Google Practice Questions, Discussions & Exam Topics by our Authors
Your product team has web servers running on both us-east1 and us-west1 regions in the prod-servers project. Your security team plans to install an intrusion detection system (IDS) in their ow...
To address the problem of setting up an intrusion detection system (IDS) in a separate Google Cloud project, while the web servers are running in the `prod-servers` project in the `us-east1` and `us-west1` regions, we need to carefully evaluate the options based on the requirements and the key factors involved.
Key Requirements:
1. The IDS must inspect incoming network traffic to the web servers in `us-east1` and `us-west1`.
2. The IDS should be in a separate project, which implies some form of network communication between the web servers in `prod-servers` and the security team's network infrastructure.
3. The solution should ensure proper inspection of traffic from the web servers in both regions.
4. The ability to forward traffic to the IDS or mirror traffic from the web servers to the IDS is essential.
Options Analysis:
Option A: Create a new project and a VPC for the security team. Peer the new VPC with the web servers VPC in the prod-servers project. Create an internal load balancer and the IDS system in both us-east1 and us-west1. Enable Packet Mirroring, and create packet mirroring policies inside the new project.
- Why it could work: By creating a separate VPC for the security team and peering it with the web servers' VPC, you can route the traffic to the IDS. Packet mirroring can help mirror network traffic from the web servers to the IDS system for inspection.
- Why it's not ideal: While this solution sets up VPC peering and allows traffic inspection through packet mirroring, creating internal load balancers in both regions (us-east1 and us-west1) is unnecessary and could complicate the architecture. The IDS system should only need to mirror the traffic and does not require load balancing for this specific use case. This adds complexity and overhead.
- Scenario: This could be used in environments where load balancing is necessary across regions, but it's not the simplest or most efficient approach for IDS deployment.
Option B: Create a host project and a Shared VPC for the security team. Make prod-servers a service project, and relocate the web servers to shared subnets in both regions. Enable IP forwarding on all the web servers. Create the IDS system in a non-shared subnet of us-east1 or us-west1. Configure the web servers to forward the packets to the IDS system.
- Why it’s not ideal: This option suggests relocating the web servers to shared subnets, which could be overly complicated. Shared VPCs are typically used to centralize network management across multiple projects, but moving the web servers to shared subnets and enabling IP forwarding might require significant changes to the current architecture and networking configuration.
- Why it's not ideal: It's a more complicated solution, involving network changes and configurations like IP forwarding on all web servers, which adds complexity. The proposed solution to manually forward packets to the IDS system might not be the most efficient approach and could create unnecessary overhead.
- Scenario: This could ...
Author: FrozenWolf2022 · Last updated Jul 26, 2026
You are in the process of deploying an internal HTTP(S) load balancer for your web server virtual machine (VM) instances. What two prerequisite tasks m...
To deploy an internal HTTP(S) load balancer for your web server VM instances, you must complete certain prerequisite tasks to ensure that the load balancer is properly configured and functions as intended. Let's break down the options and analyze each one:
Option Analysis:
Option A: Choose a region.
- Why it is required: When you create any resource in Google Cloud, including an internal HTTP(S) load balancer, you must specify a region. The region determines the location of the resources like the load balancer, VM instances, and other infrastructure components. It's necessary to define the region because the load balancer and the associated backend services need to be deployed in the same region as the VM instances to route traffic correctly.
- Why it’s essential: Regions are fundamental to setting up network resources in Google Cloud, and an internal load balancer must be region-specific to properly serve traffic to VMs within that region.
- Scenario: This is required for any setup of resources in Google Cloud, and particularly for load balancing resources, as they need to be region-specific.
Option B: Create firewall rules for health checks.
- Why it is required: Internal HTTP(S) load balancers use health checks to verify the availability of backend instances (in this case, the web server VM instances). Without proper firewall rules, the health check traffic may be blocked, preventing the load balancer from determining whether the backend VMs are healthy or not.
- Why it’s essential: Health checks need to be able to communicate with your backend VMs on specific ports (such as HTTP/HTTPS ports). If these firewall rules are not set up correctly to allow health check traffic, the load balancer will not function properly.
- Scenario: This step is essential for proper health check functionality, as the load balancer must be able to communicate with backend VMs to determine if they are responsive.
Option C: Reserve a static IP address for the load balancer.
- Why it’s not required: Internal HTTP(S) load balancers do not require a public-facing static IP address. They are only accessible within your internal network, so there is no need for a static public IP. For internal load balancers...
Author: Noah Williams · Last updated Jul 26, 2026
You have the networking configuration shown in the diagram. A pair of redundant Dedicated Interconnect connections (int-Iga1 and int-Iga2) terminate on the same Cloud Router. The Interconnect connections terminate on two separate on-premises routers. You are advertising the same prefixes from the Border Gateway Protocol (BGP) sessions associated with the Dedicated Interconnect connections. You need to configure one connection as Active for both ingress and egress traffic. I...
To ensure that one Dedicated Interconnect connection is active for both ingress and egress traffic, while the other becomes passive, you need to configure a failover mechanism. The Border Gateway Protocol (BGP) supports this through the use of routing attributes such as MED (Multi-Exit Discriminator) and BGP Route Priority. The selected options should focus on establishing a primary (active) and secondary (passive) route for each direction of traffic.
Let’s analyze each option:
A) Configure the advertised route priority as 200 for the BGP session associated with the active interconnect connection.
- Analysis: Configuring the route priority can influence which BGP route is preferred. In BGP, the lower the priority value, the more preferred the route is. However, without ensuring the other side of the routing path (on the passive link) has a higher priority, this doesn't guarantee automatic failover.
- Why not selected?: This option only addresses the active interconnect but does not directly enable failover in case the active connection fails.
B) Configure the advertised route priority > 10,200 on the active Interconnect connection.
- Analysis: BGP prefers the path with the lower route priority, and setting a priority of > 10,200 on the active connection will make this route unlikely to be preferred unless it's the only one available. However, this configuration doesn’t take into account the failover mechanism for the passive interconnect.
- Why not selected?: The priority value is too high, making this configuration unideal for automatic failover since the passive path is not properly set up.
C) Advertise a lower MED on the active Interconnect connection from the on-premises router.
- Analysis: MED is used in BGP to...
Author: Emma · Last updated Jul 26, 2026
You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible. To ease the transition, you decided to use the same architecture as your on-premises network: a hub-and-spoke model. Your on-premises architecture consists of over 50 spokes. Each spoke does not have connectivity to the other spokes, and all traffic is sent through the hub for security reasons. You need to ensure that the Googl...
To meet the requirement of migrating your on-premises network to Google Cloud while ensuring minimal management overhead, cost, and using default networking quotas and limits, we need to evaluate the best options for implementing a hub-and-spoke architecture in Google Cloud.
Let's analyze each option:
A) Connect all the spokes to the hub with Cloud VPN.
- Analysis: Cloud VPN allows secure, encrypted communication between Google Cloud VPCs and on-premises networks. While you could use VPN to connect each spoke to the hub, Cloud VPN is often more suitable for connecting on-premises networks to Google Cloud, not for large-scale internal communication between multiple VPCs in the cloud. VPN connections can also be expensive and harder to scale for large networks like yours with 50+ spokes. Moreover, it does not inherently prevent spoke-to-spoke communication.
- Why not selected?: Using Cloud VPN for all spokes would introduce high costs and complexity with limited scalability. VPN also requires managing individual connections per spoke, increasing management overhead.
B) Connect all the spokes to the hub with VPC Network Peering.
- Analysis: VPC Network Peering is a more scalable solution that allows VPCs to communicate with each other. Connecting all the spokes to the hub via VPC Network Peering can work well in a hub-and-spoke architecture. However, the drawback is that VPC Network Peering does not inherently prevent spoke-to-spoke communication unless further configurations are applied (e.g., using firewall rules). Additionally, in this case, VPC Peering could result in some management overhead if you have more than 50 VPCs to manage.
- Why not selected?: While VPC Peering is scalable, it could be challenging to manage and ensure no unintended connectivity between spokes. Also, VPC peering connections can become complex when there are a lot of VPCs involved.
C) Connect all the spokes to the hub with Cloud VPN. Use a third-party network appliance as a defaul...
Author: Vikram · Last updated Jul 26, 2026
You have the networking configuration shown in the diagram. Two VLAN attachments associated with two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BGP) sessions associated with each of the VLAN attachments.
Y...
When troubleshooting asymmetric traffic flow between two Dedicated Interconnect connections that terminate on the same Cloud Router, it's essential to gather information about the status of the routing, BGP sessions, and traffic flow between the on-premises routers and the cloud infrastructure.
Let’s break down each option:
A) From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results.
- Analysis: VPC Flow Logs capture information about the traffic flowing to and from your VM instances in Google Cloud. However, these logs focus on traffic between VMs, and they do not provide insights into routing issues related to Interconnect or BGP sessions. While Flow Logs can be useful for understanding ingress and egress traffic for VMs, they do not directly address BGP session or asymmetric routing issues between two Dedicated Interconnect connections.
- Why not selected?: This option is useful for troubleshooting VM-to-VM traffic but not for diagnosing asymmetric traffic flow related to Interconnect or BGP sessions.
B) From the Cloud CLI, run gcloud compute --project PROJECT_ID routers get-status mycloudrouter --region REGION and review the results.
- Analysis: This command provides the status of the Cloud Router, including information about BGP sessions and routes. It is useful for checking the operational state of the router, verifying the BGP session status, and inspecting the routes being advertised and received. This can help identify issues with the BGP session and routing, which could explain asymmetric traffic flow (such as mismatched prefixes or routing inconsistencies).
- Why selected?: This option is ideal because it directly checks the BGP session status and provides insights into the Cloud Router’s configuration and state, helping to troubleshoot asymmetric routing between Interconnect connections.
C) From the Google Cloud console, navigate to Hybrid Connectivity, select the Cloud Router, and view BGP sessions.
- Analysis...
Author: RadiantJaguar56 · Last updated Jul 26, 2026
You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network. Currently, there is no end-to-end connectivit...
To ensure a service level agreement (SLA) of 99.99% availability, you need to design a solution with high availability and redundancy. Let’s review each option based on the key requirements of high availability, redundancy, and service reliability:
A) Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
- Analysis: A single Dedicated Interconnect connection provides high performance but lacks redundancy. If the connection fails, there would be no backup, which violates the 99.99% availability requirement. While Dedicated Interconnect offers low latency and high throughput, it doesn’t meet the redundancy needed for high availability.
- Why not selected?: This option doesn't meet the SLA requirement because it relies on a single connection, meaning there’s no failover in case of an outage.
B) Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
- Analysis: Direct Peering is used for connecting directly to Google Cloud from an on-premises data center but doesn’t offer high availability. While the two tunnels from Classic VPN provide redundancy, the overall solution doesn’t meet the high availability requirement. Classic VPN typically does not provide the level of reliability needed for a 99.99% SLA and is more suitable for lower-cost or less critical connections.
- Why not selected?: This option doesn’t provide the level of availability or redundancy needed to meet the 99.99% SLA. It's a less reliable option for production-grade services.
C) Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
- Analysis: Using two Dedicated Interconnect connections in the same metropolitan area provides redundancy. If one connection fails, the other can take over. ...
Author: Elizabeth · Last updated Jul 26, 2026
Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximu...
When designing a Kubernetes cluster with Google Kubernetes Engine (GKE), the Pod CIDR range is an important consideration as it determines how many Pods can be allocated per node in the cluster. In this case, the application team requires a minimum of 60 Pods per node and a maximum of 100 Pods per node.
