Google Cloud Professional Cloud Network Engineer

Question 1

A retail company started with a single auto-mode VPC that automatically created a /20 subnet in every Google Cloud region. As they expand globally and plan to add many custom subnets, peer with a partner VPC, and tightly control IP address allocation per region, the network team is concerned about the fixed 10.128.0.0/9 range auto mode uses and the risk of overlap with the partner. What is the recommended approach to gain full control of subnet CIDR planning while preserving existing workloads?

Accepted Answer

Convert the auto-mode VPC to custom mode, then manually manage all subnet ranges going forward

Answer

Delete the auto-mode VPC and recreate all resources in a brand-new custom-mode VPC

Answer

Enable a hierarchical firewall policy to override the auto-mode subnet ranges

Answer

Add secondary IP ranges to each auto-created subnet to replace the primary ranges

Question 2

You are designing a new production VPC for a retail company. The network must connect to two on-premises data centers via HA VPN, and the on-premises teams have already allocated the 10.128.0.0/9 range for their infrastructure. The cloud team wants precise control over which regions have subnets and the exact CIDR ranges used, to avoid any overlap with on-premises addressing. Which VPC design should you choose?

Accepted Answer

Create a custom mode VPC and manually define subnets only in the regions you need with non-overlapping CIDR ranges.

Answer

Create an auto mode VPC so subnets are automatically provisioned in every region with predefined ranges.

Answer

Create an auto mode VPC and rely on custom routes to prevent overlap with the on-premises 10.128.0.0/9 range.

Answer

Create a custom mode VPC but let Google auto-assign secondary ranges to guarantee no overlap.

Question 3

You are designing a new production VPC for a company that will initially deploy workloads in us-central1 and europe-west1, with plans to add three more regions over the next two years. The network team requires strict control over which subnet CIDR ranges exist in each region and wants to avoid any automatically created subnets that could later overlap with on-premises ranges reachable over Cloud Interconnect. Which VPC design best meets these requirements?

Accepted Answer

Create a custom mode VPC and manually define subnets with explicitly chosen CIDR ranges only in the regions you intend to use.

Answer

Create an auto mode VPC, then delete the subnets in unused regions to prevent CIDR overlap with on-premises networks.

Answer

Create an auto mode VPC because it automatically assigns non-overlapping ranges and later convert it to custom mode when adding regions.

Answer

Create a custom mode VPC and enable auto-subnet creation so new regions receive predefined 10.128.0.0/9 ranges as they launch.

Question 4

Your company runs a Classic VPN gateway connecting its on-premises data center to a Google Cloud VPC. The Classic VPN uses static routes and a single tunnel. Leadership now requires a 99.99% availability SLA for this hybrid connection. Which approach correctly migrates the connectivity to meet the SLA requirement?

Accepted Answer

Deploy an HA VPN gateway with two interfaces, configure two tunnels to two separate on-premises peer devices (or a single device with two interfaces), and establish BGP sessions through a Cloud Router.

Answer

Add a second static-route tunnel to the existing Classic VPN gateway and enable ECMP so both tunnels carry traffic simultaneously.

Answer

Upgrade the Classic VPN gateway to enable dynamic routing with a Cloud Router while keeping the single tunnel, since BGP alone provides the 99.99% SLA.

Answer

Deploy an HA VPN gateway with a single tunnel to one on-premises peer device and configure a Cloud Router with BGP for automatic failover.

Question 5

A retail company runs a public storefront behind a global external Application Load Balancer with a Cloud Armor security policy attached to the backend service. During a flash sale, the site experiences a sudden surge of HTTP requests that appear to originate from thousands of distinct IP addresses with subtly varied request patterns, overwhelming the backends. The security team cannot manually author rate-limit or IP-deny rules fast enough to keep pace with the shifting attack signatures. Which Cloud Armor capability should they enable to automatically detect and generate a suggested mitigation rule for this Layer 7 volumetric attack?

Accepted Answer

Enable Adaptive Protection on the Cloud Armor security policy so it baselines normal traffic and auto-generates a suggested rule to mitigate the anomalous Layer 7 attack.

Answer

Configure a preconfigured WAF rule using the OWASP ModSecurity Core Rule Set (CRS) to block the SQL injection signatures in the requests.

Answer

Attach a rate-limiting throttle rule keyed on a single named IP address list containing the known attacker ranges.

Answer

Enable edge security policies with a country-based geo-match deny rule to block the source region generating the traffic.

Question 6

Your company serves static assets from a Cloud Storage backend bucket behind a global external Application Load Balancer with Cloud CDN enabled. Security wants to block requests from a list of known malicious IP ranges as early as possible—ideally at Google's edge and even for cached content served by CDN—before those requests reach the backend bucket or consume cache resources. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Attach an edge security policy to the backend bucket with deny rules matching the malicious IP ranges

Answer

Attach a backend security policy to the backend bucket with deny rules matching the malicious IP ranges

Answer

Configure a hierarchical firewall policy at the organization level to deny the malicious IP ranges

Answer

Add a VPC network firewall rule denying the malicious IP ranges on the load balancer's forwarding rule

Question 7

Your security team wants to allow a large SaaS partner's published IP ranges to reach your global external Application Load Balancer while blocking all other source IPs. The partner distributes their egress ranges as a curated list that Google maintains and updates automatically. You must implement this in a Cloud Armor security policy with minimal ongoing maintenance and without exceeding rule limits from listing hundreds of individual CIDRs. Which approach should you use?

Accepted Answer

Create a Cloud Armor security-policy rule whose match expression references the partner named IP address list (address-group / named IP list), set the rule action to allow, and add a default deny rule at the lowest priority.

Answer

Add every partner CIDR block as separate allow rules in the Cloud Armor policy and rely on rule priority to deny remaining traffic.

Answer

Configure a VPC firewall rule with the partner CIDRs as source ranges and attach it to the load balancer backend instances.

Answer

Enable Cloud Armor Adaptive Protection so it automatically learns and allowlists the partner's traffic patterns.

Question 8

A retail company runs a public web application behind a global external Application Load Balancer, protected by a Cloud Armor security policy. The security team enables the preconfigured SQL injection (sqli-v33-stable) WAF rule at its default sensitivity. Immediately, legitimate users report that they can no longer submit product reviews containing text like "O'Brien's shop is great", and logs show these requests are being blocked by the sqli rule. The team must keep strong SQLi protection but stop blocking valid review submissions. What is the most appropriate action?

Accepted Answer

Lower the preconfigured sqli rule sensitivity level and/or exclude the specific request field (the review body) from inspection using the rule's opt-out expression, then retest.

Answer

Delete the sqli-v33-stable rule entirely and rely on Adaptive Protection to detect any injection attempts automatically.

Answer

Add a higher-priority allow rule that matches all requests to the review submission URL path, bypassing WAF evaluation for that path.

Answer

Switch the security policy to preview (dry-run) mode so the sqli rule logs matches but never blocks any traffic.

Question 9

You manage a Google Cloud Armor security policy attached to a global external Application Load Balancer serving a production e-commerce site. Your security team wants to introduce a new WAF rule that blocks requests matching a broad regular expression, but they are concerned it may inadvertently block legitimate customer traffic. They need to evaluate the real-world impact of the rule against live production traffic before it actually starts denying any requests. What should you configure?

