79 free Google Professional Cloud Network Engineer practice questions from the CertStash pack of 316, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 79 free here, all 316 in the pack, and each step includes the one before it.
Get all 316 questions (US$39) · Download the first 10 as a PDF
Question 1
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services. Which session affinity should you choose?
Show answer and explanation
Correct answer: B. Client IP
When clients need to connect to the same backend instance across multiple protocols (HTTP and TFTP), Client IP affinity ensures that all connections from a given client IP address are directed to the same instance regardless of protocol. This satisfies the requirement for sticky sessions across both services without being overly restrictive like the protocol-aware options.
Why the other options are wrong
- A. None affinity would not ensure clients stick to the same instance, defeating the stated requirement.
- C. Client IP and protocol affinity would route the same client's HTTP and TFTP traffic to different instances since they use different protocols, violating the requirement.
- D. Client IP, port and protocol affinity is even more granular and would similarly fail to maintain stickiness across protocols.
Question 2
You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic. What should you do?
Show answer and explanation
Correct answer: D. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.
The implied deny ingress rule cannot be logged, which is why no blocked traffic appears. Creating an explicit deny-all rule at priority 65500 with logging turned on catches the same traffic just above the implied rule and records each denied connection.
Why the other options are wrong
- A. VPC Flow Logs record sampled flows for the instance, not firewall deny decisions, so they do not show which traffic the firewall blocked.
- B. SSH would be blocked by the same implied deny rule and connecting would not produce any firewall logs.
- C. Allowing port 22 logs permitted SSH traffic, not the blocked traffic you want to see.
Question 3
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary. Which level of permissions should you request?
Show answer and explanation
Correct answer: A. Security Admin privileges from the Shared VPC Admin.
To modify firewall rules in a Shared VPC, Security Admin role is required at the host project level. This is the least privileged role that grants the ability to manage firewall rules while remaining more restrictive than Shared VPC Admin or Organization Admin roles.
Why the other options are wrong
- B. Service Project Admin permissions do not grant firewall rule modification capabilities in the host project.
- C. Shared VPC Admin is a higher privilege level than necessary; Security Admin is the least privilege role needed.
- D. Organization Admin is the highest privilege level and violates the principle of least privilege.
Question 4
You want to create a service in GCP using IPv6. What should you do?
Show answer and explanation
Correct answer: C. Configure a global load balancer with the designated IPv6 address.
GCP's IPv6 support is available through global load balancers (HTTP(S) and SSL/TCP Proxy load balancers). These load balancers can accept IPv6 traffic from clients and distribute it to IPv4 backend instances. This is the supported method for using IPv6 in GCP services.
Why the other options are wrong
- A. Compute Engine instances in GCP do not support direct IPv6 address assignment.
- B. TCP Proxy load balancers (when not global) do not support IPv6 in GCP; only global load balancers have IPv6 support.
- D. Internal load balancers do not support IPv6 in GCP.
Question 5
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: D. • Create a Cloud VPN instance. • Create a route-based VPN tunnel. • Configure the appropriate local and remote traffic selectors to 0.0.0.0/0. • Configure the appropriate static routes.
For non-BGP devices, Google recommends route-based VPN tunnels over policy-based tunnels for scalability. Route-based tunnels require fewer configuration changes when networks grow. Setting traffic selectors to 0.0.0.0/0 on a route-based tunnel follows Google's recommended approach for simplicity and future-proofing, allowing static routes to control the actual traffic flow without needing per-subnet tunnel configurations.
Why the other options are wrong
- A. Policy-based tunnels require creating one tunnel per subnet, which increases operational overhead as the network grows.
- B. Policy-based tunnels are not recommended for non-BGP devices when scalability is a concern; a single policy-based tunnel still requires manual traffic selector configuration per subnet.
- C. While route-based is correct, setting traffic selectors to specific local/remote networks rather than 0.0.0.0/0 doesn't follow Google's recommended practice for simplified route-based configurations.
Question 6
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments. • Each organization has enabled full connectivity between all of its projects by using Shared VPC. • Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic. • There are no prefix overlaps between the two organizations. • Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space. • Neither organization has Interconnects to their on-premises environment. You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime. Which two steps should you take? (Choose two.)
Show answer and explanation
Correct answer: B, C. Set up some variant of DNS forwarding and zone transfers in each organization; Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
The fastest integration with minimal downtime uses Cloud VPN with Cloud Router to connect the two VPCs across organizations (option C), avoiding the delay of Interconnect provisioning. DNS forwarding and zone transfers (option B) enable the custom DNS solutions to work across both organizations while maintaining their separate domains until the full transition. Together, these provide network and DNS connectivity quickly without requiring shared VPC restructuring.
Why the other options are wrong
- A. Cloud Interconnect requires physical provisioning which takes weeks, not the fastest approach.
- D. Creating A records in Cloud DNS bypasses their custom DNS solution and doesn't integrate their existing infrastructure.
- E. Creating a third organization requires complex migration of all projects and doesn't honor the one-year transition timeline.
Question 7
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired. During troubleshooting you find: • Each on-premises router is configured with a unique ASN. • Each on-premises router is configured with the same routes and priorities. • Both on-premises routers are configured with a VPN connected to a single Cloud Router. • BGP sessions are established between both on-premises routers and the Cloud Router. • Only 1 of the on-premises router's routes are being added to the routing table. What is the most likely cause of this problem?
Show answer and explanation
Correct answer: D. The ASNs being used on the on-premises routers are different.
Cloud Router uses BGP ASN for route deduplication and propagation. When two on-premises routers have different ASNs and advertise the same routes with the same priority to Cloud Router, the router may only accept and propagate routes from one ASN, blocking the second router's routes from being added to the routing table. This is a BGP behavior where the ASN difference prevents proper ECMP load balancing.
Why the other options are wrong
- A. Same routes with the same priority should load-balance if properly configured; this is the normal expectation.
- B. A firewall blocking the second VPN would cause complete connectivity loss, not selective route acceptance.
- C. The issue is at the routing protocol level, not the application load balancer level; routes aren't being shared as expected.
Question 8
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOACFA) to your cross-connect provider to complete the physical connection. Which two actions can accomplish this? (Choose two.)
Show answer and explanation
Correct answer: B, D. Download the LOACFA from the Hybrid Connectivity section of the GCP Console; Check the email for the account of the NOC contact that you specified during the ordering process.
The LOACFA can be obtained by downloading it from the Hybrid Connectivity section of the GCP Console (option B). Additionally, Google sends the LOA/CFA via email to the NOC contact specified during the ordering process, so checking that email account provides another direct method (option D) to retrieve the document needed for the cross-connect provider.
Why the other options are wrong
- A. Opening a support ticket is not the primary method for obtaining the LOA/CFA; it's available directly in the console.
- C. The gcloud command for describing interconnects provides details about the interconnect but not the LOA/CFA document itself.
- E. Google does not automatically send the LOA/CFA to the cross-connect provider; you must provide it to them directly.
Question 9
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect. What should you do?
Show answer and explanation
Correct answer: C. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
Firewall rules with target tags are the standard Google Cloud mechanism for restricting access to backend instances. You create a firewall rule that targets instances tagged 'application' and allows traffic only from the specified source IP ranges (allowed clients and Google health check IPs). This provides direct network-level access control without the complexity of VPC Service Controls, which are designed for enforcing organizational policies rather than simple IP-based restrictions.
Why the other options are wrong
- A. VPC Service Controls creates a security perimeter for organizational policy enforcement, not for simple IP-based load balancer access control.
- B. VPC Service Controls do not work by marking load balancers as restricted services; they operate at the service perimeter level for organization-wide policies.
- D. Labels are not used for firewall rule targeting; Google Cloud uses tags for this purpose.
Question 10
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency. How should you design this topology?
Show answer and explanation
Correct answer: D. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
Creating a single VPC with regional subnets in us-east1 and europe-west1 allows workloads to communicate using private RFC1918 IP addresses. This approach minimizes costs by avoiding external IP address charges, reduces latency through direct private connectivity, and improves network efficiency. A single VPC provides unified management and automatic inter-region routing, eliminating the need for VPN or external IP gateways.
Why the other options are wrong
- A. Using separate VPCs requires VPN connections, which add latency and cost compared to a single VPC architecture.
- B. Using external IP addresses incurs additional charges and adds unnecessary complexity when private communication is possible.
- C. Global load balancers are designed for distributing traffic to users globally, not for enabling direct inter-region workload communication.
What people say about the full Professional Cloud Network Engineer pack 5.0 from 1
Professional Cloud Network is a tough exam but due to study material it's now easy to pass it. But from what site? Well, I recommend Cert Stash. I bought from them and I’m 100% satisfied. Thanks.
Question 11
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client IP address. You want to identify this actor while minimizing disruption to your legitimate users. What should you do?
Show answer and explanation
Correct answer: B. Create a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.
Cloud Armor Policy preview mode allows you to test deny rules without actually blocking traffic, making it ideal for identifying malicious actors while minimizing disruption to legitimate users. Preview mode logs the traffic that would be denied, enabling you to verify the correct IP address before enforcing the rule. VPC Firewall rules lack a preview mode for testing purposes, and creating an immediate deny rule without preview risks blocking legitimate users.
Why the other options are wrong
- A. Creating and enforcing a deny rule immediately could block legitimate users if the IP address identification is incorrect.
