regional external TCP/UDP Network Load Balancer

AnswerD

NLB is pass-through, preserves client IP, and supports connection draining.

Why this answer

Regional external TCP/UDP Network Load Balancer (NLB) is pass-through and preserves client IP. Connection draining is supported for NLB backends. Global Proxy LBs rewrite source IP.

Practice this question →

191

MCQmedium

A company is deploying an internal HTTP application on Compute Engine instances. The application must be load-balanced across multiple instances in different regions, but only accessible from within the same VPC. Which load balancer type meets these requirements?

A.Internal HTTP(S) Load Balancer

B.External TCP/UDP Load Balancer

C.External HTTP(S) Load Balancer

D.Internal TCP/UDP Load Balancer

AnswerA

Internal HTTP(S) LB can be configured with backends in multiple regions and is internal to the VPC.

Why this answer

An Internal HTTP(S) Load Balancer is a regional, internal-only load balancer that distributes HTTP/HTTPS traffic among Compute Engine instances within the same VPC network. It uses an internal IP address and is not accessible from outside the VPC, meeting the requirement for internal-only access while providing cross-region load balancing via a multi-region backend service.

Exam trap

Google Cloud often tests the misconception that any 'internal' load balancer can handle HTTP traffic, but the Internal TCP/UDP Load Balancer (option D) operates at layer 4 and cannot inspect or route HTTP application-layer data, making it unsuitable for an HTTP application.

How to eliminate wrong answers

Option B is wrong because an External TCP/UDP Load Balancer is designed for traffic originating from the internet, using external IP addresses, and does not support internal-only VPC access. Option C is wrong because an External HTTP(S) Load Balancer also uses external IP addresses and is intended for internet-facing applications, not for traffic confined to a VPC. Option D is wrong because an Internal TCP/UDP Load Balancer handles non-HTTP traffic (TCP/UDP) and cannot perform HTTP-level content-based routing or terminate TLS, which is required for an HTTP application.

Practice this question →

192

Multi-Selecthard

An organization is deploying a Global HTTPS Load Balancer with Cloud Armor and Cloud CDN. They want to ensure that only requests with a valid signed cookie can access private content. Which three steps are required? (Choose THREE.)

Select 3 answers

A.Configure a Cloud Armor security policy to validate the cookie.

B.Create the signed cookie using the key and set it in the client.

C.Enable Cloud CDN on the backend bucket or service.

D.Create a Cloud CDN signed request key.

E.Set a Cache-Control header to private.

AnswersB, C, D

The client must present the signed cookie.

Why this answer

To use signed cookies with Cloud CDN, you must: 1) Enable Cloud CDN on the backend service or bucket, 2) Create a Cloud CDN signed request key (key name and secret), 3) Create the signed cookie with the key and set it on the client. The load balancer will then validate the cookie. There is no need to configure a separate IAM policy for the cookie.

Practice this question →

193

MCQeasy

A company has a Cloud VPN tunnel to on-premises. They want on-premises clients to resolve private DNS names in the VPC. Which service should they configure?

A.Inbound DNS policy

B.Outbound DNS policy

C.Cloud NAT

D.Private Google Access

AnswerA

An inbound DNS policy allows on-premises DNS servers to forward queries to Cloud DNS.

Why this answer

An inbound DNS policy forwards DNS queries from on-premises DNS servers to Cloud DNS, enabling resolution of private zone names. Option B (Outbound DNS policy) is for forwarding queries from VMs to on-premises DNS, the opposite direction. Option C (Cloud NAT) provides outbound internet access for VMs, not DNS resolution.

Option D (Private Google Access) allows VMs with internal IPs to reach Google APIs, not on-premises DNS resolution.

Practice this question →

194

Multi-Selecthard

An organization uses Cloud DNS with a managed zone for internal resolution. They want to implement a failover routing policy so that if the primary health-checked endpoint is unhealthy, traffic is directed to a secondary endpoint. Which THREE steps are required? (Choose three.)

Select 3 answers

A.Create a health check for the secondary endpoint

B.Create a routing policy of type FAILOVER

C.Create a health check for the primary endpoint

D.Create a routing policy of type WEIGHTED

E.Create a response policy zone

AnswersA, B, C

Required to know when secondary is healthy.

