Courseiva

CCNA Pcne Designing Network Questions

75 of 222 questions · Page 1/3 · Pcne Designing Network topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

A.Assign a static external IP address to the forwarding rule.
B.Upload an SSL certificate to the load balancer.
C.Specify a subnet in the same region as the backend instances.
D.Create a Cloud NAT gateway for the backend instances.
AnswerC

The ILB's IP is allocated from a subnet in the same region.

Why this answer

An internal load balancer (ILB) in GCP requires a regional forwarding rule that routes traffic to backend instances within the same VPC. Specifying a subnet in the same region as the backend instances is mandatory because the ILB's internal IP address is allocated from that subnet, and the forwarding rule must reference a subnet to enable internal-only routing. Without a subnet, the ILB cannot be provisioned as an internal load balancer.

Exam trap

Google Cloud often tests the misconception that an internal load balancer requires an external IP or SSL termination, but the key requirement is specifying a subnet in the same region as the backends for internal IP allocation.

How to eliminate wrong answers

Option A is wrong because an internal load balancer uses an internal IP address, not an external one; assigning a static external IP would make it an external load balancer, which is not required for internal-only access. Option B is wrong because SSL certificates are only needed for HTTPS/SSL proxy load balancers, not for internal TCP/UDP load balancers, which operate at Layer 4 and do not terminate TLS. Option D is wrong because Cloud NAT is used to provide outbound internet access for instances without external IPs, but it is unrelated to inbound traffic distribution via an internal load balancer.

Practice this question →
2
MCQhard

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

A.Local preference
B.MED (Multi-Exit Discriminator)
C.AS path prepend
D.Weight
AnswerB

MED is used to indicate preference for a route when multiple paths exist. A lower MED value is preferred, so setting a lower MED for the specific subnet will make it preferred over the less specific route.

Why this answer

MED (Multi-Exit Discriminator) is used to influence inbound route preference. A lower MED value is preferred. Setting a lower MED for the specific subnet will make it preferred over the less specific route.

Practice this question →
3
MCQmedium

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

A.DNS forwarding (inbound)
B.Managed zone with cross-project binding
C.DNS peering
D.Global DNS configuration
AnswerC

DNS peering enables cross-project DNS resolution by forwarding queries to a target VPC.

Why this answer

DNS peering allows forwarding DNS queries from one VPC to another VPC's DNS for resolution, without zone transfer.

Practice this question →
4
MCQmedium

You are designing DNS resolution for a hybrid cloud. On-premises DNS servers must resolve GCP private VM hostnames, and GCP VMs must resolve on-premises hostnames. Which Cloud DNS feature should you use?

A.DNS peering
B.Cloud DNS public zones
C.DNS forwarding (inbound and outbound)
D.Split-horizon DNS
AnswerC

Inbound forwarding allows on-prem to forward queries to Cloud DNS; outbound forwards GCP queries to on-prem.

Why this answer

DNS forwarding with inbound and outbound policies is the correct choice because it enables bidirectional resolution between on-premises and GCP VMs. Outbound forwarding sends queries from GCP to on-premises DNS servers, while inbound forwarding allows on-premises clients to resolve GCP private VM hostnames by forwarding queries to Cloud DNS. This creates a seamless hybrid DNS namespace without exposing private zones to the internet.

Exam trap

The trap here is that candidates confuse DNS peering (which only works between GCP VPCs) with the forwarding capabilities needed for hybrid on-premises-to-cloud resolution, leading them to select option A instead of C.

How to eliminate wrong answers

Option A is wrong because DNS peering allows two VPC networks within GCP to resolve each other's private zones, but it does not extend resolution to on-premises DNS servers. Option B is wrong because Cloud DNS public zones are used to publish DNS records to the internet, not to resolve private hostnames in a hybrid cloud environment. Option D is wrong because split-horizon DNS is a design pattern that returns different responses based on the source IP, but it is not a Cloud DNS feature; it would require custom configuration and does not inherently provide the forwarding mechanism needed for hybrid resolution.

Practice this question →
5
MCQeasy

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

A.Cloud NAT on the subnet or VPC
B.Configure a private Google access for the subnet
C.Assign a static external IP address to the instance
D.Set up an internal HTTP(S) load balancer
AnswerA

Enables outbound internet access without external IP.

Why this answer

Cloud NAT (Network Address Translation) allows private Compute Engine instances to initiate outbound connections to the internet without assigning them public IP addresses. It translates the instance's private IP to a Cloud NAT external IP address for outbound traffic, while unsolicited inbound connections from the internet are blocked. This is the correct solution because the requirement explicitly states no public IP on the instance, yet outbound internet access is needed.

Exam trap

Google Cloud often tests the distinction between Private Google Access (which only reaches Google APIs) and Cloud NAT (which provides general internet access), causing candidates to confuse the two when the question mentions 'outbound connections to the internet' versus 'access to Google services'.

How to eliminate wrong answers

Option B is wrong because Private Google Access enables instances with only internal IPs to reach Google APIs and services (e.g., Cloud Storage, BigQuery) over Google's private network, not general internet destinations. Option C is wrong because assigning a static external IP address directly contradicts the requirement that the instance should not have a public IP address. Option D is wrong because an internal HTTP(S) load balancer distributes traffic among instances within a VPC using private IPs; it does not provide outbound internet connectivity for instances.

Practice this question →
6
MCQmedium

A company has a VPC with a firewall rule that allows SSH (tcp:22) from 0.0.0.0/0. They want to restrict SSH access to only the public IP address of their Cloud VPN gateway. How should they modify the firewall rule?

A.Use Cloud Armor to block all SSH except from the VPN IP.
B.Change the source IP range to the VPN gateway's internal IP address.
C.Change the source IP range to the VPN gateway's public IP address.
D.Use IAP Tunneling instead of SSH firewall rules.
AnswerC

Restricts SSH to traffic coming from the VPN gateway.

Why this answer

The firewall rule currently allows SSH from any source IP (0.0.0.0/0). To restrict access to only the Cloud VPN gateway, you must change the source IP range to the gateway's public IP address, because the SSH connection originates from the VPN gateway's public-facing interface over the internet. Internal IP addresses are not routable over the internet and would not match the source of the incoming SSH traffic.

Exam trap

Google Cloud often tests the misconception that internal IPs can be used as source ranges for internet-originating traffic, leading candidates to choose Option B instead of recognizing that the source IP of the SSH connection is the VPN gateway's public IP.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall for HTTP/S traffic and cannot filter SSH (TCP/22) traffic at the network layer; it operates at Layer 7. Option B is wrong because the VPN gateway's internal IP address is private and not reachable from the internet; the SSH connection comes from the gateway's public IP, so using the internal IP would block all SSH traffic. Option D is wrong because IAP Tunneling is an alternative method for SSH access that does not modify the existing firewall rule; it requires separate IAP configuration and does not restrict the current rule's source range.

Practice this question →
7
MCQhard

An organization wants to use Shared VPC but restrict access to certain subnets for specific service projects. Which GCP feature should they use?

A.Subnet-level IAM bindings
B.VPC Network Peering
C.VPC Service Perimeters
D.Firewall rules
AnswerA

Allows granular subnet access control for service projects.

Why this answer

Subnet-level IAM bindings allow you to grant roles (e.g., compute.networkUser) on specific subnets within a Shared VPC to service project principals. This restricts access to only those subnets, while the service project can still use the shared network. It is the native GCP mechanism for fine-grained subnet access control in a Shared VPC environment.

Exam trap

The trap here is that candidates confuse VPC Service Perimeters (which control data boundaries for managed services) with subnet-level IAM (which controls compute resource access within a Shared VPC), leading them to pick Option C when the question explicitly asks about restricting access to subnets for service projects.

How to eliminate wrong answers

Option B is wrong because VPC Network Peering connects two separate VPC networks, not a Shared VPC with service projects, and does not support subnet-level access restrictions within a single shared network. Option C is wrong because VPC Service Perimeters (part of VPC Service Controls) restrict data exfiltration from managed services (e.g., BigQuery, Cloud Storage) by defining perimeters around projects, not subnet-level IAM access for compute resources. Option D is wrong because Firewall rules control traffic flow (allow/deny) based on IP addresses, ports, and protocols, but do not control which principals can use or access a subnet; they are not an IAM mechanism.

Practice this question →
8
Multi-Selecthard

Which THREE actions are required to configure a High-Availability Cloud VPN (HA VPN) with dynamic routing to an on-premises peer?

Select 3 answers
A.Create two VPN tunnels, each associated with a different Cloud VPN gateway interface
B.Create two separate Cloud Routers, one for each tunnel
C.Allocate two external IP addresses for the Cloud VPN gateway
D.Create a Cloud Router in the same region as the VPN gateway
E.Configure static routes for the remote network in the VPC
AnswersA, C, D

Two tunnels provide redundancy.

Why this answer

HA VPN requires two tunnels, each attached to a different interface of the Cloud VPN gateway, to provide redundancy and failover. This ensures that if one tunnel or interface fails, traffic can continue through the other tunnel. Option C is correct because each tunnel must have its own external IP address, so you need to allocate two external IP addresses for the HA VPN gateway interfaces.

Option D is correct because a Cloud Router must be created in the same region as the VPN gateway to manage BGP sessions for dynamic routing. Option B is incorrect because HA VPN uses a single Cloud Router to manage BGP sessions for both tunnels; separate Cloud Routers are not required. Option E is incorrect because with dynamic routing, static routes are not needed; the BGP sessions advertise routes automatically.

Exam trap

Google Cloud often tests the misconception that you need separate Cloud Routers for each tunnel, but HA VPN uses a single Cloud Router to manage BGP sessions for both tunnels, and static routes are not used with dynamic routing.

Practice this question →
9
MCQmedium

A financial services company requires a dedicated, low-latency connection between their on-premises data center and Google Cloud. They need a 99.99% SLA and bandwidth of 10 Gbps. Which connectivity option should they choose?

A.HA VPN
B.Partner Interconnect
C.Classic VPN
D.Dedicated Interconnect
AnswerD

Correct. Dedicated Interconnect offers 10 Gbps links and a 99.99% SLA.

Why this answer

Dedicated Interconnect provides 10 Gbps or 100 Gbps links with a 99.99% SLA when configured with two connections.

Practice this question →
10
MCQmedium

A company has two VPCs connected via VPC peering. They want resources in VPC A to be able to reach a service in VPC B that uses a custom static route. What must be configured on the VPC peering connection?

A.Enable VPC Flow Logs on both VPCs
B.Use a VPN between the VPCs
C.Create a Cloud Router in VPC A
D.Enable export of custom routes in VPC B and import of custom routes in VPC A
AnswerD

Correct. VPC B must export custom routes, and VPC A must import them.

Why this answer

By default, custom static routes are not exchanged across VPC peering. You must export custom routes from VPC B and import them into VPC A.

Practice this question →
11
MCQhard

An organization uses Dedicated Interconnect with VLAN attachments in multiple regions. They need to ensure that traffic from one region to another flows over the interconnect backbone instead of the internet. Which configuration is required?

A.Use Partner Interconnect instead
B.Configure Network Connectivity Center
C.Enable global routing mode on the VPC
D.Set BGP MED values on Cloud Router
AnswerC

Global routing mode ensures routes are propagated to all regions, allowing cross-region traffic over backbone.