Accepted Answer

Add the rule with the '--preview' flag enabled so matches are logged in Cloud Logging without enforcing the deny action.

Answer

Add the rule with action 'deny(403)' but set the rule to a lower priority than the default rule so it is never evaluated first.

Answer

Deploy the rule in a separate Cloud Armor edge security policy and monitor Adaptive Protection alerts before promoting it.

Answer

Enable Cloud Armor rate limiting in 'throttle' mode so the rule only restricts a percentage of matching requests during testing.

Question 10

An e-commerce company runs a public web application behind a global external Application Load Balancer protected by Google Cloud Armor. During flash sales, individual clients sometimes send bursts of requests to the /api/checkout path, degrading the backend for everyone. The security team wants to allow legitimate traffic to continue but automatically throttle any single client IP that exceeds 100 requests per minute to that path, without permanently blocking the client. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Create a throttle rule with rate_limit_options specifying a count of 100 per 60-second interval and enforce_on_key set to IP, matching requests to /api/checkout.

Answer

Create a rate-based ban rule with action 'deny(429)' that permanently blocks clients exceeding the threshold.

Answer

Enable Adaptive Protection on the security policy so it automatically learns and mitigates the traffic burst.

Answer

Configure Cloud NAT with a reduced minimum ports-per-VM setting to limit the number of concurrent client connections.

Question 11

A media company serves images through a global external Application Load Balancer with Cloud CDN enabled and cache mode set to CACHE_ALL_STATIC. An editor replaces the file at /assets/hero.jpg with corrected artwork, but users worldwide continue to receive the old image because it is still cached at Google's edge locations with a long TTL. The team needs the corrected image served immediately without waiting for the TTL to expire, and they want to minimize disruption to other cached content. What should they do?

Accepted Answer

Issue a Cloud CDN cache invalidation for the path /assets/hero.jpg on the backend service.

Answer

Disable Cloud CDN on the backend service and re-enable it to clear all cached objects.

Answer

Change the cache mode to USE_ORIGIN_HEADERS so the edge caches respect the origin's freshness.

Answer

Lower the default TTL on the backend service so the object expires from cache sooner.

Question 12

A media company hosts static images and CSS/JS bundles on a Cloud Storage bucket fronted by a global external Application Load Balancer with Cloud CDN enabled. The origin responses do NOT include any Cache-Control headers. The team wants Cloud CDN to cache as much of this static content as possible without requiring the developers to modify origin headers, while still respecting any explicit no-cache directives if they are added later. Which Cloud CDN cache mode should they configure?

Accepted Answer

CACHE_ALL_STATIC, which caches successful responses for common static content types even without cache headers, but honors explicit no-cache directives

Answer

USE_ORIGIN_HEADERS, so caching only occurs when the origin explicitly sets caching headers

Answer

FORCE_CACHE_ALL, which caches all successful responses and ignores any origin cache directives

Answer

BYPASS_CACHE, which forwards all requests to the origin without caching

Question 13

Your company hosts a large library of static marketing assets (images, PDFs, videos) in a Cloud Storage bucket. You want to serve these assets globally with low latency and caching, using a global external Application Load Balancer with Cloud CDN enabled. The team wants the simplest configuration that requires no compute instances and lets Cloud CDN cache directly from the bucket. Which backend configuration should you use?

Accepted Answer

Create a backend bucket that references the Cloud Storage bucket and enable Cloud CDN on the backend bucket.

Answer

Create a backend service with a managed instance group of NGINX proxies that read from the bucket, then enable Cloud CDN on the backend service.

Answer

Create an internet network endpoint group (NEG) pointing to storage.googleapis.com and attach it to a backend service with Cloud CDN.

Answer

Create a serverless NEG backed by a Cloud Run service that streams objects from the bucket, then enable Cloud CDN.

Question 14

Your team runs a global external Application Load Balancer with Cloud CDN enabled in CACHE_ALL_STATIC mode fronting a backend service. During a recent origin outage, clients received many HTTP 404 and 5xx responses. You notice these error responses are being cached at the edge with default TTLs, and stale 404s continued to be served to users even after the objects were restored on the origin. You want to keep error responses out of the cache (or minimize how long they are cached) while retaining normal caching for successful static content. What should you configure?

Accepted Answer

Enable negative caching on the backend service and set a negative caching policy that assigns a TTL of 0 to the specific supported negative-caching status codes (such as 404 and 410) rather than general 5xx status codes.

Answer

Switch the cache mode to USE_ORIGIN_HEADERS so that only responses with explicit Cache-Control headers are cached.

Answer

Issue a cache invalidation with the path /* every time the origin returns an error response.

Answer

Set the default TTL and max TTL on the backend service to 0 to prevent any responses from being cached.

Question 15

A media streaming company uses an external Application Load Balancer with Cloud CDN enabled to deliver video content stored in a Cloud Storage backend bucket. Each video is segmented into hundreds of individual files (manifests and chunks) that must all be protected so only paying subscribers can access them. The company wants to authorize access to an entire set of files with a single authorization step per user session, rather than issuing a separate token for every file. Which Cloud CDN access-control mechanism should they use?

Accepted Answer

Signed cookies, scoped to a URL prefix covering all the video's files

Answer

Signed URLs, generating one signed URL per video segment file

Answer

IAM policies on the backend bucket granting subscribers the objectViewer role

Answer

A Google-managed SSL certificate attached to the load balancer's target proxy

Question 16

A media company serves premium video files from a Cloud Storage bucket that is configured as a backend bucket behind a global external Application Load Balancer with Cloud CDN enabled. The company wants to ensure that only paying subscribers can download individual video files, and each access grant must automatically expire after a short time window. They do not want to modify the client application to send custom authentication headers, and access should be enforced at the CDN edge before the origin is contacted. Which approach should they implement?

Accepted Answer

Configure Cloud CDN signed URLs by adding a signed URL key to the backend bucket and generating time-limited signed URLs for each authorized request.

Answer

Set the Cloud CDN cache mode to USE_ORIGIN_HEADERS and rely on the bucket's IAM policy to grant temporary access to subscribers.

Answer

Enable Identity-Aware Proxy (IAP) on the backend bucket so that users must authenticate with Google credentials before downloading files.

Answer

Create a Cloud Armor security policy that allows requests only from subscriber IP ranges and attach it to the backend bucket.

Question 17

A financial services company hosts its public domain 'example-bank.com' in a Cloud DNS public managed zone. Security auditors require protection against DNS cache poisoning and spoofing so that resolvers can cryptographically validate the authenticity of DNS responses. What should the network engineer do?

Accepted Answer

Enable DNSSEC on the public managed zone and add the DS record to the domain registrar

Answer

Configure a DNS forwarding zone that routes queries through Google Public DNS at 8.8.8.8

Answer

Enable DNSSEC on a private managed zone and configure split-horizon DNS for the domain

Answer

Create signed URLs for the DNS records and distribute the signing keys to trusted resolvers

Question 18

Your company runs an internal application in a Google Cloud VPC. Applications on Compute Engine instances must resolve hostnames in the internal domain 'corp.example.internal', which is managed by DNS servers running in your on-premises data center reachable over an existing HA VPN connection (private IP 10.20.0.53). Google Cloud must send queries for this domain to the on-premises resolver, but all other queries should continue to use Google's default resolution. What should you configure in Cloud DNS?