Why this answer

Failover routing policy requires a primary and secondary target, each with an associated health check to determine health.

Practice this question →

195

Multi-Selectmedium

Which THREE components are required when configuring an internal TCP/UDP load balancer? (Choose THREE.)

Select 3 answers

A.Health check

B.Backend service

C.External IP address

D.SSL certificate

E.Forwarding rule

AnswersA, B, E

Health checks determine which backends receive traffic.

Why this answer

The three required components for an internal TCP/UDP load balancer in Google Cloud are: a health check to determine backend instance health, a backend service to define the instance group and port mapping, and a forwarding rule to assign the internal VIP address. Option C (External IP address) is not used because internal load balancers use internal IP addresses. Option D (SSL certificate) is not required for internal load balancing, as SSL termination is handled by external load balancers or proxies.

Practice this question →

196

Multi-Selectmedium

You are deploying a new internal HTTP(S) load balancer for a microservice that runs on Compute Engine instances within the same region. The load balancer must be accessible only from within the VPC network. Which components are required? (Choose two.)

Select 2 answers

A.Global external HTTP(S) load balancer

B.Regional internal HTTP(S) load balancer

C.Backend service with health check

D.Cloud CDN enabled

E.SSL certificate

AnswersB, C

This is the correct LB type for internal L7 load balancing.

Why this answer

Regional internal HTTP(S) LB uses an internal IP address and forwards traffic to a backend service. Backend service requires a health check. An SSL certificate is optional if HTTP is used.

Global external LB is for external access.

Practice this question →

197

Multi-Selecteasy

Which TWO network services can be used to provide secure connectivity between a VPC and an on-premises data center without traversing the public internet? (Choose two.)

Select 2 answers

A.Cloud VPN with IPsec

B.Cloud NAT

C.Dedicated Interconnect

D.VPC Network Peering

E.Partner Interconnect

AnswersC, E

Interconnect provides direct private connection.

Why this answer

Dedicated Interconnect (C) provides a direct, private physical connection between your on-premises network and Google's VPC, bypassing the public internet entirely. This ensures low latency, high bandwidth, and consistent network performance for secure hybrid cloud connectivity.

Exam trap

Google Cloud often tests the distinction between 'secure connectivity' and 'private connectivity' — candidates mistakenly choose Cloud VPN (IPsec) because it is encrypted, but the question explicitly requires no traversal of the public internet, which only Dedicated or Partner Interconnect can guarantee.

Practice this question →

198

MCQeasy

A network engineer is configuring a Cloud Router for BGP peering with an on-premises router over a VPN tunnel. The on-premises router uses 169.254.x.x link-local addresses. Which BGP peer IP should the engineer use in the Cloud Router configuration?

A.169.254.0.1

B.10.0.0.1

C.The tunnel's external IP address

D.The on-premises router's external IP address

AnswerA

Google requires BGP peer IPs to be in the 169.254.0.0/16 range for Cloud VPN tunnels.

Why this answer

The correct BGP peer IP is 169.254.0.1 because Cloud Router uses the first IP in the 169.254.0.0/16 link-local range for BGP peering over a VPN tunnel. This is required by Google Cloud's implementation, where the on-premises router must use a link-local address from the 169.254.0.0/16 range, and Cloud Router automatically assigns 169.254.0.1 as its own BGP peer IP. The on-premises router typically uses 169.254.0.2 as its BGP peer IP, ensuring a point-to-point link-local BGP session.

Exam trap

Google Cloud often tests the misconception that BGP peering over a VPN tunnel uses the tunnel's external IP addresses or private RFC 1918 addresses, but the correct answer requires knowledge that Google Cloud mandates link-local 169.254.x.x addresses for BGP sessions.

How to eliminate wrong answers

Option B is wrong because 10.0.0.1 is a private RFC 1918 address, not a link-local address, and Cloud Router requires a 169.254.x.x address for BGP peering over VPN tunnels. Option C is wrong because the tunnel's external IP address is the public IP of the VPN gateway, which is used for the tunnel establishment itself, not for BGP peering; BGP peering uses link-local addresses within the tunnel. Option D is wrong because the on-premises router's external IP address is its public-facing IP, which is used for the VPN tunnel endpoint, not for the BGP session; BGP peering must use link-local addresses from the 169.254.0.0/16 range.