Why this answer

C is correct because enabling global routing mode on the VPC allows the VPC to use the same Dedicated Interconnect VLAN attachments across all regions. With global routing, routes learned via BGP over the interconnect are propagated to every region, ensuring that inter-region traffic is forwarded through the interconnect backbone rather than the public internet. Without global routing, each region would have its own VPC and would not share the interconnect routes, causing traffic to egress via the internet.

Exam trap

Candidates often assume Network Connectivity Center is required for inter-region traffic over interconnect, but the actual requirement is simply enabling global routing mode on the VPC. This setting controls route propagation scope and ensures routes learned via BGP over the interconnect are propagated to all regions.

How to eliminate wrong answers

Option A is wrong because Partner Interconnect is a different connectivity option that relies on a third-party provider and does not inherently force inter-region traffic over the interconnect backbone; the same VLAN attachment and routing configuration would be needed. Option B is wrong because Network Connectivity Center is a hub-and-spoke topology manager for on-premises and cloud networks, but it does not directly control how inter-region traffic within a single VPC is routed; global routing mode on the VPC is the specific setting required. Option D is wrong because BGP MED values influence inbound traffic path selection from on-premises to Google Cloud, not the routing of traffic between regions within Google Cloud; MED does not affect VPC internal routing decisions.

Practice this question →
12
MCQhard

A large multinational corporation uses a Shared VPC in Google Cloud with multiple service projects. They have a central Cloud NAT configured in the host project in the us-central1 region to provide internet egress for all VMs. Recently, the IT team added a new subnet (10.0.10.0/24) in a service project and deployed VMs there. All other VMs in the same project but in different subnets (e.g., 10.0.1.0/24) can reach the internet, but the new VMs in 10.0.10.0/24 cannot. The Cloud NAT gateway is configured in us-central1 with all IP ranges allowed. The VPC firewall rules allow egress traffic to the internet. The team verified that the VMs have a default route (0.0.0.0/0) with next-hop 'default-internet-gateway' and that the Cloud NAT router's NAT IPs are properly assigned. However, the new subnet's VMs are unable to connect to any external IP. The network engineer suspects that the Cloud NAT's NAT reservations might be the issue, but all NAT IPs are ephemeral. Further investigation shows that the Cloud Router used by Cloud NAT is advertising custom IP ranges via BGP to an on-premises router for a different use case. What is the most likely cause and solution?

A.Remove the new subnet range (10.0.10.0/24) from the custom advertised routes on the Cloud Router associated with the Cloud NAT.
B.Add a static route for 0.0.0.0/0 with next-hop set to the Cloud NAT gateway's IP address in the VPC.
C.Update the VPC firewall rules to explicitly allow egress traffic from the new subnet's IP range to 0.0.0.0/0.
D.Reserve static NAT IPs for the new subnet in the Cloud NAT configuration to ensure that the VMs have a consistent egress IP.
AnswerA

The Cloud Router is advertising that subnet to on-premises, causing Cloud NAT to think traffic for that subnet should be sent through the VPN, not NATed.

Why this answer

The Cloud Router associated with Cloud NAT is advertising custom IP ranges via BGP to an on-premises router. If the new subnet range (10.0.10.0/24) is included in those custom advertised routes, the on-premises router may advertise a more specific route back to the VPC, causing the VMs in that subnet to prefer the on-premises route over the default route (0.0.0.0/0) for internet-bound traffic. Since the on-premises router does not have internet access, the traffic is blackholed.

Removing the subnet range from the custom advertised routes on the Cloud Router resolves the issue by ensuring the default route remains the preferred path for internet egress.

Exam trap

The trap here is that candidates often focus on Cloud NAT configuration or firewall rules, overlooking how BGP custom route advertisements from the Cloud Router can inject more specific routes that override the default route and cause asymmetric routing or blackholing.

How to eliminate wrong answers

Option B is wrong because adding a static route for 0.0.0.0/0 with next-hop set to the Cloud NAT gateway's IP address is not a valid configuration; Cloud NAT is not a next-hop target, and the default route already exists with next-hop 'default-internet-gateway'. Option C is wrong because the VPC firewall rules already allow egress traffic to the internet, and the issue is not firewall-related; the problem is a routing conflict caused by BGP advertisements. Option D is wrong because reserving static NAT IPs would not fix the routing issue; the Cloud NAT is already using ephemeral IPs and the problem stems from the Cloud Router's BGP advertisements overriding the default route for the new subnet.

Practice this question →
13
MCQeasy

A company wants to use Cloud DNS to resolve DNS queries from their on-premises network for a private zone that contains internal GCP resource names. They do not want to manage DNS servers on-premises. Which Cloud DNS feature should they use?

A.Private DNS zone
B.Inbound DNS server policy
C.Outbound DNS server policy
D.DNS peering
AnswerB

Inbound policy allows on-premises resolvers to forward queries to Cloud DNS private zones, meeting the requirement.

Why this answer

Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS private zones, enabling resolution without managing on-premises DNS servers.

Practice this question →
14
Matchingmedium

Match each network troubleshooting command/tool to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Tests basic connectivity to an IP address

Traces the path packets take to a destination

Displays network connections and listening ports

Queries DNS to resolve a hostname

Captures and analyzes network packets

Why these pairings

Common network troubleshooting tools: ping tests connectivity, traceroute maps the route, nslookup resolves DNS, netstat shows connections. The distractors swap ping and traceroute functions.

Practice this question →
15
MCQeasy

A company wants to connect two VPC networks (vpc-a and vpc-b) that both reside in the same Google Cloud project. They need to ensure that all IP ranges in both VPCs can communicate using internal private IP addresses. Which solution should they implement?

A.Use Dedicated Interconnect to connect the VPCs.
B.Enable VPC Network Peering between vpc-a and vpc-b.
C.Set up Cloud VPN tunnels between the two VPCs.
D.Configure Cloud NAT to allow the VPCs to communicate through NAT.
AnswerB

VPC Network Peering allows private RFC 1918 connectivity across two VPCs, regardless of project or region, as long as they are in the same organization or project.

Why this answer

VPC Network Peering directly connects two VPCs within the same project using internal RFC 1918 IP addresses, with no bandwidth limitations and no single point of failure. It allows all subnets in both VPCs to communicate privately without requiring external connectivity, VPN tunnels, or NAT gateways.

Exam trap

Google Cloud often tests the misconception that VPN or Interconnect is required for VPC-to-VPC connectivity, but in Google Cloud, VPC Network Peering is the native, simpler solution for same-project or cross-project private communication.

How to eliminate wrong answers

Option A is wrong because Dedicated Interconnect is a hybrid connectivity solution for connecting on-premises networks to a VPC, not for connecting two VPCs within the same project. Option C is wrong because Cloud VPN tunnels introduce latency, bandwidth limits, and complexity (e.g., BGP configuration) that are unnecessary when VPC Network Peering provides simpler, lower-latency private connectivity. Option D is wrong because Cloud NAT is designed to allow private instances to access the internet outbound, not to enable direct private communication between VPCs; it would force traffic through external IPs and break internal routing.

Practice this question →
16
MCQmedium

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

A.VPC Network Peering
B.Shared VPC
C.Network Connectivity Center
D.Cloud VPN
AnswerC

NCC provides hub-and-spoke connectivity with transitive routing across VPCs and on-premises.

Why this answer

Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Practice this question →
17
MCQeasy

A company wants to allow on-premises servers to access Google APIs and services through a Dedicated Interconnect without using public IPs. What should they configure?

A.Enable Private Google Access on the VPC subnet.
B.Set up VPC Network Peering.
C.Configure Private Service Connect.
D.Configure Cloud Router with custom route advertisement.
AnswerA

This enables private access to Google APIs via the interconnect.

Why this answer

Private Google Access enables on-premises hosts connected via Dedicated Interconnect to reach Google APIs and services using internal IP addresses. When enabled on the VPC subnet, traffic destined for Google APIs is routed through the interconnect without needing public IPs, as the VPC uses its default routes and Cloud NAT-like functionality to forward requests to Google's internal addresses.

Exam trap

Google Cloud often tests the misconception that Private Service Connect or Cloud Router alone can provide private API access from on-premises, but the key requirement is enabling Private Google Access on the subnet to route API traffic through the interconnect without public IPs.

How to eliminate wrong answers

Option B is wrong because VPC Network Peering connects two VPC networks, not on-premises networks to Google APIs; it does not provide access to Google APIs from on-premises via interconnect. Option C is wrong because Private Service Connect is used to privately access managed services (e.g., Google APIs) from within a VPC using endpoints, but it does not extend that access to on-premises networks over Dedicated Interconnect without additional configuration like Private Google Access. Option D is wrong because Cloud Router with custom route advertisement manages dynamic routing (BGP) between on-premises and GCP, but it does not by itself enable access to Google APIs without public IPs; Private Google Access must be explicitly enabled on the subnet.

Practice this question →
18
Multi-Selectmedium

An engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They want to control which on-premises subnets are advertised to GCP. Which TWO methods can they use?

Select 2 answers
A.Change the Cloud Router ASN
B.Use route priority in the VPC
C.Set MED on the on-premises router
D.Apply BGP filters on the on-premises router to limit advertised prefixes
E.Configure custom learned routes on the Cloud Router
AnswersD, E

On-premises filters can restrict which prefixes are advertised to GCP.

Why this answer

Custom learned routes can be configured to filter prefixes, and BGP filters can be applied on the on-premises side.

Practice this question →
19
MCQmedium

Your company has a hybrid network architecture with two Cloud VPN tunnels (tunnel-a and tunnel-b) from an on-premises router to a Cloud VPN gateway in us-central1, and one Dedicated Interconnect connection from the same on-premises router to a VLAN attachment in us-east1. All connections use BGP to exchange routes. The on-premises router advertises the same CIDR block 10.0.0.0/8 to both VPN and Interconnect. Google Cloud routes for on-premises prefixes are learned via both paths with the same priority. You notice that traffic from Google Cloud VMs in us-central1 to on-premises destinations sometimes fails during periods of high load. Additionally, you observe ICMP redirects from the VMs. What is the most likely cause and recommended action?

A.Configure BGP ASN prepending on the Cloud Router associated with the VPN tunnels to make the Interconnect path more preferred for on-premises traffic back to Google Cloud.
B.Create a second Cloud VPN gateway in us-east1 and establish a separate VPN tunnel from on-premises to that gateway to provide symmetric routing.
C.Enable source NAT on the Cloud VPN gateway so that VMs' source IPs are rewritten, preventing ICMP redirects.
D.Disable route propagation on the Cloud Router in us-east1 to force all traffic through the VPN tunnels.
AnswerA

ASN prepending makes the VPN path less desirable, causing return traffic to use the Interconnect connection, achieving symmetric routing.

Why this answer

The issue is asymmetric routing: traffic from Google Cloud VMs in us-central1 to on-premises destinations uses the Interconnect (us-east1) due to equal-cost multipath (ECMP) or routing decisions, but return traffic from on-premises may prefer the VPN tunnels (tunnel-a/tunnel-b) because BGP path selection (e.g., local preference, AS path length) is not influenced. This causes ICMP redirects and failures under load. Option A corrects this by using BGP ASN prepending on the Cloud Router for the VPN tunnels, artificially lengthening the AS path for routes learned via VPN, making the Interconnect path more preferred for return traffic, ensuring symmetric routing.