- C. VPC Firewall rules do not have a preview mode; disabling enforcement defeats the purpose of protection.
- D. VPC Firewall rules cannot preview rule effects without enforcement like Cloud Armor can, risking premature traffic disruption.
Question 12
You need to enable Cloud CDN for all the objects inside a storage bucket. You want to ensure that all the object in the storage bucket can be served by the CDN. What should you do in the GCP Console?
Show answer and explanation
Correct answer: D. Create a new HTTP load balancer, select the storage bucket as a backend, enable Cloud CDN on the backend, and make sure each object inside the storage bucket is shared publicly.
Cloud CDN cannot be enabled directly on a storage bucket without a load balancer. To serve storage bucket objects via CDN, you must create an HTTP(S) load balancer with the storage bucket as a backend, enable Cloud CDN on that backend, and ensure objects are publicly shared so the CDN can cache and serve them.
Why the other options are wrong
- A. Creating a bucket alone does not enable CDN; buckets require a load balancer as an intermediary to use Cloud CDN.
- B. TCP load balancers operate at Layer 4 and cannot serve HTTP content from storage buckets; HTTP(S) load balancers are required.
- C. SSL proxy load balancers are designed for non-HTTP protocols; HTTP(S) load balancers are the correct choice for serving storage bucket content via CDN.
Question 13
You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In one of your instances you notice the master is not responding, even though the cluster is up and running. What should you do to solve the problem?
Show answer and explanation
Correct answer: D. Create the appropriate master authorized network entries to allow the instance to communicate to the master.
In a private GKE cluster, the master is not publicly accessible. Master authorized networks explicitly whitelist which networks and IP addresses are allowed to communicate with the master API. Adding the instance's network/IP address to the master authorized networks list allows kubectl commands from that instance to reach the master.
Why the other options are wrong
- A. Assigning a public IP to the instance does not solve access to a private master that requires authorization.
- B. Creating a route to the internet gateway does not help reach a private master that requires explicit authorization, not public internet access.
- C. Firewall policies control traffic flow but do not address the master authorization requirement specific to private clusters; authorized networks is the required configuration.
Question 14
You are configuring your Google Cloud environment to connect to your on-premises network. Your configuration must be able to reach Cloud Storage APIs and your Google Kubernetes Engine nodes across your private Cloud Interconnect network. You have already configured a Cloud Router with your Interconnect VLAN attachments. You now need to set up the appropriate router advertisement configuration on the Cloud Router. What should you do?
Show answer and explanation
Correct answer: C. Configure the route advertisement to the custom setting, and manually add prefix 199.36.153.8/30 to the list of advertisements. Leave all other options as their default settings.
To reach Cloud Storage APIs across Cloud Interconnect, the Cloud Router must advertise the specific prefix 199.36.153.8/30, which is the IP range for Cloud Storage API endpoints. Configuring custom route advertisement and manually adding this prefix ensures that on-premises routers can reach the Storage API. Leaving other options as defaults ensures the VPC subnets are also advertised.
Why the other options are wrong
- A. Default settings typically advertise only the VPC subnets, not the specific Google API IP ranges needed for Cloud Storage access.
- B. Configuring a static route on the on-premises router is the on-premises responsibility, not the Cloud Router configuration being asked about.
- D. While this option advertises all visible subnets, advertising all subnets can create routing conflicts and is not the recommended best practice; custom advertisement with only the necessary prefix is preferred.
Question 15
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to restrict your origin to allow connections only from the traffic-scrubbing service. What should you do?
Show answer and explanation
Correct answer: A. Create a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing service.
With a global external load balancer, client connections end at Google's edge and backends see traffic from load balancer and proxy ranges, not the original client. A Cloud Armor security policy on the backend service can allow only the scrubbing service's IP ranges and deny everything else at the edge.
Why the other options are wrong
- B. VPC firewall rules see traffic coming from the load balancer's proxy ranges, not the scrubbing service's addresses, so they cannot filter on it.
- C. VPC Service Controls protect access to Google managed service APIs, not traffic reaching a load balancer.
- D. iptables on the instances also only see load balancer source addresses and are harder to manage at scale.
Question 16
You are configuring a new instance of Cloud Router in your Organization's Google Cloud environment to allow connection across a new Dedicated Interconnect to your data center Sales, Marketing, and IT each have a service project attached to the Organization's host project. Where should you create the Cloud Router instance?
Show answer and explanation
Correct answer: C. VPC network in the Host Project
Cloud Router should be created in the host project's VPC network when using a shared VPC architecture with service projects. This allows a single Cloud Router instance in the host project to manage routing for the Dedicated Interconnect connection, which is then shared across all service projects (Sales, Marketing, and IT). This centralized approach reduces complexity and cost while maintaining proper network segmentation.
Why the other options are wrong
- A. Creating Cloud Router in all project VPCs would result in multiple unnecessary instances and routing conflicts.
- B. Creating Cloud Router only in the IT project would not provide routing for Sales and Marketing service projects.
- D. Creating separate Cloud Router instances in each service project duplicates infrastructure and complicates management of the shared Interconnect.
Question 17
You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing using the gcloud command. Which next hop should you choose?
Show answer and explanation
Correct answer: C. The name and region of the Cloud VPN tunnel
For policy-based routing with Cloud VPN, the next hop in a static route must be the Cloud VPN tunnel itself, specified by its name and region. This tells the routing system to direct traffic matching the destination range through that specific VPN tunnel to reach the on-premises resources.
Why the other options are wrong
- A. The default internet gateway routes traffic to the public internet, not through a VPN tunnel to on-premises resources.
- B. While a VPN gateway exists, the next hop must reference the tunnel (which connects through the gateway), not the gateway's IP address directly.
- D. The IP address of a remote instance is not used as a next hop; the VPN tunnel itself serves as the next hop abstraction.
Question 18
You have deployed an HTTP(s) load balancer, but health checks to port 80 on the Compute Engine virtual machine instance are failing, and no traffic is sent to your instances. You want to resolve the problem. Which commands should you run?
Show answer and explanation
Correct answer: C. gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --source-ranges 130.211.0.0/22,35.191.0.0/16 --direction INGRESS
Health checks from the HTTP(S) load balancer fail because the firewall rules don't allow traffic from Google Cloud's load balancer health check IPs (130.211.0.0/22 and 35.191.0.0/16). You must create an ingress firewall rule allowing TCP traffic from these source ranges to reach the instances on port 80. This enables the load balancer to verify instance health and begin sending production traffic once health checks pass.
Why the other options are wrong
- A. Adding an external access config to instances is not related to health check connectivity and doesn't resolve firewall rule issues.
- B. An egress rule in the wrong direction doesn't allow inbound health check traffic; the direction should be INGRESS.
- D. Increasing the unhealthy threshold doesn't resolve the underlying firewall rule problem preventing health checks from reaching the instances.
Question 19
You have a storage bucket that contains the following objects: [1] [1] [1] [1] Cloud CDN is enabled on the storage bucket, and all four objects have been successfully cached. You want to remove the cached copies of all the objects with the prefix folder-a, using the minimum number of commands. What should you do?
Show answer and explanation
Correct answer: B. Issue a cache invalidation command with pattern /folder-a/*.
Cache invalidation using a pattern removes cached objects matching that pattern from Cloud CDN with a single command. The pattern /folder-a/* matches all objects with the folder-a prefix and invalidates their cached copies across all edge locations. This achieves the goal in the minimum number of commands with a single cache invalidation operation. Lifecycle rules delete actual objects, not cached copies. Making objects private does not remove existing cached copies, and disabling/re-enabling CDN is inefficient and would eventually re-cache the same content.
Why the other options are wrong
- A. Lifecycle rules manage the actual objects in the bucket, not Cloud CDN cached copies; they would delete the source objects, not just cached versions.
- C. Changing object visibility to non-public does not invalidate already-cached copies in Cloud CDN edge locations.
- D. Disabling and re-enabling Cloud CDN is inefficient and does not guarantee removal of specific cached objects; it may re-cache them on the next request.
Question 20
Your company's Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure: /fr/video /en/video /es/video /../video /fr/audio /en/audio /es/audio /../audio Which solution should you recommend?
Show answer and explanation
Correct answer: A. Rearrange the directory structure, create a URL map and leverage a path rule such as /video/* and /audio/*.
URL maps support simple wildcard path rules like /video/* and /audio/ that match all paths under those directories regardless of language prefix. Rearranging the directory structure to group by content type first (video/audio) rather than language allows clean, operational path-based routing without complex regex patterns, minimizing overhead.
Why the other options are wrong
- B. Creating DNS entries for video and audio adds operational complexity and does not leverage URL map capabilities for path-based routing.
- C. While regex patterns like \/[a-z]{2}\/video work, they introduce unnecessary complexity when a simpler directory restructure and basic wildcard rules achieve the same result.
- D. The wildcard pattern /*/video and /*/audio would work with the current structure, but it still adds complexity compared to restructuring for direct /video/* and /audio/* rules.
Question 21
You are deploying a global external TCP load balancing solution and want to preserve the source IP address of the original layer 3 payload. Which type of load balancer should you use?
Show answer and explanation
Correct answer: B. Network load balancer
The Network Load Balancer operates at Layer 4 and preserves the original source IP address in the packet header, allowing backend services to see the true client IP without any translation. This is essential for applications that require source IP visibility.