Practice this question →

199

Multi-Selecthard

A company wants to serve private content over Cloud CDN with access control. They need to generate time-limited URLs that allow users to download files from Cloud Storage. Which TWO methods can they use? (Choose two.)

Select 2 answers

A.Create a CNAME record pointing to the Cloud CDN IP

B.Use IAM conditions on Cloud Storage to restrict access

C.Use Cloud Armor with IP allowlists

D.Use Cloud CDN signed cookies with a key defined in the backend bucket

E.Use Cloud CDN signed URLs with a key defined in the backend bucket

AnswersD, E

Signed cookies allow access to multiple objects or paths.

Why this answer

Cloud CDN supports signed URLs and signed cookies to control access to private content. IAM conditions are not supported directly with Cloud CDN. CNAME records are DNS configuration, not access control.

Cloud Armor is for security policies but not for generating signed URLs.

Practice this question →

200

MCQmedium

To enable DNSSEC for a Cloud DNS managed zone, what must be configured?

A.Create a response policy

B.Set the DNSSEC state to 'on' for the zone

C.Add DS records to the parent zone

D.Set the zone type to private

AnswerB

This is the primary step to enable DNSSEC.

Why this answer

DNSSEC is enabled at the zone level by setting the DNSSEC state to 'on'. This can be done via the console or gcloud with '--dnssec-state=on'.

Practice this question →

201

MCQmedium

A DevOps team is configuring a VPC with a subnet in us-east1. They need to allow a specific VM (source IP 10.0.1.2) to access a database VM (destination IP 10.0.2.3) on port 3306, but only from that specific source. All other traffic should be denied. Which firewall rule configuration should they use?

A.Create an egress rule on the source VM's network interface allowing traffic to 10.0.2.3/32 on port 3306.

B.Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol all, target service account = db-sa.

C.Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol tcp:3306, target tags = db, and assign the 'db' tag to the database VM.

D.Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol tcp:3306, target 10.0.2.3/32.

AnswerC

Ingress rule with specific source and port allows the required traffic when tag is assigned to destination VM.

Why this answer

It creates an ingress firewall rule with the highest priority (1000 is the default for custom rules) that explicitly allows TCP traffic on port 3306 from source IP 10.0.1.2/32 to any VM tagged with 'db'. By assigning the 'db' tag to the database VM, the rule applies only to that target, and since VPC firewall rules are stateful, the corresponding return traffic is automatically allowed. All other traffic is denied by the implied deny-all rule (priority 65535), meeting the requirement.

Exam trap

The trap here is that candidates often confuse ingress vs. egress rules or try to target a specific destination IP in a firewall rule, but GCP firewall rules only support targets via tags, service accounts, or the entire network, not by IP address.

How to eliminate wrong answers

Option A is wrong because egress rules control outbound traffic from the source VM, but the requirement is to allow inbound traffic to the database VM; egress rules cannot permit ingress connections. Option B is wrong because it specifies 'protocol all', which would allow all protocols (including non-TCP) on all ports, violating the requirement to restrict to port 3306 only. Option D is wrong because firewall rules cannot target a specific IP address as a destination; they target VMs via tags, service accounts, or the entire VPC, and the destination IP is not a valid target specifier in GCP firewall rules.

Practice this question →

202

MCQmedium

A multinational corporation has deployed a multi-region application on Google Kubernetes Engine (GKE) clusters in us-central1 and europe-west1. The application serves global users and requires low-latency access to a shared database hosted on Cloud SQL in us-central1. The network team has configured Cloud VPN tunnels between each region and the on-premises data center for administrative access. The application instances in europe-west1 are experiencing high latency when connecting to the Cloud SQL instance in us-central1. The team wants to reduce latency without migrating the database. The team has already verified that the Cloud SQL instance has private IP enabled and is peered to a shared VPC that spans both regions. The GKE clusters are in the same shared VPC. What should the team do?

A.Configure Private Service Connect to expose the Cloud SQL instance from us-central1 and access it via a service attachment from europe-west1.