The CIDR range directly impacts the number of IP addresses available for Pods on each node. To calculate the required Pod per node CIDR range, we need to determine how many IP addresses are needed to accommodate between 60 and 100 Pods per node.
Calculating the IP range:
- Each IP in the CIDR range corresponds to a Pod.
- The number of available IP addresses per node is determined by the size of the subnet (the CIDR block size).
Analysis of each option:
A) /24
- A /24 subnet has 256 IP addresses. This is much larger than the required range (60–100 Pods). While it can comfortably accommodate 100 Pods per node, it's excessive and wastes IP addresses.
- Why not selected?: A /24 subnet provides more IP addresses than needed, which can lead to inefficient use of IP space and unnecessary overhead.
B) /25
- A /25 subnet provides 128 IP addresses. This can comfortably accommodate up to 100 Pods per node, as required by the application team. It would still leave some ...
Author: Ava · Last updated Jul 26, 2026
You are designing a packet mirroring policy as part of your network security architecture for your gaming workload. Your infrastructure is located in the us-west2 region and deployed across several zones: us-west2-a, us-west2-b, and us-west2-c. The infrastructure is running a web-based application on TCP ports 80 and 443 with other game servers that utilize the UDP protocol. You need to deploy packet mirroring policies and collector instances to monito...
To design a packet mirroring policy for your gaming workload, the objective is to monitor web traffic while minimizing inter-zonal network egress costs. Here's an analysis of each option based on key factors:
Option A:
Create three packet mirroring policies: one for each zone. Create one group of collector instances for the us-west2 region. Configure each packet mirroring policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
- Pros:
- Uses instance-tags to filter traffic, which ensures that only the relevant instances (web servers) in each zone are mirrored.
- The collector instances are centralized in one group for the entire region (us-west2), which minimizes the need for multiple collector groups.
- Cons:
- Having a single group of collector instances might introduce potential issues in handling mirrored traffic if traffic volume is high. This could cause performance bottlenecks.
- Though inter-zonal egress is minimized, the performance impact could increase because of the centralization.
Option B:
Create one packet mirroring policy for the us-west2 region. Create one group of collector instances for the us-west2 region. Configure the packet mirroring policy to match traffic for web server instances based on instance-tags, and create a filter for TCP traffic.
- Pros:
- Simplifies the configuration by using a single packet mirroring policy for the entire region, which reduces complexity.
- Filtering on instance-tags ensures only web server traffic is mirrored.
- Cons:
- This setup mirrors all traffic (including UDP) for the entire region. While the filter is set for TCP traffic, it is not optimized for your gaming workload that uses UDP as well.
- It creates a potential performance bottleneck, especially if there is high traffic volume from other services or game servers.
Option C:
Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
- Pros:
- The setup is more...
Author: FrozenWolf2022 · Last updated Jul 26, 2026
Your company recently migrated to Google Cloud. You configured separate Virtual Private Cloud (VPC) networks for Department A and Department B. You need to configure both VPC networks to have access to the same on-premises location through separate links with full isolation between the VPC networks. Your design must also query on-p...
To address the given requirements, you need to ensure that both VPC networks (Department A and Department B) are isolated from each other while having access to the same on-premises location through separate links. Additionally, you need to configure conditional DNS forwarding for querying on-premises DNS servers, while minimizing operational overhead. Let's break down the options:
Option A: Customize the operating system DNS configuration files to target the on-premises DNS servers.
- Pros: Customizing DNS configurations at the operating system level is a straightforward approach for small-scale setups.
- Cons: This approach would require manual intervention and maintenance on each individual instance. It doesn't scale well as your infrastructure grows, especially when you want to manage multiple workloads across different VPC networks. Also, it doesn't inherently address isolation between the two VPCs or their access to on-premises resources.
- Use Case: This might be a quick solution for very small deployments or a short-term fix, but it won't meet the scaling and isolation requirements in the long term.
Option B: Keep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
- Pros:
- This design maintains isolation between the two departments' VPC networks, as they have separate on-premises links.
- Using separate Cloud DNS private zones ensures that each department's VPC network can resolve internal domain names within its own isolated environment.
- Conditional DNS forwarding can be configured separately, allowing each department to query the on-premises DNS servers.
- Cons:
- While this design meets the isolation and DNS forwarding requirements, it results in increased operational overhead. Each department would require its own on-premises link and separate DNS configurations, increasing complexity for maintaining two separate systems.
- Use Case: This approach is useful if the departments are highly independent and require strict isolation between VPC networks, but it introduces more operational complexity.
Option C: Peer Department A's and Department B's VPC networks to have all on-premises connectivity via a single VPC network. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
- Pros:
- Peering the VPC networks can simplify network management, as both Department A and Depart...
Author: Maya2022 · Last updated Jul 26, 2026
You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements:
* Each Google Cloud project must represent an internal project that your team will work on.
* After an internal project is finished, the infrastructure must be deleted.
* Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources.
* You have 10-100 proje...
To determine the most appropriate option for your Terraform code design, let's break down the key requirements and assess how each option meets those needs:
Key Requirements:
1. Each Google Cloud project must represent an internal project that your team will work on.
2. After an internal project is finished, the infrastructure must be deleted, indicating a dynamic lifecycle.
3. Each internal project must have its own Google Cloud project owner for resource management.
4. You will deploy 10-100 projects at a time, requiring scalability and simplicity in the deployment process.
5. The Terraform code should be simple, reusable, and centralized for efficient management.
Option A: Create a single project and single VPC for each internal project.
- Pros:
- Allows for full control over each project, as every internal project gets its own VPC and project scope.
- Can easily delete the infrastructure by removing the project when it's finished.
- Cons:
- This approach would require a separate VPC for each project, which isn't optimal when scaling to 10-100 projects.
- Managing VPCs and project owners becomes more cumbersome and less efficient with a high number of projects.
- Lacks centralization, which could lead to duplication in code as each project will have its own separate VPC and project configuration.
- Difficult to manage shared resources (e.g., shared DNS, centralized logging) across multiple VPCs.
Option B: Create a single Shared VPC and attach each Google Cloud project as a service project.
- Pros:
- Using a Shared VPC allows all internal projects to use a centralized VPC while maintaining isolated resources within individual projects.
- Centralized management of network resources (subnets, firewall rules, etc.) while projects can have isolated Google Cloud resources.
- It simplifies network management and avoids the need to create separate VPCs for each project.
- With a Shared VPC, projects are easier to manage, and the configuration is centralized in a way that makes the deployment scalable for multiple projects.
- Terraform code can be more reusable as the Shared VPC setup is central, with projects referencing this shared infrastructure.
- Ensures each internal project can be managed independently with separate owners, as the Shared VPC is a network-level concept rather than a project-level one.
- Cons:
- Requires careful management of IAM roles, as the Shared VPC owner must grant appropriate permissions for service projects.
- Can require careful planning of subnets to ensure that each internal pro...
Author: Aria · Last updated Jul 26, 2026
You have the following Shared VPC design. VPC Flow Logs is configured for Subnet-1 in the host VPC. You also want to ...
To monitor VPC Flow Logs for Subnet-2, we need to focus on how to correctly configure VPC Flow Logs in the context of a Shared VPC setup. Let’s analyze each option based on your requirements:
Key Details:
- Shared VPC means that the host project contains the VPC network, and service projects can use the VPC network as a "service" project. The host project manages the VPC resources, and service projects deploy their workloads in subnets within that VPC.
- VPC Flow Logs are used to capture network traffic metadata, providing insights into network activity.
- Subnet-1 has already been configured for flow logs, but now we want to monitor Subnet-2 in the same Shared VPC.
Option A: Configure a VPC Flow Logs filter for Subnet-2 in the host project VPC.
- Pros:
- In a Shared VPC setup, the host project manages the VPC network, so it is responsible for configuring VPC Flow Logs.
- You can enable VPC Flow Logs for any subnet in the host VPC, including Subnet-2.
- It is the correct approach to ensure that flow logs are collected for Subnet-2 in the host project.
- Cons:
- This is the standard and correct approach in a Shared VPC environment, so there are no significant cons.
- Use Case: This option works perfectly in this scenario as you are managing the network at the host level and want to monitor flow logs for a specific subnet in that VPC.
Option B: Configure VPC Flow Logs in the service project VPC for Subnet-2.
- Pros:
- You could configure VPC Flow Logs in the service project directly if Subnet-2 was in a standalone VPC owned by the service project.
- Cons:
- In a Shared VPC setup, VPC Flow Logs should be managed at the host project level for subnets in the host VPC. A service project doesn’t manage VPC configurations, and thus it cannot enable VPC Flow Logs for Subnet-2 in the Shared VPC.
- This option is incorrect because flow logs must be configured on the VPC in the host project where Subnet-2 resides.
- Use Case: ...
Author: Lucas Carter · Last updated Jul 26, 2026
You are configuring your organization's Google Cloud environment to connect to your on-premises network, which does not support Border Gateway Protocol (BGP). Your on-premises network has 30 CIDR ranges that must be reachable from Google Cloud. Your VPN gateway creates a unique child security association (SA) per CIDR. You must ensure that the 30 CIDR ranges in your ...
To connect your organization's Google Cloud environment to your on-premises network, which doesn't support Border Gateway Protocol (BGP), and has 30 CIDR ranges that must be reachable from Google Cloud, we need to consider the best methods for configuring VPN tunnels with Google Cloud and following the Google-recommended practices.
Key Factors:
- Your on-premises network does not support BGP (which typically helps in dynamic route exchange).
- You must accommodate 30 CIDR ranges.
- Each CIDR range requires a unique child security association (SA), meaning each CIDR needs to have a dedicated routing rule or tunnel.
- VPN Gateway Configuration: The solution needs to scale, be efficient, and meet the Google Cloud VPN design best practices for multiple CIDRs.
Let’s break down the options and analyze which ones are appropriate:
Option A: Create a single Cloud VPN tunnel that uses route-based VPN.
- Pros:
- Route-based VPN provides more flexibility for routing and is commonly used for dynamic routing.
- Typically easier to manage than policy-based routing because routes are dynamically learned.
- Cons:
- Since BGP is not supported on your on-premises side, you cannot use dynamic routing to handle the 30 CIDRs effectively with a single VPN tunnel.
- This would typically require multiple static routes or manual configuration for each CIDR, which becomes cumbersome when you need to configure 30 CIDR blocks.
- It doesn’t align well with the requirement for each CIDR to have a unique security association (SA), which suggests a more granular, policy-based approach is needed.
Rejected: A single tunnel is not suitable for handling 30 CIDRs when BGP is not available and each CIDR needs a unique SA.
Option B: Create a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors.
- Pros:
- Policy-based routing can be used for specific traffic selectors.
- This approach could allow you to configure a single tunnel to handle all 30 CIDRs.
- Cons:
- While it could work technically, policy-based routing with multiple CIDRs in a single tunnel is generally not recommended for large numbers of CIDRs because it can make the configuration more complex and harder to manage.
- With 30 CIDRs, this could lead to potential performance or maintenance issues, especially when managing multiple selectors under one tunnel.
Rejected: This method is feasible, but it’s not the best practice for handling 30 CIDRs. It would lead to a more complicated and potentially less scalable setup.
Option C: Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to unique peer IP addresses.
- Pros:
- By creating multiple tunne...
Author: Suresh · Last updated Jul 26, 2026
You have two VPCs: VPC A in Project A and VPC B in Project B. The VPCs are peered, and each VPC has VM instances in four zones. You are using the Network Intelligence Center Performance Dashboard to investigate the packet loss for traffic flows that start in VPC A and term...
