Google Practice Questions, Discussions & Exam Topics by our Authors
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple
Compute Engine instances, but need to ensure that clients are...
Let's evaluate the options based on the need for session affinity, where clients should be directed to the same instance for both HTTP and TFTP services.
A) No option provided (but we can rule this out because there's no relevant option here)
B) Client IP
- Explanation: Session affinity based on Client IP ensures that requests from a particular client IP address are always directed to the same backend instance. This is useful for cases where you need to keep traffic from a specific client (on-premises host) routed to the same instance consistently.
- Why rejected: This works for general cases of session affinity, but it doesn't take into account protocol-specific needs. In some situations, like when both HTTP and TFTP services are involved, you may want more granularity (e.g., differentiating between HTTP and TFTP requests). This option lacks the level of control necessary for managing multiple protocols.
C) Client IP and protocol
- Explanation: This option combines Client IP and protocol for session affinity. This would ensure that traffic from a specific IP address is routed to the same backend instance based on the protocol (HTTP or TFTP), ensuring that both services are sticky for the client.
- Why selected: This option provides the necessary granularity by considering both the client's IP address and the protocol used. Given that both HTTP and TFTP services need to ro...
Author: Layla · Last updated Jul 26, 2026
You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging.
When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdri...
Let's evaluate each option based on the requirement to log blocked traffic and the current issue of Remote Desktop Protocol (RDP) login failure.
A) Check the VPC flow logs for the instance.
- Explanation: VPC Flow Logs provide information about the traffic to and from network interfaces in your VPC, including allowed and denied traffic. However, VPC flow logs do not log traffic specifically blocked by firewall rules. They log traffic based on network interface activity, but they do not capture detailed firewall-specific logs of blocked traffic.
- Why rejected: While VPC flow logs show traffic flow, they do not capture logs for blocked traffic based on firewall rules, which is the core requirement here.
B) Try connecting to the instance via SSH, and check the logs.
- Explanation: This suggestion focuses on SSH traffic (which uses port 22), but the issue is specifically with Remote Desktop Protocol (RDP), which typically uses port 3389. Since your original issue is about RDP failure and the firewall only allows HTTP (port 80) traffic, testing SSH will not help resolve this problem. Additionally, SSH traffic logs will not show the RDP-related logs you're looking for.
- Why rejected: The issue is with RDP, not SSH. Testing SSH doesn't help you diagnose the problem with RDP or reveal firewall logs for blocked traffic on port 3389.
C) Create a new firewall rule to allow traffic from port 22, and enable logs.
- Explanation: While creat...
Author: IronLion88 · Last updated Jul 26, 2026
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules.
Your organization requires us...
To determine the appropriate level of permissions you need to update the firewall rules in a Shared VPC, we need to analyze each option and the level of access required for modifying firewall rules.
Option A: Security Admin privileges from the Shared VPC Admin
- Security Admin permissions grant control over firewall rules and other security-related resources like IAM policies for security. However, they don’t grant administrative control over the VPC itself, such as managing networks or subnets.
- Why rejected: While you need to modify firewall rules, Security Admin may have broader control over security settings, but it doesn't necessarily provide full control over the VPC network itself, such as permissions for editing the Shared VPC configuration, which is required in this case.
Option B: Service Project Admin privileges from the Shared VPC Admin
- Service Project Admin grants administrative access over the resources within a service project, including networks and firewall rules, but typically doesn’t grant the ability to modify Shared VPC configurations.
- Why rejected: Although this role allows you to manage firewall rules within the service project, it doesn't grant the broader permissions necessary to update firewall rules in the shared VPC itself. This level of access is restricted to service projects and doesn't extend to the shared VPC admin controls.
Option C: Shared VPC Admin privileges from the Organization Admin
- Shared VPC Admin privileges grant the ability to configure and manage a Shared VPC, which includes updating firewall rules, managing network resources, and configuring network peering. These permissions are directly aligned with the task of updating firewall rules in the Shared VPC.
- Why ...
Author: Ming · Last updated Jul 26, 2026
You want to create a service in GCP using IPv6.
What should you do?
To determine the best approach for creating a service in Google Cloud Platform (GCP) using IPv6, let’s evaluate each option:
Option A: Create the instance with the designated IPv6 address
- Explanation: Instances in GCP can have both IPv4 and IPv6 addresses, but simply assigning an IPv6 address directly to an instance may not be sufficient for ensuring the service can be properly reached or load balanced using IPv6. While you can assign an IPv6 address to a VM, you still need to ensure the IPv6 traffic can flow correctly through a load balancer or gateway if you want it to be publicly accessible or if it's part of a larger service architecture.
- Why rejected: Assigning an IPv6 address to an instance works only for the instance itself, but it doesn't scale well for managing traffic or offering a service across multiple instances, particularly for public-facing services. Additionally, this option doesn't help with global or regional availability or ensure load balancing.
Option B: Configure a TCP Proxy with the designated IPv6 address
- Explanation: TCP Proxy load balancing in GCP supports only IPv4 for external traffic. While it can handle TCP traffic, it does not support IPv6 natively for the client-facing portion of the service.
- Why rejected: The TCP Proxy load balancer does not support IPv6 on the frontend (client-facing side). Therefore, it is not an option for services that require IPv6.
Option C: Configure a global load balancer with the designated IPv6 address
- Explanation: Global HTTP(S) Load Balancer and Global TCP/UDP Load Balancer in GCP support IPv6 addresses. These load balancers can accept IPv6 traffic on the frontend and distribute that t...
Author: Olivia · Last updated Jul 26, 2026
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The devic...
To deploy a VPN Gateway for connecting your on-premises network to Google Cloud Platform (GCP), there are a few key considerations:
1. Non-BGP-capable device: Since your on-premises VPN device does not support Border Gateway Protocol (BGP), the solution must rely on static routes, as dynamic routing with BGP won't be feasible.
2. IKEv2 support: Your VPN device supports IKEv2, which is the latest version of the Internet Key Exchange protocol, used for establishing secure connections over VPN tunnels.
3. Minimize downtime and operational overhead: You want a solution that minimizes manual intervention and ensures that the setup can scale smoothly as your network grows.
Option A: Create a Cloud VPN instance, create a policy-based VPN tunnel per subnet, configure the appropriate traffic selectors, and static routes
- Explanation: A policy-based VPN is configured based on traffic selectors, which are specific policies that match the traffic between your on-premises network and the GCP network. For each subnet, a separate tunnel would need to be created and maintained, which could lead to higher operational overhead as the network grows.
- Why rejected: While policy-based VPNs are viable for simpler use cases, they tend to be less scalable compared to route-based VPNs. Managing one policy-based tunnel per subnet becomes cumbersome as the network expands, leading to more manual configuration and maintenance. Google recommends using route-based VPNs over policy-based ones for scalability and ease of management.
Option B: Create a Cloud VPN instance, create a policy-based VPN tunnel, configure the appropriate traffic selectors, and static routes
- Explanation: This option is very similar to Option A, except it doesn't specifically mention creating a tunnel per subnet. Again, policy-based VPNs are chosen here, which can work but aren’t the best for scalability.
- Why rejected: The use of policy-based VPN tunnels is still the limiting factor, as discussed in Option A. Even without per-subnet tunnels, policy-based VPNs still require manual intervention and are not the best for dynamic growth or ease of scaling.
Option C: Create a Cloud VPN instance, create a route-based VPN tunnel, configure the appropriate traffic selectors, and static r...
Author: Joseph · Last updated Jul 26, 2026
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year.
These are the assumptions for both GCP environments.
* Each organization has enabled full connectivity between all of its projects by using Shared VPC.
* Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.
* There are no prefix overlaps between the two organizations.
* Both organizations already have firewall rules th...
To integrate the networking and DNS infrastructure of both organizations (your company and Altostrat) as quickly as possible with minimal downtime, let's break down each option:
Option A: Provision Cloud Interconnect to connect both organizations together
- Explanation: Cloud Interconnect provides a private connection between on-premises data centers and GCP. However, this option is generally used for connecting on-premises networks to GCP, not for connecting two different GCP organizations. Also, Cloud Interconnect is typically more complex and might introduce additional cost and effort, especially if there's no existing need for on-premises connectivity.
- Why rejected: Cloud Interconnect is not the right tool for connecting two GCP organizations directly. It's used for connecting on-premises environments to GCP rather than linking cloud environments. This does not fit the requirements of connecting two GCP organizations.
Option B: Set up some variant of DNS forwarding and zone transfers in each organization
- Explanation: DNS forwarding and zone transfers allow for DNS resolution across different domains or networks. Since both organizations are using custom DNS solutions, setting up DNS forwarding and zone transfers between their DNS servers will enable both organizations to resolve each other's domain names. This is a relatively simple approach that can be implemented quickly and ensures minimal downtime.
