Designing and planning a Google Cloud VPC network — PCNE Practice Quiz

Question 1

A retail company started with a single auto-mode VPC that automatically created a /20 subnet in every Google Cloud region. As they expand globally and plan to add many custom subnets, peer with a partner VPC, and tightly control IP address allocation per region, the network team is concerned about the fixed 10.128.0.0/9 range auto mode uses and the risk of overlap with the partner. What is the recommended approach to gain full control of subnet CIDR planning while preserving existing workloads?

Accepted Answer

Convert the auto-mode VPC to custom mode, then manually manage all subnet ranges going forward

Answer

Delete the auto-mode VPC and recreate all resources in a brand-new custom-mode VPC

Answer

Enable a hierarchical firewall policy to override the auto-mode subnet ranges

Answer

Add secondary IP ranges to each auto-created subnet to replace the primary ranges

Question 2

You are designing a new production VPC for a retail company. The network must connect to two on-premises data centers via HA VPN, and the on-premises teams have already allocated the 10.128.0.0/9 range for their infrastructure. The cloud team wants precise control over which regions have subnets and the exact CIDR ranges used, to avoid any overlap with on-premises addressing. Which VPC design should you choose?

Accepted Answer

Create a custom mode VPC and manually define subnets only in the regions you need with non-overlapping CIDR ranges.

Answer

Create an auto mode VPC so subnets are automatically provisioned in every region with predefined ranges.

Answer

Create an auto mode VPC and rely on custom routes to prevent overlap with the on-premises 10.128.0.0/9 range.

Answer

Create a custom mode VPC but let Google auto-assign secondary ranges to guarantee no overlap.

Question 3

You are designing a new production VPC for a company that will initially deploy workloads in us-central1 and europe-west1, with plans to add three more regions over the next two years. The network team requires strict control over which subnet CIDR ranges exist in each region and wants to avoid any automatically created subnets that could later overlap with on-premises ranges reachable over Cloud Interconnect. Which VPC design best meets these requirements?

Accepted Answer

Create a custom mode VPC and manually define subnets with explicitly chosen CIDR ranges only in the regions you intend to use.

Answer

Create an auto mode VPC, then delete the subnets in unused regions to prevent CIDR overlap with on-premises networks.

Answer

Create an auto mode VPC because it automatically assigns non-overlapping ranges and later convert it to custom mode when adding regions.

Answer

Create a custom mode VPC and enable auto-subnet creation so new regions receive predefined 10.128.0.0/9 ranges as they launch.

Question 4

A retailer runs workloads in a Google Cloud VPC and maintains a large on-premises data center connected via HA VPN. Applications in the VPC must resolve private hostnames hosted by the on-premises Microsoft AD DNS servers, and on-premises clients must resolve records for private Cloud DNS zones used by the cloud workloads. The team wants a fully managed solution without deploying and maintaining DNS proxy VMs in Google Cloud. Which Cloud DNS configuration should they implement?

Accepted Answer

Create a Cloud DNS private zone with forwarding to the on-premises servers, and configure a Cloud DNS server policy that enables inbound DNS forwarding so on-premises clients query the assigned inbound forwarder IPs.

Answer

Deploy DNS forwarder VM instances in the VPC that relay queries in both directions and point both environments at these instances.

Answer

Use Cloud DNS peering between the VPC and the on-premises DNS servers so records are exchanged bidirectionally.

Answer

Configure a single Cloud DNS public managed zone and enable DNSSEC so both environments resolve each other's records over the internet.

Question 5

A retail company runs an internal application in a Google Cloud VPC. The same hostname, app.retail.internal, must resolve to a private RFC 1918 address for clients inside the VPC, but to a public-facing external IP for clients querying from the internet. The DNS team wants a Google-managed solution that avoids maintaining separate hostnames and works without deploying custom DNS servers. Which Cloud DNS approach should they implement?

Accepted Answer

Create a Cloud DNS private zone and a separate public managed zone, both named for a domain you own such as corp.retailexample.com, and add differing A records for app.corp.retailexample.com in each — using Cloud DNS split-horizon (response policy is not required).

Answer

Create a single public managed zone with two A records for app.retail.internal and rely on Cloud DNS to return the private record only to internal VPC clients.

Answer

Deploy BIND on a Compute Engine instance to serve split-horizon views, and point the VPC's DNS server policy to that instance.

Answer

Use Cloud DNS DNS peering to forward app.retail.internal queries from the VPC to the public zone while internet clients query the public zone directly.