B.Configure a global external HTTP(S) load balancer in front of the Cloud SQL instance.

C.Create a Cloud Interconnect connection from europe-west1 to the on-premises data center and route traffic through the on-premises network to reach us-central1.

D.Enable Cloud SQL public IP and allow the GKE nodes in europe-west1 to connect over the internet using Cloud NAT.

AnswerA

Private Service Connect provides low-latency, private cross-region access to Cloud SQL without traversing the internet or on-premises.

Why this answer

Private Service Connect (PSC) allows the Cloud SQL instance in us-central1 to be accessed from europe-west1 via a service attachment and a private endpoint, enabling traffic to traverse Google's internal network without backhauling through the on-premises data center. This reduces latency by keeping the traffic within Google's backbone, avoiding the longer path through the Cloud VPN and on-premises network. PSC supports cross-region connectivity with private IP, which aligns with the requirement to not migrate the database.

Exam trap

Google Cloud often tests the misconception that cross-region private connectivity must go through a VPN or on-premises network, when in fact Private Service Connect can provide direct, low-latency access within Google's network without additional infrastructure.

How to eliminate wrong answers

Option B is wrong because a global external HTTP(S) load balancer is designed for HTTP/HTTPS traffic to application backends, not for proxying database connections like Cloud SQL, and it would introduce unnecessary overhead and protocol incompatibility. Option C is wrong because creating a Cloud Interconnect to the on-premises data center and routing traffic through it would add additional latency and complexity, as traffic would still need to traverse the on-premises network to reach us-central1, defeating the purpose of reducing latency. Option D is wrong because enabling Cloud SQL public IP and connecting over the internet via Cloud NAT would expose the database to public internet risks and increase latency due to internet routing, while also violating the requirement to use private IP.

Practice this question →

203

MCQhard

A company has a VPC with multiple subnets. They want to restrict traffic between two specific subnets (10.0.1.0/24 and 10.0.2.0/24) while allowing all other traffic. They create a firewall rule with priority 1000 denying ingress from 10.0.1.0/24 to 10.0.2.0/24. However, traffic is still allowed. What is the most likely reason?

A.The rule is incorrectly applied to the wrong network tag

B.The traffic is going through the metadata server

C.There is a higher priority allow rule that matches the traffic

D.Firewall rules are stateless, so return traffic is blocked

AnswerC

Higher priority allow rule can override deny.

Why this answer

In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence. A rule with priority 1000 is evaluated after any rule with a priority lower than 1000 (e.g., priority 65535 is the default allow rule). If a higher priority (lower number) allow rule exists that matches the same traffic, it will override the deny rule.

The default VPC firewall rules include an implicit allow rule for egress and an ingress allow rule for traffic within the same VPC, which may have a higher priority than 1000, thus permitting the traffic despite the deny rule.

Exam trap

Google Cloud often tests the misconception that a deny rule with a higher priority number (e.g., 1000) will override allow rules with lower priority numbers, when in fact lower numbers have higher precedence.

How to eliminate wrong answers

Option A is wrong because network tags are used to apply firewall rules to specific VM instances, not to subnets; the rule is applied to the subnet via the source and destination IP ranges, not tags. Option B is wrong because the metadata server (169.254.169.254) is used for instance metadata and does not route traffic between subnets; traffic between subnets goes through the VPC's internal routing, not the metadata server. Option D is wrong because Google Cloud VPC firewall rules are stateful by default, meaning return traffic is automatically allowed; the issue is not about statelessness but about rule priority.

Practice this question →

204

MCQmedium

An engineer is configuring a Global HTTPS Load Balancer with a serverless NEG pointing to Cloud Run. The deployment fails with a health check error. What is the most likely cause?

A.The Cloud Run service is not deployed

B.The health check interval is too short

C.The SSL certificate is misconfigured

D.The serverless NEG does not support health checks

AnswerD

Correct: serverless NEGs do not have health checks; the error is likely due to something else.

Why this answer

Serverless NEGs do not require health checks; the health check configuration is ignored. The error may be due to incorrect IAM permissions or service account.

