Your company has a single on-premises data center that needs to be connected to a VPC in Google Cloud. The total bandwidth requirement is 10Gbps. The connection must be redundant and have a minimum SLA of 99.9%. Due to the sensitive nature of the workloads, you need to implement the solution with the lowest latency. What should you do?
-
A
Order a 10Gbps Partner Interconnect VLAN attachment. Create a Cloud Router in your Google Cloud
VPC.
-
B
Order two 10Gbps Dedicated Interconnect connections in a single metropolitan area (metro). Distribute the connections across different edge availability domains. Create a Cloud Router and two 10Gbps VLAN attachments.
-
C
Create one HA VPN gateway. Create two tunnels-one tunnel for each of the two interfaces of the HA VPN gateway. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device that is located on-premises.
-
D
Create one HA VPN gateway. Create two tunnels-one tunnel for each of the two interfaces of the HA VPN gateway. Terminate each of the two tunnels on different public IPs addresses that are configured on the VPN termination device that is located on-premises.
Reveal answer details
Close answer details
Correct answerB
ExplanationDedicated Interconnect: Provides the lowest latency and highest throughput for on-premises connectivity to Google Cloud, which is critical for sensitive workloads. Redundancy and SLA: By ordering two Dedicated Interconnect connections in a single metropolitan area and placing them in different edge availability domains, you achieve redundancy and meet the 99.9% SLA requirement. Bandwidth: Two 10Gbps connections provide the required 10Gbps bandwidth while ensuring failover capacity. Cloud Router and VLAN Attachments: These are needed to manage BGP routing and establish connectivity between your on-premises network and the Google Cloud VPC.
You are designing the VPC network for a large enterprise with many development teams. You need to centralize the management of common network resources while allowing each development team the flexibility to provision and manage their own virtual machines and other compute resources within their respective projects. You also need to ensure that all applications can communicate securely within the corporate environment. What should you do?
-
A
Designate a host project to contain a Shared VPC network, and then attach each development team's project as a service project to share this network.
-
B
Configure Cloud VPN tunnels from each development project's VPC to a central network project that acts as a hub.
-
C
Implement a single large VPC for all development teams in one project and grant them specific IAM roles to manage resources within it.
-
D
Create individual VPCs in each development project and establish VPC Network Peering connections between all of them.
Reveal answer details
Close answer details
Correct answerA
ExplanationShared VPC is the Google Cloud design for centralized network administration with decentralized application ownership. You place the common VPC network in a host project and attach each development team's project as a service project. The networking team keeps centralized control over subnets, routes, and firewall rules, while the development teams can create and manage their own compute resources in their own projects using that shared network. This also supports secure internal communication across applications on the shared corporate network. References:
https://docs.cloud.google.com/vpc/docs/shared-vpc
You need to enable Cloud CDN for all the objects inside a storage bucket. You want to ensure that all the objects in the storage bucket can be served by the CDN. What should you do in the GCP Console?
-
A
Create a new cloud storage bucket, and then enable Cloud CDN on it.
-
B
Create a new TCP load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.
-
C
Create a new SSL proxy load balancer, select the storage bucket as a backend, and then enable Cloud CDN on the backend.
-
D
Create a new HTTP load balancer, select the storage bucket as a backend, enable Cloud CDN on the backend, and make sure each object inside the storage bucket is shared publicly.
Reveal answer details
Close answer details
You manage a public Cloud DNS zone for example.com. The security team requires DNS resolvers to validate that responses are signed and have not been altered. What should you configure?
-
A
Enable DNSSEC for the public managed zone and publish the required DS record with the domain registrar.
-
B
Create a private managed zone with the same name and associate it with all VPC networks.
-
C
Enable VPC Flow Logs on every subnet that hosts DNS clients.
-
D
Configure Cloud CDN signed URLs for the domain.
Reveal answer details
Close answer details
Correct answerA
ExplanationDNSSEC signs DNS records so validating resolvers can verify the authenticity and integrity of DNS responses. For a public zone, the chain of trust also requires publishing the appropriate DS record at the registrar or parent zone. A private managed zone changes internal name resolution but does not provide public DNSSEC validation. VPC Flow Logs observe network flows and do not sign DNS records. Cloud CDN signed URLs authorize content access and are unrelated to DNSSEC.
You manage a Google Cloud VPC network that has multiple Cloud VPN tunnels connecting to a single branch office for redundancy. One tunnel is a new, high-performance link, while the other is an older, less reliable link. You need to configure dynamic routing to influence how your on-premises network routes traffic, ensuring it prefers sending traffic to Google Cloud over the new, high-performance tunnel. The older tunnel must remain available as a backup. What should you do?
-
A
Adjust the Border Gateway Protocol (BGP) Multi-Exit Discriminator (MED) attribute advertised by the Cloud Router for the preferred VPN tunnel to a lower value.
-
B
Configure static routes with different priorities on your on-premises router to point to the two different Cloud VPN tunnel interfaces in Google Cloud.
-
C
On the Cloud Router, configure custom route advertisements to send a shorter prefix route over the
new, high-performance tunnel.
-
D
For the BGP session associated with the new tunnel, configure a higher advertised route priority (a lower numerical value) on the Cloud Router.
Reveal answer details
Close answer details
Correct answerD
ExplanationCloud Router lets you influence inbound traffic from on-premises by setting the advertised route priority per BGP session. Advertising routes with a more preferred priority on the BGP session over the new tunnel causes the on-premises side to select that path for traffic to Google Cloud, while the older tunnel remains available to take over if the preferred session or tunnel fails.
Your organization has implemented Vertex AI online prediction in your Google Cloud environment, which is in the us-central1 region. Online prediction is available through private services access by using the IP CIDR range of 172.16.53.0/24. You need to configure access to Vertex AI without affecting the existing routes. You want to use the VLAN attachments that are located in the us-west1 region as primary. The interconnect VLAN attachments in the us-west2 region can only be used as a backup. What should you do?
-
A
Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24.