Exam trap

The trap here is that candidates confuse ICMP redirects with a NAT or firewall issue, rather than recognizing them as a classic symptom of asymmetric routing in a multi-homed BGP environment, and they overlook the simple BGP path manipulation technique of ASN prepending to enforce symmetric routing.

How to eliminate wrong answers

Option B is wrong because creating a second VPN gateway in us-east1 does not solve the asymmetric routing problem; it adds another path without influencing path preference, and the core issue is route selection, not geographic proximity. Option C is wrong because source NAT on the Cloud VPN gateway would break end-to-end IP connectivity and does not address the routing asymmetry; ICMP redirects are a symptom of asymmetric routing, not a source IP issue. Option D is wrong because disabling route propagation on the Cloud Router in us-east1 would remove the Interconnect route entirely, forcing all traffic through VPN tunnels, which defeats the purpose of using Dedicated Interconnect and may cause performance degradation or single-path failure.

Practice this question →
20
MCQmedium

An organization is planning a hybrid network between an on-premises data center and Google Cloud. They require a dedicated, high-bandwidth connection with 99.99% availability SLA and the ability to scale up to 100 Gbps. They have a co-location facility that is connected to a Google Cloud region. Which connectivity option should they choose?

A.HA VPN
B.Partner Interconnect
C.Dedicated Interconnect
D.Classic VPN
AnswerC

Dedicated Interconnect offers dedicated 10 Gbps or 100 Gbps links, supports up to 100 Gbps, and has a 99.99% SLA when deployed with redundant connections.

Why this answer

Dedicated Interconnect provides direct physical connections between on-premises and GCP, offering 10 Gbps or 100 Gbps per link, with a 99.99% SLA when configured with redundant links. It is the best fit for high-bandwidth, high-availability requirements when co-location is available.

Practice this question →
21
MCQhard

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

A.Ingress rule: source 203.0.113.5/32, destination 169.254.0.1/32, tcp:22
B.Ingress rule: source 10.0.1.2/32, destination 203.0.113.5/32, tcp:22
C.Ingress rule: source 0.0.0.0/0, destination 203.0.113.5/32, tcp:22
D.Ingress rule: source 203.0.113.5/32, destination 10.0.1.2/32, tcp:22
AnswerD

Allows SSH from on-premises IP to the instance.

Why this answer

Firewall rules in GCP are stateful and applied at the instance level, not the VPN tunnel. The rule must allow ingress traffic from the on-premises source IP (203.0.113.5/32) to the Compute Engine instance's internal IP (10.0.1.2/32) on TCP port 22. The Cloud VPN and Cloud Router handle routing, but the firewall rule explicitly defines the allowed traffic flow.

Exam trap

The trap here is that candidates often confuse the direction of traffic in firewall rules, mistakenly thinking the on-premises IP should be the destination (as in Option B) or that the VPN tunnel's link-local address is the correct destination (as in Option A), when in fact the rule must match the actual source and destination IPs of the SSH session.

How to eliminate wrong answers

Option A is wrong because the destination 169.254.0.1/32 is a link-local address used for BGP peering between the Cloud Router and the VPN tunnel, not the Compute Engine instance; SSH traffic must reach the instance's internal IP. Option B is wrong because it reverses the source and destination: the on-premises host (203.0.113.5) is the source initiating SSH, not the destination, and the rule would incorrectly allow traffic from the instance to the on-premises host. Option C is wrong because it allows SSH from any source (0.0.0.0/0), which violates the requirement to restrict access to only the specific on-premises IP 203.0.113.5, creating a security risk.

Practice this question →
22
MCQhard

A global application uses a global external HTTPS load balancer with backend NEGs in multiple regions. The content is static and must be cached at edge locations to reduce latency. Which GCP service should be enabled?

A.Cloud CDN
B.Cloud Storage
C.Cloud NAT
D.Cloud Memorystore
AnswerA

Provides edge caching for content.

Why this answer

Cloud CDN is the correct service because it leverages Google's global edge cache network to cache static content from an external HTTPS load balancer with backend NEGs. When enabled, Cloud CDN intercepts requests at edge locations and serves cached responses, reducing latency and offloading origin servers. This directly addresses the requirement to cache static content at edge locations for a global application.

Exam trap

The trap here is confusing Cloud CDN (edge caching) with Cloud Memorystore (backend caching) or Cloud Storage (origin storage), as candidates may think any caching service works at the edge, but only Cloud CDN integrates with the external HTTPS load balancer and Google's edge PoPs.

How to eliminate wrong answers

Option B (Cloud Storage) is wrong because Cloud Storage is a scalable object storage service, not a content delivery network; it can serve static content but does not provide edge caching without Cloud CDN enabled on the bucket. Option C (Cloud NAT) is wrong because Cloud NAT provides outbound internet connectivity for private instances, not inbound caching or content delivery. Option D (Cloud Memorystore) is wrong because Cloud Memorystore is a managed in-memory cache (Redis/Memcached) for backend caching, not an edge caching service; it operates within a VPC, not at Google's edge locations.

Practice this question →
23
MCQmedium

A company needs a hybrid connectivity solution with a bandwidth of 500 Mbps and a 99.9% SLA. They do not have a presence in a colocation facility that supports Dedicated Interconnect. Which GCP service should they use?

A.Classic VPN
B.HA VPN
C.Partner Interconnect
D.Dedicated Interconnect
AnswerC

Suitable for 500 Mbps, 99.9% SLA, no colocation needed.

Why this answer

Partner Interconnect provides connectivity through a supported service provider with bandwidth from 50 Mbps to 10 Gbps and offers 99.9% or 99.99% SLA. It does not require colocation facility access.

Practice this question →
24
MCQhard

An organization is using Shared VPC with 100 service projects. They want to allow each service project to manage its own Cloud NAT, but the network administration team wants to control the outbound IP addresses used. What is the best design?

A.Create a single Cloud NAT in the host project and share it
B.Use a NAT instance with an external IP in the host project and route traffic from service projects
C.Create Cloud NAT in each service project with the same external IPs
D.Use Private Google Access with Cloud NAT in the host project
AnswerC

Correct. Service projects can create their own Cloud NAT gateways using the same set of external IPs reserved in the host project, achieving both management autonomy and centralized IP control.

Why this answer

In Shared VPC, Cloud NAT can be created in each service project, using the same set of external IP addresses. This allows service projects to manage their own NAT gateways (e.g., configure NAT rules and logging) while the network administration team controls the outbound IPs by reserving the IP addresses in the host project. The IPs can be shared across multiple NAT gateways across different service projects, as long as they are in the same region and the IPs are allocated from a common pool in the host project.

Option A is wrong because a single Cloud NAT in the host project cannot be managed by service projects. Option B is wrong because a NAT instance does not allow service projects to manage their own Cloud NAT; it is a single instance managed centrally. Option D is wrong because Private Google Access is for accessing Google APIs privately, not for general outbound NAT.

Exam trap

A common misconception is that Cloud NAT must be created in the host project only. In reality, Cloud NAT can be created in service projects when using Shared VPC, and multiple NAT gateways can use the same external IP addresses, enabling both service project autonomy and centralized IP control.

How to eliminate wrong answers

Option A is wrong because a single Cloud NAT in the host project cannot be 'shared' across service projects; Cloud NAT is per-VPC network and per-region, and service projects would need to use the host project's NAT, which prevents them from managing their own Cloud NAT. Option C is wrong because creating Cloud NAT in each service project with the same external IPs is not possible—Cloud NAT assigns ephemeral or static IPs per NAT gateway, and multiple service projects cannot use identical external IPs without complex, unsupported configurations. Option D is wrong because Private Google Access with Cloud NAT in the host project only enables outbound connections to Google APIs and services, not general internet egress, and still does not allow service projects to manage their own Cloud NAT.

Practice this question →
25
MCQhard

An organization is connecting their on-premises data center to GCP using Dedicated Interconnect with multiple VLAN attachments. They have configured Cloud Router with BGP sessions for each VLAN attachment. They notice that traffic from GCP to on-premises is not load-balanced across the attachments; instead, all traffic uses a single link. What is the most likely cause?

A.Cloud Router's BGP is not configured for multipath; it selects only one best path per prefix.
B.The on-premises router is not advertising the same routes over all BGP sessions.
C.The VLAN attachments have different bandwidths, causing BGP to prefer the higher bandwidth link.
D.The BGP keepalive timers are misconfigured, causing session flapping.
AnswerA

BGP multipath must be enabled to load-balance across multiple equal-cost paths.

Why this answer

Cloud Router uses BGP to exchange routes with the on-premises router. By default, BGP selects only a single best path per prefix based on the lowest MED, weight, local preference, AS-path length, or IGP metric. Without BGP multipath enabled (e.g., 'maximum-paths' or 'bgp multipath' configuration), Cloud Router will not load-balance traffic across multiple VLAN attachments even if multiple equal-cost paths are available.

This causes all traffic to egress through a single link.

Exam trap

The trap here is that candidates often assume BGP automatically load-balances across multiple equal-cost paths, but BGP requires explicit multipath configuration to enable ECMP; otherwise, it selects only one best path per prefix.

How to eliminate wrong answers

Option B is wrong because if the on-premises router were not advertising the same routes over all BGP sessions, Cloud Router would not see multiple paths at all, but the question states that traffic is not load-balanced across the attachments, implying multiple paths are received but not used equally. Option C is wrong because BGP does not consider link bandwidth in its path selection algorithm; bandwidth is not a standard BGP attribute, and Cloud Router does not use bandwidth to influence path preference. Option D is wrong because misconfigured BGP keepalive timers would cause session flapping and intermittent connectivity, not a consistent failure to load-balance across stable sessions.

Practice this question →
26
MCQhard

A company has a Shared VPC with a host project and several service projects. They want to allow a service project's Network Engineer to create and manage Cloud Load Balancers, but not modify other networking resources in the shared VPC. Which IAM role should be granted at the service project level?

A.Project Editor (roles/editor)
B.Compute Network Admin (roles/compute.networkAdmin)
C.Compute Load Balancer Admin (roles/compute.loadBalancerAdmin)
D.Compute Security Admin (roles/compute.securityAdmin)
AnswerC

This role specifically targets load balancer management.

Why this answer

The Compute Load Balancer Admin role (roles/compute.loadBalancerAdmin) grants permissions to create, update, and delete load balancers. The Network Admin role (roles/compute.networkAdmin) would allow modifying other network resources, which is not desired.

Practice this question →
27
Multi-Selecthard

A company has two VPCs in the same project: vpc-a (10.0.0.0/8) and vpc-b (10.0.0.0/8). They plan to peer these VPCs using VPC Network Peering. Which two prerequisites are required for the peering to work? (Choose TWO.)

Select 2 answers
A.The VPCs must have non-overlapping IP CIDR ranges.
B.At least one VM must exist in each VPC before peering.
C.Firewall rules must allow traffic between the peered VPCs.
D.The project must have a Shared VPC host project configured.
E.Both VPCs must be in custom mode.
AnswersA, C

Overlapping IP ranges prevent VPC peering from working.