Why the other options are wrong
- A. HTTP(S) load balancers operate at Layer 7 and may perform source IP translation or hiding; they do not preserve the original Layer 3 source IP in the payload.
- C. Internal load balancers are designed for internal VPC traffic but do not specifically preserve source IP addresses for external TCP traffic.
- D. TCP/SSL proxy load balancers terminate connections and proxy them, resulting in the load balancer becoming the source IP rather than preserving the original client IP.
Question 22
You have configured a Compute Engine virtual machine instance as a NAT gateway. You execute the following command: gcloud compute routes create no-ip-internet-route \ --network custom-network1 \ --destination-range 0.0.0.0/0 \ --next-hop instance nat-gateway \ --next-hop instance-zone us-central1-a \ --tags no-ip --priority 800 You want existing instances to use the new NAT gateway. Which command should you execute?
Show answer and explanation
Correct answer: B. gcloud compute instances add-tags [existing-instance] --tags no-ip
The route has already been created with a tag-based selector (--tags no-ip). To make existing instances use this NAT gateway route, those instances must be tagged with the 'no-ip' tag so they match the route's selection criteria. Option B uses the correct gcloud command to add the 'no-ip' tag to existing instances, enabling them to route traffic through the NAT gateway.
Why the other options are wrong
- A. Enabling IP forwarding on a single instance is a kernel-level setting relevant to the NAT gateway itself, not to making other instances use the route.
- C. Cloud Build and cloudbuild configuration files are for CI/CD pipelines, not for routing configuration or instance tagging.
- D. Creating a new instance with the tag only applies to future instances, not to existing instances that need to use the NAT gateway.
Question 23
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template. How should you update your instances?
Show answer and explanation
Correct answer: D. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
A canary update allows you to test new instance templates on a subset of instances before rolling out to the entire group, minimizing user impact from untested features. GCP's managed instance groups support specifying a target size for canary instances within a rolling update operation, allowing verification before full rollout. This approach reduces risk while maintaining the efficiency of a single update operation.
Why the other options are wrong
- A. Manually patching instances is error-prone and doesn't leverage the managed instance group's orchestration capabilities.
- B. Rolling out untested features to all instances at once defeats the purpose of minimizing impact from potential bugs.
- C. Creating a separate canary instance group is more complex and costly than using the built-in canary update feature of managed instance groups.
Question 24
You are in the early stages of planning a migration to GCP. You want to test the functionality of your hybrid cloud design before you start to implement it in production. The design includes services running on a Compute Engine Virtual Machine instance that need to communicate to on-premises servers using private IP addresses. The on-premises servers have connectivity to the internet, but you have not yet established any Cloud Interconnect connections. You want to choose the lowest cost method of enabling connectivity between your instance and on-premises servers and complete the test in 24 hours. Which connectivity method should you choose?
Show answer and explanation
Correct answer: A. Cloud VPN
Cloud VPN is the lowest cost method for establishing connectivity between GCP and on-premises networks when Cloud Interconnect is not yet available. It requires no setup time beyond configuration and can be deployed within hours, making it ideal for a 24-hour test. VPN uses encrypted tunnels over the internet and supports private IP communication through custom traffic selectors.
Why the other options are wrong
- B. Partner VLAN attachments require an established partner connection and take weeks to provision.
- C. Dedicated Interconnect requires physical provisioning by Google and partners, taking weeks or months.
- D. Dedicated Interconnect without VLAN attachments provides no connectivity whatsoever.
Question 25
You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer working. You want to resolve the problem. What should you do?
Show answer and explanation
Correct answer: D. Explicitly reference the custom mode networks in the Deployment Manager templates.
When converting an auto mode VPC to custom mode, auto-generated routes and subnets are removed. Cloud Deployment Manager templates that reference specific subnet names or network resources must be explicitly updated to reference the newly created custom mode subnets and networks. The templates contain hardcoded references that are no longer valid after conversion.
Why the other options are wrong
- A. Converting to custom mode does not require additional IAM roles for the Google APIs service account.
- B. Firewall rules do not affect whether Deployment Manager can reference custom mode networks.
- C. Cloud Armor is for DDoS protection and does not relate to network mode conversion or template functionality.
Question 26
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications: • Your ISP is a Google Partner Interconnect provider. • Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps. • A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses. • Most of the data transfer will be from GCP to the on-premises environment. • The application can burst up to 1.5 Gbps during peak transfers over the Interconnect. • Cost and the complexity of the solution should be minimal. How should you provision the connectivity solution?
Show answer and explanation
Correct answer: A. Provision a Partner Interconnect through your ISP.
Partner Interconnect is ideal when your ISP is a Google Partner Interconnect provider and you need speeds beyond VPN capabilities (the test shows 500 Mbps maximum). At 1.5 Gbps burst requirements, Partner Interconnect can easily accommodate this with minimal complexity and cost compared to Dedicated Interconnect, while providing direct RFC 1918 connectivity.
Why the other options are wrong
- B. Dedicated Interconnect requires meeting at Google POPs and is more complex and costly than Partner Interconnect when an ISP partner is available.
- C. Multiple VPN tunnels and ECMP still suffer from the 500 Mbps per-tunnel limitation; this approach wastes resources without solving the core VPN performance constraint.
- D. Network compression is not a standard solution and doesn't reliably overcome VPN's intrinsic throughput limitations.
Question 27
You work for a multinational enterprise that is moving to GCP. These are the cloud requirements: • An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions uswest1 (primary HQ) and us-east4 (backup) • Multiple regional offices in Europe and APAC • Regional data processing is required in europe-west1 and australia-southeast1 • Centralized Network Administration Team Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us-west1. What should you do?
Show answer and explanation
Correct answer: A. • Create 2 VPCs in a Shared VPC Host Project. • Configure a 2-NIC instance in zone us-west1-a in the Host Project. • Attach NIC0 in VPC #1 us-west1 subnet of the Host Project. • Attach NIC1 in VPC #2 us-west1 subnet of the Host Project. • Deploy the instance. • Configure the necessary routes and firewall rules to pass traffic through the instance.
For a centralized security appliance in a Shared VPC architecture with centralized network administration, create two separate VPCs within a Shared VPC Host Project. Deploy a dual-NIC instance in the Host Project with one NIC attached to each VPC's subnet. This allows the security appliance to inspect traffic flowing between the two VPCs while maintaining centralized control. The appliance must be in the Host Project, not a Service Project, to have the authority to access resources across both VPCs. Using a single VPC does not provide the network segmentation needed for proper traffic inspection between departments.
Why the other options are wrong
- B. The security appliance instance must be in the Host Project to properly access and route traffic between VPCs.
- C. A single VPC does not provide the network isolation needed for departmental traffic separation and inspection.
- D. VPCs must be created in the Host Project for a Shared VPC model, and the instance must be in the Host Project to route between them.
Question 28
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance. What should you do?
Show answer and explanation
Correct answer: B. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
With OS Login disabled and no SSH keys configured on the instance or project, you cannot SSH using traditional methods. Enabling OS Login at the metadata level (set to TRUE) activates Google Cloud's OS Login feature, which allows SSH access using your Google Cloud credentials and is synchronized with the instance's OS user management. This is the most direct solution given the constraints and works with standard SSH tools.
Why the other options are wrong
- A. Cloud Shell SSH using `gcloud compute ssh` also requires either OS Login enabled or pre-configured SSH keys on the instance.
- C. Generating an SSH key pair and adding it to the instance is not possible when the instance blocks project-wide SSH keys and has no pre-existing key setup mechanism available.
- D. Adding SSH keys to the project will not work because the instances are configured to block project-wide SSH keys.
Question 29
You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall. Which two actions should you take? (Choose two.)
Show answer and explanation
Correct answer: A, D. Turn on Private Google Access at the subnet level; Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
Private Google Access must be enabled at the subnet level (not VPC level) to allow instances without public IPs to access Google APIs through private IP routes. Additionally, custom static routes must be created to direct traffic destined for Google APIs to the default internet gateway (which has special handling for Google services), bypassing the firewall. These routes use external IP address ranges published by Google for API endpoints, ensuring traffic reaches the appropriate service without firewall inspection.
Why the other options are wrong
- B. Private Google Access is configured at the subnet level, not the VPC level, for granular control.
- C. Private Services Access is for creating private connections to Google-managed services like Cloud SQL, not for accessing public APIs like BigQuery and Pub/Sub.
- E. Google APIs are accessed via external IP addresses, not internal IP addresses; internal routes would not reach the services.
Question 30
You are the network administrator responsible for hybrid connectivity at your organization. Your developer team wants to use Cloud SQL in the uswest1 region in your Shared VPC. You configured a Dedicated Interconnect connection and a Cloud Router in us-west1, and the connectivity between your Shared VPC and on-premises data center is working as expected. You just created the private services access connection required for Cloud SQL using the reserved IP address range and default settings. However, your developers cannot access the Cloud SQL instance from on-premises. You want to resolve the issue. What should you do?
Show answer and explanation
Correct answer: A. 1. Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes. 2. Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.
When Cloud SQL is accessed via Private Services Access, the Cloud SQL IP range is connected to the VPC through VPC Network Peering. For on-premises users to reach Cloud SQL through the Dedicated Interconnect, this peered range must be advertised back to the on-premises network via Cloud Router. You must enable import and export of routes on the peering connection to allow route propagation, then configure Cloud Router to advertise the Cloud SQL IP address range through BGP to the on-premises data center.