To determine the packet loss metric for traffic flows between VPC A and VPC B with at least a 90% confidence level, it's essential to consider how the Network Intelligence Center Performance Dashboard uses metrics from compute instances to calculate the confidence level of the reported packet loss. The more instances there are in each zone, the higher the data volume, which improves the confidence in the metric calculation.
Here’s the reasoning for each option:
1. Option A: Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project A for the reported metric.
- This option would ensure a high data volume with at least 10 compute instances in each zone, which is beneficial for a higher confidence level. However, looking at the reported metric in Project A may not provide the best insight into the flows between VPC A and VPC B, as the performance dashboard could be using data from Project B to evaluate the flows terminating in Project B.
2. Option B: Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project B for the reported metric.
- This option sets a lower threshold of 9 compute instances, which may reduce the confidence level in the metric compared to Option A. However, it looks at the reported metric in Project B, where the traffic is terminating. This is relevant because the terminating project should typically have the most accurate view of the packet loss from the other side, which makes this a viable choice.
3. Option C: Ensure that each zone in each of the VPC ne...
Author: GlowingTiger · Last updated Jul 26, 2026
You are designing a new network infrastructure for your customer in Google Cloud. Your customer requires a connection between two Google Cloud VPCs that must include a VPN tunnel. You want to follow Google-recommended practices...
When designing a new network infrastructure in Google Cloud with a VPN tunnel, Google recommends solutions that maximize availability, scalability, and resilience. Here’s the reasoning behind each option:
Key Factors to Consider:
1. High Availability: Google recommends using High Availability (HA) VPN for maximum availability, as it offers automatic failover and redundancy.
2. Routing Protocol: BGP (Border Gateway Protocol) is favored over policy-based or static routes because it is more scalable and dynamically adjusts to network changes, which is crucial for resilience.
3. VPN Types: Classic VPN is the older VPN solution, while HA VPN is the newer and more resilient solution designed for higher availability and redundancy.
Analysis of Options:
1. Option A: Policy-based VPN using Classic VPN between the two Google Cloud VPCs
- Rejected: Policy-based VPN uses static routing, which is less flexible and doesn’t scale well. It is more prone to manual configuration errors and is not recommended for high-availability configurations in modern Google Cloud setups.
2. Option B: Border Gateway Protocol (BGP)-based VPN using Classic VPN between the two Google Cloud VPCs
- Rejected: ...
Author: Kai · Last updated Jul 26, 2026
Your company is moving to a hybrid cloud environment and needs to connect two on-premises data centers to Google Cloud. Your company has opted for no service level agreement (SLA) on the Dedicated Interconnect ports. You set up a single Dedicated Interconnect to connect each on-premises data center to Google Cloud: one Dedicated Interconnect in us-east1 and another Dedicated Interconnect in us-west1. You also configured a Cloud Router for each Dedicated...
To maximize high availability diversity based on your current hybrid cloud environment setup, the key factors you need to consider include the following:
1. Regional Redundancy: To avoid a single point of failure, it's crucial to have redundancy in each region. Since you have two on-premises data centers and two Dedicated Interconnects (one in `us-east1` and another in `us-west1`), you need to ensure that you have multiple Interconnect attachments for each region and that they are connected in a way that provides failover capability.
2. Attachment Redundancy: The Cloud Router and Dedicated Interconnect configurations should be set up with redundant Interconnect attachments. This allows the system to handle failures more effectively, ensuring high availability if one of the Interconnects goes down.
3. Link Resiliency: Since you're not...
Author: Sofia · Last updated Jul 26, 2026
You are deploying your infrastructure in the us-central1 region. Your on-premises data center is located in New York City, and the Google Cloud region closest to New York City is us-east4. Your Cloud Interconnect is located in Ashburn, Virginia (VA), United States. You need to use Cloud Interconnect to connect your application infrastructure with backend syst...
To determine the best option, we need to consider several key factors: location of the infrastructure, latency, cost, bandwidth needs, and routing configuration. Let's evaluate each option based on these factors:
1. Latency:
- The goal is to minimize latency. The closer your Cloud Interconnect and Cloud Router are to your on-premises data center, the lower the latency will be. The data center is in New York City, and the closest Google Cloud region is us-east4.
- Interconnect is located in Ashburn, VA, which is geographically close to us-east4, so placing resources in this region minimizes latency.
2. Cost:
- Keeping the Cloud Router and VLAN attachments in the same region as your Interconnect will result in lower costs for traffic between the Google Cloud and your on-premises systems.
- Using global routing could incur extra charges, but it's necessary if you want to route traffic from us-central1 to your on-premises systems via us-east4.
3. Bandwidth and Performance:
- The application requires bandwidth up to 500 Mbps. The options that allow you to allocate the bandwidth on VLAN attachments are more suited for this requirement.
4. Global Routing:
- For cross-region traffic, enabling global routing allows a seamless connection across multiple regions. However, using global routing when not necessary may introduce additional complexity and cost.
Now, let's review the options in detail:
A) Create a Cloud Router and VLAN attachments in the us-east4 region attached to your physical Interconnect in Ashburn, VA. Enable global routing in your VPC. Set the bandwidth on the VLAN attachments to 500 Mbps.
- Pros:
- This option places the Cloud Router and VLAN attachments in us-east4, which is the closest region to your data center in New York City. It reduces latency by keeping the connection local.
- The bandwidth can be set to 500 Mbps, which meets your requirement.
- Cons:
- Enabling global routing in this case may be unnecessary because you don't need routing to regio...
Author: Sofia · Last updated Jul 26, 2026
You have provisioned a Cloud Interconnect connection with a VLAN attachment. You configured Border Gateway Protocol (BGP) between your on-premises router and your Cloud Router. After deploying and testing the connection, you discover that the BGP session is not established betw...
When troubleshooting an issue with a Cloud Interconnect connection where the BGP session is not established, it's essential to focus on the factors that directly impact the BGP session establishment process, including proper configuration on both the Cloud Router and the on-premises router. Here's an analysis of the options:
Option Breakdown:
A) From the Google Cloud console, run `gcloud compute routers get-status` to verify the Address Resolution Protocol (ARP) learned.
- Reasoning: While ARP can be important for verifying network reachability, it is not directly related to resolving issues with BGP session establishment. BGP relies on IP addresses and routing, not directly on ARP. Hence, this option is less likely to resolve the issue with BGP session setup.
- Rejected: Not directly relevant for troubleshooting BGP session failure.
B) Verify that you have configured the on-premises router's subinterface with a subnet mask of /31.
- Reasoning: BGP requires a point-to-point connection for which a /31 subnet mask is essential. In a point-to-point connection (such as between a Cloud Router and an on-premises router), using a /31 subnet allows both devices to have unique IP addresses and establish BGP peer relationships. If this is misconfigured, BGP won't be able to establish a session.
- Selected: This is a key step in ensuring the on-premises router and Cloud Router can communicate properly for BGP.
C) Verify that you have configured the on-premises router's eBGP multihop with a minimum hop length of 4.
- Reasoning: eBGP multihop is typically used when BGP peers are not directly connected, meaning there are intermediate routers. Since y...
Author: Emma · Last updated Jul 26, 2026
Your company has a single on-premises data center that needs to be connected to a VPC in Google Cloud. The total bandwidth requirement is 10Gbps. The connection must be redundant and have a minimum SLA of 99.9%. Due to the sensitive na...
When considering the best solution for connecting your on-premises data center to Google Cloud with the required bandwidth, redundancy, SLA, and low latency, let's evaluate each option based on the following key factors:
- Bandwidth Requirements: The total bandwidth required is 10 Gbps, which is significant, so we need a solution that can support this bandwidth efficiently.
- Redundancy: The solution needs to be redundant to ensure availability and fault tolerance, with a minimum SLA of 99.9%.
- Latency: Since the workloads are sensitive, low latency is essential.
- Cost and Complexity: Some solutions are more complex and costly, so we need to balance performance with budget constraints.
Option A: Order a 10Gbps Partner Interconnect VLAN attachment. Create a Cloud Router in your Google Cloud VPC.
- Pros:
- A Partner Interconnect can provide high bandwidth and is well-suited for medium to large-scale workloads. It can also offer redundancy if you use multiple connections.
- Partner Interconnect typically offers low latency and good performance.
- Cons:
- Partner Interconnect connections are provided by service providers, which means they might have certain limitations in terms of physical infrastructure and availability.
- May not offer the same level of redundancy or SLA guarantees as Dedicated Interconnect.
- This option is suitable for medium bandwidth needs but may not always meet the SLA and redundancy levels required for your specific case (10 Gbps with 99.9% SLA).
Option B: Order two 10Gbps Dedicated Interconnect connections in a single metropolitan area (metro). Distribute the connections across different edge availability domains. Create a Cloud Router and two 10Gbps VLAN attachments.
- Pros:
- Dedicated Interconnect offers high bandwidth (10 Gbps) and is ideal for workloads requiring low latency and high performance.
- By distributing the connections across different availability domains, you ensure redundancy, which meets the 99.9% SLA requirement.
- Dedicated Interconnect provides a direct, private connection to Google Cloud, which minimizes latency and offers better performance than VPN options.
- High availability is a key feature with this setup, and the SLA is met due to redundancy.
- Cons:
- This option can be more expensive than Partner Interconnect or VPN options because you'r...
Author: Evelyn · Last updated Jul 26, 2026
Your company deployed a hub and spoke architecture in Google Cloud to host their workloads. They use VPC network peerings to connect the hub and the spokes. You need to rep...
When replicating your hub and spoke architecture in Google Cloud using Network Connectivity Center (NCC), we need to evaluate each option based on how VPCs are configured in NCC and how traffic flows between them. The goal is to replicate a hub-and-spoke design using NCC, considering the role of hub VPC and spoke VPCs.
Key factors to consider:
1. Network Connectivity Center (NCC) Topology: NCC supports both star and mesh topologies.
- Star topology: Typically used for hub-and-spoke architectures, where the hub connects to the spokes but not directly to each other.
- Mesh topology: All networks can directly communicate with one another. This is usually more complex than a hub-and-spoke setup.
2. Hub and Spoke Design: In a hub-and-spoke architecture, all spoke VPCs connect to a single hub VPC. The hub VPC acts as a central point, facilitating communication between all spokes.
Evaluating the options:
Option A: Choose a Network Connectivity Center star topology. Deploy the hub VPC in the center group. Deploy the spoke VPCs in the edge group.
- Pros:
- This star topology mimics the hub-and-spoke model, where the hub VPC is in the center and spoke VPCs are in the edge group, just as they should be in a typical hub-and-spoke design.
- The hub VPC serves as the central point for routing traffic to and from the spoke VPCs.
- This is the most direct and correct representation of a hub-and-spoke architecture using NCC.
- Cons:
- No notable cons for this approach in this context.
Option B: Choose a Network Connectivity Center star topology. Deploy the spoke VPCs in the center group. Deploy the hub VPC in the edge group.
- Pros:
- This configuration places the spokes in the center and the hub in the edge group.
- Cons:
- This does not represent a typical hub-and-spoke architecture. In the hub-a...
Author: Isabella · Last updated Jul 26, 2026
You are deploying HA VPN within Google Cloud. You need to exchange routes dynamically between your on-premises gateway and Google Cloud. You have already created...
When configuring HA VPN within Google Cloud, the goal is to enable dynamic route exchange between your on-premises gateway and Google Cloud. This typically involves using BGP (Border Gateway Protocol) for dynamic route advertisement and management. Let’s evaluate each option:
Key Factors to Consider:
1. Dynamic Route Exchange: For dynamic route exchange, BGP is commonly used, which allows automatic route updates between the on-premises and Google Cloud environments.