Question 6

A financial services company is designing a Dedicated Interconnect connection between their on-premises data center and Google Cloud. A compliance requirement mandates that all traffic traversing the physical link between their edge router and Google's peering edge must be encrypted at Layer 2. The design must minimize latency overhead and avoid tunnel-based encryption. Which approach should the network engineer choose?

Accepted Answer

Enable MACsec for Cloud Interconnect on the Dedicated Interconnect connection

Answer

Deploy HA VPN tunnels over the Dedicated Interconnect using IPsec encryption

Answer

Configure Cloud Interconnect with private Google Access and rely on Google's default in-transit encryption

Answer

Use Partner Interconnect and request the connectivity provider to encrypt the VLAN attachment

Question 7

A financial services company needs to connect its on-premises data center to Google Cloud. The workload requires a sustained, private data transfer rate of 15 Gbps, must avoid traversing the public internet for regulatory compliance, and the company already operates in a colocation facility that is listed as a Google Cloud Interconnect location. They want to minimize per-GB egress costs for high-volume transfers. Which connectivity option should the network engineer recommend?

Accepted Answer

Provision Dedicated Interconnect with the appropriate number of 10 Gbps circuits

Answer

Deploy two HA VPN gateways with multiple tunnels and ECMP to aggregate bandwidth up to 15 Gbps

Answer

Use Partner Interconnect with a Layer 2 partner connection sized at 15 Gbps

Answer

Configure Cloud VPN Classic with a single tunnel and enable Cloud Router dynamic routing

Question 8

Your organization runs three separate VPC networks (prod-vpc, staging-vpc, and tools-vpc) that are not peered with each other. A central 'shared-services-vpc' hosts a Cloud DNS private zone (internal.example.com) plus an inbound forwarding configuration that resolves on-premises records. You need all three isolated VPCs to resolve both the internal.example.com records and the on-premises records managed in shared-services-vpc, without creating full mesh VPC peering and without duplicating zone data in each VPC. What should you implement?

Accepted Answer

Create a Cloud DNS peering zone in each of the three VPCs that targets shared-services-vpc as the DNS peering network.

Answer

Configure VPC Network Peering between each isolated VPC and shared-services-vpc, then rely on automatic DNS resolution across the peering.

Answer

Create a private DNS forwarding zone in each VPC pointing to the inbound forwarder IP of shared-services-vpc for all queries.

Answer

Attach all three VPCs as spokes to a Network Connectivity Center hub so DNS zones are shared automatically across the mesh.

Question 9

A retail company runs a customer-facing web application on a VPC-native GKE cluster exposed through an external HTTP(S) load balancer. During load testing, the network team notices that traffic first reaches a node's kube-proxy and is then redirected to a Pod on a different node, adding an extra hop and causing uneven backend utilization and inaccurate health checks. The team wants the load balancer to distribute traffic directly to the Pods and to see accurate per-Pod health. What should they implement?

Accepted Answer

Enable container-native load balancing by using standalone or Ingress-managed Network Endpoint Groups (NEGs) so the load balancer targets Pod IPs directly.

Answer

Change the Kubernetes Service type to NodePort and add more nodes to the cluster so kube-proxy can spread the load more evenly.

Answer

Set externalTrafficPolicy to Local on a LoadBalancer Service so traffic is only sent to nodes that host a Pod.

Answer

Convert the cluster to a non-VPC-native (routes-based) cluster so Pod IPs are advertised through the VPC route table to the load balancer.

Question 10

Your company is deploying a new GKE cluster to host a microservices platform. Security requires that cluster nodes have no public IP addresses. The platform team expects the number of Pods to grow significantly over the next two years, and they want to avoid re-creating the cluster to accommodate more Pod IPs. The cluster will run in an existing Shared VPC subnet that already has a primary range and one secondary range reserved for Services. How should you design the cluster's IP addressing?

Accepted Answer

Create a VPC-native (alias IP) private cluster and assign a secondary range for Pods that you can later expand with additional non-contiguous secondary ranges (multi-Pod CIDR).

Answer

Create a routes-based private cluster and rely on custom static routes so more Pod IPs can be added without re-creating the cluster.

Answer

Create a VPC-native public cluster using the subnet primary range for Pods so the range can be resized in place at any time.

Answer

Create a VPC-native private cluster and place both Pods and Services in the single existing Services secondary range to conserve address space.