Why the other options are wrong
- B. Changing routing mode to global alone doesn't enable route propagation across the peering connection; you still need to enable import/export on the peering connection and advertise routes through Cloud Router.
- C. Creating an additional Cloud Router in a different region is unnecessary; you already have connectivity in us-west1 where Cloud SQL is deployed.
- D. While changing routing mode to global and enabling route import/export are helpful, the critical missing piece is the custom route advertisement in Cloud Router to actually advertise the Cloud SQL range to on-premises.
Question 31
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network. What should you do?
Show answer and explanation
Correct answer: C. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.
Alias IP ranges allow a single virtual machine to have multiple IP addresses from different subnets assigned to the same network interface. By creating an alias IP range of 172.16.45.0/24 on instances within the primary subnet 10.1.1.0/24, instances can respond to traffic on both IP ranges without requiring separate network interfaces or peering configurations.
Why the other options are wrong
- A. Global load balancing is not designed to assign multiple IP ranges to instances; it routes traffic based on rules, not source IP assignment.
- B. DNS records map names to IP addresses but do not assign multiple IP addresses to a single instance, nor do they solve the underlying requirement of having instances respond on both subnets.
- D. VPC peering connects separate VPC networks; this scenario requires a single VPC with multiple IP ranges on the same instances, not network-to-network connectivity.
Question 32
You are creating an instance group and need to create a new health check for HTTP(s) load balancing. Which two methods can you use to accomplish this? (Choose two.)
Show answer and explanation
Correct answer: A, C. Create a new health check using the gcloud command line tool; Create a new health check, or select an existing one, when you complete the load balancer's backend configuration in the GCP Console.
Health checks for HTTP(s) load balancing can be created via the gcloud command line tool (A) or through the GCP Console during load balancer backend configuration (C). Option C allows creation of health checks directly within the load balancer setup workflow. These are the standard methods for creating modern health checks used by HTTP(s) load balancers. Legacy health checks are a deprecated predecessor and should not be used for new deployments.
Why the other options are wrong
- B. Health checks are not created in the VPC Network section; they are created in the Health Checks section or during load balancer configuration.
- D. Legacy health checks should not be used for new HTTP(s) load balancing; modern health checks are the standard.
- E. While the Health Checks section exists in the console, legacy health checks are deprecated and inappropriate for HTTP(s) load balancing.
Question 33
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible. What should you do?
Show answer and explanation
Correct answer: A. Upload your public ssh key to the project Metadata.
Uploading your public SSH key to the project metadata makes it available to all instances in the project automatically. This is the most efficient approach as it requires a single upload and applies across all instances without individual configuration, and new instances created in the project will also inherit this key.
Why the other options are wrong
- B. Uploading to each instance metadata requires repetitive manual work on every instance, which is not efficient.
- C. Creating a custom image embeds the key but requires rebuilding and managing the image; project metadata is simpler and more scalable.
- D. The gcloud compute ssh command copies keys to individual instances, not to all instances at once, and requires manual execution per instance.
Question 34
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them. How should you set up permissions for the networking team?
Show answer and explanation
Correct answer: B. Assign members of the networking team the compute.networkAdmin role.
The predefined Compute Network Admin role lets members create, modify and delete networking resources, but gives only read-only access to firewall rules and SSL certificates. That matches a networking team that manages the network while the security team controls firewalls.
Why the other options are wrong
- A. compute.networkUser only lets members use shared networks and does not let them manage networking resources.
- C. A custom role with only these permissions is more work to maintain and leaves out many networking permissions the team needs, such as subnetworks and routes.
- D. compute.networkViewer is read only for all networking resources, so the team could not manage the network.
Question 35
You work for a university that is migrating to GCP. These are the cloud requirements: • On-premises connectivity with 10 Gbps • Lowest latency access to the cloud • Centralized Networking Administration Team New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud. What should you do?
Show answer and explanation
Correct answer: A. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
Using Shared VPC with VLAN attachments and Interconnect deployed in the host project provides the most cost-efficient solution. The Interconnect connection is expensive and should be shared across all departments rather than duplicated. The centralized Networking Administration Team manages the host project, which aligns with the university's requirement for centralized networking administration. Service projects connect through the shared VPC to access the single Interconnect, minimizing costs while maintaining the required 10 Gbps connectivity and low latency.
Why the other options are wrong
- B. Deploying VLAN attachments in service projects adds complexity and doesn't leverage the cost benefits of a shared Interconnect.
- C. Using standalone projects with individual Interconnects duplicates infrastructure and costs, contradicting the cost-efficiency requirement.
- D. Deploying Interconnects in each individual project multiplies the cost and complexity significantly, violating the cost-efficiency requirement.
Question 36
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can communicate with each other, but only via specific networks. You want to follow Google-recommended practices. How should you design this topology?
Show answer and explanation
Correct answer: D. Create 1 VPC within the shared VPC Host Project, and share individual subnets with the Service Projects to filter access between the specific networks.
The recommended Google practice for departmental isolation within a shared VPC is to create a single VPC in the Host Project and share individual subnets with Service Projects. This approach allows the network administration team to maintain centralized control while enforcing strict route and network isolation through subnet-level sharing. Creating separate VPCs would require peering or VPN connections which add unnecessary complexity. Placing VPCs in Service Projects contradicts the shared VPC model where the Host Project owns network resources.
Why the other options are wrong
- A. Creating multiple VPCs requires peering which does not provide the granular control needed for strict departmental network isolation.
- B. VPN and Cloud Router between separate VPCs adds unnecessary complexity; Shared VPC is designed to eliminate this need.
- C. VPCs must be created in the Host Project, not Service Projects, which contradicts the shared VPC architecture pattern.
Question 37
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member. Which two methods can you use to accomplish this? (Choose two.)
Show answer and explanation
Correct answer: B, D. setIamPolicy() via REST API; gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
The setIamPolicy() REST API method allows programmatic role assignment and is suitable for scripting and automation. The gcloud projects add-iam-policy-binding command is the command-line equivalent that automates role granting for project members. Both enable scriptable, repeatable IAM management. GetIamPolicy() only retrieves policies without modifying them. The pubsub command is for Pub/Sub-specific bindings, not project-level roles. The console method is manual and not automatable.
Why the other options are wrong
- A. GetIamPolicy() retrieves policies but does not grant roles; it cannot accomplish the task alone.
- C. The pubsub add-iam-policy-binding command manages Pub/Sub topic access, not project-level editor roles.
- E. Using the GCP Console is manual and cannot be scripted or automated as required.
Question 38
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs. Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)
Show answer and explanation
Correct answer: A, C. VPC peering; Cloud VPN
VPC peering enables direct network connectivity between two VPCs in different organizations with no CIDR overlap, providing secure private communication without Internet exposure. Cloud VPN creates an encrypted tunnel over the Internet for secure connectivity between separate organizations' networks. Both solutions maintain security by keeping traffic private and encrypted. Shared VPC requires organizational hierarchy within the same organization, Dedicated Interconnect requires physical infrastructure setup inappropriate for partner scenarios, and Cloud NAT is for outbound traffic translation, not cross-network resource access.
Why the other options are wrong
- B. Shared VPC requires a hierarchical organizational structure and is designed for intra-organizational resource sharing, not inter-organizational partner connectivity.
- D. Dedicated Interconnect requires physical connection infrastructure and is typically used for high-capacity, long-term dedicated connections rather than partner network connectivity.
- E. Cloud NAT provides outbound Internet connectivity translation and does not enable direct access to partner network resources.
Question 39
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby. Which BGP attribute should you use on your on-premises router?
Show answer and explanation
Correct answer: D. Multi-exit Discriminator
The Multi-exit Discriminator (MED) attribute is used to influence path selection and preference between multiple routes to the same destination. On the on-premises router, setting a lower MED value on one Cloud Router's route advertisement makes it the preferred (active) path, while the standby Cloud Router receives a higher MED value, causing its routes to be less preferred. This creates an active-standby configuration without requiring session termination. AS-Path, Community, and Local Preference are used for different routing purposes and do not create this specific active-standby relationship.
Why the other options are wrong
- A. AS-Path is used to prevent routing loops and influence path length, not to establish active-standby relationships.
- B. Community is used for route tagging and grouping, not for creating active-standby BGP session preferences.
- C. Local Preference influences route selection within an AS but is not the standard attribute for Cloud Router active-standby configuration.
Question 40
You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on-premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access. What configuration changes should you make to enable Private Google Access while adhering to your security team’s requirements?
Show answer and explanation
Correct answer: A. 1. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range. 2. Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
To use Private Google Access while routing all internet traffic through the on-premises data center for inspection and implementing VPC Service Controls, you must create a private DNS zone redirecting *.googleapis.com to restricted.googleapis.com with A records pointing to Google's restricted API address range (199.36.153.4/30). This range is only accessible through VPC Service Controls and on-premises routes. You then need a custom route pointing Google's restricted API range to the default internet gateway (which routes back to on-premises), allowing traffic to reach the APIs through your inspection infrastructure.
Why the other options are wrong
- B. Changing the default route (0.0.0.0/0) would route all traffic, including regular internet traffic, back to on-premises, but doesn't specifically ensure only restricted APIs are directed correctly.
- C. Using private.googleapis.com (the unrestricted range) bypasses VPC Service Controls and doesn't work with the security team's requirement for API-level security control.
- D. Using private.googleapis.com instead of restricted.googleapis.com defeats the VPC Service Controls implementation.