Accepted Answer

Create a Cloud DNS forwarding zone for 'corp.example.internal' with forwarding targets set to the on-premises resolver IP 10.20.0.53.

Answer

Create a private managed zone for 'corp.example.internal' with DNSSEC enabled and add A records manually for each on-premises host.

Answer

Create a DNS peering zone for 'corp.example.internal' that peers with the on-premises DNS servers over the HA VPN.

Answer

Enable inbound DNS forwarding by creating an inbound server policy so on-premises servers can query Cloud DNS for 'corp.example.internal'.

Question 19

A retailer runs workloads in a Google Cloud VPC and maintains a large on-premises data center connected via HA VPN. Applications in the VPC must resolve private hostnames hosted by the on-premises Microsoft AD DNS servers, and on-premises clients must resolve records for private Cloud DNS zones used by the cloud workloads. The team wants a fully managed solution without deploying and maintaining DNS proxy VMs in Google Cloud. Which Cloud DNS configuration should they implement?

Accepted Answer

Create a Cloud DNS private zone with forwarding to the on-premises servers, and configure a Cloud DNS server policy that enables inbound DNS forwarding so on-premises clients query the assigned inbound forwarder IPs.

Answer

Deploy DNS forwarder VM instances in the VPC that relay queries in both directions and point both environments at these instances.

Answer

Use Cloud DNS peering between the VPC and the on-premises DNS servers so records are exchanged bidirectionally.

Answer

Configure a single Cloud DNS public managed zone and enable DNSSEC so both environments resolve each other's records over the internet.

Question 20

A retail company runs an internal application in a Google Cloud VPC. The same hostname, app.retail.internal, must resolve to a private RFC 1918 address for clients inside the VPC, but to a public-facing external IP for clients querying from the internet. The DNS team wants a Google-managed solution that avoids maintaining separate hostnames and works without deploying custom DNS servers. Which Cloud DNS approach should they implement?

Accepted Answer

Create a Cloud DNS private zone and a separate public managed zone, both named for a domain you own such as corp.retailexample.com, and add differing A records for app.corp.retailexample.com in each — using Cloud DNS split-horizon (response policy is not required).

Answer

Create a single public managed zone with two A records for app.retail.internal and rely on Cloud DNS to return the private record only to internal VPC clients.

Answer

Deploy BIND on a Compute Engine instance to serve split-horizon views, and point the VPC's DNS server policy to that instance.

Answer

Use Cloud DNS DNS peering to forward app.retail.internal queries from the VPC to the public zone while internet clients query the public zone directly.

Question 21

A financial services company is designing a Dedicated Interconnect connection between their on-premises data center and Google Cloud. A compliance requirement mandates that all traffic traversing the physical link between their edge router and Google's peering edge must be encrypted at Layer 2. The design must minimize latency overhead and avoid tunnel-based encryption. Which approach should the network engineer choose?

Accepted Answer

Enable MACsec for Cloud Interconnect on the Dedicated Interconnect connection

Answer

Deploy HA VPN tunnels over the Dedicated Interconnect using IPsec encryption

Answer

Configure Cloud Interconnect with private Google Access and rely on Google's default in-transit encryption

Answer

Use Partner Interconnect and request the connectivity provider to encrypt the VLAN attachment

Question 22

You operate a production VPC connected to on-premises via HA VPN. Last week a tunnel went down for 40 minutes before anyone noticed, causing an outage. The network team wants to be paged immediately whenever any VPN tunnel loses its BGP session or drops. Using Google Cloud Observability, what is the most appropriate way to implement this proactive notification?

Accepted Answer

Create a Cloud Monitoring alerting policy on the VPN Gateway metric 'vpn.googleapis.com/tunnel_established' (and/or the BGP session state metric) with a notification channel that pages the on-call team.

Answer

Enable VPC Flow Logs on the subnets behind the VPN and build a Logs-based metric that counts dropped packets, then alert when the count exceeds zero.

Answer

Schedule a recurring Connectivity Test every 5 minutes against the on-premises endpoint and email the results to the team.

Answer

Enable Firewall Rules Logging on the VPN traffic and create a dashboard that the NOC reviews hourly for tunnel status.

Question 23

Your company runs a fleet of Compute Engine VMs without external IP addresses in a subnet that uses Cloud NAT for internet egress. A SaaS partner requires that all outbound requests to their API originate from a small, fixed set of source IP addresses that you must provide to them for allowlisting. Currently the Cloud NAT gateway is configured with automatic NAT IP address allocation. What should you do to meet the partner's requirement while continuing to allow egress?

Accepted Answer

Reconfigure the Cloud NAT gateway to use manual NAT IP address allocation with reserved static external IP addresses, then share those addresses with the partner.

Answer

Assign ephemeral external IP addresses directly to each VM and remove the Cloud NAT gateway so traffic egresses with predictable addresses.

Answer

Keep automatic NAT IP allocation and enable Dynamic Port Allocation so the same IP addresses are always reused for the partner's traffic.

Answer

Create an egress VPC firewall rule that rewrites the source IP of outbound packets to a fixed address before they leave the gateway.

Question 24

A fleet of 200 instances in a private subnet uses a single Cloud NAT gateway to reach an external payment API. During peak traffic, application logs show many outbound connections to the same API endpoint failing intermittently. Cloud Monitoring shows the 'dropped_sent_packets' metric for the NAT gateway spiking, while CPU and bandwidth on the instances remain low. What is the most likely cause and the correct remediation?

Accepted Answer

NAT port exhaustion because too few ports are allocated per VM for many connections to the same destination; increase minimum ports per VM or enable Dynamic Port Allocation.

Answer

The NAT gateway has reached its bandwidth limit; add a second Cloud NAT gateway in the same region to load-balance egress.

Answer

MTU mismatch on the egress path; lower the interface MTU to 1460 on all instances to prevent fragmentation drops.

Answer

The default route to the internet gateway was deleted; recreate the 0.0.0.0/0 route pointing to the default internet gateway.

Question 25

A financial services company runs Compute Engine VMs with no external IP addresses in a private subnet. The security team requires two things for internet egress: (1) all outbound HTTP/HTTPS traffic must be restricted to an approved list of FQDNs (e.g., only *.partnerbank.com and api.provider.net), and (2) any non-HTTP(S) egress that is still permitted must be source-NATed through a predictable set of static IP addresses so partners can allowlist them. What should you deploy to meet BOTH requirements with the least operational overhead?

Accepted Answer

Deploy Secure Web Proxy with a URL/FQDN allowlist policy for HTTP/HTTPS egress, and configure Cloud NAT with manually assigned static external IP addresses for the remaining permitted egress traffic.

Answer

Configure Cloud NAT with automatic IP allocation and add hierarchical firewall rules that match destination FQDNs to filter HTTP/HTTPS egress.

