Google Professional Cloud Network Engineer practice questions

1. Question 1 of 25

   You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect. What should you do?

   • ACreate a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
   • BCreate a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
   • CTag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
   • DLabel the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.

   Show answer

   Correct answer: C

   How others answered

   • C70%
   • B15%
   • A15%

   Only 70% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Answer C. This question is actually asking specifically about using firewall with a Network LB, because Network Load Balancing is a pass-through load balancer, you control access to the load balancer's backends using Google Cloud firewall rules. https://cloud.google.com/load-balancing/docs/network/networklb-backend-service#firewall_rules

   Adapted from community discussion by PeppaPig · 2021-09-19 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. P

      PeppaPig

      2021-09-19

      14 upvotes

      Answer C. This question is actually asking specifically about using firewall with a Network LB, because Network Load Balancing is a pass-through load balancer, you control access to the load balancer's backends using Google Cloud firewall rules. https://cloud.google.com/load-balancing/docs/network/networklb-backend-service#firewall_rules

   2. M

      Mo7y

      2023-06-18

      Selected C4 upvotes

      I was confused between B and C, but then I realized that Load Balancers are actually NOT supported by VPC service controls, C is the correct answer.

   3. P

      PeppaPig

      2021-09-19

      5 upvotes

      By pass-through, it means LB preserves the source IPs of incoming requests

   4. M

      mlyu

      2020-10-19

      4 upvotes

      Using Elimination VPC service controls is not about application access control, so A n B is not correct. Targeted label is not a valid target for firewall rule, see https://cloud.google.com/vpc/docs/firewalls#rule_assignment So the only option C is correct answer

2. Question 2 of 25

   You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic. What should you do?

   • ACheck the VPC flow logs for the instance.
   • BTry connecting to the instance via SSH, and check the logs.
   • CCreate a new firewall rule to allow traffic from port 22, and enable logs.
   • DCreate a new firewall rule with priority 65500 to deny all traffic, and enable logs.

   Show answer

   Correct answer: D

   How others answered

   • D86%

   Explanation

   I think correct answer should be D. https://cloud.google.com/blog/products/identity-security/google-cloud-firewall-rules-logging-how-and-why-you-should-use-it "Since we have implicit ingress and the denial rule is not being logged, we create a “deny all” rule with priority 65534 to capture anything that gets denied" https://cloud.google.com/vpc/docs/firewall-rules-logging

   Adapted from community discussion by elguije · 2020-12-15 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. E

      elguije

      2020-12-15

      26 upvotes

      I think correct answer should be D. https://cloud.google.com/blog/products/identity-security/google-cloud-firewall-rules-logging-how-and-why-you-should-use-it "Since we have implicit ingress and the denial rule is not being logged, we create a “deny all” rule with priority 65534 to capture anything that gets denied" https://cloud.google.com/vpc/docs/firewall-rules-logging

   2. E

      ESP_SAP

      2021-05-01

      4 upvotes

      Correct Answer is (A): Using VPC Flow Logs VPC Flow Logs records a sample of network flows sent from and received by VM instances, including instances used as GKE nodes. These logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization. This page assumes you are familiar with the concepts described in VPC Flow Logs overview. Enabling VPC flow logging When you enable VPC Flow Logs, you enable for all VMs in a subnet. However, you can cut down the amount of information written to logging. Refer to Log sampling and aggregation for details on the parameters you can control. https://cloud.google.com/vpc/docs/using-flow-logs

   3. X

      xhilmi

      2024-06-11

      Selected D2 upvotes

      Choose option D. When you create a new firewall rule with priority 65500 and set it to deny all traffic, and then enable logging, you effectively create a "catch-all" rule that logs all denied traffic. This can be useful for troubleshooting and identifying traffic that is being blocked by the firewall. Here's the breakdown: Priority 65500: Firewall rules are processed in ascending order of priority. By setting the priority to 65500, this rule becomes one of the last rules to be evaluated, effectively serving as a catch-all rule after other rules have been checked. Deny All Traffic: This rule denies all traffic, including HTTP traffic, RDP traffic, and any other traffic. It acts as a safety net to catch and log any unexpected or unwanted traffic. Enable Logs: Enabling logging for this rule allows you to see entries in the firewall logs for any traffic that matches this rule.

   4. J

      jeeet_

      2021-12-24

      3 upvotes

      Initially I chose A. (Wrong). Correct is D. https://cloud.google.com/vpc/docs/flow-logs Ingress packets are sampled after ingress firewall rules. If an ingress firewall rule denies inbound packets, those packets are not sampled by VPC Flow Logs. --> it says, if an ingress firewall rule denies something, that won't be logged in VPC flow logs. That makes Option A out and wrong. for sake of explaination--> Egress packets are sampled before egress firewall rules. Even if an egress firewall rule denies outbound packets, those packets can be sampled by VPC Flow Logs. which means--> creating Option B and C -> makes no sense, as question talks about RDP. Option D -> by default without explanation is the answer. as you cannot monitor implied deny rules, you create a custom one to monitor. makes more sense.

3. Question 3 of 25

   You have a Cloud Storage bucket in Google Cloud project XYZ. The bucket contains sensitive data. You need to design a solution to ensure that only instances belonging to VPCs under project XYZ can access the data stored in this Cloud Storage bucket. What should you do?

   • AConfigure Private Google Access to privately access the Cloud Storage service using private IP addresses.
   • BConfigure a VPC Service Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter.
   • CConfigure Cloud Storage with projectPrivate Access Control List (ACL) that gives permission to the project team based on their roles.
   • DConfigure Private Service Connect to privately access Cloud Storage from all VPCs under project XYZ.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   • B. Configure a VPC Service ***** Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter. Overview of VPC Service Controls VPC Service Controls improves your ability to mitigate the risk of data exfiltration from Google Cloud services such as Cloud Storage and BigQuery. You can use VPC Service Controls to create perimeters that protect the resources and data of services that you explicitly specify. The following diagram shows a service perimeter that allows access from the internet to protected resources based on the configured access levels, such as IP address or device policy:

   Adapted from community discussion by pk349 · 2023-07-14 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. C

      ccieman2016

      2023-06-02

      Selected B4 upvotes

      For me, B is correct. https://cloud.google.com/vpc/docs/private-access-options https://cloud.google.com/vpc/docs/configure-private-service-connect-apis

   2. P

      pk349

      2023-07-14

      2 upvotes

      • B. Configure a VPC Service ***** Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter. Overview of VPC Service Controls VPC Service Controls improves your ability to mitigate the risk of data exfiltration from Google Cloud services such as Cloud Storage and BigQuery. You can use VPC Service Controls to create perimeters that protect the resources and data of services that you explicitly specify. The following diagram shows a service perimeter that allows access from the internet to protected resources based on the configured access levels, such as IP address or device policy:

   3. A

      al_zo

      2023-06-02

      Selected B3 upvotes

      Agree on B. Typical use case of VPC Service Controls: https://cloud.google.com/vpc-service-controls/docs/overview

   4. B

      Ben756

      2023-09-16

      Selected B1 upvote

      The correct answer is B. Configure a VPC Service Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter. By configuring a VPC Service Controls perimeter around project XYZ, you can create a secure boundary around the project and restrict access to Cloud Storage to only those instances that are within the VPCs under project XYZ. You can include storage.googleapis.com as a restricted service in the service perimeter, which will ensure that only authorized VPCs can access the Cloud Storage bucket containing sensitive data.

4. Question 4 of 25

   You recently configured Google Cloud Armor security policies to manage traffic to your application. You discover that Google Cloud Armor is incorrectly blocking some traffic to your application. You need to identity the web application firewall (WAF) rule that is incorrectly blocking traffic. What should you do?

   • AEnable firewall logs, and view the logs in Firewall Insights.
   • BEnable HTTP(S) Load Balancing logging with sampling rate equal to 1, and view the logs in Cloud Logging.
   • CEnable VPC Flow Logs, and view the logs in Cloud Logging.
   • DEnable Google Cloud Armor audit logs, and view the logs on the Activity page in the Google Cloud Console.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring n the Sample rate field, set the sampling probability. You can set a number from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. The default value is 1.0.

   Adapted from community discussion by AzureDP900 · 2023-06-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. K

      Komal697

      2023-09-30

      Selected B2 upvotes

      Enabling HTTP(S) Load Balancing logging with a sampling rate of 1 allows you to see detailed logs of all the traffic flowing through the load balancer, including any traffic that may have been blocked by Google Cloud Armor. By analyzing the logs in Cloud Logging, you can identify the specific WAF rule that is blocking the traffic and adjust your Google Cloud Armor security policy accordingly.