- Why selected: This is a lightweight, quick method for DNS integration, and it will allow both organizations to resolve each other's host names, which is a key requirement. Zone transfers or forwarding would ensure DNS resolution across the two organizations' networks. It also minimizes downtime since DNS forwarding can be done without significant reconfiguration.
Option C: Connect VPCs in both organizations using Cloud VPN together with Cloud Router
- Explanation: Connecting the VPCs in both organizations using Cloud VPN and Cloud Router allows the creation of a secure connection between the two organizations over the internet. While this is a viable solution for enabling communication between VPCs in different organizations, it requires VPN configuration and might introduce overhead in managing the tunnel and routes.
- Why rejected: While Cloud VPN with Cloud Router would provide connectivity between VPCs in different organizations, it's not the most optimal solution when compared to the DNS-based approach (Option B). VPN adds complexity and overhead for just DNS integration. It's better suited for general network communication rather than DNS integration.
...
Author: StarlightBear · Last updated Jul 26, 2026
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with a unique ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cl...
To identify the root cause of the issue, let's break down the situation and the options provided:
Key Details:
- Two routers are connected to Google Cloud via VPN, but traffic is only passing through one of them.
- BGP sessions are established between the on-premises routers and the Cloud Router, which means routing is handled dynamically using BGP.
- Both routers have the same routes and priorities.
- Only one router's routes are being added to the routing table, implying that the second VPN connection is not being used for traffic routing.
Option A: The on-premises routers are configured with the same routes
- Explanation: While having the same routes configured on both routers is common, it should not inherently cause the issue. As long as BGP is configured correctly, both routers should be able to propagate their routes to the Cloud Router.
- Why rejected: This is unlikely the issue because having identical routes doesn't prevent traffic from being distributed across both connections. The main issue seems to be with the behavior of BGP routing, not route configuration.
Option B: A firewall is blocking the traffic across the second VPN connection
- Explanation: If a firewall were blocking the second VPN connection, you would likely see a failure to establish a VPN connection or incomplete traffic flow through both VPNs. Since both routers are establishing BGP sessions with the Cloud Router and the traffic is passing correctly across one VPN, this is unlikely to be the cause.
- Why rejected: A firewall issue would most likely prevent the VPN tunnel from being fully established or allow partial traffic through but not cause routing to be limited to just one connection. The routing table problem is more likely tied to BGP configuration.
Option C: You do not have a load balancer to load-balance the network traffic
- Explanation: While a load balancer is used for distributing traffic across multiple backends in an application setup, it is not typically used for load balancing VPN connections. VPN traffic and BGP routing work based on routing tables, not load balancers.
- Why rejected: The issue you're experiencin...
Author: SilverBear · Last updated Jul 26, 2026
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complet...
To complete the physical connection after ordering Dedicated Interconnect in Google Cloud Platform (GCP), you need to provide the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider. Let's evaluate each option:
A) Open a Cloud Support ticket under the Cloud Interconnect category.
- Rejected: While opening a support ticket can be useful for addressing technical issues or getting assistance, it is not the standard method to get the LOA-CFA document. The LOA-CFA is typically available in the GCP Console or sent via email, so this option doesn't directly provide you with the document.
B) Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
- Selected Option: This is the correct and most straightforward method. Once you have ordered the Dedicated Interconnect in the GCP Console, you can go to the Hybrid Connectivity section, where you will find the option to download the LOA-CFA document. This document is necessary for completing the physical connection with your cross-connect provider, so this is the action that directly accomplishes the goal.
C) Run `gcloud compute interconnects describe <interconnect>`.
- Rejected: While running this `gcloud` com...
Author: FrozenWolf2022 · Last updated Jul 26, 2026
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client I...
To identify the potential malicious actor while minimizing disruption to legitimate users, the goal is to isolate the suspect traffic without affecting legitimate users. Let's evaluate each option:
A) Create a Cloud Armor Policy rule that denies traffic and review necessary logs.
- Rejected: Creating a Cloud Armor policy that immediately denies traffic would block access for all users from the identified IP, which could potentially disrupt legitimate users as well, especially if the malicious actor's IP is not accurately identified. Immediate denial could lead to unintentional disruptions.
B) Create a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.
- Selected Option: This is the best choice. In "preview mode," Cloud Armor will not actively deny traffic but will instead log the matched traffic, giving you the ability to review the potential malicious traffic without actually blocking it. This allows you to gather evidence to identify the malicious actor while minimizing disruption to legitimate users. Once you're confident in the identity of the malicious actor, you can enforce the rul...
Author: Harper · Last updated Jul 26, 2026
Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers. The migration to GCP will be lift-and-shift, and all requests to the servers will be served by a single ne...
To deploy the service in GCP with minimal disruption and using a GCP-native solution while accommodating the significant differences across backend servers, let's evaluate each option:
A) Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.
- Selected Option: This is a good approach for a "lift-and-shift" migration because it allows you to automate the deployment and scaling of the backend servers while taking advantage of GCP’s native infrastructure. A managed instance group (MIG) will allow you to create and manage multiple instances from a single image of your on-premises servers, which is suitable when the libraries and configurations are not easily compatible. The target pool behind the load balancer will distribute traffic to these instances efficiently, and GCP will manage instance health and scaling. This solution keeps things GCP-native, leveraging the scalability and management benefits of a MIG, while minimizing manual configuration.
B) Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.
- Rejected: While this option could work for distributing traffic to backend servers, it does not provide the automation, scaling, or management benefits of a managed instance group. It’s more of a static configuration where instances must be manually added to the target pool, which could increa...
Author: Victoria · Last updated Jul 26, 2026
You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for ou...
Let's break down the potential causes of the issue where an instance is not using Cloud NAT for outbound NAT.
A) The instance has been configured with multiple interfaces.
- Selected Option: This is the most likely cause of the issue. If the instance has multiple network interfaces (e.g., one for internal traffic and one for external traffic), the outbound traffic might be routed through the wrong interface that does not route through Cloud NAT. Cloud NAT is configured to handle outbound traffic from instances within a VPC using the default route, so multiple interfaces can cause routing problems if the instance tries to use a non-default interface that doesn't route through Cloud NAT.
B) An external IP address has been configured on the instance.
- Rejected: If the instance has an external IP address configured, it can bypass Cloud NAT entirely by directly using the external IP for outbound traffic. This would not prevent the use of Cloud NAT; in fact, it would bypass Cloud NAT entirely. Cloud NAT is typically used f...
Author: Ahmed · Last updated Jul 26, 2026
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby.
W...
In a scenario where you want to set up two Cloud Routers in a high-availability configuration for Border Gateway Protocol (BGP), one of which is active and the other is standby, you need a way to control which BGP session is preferred for traffic routing. Let's evaluate the options:
A) AS-Path
- Rejected: The AS-Path is used to indicate the Autonomous System (AS) path that a route has taken. While it is a critical attribute in BGP for preventing routing loops, it doesn't directly help with determining which BGP session should be active or standby. AS-Path is more about route filtering and preventing loops, not about influencing which session to prefer in an active-standby configuration.
B) Community
- Rejected: The BGP Community attribute is used to tag routes with specific information that can be used by routers to apply routing policies. While communities can influence routing decisions, they are not designed to manage the active/standby status of BGP sessions. Therefore, it...
Author: Scarlett · Last updated Jul 26, 2026
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to in...
To increase the available bandwidth using Cloud VPN while supporting more traffic between your on-premises network and GCP, here’s a breakdown of the options:
A) Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- Rejected: Increasing the MTU (Maximum Transmission Unit) will allow larger packets to be sent in a single transfer, but this does not directly increase the overall available bandwidth. Additionally, Cloud VPN operates with an MTU of 1460 bytes, and doubling the MTU could cause fragmentation issues. Cloud VPN also has its own MTU limitations, which means this change would likely cause problems rather than improve throughput.
- Scenario where it might be useful: This could help if you're facing issues with large packet fragmentation, but it won't solve the need for more bandwidth.
B) Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- Rejected: This would not provide additional bandwidth because the Cloud VPN gateway will still be limited by the same underlying resources, even though it uses two tunnels. Both tunnels would route through the same resources, meaning the total available bandwidth is still limited.
- Scenario where it might be useful: This might be helpful for redundancy, but it won't improve the throughput if you need to scale the bandwidth.
C) Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the ex...
Author: Scarlett · Last updated Jul 26, 2026
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports th...