Practice this question →

205

MCQmedium

A company has two VPC networks (VPC-A and VPC-B) in the same project. They are connected via VPC peering. VPC-A contains an internal TCP load balancer with IP 10.1.2.3 serving on port 80. VPC-B needs to access this load balancer. The network engineer has verified that the firewall rules allow traffic from VPC-B to the load balancer's IP and port. However, instances in VPC-B cannot connect to 10.1.2.3:80. What is the most likely reason for this failure?

A.Internal load balancers are regional; clients must be in the same region as the load balancer when using VPC peering.

B.The VPC peering connection does not propagate routes for the load balancer IP.

C.The backend instances are unhealthy and the load balancer is not serving traffic.

D.Firewall rules in VPC-B are not allowing egress to the load balancer IP.

AnswerA

Internal TCP/UDP LBs are regional and only accept connections from VPCs in the same region via peering.

Why this answer

Internal TCP/UDP load balancers are regional and only accept traffic from clients in the same region when using VPC peering. If VPC-B's instances are in a different region than the load balancer, they cannot reach it via peering unless the load balancer has global access enabled (which is only available for external LBs). Option B is incorrect: VPC peering does propagate subnets, but the issue is not routing; it's the regional constraint.

Option C is incorrect: Health checks affect the load balancer's ability to send traffic to backends, not clients' ability to connect to the load balancer IP. Option D is incorrect: Firewall rules were already verified as allowing traffic.

Practice this question →

206

Multi-Selecthard

A company uses Cloud VPN with dynamic routing (BGP). The on-premises network advertises a prefix that overlaps with a subnet in the VPC. Which TWO actions can resolve this conflict? (Choose TWO.)

Select 2 answers

A.Delete the conflicting subnet in the VPC.

B.Modify the on-premises BGP advertisement to use a more specific prefix (longer subnet mask) that does not overlap.

C.Use route propagation with a filter in the VPC route table.

D.Create a static route in the VPC with the same prefix as the overlapping route.

E.Use Cloud Router custom route advertisements to control which routes are learned or advertised.

AnswersB, E

A more specific prefix will be preferred for traffic destined to that subnet, eliminating the conflict.

Why this answer

By advertising a more specific prefix (longer subnet mask) from on-premises, that route will be preferred over the less specific VPC subnet route due to longest prefix match. Option E is correct: Cloud Router custom route advertisements allow you to filter or modify which routes are learned or advertised, which can be used to prevent the overlapping route from being installed. Options A, C, and D are incorrect: deleting the subnet is unnecessary; route propagation filters are not a native feature; and a static route with the same prefix length would not override a dynamic BGP route.

Practice this question →

207

Multi-Selectmedium

A company needs to cache API responses that are dynamic but cacheable for short periods. They want to use Cloud CDN with a Global HTTPS Load Balancer. Which three settings should they configure?

Select 3 answers

A.Disable Cloud CDN for the backend service

B.Set cache mode to USE_ORIGIN_HEADERS

C.Set a short TTL (e.g., 60 seconds)

D.Configure cache keys to include query parameters

E.Set cache mode to FORCE_CACHE_ALL

AnswersC, D, E

Correct: TTL controls how long content is cached.

Why this answer

To cache dynamic but cacheable API responses with Cloud CDN and a Global HTTPS Load Balancer, three settings are required: Set a short TTL (e.g., 60 seconds) to control how long responses are cached. Set cache mode to FORCE_CACHE_ALL to override origin cache headers and allow caching of all responses. Configure cache keys to include query parameters to distinguish different API calls.

These three settings ensure dynamic content is cached appropriately.

Practice this question →

208

Multi-Selecteasy

A network engineer is designing a hybrid cloud architecture connecting an on-premises data center to Google Cloud via Dedicated Interconnect. The on-premises network uses BGP for dynamic routing. The engineer needs to configure Cloud Router to exchange routes with the on-premises router. Which two configuration steps are required? (Choose two.)

Select 2 answers

A.Enable the BGP session on the Cloud Router and configure the peer IP address and ASN.

B.Create a VLAN attachment for the Interconnect connection.

C.Configure a static route in Google Cloud VPC with the on-premises prefix.

D.Assign a primary and secondary IP range to the Cloud Router interface.

E.Configure the Cloud Router with the same ASN as the on-premises router.