Answer

Deploy a self-managed NGINX proxy appliance with IP forwarding as the only egress path and rely on Cloud Armor named IP lists to restrict destinations.

Answer

Use VPC Service Controls perimeters to restrict egress to approved FQDNs and enable Private Google Access so VMs reach the internet through Google's front end.

Question 26

You configured an HA VPN tunnel between Google Cloud and an on-premises router. The tunnel status shows 'Established', but the BGP session on the Cloud Router remains in a state where routes are not being exchanged. You verify that the Cloud Router uses Google ASN 65001 and advertises subnet routes correctly. On the on-premises side, the peer is configured with ASN 65001 as its local ASN, and the BGP peer IP addresses fall within the same /30 link-local range you assigned in the BGP session configuration. What is the most likely cause of the BGP session failure?

Accepted Answer

The on-premises router and Cloud Router are both configured with ASN 65001, causing an unintended iBGP relationship instead of the expected eBGP peering.

Answer

HA VPN requires the Cloud Router to use a 4-byte ASN, so 65001 is invalid and must be replaced with a value above 65535.

Answer

The BGP peer IP addresses must be from a public IP range, not link-local (169.254.0.0/16), for the session to establish.

Answer

BGP route exchange only begins after Cloud Router is set to a custom advertisement mode; the default base mode blocks all route exchange.

Question 27

Your company runs an HA VPN connection between an on-premises data center and a Google Cloud VPC named prod-vpc. The Cloud Router uses BGP to exchange routes. The on-premises router currently learns the subnet ranges in prod-vpc. You have now enabled Private Google Access and want the on-premises hosts to also reach Google APIs through the tunnel using the restricted.googleapis.com range (199.36.153.4/30), which is NOT a subnet in your VPC. What is the correct way to make the on-premises router learn this range via BGP?

Accepted Answer

Switch the Cloud Router (or the BGP session) to custom route advertisement mode and add 199.36.153.4/30 as a custom advertised IP range.

Answer

Keep the Cloud Router in base advertisement mode; subnet routes and the restricted VIP range are advertised automatically.

Answer

Add a custom static route for 199.36.153.4/30 in prod-vpc, which the Cloud Router will automatically redistribute into BGP in base mode.

Answer

Enable route exchange via VPC Network Peering so the restricted VIP range propagates to the on-premises router.

Question 28

Your company runs an HA VPN connection between an on-premises data center and a Google Cloud VPC, using a Cloud Router with BGP. During periods of transient network latency on the WAN link, the BGP sessions repeatedly drop and re-establish, causing routes to flap and briefly interrupting traffic. The on-premises router administrator asks what BGP timer setting on the Cloud Router side you can adjust to make the session more tolerant of brief connectivity interruptions before it is declared down. What should you do?

Accepted Answer

Increase the BGP keepalive interval on the Cloud Router, which raises the effective hold timer and gives the session more time to recover before it is torn down

Answer

Enable Bidirectional Forwarding Detection (BFD) with the shortest possible interval to detect failures faster and prevent flapping

Answer

Lower the BGP keepalive interval on the Cloud Router so that keepalives are sent more frequently and the peer never times out

Answer

Set the Cloud Router ASN to match the on-premises ASN so the session becomes iBGP and uses a longer default hold time

Question 29

Your company runs a Cloud Router with a BGP session to an on-premises router over HA VPN. By default the Cloud Router advertises all subnets in the VPC. The network team now wants the Cloud Router to advertise only a single aggregate prefix (10.100.0.0/16) that summarizes several subnets, plus the range for a Private Google Access endpoint (199.36.153.8/30), while suppressing individual subnet advertisements. What should you configure on the Cloud Router?

Accepted Answer

Set the Cloud Router advertisement mode to custom, and add both 10.100.0.0/16 and 199.36.153.8/30 as custom IP ranges.

Answer

Keep the default (base) advertisement mode and add the two prefixes as custom routes on the BGP peer.

Answer

Set the advertisement mode to custom and enable 'Advertise all subnets' while adding 199.36.153.8/30 as a custom range.

Answer

Create custom static routes in the VPC for the two prefixes so the Cloud Router propagates them automatically.

Question 30

Your company has two Dedicated Interconnect connections in the same metropolitan area, each terminating on a different Google edge availability domain. You create one VLAN attachment on each connection, both associated with a single Cloud Router in the us-central1 region. Your on-premises router advertises the same on-premises prefix (10.50.0.0/16) over both BGP sessions with identical MED values, and both attachments have the same egress capacity. You want Google Cloud to distribute egress traffic toward on-premises across both VLAN attachments simultaneously. What must be true for Cloud Router to perform this load distribution?

Accepted Answer

The BGP sessions must advertise the on-premises prefix with equal MED values so Cloud Router installs equal-cost multipath (ECMP) routes across both attachments.

Answer

Each VLAN attachment must use a Cloud Router in a different region so ECMP can be applied across regional boundaries.

Answer

You must enable global dynamic routing mode on the VPC network, which forces traffic onto a single lowest-cost attachment.

Answer

You must configure a custom static route with equal priority pointing to each attachment, because Cloud Router does not support ECMP for dynamic routes.

Question 31

Your company has established an HA VPN gateway connecting a Google Cloud VPC to an on-premises data center. Two tunnels are up, each with its own BGP session on the same Cloud Router, and both peers advertise the identical on-premises prefix 10.50.0.0/16 with the same MED value. You want traffic from the VPC toward the on-premises network to be distributed across both tunnels simultaneously to maximize aggregate throughput. What must be true for the Cloud Router to program equal-cost multi-path (ECMP) routes across both tunnels?

Accepted Answer

The two BGP-learned routes for 10.50.0.0/16 must have identical route priority (derived from equal MED values), and both dynamic routes will be installed so traffic is load-shared via ECMP.

Answer

One tunnel must be configured with a lower MED so it becomes primary; ECMP only activates automatically when the primary tunnel's BGP session goes down.

Answer

You must enable a global routing mode on the VPC, because ECMP across VPN tunnels is only supported when Cloud Router advertises routes to all regions.

Answer

You must configure static routes with equal priority pointing to each tunnel, since Cloud Router does not perform ECMP for BGP-learned dynamic routes.

Question 32

A development team deploys a Cloud Run service that must call a backend running on a Compute Engine VM addressed only by its internal RFC 1918 IP inside a custom-mode VPC. The team wants the lowest-latency egress path with the least infrastructure to manage and the ability to scale out without provisioning a fixed pool of connector instances. Which configuration should they choose?

Accepted Answer

Enable Direct VPC egress on the Cloud Run service, attaching it to the target subnet in the VPC

Answer

Create a Serverless VPC Access connector sized with a fixed min/max instance range and route egress through it

Answer

Configure a Private Service Connect endpoint pointing at the VM's internal IP and route Cloud Run traffic to it

Answer

Deploy Cloud NAT and set the Cloud Run service egress to route all traffic through the NAT gateway

Question 33

A data engineering team runs a Cloud Run service that must reach a Cloud SQL instance and several Compute Engine VMs over private IPs in a custom-mode VPC. The service experiences bursty traffic that occasionally spikes to very high sustained egress throughput, and the team wants to minimize the operational overhead of managing throughput-limited infrastructure while keeping traffic on internal IP addresses. Which egress configuration should they choose?