   2. A

      AzureDP900

      2023-06-11

      3 upvotes

      https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring n the Sample rate field, set the sampling probability. You can set a number from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. The default value is 1.0.

   3. C

      ccieman2016

      2023-06-02

      Selected B2 upvotes

      I think is B. https://cloud.google.com/armor/docs/troubleshooting#traffic-allowed-despite-deny-rule

   4. D

      desertlotus1211

      2024-08-25

      2 upvotes

      Answer B seems to be the better choice: https://cloud.google.com/armor/docs/troubleshooting "Review the HTTP(S) logs to determine which policy and rule were matched for your traffic along with the associated action. To view the logs, use Cloud Logging."

5. Question 5 of 25

   You need to configure a Google Kubernetes Engine (GKE) cluster. The initial deployment should have 5 nodes with the potential to scale to 10 nodes. The maximum number of Pods per node is 8. The number of services could grow from 100 to up to 1024. How should you design the IP schema to optimally meet this requirement?

   • AConfigure a /28 primary IP address range for the node IP addresses. Configure a /25 secondary IP range for the Pods. Configure a /22 secondary IP range for the Services.
   • BConfigure a /28 primary IP address range for the node IP addresses. Configure a /25 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.
   • CConfigure a /28 primary IP address range for the node IP addresses. Configure a /28 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.
   • DConfigure a /28 primary IP address range for the node IP addresses. Configure a /24 secondary IP range for the Pads. Configure a /22 secondary IP range for the Services.

   Show answer

   Correct answer: D

   How others answered

   • D65%
   • B24%

   Only 65% agreed on this answer — treat it as contested rather than settled.

   Explanation

   This is a tricky question. Keep in mind that Nodes use Primary IP ranges whereas Pods and Services use Secondary ranges. For secondary, as you can use all of the IP addresses unlike the Primary where 4 x IPs are reserved. E.g. Max hosts in /24 for Node is 252 vs. 256 for pods and services. If we gather the above logic: 1) 10 nodes = /28 2) 80 pods = /24 (Reason is /24 is the smallest possible Pod) 3) 1024 services = /22 (Can use all of 1024 IPs) https://cloud.google.com/kubernetes-engine/docs/concepts/alias-ips#cluster_sizing_secondary_range_pods

   Adapted from community discussion by Thornadoo · 2023-08-26 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. A

      al_zo

      2022-12-01

      15 upvotes

      /22 has only 1022 usable IP addresses, looks like B is the correct answer.

   2. J

      jfwahab

      2023-01-26

      Selected D12 upvotes

      Vote for D 10 nodes = /28 can max 12 nodes 8 Pods per node = 80 Pods = /24 max 110 Pods 1024 services = /22 max 1024 services source: https://cloud.google.com/kubernetes-engine/docs/concepts/alias-ips

   3. T

      Thornadoo

      2023-08-26

      Selected D10 upvotes

      This is a tricky question. Keep in mind that Nodes use Primary IP ranges whereas Pods and Services use Secondary ranges. For secondary, as you can use all of the IP addresses unlike the Primary where 4 x IPs are reserved. E.g. Max hosts in /24 for Node is 252 vs. 256 for pods and services. If we gather the above logic: 1) 10 nodes = /28 2) 80 pods = /24 (Reason is /24 is the smallest possible Pod) 3) 1024 services = /22 (Can use all of 1024 IPs) https://cloud.google.com/kubernetes-engine/docs/concepts/alias-ips#cluster_sizing_secondary_range_pods

   4. P

      pfilourenco

      2022-12-08

      Selected D6 upvotes

      B is not correct since we have 8 pods per node(10 nodes), that means we will need 10x /28 (https://cloud.google.com/kubernetes-engine/docs/how-to/flexible-pod-cidr#cidr_ranges_for_clusters), only a /24 can handle that. But, on D we have /22 for services, but we need 1024 that means we need a /21, and a /22 can only have 1022 IP's available... So, there is no correct answer. On B you will can only have 8 nodes, on D you can only have 1022 services (I will go for D)

6. Question 6 of 25

   You want to create a service in GCP using IPv6. What should you do?

   • ACreate the instance with the designated IPv6 address.
   • BConfigure a TCP Proxy with the designated IPv6 address.
   • CConfigure a global load balancer with the designated IPv6 address.
   • DConfigure an internal load balancer with the designated IPv6 address.

   Show answer

   Correct answer: C

   How others answered

   • C75%
   • A19%

   Explanation

   Choose option C. Global Load Balancer: Global Load Balancers in GCP are capable of handling both IPv4 and IPv6 traffic. They provide a single anycast IP address for the service, which can be accessed globally. This is a suitable option for creating a service accessible over IPv6. Options A and B seem to be referring to individual instances or proxies, and they might not provide the global reach and load balancing capabilities that a global load balancer offers. Option D (Configure an internal load balancer) is not the best fit if you want to expose the service to the internet using IPv6, as internal load balancers are typically used for internal-facing services within a Virtual Private Cloud (VPC). Therefore, configuring a global load balancer (option C) is the most appropriate choice for creating a service in GCP that is accessible over IPv6.

   Adapted from community discussion by xhilmi · 2024-06-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. R

      rezavage

      2021-04-05

      6 upvotes

      TCP Proxy load balancer could be an option but it supports IPv6 only if it is implemented in global type which requires premium tier. the same goes for Https and SSL proxy load balancer . they all should be Global not Regional in order to support IPv6.so the answer will be C.

   2. S

      saurabh1805

      2021-02-23

      6 upvotes

      C should be correct answer, Gloabal Load Balancer (https) is one of load balancer supports Ipv6 address. https://cloud.google.com/load-balancing/docs/ipv6

   3. X

      xhilmi

      2024-06-11

      Selected C2 upvotes

      Choose option C. Global Load Balancer: Global Load Balancers in GCP are capable of handling both IPv4 and IPv6 traffic. They provide a single anycast IP address for the service, which can be accessed globally. This is a suitable option for creating a service accessible over IPv6. Options A and B seem to be referring to individual instances or proxies, and they might not provide the global reach and load balancing capabilities that a global load balancer offers. Option D (Configure an internal load balancer) is not the best fit if you want to expose the service to the internet using IPv6, as internal load balancers are typically used for internal-facing services within a Virtual Private Cloud (VPC). Therefore, configuring a global load balancer (option C) is the most appropriate choice for creating a service in GCP that is accessible over IPv6.

   4. J

      jeeet_

      2022-01-06

      4 upvotes

      Answer is C, B- Why Not? just try to create a TCP LB, with default settings, you'll not get option to select IPV6, But if you chose Global LB, then you'll get the option. Concept- you're LB should be GLOBAL in order to have IPV6 IP Address. So read option C again.

7. Question 7 of 25

   You are configuring a new application that will be exposed behind an external load balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest possible latency while ensuring high availability and autoscaling. Which configuration should you use?

   • AUse global SSL Proxy Load Balancing with backends in both regions.
   • BUse global TCP Proxy Load Balancing with backends in both regions.
   • CUse global external HTTP(S) Load Balancing with backends in both regions.
   • DUse Network Load Balancing in both regions, and use DNS-based load balancing to direct traffic to the closest region.

   Show answer

   Correct answer: D

   How others answered

   • D52%
   • B48%

   Only 52% agreed on this answer — treat it as contested rather than settled.

   Explanation

   TCP pass-through = A, B and C is wrong, because they make ssl offloading. In this requirement, only Letter D is possible. External LB with support a TCP pass-through. https://cloud.google.com/load-balancing/docs/choosing-load-balancer https://cloud.google.com/load-balancing/docs/network

   Adapted from community discussion by ccieman2016 · 2022-12-03 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. C

      ccieman2016

      2022-12-03

      Selected D14 upvotes

      TCP pass-through = A, B and C is wrong, because they make ssl offloading. In this requirement, only Letter D is possible. External LB with support a TCP pass-through. https://cloud.google.com/load-balancing/docs/choosing-load-balancer https://cloud.google.com/load-balancing/docs/network

   2. G

      GHOST1985

      2023-10-17

      Selected D3 upvotes

      "IPv6 traffic is not supported with regional external Application Load Balancers, cross-region internal Application Load Balancers, regional internal Application Load Balancers, regional internal proxy Network Load Balancers, regional external proxy Network Load Balancers, and internal passthrough Network Load Balancers." https://cloud.google.com/load-balancing/docs/ipv6?hl=en#limitations

   3. G

      gonlafer

      2024-02-20

      Selected D4 upvotes

      It's D, pass-through is a requirement. https://cloud.google.com/load-balancing/docs/choosing-load-balancer

   4. B

      BenMS

      2023-12-29

      Selected D3 upvotes

      The only answer that supports TCP passthrough is D, which is shown here: https://cloud.google.com/architecture/global-load-balancing-architectures-for-dns-routing-policies

8. Question 8 of 25

   Select 2

   You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member. Which two methods can you use to accomplish this? (Choose two.)