Why this answer

For VPC peering, the CIDR ranges must not overlap. Additionally, the 'export custom routes' and 'import custom routes' flags must be set correctly if custom routes are needed; but the basic requirement is no overlapping subnets. Also, VMs must have firewall rules allowing traffic.

Practice this question →
28
MCQmedium

Your company is deploying a multi-tier web application on Google Kubernetes Engine (GKE) with a regional cluster. You need to design network policies to allow traffic only from the frontend pods to the backend pods on port 8080. Which of the following is the most secure and recommended approach?

A.Define a Kubernetes NetworkPolicy that allows ingress to backend pods from frontend pods on port 8080.
B.Configure Private Service Connect to restrict access to backend pods.
C.Create VPC firewall rules to allow ingress from frontend pods to backend pods on port 8080.
D.Use Cloud Armor security policies to restrict traffic to backend pods.
AnswerA

NetworkPolicy is the native Kubernetes mechanism for pod-level traffic control.

Why this answer

A Kubernetes NetworkPolicy is the native and most secure way to control pod-to-pod traffic within a GKE cluster. By defining an ingress rule that allows traffic only from frontend pods (selected via pod labels) to backend pods on TCP port 8080, you enforce micro-segmentation at the pod level, which is the recommended practice for multi-tier applications. This approach works regardless of the underlying node or VPC configuration and is fully integrated with GKE's network policies engine (Calico or Cilium).

Exam trap

The trap here is that candidates often confuse VPC firewall rules (which control traffic at the node level) with Kubernetes NetworkPolicy (which controls traffic at the pod level), leading them to choose option C, even though pod IPs are ephemeral and not directly manageable via VPC firewall rules.

How to eliminate wrong answers

Option B is wrong because Private Service Connect is used to expose managed services privately to VPC networks, not to restrict pod-to-pod traffic within a cluster. Option C is wrong because VPC firewall rules operate at the node/VM level, not at the pod level, and cannot distinguish between individual pods running on the same node; they also cannot enforce label-based selection. Option D is wrong because Cloud Armor is a web application firewall (WAF) that protects external HTTP(S) load balancers, not internal pod-to-pod traffic within a GKE cluster.

Practice this question →
29
MCQmedium

An engineer is designing a hybrid network with a 10 Gbps Dedicated Interconnect. They require 99.99% availability for the connection. What is the minimum number of VLAN attachments and BGP sessions recommended?

A.2 VLAN attachments, 4 BGP sessions
B.2 VLAN attachments, 2 BGP sessions (one per attachment)
C.2 VLAN attachments, 1 BGP session
D.1 VLAN attachment, 1 BGP session
AnswerB

Two attachments on redundant links provide 99.99% availability.

Why this answer

To achieve 99.99% availability, you need at least 2 VLAN attachments (each on different physical links) and 2 BGP sessions. For higher SLAs, use 2 attachments and 4 BGP sessions.

Practice this question →
30
Multi-Selecthard

A company uses Shared VPC with a host project and multiple service projects. They want to grant a team in a service project the ability to create and manage firewall rules that apply to the shared VPC's subnets. Which THREE IAM roles or permissions are needed? (Choose three.)

Select 3 answers
A.compute.firewalls.create permission on the host project
B.compute.firewalls.delete permission on the service project
C.Compute Security Admin (roles/compute.securityAdmin) on the host project
D.compute.firewalls.update permission on the host project
E.Compute Network Admin (roles/compute.networkAdmin) on the service project
AnswersA, C, D

Explicit permission is needed to create firewall rules.

Why this answer

To manage firewall rules on a shared VPC, the user needs compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete permissions, which are included in the Compute Security Admin role (roles/compute.securityAdmin) at the host project level. Additional roles may be needed depending on organization policies.

Practice this question →
31
MCQeasy

A company is designing a VPC for a multi-tier application. The web tier must be accessible from the internet, the app tier only from the web tier, and the db tier only from the app tier. Which combination of firewall rules is appropriate?

A.Ingress allow from web to app, ingress allow from app to db, no rule for web
B.Ingress allow from 0.0.0.0/0 to web, ingress allow from web subnets to app, ingress allow from app subnets to db
C.Ingress allow from 0.0.0.0/0 to web, ingress allow from all subnets to app, ingress allow from app to db
D.Ingress allow from web to app, ingress allow from web to db, ingress allow from app to db
AnswerB

Correctly restricts access at each tier.

Why this answer

It follows the principle of least privilege for a multi-tier VPC. The web tier must be accessible from the internet (0.0.0.0/0) on ingress, the app tier must only accept ingress from the web tier subnets, and the db tier must only accept ingress from the app tier subnets. This ensures that each tier is isolated and only reachable from the immediate upstream tier, which is a fundamental security best practice for multi-tier architectures in Google Cloud.

Exam trap

The trap here is that candidates often confuse 'ingress allow from web to app' with 'ingress allow from web subnets to app', forgetting that firewall rules must specify source CIDR ranges (e.g., subnet IPs) rather than just the tier name, and they may also incorrectly allow direct web-to-db access, thinking it simplifies connectivity without realizing it breaks the isolation requirement.

How to eliminate wrong answers

Option A is wrong because it lacks an ingress rule allowing traffic from the internet (0.0.0.0/0) to the web tier, making the web tier inaccessible from the internet, which violates the requirement. Option C is wrong because it allows ingress from 'all subnets' to the app tier, which would permit traffic from the db tier or other subnets to the app tier, breaking the isolation requirement that the app tier should only be reachable from the web tier. Option D is wrong because it includes an ingress rule allowing traffic from the web tier directly to the db tier, which bypasses the app tier and violates the requirement that the db tier should only be accessible from the app tier.

Practice this question →
32
MCQmedium

A company is using VPC Network Peering between two VPCs. They want to ensure that routes for a specific subnet in VPC A are exported to VPC B. However, VPC B should not export its routes to VPC A. What peering configuration should they set?

A.On VPC A's peering, enable 'Export selected custom routes' and specify the subnet; on VPC B's peering, disable all route export/import
B.On VPC B's peering, enable 'Import custom routes'; on VPC A's peering, disable 'Export custom routes'
C.Enable VPC Network Peering with default settings
D.On VPC A's peering, enable 'Export custom routes'; on VPC B's peering, disable 'Import custom routes'
AnswerB

This option enables import on VPC B's peering, allowing B to accept routes, but disables export on VPC A's peering, so A does not export the subnet. It is the only option that enables import on B.

Why this answer

VPC Network Peering consists of two separate peering connections: one from VPC A to VPC B and another from VPC B to VPC A. To ensure VPC B receives the specific subnet from VPC A, the import setting on VPC B's peering must be enabled to accept routes. Option B enables 'Import custom routes' on VPC B's peering, allowing B to import routes if they are exported by A.

However, it disables 'Export custom routes' on VPC A's peering, which means A will not export its routes. Among the options, only B ensures import is enabled on B, which is necessary for receiving routes. The other options either disable import on B or do not allow selective export.

While B does not fully meet the requirement, it is the closest correct configuration based on the available choices.

Practice this question →
33
MCQhard

Refer to the exhibit. A VM in the default VPC with IP 10.0.0.5 is unable to receive traffic from another VM in the same VPC with IP 10.0.1.5. The firewall rule shown is in place. What is the most likely reason?

A.The source range does not include 10.0.1.5
B.The rule only allows TCP but the traffic is UDP
C.The target service account does not match the VM's service account
D.The priority is too low
AnswerC

The rule only applies to VMs with the specified service account.

Why this answer

The firewall rule shown uses a target service account, which means it applies only to VM instances that are associated with that specific service account. If the VM at 10.0.0.5 has a different service account (or no service account) than the one specified in the rule, the rule will not apply to it, and traffic will be blocked by the implicit deny-all egress/ingress firewall rules. This is the most likely reason the VM cannot receive traffic from 10.0.1.5.

Exam trap

Google Cloud often tests the distinction between target tags and target service accounts, and the trap here is that candidates assume a firewall rule with a broad source range (0.0.0.0/0) will apply to all VMs, overlooking that the target service account field restricts which VMs the rule actually applies to.

How to eliminate wrong answers

Option A is wrong because the source range in the rule is 0.0.0.0/0, which includes all IP addresses, including 10.0.1.5. Option B is wrong because the rule specifies 'tcp' as the protocol, but the exhibit does not indicate that the traffic is UDP; the question states the VM is unable to receive traffic, and if the traffic were UDP, the rule would not match, but the most likely reason given the target service account mismatch is more specific. Option D is wrong because the priority is 1000, which is the default priority; while a lower numerical value means higher priority, a priority of 1000 is not 'too low' to override the implicit deny rules, and the issue is not about priority but about the rule not being applied to the VM due to service account mismatch.

Practice this question →
34
MCQeasy

A company wants to connect their on-premises data center to Google Cloud using a site-to-site VPN with dynamic routing. Which protocol should they use for route exchange?

A.OSPF
B.Static routing
C.BGP
D.RIP
AnswerC

BGP is used for dynamic route exchange in Cloud VPN.

Why this answer

C is correct because Cloud VPN with dynamic routing requires BGP (Border Gateway Protocol) to exchange routes between the on-premises router and the Cloud Router. BGP is the only dynamic routing protocol supported by Google Cloud for site-to-site VPN tunnels, as it allows route advertisement, failover, and policy-based control over multiple tunnels.

Exam trap

The trap here is that candidates often assume OSPF or RIP are valid for dynamic routing in cloud VPNs because they are common in on-premises networks, but Google Cloud exclusively supports BGP for dynamic route exchange over site-to-site VPN tunnels.

How to eliminate wrong answers

Option A is wrong because OSPF is a link-state interior gateway protocol (IGP) that is not supported by Google Cloud VPN; Cloud VPN only supports BGP for dynamic route exchange. Option B is wrong because static routing does not provide dynamic route exchange; it requires manual configuration and cannot adapt to network changes or support failover across multiple tunnels. Option D is wrong because RIP is a distance-vector IGP that is not supported by Google Cloud VPN; it is outdated and lacks the scalability and policy control needed for cloud-to-on-premises connectivity.

Practice this question →
35
MCQmedium

An enterprise is planning a Dedicated Interconnect connection to GCP. They require 99.99% availability and expect to use multiple VLAN attachments. What is the minimum number of 10 Gbps links and VLAN attachments needed to meet the availability goal?

A.Two 10 Gbps links and one VLAN attachment
B.One 100 Gbps link and one VLAN attachment
C.Two 10 Gbps links and two VLAN attachments
D.One 10 Gbps link and one VLAN attachment
AnswerC

Two links in different edge availability domains with two VLAN attachments achieve 99.99% SLA.

Why this answer

To achieve 99.99% availability, Dedicated Interconnect requires at least two links (each 10 Gbps or 100 Gbps) in different edge availability domains, and at least two VLAN attachments.

Practice this question →
36
MCQmedium

An organization uses Classic VPN with static routing to connect to GCP. They now need to add a new subnet in GCP and ensure on-premises traffic can reach it without manual updates. What should they do?

A.Add a static route for the new subnet on the Classic VPN tunnel
B.Use Cloud Router with the Classic VPN
C.Create a new Classic VPN tunnel for the new subnet
D.Convert the Classic VPN to HA VPN with dynamic routing (BGP)
AnswerD

HA VPN with BGP automatically advertises new subnets to on-premises, eliminating manual updates.