Question 41
You are maintaining a Shared VPC in a host project. Several departments within your company have infrastructure in different service projects attached to the Shared VPC and use Identity and Access Management (IAM) permissions to manage the cloud resources in those projects. VPC Network Peering is also set up between the Shared VPC and a common services VPC that is not in a service project. Several users are experiencing failed connectivity between certain instances in different Shared VPC service projects and between certain instances and the internet. You need to validate the network configuration to identify whether a misconfiguration is the root cause of the problem. What should you do?
Show answer and explanation
Correct answer: C. Run Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the internet.
Network Intelligence Center's Connectivity Tests tool is designed specifically for validating network configurations and diagnosing connectivity issues between endpoints. It can test connectivity between instances in different projects and to the internet, making it the most appropriate tool for identifying whether network configuration misconfigurations are causing the reported failures.
Why the other options are wrong
- A. VPC audit logs track administrative actions like creating rules or resources, not the actual data plane connectivity issues affecting traffic flow.
- B. Manual ping testing is time-consuming and does not systematically validate the entire network path or identify misconfigured routes and firewall rules.
- D. VPC Flow Logs show traffic that was allowed or denied by existing rules but do not actively test connectivity or identify configuration errors.
Question 42
You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements: • IP ranges for pods and services must be as small as possible. • The nodes and the master must not be reachable from the internet. • You must be able to use kubectl commands from on-premises subnets to manage the cluster. How should you create the GKE cluster?
Show answer and explanation
Correct answer: D. • Create a VPC-native GKE cluster using user-managed IP ranges. • Enable privateEndpoint on the cluster master. • Set the pod and service ranges as /24. • Set up a network proxy to access the master. • Enable master authorized networks.
Option D creates a private GKE cluster using user-managed IP ranges sized at /24 for both pods and services (minimizing IP usage), disables public endpoint access with privateEndpoint, enables master authorized networks to restrict master access to on-premises subnets, and sets up a network proxy for kubectl access from on-premises. This configuration satisfies all requirements: minimal pod/service ranges, no internet reachability, and kubectl access from on-premises through the proxy and authorized networks.
Why the other options are wrong
- A. VPC advanced routes are deprecated; GKE-managed ranges are required for modern clusters. /24 is too small for service ranges in GKE (typically /20 minimum).
- B. GKE-managed ranges do not allow user control, conflicting with the pre-provisioning requirement. /21 for pods and /24 for services are not minimum sizes.
- C. Network policies provide micro-segmentation but don't enable private endpoint configuration; lacks the privateEndpoint setting required for true master privacy.
Question 43
You are designing a Partner Interconnect hybrid cloud connectivity solution with geo-redundancy across two metropolitan areas. You want to follow Google-recommended practices to set up the following region/metro pairs: • (region 1/metro 1) • (region 2/metro 2) What should you do?
Show answer and explanation
Correct answer: D. Create a Cloud Router in region 1 with one VLAN attachment connected to metro1-zone1-x and one VLAN attachment connected to metro1zone2-x. Create a Cloud Router in region 2 with one VLAN attachment connected to metro2-zone1-x and one VLAN attachment to metro2-zone2-x.
Google-recommended practices for Partner Interconnect geo-redundancy require redundancy within each metro area. For each region/metro pair, you should create a Cloud Router with VLAN attachments to both zones within that metro area. This ensures that if one zone's connection fails, traffic can still flow through the other zone. Therefore, region 1 connects to both metro1-zone1 and metro1-zone2, and region 2 connects to both metro2-zone1 and metro2-zone2.
Why the other options are wrong
- A. This creates redundancy within a single zone (metro1-zone1) instead of across zones within the metro, failing to provide proper geographic redundancy.
- B. Region 2 has two attachments to the same zone (metro2-zone2), which does not provide zone-level redundancy within the metro.
- C. This provides only a single attachment per region with no redundancy, leaving each metro with a single point of failure.
Question 44
You want to establish a dedicated connection to Google that can access Cloud SQL via a public IP address and that does not require a third-party service provider. Which connection type should you choose?
Show answer and explanation
Correct answer: B. Direct Peering
Direct Peering establishes a dedicated connection to Google without requiring a third-party service provider, and it supports access to Google Cloud services like Cloud SQL via public IP addresses. It is a direct, managed connection between your network and Google's network.
Why the other options are wrong
- A. Carrier Peering requires a telecommunications carrier as an intermediary, which contradicts the requirement for no third-party service provider involvement.
- C. Dedicated Interconnect requires a third-party service provider to establish the physical connection, not meeting the no-provider requirement.
- D. Partner Interconnect explicitly involves a service provider partner as an intermediary, making it unsuitable for avoiding third-party dependencies.
Question 45
You are designing the network architecture for your organization. Your organization has three developer teams: Web, App, and Database. All of the developer teams require access to Compute Engine instances to perform their critical tasks. You are part of a small network and security team that needs to provide network access to the developers. You need to maintain centralized control over network resources, including subnets, routes, and firewalls. You want to minimize operational overhead. How should you design this topology?
Show answer and explanation
Correct answer: A. Configure a host project with a Shared VPC. Create service projects for Web, App, and Database.
Shared VPC is designed to provide centralized control over network resources while allowing multiple service projects to use shared subnets, routes, and firewall rules. By creating a single host project with a Shared VPC and separate service projects for Web, App, and Database teams, the network team maintains complete control over network infrastructure while developers in service projects can manage their compute resources. This minimizes operational overhead compared to managing multiple independent VPCs.
Why the other options are wrong
- B. Multiple VPCs with HA VPN between them creates significant operational overhead for the network team and lacks centralized control.
- C. Three separate host projects would require duplicating network infrastructure and is far less efficient than a single host project.
- D. Multiple VPCs with peering adds complexity and does not provide the same level of centralized control as Shared VPC.
Question 46
You want to configure load balancing for an internet-facing, standard voice-over-IP (VOIP) application. Which type of load balancer should you use?
Show answer and explanation
Correct answer: B. Network load balancer
Network load balancers operate at Layer 4 and handle UDP/TCP traffic with ultra-high performance and low latency, making them ideal for VoIP applications which require real-time voice transmission. VoIP uses UDP-based protocols like SIP and RTP that require connection-less, fast packet forwarding that only a network load balancer can provide efficiently.
Why the other options are wrong
- A. HTTP(S) load balancers operate at Layer 7 and are designed for web traffic, not for real-time UDP-based protocols like VoIP.
- C. Internal TCP/UDP load balancers are for internal traffic only, not internet-facing applications.
- D. TCP/SSL proxy load balancers are designed for encrypted TCP connections and introduce additional latency unsuitable for real-time VoIP.
Question 47
One instance in your VPC is configured to run with a private IP address only. You want to ensure that even if this instance is deleted, its current private IP address will not be automatically assigned to a different instance. In the GCP Console, what should you do?
Show answer and explanation
Correct answer: C. Change the instance's current internal IP address to static.
Changing the instance's current internal IP address to static (by reserving the internal IP) ensures that the private IP address will not be automatically reassigned to other instances if this instance is deleted. In GCP, when you convert an ephemeral internal IP to a static/reserved internal IP address, that address is reserved for your use.
Why the other options are wrong
- A. Assigning a public IP address does not protect the private IP address from reassignment.
- B. Assigning a new reserved internal IP address replaces the current IP rather than reserving it.
- D. Adding custom metadata has no effect on IP address reservation or assignment behavior.
Question 48
You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses. Which subnet mask should you use for the Pod IP address range?
Show answer and explanation
Correct answer: B. /22
For a VPC-native GKE cluster, each node gets a /24 pod subnet from the primary pod IP range by default. With a maximum of 3 nodes, you need 3 × /24 subnets, which totals 768 pod IPs. A /22 provides 1024 IPs, offering sufficient capacity with minimal waste. A /25 would only provide 128 IPs per subnet (insufficient for standard GKE node allocations), while /21 and /23 exceed the minimum requirement. The /22 represents the minimum appropriately-sized range for 3 nodes with default allocation.
Why the other options are wrong
- A. /21 provides 2048 IPs, which exceeds the minimum needed for 3 nodes and wastes address space.
- C. /23 provides 512 IPs total, which is insufficient for 3 nodes at /24 per node (requiring 768 IPs minimum).
- D. /25 provides only 128 IPs per subnet, below the 256 IPs per /24 that GKE allocates to each node by default.
Question 49
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection. What should you do on your on-premises servers?
Show answer and explanation
Correct answer: A. Tune TCP parameters on the on-premises servers.
With a 100-millisecond latency on a 10-Gbps connection, TCP window size and buffer settings become the limiting factor for throughput. Tuning TCP parameters such as TCP window size, socket buffers, and congestion control algorithms on the on-premises servers can significantly improve bandwidth utilization for long-distance, high-bandwidth connections. File compression reduces data size but does not address the underlying bandwidth utilization issue. Removing the -m flag disables parallel uploads, reducing throughput. The perfdiag parameter is for diagnostics, not performance optimization.
Why the other options are wrong
- B. Compression reduces data volume but does not address the TCP-level bandwidth utilization problem.
- C. Removing the -m flag disables parallel transfers, further reducing bandwidth utilization.
- D. perfdiag is a diagnostic tool that identifies performance issues but does not directly optimize bandwidth.
Question 50
You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner. What should you first?