   • AGetIamPolicy() via REST API
   • BsetIamPolicy() via REST API
   • Cgcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
   • Dgcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
   • EEnter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.

   Show answer

   Correct answer: B, D

   How others answered

   • BD71%
   • DE18%

   Only 71% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Correct Answer are (D) & (E) GetIamPolicy and SetIamPolicy is only for service accounts. But question asks for a project members. Hence, D and E are correct ans. D - https://cloud.google.com/iam/docs/granting-changing-revoking-access#granting-gcloud-manual E - https://cloud.google.com/iam/docs/granting-changing-revoking-access#access-control-via-console

   Adapted from community discussion by ESP_SAP · 2021-05-02 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. E

      ESP_SAP

      2021-05-02

      18 upvotes

      Correct Answer are (D) & (E) GetIamPolicy and SetIamPolicy is only for service accounts. But question asks for a project members. Hence, D and E are correct ans. D - https://cloud.google.com/iam/docs/granting-changing-revoking-access#granting-gcloud-manual E - https://cloud.google.com/iam/docs/granting-changing-revoking-access#access-control-via-console

   2. D

      dzhu

      2022-03-18

      12 upvotes

      E is not scripting and automation. So E is obviously wrong. The answer should be B and D

   3. E

      EranSolstice

      2022-04-21

      9 upvotes

      A) GetIamPolicy() would not do anything by itself but see (B) B) would require use of GetIamPolicy() as otherwise SetIamPolicy() override existing binding C) obviously wrong, question is not about pubsub D) the documentation indicate that project_id need to be used not project_name, would therefore return an error E) would work, despite being very vague, but is not automation. Now, the question ask for "which 2 _methods_ can be used to achieve that". Both GetIamPolicy() and SetIamPolicy() are programatic _methods_ that if used together could achieve that. Therefore one could roll with A&B in the spirits of that very tricky question.

   4. B

      Blitzer

      2023-08-24

      Selected B, D5 upvotes

      I think BD are the correct ones by elimination: A. GetIamPolicy() - read only method and BTW with a typo (should be getIAmPolicy but I guess that's not the intenional mistake) B. setIamPolicy() via REST API - does the job! C. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor - nothing to do because points to pubsub D. gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor - does the job! E. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console. - no automation option

9. Question 9 of 25

   You work for a multinational enterprise that is moving to GCP. These are the cloud requirements: "¢ An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions us-west1 (primary HQ) and us-east4 (backup) "¢ Multiple regional offices in Europe and APAC "¢ Regional data processing is required in europe-west1 and australia-southeast1 "¢ Centralized Network Administration Team Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us- west1. What should you do?

   • A"¢ Create 2 VPCs in a Shared VPC Host Project. "¢ Configure a 2-NIC instance in zone us-west1-a in the Host Project. "¢ Attach NIC0 in VPC #1 us-west1 subnet of the Host Project. "¢ Attach NIC1 in VPC #2 us-west1 subnet of the Host Project. "¢ Deploy the instance. "¢ Configure the necessary routes and firewall rules to pass traffic through the instance.
   • B"¢ Create 2 VPCs in a Shared VPC Host Project. "¢ Configure a 2-NIC instance in zone us-west1-a in the Service Project. "¢ Attach NIC0 in VPC #1 us-west1 subnet of the Host Project. "¢ Attach NIC1 in VPC #2 us-west1 subnet of the Host Project. "¢ Deploy the instance. "¢ Configure the necessary routes and firewall rules to pass traffic through the instance.
   • C"¢ Create 1 VPC in a Shared VPC Host Project. "¢ Configure a 2-NIC instance in zone us-west1-a in the Host Project. "¢ Attach NIC0 in us-west1 subnet of the Host Project. "¢ Attach NIC1 in us-west1 subnet of the Host Project "¢ Deploy the instance. "¢ Configure the necessary routes and firewall rules to pass traffic through the instance.
   • D"¢ Create 1 VPC in a Shared VPC Service Project. "¢ Configure a 2-NIC instance in zone us-west1-a in the Service Project. "¢ Attach NIC0 in us-west1 subnet of the Service Project. "¢ Attach NIC1 in us-west1 subnet of the Service Project "¢ Deploy the instance. "¢ Configure the necessary routes and firewall rules to pass traffic through the instance.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Correct Answer is (A): You cannot attach 2 NICs of same appliance to same VPC. The two NICs must be attached to different VPCs. It cant be C or D because you need 2 VPCs. https://cloud.google.com/vpc/docs/create-use-multiple-interfaces Each interface is attached to a different VPC network, giving that instance access to different VPC networks in Google Cloud Platform (GCP). You cannot attach multiple network interfaces to the same VPC network. It can't be B because you need to deploy the appliances in HOST Project to achieve CENTRALIZED NETWORK ADMINISTRATION

   Adapted from community discussion by ESP_SAP · 2021-05-02 · 33 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

   1. E

      ESP_SAP

      2021-05-02

      33 upvotes

      Correct Answer is (A): You cannot attach 2 NICs of same appliance to same VPC. The two NICs must be attached to different VPCs. It cant be C or D because you need 2 VPCs. https://cloud.google.com/vpc/docs/create-use-multiple-interfaces Each interface is attached to a different VPC network, giving that instance access to different VPC networks in Google Cloud Platform (GCP). You cannot attach multiple network interfaces to the same VPC network. It can't be B because you need to deploy the appliances in HOST Project to achieve CENTRALIZED NETWORK ADMINISTRATION

   2. S

      seddy

      2021-11-11

      6 upvotes

      Yeah, but I believe the Centralized network Administration refers to 'Shared VPC' in general, not to creating the workload in the Host project. By creating a shared VPC, we are centralizing the networking aspect in the first place. Then, it's a best practice to separate the workload by creating the instance in the service project. So, I believe the answer should be B!

   3. D

      densnoigaskogen

      2021-11-19

      3 upvotes

      Reviewed the question again, my answer is wrong. A should be the answer. The reasons to create 2 VPCs in the shared VPC Host project can be: - meet the requirements of primary and backup redundancy for interconnect towards the Data centers in Oregon and New york. Each VPC should represent a On-prem Data Center. - each VM NIC needs to be attached to a VPC, as we can not attach multiple network interfaces of a VM to the same VPC network. B is not correct, because the L7 virutal application needs to be deployed in Host project to bridge between those 2 VPCs, so that it can inspects both traffic coming from interconnects (us-west1 and us-east4) and internet-based connections (Europe and APAC) Additonal ref: https://cloud.google.com/architecture/best-practices-vpc-design#single-host-project-multiple-service-projects-single-shared-vpc

   4. S

      saraali

      2025-02-11

      Selected A1 upvote

      The correct option is A. Because Shared VPC Host Project is the best approach for centralized network management and security policies. Here, the security appliance requires two network interfaces (NICs) for inspecting and filtering traffic between different VPCs or subnets. In this setup, you can create a 2-NIC instance in us-west1 (your primary region) in the Host Project. Each NIC is attached to a different VPC subnet within the Host Project, allowing traffic to be inspected as it flows between different subnets or VPCs. Now you will configure routes and firewall rules to ensure traffic flows through the appliance for L7 inspection before proceeding to the destination.

10. Question 10 of 25

    Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates. Which Google Cloud load balancer should you use?