Why this answer

Classic VPN supports policy-based routing with static routes. To handle new subnets automatically, they should migrate to HA VPN with dynamic routing (BGP), which advertises routes via BGP.

Practice this question →
37
MCQmedium

A company needs to connect on-premises to GCP using Dedicated Interconnect with a 10 Gbps link, and they require high availability. They plan to use a single VLAN attachment. What is the best design?

A.Deploy two interconnects with one VLAN attachment each.
B.Deploy one interconnect with one VLAN attachment and a VPN as backup.
C.Deploy one interconnect with one VLAN attachment and use static routing.
D.Deploy two VLAN attachments on the same interconnect with separate BGP sessions.
AnswerA

This provides physical diversity and HA.

Why this answer

For high availability with Dedicated Interconnect, you need two separate physical connections (interconnects) to avoid a single point of failure. Each interconnect must have its own VLAN attachment and BGP session to ensure that if one link fails, traffic can still flow over the other. A single VLAN attachment cannot provide redundancy because it is tied to one physical interconnect.

Exam trap

Google Cloud often tests the misconception that multiple VLAN attachments on the same physical interconnect provide high availability, but in reality, they share the same physical path and single point of failure.

How to eliminate wrong answers

Option B is wrong because using a VPN as backup introduces lower bandwidth and higher latency, and does not meet the requirement for high availability with a 10 Gbps link; the VPN would be a significant bottleneck. Option C is wrong because static routing lacks the automatic failover capabilities of BGP, and a single interconnect is still a single point of failure. Option D is wrong because deploying two VLAN attachments on the same interconnect does not provide physical redundancy; if the interconnect fails, both VLAN attachments go down.

Practice this question →
38
MCQmedium

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

A.Cloud VPN
B.VPC peering
C.Network Connectivity Center
D.Cloud Router
AnswerC

Correct. NCC provides hub-and-spoke connectivity.

Why this answer

Network Connectivity Center (NCC) uses a hub-and-spoke model to connect on-premises networks and VPCs.

Practice this question →
39
Multi-Selecthard

A company has multiple VPCs in different projects and wants to connect them all to a single on-premises data center using a hub-and-spoke model with Network Connectivity Center (NCC). Which THREE components are required for this setup?

Select 3 answers
A.NCC hub
B.Cloud NAT
C.Spokes (VPCs or on-prem networks)
D.Cloud Router
E.VPC peering between spokes
AnswersA, C, D

Correct. The hub is the central point of connectivity.

Why this answer

NCC requires a hub, spokes (VPC spokes or on-prem spokes via interconnect/VPN), and a Cloud Router for dynamic routing.

Practice this question →
40
MCQmedium

A company is deploying a multi-tier application on Google Cloud. The frontend tier runs in a managed instance group behind a global external HTTP(S) load balancer. The backend tier runs on Compute Engine instances in a different VPC subnet. The frontend instances must communicate with the backend instances using internal IP addresses only. Which configuration should the network engineer use?

A.Use Cloud NAT to allow the frontend to reach the backend via the internet.
B.Use an internal TCP/UDP load balancer in the backend VPC and configure the frontend to send traffic to the load balancer's internal IP.
C.Place both frontend and backend instances in the same VPC but different subnets, and use firewall rules to allow traffic.
D.Set up VPC Network Peering between the frontend VPC and the backend VPC.
AnswerD

VPC peering enables private IP communication across VPCs without requiring external IPs or gateways, meeting the requirement of internal-only communication.

Why this answer

VPC Network Peering allows two separate VPC networks to communicate using internal IP addresses without traversing the internet or requiring a VPN. Since the frontend and backend are in different VPCs (implied by the need for peering), peering enables direct internal IP connectivity between the frontend instances and the backend instances, satisfying the requirement for internal-only communication.

Exam trap

The trap here is that candidates may assume placing instances in the same VPC (Option C) is the simplest solution, but the question explicitly implies the frontend and backend are in separate VPCs, making VPC Network Peering the correct choice for internal IP communication across VPCs.

How to eliminate wrong answers

Option A is wrong because Cloud NAT is used to allow outbound internet access from instances without external IPs, not for internal communication between VPCs; it would force traffic over the internet, violating the internal IP requirement. Option B is wrong because an internal TCP/UDP load balancer is used to distribute traffic within the same VPC or across peered VPCs, but it does not establish connectivity between separate VPCs on its own; peering is still required for the frontend to reach the load balancer's internal IP. Option C is wrong because placing instances in the same VPC but different subnets would work for internal communication, but the question states the frontend and backend are in different VPCs (implied by the need for a solution), so this option does not apply to the given architecture.

Practice this question →
41
MCQmedium

An organization has multiple GCP projects that need to share a common network infrastructure. They want to centralize network administration in a single project while allowing service projects to create their own resources in shared subnets. Which networking approach should they use?

A.Multi-NIC instances in a single project
B.Shared VPC
C.VPC peering between all projects
D.Network Connectivity Center
AnswerB

Shared VPC enables a host project to share subnets with service projects, with centralized network administration.

Why this answer

Shared VPC allows a host project to share subnets with service projects, with IAM controls for centralized administration.

Practice this question →
42
MCQmedium

A company is planning a hybrid connectivity setup using HA VPN. They want to ensure high availability by using two Cloud VPN gateways. How many tunnels and external IP addresses are required for the HA VPN to achieve 99.99% SLA?

A.2 external IPs, 4 tunnels
B.4 external IPs, 4 tunnels
C.2 external IPs, 2 tunnels
D.1 external IP, 2 tunnels
AnswerA

Correct. Two gateways with two tunnels each.

Why this answer

HA VPN uses two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP to provide a 99.99% SLA.

Practice this question →
43
MCQmedium

Refer to the exhibit. What is the purpose of the --enable-private-ip-google-access flag?

A.Enables the subnet to be used for Cloud VPN tunnels.
B.Allows external traffic to reach VMs using private IPs.
C.Enables Cloud NAT on this subnet.
D.Allows VMs to access Google APIs without requiring an external IP.
AnswerD

Private Google Access enables this.

Why this answer

The `--enable-private-ip-google-access` flag, when set to `true` on a subnet, allows VM instances in that subnet to reach Google APIs and services (e.g., Cloud Storage, BigQuery) using their private IP addresses, without requiring an external (public) IP. This works by routing traffic through Google's internal network to the Google API frontend, bypassing the public internet.

Exam trap

Google Cloud often tests the misconception that this flag enables Cloud NAT or provides general internet access, when in fact it only provides access to Google APIs and services, not arbitrary public IPs.

How to eliminate wrong answers

Option A is wrong because Cloud VPN tunnels are configured on the VPC network level or via a Cloud Router, not enabled by a subnet-level flag; the flag does not affect VPN functionality. Option B is wrong because external traffic cannot reach VMs using private IPs without a mechanism like a load balancer or Cloud NAT; this flag controls outbound access from VMs to Google APIs, not inbound external access. Option C is wrong because Cloud NAT is a separate resource configured on a Cloud Router, not enabled by a subnet flag; this flag provides direct private access to Google APIs, not NAT-based internet access.

Practice this question →
44
Multi-Selecteasy

Which THREE components are part of a typical Cloud Hybrid Networking architecture?

Select 3 answers
A.VPC
B.Cloud Router
C.Cloud Interconnect
D.Cloud CDN
E.Cloud VPN
AnswersB, C, E

Manages BGP sessions for dynamic routing between on-prem and GCP.

Why this answer

Cloud Router is a core component of Cloud Hybrid Networking because it enables dynamic route exchange between a GCP VPC and an on-premises network using BGP. It works with Cloud VPN or Cloud Interconnect to automatically learn and propagate routes, eliminating the need for static route management.

Exam trap

Google Cloud often tests the misconception that a VPC itself is a hybrid networking component, but candidates must remember that hybrid connectivity requires dedicated services like Cloud VPN, Cloud Interconnect, or Cloud Router to bridge the VPC with external networks.

Practice this question →
45
MCQmedium

An organization wants to connect its on-premises data center to Google Cloud using Dedicated Interconnect. They require 99.99% availability SLA. Which configuration meets this requirement?

A.A single 10Gbps Dedicated Interconnect connection with one VLAN attachment and one BGP session
B.A single 100Gbps Dedicated Interconnect connection with two VLAN attachments and two BGP sessions
C.Two 10Gbps Dedicated Interconnect connections, each with its own VLAN attachment and BGP session, from the same provider
D.Two Partner Interconnect connections with 99.9% SLA each
AnswerC

Two redundant connections are required for 99.99% SLA.

Why this answer

Dedicated Interconnect offers 99.99% SLA when you have two separate physical connections (each 10Gbps or 100Gbps) from the same provider, each with its own VLAN attachment and BGP session, and they are configured in a redundant manner.

Practice this question →
46
MCQeasy

Which VPC type allows you to specify custom IP ranges and regions for subnets during creation, and does not automatically create subnets in every region?

A.Custom mode VPC
B.Auto mode VPC
C.Legacy Network
D.Shared VPC
AnswerA

Custom mode gives full control over subnet creation and IP ranges.

Why this answer

Custom mode VPCs let you define subnets manually. Auto mode creates a subnet per region automatically.

Practice this question →
47
MCQeasy

Which Google Cloud service allows you to create a hub-and-spoke topology for connecting on-premises networks and VPCs?

A.Cloud VPN
B.Network Connectivity Center
C.VPC Network Peering
D.Cloud Interconnect
AnswerB

NCC is designed for hub-and-spoke connectivity.

Why this answer

Network Connectivity Center (NCC) provides a hub-and-spoke model to interconnect on-premises networks and VPCs centrally.

Practice this question →
48
Multi-Selectmedium

A company needs to connect three VPC networks in separate projects (two in the same organization, one in a different organization) to each other for private IP communication. Which TWO GCP solutions should they consider? (Choose 2.)

Select 2 answers
A.Cloud Interconnect
B.VPC Network Peering hub-and-spoke topology
C.Shared VPC
D.VPC Network Peering
E.Cloud VPN with dynamic routing
AnswersD, E

VPC Network Peering directly connects two VPCs and supports cross-organization peering. A full mesh of peerings can connect all three VPCs, making it a valid solution.

Why this answer

Options D and E are correct for connecting three VPC networks in separate projects, including across organizations. VPC Network Peering (D) directly connects VPCs, allowing private IP communication, but it is non-transitive, so a full mesh of peerings is required for all three VPCs to communicate. Cloud VPN with dynamic routing (E) can also be used to create routed connections between VPCs via Cloud Routers, enabling private IP communication even across organizations, though it involves more overhead.

Option B (hub-and-spoke topology) is incorrect because VPC peering is non-transitive; spokes cannot communicate through the hub without additional routing, so a hub-and-spoke design alone does not enable full connectivity among all three VPCs. Shared VPC (C) is limited to projects within the same organization, and Cloud Interconnect (A) is designed for on-premises to VPC connections, not VPC-to-VPC.

Exam trap

Candidates often assume hub-and-spoke VPC peering allows all spokes to communicate, but peering is non-transitive. For three VPCs to talk, either a full mesh of peerings or a routed solution like Cloud VPN is needed.