When you're disabling DNSSEC for your Cloud DNS-managed zone and encountering issues where DNSSEC-validating resolvers are unable to resolve names, the problem typically stems from DNSSEC-related settings that haven't been fully cleared, specifically at the domain registrar.
Here’s the breakdown of each option:
A) Update the TTL for the zone.
- Rejected: The TTL (Time to Live) setting controls how long DNS records are cached by resolvers, but changing the TTL will not resolve the issue with DNSSEC validation. DNSSEC validation issues are not typically caused by cached records but by missing or incorrect DNSSEC signatures or DS records at the registrar. Simply updating TTL will not affect the state of DNSSEC validation.
- Scenario where it might be useful: Changing TTL could help with caching problems, but it doesn't address the root issue of DNSSEC validation failure.
B) Set the zone to the TRANSFER state.
- Rejected: The TRANSFER state is used when transferring a domain to another registrar or when you're preparing to make significant changes to DNS settings. This state does not address DNSSEC validation or any issues related to DNSSEC signatures. In fact, transferring or setting the zone to TRANSFER might delay resolution without directly solving the DNSSEC issue.
- Scenario where it might be useful: This is helpful when you're transferring a domain, but it’s not related to disablin...
Author: Liam · Last updated Jul 26, 2026
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
* Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.
* The subnetwork logs are not excluded from Stackdriver.
* The instance that is hosting the application can communicate...
The issue you're encountering revolves around missing logs for traffic from an external resource to your Compute Engine virtual machine (VM). Let's break down the details and possible causes:
Observations:
- Flow logs are enabled for the VPC subnet, and firewall rules are set to log traffic.
- The instance can communicate outside the subnet, which suggests that basic networking is functional.
- Other instances within the subnet can communicate outside the subnet, indicating no overarching subnet-level issues.
- The external resource initiates communication, which is key in determining the type of traffic we're dealing with.
- The key issue is that no denied traffic is seen in the logs, which implies the traffic isn't even being processed or logged as denied.
Analyzing Options:
A) The traffic is matching the expected ingress rule.
- Rejected: Ingress traffic refers to traffic coming into the VM, typically from external sources (like the external resource). If the traffic were matching the ingress rule, it would be allowed and logged accordingly. However, the external resource initiates communication, so this option is less likely to be the cause of the issue because we're primarily concerned with the VM's ability to respond to the external resource.
B) The traffic is matching the expected egress rule.
- Rejected: Egress refers to traffic leaving the VM towards external destinations. T...
Author: Aarav2020 · Last updated Jul 26, 2026
You have configured Cloud CDN using HTTP(S) load balancing as the origin for cacheable content. Compression is configured on the web servers, but responses served by Clo...
In this scenario, the issue revolves around the fact that content served by Cloud CDN is not being compressed, despite compression being configured on the web servers. Let's analyze the potential causes and their implications:
Observations:
- Cloud CDN is being used as the origin for cacheable content with HTTP(S) load balancing.
- Compression is configured on the web servers, but the content served by Cloud CDN is not compressed.
Analyzing Options:
A) You have not configured compression in Cloud CDN.
- Selected: This is the most likely cause of the issue. Cloud CDN does not automatically compress responses; compression must be explicitly configured. While the web servers can handle compression, Cloud CDN must be configured separately to serve compressed content, and without this configuration, it may serve uncompressed content from the cache, even if the web servers are configured to compress it.
- Scenario where it can be used: If Cloud CDN is not configured to handle compression, then the content served will be uncompressed, even though the web servers might be doing the compression.
B) You have configured the web servers and Cloud CDN with different compression types.
- Rejected: Cloud CDN does not require different compression types for it to work properly, as long as the content is being served with a proper `Content-Encoding` header (like `gzip`). The issue in this case would be more related to Cloud CDN not being configured to serve compressed content rather...
Author: Aditya · Last updated Jul 26, 2026
You have a web application that is currently hosted in the us-central1 region. Users experience high latency when traveling in Asia. You've configured a network load balancer, but users have not experi...
To decrease the latency for users traveling in Asia, we need to optimize the way users access the web application hosted in the us-central1 region. Let's break down the options and assess which one is most likely to address the latency issue.
Observations:
- Users in Asia experience high latency when accessing the application.
- You have configured a network load balancer, but users have not seen a performance improvement.
Analyzing Options:
A) Configure a policy-based route rule to prioritize the traffic.
- Rejected: Policy-based routing is typically used for directing specific traffic flows based on policies such as source IP, destination IP, or other criteria. While this can be helpful in certain routing or network traffic management scenarios, it does not address the latency issue from users in Asia to a US-based server. It does not improve the overall routing or reduce the physical distance between users and servers, which is the key factor in reducing latency.
- Scenario where it might be useful: This could be helpful for specialized traffic prioritization but won't improve latency in this case.
B) Configure an HTTP load balancer, and direct the traffic to it.
- Selected: An HTTP(S) load balancer would be more effective than a network load balancer because it can leverage global HTTP(S) load balancing to route users to the closest available backend based on the user's location. This would significantly reduce latency for users in Asia by automatically directing them to a nearby GCP region or edge point of presence (PoP), thus reducing the distance and improving performance. HTTP(S) load balancing also supports content ca...
Author: Ethan · Last updated Jul 26, 2026
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have ext...
To ensure that none of the application instances have external IP addresses while interacting with BigQuery and Cloud Storage, you need to rely on private communication methods between your instances and these Google Cloud services. Let's evaluate each option:
A) Enable Private Google Access on all the subnets.
Explanation: Private Google Access allows virtual machine instances without external IP addresses to reach Google APIs (like BigQuery or Cloud Storage) via internal IP addresses. This ensures that your instances can still access BigQuery and Cloud Storage privately without needing an external IP address.
- Selected because this option directly addresses the requirement of enabling private communication with Google services without assigning external IP addresses.
B) Enable Private Google Access on the VPC.
Explanation: This option is essentially similar to A), but it is broader. Enabling Private Google Access on the VPC applies to all subnets in that VPC, ensuring that instances in any subnet can access Google services like BigQuery or Cloud Storage privately, even if they do not have external IP addresses.
- Selected because it ensures all resources in the VPC can access Google services privately, and it doesn't require enabling Private Google Access individually for each subnet.
C) Enable Private Services Access on the VPC.
Explanation: Private Services Access is used to set up private connections to Google services that are not available through the default external IP. It is more suitable for services like Google Cloud SQL, Cloud Memorystore, or partner services rather than for accessing BigQuery or Cloud Storage, which can be accessed with Private Google Access (Option A).
- Rejected because it's more relevant for setting up private connections to ser...
Author: Sofia · Last updated Jul 26, 2026
You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your
Production and Staging departments can communicate with each other, but only via spe...
To design a shared VPC architecture while adhering to strict network and security controls and ensuring controlled communication between Production and Staging departments, let's evaluate the options:
A) Create 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between them. Use firewall rules to filter access between the specific networks.
Explanation: Shared VPCs within a host project are typically used to manage network resources centrally. VPC peering allows communication between two VPCs. While you could use firewall rules to filter traffic between the specific networks, this approach is not ideal because:
- VPC Peering allows traffic between VPCs but doesn't have built-in support for flexible route control or advanced network segmentation.
- Managing complex routing and access control via just VPC peering and firewall rules can become difficult to scale and maintain in large architectures.
Rejected: The use of VPC peering here does not align with Google-recommended practices for highly controlled environments where specific access policies need to be enforced across departments.
B) Create 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement (FRA) to filter access between the specific networks.
Explanation: Cloud VPN and Cloud Router provide encrypted communication between VPCs and offer flexible route advertisement. However, VPNs are generally used for connecting on-premises networks or VPCs across regions or different cloud environments. Using Cloud VPN for intra-Google Cloud communication adds unnecessary complexity and introduces overhead with encryption and tunneling, which is not ideal for this use case.
Rejected: Cloud VPN is better suited for hybrid or multi-cloud setups and not the most efficient method for intra-Google Cloud communication between VPCs within the same organization.
C) Create 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud Router between them. Use Flexible Route Advertisement ...
Author: Benjamin · Last updated Jul 26, 2026
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a
Cloud Storage bucket. You...
In this scenario, you're looking to provide a service account with the least privilege necessary to retrieve files from a Cloud Storage bucket. Let's evaluate the options to ensure proper access control and minimal privileges.
A) Grant the compute.instanceAdmin to your user account.
Explanation: The `compute.instanceAdmin` role grants permissions related to managing Compute Engine instances, such as creating, deleting, and modifying virtual machines. This is not relevant to accessing Cloud Storage or retrieving files from a bucket.
- Rejected: This role is unrelated to Cloud Storage and does not meet the requirement of granting access to files in Cloud Storage.