    • ASSL proxy load balancer
    • BNetwork load balancer
    • CHTTPS load balancer
    • DTCP proxy load balancer

    Show answer

    Correct answer: D

    How others answered

    • D67%
    • A30%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    D should be the answer. "Globally distributed users report that their SMTP and IMAP services are slow" --> means it's needed to be global, traffic type is TCP. "end-to-end encryption" +"you do not have access to the SSL certificates" ---> means that you can not use client certificate to configure on LB to do SSL offload. As per the reference below, only TCP proxy Load Balancer. https://cloud.google.com/load-balancing/docs/choosing-load-balancer

    Adapted from community discussion by densnoigaskogen · 2021-11-19 · 32 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. D

       densnoigaskogen

       2021-11-19

       32 upvotes

       D should be the answer. "Globally distributed users report that their SMTP and IMAP services are slow" --> means it's needed to be global, traffic type is TCP. "end-to-end encryption" +"you do not have access to the SSL certificates" ---> means that you can not use client certificate to configure on LB to do SSL offload. As per the reference below, only TCP proxy Load Balancer. https://cloud.google.com/load-balancing/docs/choosing-load-balancer

    2. B

       BobBui

       2021-09-15

       10 upvotes

       I go with D, https://cloud.google.com/load-balancing/docs/choosing-load-balancer SSL offload yes >> SSL proxy SSL offload no >> TCP proxy

    3. T

       terrain

       2021-01-22

       6 upvotes

       This question is ambiguous. The requirement here is to have end-to-end encryption for SMTP & IMAP. The only load balancer that supports this is SSL proxy. "For client traffic that is encrypted on these same ports, use SSL Proxy Load Balancing." https://cloud.google.com/load-balancing/docs/tcp The fact that you do not have access to the SSL certificates would probably mean that you need to get the required SSL certificates or generate new ones to use SSL proxy. https://cloud.google.com/load-balancing/docs/ssl-certificates TCP proxy does not supports end-to-end encryption https://cloud.google.com/security/encryption-in-transit/ "For TCP load balancers, there is no encryption between the end user and the GFE. The customer's application may, however, use its own encryption between the end user and the VMs." Even if we could use TCP Proxy, the question never mentions the user provides the encryption or uses Gmail to enforce TLS. This leaves the possibility open to fail the encryption requirement. I would say "A" is the correct answer.

    4. [

       [Removed]

       2021-01-24

       5 upvotes

       A is the correct answer . TCP Proxy Load Balancing is intended for TCP traffic on specific well-known ports, such as port 25 for Simple Mail Transfer Protocol (SMTP). For more information, see Port specifications. For client traffic that is encrypted on these same ports, use SSL Proxy Load Balancing. https://cloud.google.com/load-balancing/docs/tcp

11. Question 11 of 25

    Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them. How should you set up permissions for the networking team?

    • AAssign members of the networking team the compute.networkUser role.
    • BAssign members of the networking team the compute.networkAdmin role.
    • CAssign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
    • DAssign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.

    Show answer

    Correct answer: B

    How others answered

    • B65%
    • C25%

    Only 65% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "B" should be the correct answer https://cloud.google.com/compute/docs/access/iam#compute.networkAdmin "For example, if your company has a security team that manages firewalls and SSL certificates and a networking team that manages the rest of the networking resources, then grant this role to the networking team's group."

    Adapted from community discussion by terrain · 2020-07-22 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. T

       terrain

       2020-07-22

       15 upvotes

       "B" should be the correct answer https://cloud.google.com/compute/docs/access/iam#compute.networkAdmin "For example, if your company has a security team that manages firewalls and SSL certificates and a networking team that manages the rest of the networking resources, then grant this role to the networking team's group."

    2. B

       beebee

       2020-07-22

       14 upvotes

       Should be B: https://cloud.google.com/compute/docs/access/iam

    3. T

       thewalker

       2024-04-26

       2 upvotes

       The other options are incorrect because: A. Assign members of the networking team the compute.networkUser role. The compute.networkUser role does not have the compute.firewalls.list permission. B. Assign members of the networking team the compute.networkAdmin role. The compute.networkAdmin role has too many permissions. It allows members of the networking team to create, modify, and delete firewall rules. D. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission. The compute.networkViewer role does not have the compute.firewalls.list permission. The compute.networks.use permission is not necessary for the networking team to read firewall rules. Therefore, the best option is to assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.

    4. H

       HateMicrosoft

       2020-08-24

       4 upvotes

       The correct answer is B. This is a Shared VPC because "Your company has a security team that manages firewalls and SSL certificates." So,Network Admins have full control over all network resources except for firewall rules and SSL certificates. Network and Security Admins https://cloud.google.com/vpc/docs/shared-vpc#net_and_security_admins

12. Question 12 of 25

    Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications: ✑ Your ISP is a Google Partner Interconnect provider. ✑ Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps. ✑ A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses. ✑ Most of the data transfer will be from GCP to the on-premises environment. ✑ The application can burst up to 1.5 Gbps during peak transfers over the Interconnect. ✑ Cost and the complexity of the solution should be minimal. How should you provision the connectivity solution?

    • AProvision a Partner Interconnect through your ISP.
    • BProvision a Dedicated Interconnect instead of a VPN.
    • CCreate multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
    • DUse network compression over your VPN to increase the amount of data you can send over your VPN.

    Show answer

    Correct answer: A

    How others answered

    • A76%

    Explanation

    Answer is A, cost and complexity of multiple tunnel vpn is very high, also , dedicated interconnect is not required as required max speed is 1.5gbps Also , direct connectivity is bogus verb, all the solution provide direct connectivity to your vpc instance , once connected through router

    Adapted from community discussion by garbad · 2021-01-17 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. G

       garbad

       2021-01-17

       26 upvotes

       Answer is A, cost and complexity of multiple tunnel vpn is very high, also , dedicated interconnect is not required as required max speed is 1.5gbps Also , direct connectivity is bogus verb, all the solution provide direct connectivity to your vpc instance , once connected through router

    2. J

       JohnnyBG

       2021-07-24

       14 upvotes

       Everybody that says C please do not take this exam and never be consulted for network related question ...

    3. T

       ThisisJohn

       2021-11-05

       4 upvotes

       I would vote for A because of this statement " Most of the data transfer will be from GCP to the on-premises environment.". According to the documentation, carrier peering "Has reduced internet egress rates to your on-premises network " while Cloud VPN "Has standard egress rates for traffic sent through an Interconnect connection;" https://cloud.google.com/network-connectivity/docs/how-to/choose-product#cp-compare

    4. X

       xhilmi

       2023-12-22

       Selected A2 upvotes

       Partner Interconnect (Option A): This solution involves using your ISP as a Google Partner Interconnect provider. It establishes a connection between your on-premises network and Google's network through the service provider. Partner Interconnect can offer a dedicated and reliable connection with specified bandwidth. Given the requirement for direct connectivity, the fact that your ISP is a Google Partner Interconnect provider, and considering factors like minimal cost and complexity, this could indeed be a suitable choice.

13. Question 13 of 25

    Select 2

    Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that the caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it as a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost. Which two steps should you take? (Choose two.)

    • AUse Cloud Armor to blacklist the attacker's IP addresses.
    • BIncrease the maximum autoscaling backend to accommodate the severe bursty traffic.
    • CCreate a global HTTP(s) load balancer and move your application backend to this load balancer.
    • DShut down the entire application in GCP for a few hours. The attack will stop when the application is offline.
    • ESSH into the backend compute engine instances, and view the auth logs and syslogs to further understand the nature of the attack.

    Show answer

    Correct answer: A, C

    How others answered

    • AC45%
    • AB40%

    Only 45% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A & C Cloud Armor is the solution to prevent and mitigate attack (DDOS SQL injection and so on), it's a revenue generating so have to be alive and protected. No Cloud Armor is not a firewall. Using the CA language you have tons of prebuild rules to evaluate and block the malicious traffic in automatic way. You can put the rule blocking a specific traffic but it's not there the value (you have the firewall for that). Than you need C cause Cloud Armor require an HTTP(s) load balancer (that can be used cause it's a web application)

    Adapted from community discussion by Alex_74 · 2021-08-24 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. A

       Alex_74

       2021-08-24

       27 upvotes

       A & C Cloud Armor is the solution to prevent and mitigate attack (DDOS SQL injection and so on), it's a revenue generating so have to be alive and protected. No Cloud Armor is not a firewall. Using the CA language you have tons of prebuild rules to evaluate and block the malicious traffic in automatic way. You can put the rule blocking a specific traffic but it's not there the value (you have the firewall for that). Than you need C cause Cloud Armor require an HTTP(s) load balancer (that can be used cause it's a web application)

    2. H

       Hybrid_Cloud_boy

       2020-12-06

       14 upvotes

       I think B,E are actually correct. A and C would increase cost to global LB, change app architecture, and could potential block legitimate traffic since you “think” it is a DDoS, but do i not know. I do not think google would recommend blocking traffic unless you KNOW. So a temp increase in auto scale, with further investigation is the best course of action. It may lead to some short-term cost increase, but ultimately less cost increase than moving to global LB premium tier with cloudarmor.