-
B
Create a custom learned route on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
-
C
Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 100. Create a custom route advertisement on VLAN attachments in the us- west2 region for prefix 172.16.53.0/24, and set the route priority on the BGP session as 200.
-
D
Create a custom route advertisement on VLAN attachments in the us-west1 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 100. Create a custom route advertisement on VLAN attachments in the us-west2 region for prefix 172.16.53.0/24, and create a BGP route-policy to set the multi-exit discriminator (MED) to 200.
Reveal answer details
Close answer details
Correct answerC
ExplanationTo configure access to Vertex AI online prediction (via private services access) while designating a primary and backup region for interconnect VLAN attachments:
1. Custom route advertisements: Advertise the prefix 172.16.53.0/24 on the VLAN attachments in both us- west1 (primary) and us-west2 (backup) regions. This ensures that the prefix for private services access is known in your on-premises environment.
2. Set BGP route priority: The BGP priority determines the preferred path for traffic. Assign a lower priority value (e.g., 100) for the primary region (us-west1). Assign a higher priority value (e.g., 200) for the backup region (us-west2). BGP always selects the route with the lowest priority value, ensuring that traffic flows through us-west1 as the primary path. If the us-west1 interconnect becomes unavailable, traffic will automatically fail over to us-west 2.
You recently deployed Compute Engine instances in regions us-west1 and us-east1 in a Virtual Private Cloud (VPC) with default routing configurations. Your company security policy mandates that virtual machines (VMs) must not have public IP addresses attached to them. You need to allow your instances to fetch updates from the internet while preventing external access. What should you do?
-
A
Create a Cloud NAT gateway and Cloud Router in both us-west1 and us-east1.
-
B
Create a single global Cloud NAT gateway and global Cloud Router in the VPC.
-
C
Change the instances' network interface external IP address from None to Ephemeral.
-
D
Create a firewall rule that allows egress to destination 0.0.0.0/0.
Reveal answer details
Close answer details
You are designing a highly resilient and secure connection between an on-premises data center and Google Cloud for a financial services company. The company requires 10 Gbps of bandwidth and mandates that all traffic be encrypted end-to-end between their on-premises network and their Google Cloud VPC. You have already provisioned two 10 Gbps Dedicated Interconnect connections. You need to determine an encryption strategy that meets these requirements and provides redundancy. What should you do?
-
A
Deploy four HA VPN gateways on each Dedicated Interconnect connection.
-
B
Deploy two HA VPN gateways on each Dedicated Interconnect connection.
-
C
Configure MACsec on each of the Dedicated Interconnect connections.
-
D
Use one Dedicated Interconnect for traffic and an HA VPN over the internet for backup.
Reveal answer details
Close answer details
Correct answerB
ExplanationTo meet the requirement for end-to-end encryption between the on-premises network and the VPC, use HA VPN over Cloud Interconnect rather than MACsec. Google documents that MACsec protects traffic only between your router and Google's edge, while HA VPN over Cloud Interconnect provides IPsec encryption for the traffic carried by the VLAN attachments. For a 10 Gbps encrypted design with failover across two Dedicated Interconnect attachments, Google recommends 4 tunnels per 10 Gbps attachment, or 8 tunnels total, and its 10 Gbps reference design uses four HA VPN gateways across the two encrypted attachments.
Your organization is developing a landing zone architecture with the following requirements: There should be no communication possible between production and non-production environments.
Communication between applications within an environment may be necessary. Network administrators should centrally manage all network resources, including subnets, routes, and firewall rules. Each application should be billed separately. Developers of an application within a project should have the autonomy to create their compute resources. They should not create or modify networking resources. Up to 1000 applications are expected per environment.
You need to create a design that accommodates these requirements. What should you do?
-
A
Create a design that has one Shared VPC host project for the production environment, and another Shared VPC host project for the nonproduction environment. Associate the various applications' service projects with the corresponding environment's host project.
-
B
Create a design that has a Shared VPC for each project. Implement hierarchical firewall policies to
apply micro-segmentation between VPCs.
-
C
Create a design that implements a single Shared VPC. Use VPC firewall rules with secure tags to
enforce micro-segmentation between environments.
-
D
Create a design where each project in each environment has its own VPC with its own subnets, routes, and firewall rules. Ensure all VPCs are added as spokes to a Network Connectivity Center hub.
Reveal answer details
Close answer details
Correct answerA
ExplanationSeparation Between Production and Non-Production Environments: By creating separate Shared VPC host projects for production and non-production environments, you ensure complete isolation between the two environments, meeting the requirement of no communication between them. Application Communication Within an Environment: Within each Shared VPC, applications can communicate as needed using VPC-level routing and firewall rules. Centralized Network Management: Shared VPC allows network administrators to centrally manage networking resources, such as subnets, routes, and firewall rules, while developers retain control over their compute resources within their service projects. Separate Billing for Applications: Each application is associated with a separate service project, enabling separate billing and resource allocation. Developer Autonomy with Networking Restrictions: Developers in service projects can manage their compute resources but cannot create or modify networking resources, aligning with organizational control and autonomy requirements. Scalability: Shared VPC can scale to support multiple service projects, making it suitable for the expected 1000 applications per environment.
Question 10
Single choice
You have deployed an HTTP(s) load balancer, but health checks to port 80 on the Compute Engine virtual machine instance are failing, and no traffic is sent to your instances. You want to resolve the problem. Which commands should you run?
-
A
gcloud compute instances add-access-config instance-1
-
B
gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --destination-ranges
130.211.0.0/22,35.191.0.0/16 --direction EGRESS
-
C
gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --source-ranges
130.211.0.0/22,35.191.0.0/16 --direction INGRESS
-
D
gcloud compute health-checks update http health-check --unhealthy-threshold 10
Reveal answer details
Close answer details
Question 11
Single choice
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance. What should you do?
-
A
Open the Cloud Shell SSH into the instance using gcloud compute ssh.