B) Grant the iam.serviceAccountUser to your user account.
Explanation: The `iam.serviceAccountUser` role allows a user to impersonate a service account. This is useful when you want users to act on behalf of a service account but doesn’t grant permissions to interact directly with Cloud Storage. It's not the right role for accessing Cloud Storage files.
- Rejected: While this is important for impersonating a service account, it doesn't directly address the need for Cloud Storage access.
C) Grant the read-only privilege to the service account for the Cloud Storage bucket.
Explanation: Granting the `Storage Object Viewer` (read-only) role to the service account fo...
Author: Olivia · Last updated Jul 26, 2026
You converted an auto mode VPC network to custom mode. Since the conversion, some of your Cloud Deployment Manager templates are no longer wo...
When converting an auto mode VPC to a custom mode VPC, you need to explicitly define the subnets and other network-related configurations that were previously automatically created in the auto mode. If your Cloud Deployment Manager templates are no longer working after this change, the issue is likely due to the fact that the templates were designed to work with the auto mode configuration and expect the default network setup (which is automatically created in auto mode).
Let’s evaluate each option:
A) Apply an additional IAM role to the Google API's service account to allow custom mode networks.
Explanation: The problem is likely related to network configuration and not permissions related to the Google API's service account. While IAM roles govern access to resources, custom mode networks do not require a specific IAM role for them to function. The issue lies in the reference to the VPC network in the Cloud Deployment Manager templates.
- Rejected: IAM roles are not the issue here, as the problem is not related to permissions for accessing the VPC but rather the network's configuration.
B) Update the VPC firewall to allow the Cloud Deployment Manager to access the custom mode networks.
Explanation: This would be relevant if the issue was related to firewall rules preventing access to resources. However, the issue seems to be related to the lack of explicit reference to the custom subnets created in the custom VPC network, not a firewall issue.
- Rejected: The firewall configuration is unlikely to be the cause of the problem, since it is more about how the ...
Author: Joseph · Last updated Jul 26, 2026
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the edit...
In this scenario, you need to grant the `roles/editor` role to a project member. Let's evaluate each method and see which ones allow you to do this effectively using automation or scripting.
A) GetIamPolicy() via REST API
Explanation: The `GetIamPolicy()` API is used to retrieve the IAM policy associated with a project, but it doesn't change or modify the policy. It’s a read-only operation that lets you inspect the current permissions. It’s useful for understanding what roles are currently assigned, but not for assigning or changing roles.
- Rejected: This option is used for querying the IAM policy, not for modifying it. Thus, it cannot be used to grant roles.
B) setIamPolicy() via REST API
Explanation: The `setIamPolicy()` API is used to update or set a new IAM policy on a resource, such as a project. This API allows you to grant specific roles, like `roles/editor`, to members programmatically. It’s an appropriate method for automating the process of modifying IAM roles.
- Selected: This method directly modifies the IAM policy by setting the roles and can be automated via scripting, making it a valid option.
C) gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
Explanation: This command is intended for adding IAM policy bindings to a Cloud Pub/Sub resource, not a project. The `gcloud pubsub` commands are specific to managing IAM roles on Pub/Sub resources, not for granting roles at the project level.
- Rejected: Since this command is for Cloud Pub/Sub, it does...
Author: Liam123 · Last updated Jul 26, 2026
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth ...
When optimizing bandwidth utilization for uploads to Google Cloud Storage using a 10-Gbps peering connection and gsutil, you need to consider factors like network latency, TCP behavior, and file transfer efficiency.
Let's evaluate each option:
A) Tune TCP parameters on the on-premises servers
- Key Factor: Network performance, especially in high-bandwidth, high-latency environments (like your 100ms latency) can benefit from optimized TCP settings. TCP parameters such as window size, buffer size, and congestion control can influence how effectively the bandwidth is utilized.
- Reasoning: With 100ms latency, TCP’s default settings might not be optimal. Tuning TCP window size and buffer settings would allow more outstanding data packets to be in flight simultaneously, leading to better throughput on high-latency connections. This could help to fully utilize the 10 Gbps link.
- When Used: This option is ideal in high-latency environments where large amounts of data need to be transferred, and the default TCP settings might cause underutilization of the available bandwidth.
B) Compress files using utilities like tar to reduce the size of data being sent
- Key Factor: Reducing the data size can speed up transfer in some cases, but it won't necessarily help with the bandwidth utilization problem, especially if the compression process adds overhead or the data is already in a compressed format (like video or images).
- Reasoning: Compression is useful if you're sending large files that can be reduced significantly in size, but it won't address the issue of not fully utilizing the available bandwidth (10 Gbps). Also, in your case, file compression could even increase the CPU load, which might limit performance rather than improving it.
- When Used: This option is more useful when transferring data that can be compressed substantially. It wouldn't h...
Author: Krishna · Last updated Jul 26, 2026
You work for a multinational enterprise that is moving to GCP.
These are the cloud requirements:
* An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions us-west1 (primary
HQ) and us-east4 (backup)
* Multiple regional offices in Europe and APAC
* Regional data processing is required in europe-west1 and australia-southeast1
* Centralized Network Administration Te...
When setting up a virtual inline security appliance for Layer 7 (L7) inspection in the us-west1 region with specific requirements, it's essential to align with the Google Cloud best practices regarding network architecture and security appliance deployment. Let’s break down the options and their relevance based on the provided requirements:
Key Requirements:
- You need a virtual inline security appliance for L7 inspection (URL filtering).
- The appliance must be deployed in the us-west1 region.
- You are working with Shared VPC and the network should be centrally managed.
Evaluation of Each Option:
A) Create 2 VPCs in a Shared VPC Host Project
- Reasoning:
- The Shared VPC Host Project is used for managing VPCs centrally. However, in this option, the appliance is being deployed within the Host Project and using multiple VPCs.
- The idea of using 2 VPCs with separate subnets and configuring routes/firewall rules manually adds complexity. While feasible, this setup can create challenges in managing the appliance's security and routing.
- Drawback:
- The setup is more complex than necessary, as it involves configuring two VPCs within a single Host Project. Managing traffic between these VPCs, along with routing and firewall rules, can complicate the deployment, especially with centralized network administration requirements.
B) Create 2 VPCs in a Shared VPC Host Project, Deploy 2-NIC Instance in a Service Project
- Reasoning:
- Using a Service Project with 2 VPCs in a Host Project could make sense for isolating resources and maintaining a secure network. However, the two NICs attached to the instance and configuring routes/firewall rules between VPCs would require careful management of inter-VPC traffic.
- Service Projects typically work well in multi-project environments where workloads are isolated, but managing two VPCs with traffic through the 2-NIC appliance introduces unnecessary complexity.
- Drawback:
- The configuration of the appliance in a Service Project with 2 VP...
Author: Sara · Last updated Jul 26, 2026
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 service...
When designing a Google Kubernetes Engine (GKE) cluster with VPC-native clusters and alias IP ranges, the main considerations are the efficient allocation of IP address space and ensuring scalability to accommodate future growth, both in terms of nodes, Pods, and services. Let's analyze each option based on the growth plans, VPC-native clusters, and alias IP ranges:
Key Factors:
- VPC-native clusters: These clusters use alias IP ranges for Pods and Services, which allows Pods to have their own IPs and helps isolate network traffic.
- Efficient address consumption: The design should minimize IP consumption while accommodating future growth, specifically for the planned increase in nodes, Pods, and services.
- Growth plans: The cluster is expected to grow significantly, reaching 100 nodes, 200 Pods per node, and 1500 services.
Evaluation of Each Option:
A) Create a subnet of size /25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
- Reasoning:
- A subnet of size `/25` (128 IP addresses) is quite small for a cluster that will scale to 100 nodes and 200 Pods per node (20,000 Pods). You need more than 128 IP addresses for both the Pods and Services.
- The `/17` range for Pods and `/21` for Services would result in excessive IP space for both, with the `/17` range allocating 32,768 IP addresses, and the `/21` allocating 2,048 IP addresses. This is inefficient given the actual address requirements, leading to significant wastage.
- Drawback: The IP address ranges are far larger than needed for the planned future scale, leading to unnecessary address consumption and inefficient IP allocation.
B) Create a subnet of size /28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
- Reasoning:
- A `/28` subnet (16 IP addresses) is far too small to accommodate even the initial 10 nodes and 20 Pods per node. The subnet would need to be much larger for the planned growth (100 nodes and 20,000 Pods).
- The `/24` ranges for Pods and Services would allocate 256 IP addresses each, which might be sufficient initially but would not be enough for the future scale of 20,000 Pods and 150...
Author: Maya · Last updated Jul 26, 2026
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow.