Show answer and explanation
Correct answer: C. Create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.
The first step in setting up Partner Interconnect is to create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key. This pairing key is then provided to the Interconnect partner to provision the physical connection on their end.
Why the other options are wrong
- A. Logging into the partner's portal comes after creating the VLAN attachment and obtaining the pairing key.
- B. Asking the partner to provision a physical connection is the second step, after you have created the VLAN attachment and provided the pairing key.
- D. This command is for updating an existing attachment configuration, not for initial setup.
Question 51
You have configured Cloud CDN using HTTP(S) load balancing as the origin for cacheable content. Compression is configured on the web servers, but responses served by Cloud CDN are not compressed. What is the most likely cause of the problem?
Show answer and explanation
Correct answer: D. You have to configure the web servers to compress responses even if the request has a Via header.
Web servers automatically detect when a request includes a Via header (indicating the request passed through a proxy or CDN) and often disable compression for such requests. When Cloud CDN caches content from web servers, subsequent requests served by Cloud CDN include the Via header, causing the origin web servers to not compress responses when Cloud CDN attempts to refresh the cache. The solution is to configure the web servers to compress responses regardless of the Via header presence. Cloud CDN does not require explicit compression configuration, and mismatched compression types between CDN and servers are not the issue.
Why the other options are wrong
- A. Cloud CDN inherits compression from the origin; explicit Cloud CDN compression configuration is not required.
- B. Different compression types between web servers and Cloud CDN is not the cause of missing compression.
- C. Different compression types across backend servers do not prevent Cloud CDN from serving compressed content from the origin.
Question 52
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from your on-premises network using Cloud Interconnect. You must configure access only to Google APIs and services that are supported by VPC Service Controls through hybrid connectivity with a service level agreement (SLA) in place. What should you do?
Show answer and explanation
Correct answer: B. Use Private Google Access for on-premises hosts with restricted.googleapis.com virtual IP addresses.
Private Google Access for on-premises networks allows hybrid connections via Cloud Interconnect to reach Google APIs and services through restricted.googleapis.com, which routes traffic privately without using public IP addresses. This approach integrates with VPC Service Controls for security policies and maintains SLA guarantees through the dedicated interconnect.
Why the other options are wrong
- A. Advertising public virtual IP addresses defeats the purpose of private connectivity and does not align with VPC Service Controls requirements.
- C. Cloud NAT translates on-premises traffic to appear as if it originates from the VPC, but this uses public IP addresses and does not provide the private, SLA-backed connectivity required.
- D. Direct Peering uses public IP addresses and does not support VPC Service Controls integration, making it unsuitable for this security and SLA requirement.
Question 53
In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet. What should you do?
Show answer and explanation
Correct answer: B. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A.
Creating a more specific route than the system-generated subnet route with a tag applied to instance-A ensures that only instance-A's traffic is forced through the security appliance (instance-B). The tag restricts the route to apply only to the tagged instance, providing the subnet-level isolation required while allowing other instances to use normal routing.
Why the other options are wrong
- A. Without a tag, this route would apply to all instances in the subnet, not just instance-A, defeating the purpose of isolation.
- C. Deleting the system-generated subnet route would break connectivity for all instances in the subnet; you must keep it and create a more specific route instead.
- D. Moving instance-B to another VPC and using multi-NIC overcomplicates the architecture and is unnecessary for this use case.
Question 54
Your organization has Compute Engine instances in us-east1, us-west2, and us-central1. Your organization also has an existing Cloud Interconnect physical connection in the East Coast of the United States with a single VLAN attachment and Cloud Router in us-east1. You need to provide a design with high availability and ensure that if a region goes down, you still have access to all your other Virtual Private Cloud (VPC) subnets. You need to accomplish this in the most cost-effective manner possible. What should you do?
Show answer and explanation
Correct answer: C. 1. Configure your VPC routing in global mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-west2 region, and configure a Cloud Router in us-west2.
Global routing mode allows traffic to use any available Cloud Router in any region, providing true redundancy. Adding a VLAN attachment in us-west2 (a different region from the existing us-east1 connection) ensures that if the East Coast region fails, traffic can still reach on-premises through the West Coast connection. This provides geographic redundancy at minimal cost compared to adding attachments in every region.
Why the other options are wrong
- A. Regional routing mode limits each region to local routes, preventing failover between regions if one goes down.
- B. Adding an additional VLAN attachment only in us-east1 provides no geographic redundancy; if the entire region fails, both attachments are unreachable.
- D. Requiring VLAN attachments in all three regions is unnecessarily costly; global routing with one additional attachment in a different region is sufficient for high availability.
Question 55
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin. What should you do?
Show answer and explanation
Correct answer: D. Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
The Cache-Control metadata header with value 'private' instructs Cloud CDN not to cache the object and to serve it directly from origin for each request. After adding this metadata to the object, invalidating previously cached copies ensures immediate effect. This is the standard HTTP cache control mechanism for preventing CDN caching of specific objects.
Why the other options are wrong
- A. Object sharing permissions don't control CDN caching behavior; both public and private objects can be cached by CDN.
- B. Moving objects to a separate bucket with a private attribute doesn't prevent caching; CDN caching is controlled by cache headers, not bucket settings.
- C. Lifecycle rules manage object deletion and storage classes, not cache behavior.
Question 56
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN. What should you do?
Show answer and explanation
Correct answer: C. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
To increase Cloud VPN bandwidth capacity, you add a second on-premises VPN gateway with a different public IP address and create a second tunnel from the existing Cloud VPN gateway to this new on-premises gateway IP, while both tunnels forward the same IP range. This distributes traffic across multiple tunnels and gateways, effectively increasing bandwidth. Changing MTU does not increase bandwidth, using the same destination address does not add capacity, and adding a second Cloud VPN gateway in a different region adds latency and complexity without solving the bandwidth limitation.
Why the other options are wrong
- A. MTU changes affect packet fragmentation but do not increase overall tunnel bandwidth capacity.
- B. Two tunnels pointing to the same destination VPN gateway IP will not achieve load distribution or increased bandwidth.
- D. Adding a second Cloud VPN gateway in a different region introduces latency and is not the recommended approach for bandwidth scaling.
Question 57
You need to centralize the Identity and Access Management permissions and email distribution for the WebServices Team as efficiently as possible. What should you do?
Show answer and explanation
Correct answer: A. Create a Google Group for the WebServices Team.
Creating a Google Group for the WebServices Team is the most efficient method to centralize IAM permissions and email distribution. Google Groups allow you to assign roles and permissions to the entire group at once, and group members can communicate via a shared email address, without the complexity or cost of setting up separate G Suite or Cloud Identity domains.
Why the other options are wrong
- B. Creating a G Suite Domain is excessive overhead for managing team permissions and email distribution.
- C. Creating a Cloud Identity Domain is more complex and costly than necessary for this use case.
- D. Custom Roles are for defining specific permission sets, not for centralizing team management and communication.
Question 58
You are using the gcloud command line tool to create a new custom role in a project by coping a predefined role. You receive this error message: INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
Show answer and explanation
Correct answer: C. Remove the resourcemanager.projects.list permission, and try again.
The permission resourcemanager.projects.list is not a valid permission in GCP's IAM system and cannot be included in a custom role. Removing this invalid permission and using only valid permissions from the predefined role will allow the custom role creation to succeed.
Why the other options are wrong
- A. The resourcemanager.projects.get permission exists but the real issue is that resourcemanager.projects.list is invalid.
- B. Trying again with a different role name will not resolve the invalid permission error.
- D. Adding resourcemanager.projects.setIamPolicy does not address the core problem of the invalid permission.
Question 59
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed. During troubleshooting you find: • Flow logs are enabled for the VPC subnet, and all firewall rules are set to log. • The subnetwork logs are not excluded from Stackdriver. • The instance that is hosting the application can communicate outside the subnet. • Other instances within the subnet can communicate outside the subnet. • The external resource initiates communication. What is the most likely cause of the missing log lines?
Show answer and explanation
Correct answer: C. The traffic is not matching the expected ingress rule.
Since flow logs and firewall logging are enabled and no denied traffic appears in the logs, the traffic is not being denied by firewall rules. The external resource initiates communication, but the instance cannot communicate back, yet no logs show denial. This indicates the traffic is not matching any ingress rule (the rule that would allow the external resource's inbound traffic), so it is dropped before being logged as a denial. Traffic that does not match any rule is dropped silently without log entries. If an egress rule was not matching, the instance itself could not send the response, but we would see denied egress logs if logging was configured.
Why the other options are wrong
- A. If traffic matched an expected ingress rule, the connection would be allowed and communication would succeed.
- B. The problem is inbound communication from the external resource, not egress from the instance.
- D. If an egress rule was not matching, we would see denied egress logs in the output, but we see no logs at all.
Question 60
You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?
Show answer and explanation
Correct answer: C. Configure the authorized networks to be the subnet ranges of the other spoke projects.
GKE's authorized networks feature controls which IP ranges can access the control plane's public endpoint. When accessing the control plane from different spoke projects via VPC Network Peering, you must add the subnet ranges of those spoke projects to the authorized networks list. This is the standard GKE security mechanism for controlling who can reach the control plane, and it works across peered networks because the source IP of traffic from peered VPCs appears as coming from those peered ranges.
Why the other options are wrong
- A. Firewall rules do not control access to the GKE control plane public endpoint; authorized networks is the correct mechanism.