-
B
Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
-
C
Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
-
D
Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
Reveal answer details
Close answer details
Question 12
Single choice
You are securing a newly provisioned 10 Gbps Dedicated Interconnect that connects your on-premises data center to your Google Cloud VPC. Your company mandated that all IP traffic between your private on-premises network and the VPC must be secured with strong, end-to-end encryption at layer 3 in the Open Systems Interconnection (OSI) model. You need to implement the most direct and effective solution. What should you do?
-
A
Configure BGP sessions over the Dedicated Interconnect, and enable MD5 authentication.
-
B
Enable MACsec for Cloud Interconnect to encrypt all data frames between your on-premises router and Google's edge device.
-
C
Deploy HA VPN tunnels over the Dedicated Interconnect connections, and configure BGP sessions with on-premises routers to exchange routes.
-
D
Migrate your connection from Dedicated Interconnect to Partner Interconnect, and select a service provider that offers a private, encrypted connection.
Reveal answer details
Close answer details
Correct answerC
ExplanationThe requirement is strong end-to-end encryption at layer 3. Running Cloud HA VPN over Dedicated Interconnect provides IPsec encryption for all IP traffic between on-premises and the VPC while still using Interconnect for high throughput and reliability. Using BGP over the VPN tunnels enables dynamic route exchange across the encrypted layer-3 tunnels.
Question 13
Single choice
Your company's public domain, example.com, is managed using a public Cloud DNS zone. You need to enhance security and protect your users from DNS spoofing and cache poisoning attacks. What should you do?
-
A
Request DNSSEC be enabled at your domain registrar, and then import the provided key-signing keys (KSKs) into the Cloud DNS zone.
-
B
Attach a Google Cloud Armor security policy to the DNS zone to filter malicious queries and protect
against DNS protocol-level attacks.
-
C
Use Cloud NGFW network policies to allow only specific DNS domains into the VPC.
-
D
Enable DNSSEC on the public Cloud DNS zone, and add the provided DS records to your domain registrar.
Reveal answer details
Close answer details
Correct answerD
ExplanationEnabling DNSSEC on the public Cloud DNS zone signs DNS responses so resolvers can validate authenticity and integrity, protecting against spoofing and cache poisoning. Publishing the DS records at the domain registrar establishes the chain of trust from the parent zone to your signed zone so clients can perform DNSSEC validation end-to-end.
Question 14
Single choice
Your organization requires that all SMTP traffic to your cloud environment is blocked, except for traffic that originates from your corporate network. Your organization also requires that only specific VPCs across your Google Cloud projects will allow SMTP access from your corporate network. You need to configure a security policy that will enable this connectivity. What should you do?
-
A
1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
2. Configure an egress hierarchical firewall rule with priority 10010 specifying the source of your corporate network as TCP port 25 and the goto_next action.
3. Associate the hierarchical firewall policy at the organization level.
4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
-
B
1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the allow action.
2. Associate the hierarchical firewall policy at the organization level.
3. Configure firewall policy rules to deny TCP port 25 in the firewall policies associated with the respective VPCs that do not require that access.
-
C
1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the source of your corporate network, TCP port 25, and the goto_next action.
2. Configure an ingress hierarchical firewall rule with priority 10010 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
3. Associate the hierarchical firewall policy at the organization level.
4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
-
D
1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
2. Associate the hierarchical firewall policy at the organization level.
3. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.
Reveal answer details
Close answer details
Correct answerC
ExplanationYou need to block all SMTP traffic by default while allowing only SMTP traffic originating from your corporate network and destined for specific VPCs. Hierarchical firewall rules allow organization-wide policies that apply to all projects under the organization, simplifying management and enforcing consistency. The goto_next action ensures that the rule passes the traffic to the next layer (VPC-level rules) for evaluation, allowing flexibility for specific VPCs. A deny-all rule with a higher priority (10010 in this case) ensures that SMTP traffic from other sources (0.0.0.0/0) is blocked. Individual firewall rules at the VPC level can then allow SMTP traffic for specific VPCs, ensuring access is restricted only to those that explicitly allow it.
Question 15
Single choice
One instance in your VPC is configured to run with a private IP address only. You want to ensure that even if this instance is deleted, its current private IP address will not be automatically assigned to a different instance.
In the GCP Console, what should you do?
-
A
Assign a public IP address to the instance.
-
B
Assign a new reserved internal IP address to the instance.
-
C
Change the instance's current internal IP address to static.
-
D
Add custom metadata to the instance with key internal-address and value reserved.
Reveal answer details
Close answer details
Question 16
Single choice
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with on-premises connectivity already in place. You are deploying a new application using Google Kubernetes Engine (GKE), which must be accessible only from the same VPC network and on-premises locations. You must ensure that the GKE control plane is exposed to a predefined list of on-premises subnets through private connectivity only. What should you do?
-
A
Create a GKE private cluster with a private endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.
-
B
Create a GKE private cluster with a public endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers.
-
C
Create a GKE private cluster with a private endpoint for the control plane. Configure authorized networks to specify the desired on-premises subnets.
-
D
Create a GKE public cluster. Configure authorized networks to specify the desired on-premises subnets.
Reveal answer details
Close answer details
Question 17
Single choice
Your company's cloud network has hybrid connectivity to an on-premises environment through Cloud Interconnect in two regions (us-east4 and us-west1). You received complaints that some on-premises destinations are no longer reachable from us-east4, after changes were made to advertise additional routes to us-west1. You need to troubleshoot to see if any routes were dropped. What should you do?
-
A
Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the global
routing_mode metric attribute.
-
B
Query the dynamic_routes/learned_routes/unique_destinations_limit metric and review the global
routing_mode metric attribute.
-
C
Query the dynamic_routes/learned_routes/any_dropped_unique_destinations metric and review the
regional routing_mode metric attribute.
-
D
Query the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the regional
routing_mode metric attribute.
Reveal answer details
Close answer details
Correct answerA
ExplanationQuery the dynamic_routes/learned_routes/dropped_unique_destinations metric: This metric provides information about the number of unique routes that were dropped, helping you identify whether route limits have been exceeded. Review the global routing_mode metric attribute: If global routing mode is enabled, it allows the routes learned in one region to be used in another. Reviewing the global routing mode ensures that the route advertisements and limits are correctly applied across regions.