Your company requires end-to-end encryption, but you do ...
Given the scenario where you require end-to-end encryption for SMTP and IMAP services, but you do not have access to the SSL certificates, it’s crucial to select the right Google Cloud load balancer to ensure secure and efficient traffic routing. Here's an analysis of each option:
Key Factors:
- End-to-End Encryption: This requirement implies that the connection between the user and your service should be encrypted throughout the entire transmission. However, you don’t have access to the SSL certificates, meaning SSL offloading at the load balancer level is not an option.
- SMTP and IMAP Services: These are typically TCP-based protocols (IMAP uses TCP port 143 or 993, and SMTP uses TCP port 25, 587, etc.), so the load balancer needs to handle TCP traffic efficiently.
Evaluation of Each Option:
A) SSL Proxy Load Balancer
- Functionality: SSL Proxy Load Balancer is designed to terminate SSL/TLS connections at the load balancer level and then forward decrypted traffic to backend services.
- Why It’s Not Ideal: While it provides SSL offloading, your scenario indicates that you don't have access to the SSL certificates. Without these certificates, you cannot use SSL Proxy Load Balancer for offloading and encryption.
- Conclusion: Rejected because it requires SSL certificates, which you don't have.
B) Network Load Balancer
- Functionality: Network Load Balancer operates at the TCP level (Layer 4) and forwards traffic directly to backend instances without inspecting or modifying it. It does not terminate SSL/TLS connections, allowing encryption to remain intact as traffic is forwarded to backend s...
Author: Vivaan · Last updated Jul 26, 2026
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VP...
To allow applications in a partner's network to access resources in your company's VPC without compromising security, we need to ensure that the solutions meet the following requirements:
- No CIDR overlap: Since there is no CIDR overlap between the VPCs, solutions that directly involve network connections across VPCs are necessary.
- Security: The solutions must ensure secure communication between the networks without exposing sensitive resources.
Let’s evaluate the options based on these requirements:
A) VPC Peering
- Functionality: VPC peering allows private connectivity between two VPCs in the same or different organizations. It establishes a secure, direct network path between the VPCs.
- Why It’s Ideal: VPC peering is suitable in scenarios where there is no CIDR overlap because it allows private, secure communication between VPCs without exposing the traffic to the public internet. The connection is entirely internal to Google Cloud.
- Conclusion: Selected because VPC peering allows secure communication between your company’s VPC and the partner’s VPC, and it works well with non-overlapping CIDR blocks.
B) Shared VPC
- Functionality: Shared VPC allows a host project to share a VPC with one or more service projects. The host project controls the VPC, while the service projects can use resources in that VPC.
- Why It’s Not Ideal: Shared VPC is typically used within a single organization, where a central VPC is shared across multiple projects. It doesn’t work in scenarios where the VPCs are owned by different organizations, as in your case.
- Conclusion: Rejected because it requires both VPCs to be within the same organization, and this scenario involves separate organizations.
C) Cloud VPN
- Functionality: Cloud VPN connects your on-premises network or another VPC (partner's network in this case) to your GCP VPC over a secure IPsec VPN tunnel.
- Why It’s Ideal: Cloud VPN provides secure, encrypted communication between the VPCs. It wor...
Author: James · Last updated Jul 26, 2026
You have a storage bucket that contains the following objects:
[1]
[1]
[1]
[1]
Cloud CDN is enabled on the storage bucket, and all four objects have been successfully cached. You want to remove the cached copies of all ...
To remove the cached copies of all the objects with the prefix `folder-a` in the storage bucket using the minimum number of commands, let's evaluate each option.
A) Add an appropriate lifecycle rule on the storage bucket.
- Reasoning: Lifecycle rules in Cloud Storage are generally used for object retention, deletion, or transitioning between storage classes over time. These rules are not designed to directly affect the cache in Cloud CDN. This option does not address the cache invalidation issue and is not relevant for clearing cached copies of objects in Cloud CDN.
- Rejection Reason: Lifecycle rules won’t affect cached data in Cloud CDN, so it doesn’t meet the requirement to clear cached content with a specific prefix.
B) Issue a cache invalidation command with pattern `/folder-a/`.
- Reasoning: Cloud CDN allows you to invalidate cached objects by issuing cache invalidation requests with specific URL patterns. In this case, issuing a command to invalidate the cache for the pattern `/folder-a/` will target all objects with the `folder-a` prefix, ensuring that all cached objects under this prefix are removed from the CDN cache.
- Selected Option Reasoning: This option is the most efficient and directly addresses the problem. A cache invalidation command is a simple and direct way to clear specific cache...
Author: Leah · Last updated Jul 26, 2026
Your company is running out of network capacity to run a critical application in the on-premises data center. You want to migrate the application to GCP. You also want to ensure that the Security team does not lose their ability to monitor traffic to a...
When migrating an application to Google Cloud Platform (GCP) and ensuring that the Security team can monitor traffic to and from Compute Engine instances, you need to select tools that provide network traffic monitoring and logging capabilities. Let's evaluate each option.
A) VPC Flow Logs
- Reasoning: VPC Flow Logs provide detailed information about the network traffic going to and from virtual machine (VM) instances within a Virtual Private Cloud (VPC). This includes data on allowed and denied traffic, source and destination IP addresses, ports, and protocols. This is essential for monitoring network traffic and helps the Security team analyze the behavior of applications in the cloud.
- Selected Option Reasoning: VPC Flow Logs are specifically designed to track network traffic, making them the most relevant and valuable tool for ensuring the Security team can monitor traffic to and from the Compute Engine instances.
B) Firewall Logs
- Reasoning: Firewall logs provide information on the firewall rules applied to network traffic. They capture the actions of firewalls, including when traffic is allowed or denied based on the defined security rules. While useful, they focus more on the enforcement of security rules rather than the overall network traffic.
- Rejection Reason: Firewall logs do not provide comprehensive data on the actual traffic between Compute Engine instances; they only track whether traffic is allowed or blocked by the firewall. This doesn't provide the full picture of network activity that the Security team would require for thorough monitoring.
C) Cloud Audit Logs
- Reasoning: Cloud Audit Logs track administrative activities, including API calls made to Google Cloud resources. They include information about who did what and when, but they do not specifica...
Author: Emma · Last updated Jul 26, 2026
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to us...
When applying a Cloud Armor policy in Google Cloud, the target for the policy needs to be a resource that handles incoming traffic and can work with Cloud Armor, which is used to protect HTTP(S) traffic. Let's evaluate each GKE resource option for applying a Cloud Armor policy.
A) GKE Node
- Reasoning: A GKE Node is a VM instance that runs containers in the GKE cluster. Cloud Armor, however, operates at the HTTP(S) layer, not directly on nodes. Cloud Armor cannot be directly applied to a node, as it is intended for controlling access to HTTP(S) traffic at the load balancing level, not at the individual VM or node level.
- Rejection Reason: GKE Nodes do not directly handle HTTP(S) traffic in the way Cloud Armor is designed to protect. Therefore, this is not the correct target for Cloud Armor.
B) GKE Pod
- Reasoning: GKE Pods are the smallest deployable units in Kubernetes, containing one or more containers. While Pods handle application traffic, they are not typically the point at which Cloud Armor policies are applied. Cloud Armor is designed to be applied at the load balancer level, which routes traffic to the Pods.
- Rejection Reason: Cloud Armor does not apply directly to Pods. Instead, it works with resources that interact with HTTP(S) traffic, such as a load balancer, which routes traffic to Pods.
C) GKE Cluster
- Reasoning: A GKE Cluster represents the overall Kubernetes environment, including multiple nodes, pods, and services. However...
Author: Liam · Last updated Jul 26, 2026
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the
Finance VPC. After you complete the...
To resolve the issue where some users cannot connect to resources in the Sales VPC and the Marketing VPC after configuring VPC peering, let's evaluate the possible options and understand why each might be chosen or rejected.
A) Configure VPC peering in a full mesh.
- Reasoning: VPC peering allows connectivity between two VPCs, but it does not provide automatic transitive peering. In your current configuration, there is peering between Sales → Fice and Marketing → Fice, but there is no direct peering between Sales and Marketing. Without direct peering between these two VPCs, users in one VPC cannot access resources in the other.
- Selected Option Reasoning: The issue arises because VPC peering is not transitive. A full mesh means adding additional peering between the Sales VPC and the Marketing VPC, which would allow the users in all three VPCs to communicate with each other. This resolves the issue by creating direct peering relationships between all three VPCs.
- Rejection Reason: This is the correct approach. Without establishing the proper peering relationships between all three VPCs, connectivity between Sales and Marketing VPCs won’t be possible.