AnswersA, B

A BGP session is needed to exchange routes with the on-premises router.

Why this answer

Cloud Router uses BGP to dynamically exchange routes with the on-premises router over Dedicated Interconnect. Enabling the BGP session requires configuring the peer IP address (the on-premises router's interface IP) and the on-premises ASN, which allows the two routers to establish a BGP peering and exchange prefixes.

Exam trap

Google Cloud often tests the misconception that Cloud Router must use the same ASN as the on-premises router, but eBGP requires different ASNs, and Cloud Router does not support iBGP for Dedicated Interconnect.

Practice this question →

209

MCQeasy

A developer wants to use Cloud CDN to cache static assets from an external origin (not a GCP bucket). Which backend type supports this?

A.Backend bucket

B.Serverless NEG

C.Zonal NEG

D.Internet NEG

AnswerD

Internet NEG is designed to reference an external endpoint via FQDN, enabling CDN caching.

Why this answer

Internet NEG allows specifying an external FQDN as a backend, enabling Cloud CDN to cache content from external origins. Backend buckets are for GCS. Serverless NEG is for Cloud Run/Functions/App Engine.

Zonal NEG is for GCP VMs/containers.

Practice this question →

210

MCQmedium

A company has two VPC networks in the same project: Network A (hosting a private zone for 'example.internal.') and Network B. They are connected via VPC peering. The network engineer created a DNS peering zone in Network B for 'example.internal.' pointing to Network A. However, instances in Network B cannot resolve 'host.example.internal.' which is defined in Network A's private zone. The engineer verified that the peering zone is active and the networks are properly peered. What is the most likely reason for the resolution failure?

A.An inbound server policy must be created in Network A.

B.The peering zone should be a forwarding zone instead.

C.An outbound server policy must be created in Network B.

D.The private zone in Network A is not configured to allow resolution from peered networks.

AnswerD

Private zones must explicitly list which VPC networks can query them via peering.

Why this answer

Cloud DNS private zones do not automatically allow resolution from peered VPC networks unless explicitly configured. Even though VPC peering and DNS peering are active, the private zone in Network A must have its 'Allow resolution from peered networks' setting enabled. Without this, queries from Network B via the DNS peering zone are rejected, causing resolution failures for records like 'host.example.internal.'.

Exam trap

Google Cloud often tests the distinction between VPC peering connectivity and DNS resolution permissions, trapping candidates who assume that active VPC peering and a DNS peering zone are sufficient without checking the private zone's peering settings.

How to eliminate wrong answers

Option A is wrong because an inbound server policy is used to allow DNS queries from on-premises or external networks into a VPC, not for VPC peering scenarios. Option B is wrong because a forwarding zone is used to send queries to a specific target (e.g., on-premises DNS), whereas a peering zone is the correct type for recursively resolving from another VPC's private zone. Option C is wrong because an outbound server policy controls DNS queries leaving a VPC to on-premises or external targets, not for resolving via a peering zone within the same project.

Practice this question →

211

MCQeasy

An organization needs to distribute incoming traffic across multiple GCE instances in the same region while preserving the client IP address. Which load balancer should they use?

A.Global TCP Proxy Load Balancer

B.Global HTTPS Load Balancer

C.Regional External TCP/UDP Network Load Balancer

D.Regional Internal TCP/UDP Load Balancer

AnswerC

Correct: pass-through LB preserves client IP and works regionally.

Why this answer

Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves the client IP.

Practice this question →

212

Multi-Selectmedium

A company uses Traffic Director with Envoy sidecars to manage traffic in their service mesh. They want to perform canary deployments where 10% of traffic goes to the new version and 90% to the stable version. Which TWO Traffic Director resources should they configure? (Choose two.)

Select 2 answers

A.A TrafficDirectorService with a traffic splitting policy (weighted clusters)

B.A BackendService defining the backend (version) for each traffic pool

C.A gRPC filter in the Envoy configuration

D.An HTTPRoute resource

E.An Envoy Route Configuration with weighted clusters

AnswersA, B

Defines the weighted distribution of traffic between versions.

Why this answer

Traffic splitting is achieved through TrafficDirectorService with a weighted traffic policy. BackendService defines the service backends. Envoy Route Configuration is used for routing, but Traffic Director configures it automatically.