2. HA VPN: High availability VPN is designed for redundancy, and it requires proper configuration of VPN tunnels, Cloud Routers, and BGP sessions.
3. Cloud Router: This is essential for handling dynamic routes and integrating BGP.
4. VPN Tunnels: You need to properly configure VPN tunnels to ensure stable communication between your on-premises gateway and Google Cloud.
Option A: Create a Cloud Router, add VPN tunnels, and configure BGP sessions.
- Pros:
- This is the correct approach for dynamically exchanging routes using BGP. A Cloud Router is used to handle BGP sessions, and VPN tunnels are configured to connect the on-premises gateway to Google Cloud.
- BGP allows dynamic route advertisement and will enable the routes to be exchanged without manual static configuration.
- This aligns with best practices for HA VPN deployment with dynamic routing.
- Cons:
- There are no major cons for this option. It is the most common and suitable approach for dynamic routing with HA VPN.
Option B: Create a Cloud Router, add VPN tunnels, and configure static routes to your subnet ranges.
- Pros:
- Static routes can be configured for routing between the on-premises network and Google Cloud.
- Cons:
- Static routes do not allow for dynamic route exchange between networks, which is a key part of your requirement. Static routes require manual configuration for each new subnet or network, which can be error-prone and difficult to maintain...
Author: Akash · Last updated Jul 26, 2026
You are implementing a VPC architecture for your organization by using a Network Connectivity Center hub and spoke topology:
* There is one Network Connectivity Center hybrid spoke to receive on-premises routes.
* There is one VPC spoke that needs to be added as a Network Connectivity Center spoke.
Your organization has limited routable IP space for their cloud environment (192.168.0.0/20). The Network Connectivity Center spoke VPC is connected to on-premises with a Cloud Interconnect connection in the us-east4 region....
To implement the optimal VPC architecture for your organization while minimizing the use of routable IP addresses, let’s break down each option and analyze them against your requirements:
Key Requirements:
1. Limited IP Space: The organization has a restricted IP range (192.168.0.0/20), so careful planning is necessary.
2. Multiple Regions: Resources in multiple Google Cloud regions (us-west1, europe-central1, and asia-southeast1) need to reach the on-premises network.
3. Minimizing IP usage: We need to minimize the use of IP addresses to prevent unnecessary consumption of the IP space.
4. On-Premises Connection: Cloud Interconnect is being used in the `us-east4` region, with an on-premises IP range of 172.16.0.0/16.
Option Analysis:
Option A:
1. Private NAT Gateway in each region: A separate NAT gateway is set up in three regions (us-west1, europe-central1, asia-southeast1) with individual subnets.
- This consumes a total of 3 subnets (one per region) with each using a block like `192.168.1.0/24`, `192.168.2.0/24`, and `192.168.3.0/24`.
2. Export Include Policy: The export includes only the NAT subnets to advertise to the hub.
- The NAT gateway would only advertise the subnets for those specific regions.
3. Global Dynamic Routing: This ensures that resources from other regions can reach on-premises resources through the `us-east4` region.
Why it could work: The method uses a separate NAT gateway per region with subnet configurations, helping minimize IP address consumption across regions. However, it does not scale as efficiently as other options, especially when we consider managing separate subnets in each region and using up multiple subnets for NAT gateways.
Limitations: It still consumes more IP space than necessary for routing to on-premises and could lead to inefficient usage of the limited IP range. Multiple subnets in various regions increase complexity.
Option B:
1. Private NAT Gateway in each region: Similar to Option A but uses on-premises IP space (`172.16.x.x`), so it maps to the on-premises network.
- NAT gateways are placed in three regions with subnets `172.16.1.0/24`, `172.16.2.0/24`, `172.16.3.0/24`.
2. Export Include Policy: The export includes only the NAT subnets to advertise to the hub.
3. Global Dynamic Routing: Ensures cross-region communication with on-premises resources.
Why it could work: It uses on-premises IP space, which could help in certain hybrid network architectures, especially when managing IPs between on-premises and the cloud.
Limi...
Author: Aarav · Last updated Jul 26, 2026
You have several VMs across multiple VPCs in your cloud environment, which require access to internet endpoints. These VMs cannot have public IP addresses due to security policies, so you plan to use Cloud NAT to provide outbound internet access. Within your VPCs, you have several subnets in each region. You want to ensure that only specific subnets have access to the internet throu...
To provide internet access for VMs in multiple VPCs without assigning public IP addresses to the VMs (using Cloud NAT), and to ensure that only specific subnets have internet access while adhering to Google-recommended practices, let’s evaluate the options based on security, scalability, manageability, and best practices:
Key Considerations:
1. Cloud NAT Configuration: You need to use Cloud NAT to provide outbound internet access to VMs that don't have public IP addresses. Cloud NAT enables VMs to reach the internet while keeping them private.
2. Subnet Access: Not all subnets in your VPC should have internet access. Only specific subnets should be allowed, and this must be enforceable through configuration to avoid mistakes by other administrators.
3. Security: Restricting internet access to certain subnets is crucial, and misconfigurations should be minimized.
4. Ease of Maintenance: Aligning with Google-recommended practices ensures that your configuration is scalable, maintainable, and secure.
Option A: Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure all primary and secondary subnet source ranges.
- Pros:
- This method can work by using firewall rules to deny egress traffic to the internet by default and only allow traffic from specific subnets.
- The configuration gives fine-grained control over which subnets are allowed to access the internet.
- Cons:
- While this works, using firewall rules for egress control is not a best practice when it comes to Cloud NAT. Firewall rules are typically used for ingress traffic, and managing egress rules in this way can lead to complexity and potential misconfigurations.
- You would need to maintain and monitor these firewall rules continuously, which can increase the risk of human error.
- This approach also doesn’t align directly with Google’s recommended practice for using Cloud NAT.
Option B: Create a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the constraint to a folder that contains the associated projects. Configure the allowedValues to only contain the subnets that should have internet access. Deploy Cloud NAT and select only the allowed subnets.
- Pros:
- This solution uses an organizational policy constraint to enforce which subnets can use Cloud NAT. It is a Google-recommended best practice and allows for centralized management across multiple projects.
- The constraint enforces the configuration at the organizational level, preventing unauthorized subnets from accessing the internet through Cloud NAT.
- Minimal human error is introduced because the policy is enforced programmatically, not by administr...
Author: SilverBear · Last updated Jul 26, 2026
Your organization has five different VPCs across different projects in y our Google Cloud organization that need high-throughput connectivity. You have performed an audit of the IP address utilization in each VPC, and there are two overlapping subnets that are used by two of the VPCs: 240.0.0.0/16 and 240.128.0.0/24. You have confirmed that no Class E subnets (240.0.0.0/4) will require inter-VPC connect...
Key Considerations:
- You have five different VPCs across different Google Cloud projects that need high-throughput connectivity.
- Overlapping subnets (240.0.0.0/16 and 240.128.0.0/24) are used by two of the VPCs, and these cannot be used for inter-VPC connectivity, but other subnets need to communicate.
- The goal is to establish connectivity between all the VPCs while addressing the issue of overlapping subnets and avoiding interference with Class E addresses (240.0.0.0/4).
Evaluation of Options:
Option A: Create a full mesh of VPC Network Peering connections between all five VPCs. Make sure not to import or export subnet routes with public IP addresses. Add Cloud network firewall policy rules to allow traffic.
- Pros:
- Full mesh VPC peering provides direct connectivity between every pair of VPCs. It’s a simple solution that allows for direct communication between all VPCs.
- It ensures high-throughput connectivity since VPC peering connections are optimized for internal communication.
- Cons:
- VPC Peering with overlapping subnets can cause problems. In your case, the overlapping subnets (240.0.0.0/16 and 240.128.0.0/24) will create routing conflicts. The absence of an exclude filter for the overlapping subnets makes this approach unsuitable.
- Managing a full mesh of peering connections for five VPCs can become complex and difficult to scale as the number of VPCs increases. It could also result in increased administrative overhead and potential misconfigurations.
Option B: Create a Network Connectivity Center hub with a mesh topology. Add a VPC spoke for each of the five VPCs and configure an export exclude filter for 240.0.0.0/4. Add Cloud network firewall policy rules to allow traffic.
- Pros:
- Network Connectivity Center (NCC) with a mesh topology allows centralized management of multiple VPCs, which can reduce the complexity of managing connectivity between the VPCs.
- Export exclude filter for 240.0.0.0/4 is a critical advantage. It allows the exclusion of the problematic overlapping subnets, ensuring that these subnets do not cause routing issues.
- This solution aligns with Google Cloud's best practices for connecting multiple VPCs while handling overlapping address spaces.
- Cons:
- While this approach is clean and scalable, it may require setting up NCC correctly and could incur additional costs compared to VPC Peering, depending on the volume of data exchanged between the VPCs.
- It requires careful firewall policy configuration to allow traffic between the VPCs.
Option C: Create a series of mult...
Author: Manish · Last updated Jul 26, 2026
You are attempting to establish a HA VPN to your on-premises network; however, the VPN connection is not establishing successfully. You have full administrative control over the Google Cloud networking environment and the on-premises firewalls that are acting as the VPN devices. The Google Cloud console shows "Negotiation failure" and "BGP is down". You check Cloud Logging by using a query for resource.type="vpn_gateway" and resource.labels.gateway_id="TUNNEL_ID_NUMBER". Logs Explorer shows frequent log entries:
log name: =E2=80=A6/logs/cloud.googleap...
Problem Overview:
The error message `received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built` and the status `Negotiation failure` and `BGP is down` indicate that there is an issue during the negotiation of the VPN tunnel between your Google Cloud environment and the on-premises network. This type of error usually points to a mismatch in the VPN settings, such as the encryption and authentication settings, or the BGP configuration.
Key Considerations:
1. Error Message: The error `"received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built"` indicates that there is a mismatch in the Phase 2 settings of the IPsec VPN tunnel. This typically refers to an incompatibility in the settings such as encryption algorithms, hash algorithms, or the Diffie-Hellman group used during the tunnel establishment.
2. BGP Down: The fact that BGP is down suggests a routing issue or a BGP configuration mismatch.
3. Troubleshooting Focus: The primary focus should be on the Phase 2 IPsec settings and ensuring the configurations match on both sides (Google Cloud and on-premises firewall), as this is directly tied to the error you're seeing.
Evaluation of Options:
Option A: Update the Google Cloud BGP session configuration to match the BGP peer ASN on the on-premises side.
- Pros:
- This option addresses the BGP configuration mismatch, which is indicated by the `BGP is down` status.
- Cons:
- BGP issues are related to routing and peer establishment, but the specific error in Cloud Logging (`NO_PROPOSAL_CHOSEN`) points to an issue with the IPsec settings rather than BGP. BGP being down may be a result of the tunnel not being established due to mismatched IPsec settings.
- While BGP settings are important, the problem seems to be primarily related to Phase 2 IPsec negotiations.
Option B: Compare and review the Phase 2 settings on the on-premises firewall. Make sure the settings match one of the supported cipher suites for HA VPN.
- Pros:
- This directly addresses the error message in the logs, which points to an issue with Phase 2 IPsec negotiation (`NO_PROPOSAL_CHOSEN`).
...
Author: Suresh · Last updated Jul 26, 2026
Your team deployed two applications in GKE that are exposed through an external Application Load Balancer. When queries are sent to www.mountkirkgames.com/sales and www.mountkirkgames.com/get-an-analysis, the correct pages are displayed. However, you have receiv...