B) Alter the routing table to resolve the asymmetric route.
- Reasoning: Routing tables help determine the path for network traffic, but simply altering the routing tables does not solve the fundamental issue of missing VPC peering. The problem here is the lack of direct peering between Sales and Marketing, not a routing asymmetry.
- Rejection Reason: The issue isn't related to routing paths or asymmetry but to missing peering connections between the VPCs. This option does not directly address the is...
Author: Lucas Carter · Last updated Jul 26, 2026
You create multiple Compute Engine virtual machine instances to be used at TFTP servers.
Which type...
When selecting the appropriate load balancer for multiple Compute Engine virtual machine (VM) instances used as TFTP (Trivial File Transfer Protocol) servers, we need to consider the following key factors:
1. Protocol Compatibility: TFTP typically operates on UDP (User Datagram Protocol) port 69. This is a key factor because not all load balancers support UDP, which is the protocol used by TFTP.
2. Load Balancer Features: The load balancer must be able to distribute traffic across multiple VM instances in a way that works with the TFTP protocol.
Let's evaluate each option:
A) HTTP(S) Load Balancer
- Reasoning: The HTTP(S) Load Balancer is designed to handle traffic over the HTTP and HTTPS protocols, which use TCP. Since TFTP uses UDP, the HTTP(S) load balancer is not suitable for this use case.
- Rejection Reason: HTTP(S) load balancers do not support UDP traffic, so they cannot be used for TFTP servers.
B) SSL Proxy Load Balancer
- Reasoning: The SSL Proxy Load Balancer is used to handle SSL/TLS traffic, which is typically encrypted over TCP connections. Since TFTP does not involve encrypted connections and uses UDP, this load balancer is not suitable.
- Rejection Reason: SSL Proxy Load Bala...
Author: Aarav · Last updated Jul 26, 2026
You want to configure load balancing for an internet-facing, standard voice-over-IP (VOIP) application....
To configure load balancing for an internet-facing, standard Voice-over-IP (VoIP) application, the key factor to consider is the type of traffic that the application will handle. VoIP applications typically use UDP for real-time voice traffic, so selecting a load balancer that supports low-latency, fast communication is crucial.
Let’s analyze the options:
1. A) HTTP(S) load balancer:
- Why rejected: HTTP(S) load balancers are designed to handle web traffic, primarily for HTTP and HTTPS protocols. They operate at Layer 7 (application layer) and provide advanced features like URL routing, SSL termination, and cookie-based session persistence. However, VoIP traffic is not HTTP-based, and HTTP(S) load balancers would introduce unnecessary overhead due to their inability to efficiently handle the low-latency, real-time UDP traffic typical of VoIP applications.
- Scenario where used: Primarily for web applications that use HTTP/S traffic, such as hosting websites or APIs.
2. B) Network load balancer:
- Why selected: Network Load Balancers (NLBs) operate at Layer 4 (transport layer) and can handle both TCP and UDP traffic efficiently, which is ideal for VoIP applications that use UDP for voice traffic. They are designed for low-latency, high-throughput workloads and can scale to handle large volumes of connections, making them an optimal choice for internet-facing VoIP services.
- Scenario where used: For applications requiring high performance, low latency, and the ability to handle large numbers of simultaneous connections...
Author: Chloe · Last updated Jul 26, 2026
You want to configure a NAT to perform address translation between your on-premises network blocks a...
When configuring a NAT solution to perform address translation between your on-premises network blocks and Google Cloud Platform (GCP), you need to ensure efficient handling of IP address translation, high availability, and scalability. Let's analyze each option:
1. A) Cloud NAT:
- Why selected: Cloud NAT (Network Address Translation) is a fully managed, scalable service provided by GCP for performing outbound NAT (source network address translation) for instances without external IP addresses. Cloud NAT is the most suitable option for handling outbound traffic from GCP to external destinations, such as on-premises networks. It provides automatic scalability and reliability without requiring manual configuration of individual instances, which is ideal for cloud environments.
- Scenario where used: Cloud NAT is used when you need to provide a highly available, scalable NAT solution for instances that do not have external IP addresses, enabling them to initiate outbound connections to external networks (e.g., your on-premises network).
2. B) An instance with IP forwarding enabled:
- Why rejected: Enabling IP forwarding on a GCP instance allows it to route traffic between different networks (e.g., between a VPC and on-premises network), but this does not automatically provide NAT functionality. IP forwarding can be used for routing purposes, but without additional configurations like iptables for NAT or external IPs for addressing, this option will not perform address translation on its own.
- Scenario where used: This approach is useful when you need an instance to route traffic but do not specifically require NAT functionality. For example, it could be used for routing between subnets in a VPC, but it won’t address NAT translation needs.
3. C) An instance configured with iptables DNAT rules:
- Why rejected: DNAT (Destination Net...
Author: Siddharth · Last updated Jul 26, 2026
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this ...
When ensuring that your personal SSH key works across all instances in your Google Cloud project, the goal is to make the process as efficient as possible. Let's analyze the available options based on efficiency, scalability, and ease of use:
1. A) Upload your public SSH key to the project Metadata:
- Why selected: Uploading your SSH public key to project metadata ensures that it is automatically available for all instances in the project. This is the most efficient and scalable approach since any new instance created in the project will automatically have your SSH key added to it without needing to manually configure individual instances. This method simplifies key management for your entire project and ensures uniform access.
- Scenario where used: This is the best option for ensuring your SSH key is automatically available on every instance across the project, both for new and existing instances. It’s efficient because you only need to upload the key once to the project metadata, and all instances will have access to it.
2. B) Upload your public SSH key to each instance Metadata:
- Why rejected: While this option would allow your key to work on specific instances, it’s much more tedious and inefficient than using project-wide metadata. You would need to manually upload your public SSH key to the metadata of each individual instance, which becomes increasingly burdensome as the number of instances grows. This method is less scalable and more prone to human error.
- Scenario where used: This method can be useful if you only need your SSH key to be available on a few specific instances, but it is not ideal for large-scale environments where efficiency and scalability are important.
3. C) Create a custom Google Compu...
Author: Ethan Smith · Last updated Jul 26, 2026
In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, ca...
To force instance-A in one subnet to route through a security appliance, instance-B, in another subnet, we need to modify the routing behavior between the two subnets, ensuring that traffic from instance-A is directed through instance-B. Let's analyze the options:
1. A) Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag:
- Why rejected: Creating a more specific route pointing to instance-B without any tags would work in terms of forcing traffic from instance-A through instance-B. However, this approach will apply the route to all traffic within the subnet, which could affect other instances in the same subnet that should not route through instance-B. This is not ideal for providing subnet-level isolation because it applies the route to all instances in the subnet.
- Scenario where used: This could be used in scenarios where you want all traffic from the subnet to route through instance-B, but it doesn’t provide the required isolation for just instance-A.
2. B) Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A:
- Why selected: This option involves creating a more specific route, which will take precedence over the system-generated subnet route. By applying a tag to instance-A, we can ensure that only instance-A uses the route to instance-B. This provides the required subnet-level isolation by routing instance-A's traffic through instance-B while not affecting other instances in the subnet. Tags allow fine-grained control over routing for specific instances, ensuring that only the targeted instance (instance-A) uses the route.
- Scenario where used: This is the best solution for forcing instance-A to route through instance-B while ensuring that other instances in the subnet are unaffected. It provides the necessary isolation and targeted routing ...
Author: Maya · Last updated Jul 26, 2026
You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In one of your instances you notice the master is not responding, even t...
In this scenario, you're trying to access the master node of a Google Kubernetes Engine (GKE) private cluster using kubectl but the master is not responding. Since the cluster is private, the master node doesn't have a public IP address and communication typically happens over a private network. Let’s go through the options and explain which one is correct and why others should be rejected:
1. A) Assign a public IP address to the instance:
- Why rejected: Assigning a public IP address to the instance won't solve the issue because, in a private GKE cluster, the master node is not meant to be accessed directly over the public internet. The key challenge here is related to private networking, not a lack of a public IP for the instance.
- Scenario where used: This could be used if the instance needed to access external resources, but it is irrelevant for accessing the private master node in this case.
2. B) Create a route to reach the Master, pointing to the default internet gateway:
- Why rejected: In a private cluster, the master node is not exposed to the internet, so simply creating a route to the internet gateway will not resolve the problem. The issue lies in connecting to the private IP of the master node from your instance, and routing via the internet is not necessary or appropriate.
- Scenario where used: This could be useful in scenarios where a private resource in the VPC needs to access the internet but does not apply here, since the master node uses private IP addresses.
3. C) Create the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance:
- Why rejected: T...