Practice this question →
49
MCQhard

A company has a VPC with a subnet in us-central1 (10.0.0.0/16) and a Cloud VPN tunnel to an on-premises network (192.168.0.0/16). They also have a static route for 0.0.0.0/0 internet gateway. On-premises traffic to 10.0.0.0/16 is working. However, traffic from a GCE instance in the VPC to an on-premises IP 192.168.1.10 is timing out. What is the most likely cause?

A.Cloud NAT is not configured for the VPC
B.Missing a custom static route in the VPC for destination 192.168.0.0/16 with next hop VPN gateway
C.The VPN tunnel is down and BGP session is not established
D.Firewall rule does not allow inbound traffic from on-premises to the instance
AnswerB

Without this route, traffic is sent to the internet instead of the VPN.

Why this answer

The VPC has a default route (0.0.0.0/0) pointing to the internet gateway, but no specific route for the on-premises network (192.168.0.0/16). Without a custom static route with next hop set to the VPN gateway, traffic from the GCE instance to 192.168.1.10 will be forwarded to the internet gateway instead of the VPN tunnel, causing a timeout.

Exam trap

The trap here is that candidates assume a working VPN tunnel automatically routes traffic in both directions, but GCP requires explicit static routes for each destination network behind the VPN, even when the tunnel itself is up.

How to eliminate wrong answers

Option A is wrong because Cloud NAT is used to enable outbound internet access for private instances, not for routing traffic to on-premises networks over a VPN; the issue here is routing, not NAT. Option C is wrong because the question states that on-premises traffic to 10.0.0.0/16 is working, which confirms the VPN tunnel and BGP session are established and functional. Option D is wrong because the problem is traffic from the GCE instance to on-premises, not inbound traffic to the instance; firewall rules for inbound traffic would not affect outbound traffic initiated by the instance.

Practice this question →
50
MCQmedium

Your company has a VPC with two subnets: 10.0.1.0/24 in us-central1 and 10.0.2.0/24 in us-east1. They have a Cloud VPN tunnel to the on-premises data center using dynamic routing (BGP). The Cloud Router was created in the us-central1 region with default settings. On-premises hosts can successfully communicate with instances in the 10.0.1.0/24 subnet, but cannot reach instances in the 10.0.2.0/24 subnet. All instances have appropriate firewall rules allowing traffic from on-premises. The BGP session is established and routes from on-premises are received in Cloud Router. What is the most likely reason for the issue?

A.Cloud Router by default only advertises subnets in its own region.
B.The firewall rules in us-east1 are blocking incoming traffic from on-premises.
C.The BGP session is down for the us-east1 region.
D.The VPN tunnel is only configured to route traffic for us-central1.
AnswerA

Subnets outside the router's region are not advertised unless 'Advertise all subnets' is enabled.

Why this answer

Cloud Router with default settings only advertises subnets that are in the same region as the Cloud Router itself. Since the Cloud Router was created in us-central1, it only advertises the 10.0.1.0/24 subnet to the on-premises BGP peer. The 10.0.2.0/24 subnet in us-east1 is not advertised, so on-premises hosts have no route to it, even though the BGP session is up and firewall rules are correct.

Exam trap

The trap here is that candidates assume Cloud Router automatically advertises all VPC subnets, but the default regional mode restricts advertisements to the router's own region, which is a common misconfiguration in multi-region VPN designs.

How to eliminate wrong answers

Option B is wrong because the question explicitly states that appropriate firewall rules allow traffic from on-premises, so firewall blocking is not the issue. Option C is wrong because the BGP session is established and routes from on-premises are received, indicating the session is up; Cloud Router does not have per-region BGP sessions. Option D is wrong because the VPN tunnel is a single tunnel using dynamic routing (BGP), and the tunnel itself does not filter which subnets are advertised; the Cloud Router's advertisement settings control route propagation.

Practice this question →
51
MCQmedium

A network engineer is designing a VPC with custom subnet mode. They need to allocate IP addresses for three tiers: web (100 instances), app (200 instances), and db (50 instances). The VPC will be in the us-central1 region. Which subnet plan is most cost-effective and scalable?

A.Use one subnet per zone: us-central1-a: 10.0.0.0/22, us-central1-b: 10.0.4.0/22, us-central1-c: 10.0.8.0/22
B.Create two subnets: 10.0.1.0/24 (web+app) and 10.0.3.0/24 (db)
C.Create one subnet 10.0.0.0/20 and use network tags to isolate tiers via firewall rules
D.Create three subnets: 10.0.1.0/24 (web), 10.0.2.0/23 (app), 10.0.4.0/26 (db)
AnswerD

Adequate sizes, separate subnets provide security and flexibility.

Why this answer

It allocates IP addresses efficiently for each tier: a /24 (256 IPs) for web (100 instances), a /23 (512 IPs) for app (200 instances), and a /26 (64 IPs) for db (50 instances). This minimizes wasted IP space while providing room for growth, and using separate subnets per tier allows granular firewall rules and routing. In a custom VPC, this design is both cost-effective (no over-provisioning) and scalable (each tier can expand within its subnet).

Exam trap

Google Cloud often tests the misconception that larger subnets are always better for scalability, but the trap here is that over-provisioning IPs (e.g., /22 or /20) wastes address space and can lead to higher costs or management overhead, whereas right-sizing subnets per tier with room for growth is the most cost-effective and scalable approach.

How to eliminate wrong answers

Option A is wrong because using three /22 subnets (each with 1024 IPs) across three zones wastes significant IP address space for the given instance counts, and the question does not require zonal separation for tiers; this design is not cost-effective. Option B is wrong because combining web and app into a single /24 (256 IPs) cannot support 300 total instances (100 web + 200 app) without IP exhaustion, and the db /24 is also over-provisioned for 50 instances. Option C is wrong because a single /20 subnet (4096 IPs) is massively over-provisioned for only 350 instances, and while network tags can isolate traffic, they do not provide the subnet-level segmentation needed for scalable tier management; this design wastes IPs and is not cost-effective.

Practice this question →
52
MCQmedium

A company has a GKE cluster that needs to be accessed by pods and services. The cluster is deployed in a VPC with a primary subnet 10.0.0.0/16. To avoid IP exhaustion, they want to use separate IP ranges for pods and services. Which approach should they take?

A.Use a separate VPC for the GKE cluster with its own subnet.
B.Create secondary IP ranges on the subnet for pods and services.
C.Use the primary subnet range for pods and create a separate subnet for services.
D.Use alias IP ranges on the VM instances for pods and services.
AnswerB

Secondary ranges are the standard way to allocate IPs for GKE pods and services.

Why this answer

GKE supports secondary IP ranges for pods and services, which are defined on the subnet and allocated separately from the primary range.

Practice this question →
53
MCQmedium

A company uses Dedicated Interconnect to connect their on-premises data center to Google Cloud. They have enabled Private Google Access on the VPC subnet to allow on-premises hosts to access Google APIs via private IPs over the interconnect. Performance tests show that throughput to Google APIs is lower than expected, and the interconnect link utilization is below 30%. What should they do to improve throughput?

A.Reduce the MTU on the interconnect to reduce packet loss.
B.Add another Dedicated Interconnect attachment.
C.Create a Private Service Connect endpoint for Google APIs with multiple IP addresses.
D.Enable Cloud NAT to provide multiple public IPs.
AnswerC

This provides multiple IPs, avoiding per-IP limits and improving throughput.

Why this answer

Private Google Access (PGA) uses the default Internet Gateway to route traffic to Google APIs, which can lead to throughput limitations due to source NAT and flow hashing constraints. Creating a Private Service Connect (PSC) endpoint for Google APIs with multiple IP addresses allows traffic to be load-balanced across multiple endpoints, improving throughput by enabling ECMP (Equal-Cost Multi-Path) routing over the Dedicated Interconnect, thus better utilizing the available bandwidth.

Exam trap

The trap here is that candidates assume low interconnect utilization means the link is underutilized and needs more capacity (Option B), when the real issue is a lack of multipathing to the destination, which is solved by creating multiple endpoints via Private Service Connect.

How to eliminate wrong answers

Option A is wrong because reducing the MTU on the interconnect would increase overhead and potentially cause fragmentation, not improve throughput; packet loss is not indicated by low utilization. Option B is wrong because adding another interconnect attachment does not address the bottleneck at the Google API access layer; the issue is not link capacity but how traffic is routed and load-balanced to Google APIs. Option D is wrong because Cloud NAT provides outbound connectivity to the internet, not to Google APIs via private IPs, and would not improve throughput over the existing Private Google Access configuration.

Practice this question →
54
MCQhard

Refer to the exhibit. What is the purpose of the IP address 169.254.0.1 assigned to the Cloud Router interface?

A.It is the public IP address of the VPN gateway.
B.It is a private IP address for BGP peering with the on-premises router.
C.It is the management IP address of the Cloud Router.
D.It is a link-local IP address used for BGP sessions between the Cloud Router and the VPN gateway.
AnswerD

BGP uses link-local addresses (169.254.x.x) for peering.

Why this answer

The IP address 169.254.0.1 falls within the 169.254.0.0/16 range, which is reserved for link-local addressing (RFC 3927). In Google Cloud, Cloud Routers use link-local addresses for BGP sessions with VPN gateways (both HA VPN and Classic VPN). This address is not routable and is used exclusively for BGP peering between the Cloud Router and the VPN gateway, ensuring that the BGP session operates over the VPN tunnel without conflicting with other IP assignments.

Exam trap

Google Cloud often tests the distinction between link-local, private, and public IP addresses, and the trap here is that candidates see 'BGP peering' and assume a private IP is used, failing to recognize that GCP specifically uses link-local addresses from the 169.254.0.0/16 range for BGP sessions with VPN gateways.

How to eliminate wrong answers

Option A is wrong because 169.254.0.1 is not a public IP address; public IPs are globally routable and assigned by an ISP or cloud provider, whereas link-local addresses are non-routable and used only on a single link. Option B is wrong because 169.254.0.1 is not a private IP address (private ranges are 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); it is a link-local address, and while it is used for BGP peering, calling it 'private' is technically incorrect and misleading. Option C is wrong because the management IP address of a Cloud Router is not 169.254.0.1; Cloud Routers are managed via the Google Cloud API and console, and their management plane does not use link-local addressing.

Practice this question →
55
MCQhard

A company is connecting their on-premises network to GCP via Cloud Interconnect with VLAN attachments and BGP sessions. They want to prefer one attachment over the other for traffic to a specific prefix. Which BGP attribute should they use?

A.MED
B.AS path prepend
C.Weight
D.Local preference
AnswerA

Correct. MED influences inbound traffic selection.

Why this answer

Multi-Exit Discriminator (MED) is used to influence inbound traffic from a peer AS. Lower MED values are preferred.

Practice this question →
56
MCQmedium

A company is planning to migrate their on-premises application to Google Cloud. The application requires consistent high bandwidth and low latency to on-premises databases. They have a Dedicated Interconnect connection with a 10 Gbps link. To improve availability, they decide to add a second Interconnect connection. Which of the following is a best practice for configuring BGP sessions?

A.Configure two BGP sessions with the same ASN and MED values
B.Configure two BGP sessions, each on a separate connection, with different ASNs and MED values to influence path selection
C.Enable ECMP across the two connections with a single BGP session
D.Use a single BGP session across both connections
AnswerA

Correct. Using the same ASN and configuring MED values allows proper path selection and meets best practices for redundancy.