Problem Overview:
You have deployed two applications in GKE, both exposed through an external Application Load Balancer. The URLs `www.mountkirkgames.com/sales` and `www.mountkirkgames.com/get-an-analysis` work correctly, but `www.mountkirkgames.com` yields a 404 error. This indicates that the root path (`/`) is not properly routed to an application, likely because there is no default service or path defined for it.
Key Considerations:
1. Root Path Handling: When a user accesses `www.mountkirkgames.com` (i.e., the root path `/`), the load balancer needs to know how to route traffic for that path. If it's not properly configured, a 404 error will occur.
2. Ingress vs. Service: In Kubernetes, Ingress resources define how HTTP(S) traffic is routed to services. On the other hand, Service resources define how traffic is routed internally within the cluster. For external access and path-based routing, the Ingress resource is key.
3. Default Backend: In the context of an Ingress resource, a default backend is specified to handle requests that don't match any defined path rules.
Evaluation of Options:
Option A: Review the Service YAML file. Add a new path rule for the character that directs to the base service. Reapply the YAML.
- Pros:
- This option suggests adding a wildcard path (``) rule to route all unmatched traffic to the base service. However, Service YAML files typically define how traffic is routed within the cluster to individual pods, not how it is routed based on paths in external HTTP requests.
- Cons:
- The Service YAML does not handle path-based routing; this is done via the Ingress resource. Modifying the Service YAML will not address the problem of routing the root path (`/`).
- This option is not correct because it attempts to define path rules in the wrong resource (the Service), where such rules are not applicable.
Option B: Review the Ingress YAML file. Add a new path rule for the character that directs to the base service. Reapply the YAML.
- Pros:
- Adding a wildcard path (``) in the Ingress YAML file can direct all unmatc...
Author: Ming · Last updated Jul 26, 2026
Your multi-region VPC has had a long-standing HA VPN configured in "region 1" connected to your corporate network. You are planning to add two 10 Gbps Dedicated Interconnect connections and VLAN attachments in "region 2" to connect to the same corporate network. You need to plan for connectivity between your VPC and corporate network ...
To ensure traffic between your VPC and corporate network uses the Dedicated Interconnect connections as the primary path and the HA VPN as the secondary path, you need to configure the routing appropriately. This involves setting up priorities for BGP routes, as well as leveraging regional or global dynamic routing modes.
Key Factors in Routing Decisions:
1. Priority Values in BGP: The higher the priority value, the less preferred the route. By configuring lower priorities (base priority) for the Dedicated Interconnect connections (in "region 2"), you ensure they are preferred over the HA VPN (in "region 1").
2. Routing Mode (Regional vs. Global):
- Regional Dynamic Routing Mode is used when you need to configure routes for a single region. It is more appropriate when traffic within a region is isolated to that region’s VPC and Interconnects.
- Global Dynamic Routing Mode is appropriate for multi-region setups, where you need to configure routing that spans multiple regions, especially when connecting to services in different regions.
3. Multi Exit Discriminator (MED): MED values are used to indicate to the on-premises routers which path is preferred. Matching this between your on-premises routers and Google Cloud’s BGP configuration helps ensure that your network consistently uses the correct path.
Analyzing Options:
- Option A: Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi exit discriminator (MED) values.
- Pros: This ensures that the HA VPN has a higher preference (lower priority value) than the VLAN attachments (Dedicated Interconnect), which means HA VPN will be the primary path.
- Cons: The use of regional dynamic routing may limit scalability across regions.
- Scenario Use: This is suitable if you are only concerned with traffic within "region 1" and don’t need cross-region traffic flow to be managed centrally.
- Option B: Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in "region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi exi...
Author: Ming · Last updated Jul 26, 2026
Your company uses Compute Engine instances that are exposed to the public internet. Each compute instance has a single network interface with a single public IP address. You need to block any connection attempt that originates fro...
To block connections originating from specific BGP Autonomous System Numbers (ASNs), you need to use a security tool that can filter traffic based on the ASN information. Google Cloud Armor is the most suitable tool for this purpose, as it provides the ability to create security policies that allow or block traffic based on source ASN.
Key Factors in Decision:
1. Cloud Armor Security Policies: Cloud Armor allows you to create rules for blocking traffic based on attributes like IP addresses, geographic location, and ASNs. It is specifically designed to handle high-performance traffic filtering and access control.
2. Types of Security Policies:
- Backend Security Policy: This is typically used for blocking or allowing traffic at the backend level, which can be tied to specific backends in your load balancer.
- Network Edge Security Policy: This policy type is designed for blocking or allowing traffic at the network edge (i.e., before the request reaches your backends).
- Edge Security Policy: Similar to the network edge, this type focuses on the traffic entering from the external network, typically used with external HTTP(S) Load Balancers.
3. Firewall Policies: Firewall policies generally allow you to configure network-level rules, but they do not offer the advanced traffic filtering options available with Cloud Armor, such as ASN-based filtering.
Evaluating Options:
- Option A: Create a new Cloud Armor backend security policy, and use the --network-src-asns parameter.
- Pros: Cloud Armor backend security policies are used to manage traffic for backend services and can include source ASN-based filtering. However, this is not the best choice when you're targeting traffic entering the network at the edge.
- Cons: Since the traffic is originating from the internet and is meant to be filtered before hitting the backend, using a backend-specific policy may not be optimal for blocking traffic at the network edge.
- Scenario Use: This could work if you're specifically targeting traffic after it has been forwarded to your backend but not before.
- Option B: Create a ...
Author: Oscar · Last updated Jul 26, 2026
Your frontend application VMs and your backend database VMs are all deployed in the same VPC but across different subnets. Global network firewall policy rules are configured to allow traffic from the frontend VMs to the backend VMs. Based on a recent compliance requirement, this traffic must now be inspected by network virtual appliances (NVAs) firewalls that are deployed in the same VPC. The NVAs are configur...
To ensure that the traffic between the frontend VMs and the backend database VMs is inspected by the network virtual appliances (NVAs), which are deployed in the same VPC, you need to properly configure routing and direct traffic through the NVAs for inspection. The NVAs will act as proxies for the traffic, and you need to ensure the traffic is sent to them before reaching the backend.
Key Factors:
1. Internal Passthrough Network Load Balancer (ILB): The ILB acts as a proxy, redirecting traffic from frontend VMs to NVAs for inspection and then back to the backend VMs. It ensures that traffic is inspected without changing the IP address, as required by your compliance regulations.
2. Policy-Based Routing (PBR): PBR allows traffic to be directed based on the source or destination IP addresses, providing flexibility in routing traffic through specific appliances like NVAs.
3. Network Tags: Using network tags allows you to target specific sets of VMs for routing, ensuring the traffic from the right source (frontend VMs) is directed to the NVAs and not bypassed.
Evaluating Options:
- Option A: Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add the global network firewall policy rules to allow traffic through your NVAs. Create a policy-based route (PBR) with the source IP range of the backend VM subnet, destination IP range of the frontend VM subnet, and the next hop of ILB1. Scope the PBR to the VMs with the backend network tag. Add a backend network tag to your backend servers.
- Pros: This option uses PBR with the correct source and destination IP ranges (backend to frontend), ensuring the traffic goes through the NVAs.
- Cons: The scope of the PBR is set to backend VMs, but it should instead apply to frontend VMs, as the traffic originates from the frontend. This will result in the wrong VMs being targeted by the PBR.
- Scenario Use: This option would not work because PBR needs to be scoped to the frontend VMs (the source of the traffic) and not the backend VMs.
- Option B: Place your NVAs behind an internal passthrough Network Load Balancer named ILB1. Add global network firewall policy rules to allow traffic through your NVAs. Create a custom static route with the destination IP range of the backend VM subnet, frontend instance tag, and the next hop of ILB1. Add a frontend network tag to your frontend VMs.
- Pros: This option ensures that traffic from the frontend VMs (source) to the backend VMs (destination) passes through the NVAs, with routing properly configured for inspection.
- Cons: The use of static routes without more flexible contr...
Author: Joseph · Last updated Jul 26, 2026
Your organization wants to set up hybrid connectivity with VLAN attachments that terminate in a single Cloud Router with 99.9% uptime. You need to create a network design for your on-premises router that meets those requirements and ...
To meet the requirements of creating a network design for hybrid connectivity with VLAN attachments that terminate in a single Cloud Router, ensuring active/passive configuration with only one VLAN attachment used at a time, we need to carefully consider the approach for routing between your on-premises router and Google Cloud.
Key Factors:
1. Active/Passive Configuration: This requires that one path is active at any given time, while the other remains passive (standby). This is important because we need to prevent simultaneous traffic on both VLAN attachments.
2. Uptime Requirement: Since the Cloud Router must maintain 99.9% uptime, any solution chosen should ensure that traffic reroutes efficiently if there is a failure in the primary path.
3. BGP Attributes for Path Selection: BGP provides several attributes to control path selection, which can help in controlling which path is used in active/passive configurations. We need to use one that ensures only one path is active.
Evaluating Options:
- Option A: Create a design that uses the LOCAL_PREF BGP attribute to influence the egress path from Google Cloud to the on-premises environment.
- Pros: The LOCAL_PREF attribute is a good way to prioritize paths within an autonomous system (AS). Setting a higher LOCAL_PREF value for one VLAN attachment would ensure that it is preferred over the other. This can help achieve an active/passive configuration where only one path is active.
- Cons: LOCAL_PREF is used within an AS, meaning it does not affect inter-AS routing decisions. If you have multiple ASes or BGP neighbors, LOCAL_PREF would not provide a suitable way to control path selection between the on-premises router and Cloud Router.
- Scenario Use: This is effective for controlling egress paths within the same AS but might not be suitable if you're looking for cross-AS path management.
- Option B: Create a design that uses an equal-cost multipath (ECMP) with flow-based hashing on your on-premises devices.
- Pros: ECMP allows multiple paths to be used simultaneously for load balancing. Using flow-based hashing will distribute traffic across multiple paths.
- Cons: ECMP inherently uses multiple paths, which contradicts the requirement of having only one VLAN attachment active at a time. This would not...
Author: Akash · Last updated Jul 26, 2026
You are implementing firewall controls to protect your computer resources in a newly created VPC. To make the protection process easier to manage and control, you've defined the hierarchical firewall policies, global network firewall policies, and VPC firewall rules. The configuration of rules defines the following characteristics:
* The hierarchical firewall policy, bound at the organization level, is allowing/denying spe-cific external traffic.
* There is a global network firewall policy with rules that enforce intrusion prevention sys-tem (IPS) capabilities for specific external inbound/outbound traffic.
* The VPC firewall rules allow internal communication from RFC 1918 defined subnets communications.
* The VPC firewall contains an explicit deny rul...
To address the connectivity issue, let's review the factors and the nature of the firewall policies and rules described:
Key Details:
- The hierarchical firewall policy is applied at the organization level, controlling specific external traffic.
- The global network firewall policy enforces intrusion prevention system (IPS) rules on specific external traffic.
- VPC firewall rules control internal RFC 1918 subnet communication and explicitly deny traffic (with logging enabled).
- Logs are missing, and external communications are hanging (blocked), but internal traffic works fine.
Problem:
- The logs are missing, and external communications are blocked, even though internal traffic works as expected.
- This indicates that the external traffic (inbound/outbound) is likely being denied at some point before it reaches the VPC firewall, potentially due to misconfiguration or misordering of rules and policies.
---
Option Analysis:
A) Create a new VPC and migrate existing resources to the new VPC. Delete the old VPC, and reapply the firewall policies and rules in the new VPC.