Accepted Answer

Use Direct VPC egress, assigning the Cloud Run service to a subnet in the VPC

Answer

Use a Serverless VPC Access connector sized with the largest available machine type and manual scaling

Answer

Route egress through a Cloud NAT gateway attached to the VPC so Cloud Run reaches the private resources

Answer

Enable Private Google Access on the target subnet and let Cloud Run connect automatically

Question 34

Your company uses Network Connectivity Center with a single hub to interconnect four VPCs as VPC spokes for full-mesh transitive connectivity. You attempt to attach a fifth VPC as a spoke, but the operation fails. Investigation shows this new VPC contains a subnet with the CIDR range 10.20.0.0/24, which is identical to a subnet already present in one of the existing spoke VPCs. What is the most appropriate action to successfully attach the fifth VPC as a spoke?

Accepted Answer

Re-IP the overlapping subnet in the fifth VPC to a non-overlapping range before attaching it as a spoke, because NCC VPC spokes require unique subnet ranges across all spokes on the hub.

Answer

Enable the 'export custom routes' setting on the hub so that overlapping ranges are automatically deduplicated during spoke attachment.

Answer

Attach the fifth VPC using a group with the 'auto_accept' policy, which allows overlapping subnets by installing longest-prefix-match routes.

Answer

Create a Cloud Router in the fifth VPC and use custom route priorities (MED) so the overlapping subnet is preferred only within its own VPC.

Question 35

A workload on VM-A (subnet 10.0.1.0/24) cannot reach an internal passthrough Network Load Balancer VIP in another VPC connected via VPC peering. You run a Connectivity Test from VM-A to the VIP, and the test reports 'Reachable' for the forward path. However, actual application traffic still times out. You suspect an asymmetric routing or return-path problem. Which action within Network Intelligence Center best confirms the return-path issue?

Accepted Answer

Run a second Connectivity Test with the source and destination reversed (from the backend/VIP side toward VM-A) to evaluate the return path independently.

Answer

Increase the VPC Flow Logs sampling rate to 100% on VM-A's subnet and wait for the timeout to appear in logs.

Answer

Enable Firewall Rules Logging on VM-A's egress rule and confirm packets are being allowed outbound.

Answer

Review the Performance Dashboard for packet loss between the two Google Cloud regions hosting the VPCs.

Question 36

A network engineer at a retail company reports that VMs in a Google Cloud VPC cannot reach an on-premises subnet (10.50.0.0/24) that is connected via HA VPN and a Cloud Router using BGP. Traffic in the reverse direction (on-prem to Google Cloud) works fine. The engineer runs a Connectivity Test from a VM in the VPC to a host at 10.50.0.5, and the test result reports 'Route not found: no matching route for the destination' at the VPC network step. What is the most likely root cause?

Accepted Answer

The Cloud Router is not receiving the 10.50.0.0/24 prefix from the on-premises router over BGP, so no dynamic route was installed in the VPC.

Answer

A firewall rule is denying egress traffic to 10.50.0.0/24, which prevents the route from being used.

Answer

The HA VPN tunnel is administratively down, so all traffic is being dropped at the tunnel interface.

Answer

VPC Flow Logs are disabled on the subnet, so Connectivity Test cannot verify the route exists.

Question 37

A developer reports that a VM named app-vm in subnet 10.10.0.0/24 cannot reach a database VM named db-vm on TCP port 5432 in subnet 10.20.0.0/24 within the same VPC. Both VMs are running and have correct IP configurations. You want to quickly determine, without generating live traffic, whether a firewall rule is blocking the connection and identify exactly which rule is responsible. What should you do?

Accepted Answer

Run a Network Intelligence Center Connectivity Test specifying app-vm as the source, db-vm as the destination, protocol TCP, and port 5432, then review the trace result for the rule that dropped the packet.

Answer

Enable VPC Flow Logs on both subnets and wait for the developer to retry the connection, then filter the logs for denied packets between the two VMs.

Answer

Enable Firewall Rules Logging on every rule in the VPC and inspect the hit counts in Cloud Monitoring to find which rule matched the traffic.

Answer

Use the Performance Dashboard in Network Intelligence Center to check packet loss between the two zones hosting the VMs.

Question 38

A network engineer runs a Connectivity Test between a Compute Engine VM and an on-premises host reachable over HA VPN. The test result reports 'Reachable' based on configuration analysis, but users still report that actual traffic is failing intermittently. The engineer needs the test to also verify whether packets are truly being delivered across the live data plane, not just that the configuration permits the flow. What should the engineer do?

Accepted Answer

Enable the live data plane analysis (dynamic verification) option; note that for a non-Google destination such as an on-prem host over HA VPN it verifies delivery only as far as the Google network edge, sending probe packets along the in-scope path

Answer

Increase the VPC Flow Logs sampling rate to 1.0 on the source subnet and re-run the Connectivity Test

Answer

Enable Firewall Rules Logging on all rules in the path so the Connectivity Test can incorporate hit counts

Answer

Switch the Connectivity Test protocol from TCP to ICMP so the tool automatically pings the destination

Question 39

Your security team requires that a set of Compute Engine instances in the 'restricted-vpc' custom-mode VPC have absolutely no direct path to the public internet, while still allowing them to reach Google APIs privately. Currently the VPC has the default 0.0.0.0/0 route pointing to the default internet gateway. The instances have no external IP addresses. What is the most effective way to guarantee these instances cannot egress to the internet through the default gateway while preserving private access to Google APIs?

Accepted Answer

Delete the default 0.0.0.0/0 route to the default internet gateway, enable Private Google Access on the relevant subnets, and add a route for restricted.googleapis.com via the default internet gateway.

Answer

Keep the default route but attach a network tag to the instances and create a deny-all egress firewall rule that blocks 0.0.0.0/0 for that tag.

Answer

Remove the external IP addresses from the instances and rely on the absence of Cloud NAT to prevent internet egress.

Answer

Lower the priority of the default internet gateway route to 65535 so that Private Google Access routes are always preferred.

Question 40

Your company runs a custom-mode VPC with many Compute Engine instances in the subnet 10.20.0.0/16. Most instances must send all internet-bound traffic through a self-managed NAT/firewall appliance (a VM with IP 10.20.1.10) for inspection. However, a small group of instances tagged 'direct-egress' must instead use the default internet gateway route for maximum throughput and bypass inspection. Both route types point to 0.0.0.0/0. How should you configure routing so that only the tagged instances bypass the appliance?

Accepted Answer

Create a custom static route for 0.0.0.0/0 with next hop the appliance VM and no tags, and create a second custom static route for 0.0.0.0/0 with the network tag 'direct-egress', next hop default internet gateway, and a lower (better) priority value.

Answer

Delete the default internet gateway route, then create a single tagged static route for 'direct-egress' instances pointing to the internet gateway; untagged instances will automatically fall back to the appliance.