Question 18
Single choice
You manage the static assets for your company's global website. Users have been reporting slow load times when they visit the website. You need to develop a scalable solution to improve website load times for users worldwide. You also need to reduce direct access load on the Cloud Storage bucket where the website s static assets are stored. What should you do?
-
A
Configure an internal Application HTTPS Load Balancer in front of the Cloud Storage bucket and enable Cloud CDN on the storage bucket.
-
B
Deploy a Global external Application HTTPS Load Balancer, configure a backend bucket pointing to your Cloud Storage bucket, and enable Cloud CDN on the backend bucket.
-
C
Deploy a Global external Application HTTPS Load Balancer with a Private Service Connect backend pointing to the Cloud Storage API.
-
D
Create a new Compute Engine instance, host the static assets on it, frontend the VM with a load balancer and then enable Cloud CDN directly on the backend service of the load balancer.
Reveal answer details
Close answer details
Correct answerB
ExplanationA global external Application HTTPS Load Balancer with a backend bucket is the managed, scalable pattern for serving Cloud Storage static content. Enabling Cloud CDN on the backend bucket caches content at edge locations worldwide, improving latency for global users and significantly reducing direct request load on the Cloud Storage bucket.
Question 19
Single choice
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anymore, and will always be served to the internet directly from the origin. What should you do?
-
A
Ensure that the object you don't want to be cached anymore is not shared publicly.
-
B
Create a new storage bucket, and move the object you don't want to be cached anymore inside it. Then edit the bucket setting and enable the private attribute.
-
C
Add an appropriate lifecycle rule on the storage bucket containing the two objects.
-
D
Add a Cache-Control entry with value private to the metadata of the object you don't want to be cached anymore. Invalidate all the previously cached copies.
Reveal answer details
Close answer details
Question 20
Single choice
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications: Your ISP is a Google Partner Interconnect provider. Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps. A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses. Most of the data transfer will be from GCP to the on-premises environment. The application can burst up to 1.5 Gbps during peak transfers over the Interconnect. Cost and the complexity of the solution should be minimal. How should you provision the connectivity solution?
-
A
Provision a Partner Interconnect through your ISP.
-
B
Provision a Dedicated Interconnect instead of a VPN.
-
C
Create multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
-
D
Use network compression over your VPN to increase the amount of data you can send over your VPN.
Reveal answer details
Close answer details
Question 21
Single choice
Your company requires a highly available hybrid connection from an on-premises data center to Google Cloud. The design must support dynamic routing and encrypted traffic over the public internet, and must provide a 99.99% availability architecture when configured according to Google guidance. What should you deploy?
-
A
Classic VPN with one tunnel and static routes.
-
B
HA VPN with two interfaces, two tunnels to the peer gateway, and Cloud Router for BGP.
-
C
Direct Peering with static routes to the VPC subnet ranges.
-
D
Partner Interconnect without VLAN attachments.
Reveal answer details
Close answer details
Correct answerB
ExplanationHA VPN uses two interfaces and Cloud Router with BGP for dynamic routing. When deployed with the required redundant tunnels and peer-side availability, it can provide the high-availability architecture required for site-to-site encrypted connectivity over the public internet. Classic VPN with one tunnel is not a 99.99% HA design. Direct Peering is not an encrypted site-to-site VPN into a VPC. Partner Interconnect requires VLAN attachments and is not an internet IPSec VPN service.
Question 22
Single choice
Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments. What should you do?
-
A
Create a VPC firewall rule in each VPC to block traffic from any source, with priority 0.
-
B
Create a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.
-
C
Create two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.
-
D
Create two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.
Reveal answer details
Close answer details
Question 23
Single choice
You have the networking configuration shown in the diagram. Two VLAN attachments associated with two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BGP) sessions associated with each of the VLAN attachments. You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow? 
-
A
From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results.
-
B
From the Cloud CLI, run gcloud compute --project PROJECT_ID routers get-status mycloudrouter -- region REGION and review the results.
-
C
From the Google Cloud console, navigate to the Hybrid Connectivity, select the Cloud Router, and view
BGP sessions.
-
D
From the Cloud CLI, run gcloud compute routers describe mycloudrouter --region REGION and review the results.
Reveal answer details
Close answer details
Question 24
Single choice
You are designing a Google Kubernetes Engine (GKE) cluster for a rapidly scaling microservices application. The application will have thousands of pods and hundreds of services. The application requires internal pod-to-pod communication and exposure of services internally. You want to follow Google's recommended approach to ensure efficient IP address utilization within your existing Virtual Private Cloud (VPC) subnet while leveraging Google Cloud's native networking capabilities. What should you do?
-
A
Deploy a route-based GKE cluster and rely on GKE-managed routing tables for all pod and service communication.
-
B
Allocate a primary IP address range for the entire cluster to encompass both node, pod, and service IP addresses.
-
C
Configure the GKE cluster to use a VPC-native mode with the main subnets primary IP range for nodes, and separate secondary IP ranges for pods and services.
-
D
Implement a mesh of Istio service proxies on every pod to manage all internal pod-to-pod communication and service discovery.
Reveal answer details
Close answer details
Correct answerC
ExplanationGoogle's recommended model is a VPC-native GKE cluster. In this design, node IPs come from the subnet's primary range, while Pods and Services use separate secondary IP ranges implemented with alias IPs. This provides efficient IP address utilization and uses Google Cloud's native networking model for large-scale Pod and Service networking.
Question 25
Single choice
Your company's current network deployment is composed of a single VPC that is connected to a single data center by a Dedicated Interconnect connection. The Dedicated Interconnect topology has a 99.9% SLA. There is a single VLAN attachment for each of the two Dedicated Interconnect links. All VLAN attachments only use IPv4 addresses. Between the data center and the VPC, only IPv4 routes are exchanged by BGP. You need to create a solution to exchange IPV6 routes between the data center and the VPC. You must use a procedure that requires the least amount of setup effort and minimizes costs. It's impossible to add new BGP peers to the configuration of the on-premises routers. Only modifications of the existing BGP peers are possible. What should you do?