- Not ideal: This is a drastic solution and would involve significant overhead, as you'd need to migrate all existing resources to a new VPC. Additionally, it doesn't directly address the root cause of the issue, which appears to be related to the ordering or configuration of firewall policies and rules.
- Rejected due to the unnecessary complexity and disruption of resources.
B) Raise the priority numbers of the firewall policy rules and lower the priority numbers of the VPC firewall rules.
- Not ideal: Priority numbers determine the order in which firewall rules are evaluated. Raising the priority of firewall policy rules could lead to more restrictive rules being evaluated first, possibly blocking traffic earlier in the evaluation process. Lowering VPC firewall rule priorities might result in internal rules being less effective.
- Rej...
Author: Emma · Last updated Jul 26, 2026
You are configuring the intrusion prevention service (IPS) feature on Cloud Next Generation Firewall Enterprise. You deployed your firewall endpoints a...
To configure the Intrusion Prevention Service (IPS) feature on Cloud Next Generation Firewall Enterprise and inspect the traffic of VMs, we need to carefully consider how to enable IPS inspection and apply appropriate firewall actions.
Key Details:
- The goal is to inspect traffic on VMs using IPS.
- Security profile groups in firewall rules can apply different inspection techniques, including IPS.
- We are also dealing with the traffic of VMs, so addressing their traffic flow using the appropriate firewall actions is crucial.
---
Option Analysis:
A) Configure Packet Mirroring to match the source/destination IP addresses of the VMs.
- Packet Mirroring is typically used for traffic monitoring and analysis but not specifically for IPS inspection. It allows you to duplicate the traffic for inspection but doesn't apply IPS or security profiles directly.
- Rejected: While packet mirroring helps in traffic monitoring, it is not the best solution for applying IPS directly. It is used for traffic capture and analysis, not enforcement of security policies like IPS.
B) Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the goto_next action.
- The goto_next action simply directs traffic to the next rule without inspecting it. This means no IPS inspection would occur if this action is used, which is not ideal for your requirement to apply IPS.
- Rejected: The action specified here doesn’t apply I...
Author: Arjun · Last updated Jul 26, 2026
Your organization recently exposed a set of services through a global external Application Load Balancer. After conducting some testing, you observed that responses would intermittently yield HTTP 4xx or 5xx error response codes. You a...
To address the intermittent HTTP 4xx or 5xx error response codes observed while using a global external Application Load Balancer, it's important to understand the root cause of the error and troubleshoot effectively. Here’s an analysis of the options:
Key Factors to Consider:
- Intermittent Errors: The issue is not constant, meaning it could be related to either backend health, misconfigurations, or security policies.
- Existing Health Check Logs: The health checks are already enabled and reviewed, but there may still be more specific or detailed logs needed for diagnosis.
- Error Codes: The 4xx (client errors) and 5xx (server errors) could indicate issues with backend availability, misconfiguration, or network issues.
Option Analysis:
Option A:
- Accessing a VM directly via SSH: By connecting to a VM in the VPC and testing the backend directly, you might identify whether the VM can serve the request properly. If it works, the issue might be with the load balancer or traffic routing.
- Increase the quantity of backends: If the error is related to load or overutilization, increasing the number of backend instances could help distribute the traffic and alleviate the issue.
Why this might not be ideal: The issue is intermittent, and simply scaling the backend might not address the root cause of the 4xx/5xx errors, especially if the issue lies in the configuration or security of the load balancer or backend services. Additionally, SSH access does not directly identify or isolate the cause of 4xx or 5xx errors, which may be related to routing or other configuration issues.
Option B:
- Delete the load balancer and backend services and create a Passthrough Network Load Balancer: This option suggests reconfiguring the entire setup to use a different type of load balancer (Network Load Balancer).
Why this might not be ideal: This is an extreme solution that essentially throws away the existing setup. A Passthrough Network Load Balancer might not resolve the issues if the root cause lies within the backend service configuration, health checks, or security policies. Moreover, this approach involves unnecessary reconfiguration, and there’s no guarantee it would a...
Author: Charlotte · Last updated Jul 26, 2026
Your company's current network architecture has two VPCs that are connected by a dual-NIC instance that acts as a bump-in-the-wire firewall between the two VPCs. Flows between pairs of subnets across the two VPCs are working correctly. Suddenly, you receive an alert that none of th...
To troubleshoot the issue where flows between two VPCs that are connected through a dual-NIC instance are not working, we need to focus on the most relevant factors related to network connectivity, firewall rules, and the configuration of the dual-NIC instance. Let's analyze each option:
Option Analysis:
1. A) Verify that a VPC Service Controls perimeter has not been enabled for the project that contains the two VPCs and the dual-NIC instance.
- Why it might be selected: VPC Service Controls provide an additional layer of security that could potentially block communication between VPCs if a perimeter has been enforced. If this service perimeter is enabled and incorrectly configured, it might restrict access between the VPCs.
- Why it might not be selected: While this could be a possibility, it is not the most immediate concern in this scenario. The issue seems to be more related to networking or firewall rules. Unless there's a known modification to the Service Controls perimeter, this is not the first place to check for the issue.
2. B) Use Cloud Logging to verify that there were no modifications to the VPC firewall rules or policies that were applied to the two network interfaces of the dual-NIC instance.
- Why it might be selected: This is a very relevant step because if firewall rules or policies have been modified (either intentionally or accidentally), they could block traffic between the two VPCs. The firewall rules for the network interfaces on the dual-NIC instance are critical to allowing or denying flows.
- Why it might not be selected: None. This option is a valid step to troubleshoot the problem because it directly relates to the functionality of the dual-NIC instance and whether the firewall rules are properly configured.
3. C) Verify that a public IP address has not been assigned to any network interface of the dual-NIC instance.
- Why it might be selected: The assignment of a public IP address to the network interfaces could create routing issues or security concerns, especially if the instance was intended to operate in a private environment. However, this is a less likely cause if the dual-NIC instance is only meant to handle ...
Author: Ahmed97 · Last updated Jul 26, 2026
Your company deployed Cloud Next Generation Firewall Enterprise (Cloud NGFW Enterprise). You have already created a CA pool and a CA in Certificate Author...
To enable TLS inspection on the Cloud Next Generation Firewall Enterprise (Cloud NGFW Enterprise), you must ensure the appropriate roles are granted and configurations are set up in the firewall and certificate services. TLS inspection involves decrypting and inspecting the traffic to enforce security policies.
Key Details:
- You have already created a CA pool and a Certificate Authority (CA) in Certificate Authority Service, which is essential for enabling TLS inspection.
- TLS inspection requires certain roles and the configuration of certificate management.
---
Option Analysis:
A) Grant the network security service agent service account the privateca.certificateRequester role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
- Correct Role: The privateca.certificateRequester role is required to request and manage certificates, which is essential for enabling TLS inspection.
- TLS Inspection Policy: Creating the TLS inspection policy that links to the CA pool ensures that the inspection is applied to the relevant traffic.
- VPC Endpoint Configuration: By configuring the VPC endpoint associations to use the TLS inspection policy, you're ensuring that the traffic flowing through the endpoints is inspected.
- Firewall Policy Rules: Enabling the TLS inspection flag in the firewall policy ensures the actual enforcement of the inspection.
- Selected option: This option correctly covers the required steps for enabling TLS inspection.
B) Grant the network security service agent service account the privateca.poolReader role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
- Incorrect Role: The privat...
Author: Jack · Last updated Jul 26, 2026
Recently, your networking team enabled Cloud CDN for one of the external-facing services that is exposed through an external Application Load Balancer. The application team has already defined which content should be cached within the responses. Upon testing the load balancer, you di...
Let's evaluate the options based on the scenario provided:
Scenario Recap:
- Cloud CDN was enabled for an external-facing service through an Application Load Balancer.
- Despite this, no noticeable performance improvement was observed.
- The application team has defined which content should be cached in the responses.
The issue is likely related to the caching configuration, meaning the Cloud CDN might not be caching the expected content, or the content that is supposed to be cached isn't being cached effectively.
Option Analysis:
1. A) Configure the `CACHE_ALL_STATIC` caching mode on Cloud CDN to ensure Cloud CDN caches all static content as well as content defined by the backends.
- Why it might be selected: The `CACHE_ALL_STATIC` mode is designed to cache static content, which includes all content that can be cached (like images, CSS, JavaScript, etc.). If static content caching is the primary goal, this would ensure Cloud CDN caches static content, leading to performance improvements.
- Why it might not be selected: The description specifies that the application team has already defined what content should be cached, so the static content might not cover the necessary dynamic or backend-defined cacheable content.
2. B) Configure the `FORCE_CACHE_ALL` caching mode on Cloud CDN to ensure all appropriate content is cached.
- Why it might be selected: The `FORCE_CACHE_ALL` mode forces Cloud CDN to cache all content, regardless of what is defined by the backend. This could improve performance by caching a broader range of content.
- Why it might not be selected: This option can lead to caching content that shouldn't be cached (e.g., dynamic content that changes frequently), which could result in stale or incorrect data being served to users. It overrides the backend's defined cache policies, which isn't ideal if fine-grained control is needed.
3. C) Configure the `USE_ORIGIN_HEADERS` caching mode on Cloud CDN to ensure Cloud CDN caches content depending on responses to requests from the backends.
- Why it might be selected: The `USE_ORIGIN_HEADERS` mode ensures that Cloud CDN caches content based on the cache-control headers and other directives ...
Author: NebulaEagle11 · Last updated Jul 26, 2026
Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The compute ...
To control internet access from applications to specific URLs, including hostnames and paths, while using a secure tag for identification, we need a solution that allows fine-grained control over traffic based on both the URLs and the secure tags associated with the compute instances.
Key Details:
- The goal is to filter outgoing internet traffic based on hostnames and paths.
- You want to apply these controls to instances with a specific secure tag.
- Secure tags are applied to instances to help with traffic filtering.
---
Option Analysis:
A) Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.
- Cloud NAT Gateway: Cloud NAT can be used to enable internet access for instances that don't have external IP addresses, but it's primarily for network address translation (NAT) and not focused on filtering traffic based on hostnames or secure tags.
- Matching by Service Account: Service account matching is not directly related to the secure tag on instances. Secure tags are more granular and intended for matching specific workloads or applications, rather than service accounts.
- Rejected: While Cloud NAT is part of the solution, the reliance on service accounts and lack of secure tag matching makes this option less suitable for filtering outgoing traffic to specific URLs.
B) Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.
- Cloud NAT Gateway: This is correct for allowing internet access for the instances.
- FQDN Filtering: Using FQDN objects in firewall policies is a good approach for filtering outgoing traffic based on hostnames and URLs.
- Matching by Secure Tag: The secure tag feature can be used to filter traffic from specific machines that need access based on their assigned secure tag.
- Selected option: This option aligns perfectly with the goal of c...
Author: Ethan · Last updated Jul 26, 2026
Your organization has approximately 100 teams that need to manage their own environments. A central team must manage the network. You need to design a landing zone that provides separate project...
To design a landing zone that allows approximately 100 teams to manage their own environments while enabling a central team to manage the network, it's important to provide scalable solutions that maintain separation and flexibility for each team. The solution must also provide centralized control over networking.
Key Details:
- The central team must manage the network (infrastructure), while individual teams manage their own environments.
- The solution must scale with 100 teams, ensuring each team has its own environment, but still allows centralized management.
- The teams will likely have their own VPCs or networks, but need to interact with the central network for certain services.
---
Option Analysis:
A) Configure Policy-based Routing for each team.