Author: Ravi Patel · Last updated Jul 26, 2026
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be a...
In this scenario, the goal is to give the networking team read-only access to firewall rules, while ensuring they cannot create, modify, or delete them. We need to carefully evaluate the roles and permissions options to meet this requirement.
Option A: Assign members of the networking team the compute.networkUser role.
- The compute.networkUser role grants the ability to view and manage certain network resources, but not firewalls specifically. It allows users to view networks and other compute resources but does not provide the necessary read access to firewalls. Since this role doesn't directly cover the requirement of viewing firewall rules, it’s not the best fit.
Option B: Assign members of the networking team the compute.networkAdmin role.
- The compute.networkAdmin role grants broad administrative privileges over networking resources, including the ability to create, modify, and delete resources like networks and firewalls. This goes beyond the requirement because it allows modification and creation, which the networking team should not be able to do. Therefore, this role is too permissive and should be rejected.
Option C: Assign members of the networking team a custom role with only the compute.networks. and the compute.firewalls.list permissions.
- A custom role with the compute.firewalls.list permission would allow the net...
Author: Zara1234 · Last updated Jul 26, 2026
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding pro...
To verify that backend instances are responding properly, health checks for an HTTP(S) load balanced service need to be configured in such a way that they test the responsiveness of the backend instances accurately and efficiently. Let's break down each option to understand which one is best suited for this scenario.
Option A: Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
- Setting the request-path to a specific URL used for health checking is a good approach because it allows you to test the backend at a specific endpoint designed for health checks (like `/healthz`). However, PROXY_V1 is used when you need to support certain legacy proxy behaviors. This is usually not necessary for modern health checks, and adding it might complicate things unnecessarily unless a specific use case demands it (e.g., older proxy setups).
- In general, the proxy-header field with PROXY_V1 should be used only when it's required by a specific infrastructure that needs to process such headers. This option is not the most straightforward for a basic health check scenario.
Option B: Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
- Setting the request-path to a specific URL for health checking is essential and correct, but the host header is used to specify a particular domain name, which might be needed for multi-domain configurations (e.g., when serving multiple domains). While this can be useful in more complex scenarios, it is not always required for a basic health check.
- If you're dealing with multiple virtual hosts or domains and need to route health checks based on host headers, then this option would be relevant, but it introduces more complexity than needed for simple heal...
Author: Amelia · Last updated Jul 26, 2026
You need to give each member of your network operations team least-privilege access to create, modify, and delete Cloud...
To meet the requirement of giving each member of the network operations team least-privilege access to create, modify, and delete Cloud Interconnect VLAN attachments, we need to carefully evaluate each option and its permissions.
Option A: Assign each user the editor role.
- The editor role grants broad permissions across Google Cloud resources, including the ability to create, modify, and delete resources in various services. It is not specific to Cloud Interconnect VLAN attachments and gives more permissions than needed, violating the principle of least privilege.
- The editor role is a general-purpose role and would give the network operations team unnecessary access to resources they don’t need to manage, like Compute Engine instances, disks, etc. Therefore, this is not the best option for least-privilege access.
Option B: Assign each user the compute.networkAdmin role.
- The compute.networkAdmin role provides permissions to manage network-related resources, including the ability to create and modify network resources such as Cloud Interconnect, routers, subnets, and VLAN attachments. However, it also includes permissions that go beyond managing Cloud Interconnect VLAN attachments (e.g., managing VPC networks and other networking resources).
- This is more permissive than necessary because it allows access to various network resources beyond VLAN attachments. Therefore, it doesn't fully meet the principle of least privilege and should be rejected.
Option C: Give each user the following permissions only: compute.interconnectAttachments.create, compute.interconnectAttachments.get.
- This option provides the least-privi...
Author: Layla · Last updated Jul 26, 2026
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize i...
When updating instances in a managed instance group (MIG) and introducing a new feature that may not have been heavily tested, the goal is to minimize impact on users if any bugs are present. Let's review each option and determine which one best meets this goal.
Option A: Manually patch some of the instances, and then perform a rolling restart on the instance group.
- Manually patching some instances involves a lot of manual work and doesn't necessarily guarantee controlled testing of the new feature. Patching some instances might also lead to inconsistent environments across the group, increasing the chance of issues.
- A rolling restart will update instances one by one, but it does not allow you to verify the new feature in a more controlled way. This option lacks the ability to isolate and test the new feature before rolling it out more broadly. It is less efficient and introduces more potential risk, so it’s not ideal for minimizing impact from a bug.
Option B: Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
- A rolling update would ensure that the application stays online during the update, as instances are replaced one at a time. However, performing the update across all instances in the group at once doesn't allow for isolating any potential bugs introduced by the new feature. If the feature has a bug, it could impact a large number of users quickly, which contradicts the goal of minimizing impact.
- It’s better to verify the new feature in a smaller, controlled environment first, before rolling out changes to the entire instance group. Therefore, this option is too risky when trying to minimize impact.
Option C: Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
- Deploying a new instance group for the canary allows you to isolate the ne...
Author: FrozenWolf2022 · Last updated Jul 26, 2026
You have deployed a proof-of-concept application by manually placing instances in a single Compute Engine zone. You are now moving the application to production, so you need to increase your applicati...
To move your proof-of-concept application into production with increased availability and autoscaling, it is essential to consider factors like availability across multiple zones, automatic scaling of instances, and management of the application at scale. Let’s break down each option to see which one best meets these goals.
Option A: Create a single managed instance group, specify the desired region, and select multiple zones for the location.
- A managed instance group (MIG) allows for automatic scaling, load balancing, and health checking, which ensures better availability and ease of management. By choosing multiple zones within a region, you can distribute instances across zones, which increases the availability of your application in case of a zone failure.
- This option is ideal for increasing availability, enabling autoscaling, and providing a fully managed setup. It simplifies scaling and ensures high availability in production by using multiple zones.
Option B: Create a managed instance group for each region, select a single zone for the location, and manually distribute instances across the zones in that region.
- Using a MIG for each region and specifying a single zone for each group is not ideal because it limits your application to one zone per region, which defeats the purpose of using multiple zones for higher availability. Additionally, manually distributing instances is error-prone and not scalable.
- This approach does not fully take advantage of the benefits of zone-level redundancy, and it complicates instance management. It’s a less optimal solution for a production environment where high a...
Author: David · Last updated Jul 26, 2026
You have a storage bucket that contains two objects. Cloud CDN is enabled on the bucket, and both objects have been successfully cached. Now you want to make sure that one of the two objects will not be cached anym...
To ensure that one of the two objects is not cached anymore and will always be served directly from the origin, you need to control the caching behavior of the object using HTTP cache headers. Here’s an analysis of each option:
A) Ensure that the object you don't want to be cached anymore is not shared publicly.
- Reasoning: This would restrict public access to the object, but it doesn't necessarily affect how Cloud CDN caches the object. Cloud CDN can still cache objects even if they are publicly accessible.
- Rejected: This option doesn’t directly address caching behavior; it's more about access control.
B) Create a new storage bucket, and move the object you don't want to be cached anymore inside it. Then edit the bucket setting and enable the private attribute.
- Reasoning: Creating a new bucket and marking it as private will make the object inaccessible publicly, which may prevent Cloud CDN from caching it. However, this method is a heavy-handed solution, and it introduces additional management complexity. The object could still be cached based on its HTTP headers.
- Rejected: This is unnecessary and complicated for the goal of simply disabling caching. Moving the object to a...
Author: Emma · Last updated Jul 26, 2026
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You have recently engaged a traffic-scrubbing service and want to res...
To restrict your origin to allow connections only from the traffic-scrubbing service, we need to ensure that only traffic from the service reaches your instances. Here's an analysis of each option:
A) Create a Cloud Armor Security Policy that blocks all traffic except for the traffic-scrubbing service.
- Reasoning: Cloud Armor is a Google Cloud service designed for web application firewall (WAF) capabilities. It can be used to define security policies that allow or block traffic based on a variety of factors like IP addresses, geography, and more. Since you're using a global load balancer, Cloud Armor is ideal for controlling incoming traffic at the edge of your network, allowing you to specifically allow only traffic from the traffic-scrubbing service and block all other traffic.
- Selected: This is the most effective and scalable solution. Cloud Armor can handle the traffic filtering at the load balancer level, making it easier to manage and ensuring your internal resources are protected. It also integrates well with global load balancers.
B) Create a VPC Firewall rule that blocks all traffic except for the traffic-scrubbing service.