-
A
Modify the stack type of the existing VLAN attachments from IPv4 only to dual stack. Add a pair of new IPv6-only interfaces to the cloud router. Add the new IPv6 BGP peers to the cloud router corresponding to on-premises routers.
-
B
Enable BFD on the cloud router where the BGP sessions between your cloud router and the on-premises router are configured.
-
C
Delete the existing VLAN attachments. Create two new dual stack VLAN attachments. Enable multiprotocol BGP (MP-BGP) on all the BGP sessions between your cloud router and the on-premises router.
-
D
Modify the stack type of the existing VLAN attachments from IPv4 only to dual stack. Enable multiprotocol BGP (MP-BGP) on all the BGP sessions between your cloud router and the on-premises router.
Reveal answer details
Close answer details
Correct answerD
ExplanationThe least-effort and lowest-cost approach is to update the existing Dedicated Interconnect VLAN attachments from IPv4-only to dual-stack and then enable multiprotocol BGP on the existing IPv4 BGP sessions. Google Cloud supports exchanging IPv6 routes over an existing IPv4 BGP session with MP-BGP, as long as the VLAN attachment is dual-stack. This matches the constraint that you cannot add new BGP peers and only want to modify the existing ones.
Question 26
Single choice
You want to implement an IPSec tunnel between your on-premises network and a VPC via Cloud VPN.
You need to restrict reachability over the tunnel to specific local subnets, and you do not have a device capable of speaking Border Gateway Protocol (BGP). Which routing option should you choose?
-
A
Dynamic routing using Cloud Router
-
B
Route-based routing using default traffic selectors
-
C
Policy-based routing using a custom local traffic selector
-
D
Policy-based routing using the default local traffic selector
Reveal answer details
Close answer details
Question 27
Single choice
You work for a multinational enterprise that is moving to GCP.
These are the cloud requirements:
- An on-premises data center located in the United States in Oregon and New York with Dedicated
Interconnects connected to Cloud regions us-west1 (primary HQ) and us-east4 (backup)
- Multiple regional offices in Europe and APAC.
- Regional data processing is required in europe-west1 and australia-southeast1.
- Centralized Network Administration Team.
Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us-west1. What should you do?
-
A
- Create 2 VPCs in a Shared VPC Host Project.
- Configure a 2-NIC instance in zone us-west1-a in the Host Project.
- Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.
- Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.
- Deploy the instance.
- Configure the necessary routes and firewall rules to pass traffic through the instance.
-
B
- Create 2 VPCs in a Shared VPC Host Project.
- Configure a 2-NIC instance in zone us-west1-a in the Service Project.
- Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.
- Attach NIC1 in VPC #2 us-west1 subnet of the Host Project. - Deploy the instance.
- Configure the necessary routes and firewall rules to pass traffic through the instance.
-
C
- Create 1 VPC in a Shared VPC Host Project.
- Configure a 2-NIC instance in zone us-west1-a in the Host Project.
- Attach NIC0 in us-west1 subnet of the Host Project.
- Attach NIC1 in us-west1 subnet of the Host Project
- Deploy the instance.
- Configure the necessary routes and firewall rules to pass traffic through the instance.
-
D
- Create 1 VPC in a Shared VPC Service Project.
- Configure a 2-NIC instance in zone us-west1-a in the Service Project.
- Attach NIC0 in us-west1 subnet of the Service Project.
- Attach NIC1 in us-west1 subnet of the Service Project
- Deploy the instance.
- Configure the necessary routes and firewall rules to pass traffic through the instance.
Reveal answer details
Close answer details
Question 28
Multiple choice
You are creating a new application and require access to Cloud SQL from VPC instances without public IP addresses. Which two actions should you take? (Choose two.)
-
A
Activate the Service Networking API in your project.
-
B
Activate the Cloud Datastore API in your project.
-
C
Create a private connection to a service producer.
-
D
Create a custom static route to allow the traffic to reach the Cloud SQL API.
-
E
Enable Private Google Access.
Reveal answer details
Close answer details
Question 29
Single choice
Your company hosts a critical banking application in Google Cloud VPC. This application frequently interacts with a Cloud SQL for MySQL instance that stores sensitive customer data. Due to strict compliance and security requirements, all communication between your application's VPC and the Cloud SQL instance must remain private without traversing the public internet. You need to conserve IP space as much as possible and establish a communication connection with minimal network overhead and complexity. What should you do?
-
A
Establish a Private Service Connect endpoint between your application's VPC and the Google-
managed service producer network.
-
B
Deploy a private Compute Engine instance with a custom proxy server in your application's VPC, and route all Cloud SQL traffic through this proxy.
-
C
Establish a Private Service Access connection between your application's VPC and the Google-
managed service producer network.
-
D
Use Cloud SQL connector to connect to the Cloud SQL instance.
Reveal answer details
Close answer details
Correct answerA
ExplanationPrivate Service Connect provides private, VPC-internal connectivity to a Google-managed service without requiring large reserved IP ranges for service networking, which conserves IP space and keeps traffic off the public internet with minimal configuration overhead.
Question 30
Single choice
Your organization recently exposed a set of services through a global external Application Load Balancer.
After conducting some testing, you observed that responses would intermittently yield HTTP 4xx or 5xx error response codes. You already enabled and reviewed the health check logs. You need to identify the error. What should you do?
-
A
Access a VM in the VPC through SSH to access the backend VM directly. If the request is successful from the VM, increase the quantity of backends.
-
B
Delete the load balancer and backend services. Create a new Passthrough Network Load Balancer.
Configure a failover group of VMs for the backend.
-
C
Validate the health of the backend service. Enable logging for the backend service and identify the error response in Cloud Logging. Review the statusDetails log field.
-
D
Validate the health of the backend service. Disable any Cloud Armor policies on the backend service, and identify any error response in Cloud Logging. Review the statusDetails log field.