- Policy-based routing allows traffic to be routed based on policies, but this is primarily used for routing traffic within a single network or between a small set of networks. While it can control traffic flow, it does not provide the necessary separation of projects or environments that each team requires.
- Not ideal: It doesn't address the need for separate projects for each team and does not provide the centralized control needed for 100 teams in a scalable way.
- Rejected: Policy-based routing isn't a scalable solution for managing network boundaries across multiple projects.
B) Configure a Shared VPC, and create a VPC network in the host project.
- Shared VPC allows centralizing the networking in a host project, while individual teams can create service projects. Each team’s environment is isolated in its own project but can access the shared VPC network managed by the central team.
- This approach works well for scalable project management because the central team controls the shared VPC while teams can manage their own resources in separate service projects.
- Ideal for scalability and central network management: ...
Author: Noah · Last updated Jul 26, 2026
You are using Network Connectivity Center and you already have the hub configured. All VPCs in your environment need to have network connectivity to each other. All the subnet ranges a...
To configure your network topology using Network Connectivity Center (NCC) for VPC connectivity in a way that all VPCs can communicate with each other, let's consider the requirements and evaluate the options:
Key Details:
- Hub is already configured, and all VPCs need connectivity to each other.
- Subnets have unique ranges, meaning there won't be overlapping IPs between VPCs, which simplifies routing between VPCs.
- You need a topology that ensures all VPCs can communicate through the central hub, while maintaining efficient connectivity.
---
Option Analysis:
A) Configure a star topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
- Star Topology: In a star topology, all the VPC spokes (your VPCs) are connected to the hub. This approach is useful for centralized communication but does not naturally enable direct communication between spokes (VPCs) without routing through the hub.
- ExcludeExportRanges: This option involves filtering subnet ranges from the export list, which might be used to control which ranges are shared, but it's unnecessary in this scenario because your subnets are unique. Additionally, in a star topology, the communication goes through the hub, so filtering subnet ranges in this context might not provide any added benefit.
- Rejected: This option could work for centralized hub communication, but the added complexity of subnet filtering isn’t required here, especially if you want simple connectivity between all VPCs.
B) Configure a mesh topology, add the VPC spokes to the hub, and specify all subnet ranges in the excludeExportRanges filter.
- Mesh Topology: A mesh topology connects all VPCs to each other directly, which is a good fit for environments where every VPC must have direct communication with all other...
Author: Elizabeth · Last updated Jul 26, 2026
You are creating a design that will connect your single on-premises data center to a VPC in Google Cloud by using an IPsec VPN connection. The connection must have a minimum SLA of 99.99%. There is a single VPN termination device located in your on-premises data center. The VPN termination device can b...
To meet the requirements for high availability, minimum SLA of 99.99%, and minimal setup effort, while maintaining the constraint that the on-premises VPN termination device can only use a single public IP address, the design must be carefully selected.
Key Details:
- 99.99% SLA: To achieve this, high availability (HA) and redundancy are critical. Google Cloud's HA VPN is designed to support two tunnels for redundancy.
- Single Public IP Address: The VPN termination device at the on-premises data center can only have one public IP address.
- Minimal Setup Effort: The solution should minimize complexity and setup time.
---
Option Analysis:
A) 1. Create two HA VPN gateways. 2. Create one tunnel on interface 0 of one gateway and create one tunnel on interface 1 of the other gateway. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
- Two HA VPN Gateways: Creating two separate HA VPN gateways (one for each interface) is redundant but requires significantly more setup effort, as you're essentially creating two independent gateways.
- Single Public IP Limitation: The requirement for two different HA VPN gateways contradicts the limitation of using a single public IP address on the on-premises device. Each VPN gateway would need separate tunnels, and trying to terminate them on the same public IP address wouldn't align with Google's HA VPN design, as it expects independent connections for redundancy.
- Rejected: This option is overly complex and does not fit the constraint of using a single public IP address on the on-premises VPN device.
B) 1. Create one Classic VPN gateway and one HA VPN gateway. 2. Create one tunnel on the interface of the Classic VPN gateway and one tunnel on interface 1 of the HA VPN gateway. 3. Terminate each of the two tunnels on the single public IP address that is configured on the VPN termination device located in your on-premises data center.
- Combination of Classic VPN and HA VPN: This introduces complexity by using both a Classic VPN gateway and an HA VPN gateway. Classic VPN is less suited for high availability and more complex than needed for the requirement.
- Single Public IP: Terminating two tunnels (one from Classic VPN and one from HA VPN) on the same public IP address is not ideal and might not provide the desired reliability and scalability. It also involves unnecessary complexity by mixing two types of VPN gateways.
- Rejected: The use of a...
Author: VioletCheetah55 · Last updated Jul 26, 2026
Your organization is using a Shared VPC model. Service project owners want to independently manage their DNS zones in service projects. All service project workloads must be able to resolve all private zones that are defined in...
To meet the goal of allowing service project owners to independently manage their DNS zones while ensuring that all service project workloads can resolve private zones in other service projects, we need to carefully evaluate the options based on scalability, security, and ease of management.
Key Requirements:
- Service project owners need independent management of their DNS zones.
- All service project workloads must resolve private DNS zones defined in other service projects.
- The solution should leverage the Shared VPC model, ensuring centralized control over networking and DNS management.
---
Option Analysis:
A) Create a Cloud DNS private zone in each service project. Use a Cloud DNS forwarding zone to forward queries to the Shared VPC in the host project.
- DNS Forwarding Zone: This solution proposes setting up forwarding zones to direct DNS queries from each service project to the Shared VPC in the host project.
- Challenges:
- This approach would work, but forwarding zones can introduce complexity in managing DNS resolution across multiple projects.
- Forwarding zones are generally more suited for routing external or cross-project DNS queries rather than a streamlined solution for managing DNS across service projects in a Shared VPC model.
- Rejected: The use of forwarding zones here is not as clean or scalable as other solutions, especially since each service project may have specific DNS zones it wants to manage independently.
B) Create a Cloud DNS private zone in each service project. Use Cloud DNS peering zones that target the Shared VPC in the host project.
- Cloud DNS Peering Zones: Peering zones allow DNS resolution across projects, meaning DNS queries from one service project can resolve private DNS records in other service projects.
- DNS Peering is a powerful and scalable solution in multi-project environments. With peered DNS zones, queries from a service project are resolved via the Shared VPC in the host project, providing seamless DNS resolution across all service projects.
- Best Fit: This approach leverages Cloud DNS peering zones, which is the recommended way to ensure service projects can resolve each other's private zones while al...
Author: Evelyn · Last updated Jul 26, 2026
Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption-in-transit over the Cloud Interconnect connections. You have created a Cloud Router and two encrypted VLAN attachments that have a 5 Gbps capacity and a BGP configuration. The BGP sess...
To deploy HA VPN over Cloud Interconnect while ensuring encryption-in-transit, it is important to complete the setup with the correct configuration, leveraging the Cloud Router, VLAN attachments, and proper VPN gateway settings. The requirement is to use the existing Cloud Router and ensure the HA VPN setup is completed correctly for encrypted communication across the interconnect.
Key Considerations:
- HA VPN over Cloud Interconnect: Ensures that the traffic between your on-premises data center and Google Cloud remains encrypted while traversing the Cloud Interconnect connections.
- Cloud Router: This is required for BGP sessions to exchange routing information.
- Encrypted VLAN Attachments: These have 5 Gbps capacity and are already configured with BGP sessions.
- The configuration should allow for high availability and encryption-in-transit, ensuring seamless connectivity between the on-premises network and Google Cloud.
---
Option Analysis:
A) Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Configure the HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels. Use the same encrypted Cloud Router used for the Cloud Interconnect tier.
- HA VPN Gateway: This approach involves creating an HA VPN gateway, associating it with the two encrypted VLAN attachments.
- Cloud Router Use: It suggests using the same Cloud Router for the HA VPN configuration, which is typically valid since you already have a Cloud Router in place for BGP.
- Why this works: You don't need to create a new Cloud Router or new resources as the existing infrastructure can be used to complete the HA VPN setup. You are essentially using the current Cloud Router to handle the BGP sessions and VPN tunnels.
- Correct solution: This option fits the requirement as it leverages the existing infrastructure and correctly configures the HA VPN setup for encryption over the Cloud Interconnect.
B) Enable MACsec on Partner Interconnect.
- ...
Author: IronLion88 · Last updated Jul 26, 2026
Your organization is connecting their Shared VPC network to their on-premises data center by using Dedicated Interconnect to provide connectivity to all of its service projects. You need to create a design to configure your VLAN attachments and Cloud Routers. You...
To design a solution that provides high availability (99.9% SLA) for the Dedicated Interconnect while ensuring connectivity to all service projects in a Shared VPC network, it is essential to properly configure VLAN attachments, Cloud Routers, and interconnect connections.
Key Considerations:
1. High Availability (99.9% SLA): Google Cloud's reference design for Dedicated Interconnect typically involves using multiple connections across different edge availability domains to provide redundancy and ensure a highly available connection.
2. Shared VPC: Since the design is based on a Shared VPC, the Cloud Routers and VLAN attachments need to be configured in such a way that the service projects can access the on-premises data center via the interconnect.
---
Option Analysis:
A) Create two Cloud Interconnect connections in different edge availability domains of two different co-location facilities in a project that will contain your connections. Create one VLAN attachment and Cloud Router for each physical interconnect in the Shared VPC host project.
- Two Interconnect Connections: This is a good approach for high availability, as it uses two connections in different availability domains to ensure redundancy.
- VLAN Attachments and Cloud Routers in Shared VPC Host Project: Both the VLAN attachments and the Cloud Routers are created in the Shared VPC host project, which aligns with Google Cloud's best practices. This ensures that the Shared VPC can be centrally managed and that service projects can access the interconnect connection.
- Correct Design: This option is consistent with Google Cloud's recommended approach for connecting a Shared VPC to on-premises resources via Dedicated Interconnect, ensuring high availability and scalability.
- Selected Option: This is the correct and scalable option, as it follows Google Cloud's best practices for managing interconnect connections and VLAN attachments in the Shared VPC model.
B) Create two Interconnect connections in different edge availability domains of the co-location facility in a project that will contain your connections. Create one VLAN attachment for each physical Cloud Interconnect connection and a single Cloud Router in the Shared VPC host project.
- Single Cloud Router: While this option uses two interconnect connections for redundancy,...
Author: Ryan · Last updated Jul 26, 2026
Your organization's on-premises networking team is reporting frequent BGP session flaps toward your Google Cloud environment. You ...
When diagnosing and addressing frequent BGP session flaps toward your Google Cloud environment, it's crucial to choose the most effective approach that addresses potential issues like instability in the BGP session or connectivity.
Let's break down each option and evaluate which is the best:
A) Switch to static routing:
- Why rejected: While static routing is simple and doesn’t rely on dynamic protocols like BGP, it doesn’t scale well in a dynamic cloud environment. BGP provides automatic route updates, making it ideal for large, dynamic networks like Google Cloud. Switching to static routing would not be a scalable solution and could worsen the situation by requiring manual updates if there are network changes. This is especially relevant for a cloud environment, which often involves dynamic network topology changes.
B) Increase the BGP hold timer to 36000 seconds max:
- Why rejected: The BGP hold timer defines how long a BGP router will wait without receiving a keepalive or update message before considering the session to be down. While increasing the hold timer might reduce the chances of session flaps in environments with transient network issues, it can also introduce delays in detecting actual failures. This option could result in longer periods of routing instability in case of an actual failure, and it's not a long-term solution for addressing BGP session flaps.