- B. Private Google Access enables access to Google APIs and services, not to the GKE control plane from other projects.
- D. Using a proxy adds unnecessary complexity when authorized networks can directly solve the problem.
Question 61
In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost: • Port 8080 should always be open for VMs in the projects in the Dev folder. • Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder. What should you do?
Show answer and explanation
Correct answer: A. Create and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
Firewall policies can be created and associated at the folder level in Google Cloud, allowing you to enforce consistent firewall rules across all projects within a folder. This approach provides the most scalable and cost-efficient way to enforce different rules for Dev and Prod folders without duplicating configurations across individual VPCs or requiring Shared VPC setup. The policies automatically apply to all VMs in projects within the respective folders.
Why the other options are wrong
- B. While Shared VPC could work, it requires more operational overhead and does not leverage the folder-level policy capabilities designed for this use case.
- C. Creating rules in all individual VPCs is not scalable and violates the requirement for a scalable and consistent approach.
- D. Anthos Config Connector is for managing resources through Kubernetes and is overkill for simple firewall rule enforcement at the folder level.
Question 62
You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial-of-service and application layer (layer 7) attacks. What should you do?
Show answer and explanation
Correct answer: B. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.
Google Cloud Armor is a Web Application Firewall (WAF) that operates at layer 7 and is specifically designed to protect against DDoS attacks and application-layer threats. Attaching it to the backend service of an HTTP(S) load balancer secures the application with rules that can detect and block malicious traffic patterns before they reach the instances.
Why the other options are wrong
- A. VPC Service Controls manages data access within the Google Cloud ecosystem but does not provide DDoS or layer 7 attack protection for public-facing applications.
- C. VPC firewall rules operate at layer 3/4 and cannot detect or block application-layer (layer 7) attacks that require WAF capabilities.
- D. Hierarchical firewall rules protect at the network layer but lack the application intelligence needed to defend against layer 7 attacks and DDoS patterns.
Question 63
You want to configure a NAT to perform address translation between your on-premises network blocks and GCP. Which NAT solution should you use?
Show answer and explanation
Correct answer: A. Cloud NAT
Cloud NAT is the managed GCP service designed to perform network address translation between on-premises networks and GCP resources. It handles address translation automatically without requiring manual configuration of instances or iptables rules, and is the standard, supported solution for this use case.
Why the other options are wrong
- B. Using an instance with IP forwarding requires manual configuration and management rather than using the managed Cloud NAT service.
- C. DNAT rules translate destination addresses, not the source addresses needed for on-premises to GCP translation in this scenario.
- D. While SNAT rules do translate source addresses, manually configuring iptables is inefficient and unmaintainable compared to the Cloud NAT managed service.
Question 64
Your company's security team tends to use managed services when possible. You need to build a dashboard to show the number of deny hits that occur against configured firewall rules without increasing operational overhead. What should you do?
Show answer and explanation
Correct answer: A. Configure Firewall Rules Logging. Use Firewall Insights to display the number of hits.
Firewall Rules Logging captures deny hits, and Firewall Insights is a managed Google Cloud service that automatically analyzes firewall logs to display insights including the number of deny hits without requiring additional operational overhead. This is the managed service approach preferred by security teams.
Why the other options are wrong
- B. While Cloud Logging and Cloud Monitoring can be used together, this requires manual dashboard creation and management, increasing operational overhead compared to the built-in Firewall Insights feature.
- C. Deploying a third-party firewall appliance from the Marketplace adds operational complexity and overhead, contradicting the requirement to use managed services.
- D. Packet Mirroring and IDS appliances require significant manual configuration and operational overhead; this approach does not leverage managed services.
Question 65
You have a web application that is currently hosted in the us-central1 region. Users experience high latency when traveling in Asia. You've configured a network load balancer, but users have not experienced a performance improvement. You want to decrease the latency. What should you do?
Show answer and explanation
Correct answer: B. Configure an HTTP load balancer, and direct the traffic to it.
An HTTP(S) load balancer with Cloud CDN and multi-region backends provides geographical distribution and traffic steering to reduce latency for users in Asia. A network load balancer operates at Layer 4 and cannot perform intelligent geographical routing. Policy-based routes and dynamic routing operate at the network layer and cannot reduce application latency caused by distance. DNS TTL adjustments only affect DNS resolution timing, not application latency.
Why the other options are wrong
- A. Policy-based routes prioritize traffic within a network but do not reduce latency from geographic distance.
- C. Dynamic Routing optimizes path selection within your network infrastructure, not geographic distribution of application instances.
- D. DNS TTL settings control how often DNS records refresh but do not reduce latency between users and application servers.
Question 66
You have a Cloud Storage bucket in Google Cloud project XYZ. The bucket contains sensitive data. You need to design a solution to ensure that only instances belonging to VPCs under project XYZ can access the data stored in this Cloud Storage bucket. What should you do?
Show answer and explanation
Correct answer: B. Configure a VPC Service Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter.
VPC Service Controls creates a perimeter around project XYZ and restricts access to Cloud Storage (storage.googleapis.com) only from authorized VPCs within that perimeter. This prevents any instances or users outside the perimeter from accessing the bucket, effectively ensuring only instances in project XYZ's VPCs can reach the data. This is the most robust solution for enforcing network-based access control.
Why the other options are wrong
- A. Private Google Access enables private IP access but does not restrict which VPCs can access the service; it applies within a VPC but doesn't prevent cross-project access.
- C. ACLs based on project team roles are identity-based, not network-based, and do not restrict access to only instances in the project's VPCs.
- D. Private Service Connect creates private connectivity but without additional controls does not inherently restrict access to only project XYZ's instances.
Question 67
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC. How should you configure the Distribution VPC?
Show answer and explanation
Correct answer: B. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
When peering two VPCs, their CIDR ranges must not overlap. The Retail VPC in auto mode uses 10.0.0.0/9 by default. The Distribution VPC must use a non-overlapping range; 10.128.0.0/9 is the complementary range that provides adequate space without conflict. Creating Distribution in custom mode allows precise CIDR control, and custom mode also allows more flexible subnet creation compared to auto mode.
Why the other options are wrong
- A. Two auto mode VPCs both attempt to use 10.0.0.0/9, creating CIDR range overlap that prevents successful peering.
- C. While 10.128.0.0/9 is the correct CIDR range, this option incorrectly states it should be used with auto mode; custom mode is required for this range assignment.
- D. Renaming the default VPC does not provide control over CIDR ranges and doesn't solve the overlap problem with the Retail VPC.
Question 68
Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to and from Compute Engine instances. Which two products should you incorporate into the solution? (Choose two.)
Show answer and explanation
Correct answer: A, B. VPC flow logs; Firewall logs
VPC flow logs capture network traffic data for all instances in a VPC, providing visibility into traffic patterns and connections to and from Compute Engine instances. Firewall logs record denied and allowed connections through firewall rules, giving the Security team detailed insight into traffic filtering decisions. Together, these two products provide comprehensive traffic monitoring capabilities for security analysis. Cloud Audit logs track API calls and administrative changes rather than network traffic, Stackdriver Trace monitors application latency, and instance system logs are for OS-level events, none of which directly monitor network traffic to and from instances.
Why the other options are wrong
- C. Cloud Audit logs track API and administrative actions, not the actual network traffic to and from Compute Engine instances.
- D. Stackdriver Trace monitors application performance and latency, not network traffic monitoring.
- E. Compute Engine instance system logs contain OS-level events and metrics, not network traffic data between instances and external systems.
Question 69
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead. How should you design the topology?
Show answer and explanation
Correct answer: C. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
Everything must live in a single project, so each department gets its own VPC as a separate network administrative domain. VPC Network Peering connects the two departments that need to talk with no gateways to manage, and the third VPC simply stays unpeered and isolated.
Why the other options are wrong
- A. Shared VPC needs a host project and separate service projects, which conflicts with the single project requirement and centralises network administration.
- B. Cloud VPN between VPCs adds gateways, tunnels and cost, so it has more operational overhead than peering.
- D. Firewall rules and tags inside one network do not create separate network administrative domains.
Question 70
Your company has 10 separate Virtual Private Cloud (VPC) networks, with one VPC per project in a single region in Google Cloud. Your security team requires each VPC network to have private connectivity to the main on-premises location via a Partner Interconnect connection in the same region. To optimize cost and operations, the same connectivity must be shared with all projects. You must ensure that all traffic between different projects, on-premises locations, and the internet can be inspected using the same third-party appliances. What should you do?
Show answer and explanation
Correct answer: D. Configure the third-party appliances with multiple interfaces. Create a hub VPC network for all projects, and create separate VPC networks for on-premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks. Use VPC Network Peering to connect all projects’ VPC networks to the hub VPC. Export custom routes from the hub VPC and import on all projects’ VPC networks.
To share a single Partner Interconnect connection across 10 separate VPCs while inspecting all traffic through the same third-party appliances, you need a hub-and-spoke topology. Create a hub VPC with interfaces to both the on-premises and internet connectivity VPCs, connect the appliances there, then use VPC Network Peering to connect all 10 project VPCs to the hub. Export and import custom routes across the peered networks to direct traffic through the hub for inspection. This centralized approach minimizes cost and operational complexity while ensuring all traffic flows through the same appliances.
Why the other options are wrong
- A. Configuring multiple VLAN attachments per project is complex and does not provide centralized traffic inspection across all projects.