    3. P

       PeppaPig

       2021-09-08

       4 upvotes

       Answer is B, C. Keep in mind that DDoS protection is auto-on for HTTP Load Balancer. B is obvious, because scaling out can quickly mitigate the issue. For C, DDoS protection is provided by default if you use HTTP, TCP and SSL LB even without Cloud Armor configuration "All projects that include HTTP(S) Load Balancing, TCP Proxy Load Balancing, or SSL Proxy Load Balancing are automatically enrolled in Google Cloud Armor Standard" https://cloud.google.com/armor/docs/managed-protection-overview#standard_versus_plus "Even without a Google Cloud Armor configuration, Google infrastructure and GFEs provide defense-in-depth for DDoS attacks and SYN floods." https://cloud.google.com/load-balancing/docs/https#open_ports

    4. S

       study_aws1

       2023-07-28

       3 upvotes

       A & B - Option C) of HTTPS Load balancer is not a mandatory requirement. Google Cloud Armor also provides advanced network DDoS protection for external passthrough Network Load Balancers, protocol forwarding, and VMs with public IP addresses. https://cloud.google.com/armor/docs/security-policy-overview Standard network DDoS protection: basic always-on protection for network load balancers, protocol forwarding, or VMs with public IP addresses. This is covered under Google Cloud Armor Standard and does not require any additional subscriptions. Advanced network DDoS protection: additional protections for Managed Protection Plus subscribers who use network load balancers, protocol forwarding, or VMs with public IP addresses. https://cloud.google.com/armor/docs/advanced-network-ddos

14. Question 14 of 25

    Select 2

    You are creating a new application and require access to Cloud SQL from VPC instances without public IP addresses. Which two actions should you take? (Choose two.)

    • AActivate the Service Networking API in your project.
    • BActivate the Cloud Datastore API in your project.
    • CCreate a private connection to a service producer.
    • DCreate a custom static route to allow the traffic to reach the Cloud SQL API.
    • EEnable Private Google Access.

    Show answer

    Correct answer: A, C

    How others answered

    • AC70%
    • AE20%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer are A & C C is definitely correct. private services access require private connection In below links stated Service Networking API is required https://cloud.google.com/service-infrastructure/docs/enabling-private-services-access

    Adapted from community discussion by mlyu · 2020-11-05 · 28 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. M

       mlyu

       2020-11-05

       28 upvotes

       Answer are A & C C is definitely correct. private services access require private connection In below links stated Service Networking API is required https://cloud.google.com/service-infrastructure/docs/enabling-private-services-access

    2. E

       ESP_SAP

       2020-11-03

       18 upvotes

       Correct Answer are (C) & (E): C: If you are using private IP for any of your Cloud SQL instances, you only need to configure private services access one time for every Google Cloud project that has or needs to connect to a Cloud SQL instance. If your Google Cloud project has a Cloud SQL instance, you can either configure it yourself or let Cloud SQL do it for you to use private IP. Cloud SQL configures private services access for you when all the conditions below are true: https://cloud.google.com/sql/docs/postgres/configure-private-services-access#before_you_begin E: You can enable Private Google access on a subnet level and any VMs on that subnet can access Google APIs by using their internal IP address. https://cloud.google.com/vpc/docs/configure-private-google-access

    3. A

       Alex_74

       2021-08-24

       7 upvotes

       A & C https://cloud.google.com/sql/docs/mysql/private-ip This page provides information about using private IP with Cloud SQL. For step-by-step instructions for configuring a Cloud SQL instance to use private IP, see Configuring private IP.

    4. I

       i_0_i

       2023-08-10

       3 upvotes

       Answer should be A&C. There are different ways to consume and provide APIs and services in GCP: https://cloud.google.com/vpc/docs/private-access-options#connect-google-apis --- Private service connect --- Private Google access --- Private services access Among all the given options, only A/C(Private services access) and E(Private Google access) are reasonable. As the answers have to be two, so they can only be A and C. Also, Private Google access is enabled on subnet level, not on VPC level. *For Private services access, its deployment involves the allocation of a specific internal CIDR in the local VPC and creation of a private connection between local VPC and service provider's VPC. This private connection is created using Service Networking API. https://cloud.google.com/vpc/docs/private-services-access *For Private Google access, it applies for accessing the external ip of Google APIs and services from instances with only internal ip addresses https://cloud.google.com/vpc/docs/private-google-access

15. Question 15 of 25

    Select 2

    You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall. Which two actions should you take? (Choose two.)

    • ATurn on Private Google Access at the subnet level.
    • BTurn on Private Google Access at the VPC level.
    • CTurn on Private Services Access at the VPC level.
    • DCreate a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
    • ECreate a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    ANS is A,D. Ref.: https://cloud.google.com/vpc/docs/configure-private-google-access https://cloud.google.com/vpc/docs/private-access-options "By default, when a Compute Engine VM lacks an external IP address assigned to its network interface, it can only send packets to other internal IP address destinations. You can allow these VMs to connect to the set of external IP addresses used by Google APIs and services by enabling Private Google Access on the subnet used by the VM's network interface."

    Adapted from community discussion by EJJ · 2021-04-19 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • developers.google.com documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. G

       Ganshank

       2020-05-06

       29 upvotes

       A, D Requires Private Google Access - https://cloud.google.com/vpc/docs/private-access-options#pga

    2. E

       EJJ

       2021-04-19

       14 upvotes

       ANS is A,D. Ref.: https://cloud.google.com/vpc/docs/configure-private-google-access https://cloud.google.com/vpc/docs/private-access-options "By default, when a Compute Engine VM lacks an external IP address assigned to its network interface, it can only send packets to other internal IP address destinations. You can allow these VMs to connect to the set of external IP addresses used by Google APIs and services by enabling Private Google Access on the subnet used by the VM's network interface."

    3. C

       catalinv

       2021-06-15

       9 upvotes

       Hi buldas, it can't be private service access, as this doesn't include Google services, but only 3rd party services, like Netapp.

    4. B

       buldas

       2021-04-18

       3 upvotes

       Nope, as in https://cloud.google.com/vpc/docs/configure-private-google-access: By default, when a Compute Engine VM lacks an external IP address assigned to its network interface, it can only send packets to other internal IP address destinations. You can allow these VMs to connect to the set of EXTERNAL IP addresses used by Google APIs and services by enabling Private Google Access on the subnet used by the VM's network interface. This traffic will meet the firewal. Should be C, as in https://cloud.google.com/vpc/docs/configure-private-services-access: Private services access is a private connection between your VPC network and a network owned by Google or a third party. Google or the third party, entities who are offering services, are also known as service producers. The private connection enables VM instances in your VPC network and the services that you access to communicate exclusively by using internal IP addresses.

16. Question 16 of 25

    Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired. During troubleshooting you find: "¢ Each on-premises router is configured with the same ASN. "¢ Each on-premises router is configured with the same routes and priorities. "¢ Both on-premises routers are configured with a VPN connected to a single Cloud Router. "¢ The VPN logs have no-proposal-chosen lines when the VPNs are connecting. "¢ BGP session is not established between one on-premises router and the Cloud Router. What is the most likely cause of this problem?

    • AOne of the VPN sessions is configured incorrectly.
    • BA firewall is blocking the traffic across the second VPN connection.
    • CYou do not have a load balancer to load-balance the network traffic.
    • DBGP sessions are not established between both on-premises routers and the Cloud Router.

    Show answer

    Correct answer: A

    How others answered

    • A64%
    • D36%

    Only 64% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I will go with A Reason: If the VPN logs show a no-proposal-chosen error, this error indicates that Cloud VPN and your peer VPN gateway were unable to agree on a set of ciphers. For IKEv1, the set of ciphers must match exactly. For IKEv2, there must be at least one common cipher proposed by each gateway. Make sure that you use supported ciphers to configure your peer VPN gateway. https://cloud.google.com/network-connectivity/docs/vpn/support/troubleshooting#:~:text=If%20the%20VPN%20logs%20show,of%20ciphers%20must%20match%20exactly.&text=Make%20sure%20that%20you%20use,configure%20your%20peer%20VPN%20gateway.

    Adapted from community discussion by ArizonaClassics · 2021-09-14 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. A

       ArizonaClassics

       2021-09-14

       17 upvotes

       I will go with A Reason: If the VPN logs show a no-proposal-chosen error, this error indicates that Cloud VPN and your peer VPN gateway were unable to agree on a set of ciphers. For IKEv1, the set of ciphers must match exactly. For IKEv2, there must be at least one common cipher proposed by each gateway. Make sure that you use supported ciphers to configure your peer VPN gateway. https://cloud.google.com/network-connectivity/docs/vpn/support/troubleshooting#:~:text=If%20the%20VPN%20logs%20show,of%20ciphers%20must%20match%20exactly.&text=Make%20sure%20that%20you%20use,configure%20your%20peer%20VPN%20gateway.