C) Ensure that graceful restart is enabled on the on-premises router:
- Why rejected: Graceful Res...
Author: Isabella · Last updated Jul 26, 2026
You configured a single IPSec Cloud VPN tunnel for your organization to a third-party customer. You confirmed that the VPN tunnel is established. However, the BGP session status states that the BGP is not configured. The customer has provided you with their BGP settings:
* Local BGP address: 169.254.11.1/30
* Local ASN: 64515
* Peer BGP address: 169.254.11.2
* Peer ASN: 64517
* Base MED: 1000
* MD5 Authentication: Disabled
You need to configure the...
To configure the local BGP session for the VPN tunnel with the settings provided by the customer, let’s analyze the key factors in the customer’s provided settings and match them to the correct configuration:
Customer Provided BGP Settings:
- Local BGP address: 169.254.11.1/30
- Local ASN: 64515
- Peer BGP address: 169.254.11.2
- Peer ASN: 64517
- Base MED (Multi-Exit Discriminator): 1000
- MD5 Authentication: Disabled
Key BGP Configuration Elements:
1. Peer ASN: The local ASN is 64515, and the peer ASN is 64517. Therefore, the peer ASN for the local BGP session must be set to 64517.
2. Advertised Route Priority (MED): The customer has provided a MED of 1000. This value should be used as the Advertised Route Priority in the configuration.
3. Local BGP IP and Peer BGP IP: The local BGP address is 169.254.11.1, and the peer BGP address is 169.254.11.2. The local BGP IP should therefore be 169.254.11.1, and the peer BGP IP should be 169.254.11.2.
4. MD5 Authentication: The customer has disabled MD5 authentication. Therefore, it must not be enabled in the configuration.
Review of Options:
- Option A:
- Peer ASN: 64517 → Correct, as per the customer settings.
- Advertised Route Priority (MED): 100 → Incorrect, the customer specified 1000.
- Local BGP IP: 169.254.11.2 → Incorrect, the customer specified 169.254.11.1 as the local BGP address.
- Peer BGP IP: 169.254.11.1 → Incorrect, the customer specified 169.254.11.2 as the peer BGP address.
- MD5 Authentication: Disabled → Correct.
- Option B:
- Peer ASN: 64515 → Incorrect, the customer specified 64517 as the pee...
Author: Carlos Garcia · Last updated Jul 26, 2026
Your organization, TerramEarth, is launching a global application to manage credit card payments. There are some client VMs inside the same VPC as the application that need to access this application privately. Due to compliance requirements, the internal clients cannot use the global external IP address of the application. Currently, Cloud DNS only resolves myglobalapp.terramearth.com to the public IP address with a public zone. The clients will need t...
To address the given requirements of the scenario, let's evaluate each option and determine the best approach for managing private access to the global application within the VPC:
Option A: Create a sub-domain named internal.terramearth.com. Add the new DNS entry (myglobalapp.internal.terramearth.com) to the sub-domain pointing to the internal IP address from the application VM.
- Explanation: This option involves creating a new sub-domain (internal.terramearth.com) to map the DNS entry `myglobalapp.internal.terramearth.com` to the internal IP of the application.
- Pros: It provides a clear separation between public and private access by using a different sub-domain. This could be useful for defining different DNS records for internal and external clients.
- Cons: This doesn't meet the requirement of keeping the existing domain `myglobalapp.terramearth.com` for internal clients but with private IP access. The requirement specifies using `myglobalapp.terramearth.com` with the internal IP, which this option does not satisfy.
Option B: Configure a query logic script inside Cloud DNS to check the source IP address from the VPC, and respond with a modified DNS record to include the internal IP address from the application VM.
- Explanation: This option suggests a custom logic to modify the DNS response based on the source IP address, providing either the internal or external IP based on whether the request comes from inside the VPC.
- Pros: Flexible and dynamic; allows you to keep the same DNS name (`myglobalapp.terramearth.com`) but use different IPs based on the location of the client.
- Cons: Cloud DNS does not support dynamic DNS scripting based on the source IP address. There’s no direct way to implement custom logic in Cloud DNS, making this option unfeasible. Therefore, it doesn't meet the current capabilities of Cloud DNS.
Option C: Configure a private zone for the application record (myglobalapp.terramearth.com) and point to the internal IP address of the application VM. Bind this zone to the VPC.
- Explanation: This option creates a private DNS...
Author: BlazingPhoenix22 · Last updated Jul 26, 2026
You manage your company's network security and have noticed unusual outbound traffic from a Compute Engine VM that is part of a production subnet. You suspect the VM may be compromised, because it is attempting to communicate with a malicious external IP address. You want to capture detailed metadata for every IP connect...
We need per-connection metadata (not full packet payloads) for a specific VM suspected of compromise, including:
source/destination IP
ports
protocol
bytes transferred
Let’s evaluate each option based on GCP capabilities.
---
✅ A) Enable VPC Flow Logs (Correct)
Why it works:
VPC Flow Logs is designed exactly for this use case.
It captures network flow metadata, including:
Source/destination IP
Source/destination ports
Protocol (TCP/UDP/ICMP)
Bytes sent/received
Connection start/end timestamps
Setting sampling rate = 1.0 ensures 100% of flows are logged, giving maximum visibility.
You can filter in Google Cloud Logging for the VM’s IP.
When used:
Security monitoring
Traffic analysis
Incident response (like detecting suspicious outbound connections)
Compliance auditing
---
❌ B) Network Intelligence Center Connectivity Tests
Network Intelligence Center connectivity tests:
Only validate reachability and configuration paths
Show why traffic is allowed/blocked
Do NOT capture:
ports in active flows
byte counts
full traffic metadata over time
Why rejected:
It is diagnostic for configuration, not traffic telemetry
Not suitable for forensic-level inspection of live or historical connections
Use case:
...
Author: Alexander · Last updated Jul 26, 2026
Your company is implementing new rules for outbound internet traffic in your Google Cloud environment. You need to design a configuration that enables all outbound internet traffic from virtual machines tagged with production-critical to route through a Secure Web Proxy (...
To meet the requirement, you need selective outbound routing based on VM identity (network tag) so that only production-critical VMs send internet-bound traffic through the Secure Web Proxy (SWP), while all other VMs continue using default direct egress.
This is a classic use case for Policy-Based Routing (PBR) in Google Cloud.
---
✅ Correct Option: C) Configure a policy-based route with a destination of 0.0.0.0/0 for the production-critical network tag with the SWP IP as a next hop.
Why this is correct
Policy-Based Routes (PBR) in Google Cloud allow routing decisions based on:
Network tags (instance-level identity)
Service accounts
Source IP ranges (in some configurations)
Here, the requirement is:
Match only production-critical VMs (tag-based selection)
Redirect all outbound internet traffic (0.0.0.0/0)
Send it to Secure Web Proxy (SWP) as next hop
So option C correctly:
Uses network tag selection
Applies to all outbound traffic
Routes it to SWP for inspection
This ensures:
Fine-grained control at VM level
No impact on other workloads
Centralized inspection for sensitive workloads
---
❌ Why other options are incorrect
A) Cloud NAT gateway
C...
Author: Kai · Last updated Jul 26, 2026
Your organization is migrating workloads from AWS to Google Cloud. Because a particularly critical workload will take longer to migrate, you need to set up Google Cloud...
To solve this, we need a design that allows Cloud CDN to cache content served from an existing AWS-hosted HTTP(S) application, without migrating the workload yet.
Key requirements from the scenario
Origin is external (AWS), not in Google Cloud.
Must use Cloud CDN, which only works with:
External HTTP(S) Load Balancer (Application Load Balancer in GCP terms)
Backend service attached to that load balancer
Need a way to represent an external origin (AWS app) in GCP → this is where Internet NEG or Hybrid NEG comes in.
---
✅ Correct Option: A
A)
Create an internet NEG pointing to the existing FQDN of the AWS application
Attach it to an Application Load Balancer (external HTTP(S) LB) as backend service
Enable Cloud CDN on the backend service
Why this is correct
Internet NEG (Network Endpoint Group) is designed specifically for external HTTP(S) endpoints reachable via DNS/FQDN (like AWS ALB, EC2, or any public app).
Cloud CDN requires an External HTTP(S) Load Balancer + backend service, which this option correctly uses.
Using FQDN is preferred over IP because:
AWS load balancers often have dynamic IPs
DNS-based origin is stable and scalable
This is the standard architecture for CDN in front of a non-GCP HTTP origin
When this is used
External SaaS or cloud workloads (AWS, Azure, third-party APIs)
Public websites not yet migrated to GCP
HTTP(S)-based origins reachable via DNS name
---
❌ Why other options are incorrect
B)
Uses Hybrid NEG + passthrough Network Load Balancer + target pool
Problems:
...
Author: Nia · Last updated Jul 26, 2026
Your organization has two applications running in separate Google Cloud VPC networks (vpc-a and vpc-b) in different projects. You need to establish a secure, private, and encrypted connection between these two VPCs to allow for inter-VPC communica...
Key requirements in this question are: secure + encrypted connectivity, high availability (HA), and dynamic routing (BGP-based) between two VPCs in different projects.
✅ Correct option: D
D) In each VPC, deploy an HA VPN gateway and a Cloud Router. Create two VPN tunnels on each gateway, and configure BGP sessions for dynamic routing.
This is the only option that satisfies all requirements:
Encrypted connection: HA VPN provides IPsec encryption over the public internet.
High availability: HA VPN uses multiple interfaces and redundant tunnels (typically 2 tunnels per gateway) to ensure failover.
Dynamic routing: Cloud Router enables BGP (Border Gateway Protocol) for automatic route exchange between VPCs.
Cross-project support: HA VPN + Cloud Router works across projects and even across regions.
---
Why the other options are incorrect
❌ A) VPC Network Peering
Provides private Google backbone connectivity, but:
❌ Not encrypted (traffic stays internal but not IPsec-encrypted)
❌ No dynamic routing (routes are exchanged but not via BGP; also no route control like VPN)
✔ Good for simple, high-performance, low-latency VPC-to-VPC connectivity
❌ Not s...
Author: Isabella · Last updated Jul 26, 2026
You are designing a highly resilient and secure connection between an on-premises data center and Google Cloud for a financial services company. The company requires 10 Gbps of bandwidth and mandates that all traffic be encrypted end-to-end between their on-premises network and their Google Cloud VPC. You have already provisioned two 10 Gbps Dedicat...
The correct answer is C) Configure MACsec on each of the Dedicated Interconnect connections.
Why C is correct (MACsec on Dedicated Interconnect)
MACsec (Media Access Control Security) provides Layer 2 encryption directly on the physical Dedicated Interconnect links between the on-premises data center and Google Cloud. This makes it the best fit for the requirements because:
Meets 10 Gbps requirement: MACsec operates at line rate and does not introduce VPN tunneling overhead that could limit throughput.
End-to-end link encryption (on Interconnect): Traffic is encrypted directly on the physical connection between on-premises equipment and Google Cloud edge routers.
High resiliency: Since you already have two 10 Gbps Dedicated Interconnect connections, MACsec can be enabled on both, maintaining redundancy.
Enterprise compliance: Commonly used in financial services environments where encryption over private circuits is mandatory.
Why the other options are incorrect
A) Deploy four HA VPN gateways on each Dedicated Interconnect connection
Incorrect design: HA VPN does not scale in this manner.
HA VPN is typically deployed as one VPN gateway pair per region, not multiple gateways per interconnect link.
This option is architecturally invalid and overly complex.
Even if multiple tun...