- B. Connecting appliances directly to each of 10 VPCs requires 10+ interfaces and is operationally complex and expensive.
- C. Consolidating all projects into a single VPC loses project isolation and does not meet the requirement of having separate VPCs per project.
Question 71
You have created a firewall with rules that only allow traffic over HTTP, HTTPS, and SSH ports. While testing, you specifically try to reach the server over multiple ports and protocols; however, you do not see any denied connections in the firewall logs. You want to resolve the issue. What should you do?
Show answer and explanation
Correct answer: D. Create an explicit Deny Any rule and enable logging on the new rule.
Creating an explicit Deny Any rule with logging enabled captures denied traffic that would otherwise be silently dropped by the implicit deny-all rule. The implicit default deny rule at priority 65535 does not log by default. By creating an explicit deny rule at a lower priority (e.g., 65534) with logging enabled, all rejected traffic becomes visible in firewall logs, allowing you to verify that non-SSH traffic is properly being denied.
Why the other options are wrong
- A. The default deny rule cannot be modified to enable logging; it must be explicitly created as a new rule.
- B. Logging on VM instances does not capture firewall-level denials; firewall logs are required to see denied packets.
- C. A logging sink for firewall logs with no filters would show the same information as before (mostly allowed traffic); it doesn't enable logging on the implicit deny rule.
Question 72
You want to use Cloud Interconnect to connect your on-premises network to a GCP VPC. You cannot meet Google at one of its point-of-presence (POP) locations, and your on-premises router cannot run a Border Gateway Protocol (BGP) configuration. Which connectivity model should you use?
Show answer and explanation
Correct answer: D. Partner Interconnect with a layer 3 partner
Partner Interconnect with a layer 3 partner allows the partner to handle BGP configuration on their equipment, eliminating the requirement that your on-premises router support BGP directly. The layer 3 partner manages the BGP peering while you connect through their network, solving both the POP proximity and BGP requirement constraints.
Why the other options are wrong
- A. Direct Peering requires you to meet Google at POPs and handle your own BGP configuration.
- B. Dedicated Interconnect requires meeting at Google POPs, which you cannot do.
- C. Partner Interconnect with a layer 2 partner only provides layer 2 connectivity and still requires BGP configuration at your end.
Question 73
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly. How should you configure the health check?
Show answer and explanation
Correct answer: C. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
Pointing the health check at a dedicated request path and setting the response field makes it pass only when the returned body contains the expected string. This confirms that the backend application is actually working and responding correctly, not just returning a status code.
Why the other options are wrong
- A. PROXY_V1 adds a proxy protocol header and does nothing to confirm that the backend responds properly.
- B. A custom host header only changes the request and does not check the content of the backend's response.
- D. Without a request path or expected response, this configuration does not verify that the application is responding correctly.
Question 74
Your company’s on-premises network is connected to a VPC using a Cloud VPN tunnel. You have a static route of 0.0.0.0/0 with the VPN tunnel as its next hop defined in the VPC. All internet bound traffic currently passes through the on-premises network. You configured Cloud NAT to translate the primary IP addresses of Compute Engine instances in one region. Traffic from those instances will now reach the internet directly from their VPC and not from the on-premises network. Traffic from the virtual machines (VMs) is not translating addresses as expected. What should you do?
Show answer and explanation
Correct answer: C. Add a default static route to the VPC with the default internet gateway as the next hop, the network tag associated with the Compute Engine instances, and a higher priority than the priority of the default route to the VPN tunnel.
Cloud NAT requires traffic to be routed through the default internet gateway to function properly. Because a static route with 0.0.0.0/0 pointing to the VPN tunnel exists with default priority, all traffic is being routed to the VPN tunnel before it can reach Cloud NAT. To fix this, you must add another default static route pointing to the default internet gateway with a higher priority value (lower priority number), targeted at the Compute Engine instances via network tags. This ensures their traffic reaches Cloud NAT instead of the VPN.
Why the other options are wrong
- A. Adjusting TCP timeouts does not solve the fundamental routing problem causing traffic to go to the VPN instead of NAT.
- B. Firewall rules cannot override routing decisions; the traffic must reach NAT first through proper routing.
- D. Adjusting min-ports-per-vm is a scaling consideration that does not address the routing issue preventing NAT from functioning.
Question 75
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem. What should you do?
Show answer and explanation
Correct answer: A. Configure VPC peering in a full mesh.
VPC peering is not transitive, traffic cannot flow through a peered VPC to reach another peered VPC. In a three-VPC scenario with Sales, Marketing, and Finance, peering Sales-Finance and Marketing-Finance does not allow Sales and Marketing to communicate. To enable full connectivity between all three VPCs, you must establish VPC peering in a full mesh topology: Sales-Marketing, Sales-Finance, and Marketing-Finance. This creates direct peering relationships between each pair of VPCs. Routing tables cannot bridge non-peered networks, network tags control firewall rules not peering, and recreating networks does not change peering behavior.
Why the other options are wrong
- B. Routing tables cannot create transitive connectivity between non-peered VPCs; asymmetric routing is not the root cause of this VPC peering limitation.
- C. Network tags are used for firewall rule organization, not for establishing network connectivity between VPCs.
- D. Legacy networks are not relevant to this scenario, and recreating networks does not enable transitive peering, which is an architectural limitation of VPC peering.
Question 76
You created a new VPC for your development team. You want to allow access to the resources in this VPC via SSH only. How should you configure your firewall rules?
Show answer and explanation
Correct answer: C. Create a single firewall rule to allow port 22 with priority 1000.
A single firewall rule allowing port 22 (SSH) with priority 1000 is sufficient to permit only SSH access. VPC firewall rules in GCP operate with an implicit deny-all default rule at priority 65535, so creating an explicit allow rule for port 22 automatically denies all other traffic. Additional rules are unnecessary and add complexity. Port 3389 is RDP for Windows, not SSH.
Why the other options are wrong
- A. Priority 0 is invalid (valid range is 0-65535, with 0 being highest); creating redundant rules is unnecessary when implicit deny-all exists.
- B. Priority 65535 is the lowest priority (would be overridden by default rules); port 3389 is RDP, not SSH.
- D. Port 3389 is RDP for Windows systems, not SSH which uses port 22.
Question 77
In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full crosscommunication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost. Which two steps should you take? (Choose two.)
Show answer and explanation
Correct answer: B, D. Connect the VPCs in project code-dev and data-dev using VPC Network Peering; Enable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances in project data-dev, and vice versa.
VPC Network Peering (B) is the most cost-effective solution for full cross-communication between two VPCs in different projects without intermediaries. It provides direct connectivity at no cost and requires only firewall rules (D) to permit traffic between the subnets in both projects. This approach maintains full departmental control over each VPC without shared VPC constraints. Cloud VPN adds unnecessary cost and latency, while Shared VPC would compromise departmental autonomy.
Why the other options are wrong
- A. Cloud VPN adds latency and cost compared to direct VPC peering for same-region connectivity.
- C. Shared VPC would require one department to relinquish control of its network resources to the host project, violating the requirement for each department to maintain full control.
- E. Manual routes with default gateway as next-hop are not the appropriate solution; VPC peering automatically exchanges routes between peered VPCs.
Question 78
You recently deployed Compute Engine instances in regions us-west1 and us-east1 in a Virtual Private Cloud (VPC) with default routing configurations. Your company security policy mandates that virtual machines (VMs) must not have public IP addresses attached to them. You need to allow your instances to fetch updates from the internet while preventing external access. What should you do?
Show answer and explanation
Correct answer: A. Create a Cloud NAT gateway and Cloud Router in both us-west1 and us-east1.
Cloud NAT with Cloud Router must be created in each region where instances exist (us-west1 and us-east1) to provide outbound internet access without public IPs. Each regional Cloud Router manages NAT for its region's instances, allowing them to fetch updates while remaining without external IP addresses and preventing inbound external access.
Why the other options are wrong
- B. Cloud NAT and Cloud Router operate at the regional level; a single global instance cannot serve multiple regions.
- C. Assigning ephemeral public IPs directly violates the security policy requiring that VMs must not have public IP addresses.
- D. A firewall rule allowing egress does not provide internet access; instances still need Cloud NAT to translate private IPs for external communication.
Question 79
You recently configured Google Cloud Armor security policies to manage traffic to your application. You discover that Google Cloud Armor is incorrectly blocking some traffic to your application. You need to identity the web application firewall (WAF) rule that is incorrectly blocking traffic. What should you do?
Show answer and explanation
Correct answer: B. Enable HTTP(S) Load Balancing logging with sampling rate equal to 1, and view the logs in Cloud Logging.
HTTP(S) Load Balancing logs with a sampling rate of 1 (100% sampling) capture all requests processed by the load balancer, including those blocked by Cloud Armor policies. These logs in Cloud Logging show which specific WAF rules are matching and blocking traffic, allowing identification of incorrectly configured rules.
Why the other options are wrong
- A. Firewall Insights analyzes VPC firewall rules, not Google Cloud Armor policies, which operate at the load balancer level.
- C. VPC Flow Logs track traffic at the network layer but do not capture application-layer decisions made by Cloud Armor.
- D. Activity page logs administrative changes to policies but does not show runtime traffic decisions or which rules are blocking specific requests.
That was 79 of 316.
The full Google Professional Cloud Network Engineer pack has all 316 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 111 free as one PDF by email. Get the Half Pack →