Reveal answer details
Close answer details
Correct answerC
ExplanationWhen using a global external Application Load Balancer, intermittent HTTP 4xx or 5xx errors are often related to backend health or configuration issues. To diagnose the issue effectively:
1. Validate the health of the backend service to ensure that the instances are correctly responding to requests and passing health checks.
2. Enable logging for the backend service in Google Cloud Logging, which provides detailed information about requests and responses, including error codes.
3. Review the statusDetails log field in Cloud Logging. This field provides specific details about why requests failed, which can help pinpoint configuration errors, network issues, or application-level problems.
Question 31
Single choice
You manage a Cloud NAT gateway for a subnet that contains many virtual machines. Connection usage varies sharply during the day. You need to reduce unused port allocation while still allowing the gateway to scale ports for busy instances. What should you enable?
-
A
Static port allocation with the minimum ports per VM set to the highest expected value.
-
B
Dynamic port allocation on the Cloud NAT gateway.
-
C
Endpoint-independent mapping on the Cloud NAT gateway.
-
D
Manual NAT IP address allocation with one reserved external IP address.
Reveal answer details
Close answer details
Correct answerB
ExplanationDynamic port allocation lets Cloud NAT allocate ports to VMs based on actual demand instead of reserving a fixed large number of ports for every VM. This helps reduce wasted port capacity while still scaling for instances that need more connections. Static port allocation with a high minimum can over-allocate ports.
Endpoint-independent mapping changes how mappings are reused and does not solve variable port allocation. Manual NAT IP allocation controls which NAT IP addresses are used, but it does not by itself dynamically allocate ports per VM.
Question 32
Single choice
You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements: Each Google Cloud project must represent an internal project that your team will work on. After an internal project is finished, the infrastructure must be deleted. Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources. You have 10-100 projects deployed at a time. While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable with centralized management. What should you do?
-
A
Create a single project and single VPC for each internal project.
-
B
Create a single Shared VPC and attach each Google Cloud project as a service project.
-
C
Create a single project and additional VPCs for each internal project.
-
D
Create a Shared VPC and service project for each internal project.
Reveal answer details
Close answer details
Question 33
Single choice
Your organization, TerramEarth, is launching a global application to manage credit card payments. There are some client VMs inside the same VPC as the application that need to access this application privately.
Due to compliance requirements, the internal clients cannot use the global external IP address of the application. Currently, Cloud DNS only resolves myglobalapp.terramearth.com to the public IP address with a public zone. The clients will need to reach myglobalapp.example.com, without using its external IP address. You need to configure Cloud DNS to follow this requirement while following Google-recommended practices. What should you do?
-
A
Create a sub-domain named internal.terramearth.com. Add the new DNS entry (myglobalapp.internal.terramearth.com) to the sub-domain pointing to the internal IP address from the application VM.
-
B
Configure a query logic script inside Cloud DNS to check the source IP address from the VPC, and respond with a modified DNS record to include the internal IP address from the application VM.
-
C
Configure a private zone for the application record (myglobalapp.terramearth.com) and point to the internal IP address of the application VM. Bind this zone to the VPC.
-
D
Promote the ephemeral IP address from the application VM to static, add this static ip address to each internal client's host file, and change the myglobalapp.terramearth.com DNS record to this new static IP address.
Reveal answer details
Close answer details
Correct answerC
ExplanationTo meet the compliance requirement of using private connectivity for internal clients while adhering to Google-recommended practices: Create a private DNS zone in Cloud DNS for myglobalapp.terramearth.com and define an A record that resolves to the internal IP address of the application VM. Bind the private zone to the VPC where the internal clients and the application reside. This ensures that DNS queries from VMs in the VPC resolve myglobalapp.terramearth.com to the private IP address instead of the public IP address. With this setup, internal clients can access the application privately using its domain name while the public zone remains untouched for external users.
Question 34
Single choice
You manage a highly dynamic e-commerce website that uses Cloud CDN to improve content delivery speed for its global customer base. A new product launched on the website with updated images and pricing information, and these changes were pushed to your Cloud Storage and Compute Engine instances behind a load balancer. However, customers are still seeing the old product images and pricing on the website. You need to immediately and efficiently push the new content to users. What should you do?
-
A
Temporarily disable and then re-enable Cloud CDN on the backend services to force a cache reload.
-
B
Invalidate the specific URLs or URL prefixes corresponding to the updated product images and pricing information in Cloud CDN.
-
C
Configure a new backend service with the existing backends with Cloud CDN enabled to get the updated content.
-
D
Purge all cached content from Cloud CDN by performing a full cache flush for the entire CDN service.
Reveal answer details
Close answer details
Correct answerB
ExplanationURL invalidation is the fastest and most efficient way to remove stale objects from Cloud CDN while minimizing impact on other cached content. Invalidating only the updated product image and pricing URLs (or their prefixes) forces Cloud CDN to fetch the new versions from the origin on the next request and quickly propagate the update to users.
Question 35
Single choice
You want to use Cloud Interconnect to connect your on-premises network to a GCP VPC. You cannot meet Google at one of its point-of-presence (POP) locations, and your on-premises router cannot run a Border Gateway Protocol (BGP) configuration. Which connectivity model should you use?
-
A
-
B
-
C
Partner Interconnect with a layer 2 partner
-
D
Partner Interconnect with a layer 3 partner
Reveal answer details
Close answer details
Question 36
Single choice
You are configuring a new HTTP application that will be exposed externally behind both IPv4 and IPv6 virtual IP addresses, using ports 80, 8080, and 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest-possible latency while ensuring high availability and autoscaling, and create native content-based rules using the HTTP hostname and request path. The IP addresses of the clients that connect to the load balancer need to be visible to the backends. Which configuration should you use?
-
A
Use Network Load Balancing
-
B
Use TCP Proxy Load Balancing with PROXY protocol enabled
-
C
Use External HTTP(S) Load Balancing with URL Maps and custom headers
-
D
Use External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header
Reveal answer details
Close answer details
Question 37
Single choice
You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network. Currently, there is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability. What should you do?