Question 11

A retail company runs a VPC-native (alias IP) GKE cluster in a custom-mode subnet. The subnet's primary range is used for nodes, and a secondary range /20 is allocated for Pods. After a successful holiday campaign, the platform team plans to triple the number of nodes and Pods over the next year, and they are concerned the current Pod secondary range will be exhausted. They want to add capacity without recreating the cluster or migrating workloads. What should they do?

Accepted Answer

Add a new secondary IP range to the subnet and enable it as an additional Pod range on the cluster using discontiguous multi-Pod CIDR (expandable Pod ranges).

Answer

Delete the existing cluster and recreate it with a larger /16 secondary range for Pods, then redeploy all workloads.

Answer

Convert the cluster to routes-based networking so Pod IPs are drawn dynamically from the VPC route table instead of a fixed secondary range.

Answer

Expand the subnet's primary IP range, since Pods in VPC-native clusters draw their addresses from the primary node range.

Question 12

A media company is launching a stateless HTTP(S) web application that will serve users across North America, Europe, and Asia. Requirements: a single global anycast IP address, TLS termination at the edge close to users, automatic routing of each user to the nearest healthy backend region, and the ability to serve cached static content from Google's edge. Which load balancing option should you choose?

Accepted Answer

Global external Application Load Balancer with Cloud CDN enabled on the backend service

Answer

Regional external Application Load Balancer deployed in each region, with Cloud DNS geolocation routing policies pointing to each regional IP

Answer

Global external proxy Network Load Balancer with backend services in each region

Answer

External passthrough Network Load Balancer with a global static IP and Cloud CDN

Question 13

A retail company is building a single HA VPN gateway in the us-central1 region to connect its on-premises data center to a Google Cloud VPC. The network team wants to achieve the 99.99% availability SLA for the Cloud VPN connection. The on-premises side has two physical routers, each with a public IP. How should the team configure the HA VPN gateway and tunnels to meet this SLA requirement?

Accepted Answer

Create one HA VPN gateway (two interfaces) and configure two tunnels, one from each gateway interface to each of the two on-premises peer devices, using BGP on Cloud Router for dynamic failover.

Answer

Create two separate HA VPN gateways in the same region, each with a single tunnel to one on-premises router, and rely on static routes for failover.

Answer

Create one HA VPN gateway with a single interface and a single tunnel to one on-premises router, then enable Cloud Router graceful restart to guarantee the SLA.

Answer

Create one Classic VPN gateway with two tunnels to the two on-premises routers and configure route-based routing with equal-cost multipath.

Question 14

A retail company has two on-premises data centers connected to Google Cloud via HA VPN. They also operate three separate VPC networks (prod, staging, and shared-services) that today have no connectivity to each other or to the data centers. Management wants a single managed hub that allows the on-premises sites to reach all three VPCs and allows the VPCs to exchange data-transfer traffic with each other, without building a full mesh of VPN tunnels or peering connections, and while retaining centralized route management. Which design should the network engineer implement?

Accepted Answer

Create a Network Connectivity Center hub and attach the three VPCs as VPC spokes and the HA VPN tunnels as hybrid (VPN) spokes.

Answer

Establish VPC Network Peering between each pair of VPCs and rely on the peering to transit the HA VPN routes to all VPCs.

Answer

Migrate all three VPCs into a single Shared VPC host project and connect the data centers with HA VPN to that host project.

Answer

Deploy a self-managed router VM in a transit VPC and use custom static routes to forward traffic between the VPCs and the VPN tunnels.

Question 15

A retail company runs a set of microservices on managed instance groups spread across three zones in the us-central1 region. Internal clients within the same VPC need to reach these services using host- and path-based routing (for example, /cart and /checkout map to different backends). All traffic must stay private (RFC 1918) and must never traverse the public internet. Which load-balancing option should the network architect select?

Accepted Answer

Internal Application Load Balancer (regional internal HTTP(S) load balancer)

Answer

Internal passthrough Network Load Balancer

Answer

Global external Application Load Balancer with Cloud Armor

Answer

External passthrough Network Load Balancer with a forwarding rule

Question 16

A retail company operates 40 branch offices, each already connected to Google Cloud via its own HA VPN tunnel terminating on a separate Cloud Router in a single VPC. The branches currently cannot exchange traffic with one another; all inter-branch traffic is backhauled through an aging on-premises data center. Leadership wants branches to communicate directly with each other over Google's backbone, avoiding the data center hop, while minimizing operational overhead and avoiding a full-mesh of VPN tunnels between branches. Which Google Cloud design should the network engineer implement?