Why this answer

Using the same ASN for both BGP sessions is a best practice for Dedicated Interconnect redundancy. It ensures that the on-premises router treats both sessions as part of the same autonomous system, enabling consistent routing. MED (Multi-Exit Discriminator) values can then be used to influence path selection, allowing traffic engineering to prefer one connection over the other.

Option B is incorrect because using different ASNs is not recommended; it can cause suboptimal routing and complicates path selection. Options C and D are incorrect because each Interconnect connection requires its own BGP session; a single session across both connections is not supported, and ECMP with a single session is not possible.

Exam trap

A common trap is thinking that different ASNs should be used for redundancy, but Google Cloud recommends using the same ASN for both BGP sessions and differentiating path selection with MED values. Using different ASNs can lead to suboptimal routing and is not a best practice.

How to eliminate wrong answers

Option A is wrong because using the same ASN and MED values on both BGP sessions would cause the on-premises router to see them as equal-cost paths, potentially leading to suboptimal load balancing or failover behavior without the ability to influence path selection. Option C is wrong because ECMP across two connections with a single BGP session is not supported; each Dedicated Interconnect connection requires its own BGP session, and ECMP would require multiple sessions with equal route metrics. Option D is wrong because a single BGP session across both connections is not possible; BGP sessions are established per VLAN attachment or per connection, and a single session cannot span multiple physical links.

Practice this question →
57
MCQhard

An organization is planning a hybrid connectivity setup between their on-premises data center and GCP. They require a 99.99% SLA and want to use a single physical connection at 10 Gbps. Which connectivity option should they choose?

A.Dedicated Interconnect with a single 10 Gbps link and single VLAN attachment
B.Partner Interconnect with 10 Gbps link
C.HA VPN with two external IP addresses and four tunnels
D.Dedicated Interconnect with two 10 Gbps links (one active, one standby) and two VLAN attachments
AnswerC

Correct. HA VPN with two external IP addresses and four tunnels provides a 99.99% SLA. It uses a single logical connection over the internet and does not require physical circuits.

Why this answer

The customer requires a 99.99% SLA and wants to use a single physical connection at 10 Gbps. However, no physical connection option (Dedicated Interconnect or Partner Interconnect) can provide a 99.99% SLA with just one physical link—they require multiple links for redundancy. Therefore, the best option that meets the 99.99% SLA requirement without requiring multiple physical connections is HA VPN, which uses a logical VPN connection over the internet, not a physical one.

When configured with two external IP addresses and four tunnels, HA VPN achieves the 99.99% SLA. Thus, HA VPN is the only viable choice given the constraints.

Exam trap

The trap is assuming that a physical connection is necessary to achieve a 99.99% SLA. HA VPN can meet the same SLA with proper redundancy over the internet, and it uses a single logical connection type.

How to eliminate wrong answers

Option A is wrong because a single 10 Gbps link with a single VLAN attachment provides only a 99.9% SLA, not 99.99%, and lacks the required redundancy. Option B is wrong because Partner Interconnect does not offer a 99.99% SLA; its SLA is typically 99.9% and depends on the partner's infrastructure, not Google's direct physical connection. Option C is wrong because HA VPN with two external IP addresses and four tunnels provides a 99.99% SLA for VPN but uses the public internet, not a dedicated physical connection, and the question explicitly requires a single physical connection at 10 Gbps, which HA VPN does not provide.

Practice this question →
58
Multi-Selecteasy

Which TWO of the following are valid reasons to use a Shared VPC architecture?

Select 2 answers
A.To reduce latency by placing resources in the same region within a single VPC
B.To improve network connectivity between different organizational units without using VPN or peering
C.To prevent individual projects from creating their own VPCs and force them to use a common VPC
D.To allow a central network team to manage VPC resources while allowing application teams to deploy resources in separate projects
E.To reduce egress costs by having all resources in one VPC
AnswersC, D

Controls VPC creation via IAM.

Why this answer

A Shared VPC architecture allows an organization to enforce that individual projects cannot create their own VPCs; instead, they must use a common VPC that is centrally managed. This is achieved by designating a host project that contains the shared VPC network, and attaching service projects to it, which prevents the service projects from having their own independent VPC networks.

Exam trap

Google Cloud often tests the misconception that Shared VPC reduces latency or egress costs, when in fact its primary benefits are centralized network management and policy enforcement, not performance or cost optimization.

Practice this question →
59
MCQmedium

An engineer is planning IP address ranges for two VPCs that will be connected via VPC peering. One VPC uses 10.1.0.0/16 and the other uses 10.2.0.0/16. They also plan to use HA VPN to an on-premises network using 10.0.0.0/8. Which IP range assignment could cause a conflict?

A.Conflict between the two VPCs (10.1.0.0/16 and 10.2.0.0/16)
B.Conflict between VPC1 (10.1.0.0/16) and on-premises (10.0.0.0/8)
C.No conflict; all ranges are non-overlapping
D.Conflict between on-premises (10.0.0.0/8) and both VPCs
AnswerD

10.0.0.0/8 encompasses both 10.1.0.0/16 and 10.2.0.0/16, causing overlap.

Why this answer

The on-premises range 10.0.0.0/8 overlaps with both VPC ranges; VPC peering and VPN both require non-overlapping ranges.

Practice this question →
60
Multi-Selectmedium

Which THREE components are required to set up a Cloud VPN with dynamic routing (BGP) between an on-premises network and Google Cloud?

Select 3 answers
A.Cloud VPN gateway
B.Cloud Router
C.Cloud NAT
D.BGP peer on the on-premises router
E.Static routes for the remote network
AnswersA, B, D

The VPN gateway terminates the VPN tunnel on the Google Cloud side.

Why this answer

A Cloud VPN gateway is required because it acts as the Google Cloud-side endpoint for the VPN tunnel, handling the encryption and encapsulation of traffic. Without a VPN gateway, there is no secure tunnel termination point in GCP, making it impossible to establish the VPN connection.

Exam trap

The trap here is that candidates often confuse Cloud NAT as a required component for VPN connectivity, but Cloud NAT is unrelated to VPN tunnel establishment or BGP routing.

Practice this question →
61
MCQhard

You are configuring an HA VPN tunnel between GCP and on-premises. The on-premises VPN device only supports IKEv1 and static routing. Which of the following is true regarding this setup?

A.Partner Interconnect can be used instead
B.Classic VPN must be used
C.HA VPN can be used with static routing if you disable BGP
D.HA VPN can be configured with IKEv1 and static routes
AnswerB

Classic VPN supports IKEv1 and static routing.

Why this answer

HA VPN requires IKEv2 and dynamic routing (BGP). Classic VPN supports IKEv1 and static routing.

Practice this question →
62
MCQeasy

A startup wants to minimize costs for their development VPC. They have a few VMs that need occasional internet access for updates. What is the most cost-effective approach?

A.Use Private Google Access
B.Use Cloud NAT with a static IP
C.Use a VPN to an on-prem network for internet
D.Assign external IPs to each VM
AnswerB

Cloud NAT allows private VMs to access the internet using one or more static IPs, minimizing costs.

Why this answer

Cloud NAT with a static IP is the most cost-effective approach because it allows multiple VMs to share a single static IP address for outbound internet access, eliminating the need for individual external IPs. This reduces costs since external IP addresses incur charges, and Cloud NAT provides managed, scalable outbound connectivity without requiring a VPN or dedicated gateway.

Exam trap

Google Cloud often tests the misconception that Private Google Access (option A) provides general internet access, but it only covers Google APIs and services, not arbitrary internet destinations like update servers.

How to eliminate wrong answers

Option A is wrong because Private Google Access only enables VMs without external IPs to reach Google APIs and services, not the general internet for updates. Option C is wrong because using a VPN to an on-prem network for internet access introduces additional latency, complexity, and costs (VPN gateway, traffic egress) without benefit if the on-prem network is not already used. Option D is wrong because assigning external IPs to each VM incurs per-IP charges and increases the attack surface, making it less cost-effective than a shared NAT solution.

Practice this question →
63
MCQhard

A company uses Cloud DNS private zones for their internal network. They have multiple projects and want to resolve DNS names from one project's private zone in another project. Which feature should they use?

A.DNS peering
B.DNS forwarding
C.Shared VPC
D.VPC peering
AnswerA

Correct. DNS peering allows one project's private zone to be visible to another project's VPC.

Why this answer

DNS peering allows you to set up cross-project DNS resolution by peering a private zone in one project to a VPC in another project.

Practice this question →
64
MCQmedium

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth up to 10 Gbps. Which connectivity option should they choose?

A.VPN with Cloud Router
B.Direct Peering
C.Dedicated Interconnect with a single connection
D.Partner Interconnect with redundant connections
AnswerD

Partner Interconnect supports up to 10 Gbps and can be deployed with redundant connections for high availability.

Why this answer

The requirement for high availability (redundancy) and bandwidth up to 10 Gbps is best met by Partner Interconnect with redundant connections. Partner Interconnect supports bandwidths from 50 Mbps to 10 Gbps and allows you to connect through a supported service provider, while redundant connections ensure failover and meet the high-availability requirement. Dedicated Interconnect offers up to 10 Gbps per circuit but requires two separate connections for high availability, not a single connection.

Exam trap

The trap here is that candidates often confuse 'Dedicated Interconnect with a single connection' as sufficient for high availability, but a single physical circuit is a single point of failure. High availability requires at least two redundant connections, which is explicitly supported by Partner Interconnect with redundant connections as the correct choice.

How to eliminate wrong answers

Option A is wrong because VPN with Cloud Router typically provides up to ~3 Gbps per tunnel (with IPsec overhead) and does not guarantee 10 Gbps bandwidth, nor does it offer the same latency or reliability as a dedicated physical connection. Option B is wrong because Direct Peering is a direct connection between your on-premises network and Google at an edge exchange location, but it does not offer SLA-backed bandwidth or support for 10 Gbps; it is intended for exchanging traffic with Google services, not for dedicated hybrid connectivity. Option C is wrong because Dedicated Interconnect with a single connection provides up to 10 Gbps per circuit, but a single connection is a single point of failure and does not meet the high-availability requirement; Google recommends at least two redundant connections for HA.

Practice this question →
65
MCQhard

An engineer is troubleshooting a VPC Network Peering connection between two VPCs. The peering is established, but traffic from VPC A to VPC B is not reaching a specific subnet. Both VPCs have custom routes. What is the most likely cause?

A.The subnet has overlapping IP with VPC A
B.The subnet in VPC B is in a different region
C.Export custom routes is not enabled on the VPC A side
D.Export custom routes is not enabled on the VPC B side
AnswerD

VPC B must export custom routes to VPC A for VPC A to see the subnet route.

Why this answer

A common issue is that the subnet's custom routes are not exported. VPC peering allows exporting custom routes, but this must be explicitly enabled. If not, only system-generated routes (subnet routes) are exchanged.

Practice this question →
66
Multi-Selectmedium

A company wants to resolve DNS queries from their on-premises network for a privately hosted zone in Google Cloud (e.g., example.internal). They also want on-premises DNS servers to resolve GCP internal VM hostnames. Which two Cloud DNS features should they implement? (Choose TWO.)