HTTPRoute and gRPC filters are not used for traffic splitting.

Practice this question →

213

MCQmedium

A company uses Cloud NAT to allow private instances to reach the internet. They notice that egress traffic from Compute Engine VMs is intermittently failing. The VMs are in us-central1-a and use the default VPC network. Cloud NAT is configured with a single NAT IP address. What is the most likely cause?

A.Missing default route to Internet gateway

B.Port exhaustion due to insufficient NAT IP addresses

C.Cloud NAT not configured in the correct region

D.Firewall rule blocking egress traffic from VM

AnswerB

A single NAT IP provides limited ports; many VMs can exhaust them.

Why this answer

Cloud NAT uses source network address translation (SNAT) to map private VM IPs to a public NAT IP. With only a single NAT IP address, the available port range (typically 64,512 ephemeral ports per NAT IP per VM) can be exhausted under high egress traffic, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures and the single IP configuration.

Exam trap

Google Cloud often tests the misconception that Cloud NAT automatically scales with traffic or that a single NAT IP is sufficient for any workload, when in reality port exhaustion is a common scaling bottleneck.

How to eliminate wrong answers

Option A is wrong because the default VPC network already includes a default route (0.0.0.0/0) pointing to the internet gateway, so a missing default route is not the issue. Option C is wrong because Cloud NAT is regionally scoped, and the VMs are in us-central1-a, which is within the us-central1 region; if the NAT were misconfigured for a different region, no traffic would work at all, not just intermittently. Option D is wrong because firewall rules in VPC are stateful and allow return traffic; an egress firewall rule blocking traffic would cause consistent failure, not intermittent, and the default VPC allows all egress by default.

Practice this question →

214

MCQeasy

A startup is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose a service to the internet using a load balancer that provides SSL termination and supports WebSocket. Which type of Service should they use?

A.Create a Service of type ClusterIP and use an Ingress resource with a backendConfig.

B.Create a Service of type LoadBalancer with an HTTP(S) load balancer.

C.Create a Service of type NodePort and configure an external TCP/UDP load balancer.

D.Create a Headless Service with an external DNS A record pointing to the pod IPs.

AnswerB

GKE integrates with Cloud Load Balancing; HTTP(S) LB supports SSL and WebSocket.

Why this answer

A Service of type LoadBalancer with an HTTP(S) load balancer is correct because it provides a public IP address, handles SSL termination at the load balancer level, and natively supports WebSocket connections without additional configuration. This is the simplest and most direct way to expose a microservice to the internet with these requirements on GKE.

Exam trap

Google Cloud often tests the misconception that an Ingress resource is always required for SSL termination and WebSocket support, but in GKE, a LoadBalancer Service with an HTTP(S) load balancer directly provides these features without the complexity of Ingress.

How to eliminate wrong answers

Option A is wrong because a ClusterIP Service is only reachable within the cluster, and while an Ingress with a backendConfig can provide SSL termination, it does not inherently support WebSocket without additional annotations and configuration, making it less straightforward. Option C is wrong because a NodePort Service exposes a static port on each node, but an external TCP/UDP load balancer does not provide SSL termination (which requires an HTTP/HTTPS layer) and is not the recommended approach for HTTP-based WebSocket traffic. Option D is wrong because a Headless Service is used for stateful workloads and DNS-based service discovery, not for exposing a service to the internet with SSL termination and load balancing.

Practice this question →

215

MCQeasy

Which Google Cloud service provides a managed Envoy proxy control plane for traffic management, including traffic splitting and fault injection, in a service mesh?

A.Traffic Director

B.Cloud Endpoints

C.Cloud Load Balancing

D.Anthos Service Mesh

AnswerA

Traffic Director is the managed control plane for Envoy proxies.

Why this answer

Traffic Director is the managed control plane for Envoy-based service mesh, providing traffic management features.

Practice this question →

216

Multi-Selectmedium

You need to create a DNS routing policy that routes users in Europe to one IP and users in Asia to a different IP, with a fallback to a default IP if no match. Which THREE elements are required? (Choose 3)

Select 3 answers

A.A geo location (e.g., europe-west1)

B.A health check

C.A response policy

D.A default target (rrdata) for users not matching any geo

E.An IP address (rrdata) for each geo location

AnswersA, D, E

Geo location defines the region for routing.