Answer

Apply a hierarchical firewall policy that forces untagged instances through the appliance and allows tagged instances direct egress.

Answer

Configure Cloud NAT for the subnet and attach the 'direct-egress' tag to the NAT gateway so only tagged instances use it.

Question 41

Your company deployed a firewall virtual appliance in a VPC to inspect all egress traffic to the internet. You created a custom static route with destination 0.0.0.0/0 and next hop set to the appliance instance, with priority 1000. However, traffic from workload VMs is still bypassing the appliance and going directly to the internet via the default route. You need all workload VM egress to flow through the appliance while leaving other VMs unaffected. What should you do?

Accepted Answer

Create a new custom static route to 0.0.0.0/0 with next hop the appliance, set a priority value lower than 1000 (e.g., 100), and apply an instance tag that matches only the workload VMs.

Answer

Delete the default 0.0.0.0/0 internet gateway route so that the appliance route becomes the only default route in the VPC.

Answer

Increase the priority value of the existing appliance route to 2000 so it takes precedence over the default internet gateway route.

Answer

Add a network tag to the appliance instance and reference that tag in the existing route so only tagged traffic is forwarded.

Question 42

Your company has provisioned a single 10-Gbps Dedicated Interconnect connection at a Google colocation facility. Traffic to Google Cloud has grown, and the network team wants to increase capacity to 20 Gbps on the same connection while keeping a single logical link between your on-premises router and Google's edge. What is the correct way to achieve this?

Accepted Answer

Add a second 10-Gbps circuit to the existing Dedicated Interconnect connection so both links form a single LACP bundle terminating on the same Google edge device.

Answer

Order a second 10-Gbps Dedicated Interconnect connection; Google automatically adds it to the same link bundle and load-balances traffic across both.

Answer

Create a second VLAN attachment on the existing 10-Gbps connection; each attachment provides an additional 10 Gbps of capacity.

Answer

Upgrade the VLAN attachment capacity setting from 10 Gbps to 20 Gbps in the Cloud Console; Google reprovisions the port speed dynamically.

Question 43

Your company has provisioned a single 10 Gbps Dedicated Interconnect connection in a colocation facility. You need to create a VLAN attachment that will carry production traffic to a VPC in us-central1. The finance team requires that you only pay for the capacity you actually configure on the attachment, and the application is expected to peak at around 5 Gbps. Which action correctly configures the VLAN attachment for this requirement?

Accepted Answer

Create the VLAN attachment on the Dedicated Interconnect connection and set its capacity to 5 Gbps, then configure a Cloud Router with a BGP session for the attachment.

Answer

Create a Partner Interconnect VLAN attachment and request a 5 Gbps pairing key from the service provider.

Answer

Create the VLAN attachment with the full 10 Gbps capacity because attachment capacity must always match the underlying Interconnect connection speed.

Answer

Create two 10 Gbps Dedicated Interconnect connections and bundle them, then split traffic evenly to reach 5 Gbps effective throughput.

Question 44

Your company has provisioned a 10 Gbps Dedicated Interconnect connection and created a VLAN attachment linking your on-premises router to a Cloud Router in a custom-mode VPC. Applications transferring large datasets between on-premises hosts and Compute Engine VMs are experiencing fragmentation and lower-than-expected throughput. You want the traffic across the Interconnect to use 8896-byte jumbo frames end to end. What must you configure to achieve this?

Accepted Answer

Create the VLAN attachment with an MTU of 8896, set the VPC network MTU to 8896, and ensure the on-premises router interface and VM guest OS are configured for the matching MTU.

Answer

Set the VLAN attachment MTU to 1500 and enable TCP MSS clamping on the Cloud Router.

Answer

Change only the guest OS MTU on the VMs to 8896; the VLAN attachment and VPC MTU adjust automatically to match.

Answer

Enable jumbo frames by switching from Dedicated Interconnect to Partner Interconnect, which supports 8896-byte frames by default.

Question 45

Your company has provisioned a 10 Gbps Dedicated Interconnect connection terminating at a colocation facility. Your production VPC has resources in the us-central1 region, and you need to create a VLAN attachment so that on-premises traffic can reach those resources. When you create the VLAN attachment, the Cloud Router it associates with must be in a specific region. To minimize latency and egress cost for traffic between on-premises and your us-central1 workloads, in which region should you create the VLAN attachment and its Cloud Router?

Accepted Answer

In us-central1, the same region as the workloads being reached over the attachment

Answer

In whichever region is geographically closest to the physical colocation facility, regardless of workload location

Answer

In a global scope, since VLAN attachments are not tied to any region

Answer

In us-east1, to provide a regional separation between the interconnect and the workloads for resilience

Question 46

A financial services company needs to connect its on-premises data center to Google Cloud. The workload requires a sustained, private data transfer rate of 15 Gbps, must avoid traversing the public internet for regulatory compliance, and the company already operates in a colocation facility that is listed as a Google Cloud Interconnect location. They want to minimize per-GB egress costs for high-volume transfers. Which connectivity option should the network engineer recommend?

Accepted Answer

Provision Dedicated Interconnect with the appropriate number of 10 Gbps circuits

Answer

Deploy two HA VPN gateways with multiple tunnels and ECMP to aggregate bandwidth up to 15 Gbps

Answer

Use Partner Interconnect with a Layer 2 partner connection sized at 15 Gbps

Answer

Configure Cloud VPN Classic with a single tunnel and enable Cloud Router dynamic routing

Question 47

Your organization runs three separate VPC networks (prod-vpc, staging-vpc, and tools-vpc) that are not peered with each other. A central 'shared-services-vpc' hosts a Cloud DNS private zone (internal.example.com) plus an inbound forwarding configuration that resolves on-premises records. You need all three isolated VPCs to resolve both the internal.example.com records and the on-premises records managed in shared-services-vpc, without creating full mesh VPC peering and without duplicating zone data in each VPC. What should you implement?

Accepted Answer

Create a Cloud DNS peering zone in each of the three VPCs that targets shared-services-vpc as the DNS peering network.

Answer

Configure VPC Network Peering between each isolated VPC and shared-services-vpc, then rely on automatic DNS resolution across the peering.

Answer

Create a private DNS forwarding zone in each VPC pointing to the inbound forwarder IP of shared-services-vpc for all queries.

Answer

Attach all three VPCs as spokes to a Network Connectivity Center hub so DNS zones are shared automatically across the mesh.

Question 48

A network engineer manages a custom-mode VPC with a subnet named 'app-subnet' in us-central1 using primary range 10.20.0.0/24. The application team is deploying additional Compute Engine instances and has exhausted the available IP addresses. Existing VMs must keep their current IP addresses and stay online during the change. What should the engineer do to provide more usable IP addresses in this subnet?

Accepted Answer

Expand the subnet's primary IP range to a larger prefix, such as 10.20.0.0/22, using gcloud compute networks subnets expand-ip-range.

Answer

Delete and recreate 'app-subnet' with a larger CIDR block, then re-deploy the existing instances.

Answer

Add a secondary IP range to 'app-subnet' and configure the new VMs to draw primary interface IPs from the secondary range.

Answer

Create a new subnet in a different region with a larger range and migrate the workloads there.