Select 2 answers
A.Public zone delegation
B.DNS peering
C.DNS forwarding (outbound)
D.Split-horizon DNS
E.DNS forwarding (inbound)
AnswersB, E

DNS peering allows DNS resolution across networks, including on-prem to GCP private zones.

Why this answer

DNS peering allows on-premises to query GCP private zones, and DNS forwarding (inbound) allows GCP to forward queries to on-premises DNS servers.

Practice this question →
67
MCQhard

An organization is migrating a legacy application to GCP. The application requires static routing and does not support BGP. Which VPN option should they use?

A.Classic VPN
B.Dedicated Interconnect
C.Partner Interconnect
D.HA VPN
AnswerA

Classic VPN supports static routing without BGP.

Why this answer

Classic VPN supports static routing (policy-based or route-based) without BGP. Cloud VPN (HA VPN) and Partner Interconnect require BGP, and Dedicated Interconnect uses BGP for VLAN attachments.

Practice this question →
68
MCQhard

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

A.BGP keepalive timers are set too low, causing session flapping.
B.The MTU is mismatched between the tunnels.
C.The on-premises router is not receiving the VPC routes via BGP.
D.Traffic is taking one tunnel for outbound and the other for return, causing stateful firewall to drop packets.
AnswerD

Asymmetric paths break stateful firewalls that expect return traffic on same interface.

Why this answer

The most likely cause is asymmetric routing, where outbound traffic from GCP to on-premises takes one VPN tunnel while return traffic takes the other. Stateful firewalls track connection state based on the first packet seen; if return packets arrive via a different tunnel (and thus a different source IP or interface), the firewall does not recognize them as part of an existing session and drops them. This is a classic symptom of asymmetric routing with multiple BGP sessions over separate tunnels.

Exam trap

The trap here is that candidates often confuse asymmetric routing with route propagation failures or MTU issues, but the key clue is 'stateful firewall inspection' dropping traffic, which directly points to a session state mismatch caused by different paths for forward and return traffic.

How to eliminate wrong answers

Option A is wrong because BGP keepalive timers set too low would cause session flapping, not asymmetric routing; flapping would result in intermittent connectivity, not a consistent one-way drop. Option B is wrong because MTU mismatch typically causes fragmentation issues or packet loss, not stateful firewall drops due to asymmetric paths; it would manifest as connectivity failures for large packets, not a directional traffic drop. Option C is wrong because if the on-premises router were not receiving VPC routes via BGP, traffic from on-premises to GCP would fail entirely, not just be dropped by the firewall on return; the question states traffic is dropped by firewall inspection, implying routes are present.

Practice this question →
69
MCQeasy

A company needs to connect multiple VPCs in different projects and regions to a common hub VPC for centralized inspection. They want to avoid complex mesh peering configurations. Which service should they use?

A.VPC Network Peering
B.Shared VPC
C.Network Connectivity Center
D.Cloud VPN
AnswerC

NCC enables hub-and-spoke topology for VPCs and on-prem.

Why this answer

Network Connectivity Center (NCC) is the correct choice because it provides a hub-and-spoke topology that connects multiple VPCs across projects and regions to a central hub VPC for centralized inspection, without requiring complex mesh peering. NCC uses a software-defined networking (SDN) controller to manage inter-VPC connectivity and routing, enabling traffic to flow through the hub VPC for inspection appliances like firewalls or IDS/IPS.

Exam trap

Candidates often confuse VPC Network Peering with hub-and-spoke capabilities, but Google Cloud VPC Network Peering does not natively support transitive routing or centralized inspection without complex custom routes and additional appliances.

How to eliminate wrong answers

Option A is wrong because VPC Network Peering creates direct, point-to-point connections between VPCs, requiring a full mesh of peering links for multiple VPCs, which does not support centralized inspection through a single hub without additional routing complexity. Option B is wrong because Shared VPC allows multiple projects to share a single VPC network, but it does not connect VPCs in different regions or projects to a separate hub VPC; it centralizes resources within one VPC, not inter-VPC inspection. Option D is wrong because Cloud VPN establishes encrypted tunnels over the internet for hybrid connectivity (on-premises to GCP), not for connecting multiple VPCs within GCP, and it lacks the centralized routing and inspection capabilities of NCC.

Practice this question →
70
MCQmedium

A company has a VPC with subnets in us-east1 and europe-west1. They need low-latency communication between instances in these regions using private IPs only. Which solution should they use?

A.Use Cloud VPN to connect the regions.
B.Use Cloud Interconnect to connect the regions.
C.Use VPC Network Peering between the two regional subnets.
D.Use a Global VPC (default VPC mode).
AnswerD

Global VPC provides automatic cross-region routing.

Why this answer

A Global VPC (default VPC mode) allows subnets in multiple regions to communicate using private IPs natively, without any additional VPN or peering configuration. This is because a Global VPC spans all regions, and instances within the same VPC can reach each other via internal IPs using Google's global network, providing low-latency communication.

Exam trap

The trap here is that candidates often confuse VPC Network Peering (which connects separate VPCs) with the native inter-region communication within a single Global VPC, leading them to select option C instead of recognizing that a Global VPC already provides private IP connectivity across regions.

How to eliminate wrong answers

Option A is wrong because Cloud VPN creates encrypted tunnels over the public internet, which adds latency and does not use private IPs natively; it is designed for hybrid connectivity, not for inter-region VPC communication. Option B is wrong because Cloud Interconnect provides dedicated on-premises to GCP connectivity, not connectivity between GCP regions; it is used for hybrid cloud, not for VPC-to-VPC within GCP. Option C is wrong because VPC Network Peering connects two separate VPCs, not subnets within the same VPC; it requires explicit peering setup and does not apply to subnets in the same VPC, which already communicate via the global VPC.

Practice this question →
71
MCQeasy

Based on the exhibit, what is the purpose of Cloud Router's BGP configuration?

A.To advertise the VPC's IP range to the on-premises network.
B.To load balance traffic across multiple VPN tunnels.
C.To receive a default route from the on-premises network.
D.To advertise a default route to the on-premises network.
AnswerA

Cloud Router advertises 10.0.0.0/16 to on-premises.

Why this answer

Cloud Router uses BGP to dynamically exchange routes between a VPC network and an on-premises network over a VPN tunnel or Dedicated Interconnect. In this configuration, the purpose is to advertise the VPC's IP range (the custom or auto-mode subnet CIDR) to the on-premises router, enabling on-premises hosts to route traffic back to the VPC. This is achieved by configuring the Cloud Router with a BGP session and setting the advertised route for the VPC's IP range.

Exam trap

Google Cloud often tests the misconception that Cloud Router's primary function is to load balance traffic or receive default routes, but the core purpose is to dynamically advertise and learn specific IP prefixes via BGP for hybrid connectivity.

How to eliminate wrong answers

Option B is wrong because Cloud Router does not perform load balancing across VPN tunnels; load balancing is handled by Cloud VPN with dynamic routing, which uses multiple tunnels and BGP to distribute traffic, but the Cloud Router itself only manages BGP sessions and route advertisements. Option C is wrong because Cloud Router can be configured to receive custom routes from the on-premises network, but receiving a default route is not the purpose shown in the exhibit; the exhibit focuses on advertising the VPC's IP range, not receiving routes. Option D is wrong because while Cloud Router can advertise a default route (0.0.0.0/0) to the on-premises network if explicitly configured, the exhibit's purpose is to advertise the VPC's specific IP range, not a default route.

Practice this question →
72
MCQmedium

An organization is designing IP address planning for hybrid connectivity. They have three VPCs (Prod, Dev, Test) that will be peered with each other and also connected to an on-premises network via Cloud VPN. Which practice should they follow to avoid IP address overlap?

A.Use overlapping IP ranges but rely on NAT to resolve conflicts
B.Use carrier-grade NAT (CGNAT) ranges for all VPCs to avoid private IP conflicts
C.Use the same /16 range for all VPCs to simplify route summarization
D.Allocate unique, non-overlapping IP ranges for each VPC and on-premises network
AnswerD

Unique ranges prevent overlap and ensure proper routing across hybrid connections.

Why this answer

To avoid routing conflicts, each VPC and the on-premises network should use unique, non-overlapping RFC 1918 CIDR blocks. Overlap would cause routing issues and potential traffic blackholing.

Practice this question →
73
MCQeasy

A network engineer needs to design a VPC network for a global application that will have Compute Engine instances in multiple regions. The instances need to communicate with each other using internal IP addresses. What is the simplest way to enable this communication?

A.Use Dedicated Interconnect to connect regions.
B.Use Cloud VPN to connect the instances.
C.Create a single VPC network with subnets in each region.
D.Create separate VPC networks per region and peer them.
AnswerC

A global VPC network inherently provides internal connectivity across regions.

Why this answer

A single VPC network is global and can contain subnets in any region. By placing subnets in each required region within the same VPC, instances can communicate using internal IP addresses (RFC 1918) without any additional connectivity services. This is the simplest and most scalable approach because VPCs inherently provide global routing between subnets.

Exam trap

The trap here is that candidates may overcomplicate the solution by thinking inter-region communication requires explicit connectivity services like VPN or peering, when in fact a single global VPC network provides this natively.

How to eliminate wrong answers

Option A is wrong because Dedicated Interconnect is a hybrid connectivity service for connecting on-premises networks to GCP, not for enabling inter-region communication within GCP. Option B is wrong because Cloud VPN is also a hybrid connectivity solution for connecting external networks to GCP; using it to connect instances within the same cloud would add unnecessary complexity and latency. Option D is wrong because peering separate VPC networks per region would require explicit peering configurations and does not provide the automatic, global routing that a single VPC offers, making it more complex and less efficient.

Practice this question →
74
MCQeasy

A company wants to connect two VPCs in different GCP projects so that they can exchange traffic using internal IP addresses. They do not need centralized management or transitive routing between the VPCs. Which GCP networking feature should they use?

A.Network Connectivity Center
B.Cloud VPN
C.Shared VPC
D.VPC Network Peering
AnswerD

VPC Network Peering directly connects two VPCs using internal IPs without transitive routing.

Why this answer

VPC Network Peering allows direct connectivity between two VPCs using internal IPs, with no transitive routing. It is a simple, decentralized option for connecting two VPCs.

Practice this question →
75
Multi-Selectmedium

An organization needs to connect three GCP VPCs (VPC-A, VPC-B, VPC-C) so that all VPCs can communicate with each other. They want a solution that is transitive and does not require full mesh peering. Which TWO approaches meet these requirements?

Select 2 answers
A.Use Cloud VPN with HA VPN to connect all VPCs
B.Use Network Connectivity Center with all VPCs as spokes
C.Use a single shared VPC with subnets for all three networks
D.Establish VPC peering between each pair of VPCs (full mesh)
E.Deploy a VPN appliance in one VPC and create VPN tunnels to the other two VPCs
AnswersB, E

NCC hub-and-spoke provides transitive connectivity between spokes.

Why this answer

Network Connectivity Center hub-and-spoke and a VPN appliance in a shared VPC can provide transitive routing. VPC peering is non-transitive and would require full mesh.

Practice this question →
Page 1 of 3 · 222 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Pcne Designing Network questions.

Start 20-question session