Why this answer

A geo routing policy requires a geo location, an IP address (rrdata) for each geo, and a default target for unmatched locations.

Practice this question →

217

MCQhard

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

A.Use the gcloud compute backend-services update command with the --fault-injection flag.

B.Set a circuit breaker with a max pending requests threshold.

C.Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.

D.Create a backend service with connection draining and set the drain timeout.

AnswerC

Fault injection is configured in the route rule (via Envoy's fault filter) in Traffic Director.

Why this answer

Traffic Director uses Envoy's fault injection filter, configured via the Envoy xDS API or through GKE configuration. The correct approach is to apply a traffic policy with fault injection percentage. The other options are not valid Traffic Director features or do not achieve fault injection.

Practice this question →

218

MCQmedium

A company has a VPC with subnets in us-east1 and europe-west1. They have deployed a global external HTTP(S) load balancer with backend services in both regions. Users in Europe report high latency. What is the most likely cause?

A.Incorrect health check configuration causing backends to be marked unhealthy

B.Firewall rules blocking traffic from the load balancer's health check probes

C.The load balancer is not enabled for global access

D.Session affinity set to CLIENT_IP, causing sticky sessions to a distant backend

AnswerD

Traffic might be pinned to us-east1 even for European users.

Why this answer

CLIENT_IP session affinity causes the load balancer to hash the client's IP address to a specific backend instance. If a user in Europe is hashed to a backend in us-east1, all their requests will be forwarded to that distant region, resulting in high latency. This occurs even though a healthy backend exists in europe-west1, because the affinity overrides the load balancer's normal least-latency or proximity-based routing.

Exam trap

Google Cloud often tests the misconception that high latency is always caused by health check or firewall issues, when in fact session affinity can override geographic routing and force traffic to a distant backend.

How to eliminate wrong answers

Option A is wrong because incorrect health checks would cause backends to be marked unhealthy, leading to 502 errors or failover to healthy backends, not consistently high latency to a distant region. Option B is wrong because firewall rules blocking health check probes would also cause backends to be marked unhealthy, not sustained high latency; the load balancer would stop sending traffic to those backends. Option C is wrong because global external HTTP(S) load balancers are inherently global by design; there is no 'global access' toggle to enable—they always route traffic to the closest healthy backend based on the client's location and backend capacity.

Practice this question →

219

MCQeasy

A company uses Cloud NAT to enable outbound connectivity for private VMs. They notice that some VMs are not able to reach a specific external IP range. The VMs have no tags or service accounts. What is the most likely cause?

A.Cloud NAT requires each VM to have a unique external IP address.

B.The VMs need a default route pointing to the NAT gateway.

C.A static route must be created for the external IP range via the NAT gateway.

D.The VMs might be in a different subnet than the one where Cloud NAT is configured.

AnswerD

This is correct. Cloud NAT is configured per subnet. If VMs are in a different subnet without Cloud NAT, they cannot use it for outbound connectivity.

Why this answer

The most likely cause is that the VMs are in a subnet that does not have Cloud NAT configured. Cloud NAT is configured on a per-subnet basis, and only VMs in subnets with Cloud NAT enabled can use it for outbound traffic. Option A is incorrect because Cloud NAT does not require each VM to have a unique external IP; it uses a pool of NAT IPs.

Option B is incorrect because VMs already have a default route (0.0.0.0/0) via the default internet gateway, and Cloud NAT works with that route; there is no need for a route pointing to the NAT gateway. Option C is incorrect because no static route is needed for specific external IP ranges; Cloud NAT uses the default route and performs source NAT for all outbound traffic.

Exam trap

A common mistake is to assume that a static route for the external IP range is necessary when Cloud NAT seems to block specific addresses. However, Cloud NAT uses the default route, and the actual issue is often that the VMs are in a subnet without Cloud NAT configured.

Practice this question →

← PreviousPage 3 of 3 · 219 questions total

Ready to test yourself?

Try a timed practice session using only Pcne Configuring Services questions.

Start 20-question session