Question 49

You manage a global external Application Load Balancer serving a stateless web application backed by two managed instance groups (MIGs) in different regions. During a regional traffic spike, one MIG becomes overloaded and returns high latency, even though the second MIG has spare capacity. You want the load balancer to distribute new connections based on backend CPU load and to stop sending new requests to backends that are already near their capacity limit. Which backend service configuration should you apply?

Accepted Answer

Set the backend service balancing mode to UTILIZATION with a target maximum CPU utilization, and configure capacity scaler values per backend.

Answer

Set the balancing mode to RATE with a maximum requests-per-second value and disable the capacity scaler.

Answer

Enable session affinity based on CLIENT_IP so connections are pinned to the least-loaded backend.

Answer

Switch the backends to a target pool with an equal-weight distribution across both regions.

Question 50

A media company runs a global external Application Load Balancer to serve its website. Static assets (images, CSS, JS) are stored in a Cloud Storage bucket, while dynamic API traffic must be routed to VM-based backends running in a managed instance group in us-central1 and europe-west1. The team wants a single anycast IP and URL map that directs '/static/*' requests to the bucket and all other requests to the VMs, with static assets cached at Google's edge. Which configuration meets these requirements?

Accepted Answer

Create a backend bucket (with Cloud CDN enabled) for the storage bucket and a backend service with the two instance groups as backends, then use a URL map with a path matcher sending '/static/*' to the backend bucket and the default route to the backend service.

Answer

Create two separate load balancers—one pointing at the bucket with Cloud CDN and one pointing at the instance groups—and use DNS weighting to split traffic between them.

Answer

Create a single backend service that includes both the Cloud Storage bucket and the instance groups as backends, enabling Cloud CDN on the backend service.

Answer

Create a backend service with the instance groups and attach the Cloud Storage bucket as a serverless NEG, then enable Cloud CDN on the serverless NEG.

Question 51

You configured an external Application Load Balancer (global) with a backend service pointing to a managed instance group of Compute Engine VMs. The load balancer's HTTP health check is configured correctly to probe port 80 at path /healthz, and the application is confirmed running and responding on the VMs. However, all backends are shown as UNHEALTHY in the console and no traffic is served. Egress rules are set to allow-all. What is the most likely cause?

Accepted Answer

There is no ingress firewall rule allowing traffic from the Google health check probe source ranges 35.191.0.0/16 and 130.211.0.0/22 to the backend VMs.

Answer

The backend service protocol is set to HTTPS but the health check uses HTTP, so the probe cannot complete.

Answer

The instances lack external IP addresses, so the global load balancer cannot reach them for health probing.

Answer

A global external Application Load Balancer requires a regional health check, and the configured health check is global.

Question 52

Your company is migrating a legacy web application to Google Cloud incrementally. During the transition, the application still runs on servers in your on-premises data center, which is reachable via Cloud Interconnect. You need to expose this on-premises application through a global external Application Load Balancer so you can gradually shift traffic to new Compute Engine backends and take advantage of Cloud CDN and Google-managed TLS certificates. Which backend configuration allows the load balancer to route traffic to the on-premises servers?

Accepted Answer

Create a hybrid connectivity network endpoint group (NEG) with endpoints specifying the on-premises IP addresses and ports, and add it to the backend service.

Answer

Create a zonal NEG of type GCE_VM_IP_PORT referencing the on-premises server IP addresses.

Answer

Create an unmanaged instance group containing the on-premises servers and attach it to the backend service.

Answer

Create a serverless NEG pointing to the on-premises application endpoint.

Question 53

Your team runs a public marketing site fronted by a global external Application Load Balancer. A new feature requires exposing an HTTP-triggered Cloud Run functions (formerly Cloud Functions 2nd gen) function under the path /api/subscribe on the same domain and certificate as the existing site. You must route requests to the function through the existing load balancer without provisioning any VMs or managing instance groups. What is the correct way to attach the function as a backend?

Accepted Answer

Create a serverless network endpoint group (NEG) that references the Cloud Functions service, add it as a backend to a backend service, and configure the URL map to route /api/subscribe to that backend service.

Answer

Create a zonal NEG of type GCE_VM_IP_PORT pointing to the function's runtime instances and attach it to a new backend service.

Answer

Create an internet NEG with the function's *.cloudfunctions.net FQDN and add it as a backend so the load balancer treats it as an external origin.

Answer

Create a backend bucket that maps to the Cloud Functions deployment and reference it in the URL map for the /api/subscribe path.

Question 54

Your security team requires that a global external Application Load Balancer serving api.example.com only negotiate TLS 1.2 or higher and disable known-weak cipher suites, while still supporting a broad range of modern clients. The load balancer already has a valid Google-managed certificate attached to its target HTTPS proxy. What is the recommended way to enforce these requirements?

Accepted Answer

Create an SSL policy with profile MODERN and minimum TLS version TLS 1.2, then attach it to the target HTTPS proxy.

Answer

Replace the Google-managed certificate with a self-managed certificate that only lists TLS 1.2 cipher suites in its metadata.

Answer

Add a URL map rewrite rule that rejects requests using TLS versions below 1.2.

Answer

Configure the backend service health check to negotiate TLS 1.2 so only compliant sessions reach the backends.

Question 55

Your company runs a single web property behind a global external Application Load Balancer. The frontend serves under one hostname, www.example.com. Requests to paths starting with /api/ must be routed to a backend service backed by a Kubernetes NEG cluster, requests to /static/ must go to a Cloud Storage backend bucket, and all other requests must go to a default backend service running the main web app. All three backends already exist and pass health checks. What is the correct way to implement this routing on the load balancer?

Accepted Answer

Create a URL map with a host rule for www.example.com and a path matcher containing path rules for /api/* and /static/*, plus a defaultService for all other traffic.

Answer

Create three separate forwarding rules, each with its own target proxy pointing at one of the backends, and use firewall rules to steer traffic by path.

Answer

Configure three backend services on a single backend service group and let the health checks determine which backend receives each path.

Answer

Create three global external Application Load Balancers sharing the same anycast IP, one per backend, and route by DNS.

Question 56

Your company runs a real-time gaming service on Compute Engine instances in a single region. Clients connect over UDP to a public IP. You need a Google Cloud load balancer that preserves client source IP, distributes UDP traffic across a managed instance group, and provides pass-through (non-proxied) delivery so the backends see the original packets unchanged. Which load balancer and health check configuration should you deploy?

Accepted Answer

A regional external passthrough Network Load Balancer with a backend service and a TCP or HTTP health check on a separate serving port

Answer

A global external Application Load Balancer with a serverless NEG and a UDP health check

Answer

An internal passthrough Network Load Balancer with a UDP health check bound to the game port

Answer

A global external proxy Network Load Balancer with a backend service and gRPC health check

Question 57

Your team runs a UDP-based gaming service on Compute Engine instances in us-central1. You need a regional external passthrough Network Load Balancer that supports weighted distribution across backends, connection draining during instance removal, and non-legacy health checks. You are choosing the backend architecture for the load balancer. Which configuration meets these requirements?