    2. B

       BenMS

       2024-06-27

       Selected A5 upvotes

       While it's necessary for BGP sessions to be established with both onprem routers to activate ECMP (option D) this is a symptom rather than the cause. The message in the logs indicates a problem with negotiating a connection, which supports the hypothesis that one of the VPN tunnels is incorrectly configured (option A).

    3. E

       ESP_SAP

       2021-05-03

       1 upvote

       Correct Answer (C): Part 2 After packets are delivered to the VPC network, the internal load balancer distributes them to backend VMs according to the configured session affinity. If the lb-network has two routes, each with the destination 192.168.1.0/24 and a next hop corresponding to different VPN tunnels, responses from backend VMs can be delivered over each tunnel according to the priority of the routes in the network. If different route priorities are used, one tunnel can serve as a backup for the other. If the same priorities are used, responses are delivered by using ECMP. Replies sent from the backend VMs (such as vm-a2) are delivered directly to the on-premises clients through the appropriate tunnel. From the perspective of lb-network, if routes or VPN tunnels change, traffic might egress by using a different tunnel. This might result in TCP session resets if an in-progress connection is interrupted. https://cloud.google.com/load-balancing/docs/l7-internal/internal-https-lb-and-other-networks

    4. O

       Ocedoc

       2021-08-01

       3 upvotes

       I'm going with D here. Lack of load balancer isn't preventing one of the BGP sessions from establishing. The second BGP session not being established is preventing load balancing to the alternate vpn. As far as the wording of D, (BGP sessions are NOT established between BOTH on-premises routers and ...) think of it this way: Not both, only one. If only one of your eyes can see, then you cannot see with both eyes.

17. Question 17 of 25

    All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance. What should you do?

    • AOpen the Cloud Shell SSH into the instance using gcloud compute ssh.
    • BSet the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
    • CGenerate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
    • DGenerate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.

    Show answer

    Correct answer: A

    How others answered

    • A58%
    • B25%

    Only 58% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A is worked, I have tested as below 1) Created VM 2) Set enable-oslogin FALSE ( in compute engine metadata) as well in VM's metadata 3) None of the instances are set with any SSH key, and no project-wide SSH keys have been configured (set block project wide ssh key on VM) 4) firewall allow for tcp:22 5) Try to ssh from cloud shell and web console, worked able to ssh into VM 5)

    Adapted from community discussion by aa_desh · 2021-09-09 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. A

       aa_desh

       2021-09-09

       20 upvotes

       A is worked, I have tested as below 1) Created VM 2) Set enable-oslogin FALSE ( in compute engine metadata) as well in VM's metadata 3) None of the instances are set with any SSH key, and no project-wide SSH keys have been configured (set block project wide ssh key on VM) 4) firewall allow for tcp:22 5) Try to ssh from cloud shell and web console, worked able to ssh into VM 5)

    2. I

       iloveme

       2020-10-07

       19 upvotes

       Correct answer A . D is incorrect - it mentions that you are adding the ssh key to the project, but the question says "block project-wide SSH keys." therefore that ssh key will not be added to the instance.

    3. J

       JoeShmoe

       2021-05-28

       3 upvotes

       I think its A. The key inference here is you want to access one instance temporarily and we are assuming you are a gcloud or console user with instance admin permissions. Using cloud shell or cloud ssh a temporary private key is generated on-demand and held in the browser. The corresponding public key is created and added to project wide or instance specific metadata. The public key has additional information associated with it, including an expiry timestamp, which renders it invalid after a few minutes. The public key is set on the project's metadata unless the instance to which you're connecting via SSH has the "block project wide SSH keys" attribute set; in that case, the public key is set on the instance's metadata. D is wrong as you would allow access to all instances. C would work but it requires the user to manage the key pairs 4. When you SSH using the gcloud tool (for example, gcloud compute ssh) [4], you have to be authenticated to the gcloud tool as a compute instance admin

    4. I

       iloveme

       2020-10-16

       5 upvotes

       This statement is correct - Instance-level public SSH keys: Use this metadata to give users special access—the ability to connect to a specific instance in your project—even if it blocks project-wide public SSH keys. So it works when you add your ssh key on an instance ! Answer D says that you are adding your SSH key on the project ! And by having block project-wide SSH key , the SSH key will NOT get propagated to your instances. Again , correct answer is A .

18. Question 18 of 25

    You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner. What should you first?

    • ALog in to your partner's portal and request the VLAN attachment there.
    • BAsk your Interconnect partner to provision a physical connection to Google.
    • CCreate a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.
    • DRun gcloud compute interconnect attachments partner update <attachment> / --region <region> --admin-enabled.

    Show answer

    Correct answer: C

    How others answered

    • C82%
    • B18%

    Explanation

    Correct Answer is (C): Provisioning overview Start by connecting your on-premises network to a supported service provider. Work with the service provider to establish connectivity. Next, create a VLAN attachment for a Partner Interconnect in your GCP project. This generates a unique pairing key that you'll use to request a connection from your service provider. You'll also need to provide other information such as the connection location and capacity. After the service provider configures your attachment, activate it to start using it. For more information about the provisioning process, see the Provisioning Overview in the Partner Interconnect how-to guide. https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview#provisioning_overview

    Adapted from community discussion by ESP_SAP · 2021-11-03 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. E

       ESP_SAP

       2021-11-03

       26 upvotes

       Correct Answer is (C): Provisioning overview Start by connecting your on-premises network to a supported service provider. Work with the service provider to establish connectivity. Next, create a VLAN attachment for a Partner Interconnect in your GCP project. This generates a unique pairing key that you'll use to request a connection from your service provider. You'll also need to provide other information such as the connection location and capacity. After the service provider configures your attachment, activate it to start using it. For more information about the provisioning process, see the Provisioning Overview in the Partner Interconnect how-to guide. https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview#provisioning_overview

    2. S

       seddy

       2022-05-16

       4 upvotes

       The answer is definitely C. -It cannot be B because our selected service provide already has an established connectivity between their resources and Google edge point in a Google colocation facility. -The very first thing in Partner interconnect is to establish connectivity between our on-prem nw and the service provider edge point. This should be done first! Service provider already needs to have a connection to Google edge point in Google's colocation -Then, we create a VLAN attachment in Cloud console and send the pairing key to our provider in order for them to establish connectivity from their resources to our selected VPC network (a Vlan is always associated with a specific VPC) Thus the answer is C. Peace :)

    3. K

       kapara

       2023-06-27

       Selected C4 upvotes

       To all who answers B here is why its not B: "Service providers have existing physical connections to Google's network that they make available for their customers to use. " https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview#how-it-works-partner And as stated in the question we already HAVE a service provider so we already HAVE a connection provided by the Partner. Correct answer is "C".

    4. H

       hyosung

       2024-07-29

       Selected C3 upvotes

       the answer is C B is not the first step because "Service providers have existing physical connections to Google's network that they make available for their customers to use" which means it's already connected to Google networks physically. https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview#how-it-works-partner

19. Question 19 of 25

    You are deploying a global external TCP load balancing solution and want to preserve the source IP address of the original layer 3 payload. Which type of load balancer should you use?

    • AHTTP(S) load balancer
    • BNetwork load balancer
    • CInternal load balancer
    • DTCP/SSL proxy load balancer

    Show answer

    Correct answer: D

    How others answered

    • D63%
    • B37%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Im pretty sure if this was an exam question then the expected answer would be B (NW load balancer) 1) the question says external TCP which is either TCP proxy or Network LB. 2) The question does NOT state anything about LB being regional or global, so there is no harm in choosing Network Load balancer instead of TCP proxy 3) TCP proxy is not a pass through LB, but network LB is. So, Network LB preserves the client IP by default. NOTE: It is still possible to preserve the client IP via TCP proxy if you use a Proxy Protocol. So, if the question statement was ''External GLOBAL Tcp LB" then i would say the answer is TCP Proxy. But with all we have in the statement, Network LB is a safe answer! Peace :)

    Adapted from community discussion by seddy · 2021-05-16 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. S

       seddy

       2021-05-16

       14 upvotes

       Im pretty sure if this was an exam question then the expected answer would be B (NW load balancer) 1) the question says external TCP which is either TCP proxy or Network LB. 2) The question does NOT state anything about LB being regional or global, so there is no harm in choosing Network Load balancer instead of TCP proxy 3) TCP proxy is not a pass through LB, but network LB is. So, Network LB preserves the client IP by default. NOTE: It is still possible to preserve the client IP via TCP proxy if you use a Proxy Protocol. So, if the question statement was ''External GLOBAL Tcp LB" then i would say the answer is TCP Proxy. But with all we have in the statement, Network LB is a safe answer! Peace :)

    2. S

       seddy

       2021-05-18

       15 upvotes

       I was wrong, the question indeed says Global. So the answer is D. We cannot preserve the client IPs by default. To do that we need to use a Proxy Protocol.

