Troubleshooting practice questions

Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?

Trap 1: Disable VPC Flow Logs to reduce cost.

VPC Flow Logs are valuable for security analysis.

Trap 2: Use a single subnet for all tiers to simplify IP management.

This combines all traffic and reduces security.

Trap 3: Rely on the default priority of firewall rules to ensure proper…

Always set explicit priorities to avoid unintended effects.

A
Disable VPC Flow Logs to reduce cost.
Why wrong: VPC Flow Logs are valuable for security analysis.
B
Create separate subnets for each application tier.
Subnets allow segmentation and granular firewall rules.
C
Use firewall rules to restrict traffic between tiers to only necessary ports.
Minimize attack surface by allowing only required communication.
D
Use a single subnet for all tiers to simplify IP management.
Why wrong: This combines all traffic and reduces security.
E
Rely on the default priority of firewall rules to ensure proper ordering.
Why wrong: Always set explicit priorities to avoid unintended effects.

Question 2easymultiple choice

An application running on Compute Engine instances behind a load balancer experiences intermittent failures. Health checks show instances passing, but some users get errors. What should be the first troubleshooting step?

Trap 1: Increase instance size.

Not a targeted fix for logic errors.

Trap 2: Enable HTTP health checks.

Health checks already pass, so this is redundant.

Trap 3: Check the load balancer's backend service configuration for session…

Session affinity doesn't cause intermittent failures.

A
Increase instance size.
Why wrong: Not a targeted fix for logic errors.
B
Review the application logs for errors.
Logs reveal application-level errors.
C
Enable HTTP health checks.
Why wrong: Health checks already pass, so this is redundant.
D
Check the load balancer's backend service configuration for session affinity.
Why wrong: Session affinity doesn't cause intermittent failures.

Question 3mediummulti select

An organization wants to monitor network traffic between VMs in a VPC for troubleshooting. Which TWO services can provide this?

Trap 1: Cloud Audit Logs

Records admin activity, not network traffic.

Trap 2: Cloud Monitoring

Provides metrics, not traffic details.

Trap 3: Cloud Logging

Stores logs, but not the generation service.

A
Cloud Audit Logs
Why wrong: Records admin activity, not network traffic.
B
Packet Mirroring (Network Intelligence Center)
Provides deep packet inspection.
C
VPC Flow Logs
Captures network traffic metadata.
D
Cloud Monitoring
Why wrong: Provides metrics, not traffic details.
E
Cloud Logging
Why wrong: Stores logs, but not the generation service.

Read the full NAT/PAT explanation →

Question 4hardmultiple choice

A company uses Cloud NAT to allow private instances to access the internet. They notice intermittent connectivity issues. What should they check first?

Trap 1: Cloud NAT router has a configured IP address range.

IP ranges are needed but not the most common cause.

Trap 2: Cloud NAT gateway is in the same region as the instances.

Region mismatch can cause issues, but not the most likely first check.

Trap 3: The VPC subnet has private Google access enabled.

Private Google Access is for Google APIs, not general internet.

A
Cloud NAT gateway has at least one NAT IP address configured.
Without NAT IPs, traffic cannot be translated, causing intermittent failures.
B
Cloud NAT router has a configured IP address range.
Why wrong: IP ranges are needed but not the most common cause.
C
Cloud NAT gateway is in the same region as the instances.
Why wrong: Region mismatch can cause issues, but not the most likely first check.
D
The VPC subnet has private Google access enabled.
Why wrong: Private Google Access is for Google APIs, not general internet.
E
The instances have external IP addresses assigned.
Why wrong: If instances have external IPs, NAT is not needed.

Question 5hardmultiple choice

A company runs a critical web application behind an external HTTPS load balancer. The backend consists of a managed instance group of Compute Engine instances. Users report intermittent 502 Bad Gateway errors. The load balancer logs show occasional health check failures for some instances. The instances have a custom health check endpoint that returns a 200 status code only if the application is fully healthy. The application logs do not show any errors, and CPU/memory usage on the instances is normal. What should be the first troubleshooting step to identify the root cause?

Trap 1: Change the health check to a TCP check on the application's port

TCP check does not verify application health; would not catch issues.

Trap 2: Increase the health check check interval and decrease the unhealthy…

This only masks the problem, not solves it.

Trap 3: Increase the number of instances in the managed instance group

Does not address why health check fails.

A
Change the health check to a TCP check on the application's port
Why wrong: TCP check does not verify application health; would not catch issues.
B
Increase the health check check interval and decrease the unhealthy threshold
Why wrong: This only masks the problem, not solves it.
C
Increase the number of instances in the managed instance group
Why wrong: Does not address why health check fails.
D
Check the application's logs on the instances to see why the health check endpoint sometimes returns non-200
This directly investigates the health check failure.