- Reasoning: VPC Firewall rules operate at the network level and can control traffic to your instances based on IP address or CIDR ranges. While this would work for blocking traffic, it is typically more complex to manage because the firewall rule would need to be applied to all instances and might not be as fine-tuned as Cloud Armor for this particular use case. Also, VPC Firewall rules are more useful for managing internal traffic rather than external traffic, e...
Author: Sofia2021 · Last updated Jul 26, 2026
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:
* Your ISP is a Google Partner Interconnect provider.
* Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps.
* A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses.
* Most of the data transfer wil...
To choose the most appropriate connectivity solution between your on-premises environment and Google Cloud Platform (GCP) based on the given specifications, let's analyze each option:
A) Provision a Partner Interconnect through your ISP.
- Reasoning: Partner Interconnect provides a direct and high-performance connection to GCP through a service provider, such as your ISP, using the same RFC 1918 address space that your on-premises application requires. This solution is reliable and designed for high bandwidth, with speeds that can scale well beyond typical VPN capabilities, offering performance beyond the 500 Mbps limit you're encountering with VPN. It is well-suited for the requirements of your application, including the ability to burst up to 1.5 Gbps. Partner Interconnect is generally more cost-effective and less complex than a Dedicated Interconnect in most cases, especially when using an ISP that already provides the connection.
- Selected: This is the best option because it provides direct, low-latency, high-performance connectivity to GCP, meets your speed and performance requirements, and is easier to provision and manage compared to a Dedicated Interconnect.
B) Provision a Dedicated Interconnect instead of a VPN.
- Reasoning: Dedicated Interconnect provides a dedicated physical connection between your on-premises network and GCP, offering higher bandwidth (up to 100 Gbps) with lower latency and no packet loss. However, this solution can be more expensive and complex to set up compared to Partner Interconnect, especially considering your existing ISP already supports Partner Interconnect. Also, Dedicated Interconnect might be overkill for your current needs, given that Partner Interconnect can meet your speed and performance requirements more cost-effectiv...
Author: Sophia Clark · Last updated Jul 26, 2026
Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that the caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it a...
To address the issue of a possible DDoS attack and restore access to your critical revenue-generating web application, let's analyze the options based on speed, cost-effectiveness, and how well they address the core issue of mitigating the attack and allowing users to complete transactions.
A) Use Cloud Armor to blacklist the attacker's IP addresses.
- Reasoning: Cloud Armor is a Google Cloud service designed to protect against DDoS attacks and other malicious traffic by filtering unwanted traffic before it reaches your backend instances. It allows you to block or rate-limit specific IP addresses, regions, or even types of traffic. If you suspect a DDoS attack, this is one of the quickest and most effective ways to mitigate the issue, especially if you can identify the malicious IP addresses. It would help ensure that only legitimate traffic reaches your application.
- Selected: This is a highly effective and fast way to mitigate a DDoS attack. It prevents the attack traffic from reaching your backend instances, thereby restoring normal user access and minimizing downtime.
B) Increase the maximum autoscaling backend to accommodate the severe bursty traffic.
- Reasoning: Increasing the maximum autoscaling backend would scale up the number of instances in your managed instance group, helping to accommodate the increased traffic. However, in the case of a DDoS attack, this could end up costing you more by provisioning unnecessary resources, especially when the attack is generating non-legitimate traffic. This does not address the root cause (the DDoS attack) and might only temporarily alleviate symptoms while continuing to expose you to high costs.
- Rejected: Scaling the instances doesn't solve the underlying problem of malicious traffic. It's a resource-intensive approach and could lead to high costs without resolving the DDoS issue. It’s better to block the attack at the edge rather than relying on scaling.
C) Create a global HTTP(s) load balancer and move your application backend to this load balancer.
- Reasoning: A global HTTP(S) load balancer can distribute traffic across multiple regions and provide better traffic mana...
Author: CrystalWolfX · Last updated Jul 26, 2026
You are creating a new application and require access to Cloud SQL from VPC instances without public IP addresses....
To ensure that your VPC instances can access Cloud SQL without using public IP addresses, you need to configure a private connection to Cloud SQL. Let's break down the options and explain which ones are suitable:
A) Activate the Service Networking API in your project.
- Reasoning: The Service Networking API is required to set up private services such as Cloud SQL and other Google Cloud services within your VPC. This API enables the configuration of private IP addresses for Cloud SQL instances, allowing your VPC instances to access Cloud SQL without needing public IP addresses. This is a necessary step when setting up private IP access to Cloud SQL.
- Selected: This is the correct step because it allows you to configure a private connection between your VPC and Cloud SQL.
B) Activate the Cloud Datastore API in your project.
- Reasoning: The Cloud Datastore API is specifically for accessing Google Cloud Datastore, which is a NoSQL database service. Since you're working with Cloud SQL, this API is unrelated and unnecessary for your requirements.
- Rejected: This option is irrelevant because you're dealing with Cloud SQL, not Cloud Datastore, and activating this API will not help with accessing Cloud SQL.
C) Create a private connection to a service producer.
- Reasoning: Creating a private connection to a service producer (like Google’s services) allows you to access services like Cloud SQL privately. This is achieved by creating a private IP address for Cloud...
Author: Aarav · Last updated Jul 26, 2026
You want to use Cloud Interconnect to connect your on-premises network to a GCP VPC. You cannot meet Google at one of its point-of-presence (POP) locations, and your on-premises router cannot run a ...
In this case, you're trying to connect your on-premises network to a Google Cloud Virtual Private Cloud (VPC) via Cloud Interconnect, but there are specific constraints to consider. Let's evaluate the options:
1. Direct Peering: This option requires your on-premises router to be able to support a BGP configuration and for you to meet Google at one of its point-of-presence (POP) locations. Since you cannot meet Google at a POP location and your router cannot run BGP, this option is not viable.
2. Dedicated Interconnect: This option provides a direct physical connection between your on-premises network and Google’s network, requiring you to meet Google at a POP location and support BGP. However, since you can't meet Google at a POP and your router cannot run BGP, this option is also not suitable.
3. Partner Interconnect with a layer 2 partner: This option involves connecting your on-premises network to Google Cloud through a partner’s network that provides Layer 2 connectivity. In this scenario, you do not need to meet Google at a POP location, and your router doesn't have to support BGP. The Layer 2 partner handles the routing and ne...
Author: Mia · Last updated Jul 26, 2026
You have configured a Compute Engine virtual machine instance as a NAT gateway. You execute the following command: gcloud compute routes create no-ip-internet-route
--network custom-network1
--destination-range 0.0.0.0/0
--next-hop instance nat-gateway
--next-hop instance-zone us-centr...
To ensure that the existing instances use the new NAT gateway, you need to apply the appropriate tag to those instances so that the route (which has the `no-ip` tag) will be used for them. Let's analyze the options:
1. Option A: `sudo sysctl -w net.ipv4.ip_forward=1`
This command enables IP forwarding on the instance, allowing it to forward packets between networks. While enabling IP forwarding is required for NAT gateways in general, this command is not relevant to applying a route for existing instances. It is focused on enabling IP forwarding for routing traffic through the gateway. Hence, this option does not address the tagging requirement for the route to be applied to existing instances.
2. Option B: `gcloud compute instances add-tags [existing-instance] --tags no-ip`
This option adds the `no-ip` tag to an existing instance, which is exactly what you need. Since the route you created uses the `no-ip` tag, adding this tag to the existing instances ensures that the route is applied to those instances. This makes the existing instances use the new NAT gateway for internet access.
3. Option C: `gcloud builds submit --config=cloudbuild.yaml --substitutions=TAG_NAME=no-ip`
This command is relat...
Author: Suresh · Last updated Jul 26, 2026
You need to configure a static route to an on-premises resource behind a Cloud VPN gateway that is configured for policy-based routing u...
When configuring a static route to an on-premises resource behind a Cloud VPN gateway, you need to specify the correct next hop for the route. Let’s break down the options and see which is appropriate:
1. Option A: The default internet gateway
The default internet gateway is used for traffic destined for the internet, not for specific on-premises resources behind a Cloud VPN. This option is irrelevant in this case because the goal is to route traffic to on-premises resources, not general internet traffic. Hence, this is not the correct choice.
2. Option B: The IP address of the Cloud VPN gateway
This option would be suitable if you were routing traffic to a Cloud VPN gateway directly. However, in the case of a VPN configured for policy-based routing, the route should be directed to the VPN tunnel, not the gateway itself. The Cloud VPN gateway is a point of entry, but the route should target the specific tunnel endpoint. Hence, this option is not appropriate for policy-based routing.
3. Option C: The name and region of the Cloud VPN tunnel
This option is correct. When configuring static routes for policy-based routing with Cloud VPN, you typically specify the VPN tunnel as the next hop. The tunnel is the actua...