-
A
Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
-
B
Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
-
C
Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
-
D
Use HA VPN. Configure one tunnel from each interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.
Reveal answer details
Close answer details
Question 38
Single choice
You create multiple Compute Engine virtual machine instances to be used as TFTP servers. Which type of load balancer should you use?
-
A
-
B
-
C
-
D
Reveal answer details
Close answer details
Question 39
Single choice
You correctly configured Cloud DNS forwarding zones to point towards your on-premises DNS. You noticed that you cannot query your on-premises Active Directory main Domain Controller by using "dig ad.company.int" over your interconnect attachment. However, the query is successful if you directly target your on-premises DNS server by using "dig @10.10.10.53 ad.company.int". You need to correctly configure Cloud DNS so VMs and other resources can correctly resolve DNS records in your on-premises
DNS system. What should you do?
-
A
Make sure that the Cloud DNS source range is advertised over your BGP sessions towards the on-premises environment, and that the on-premises ingress firewalls allow traffic from this range on port
53.
-
B
Change the local DNS server in your Google Cloud VMs from 169.254.169.254 to your on-premises service, 10.10.10.53.
-
C
Use a nslookup query instead of a dig query.
-
D
Add an egress firewall rule in your VPC to allow DNS traffic on port 53 that is destined to your on-premises DNS server.
Reveal answer details
Close answer details
Correct answerA
ExplanationWhen Cloud DNS forwarding is used, the forwarded queries originate from Google-managed Cloud DNS resolver source IP ranges, not from the VM's IP. Your on-premises environment must be able to route return traffic to those resolver source ranges and allow them through firewalls on TCP/UDP 53. Once the Cloud DNS source range is reachable and permitted, VMs can resolve on-premises records via the default metadata DNS.
Question 40
Single choice
You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. The connectivity between the two environments is through the public internet. Your users are reporting
intermittent connection errors when using TCP to connect; however, ICMP tests show no failures.
According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?
-
A
Create a Connectivity Test. Review the results for configuration issues in the VPC routing table.
-
B
Enable and review Cloud Logging for Cloud Armor. Look for logs with errors that match the destination
IP address of the public SaaS provider.
-
C
Enable and review Cloud Logging on your Cloud NAT Gateway. Look for logs with errors that match the destination IP address of the public SaaS provider.
-
D
Enable the Firewall Insights API. Set the Deny rule insights observation period to one day. Review Insight results to assure there are no firewall rules denying traffic.
Reveal answer details
Close answer details
Correct answerC
ExplanationEnabling Cloud NAT logging surfaces NAT gateway events, like ephemeral port exhaustion or allocation failures, that can disrupt TCP sessions without affecting ICMP. Reviewing those logs for your SaaS provider's destination IP around the error window will reveal whether Cloud NAT is dropping or throttling connections, giving you direct insight into intermittent outbound TCP failures.
Question 41
Single choice
You want Cloud CDN to serve the https://www.example.com/images/spacetime.png static image file that is hosted in a private Cloud Storage bucket. You are using the USE_ORIGIN_HEADERS cache mode. You receive an HTTP 403 error when opening the file in your browser, and you see that the HTTP response has a Cache-Control: private, max-age=0 header. How should you correct this issue?
-
A
Enable negative caching for the backend bucket.
-
B
Change the cache mode to Force cache all content.
-
C
Configure a Cloud Storage bucket permission that gives allUsers the Storage Legacy Object Reader role.
-
D
Increase the default time-to-live (TTL) for the backend service.
Reveal answer details
Close answer details
Question 42
Single choice
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency. How should you design this topology?
-
A
Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
-
B
Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
-
C
Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
-
D
Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them
communicate using private RFC1918 IP addresses.
Reveal answer details
Close answer details
Correct answerD
ExplanationVPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet. References:
https://cloud.google.com/vpc/docs/vpc-peering
Question 43
Single choice
You are implementing a Shared VPC network for your organization, which has distributed teams. One of the application developers works across several teams and notices that they can deploy applications in subnets that are reserved for another application's service projects. You want to ensure that developers can only deploy resources in the subnets that are reserved for their respective service project. What should you do?
-
A
Specify which Shared VPC subnets each application's service projects can access by using the
constraints/compute.restrictSharedVpcSubnetworks organizational constraint.
-
B
Grant the compute.NetworkViewer role to the developer in the Shared VPC host project.
-
C
Restrict another application's project from accessing specific subnets in the host project by using the
constraints/compute.restrictSharedVpcHostProject organizational constraint.
-
D
Grant the compute.NetworkUser role to the developer in the specific Shared VPC service project.
Reveal answer details
Close answer details
Correct answerA
ExplanationUse the constraints/compute.restrictSharedVpcSubnetworks organizational constraint: This constraint allows you to define which Shared VPC subnets are accessible to specific service projects. By applying this constraint, you can limit a service project's access to only the subnets designated for its applications.
Apply the constraint to each service project: This ensures that developers working in a specific service project can deploy resources only in the allowed subnets and not in subnets reserved for other service projects.
Question 44
Single choice
You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on-premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access. What configuration changes should you make to enable Private Google Access while adhering to your security team's requirements?
-
A
1. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
2. Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
-
B
1. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
2. Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
-
C
1. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record painting to Google's private AP address range.
2. Change the custom route that points the default route (0/0) to the default internet gateway as the next hop.
-
D
1. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range.
2. Create a custom route that points Google's private API address range to the default internet gateway as the next hop.
Reveal answer details
Close answer details
Question 45
Single choice
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone. What should you do?
-
A
Update the TTL for the zone.
-
B
Set the zone to the TRANSFER state.
-
C
Disable DNSSEC at your domain registrar.
-
D
Transfer ownership of the domain to a new registrar.
Reveal answer details
Close answer details
Correct answerC
ExplanationBefore disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone. References:
https://cloud.google.com/dns/docs/dnssec-config
Question 46
Single choice
Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two VLAN attachments. The BGP sessions are operational.