    3. Y

       ydanno

       2021-01-04

       9 upvotes

       You can understand which LB we should use in this situation. The correct answer is "D". External -> no SSL offload -> Global LB -> TCP Proxy https://cloud.google.com/load-balancing/docs/choosing-load-balancer#flow_chart There is one important point to note. By default, the original(source) client IP address and port information is not preserved. We can preserve this information by using the PROXY protocol. https://cloud.google.com/load-balancing/docs/tcp#target-proxies

    4. L

       lukedj87

       2020-11-13

       7 upvotes

       I guess I was simply tired when I've answered this. CORRECT ANSWER IS D. HTTP, TCP and SSL proxies are all global and L7. By default they DO NOT preserve the client IP. Anyway, optionally, using the PROXY protocol, both the TCP and the SSL proxies can be set to preserve the client IP.

20. Question 20 of 25

    You work for a university that is migrating to GCP. These are the cloud requirements: "¢ On-premises connectivity with 10 Gbps "¢ Lowest latency access to the cloud "¢ Centralized Networking Administration Team New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud. What should you do?

    • AUse Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
    • BUse Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
    • CUse standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
    • DUse standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Correct Answer is (A) Using Cloud Interconnect with Shared VPC You can use Shared VPC to share your VLAN attachment in a project with other VPC networks. Choosing Shared VPC is preferable if you need to create many projects and would like to prevent individual project owners from managing their connectivity back to your on-premises network. In this scenario, the host project contains a common Shared VPC network usable by VMs in service projects. Because VMs in the service projects use this network, Service Project Admins don't need to create other VLAN attachments or Cloud Routers in the service projects. In this scenario, you must create VLAN attachments and Cloud Routers for a Cloud Interconnect connection only in the Shared VPC host project. The combination of a VLAN attachment and its associated Cloud Router are unique to a given Shared VPC network. https://cloud.google.com/network-connectivity/docs/interconnect/how-to/enabling-multiple-networks-access-same-attachment#using_with

    Adapted from community discussion by ESP_SAP · 2024-09-27 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. G

       Ganshank

       2020-05-06

       18 upvotes

       A https://cloud.google.com/interconnect/docs/how-to/dedicated/using-interconnects-other-projects

    2. E

       ESP_SAP

       2024-09-27

       4 upvotes

       Correct Answer is (A) Using Cloud Interconnect with Shared VPC You can use Shared VPC to share your VLAN attachment in a project with other VPC networks. Choosing Shared VPC is preferable if you need to create many projects and would like to prevent individual project owners from managing their connectivity back to your on-premises network. In this scenario, the host project contains a common Shared VPC network usable by VMs in service projects. Because VMs in the service projects use this network, Service Project Admins don't need to create other VLAN attachments or Cloud Routers in the service projects. In this scenario, you must create VLAN attachments and Cloud Routers for a Cloud Interconnect connection only in the Shared VPC host project. The combination of a VLAN attachment and its associated Cloud Router are unique to a given Shared VPC network. https://cloud.google.com/network-connectivity/docs/interconnect/how-to/enabling-multiple-networks-access-same-attachment#using_with

    3. E

       elguije

       2024-09-27

       3 upvotes

       I think A is the right answer. When using a Shared VPC Network with Dedicated Interconnect, consider the following: VLAN attachments and Cloud Routers for Dedicated Interconnect must exist in the Shared VPC host project, not in any service projects attached to the host project. When you create the Cloud Router to manage a VLAN attachment, you specify a particular VPC network. Effectively, the combination of a VLAN attachment and its associated Cloud Router are unique to a given Shared VPC network. Service Project Admins can create VMs that use subnets in a Shared VPC network of a host project based on the permissions they have to the host project. VMs that use the Shared VPC network can use the custom dynamic routes for VLAN attachments available to that network.

    4. D

       desertlotus1211

       2024-09-27

       2 upvotes

       Answer is A: https://cloud.google.com/network-connectivity/docs/interconnect/concepts/best-practices Configure VLAN attachments in the Shared VPC host project 'In a Shared VPC network, configure all VLAN attachments, not physical Interconnect connections (ports), in the host project. For more information about connecting attachments to Shared VPC networks'... https://cloud.google.com/network-connectivity/docs/interconnect/how-to/enabling-multiple-networks-access-same-attachment 'You must create VLAN attachments and Cloud Routers for an Interconnect connection only in the Shared VPC host project'

21. Question 21 of 25

    You have applications running in the us-west1 and us-east1 regions. You want to build a highly available VPN that provides 99.99% availability to connect your applications from your project to the cloud services provided by your partner's project while minimizing the amount of infrastructure required. Your partner's services are also in the us-west1 and us-east1 regions. You want to implement the simplest solution. What should you do?

    • ACreate one Cloud Router and one HA VPN gateway in each region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways. Enable global dynamic routing in each VPC.
    • BCreate one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC. Create one OpenVPN Access Server in each region of your partner's VPC. Connect your VPN gateway to your partner's servers.
    • CCreate one OpenVPN Access Server in each region of your VPC and your partner's VPConnect your servers to the partner's servers.
    • DCreate one Cloud Router and one HA VPN gateway in the us-west1 region of your VPC and your partner's VPC. Connect your VPN gateways to the partner's gateways with a pair of tunnels. Enable global dynamic routing in each VPC.

    Show answer

    Correct answer: D

    How others answered

    • D76%
    • A24%

    Explanation

    100% sure for D. https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview HA VPN requirements Your Cloud VPN configuration must meet the following requirements to achieve a service-level availability of 99.99% for HA VPN: To achieve high availability when both VPN gateways are located in VPC networks, you must use two HA VPN gateways, and both of them must be located in the same region.

    Adapted from community discussion by ccieman2016 · 2022-12-02 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. C

       ccieman2016

       2022-12-02

       Selected D8 upvotes

       100% sure for D. https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview HA VPN requirements Your Cloud VPN configuration must meet the following requirements to achieve a service-level availability of 99.99% for HA VPN: To achieve high availability when both VPN gateways are located in VPC networks, you must use two HA VPN gateways, and both of them must be located in the same region.

    2. B

       Ben756

       2023-03-13

       Selected D2 upvotes

       D is correct. Option D suggests creating one Cloud Router and one HA VPN gateway in each region of the VPC and the partner's VPC, and connecting the VPN gateways to the partner's gateways with a pair of tunnels. This solution provides redundancy and high availability with minimal infrastructure requirements. A is incorrect because it suggests creating one Cloud Router and one HA VPN gateway in each region of the VPC and the partner's VPC, which would require more infrastructure and would not necessarily simplify the solution. B is incorrect because it suggests using OpenVPN Access Servers, which would require additional infrastructure and may not necessarily simplify the solution. C is incorrect because it suggests creating OpenVPN Access Servers in each region of the VPC and the partner's VPC, which would require more infrastructure and may not necessarily provide the necessary redundancy and high availability for the VPN.

    3. P

       pfilourenco

       2022-12-03

       Selected D4 upvotes

       D is the most correct. Anyway, this is not able to have 99,99%: To achieve high availability when both VPN gateways are located in VPC networks, you must use two HA VPN gateways, and both of them must be located in the same region. And D is only talking about 1 HA VPN. info: https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview#ha-requirements

    4. G

       GeorgS

       2023-03-28

       4 upvotes

       To get 99,99% you need just 1 HA-VPN (with 2 tunnels on 1 HA-VPN gateway) https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies?hl=en#2-peers The scenario in A, setting up 2 HA-VPNs and 4 VPN-Tunnels, is for a 99.999% SLA. So the answer is D

22. Question 22 of 25

    You are the network administrator responsible for hybrid connectivity at your organization. Your developer team wants to use Cloud SQL in the us-west1 region in your Shared VPC. You configured a Dedicated Interconnect connection and a Cloud Router in us-west1, and the connectivity between your Shared VPC and on-premises data center is working as expected. You just created the private services access connection required for Cloud SQL using the reserved IP address range and default settings. However, your developers cannot access the Cloud SQL instance from on-premises. You want to resolve the issue. What should you do?

    • A1. Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes. 2. Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.
    • B1. Change the VPC routing mode to global. 2. Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.
    • C1. Create an additional Cloud Router in us-west2. 2. Create a new Border Gateway Protocol (BGP) peering connection to your on-premises data center. 3. Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.
    • D1. Change the VPC routing mode to global. 2. Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.