Accepted Answer

Deploy Network Connectivity Center with a hub, and attach each branch's HA VPN as a spoke to enable site-to-site data transfer across Google's backbone.

Answer

Create VPC Network Peering between each branch's on-premises router and the central VPC to allow transitive routing between branches.

Answer

Enable custom route advertisement on the single Cloud Router so that each branch's routes are automatically re-advertised to every other branch tunnel.

Answer

Migrate all branches to a Dedicated Interconnect and use a single VLAN attachment to provide any-to-any connectivity between sites.

Question 17

A retail company runs an SD-WAN overlay connecting 40 physical stores. Each store already has an SD-WAN edge appliance. The networking team wants to bring this SD-WAN fabric into Google Cloud so that store traffic can reach workloads in a central VPC, and they want to deploy virtual SD-WAN appliances inside the VPC that peer with the on-prem edges using BGP. They need a Google-managed hub that dynamically exchanges routes between these virtual appliances and the VPC without building point-to-point VPN tunnels for every store. Which design should they use?

Accepted Answer

Deploy the virtual SD-WAN instances as Router appliance spokes attached to a Network Connectivity Center hub, and establish BGP sessions between the appliances and Cloud Router.

Answer

Create HA VPN gateways in the VPC and configure one pair of tunnels per store directly to each SD-WAN edge appliance.

Answer

Use VPC Network Peering between the central VPC and a transit VPC that hosts the virtual SD-WAN appliances so routes propagate automatically.

Answer

Attach the central VPC as a VPC spoke to a Network Connectivity Center hub and rely on Private Service Connect to reach the on-prem edges.

Question 18

A retail company needs to connect its on-premises data center to Google Cloud with a private, dedicated connection. Their bandwidth requirement is approximately 5 Gbps, and they do not have equipment colocated in any Google-supported colocation facility. They want a private connection (not over the public internet) with a supported SLA and the ability to scale bandwidth incrementally in the future. Which hybrid connectivity option should the network engineer recommend?

Accepted Answer

Partner Interconnect through a supported service provider, provisioning VLAN attachments sized to the required capacity

Answer

Dedicated Interconnect with a single 10 Gbps circuit terminated in a Google colocation facility

Answer

HA VPN with multiple tunnels aggregated via ECMP to reach 5 Gbps

Answer

Direct Peering to establish private routes into the company's VPC

Question 19

You are designing a custom-mode VPC that must host several regional subnets. Each subnet needs a primary range for VM instances plus a secondary range that a future GKE VPC-native cluster will use for Pods. You must reserve a contiguous, private, non-overlapping addressing plan across three regions and leave headroom for growth without renumbering. Which IP addressing design best satisfies these requirements?

Accepted Answer

Allocate one large RFC 1918 supernet (e.g., 10.0.0.0/9), carve a distinct /16 per region, and within each region assign a smaller primary CIDR and a separate non-overlapping secondary CIDR for Pods.

Answer

Use auto-mode subnets so Google automatically assigns 10.128.0.0/9 ranges per region, then add secondary ranges that overlap the auto-assigned primary ranges to conserve space.

Answer

Assign the same primary and secondary CIDR blocks in all three regions to simplify management, since subnets in different regions can reuse identical ranges.

Answer

Place all VMs and all Pods in a single flat /24 primary range per region and rely on NAT to translate Pod addresses onto the VM range.

Question 20

Your company runs on-premises data-processing servers that must call Google Cloud APIs (Cloud Storage and BigQuery) without traversing the public internet. These servers connect to your VPC through an existing HA VPN tunnel and use only internal RFC 1918 addresses. You must ensure the on-premises hosts can reach the Google APIs privately through the tunnel using the default domains (e.g., storage.googleapis.com), with minimal ongoing management. What should you design?

Accepted Answer

Enable Private Google Access for on-premises hosts by routing the restricted.googleapis.com (199.36.153.4/30) range through the VPN and configuring Cloud DNS response policy zones to resolve Google API domains to that VIP range.

Answer

Enable Private Google Access on each subnet in the VPC and rely on the subnet setting to automatically extend private API access to the on-premises hosts over the VPN.

Answer

Assign public IP addresses to the on-premises servers and add firewall rules that allow egress only to the published Google API public IP ranges.

Answer

Create a Private Service Connect endpoint for each Google API and advertise the endpoint's public IP addresses to on-premises over the VPN via Cloud Router.

More PCNE practice