You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?
-
A
Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Use the existing Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
-
B
Create an HA VPN gateway and associate the gateway with your two VLAN attachments. Create a new Cloud Router for HA VPN, the peer VPN gateway resources, and the HA VPN tunnels.
-
C
Enable MACsec on the VLAN attachments.
-
D
Enable MACsec on Partner Cloud Interconnect.
Reveal answer details
Close answer details
Correct answerB
ExplanationHA VPN over Cloud Interconnect requires two separate Cloud Router instances - one dedicated to the Interconnect VLAN attachments and a second one for the HA VPN tier. To finish your deployment, you must:
1. Create an HA VPN gateway and associate its two interfaces with your encrypted VLAN attachments.
2. Provision a new Cloud Router for the HA VPN tier (you cannot reuse the Interconnect-tier router).
3. Configure the peer VPN gateway resources and HA VPN tunnels against that new router. This separation ensures the Interconnect BGP session remains distinct from your HA VPN BGP session, as documented by Google's HA VPN over Cloud Interconnect architecture.
Question 47
Single choice
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy. Which GKE resource should you use?
-
A
-
B
-
C
-
D
Reveal answer details
Close answer details
Question 48
Single choice
Your company acquired a new division. The new division's network team requires complete control over their networking infrastructure. You need to extend your existing Google Cloud network infrastructure, that consists of a single VPC, to allow workloads from all divisions to communicate with each other. You want to avoid incurring extra costs and granting unnecessary permissions to the new division's networking team. What should you do?
-
A
- Create a new project for the new division's network team.
- Create a new VPC within the new project.
- Establish a VPC peering between your existing VPC and the new division's VPC.
- Create a new subnet dedicated to the new division's workloads.
- Grant roles/compute.networkUser on the new project to the new division's network team group.
-
B
- Create a new project for the new division's network team.
- Create a new VPC within the new project.
- Establish a VPC peering between your existing VPC and the new division's VPC.
- Grant roles/compute.networkAdmin on the newly created project to the new division's network team
group.
-
C
- Ensure that the project hosting the existing network infrastructure is enabled as a host project.
- Create a new subnet dedicated to the new division's workloads in the existing VPC.
- Grant roles/compute.networkUser on the newly created subnet to the new division's network team
group.
-
D
- Create a new project for the new division's network team.
- Create a new VPC within the new project.
- Establish a VPN connection between your existing VPC and the new division's VPC.
- Grant roles/compute.networkAdmin on the newly created project to the new division's network team
group.
Reveal answer details
Close answer details
Correct answerC
ExplanationUsing a Shared VPC host project lets you keep a single VPC while creating a dedicated subnet for the new division's workloads, enabling native communication without added interconnectivity costs. Granting limited network usage permissions scoped to the subnet avoids giving the new division unnecessary administrative control over the broader network infrastructure.
Question 49
Single choice
You are designing a security-focused network architecture on Google Cloud. Your company has deployed a central inspection VPC that contains a fleet of Cloud Next Generation Firewall (NGFW) appliances. The inspection VPC has a default route with next hop pointing to the passthrough Network Load Balancer with NGFW appliances as backends.
You also have two application VPCs (App-A and App-B) that are not allowed to directly communicate with each other, nor do they have a default route in their VPC. You need to ensure that all traffic originating from App-A and App-B are forced through the inspection VPC to be analyzed by the Cloud NGFW appliances. What should you do?
-
A
Use VPC Network Peering to create a full mesh by peering all three VPCs with each other, and then use firewall rules to deny all traffic between App-A and App-B.
-
B
Create a Network Connectivity Center hub in mesh topology, connect all three VPCs as spokes, and configure the inspection VPC to advertise the default route.
-
C
Create a Network Connectivity Center hub in star topology. Configure the inspection VPC spoke as a center group that advertises a default route, and configure the application VPCs as edge spokes to use that route for inter-VPC traffic.
-
D
Create two separate VPC Network Peering connections: One between the inspection VPC and App-A, and another between the inspection VPC and App-B.
Reveal answer details
Close answer details
Correct answerC
ExplanationUse Network Connectivity Center in a star topology, with the inspection VPC as the center group and the application VPCs as edge spokes. In NCC, a star topology is specifically used to prevent direct communication between spoke VPCs while still allowing them to reach shared services through the center.
By having the inspection VPC advertise the default route, traffic from App-A and App-B can be forced toward the inspection VPC, where the Cloud NGFW appliances sit behind the passthrough Network Load Balancer. This matches the requirement to block direct App-A to App-B communication and steer all outbound traffic through centralized inspection.
Question 50
Single choice
You are configuring an Application Load Balancer. The backend resides in your on-premises data center and is connected by Dedicated Interconnect. You need to ensure the load balancer can reference these on-premises resources. You do not want the traffic to traverse the internet at all. What should you do?
-
A
Configure an internet network endpoint group (NEG) as a backend service as part of the load balancer.
Ensure firewalls are opened for the proxy-only subnet.
-
B
Configure a zonal network endpoint group (NEG) as a backend service as part of the load balancer.
Ensure firewalls are opened for the client source IPs.
-
C
Configure a hybrid network endpoint group (NEG) as a backend service as part of the load balancer.
Ensure firewalls are opened for the proxy-only subnet.
-
D
Configure a Private Service Connect network endpoint group (NEG) as a backend service as part of the load balancer. Ensure firewalls are opened for the client source IPs.
Reveal answer details
Close answer details
Correct answerC
ExplanationTo ensure the Application Load Balancer can reference on-premises resources without traffic traversing the internet, you should configure a hybrid network endpoint group (NEG). Hybrid NEGs allow you to include on-premises endpoints connected through Dedicated Interconnect or VPN as part of the backend for the load balancer. Traffic from the load balancer will use the private connection (Dedicated Interconnect) to reach the on-premises resources. Opening the firewalls for the proxy-only subnet ensures that the load balancer can connect to the backend securely while keeping traffic internal and off the public internet.
|