Accepted Answer

A backend service-based external passthrough Network Load Balancer using a regional backend service with a managed instance group backend

Answer

A target pool-based external passthrough Network Load Balancer with an HTTP health check attached to the target pool

Answer

A global external Application Load Balancer with a serverless NEG backend

Answer

An internal passthrough Network Load Balancer with a regional backend service and session affinity

Question 58

A gaming company runs a stateful multiplayer backend on a managed instance group behind an external passthrough Network Load Balancer (regional). During autoscaling scale-in events and rolling updates, players frequently report abrupt disconnections mid-session because active TCP connections to backends being removed are terminated immediately. The team wants to allow existing TCP connections to complete gracefully (up to 5 minutes) while preventing new connections from reaching instances being removed. Which configuration should they apply?

Accepted Answer

Enable connection draining on the backend service by setting connectionDraining.drainingTimeoutSec to 300.

Answer

Configure session affinity to CLIENT_IP on the backend service so connections stay pinned to the same instance.

Answer

Increase the health check unhealthyThreshold and timeoutSec so failing instances stay in rotation longer.

Answer

Enable global access on the backend service to redistribute connections across regions during scale-in.

Question 59

A security engineer at your company runs a monthly review of firewall posture across a production VPC. She wants Google Cloud to automatically surface allow rules that permit a much broader IP range or port set than the traffic actually observed hitting those rules, so she can tighten them. Which Network Intelligence Center capability should she use to obtain these specific findings?

Accepted Answer

Firewall Insights overly permissive rule analysis, which relies on firewall metrics and logging data

Answer

Connectivity Tests configured against each firewall rule to validate reachability

Answer

Network Topology to visualize traffic volume between hierarchical firewall policies

Answer

VPC Flow Logs metadata annotations exported to BigQuery for manual query

Question 60

A security team at your company complains that a legacy firewall rule allowing SSH (tcp:22) from a broad source range appears to never take effect, and they suspect it is being overridden by a higher-priority rule. They also want to identify rules that have received zero hits over the past several weeks so they can safely remove them. Which Network Intelligence Center capability should you use to provide both the override analysis and the usage data?

Accepted Answer

Firewall Insights, which reports shadowed rules and provides hit-count metrics over a configurable observation period

Answer

Connectivity Tests, which simulate a packet and return the matched firewall rule for a given 5-tuple

Answer

Firewall Rules Logging combined with Network Topology to visualize traffic flows between instances

Answer

VPC Flow Logs filtered by port 22 in Cloud Monitoring to count SSH connection attempts

Question 61

A security engineer reports that traffic from a partner subnet (192.168.50.0/24) to a set of internal application VMs is being unexpectedly denied. You suspect a specific egress or ingress firewall rule is responsible, but you cannot confirm which rule is matching the denied packets. You need to see, per-connection, exactly which firewall rule is evaluating this traffic and whether it is allowing or denying it, with minimal changes to the environment. What should you do?

Accepted Answer

Enable Firewall Rules Logging on the relevant firewall rules, then inspect the resulting log entries in Cloud Logging for the connection's disposition and matching rule reference.

Answer

Enable VPC Flow Logs on the target subnet and filter the logs by source range 192.168.50.0/24 to identify the denying firewall rule.

Answer

Run a Connectivity Test from the partner subnet to the VMs and rely on its output to display packet-level hit counts for each firewall rule.

Answer

Increase the VPC Flow Logs sampling rate to 100% and add metadata annotations to reveal which firewall rule denied each packet.

Question 62

Your team runs a private GKE cluster where nodes have only internal IP addresses. Developers connect from the corporate office (public egress IP 203.0.113.10/32) using kubectl, and a CI/CD pipeline runs on a Compute Engine VM in the same VPC (internal IP 10.20.0.5). Security requires that the Kubernetes API server (control plane) reject connections from any source except these two. Which configuration meets the requirement with the least operational overhead?

Accepted Answer

Enable control plane authorized networks and add 203.0.113.10/32; enable the option to allow access from Google Cloud internal IP addresses (or add the VM's range), and keep the private endpoint enabled.

Answer

Create a VPC firewall rule denying ingress on port 443 to the control plane except from 203.0.113.10/32 and 10.20.0.5/32.

Answer

Add both 203.0.113.10/32 and 10.20.0.5/32 to a Cloud Armor security policy attached to the cluster's external load balancer.

Answer

Disable the public endpoint entirely and route all developer kubectl traffic through Cloud NAT to reach the private endpoint.

Question 63

A development team runs a Cloud Run service that must call a REST API hosted on a Compute Engine VM using the VM's internal IP address (10.20.0.15). The Cloud Run service currently cannot reach the VM. The team wants the simplest supported configuration that routes only the RFC 1918 internal traffic through the VPC while keeping public internet egress unchanged. What should you configure?

Accepted Answer

Create a Serverless VPC Access connector in the same region and VPC, then set the Cloud Run egress setting to route only requests to private IP ranges through the connector.

Answer

Set the Cloud Run egress setting to route all traffic through a Serverless VPC Access connector so that both internet and internal traffic use the VPC.

Answer

Assign an external IP to the Compute Engine VM and add a firewall rule allowing ingress from Cloud Run's public IP range.

Answer

Enable Private Google Access on the subnet containing the VM so that Cloud Run can reach the internal IP address.

Question 64

Your team is deploying an internal HTTP(S) load balancer to expose services running in a VPC-native GKE cluster within a custom-mode VPC in region us-central1. When you attempt to create the internal Application Load Balancer's forwarding rule, the operation fails with an error indicating that no proxy-only subnet exists. The cluster subnet has a primary range and two secondary ranges already configured for Pods and Services. What must you do to allow the internal Application Load Balancer to be provisioned?

Accepted Answer

Create a subnet with purpose REGIONAL_MANAGED_PROXY and role ACTIVE in us-central1, reserved exclusively for Envoy-based proxies.

Answer

Add a third secondary IP range to the existing cluster subnet and designate it as the proxy range.

Answer

Convert the VPC from custom mode to auto mode so that a proxy-only subnet is created automatically in each region.

Answer

Enable Private Google Access on the cluster subnet so the load balancer proxies can reach backend Pods.

Exam domain	Exam weight	Practice
Designing and planning a Google Cloud VPC network	21%	Practice this topic
Implementing a VPC network	20%	Practice this topic
Configuring managed network services	16%	Practice this topic
Configuring and implementing hybrid and multicloud network interconnectivity	16%	Practice this topic
Managing, monitoring, and troubleshooting network operations	14%	Practice this topic
Configuring, implementing and managing a cloud network security solution	13%	Practice this topic

Google Cloud Professional Cloud Network Engineer (PCNE) practice exam & study guide

Start studying PCNE

All PCNE study resources

PCNE exam domains

Sample PCNE questions

Key PCNE terms

PCNE frequently asked questions

Designing and planning a Google Cloud VPC network (21%)

Implementing a VPC network (20%)

Configuring managed network services (16%)

Configuring and implementing hybrid and multicloud network interconnectivity (16%)

Managing, monitoring, and troubleshooting network operations (14%)

Configuring, implementing and managing a cloud network security solution (13%)