    Show answer

    Correct answer: A

    How others answered

    • A68%
    • B32%

    Only 68% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A is correct. This question is about "Private services access and on-premises connectivity". See this link, https://cloud.google.com/vpc/docs/private-services-access#on-premises-connectivity By default, on-premises hosts can't reach the service producer's network by using private services access. In the VPC network, you might have custom static or dynamic routes to correctly direct traffic to your on-premises network. However, the service producer's network doesn't contain those same routes. When you create a private connection, the VPC network and service producer network exchange subnet routes only. You must export the VPC network's custom routes so that the service provider's network can import them and correctly route traffic to your on-premises network. Update the VPC peering configuration associated with the private connection to export custom routes. Then, https://cloud.google.com/vpc/docs/using-vpc-peering#update-peer-connection Updating a peering connection can import and export custom routes.

    Adapted from community discussion by i_0_i · 2024-02-18 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. C

       ccieman2016

       2023-06-01

       Selected A9 upvotes

       B and D is wrong, VPC routing mode global is default, not necessary to changed. C is wrong, no make sense additional cloud router. in my opinion, Letter A is sure.

    2. I

       i_0_i

       2024-02-18

       4 upvotes

       A is correct. This question is about "Private services access and on-premises connectivity". See this link, https://cloud.google.com/vpc/docs/private-services-access#on-premises-connectivity By default, on-premises hosts can't reach the service producer's network by using private services access. In the VPC network, you might have custom static or dynamic routes to correctly direct traffic to your on-premises network. However, the service producer's network doesn't contain those same routes. When you create a private connection, the VPC network and service producer network exchange subnet routes only. You must export the VPC network's custom routes so that the service provider's network can import them and correctly route traffic to your on-premises network. Update the VPC peering configuration associated with the private connection to export custom routes. Then, https://cloud.google.com/vpc/docs/using-vpc-peering#update-peer-connection Updating a peering connection can import and export custom routes.

    3. M

       mohitms1996

       2025-04-02

       Selected A1 upvote

       ❌ B. Change VPC routing mode to global + advertise routes Changing VPC routing mode to global is unnecessary because you are already in the same region (us-west1). The issue is route advertisement via VPC Peering, not VPC routing mode. ❌ C. Create an additional Cloud Router in us-west2 + BGP peering There is no need to create another Cloud Router in a different region (us-west2) when everything is already in us-west1. BGP peering is already established with your current Cloud Router. ❌ D. Change VPC routing mode to global + modify peering Changing the routing mode alone will not fix the issue. You still need to advertise the Cloud SQL IP range via Cloud Router, which this option does not mention.

    4. S

       saraali

       2025-02-15

       Selected A2 upvotes

       Correct Answer: Option A Reason: This option ensures that the routes for Cloud SQL are properly advertised to the on-premises network, allowing the developer team to access the Cloud SQL instance. The change to VPC routing mode is not required, but modifying the peering and enabling route import/export is the correct solution.

23. Question 23 of 25

    You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services. Which session affinity should you choose?

    • ANone
    • BClient IP
    • CClient IP and protocol
    • DClient IP, port and protocol

    Show answer

    Correct answer: B

    How others answered

    • B69%
    • D31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The correct answer is B HTTP/S port 80/443 TFTP port 69 Session affinity, (sticky sessions), overrides the load-balancing algorithm by directing all requests in a session to a specific application server. So, we need a Session affinity by Client IP. Session affinity https://cloud.google.com/load-balancing/docs/backend-service#session_affinity Session affinity options https://cloud.google.com/load-balancing/docs/internal#session_affinity The answer A&D produces the same (Client IP, protocol, and port) by the way.

    Adapted from community discussion by HateMicrosoft · 2020-08-21 · 24 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. H

       HateMicrosoft

       2020-08-21

       24 upvotes

       The correct answer is B HTTP/S port 80/443 TFTP port 69 Session affinity, (sticky sessions), overrides the load-balancing algorithm by directing all requests in a session to a specific application server. So, we need a Session affinity by Client IP. Session affinity https://cloud.google.com/load-balancing/docs/backend-service#session_affinity Session affinity options https://cloud.google.com/load-balancing/docs/internal#session_affinity The answer A&D produces the same (Client IP, protocol, and port) by the way.

    2. X

       xhilmi

       2023-12-12

       Selected B4 upvotes

       B. Client IP In the context of session affinity, selecting "Client IP" means that the load balancer uses the client's IP address to determine which backend instance should receive the traffic. Each unique client IP is consistently directed to the same backend instance. If you are looking for stickiness based on the client's IP address only, and you don't need to consider the specific protocol (HTTP or TFTP), then option B is appropriate. So, if the requirement is solely to maintain stickiness based on the client IP and the protocol (HTTP or TFTP) doesn't need to be considered, then option B is indeed the correct choice. I appreciate your clarification, and I hope this provides a clear explanation.

    3. S

       sierra1784

       2023-09-26

       Selected B3 upvotes

       this part of the question "but need to ensure that clients are sticky to a particular instance across both services." has to be client IP.. (B)

    4. D

       desertlotus1211

       2021-12-06

       2 upvotes

       Answer is B: https://medium.com/google-cloud/google-cloud-load-balancer-setup-tweaking-and-observations-c12d704e6d52' ffinity Typically the LB is going to route new requests to any instance and traffic from one connection is going to route to the same instance. Say you want to set stickiness to make sure all connections from one client go to the same instance. Configure session affinity to client IP. You can also set by cookie. The GCLB sends a cookie on the first client request and future incoming requests with that cookie will be sent to the same instance.

24. Question 24 of 25

    You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?

    • AAdd a firewall rule that allows port 443 from the other spoke projects.
    • BEnable Private Google Access on the subnet where the GKE nodes are deployed.
    • CConfigure the authorized networks to be the subnet ranges of the other spoke projects.
    • DDeploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.

    Show answer

    Correct answer: D

    How others answered

    • D66%
    • C34%

    Only 66% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Agree D is right To enable access such as in hub-and-spoke designs, create a proxy hosted in authorized IP address space, because VPC network peering is non-transitive.

    Adapted from community discussion by nosense · 2023-06-11 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. J

       jitu028

       2023-06-09

       11 upvotes

       Correct answer - D https://cloud.google.com/architecture/creating-kubernetes-engine-private-clusters-with-net-proxies#:~:text=To%20enable%20access%20to%20the%20controller%20from%20another%20VPC%20network%20or%20from%20on%2Dpremises%20connected%20through%20another%20VPC%20network%20peering%20(such%20as%20in%20hub%2Dand%2Dspoke%20designs)%2C%20create%20a%20proxy%20hosted%20in%20authorized%20IP%20address%20space%2C%20because%20VPC%20network%20peering%20is%20non%2Dtransitive.

    2. N

       nosense

       2023-06-11

       Selected D11 upvotes

       Agree D is right To enable access such as in hub-and-spoke designs, create a proxy hosted in authorized IP address space, because VPC network peering is non-transitive.

    3. F

       Falconite

       2023-07-21

       5 upvotes

       In this case: Spoke 1 Hub Spoke 2 The peering does not allow transitivity: https://cloud.google.com/vpc/docs/vpc-peering#specifications "Only directly peered networks can communicate. Transitive peering is not supported. In other words, if VPC network N1 is peered with N2 and N3, but N2 and N3 are not directly connected, VPC network N2 cannot communicate with VPC network N3 over VPC Network Peering." Answer D it is the only way to achieve the communication.

    4. G

       gcpengineer

       2024-03-13

       Selected D4 upvotes

       D is the ans . https://cloud.google.com/kubernetes-engine/docs/archive/creating-kubernetes-engine-private-clusters-with-net-proxies

25. Question 25 of 25

    You recently deployed your application in Google Cloud. You need to verify your Google Cloud network configuration before deploying your on-premises workloads. You want to confirm that your Google Cloud network configuration allows traffic to flow from your cloud resources to your on- premises network. This validation should also analyze and diagnose potential failure points in your Google Cloud network configurations without sending any data plane test traffic. What should you do?

    • AUse Network Intelligence Center's Connectivity Tests.
    • BEnable Packet Mirroring on your application and send test traffic.
    • CUse Network Intelligence Center's Network Topology visualizations.
    • DEnable VPC Flow Logs and send test traffic.

    Show answer

    Correct answer: C

    How others answered

    • C57%
    • A43%

    Only 57% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Using Network Topology provides the following benefits: You can view the topology of your deployments. No additional configurations or agents are required to use Network Topology. You can use Network Topology graphs to understand your Google Cloud infrastructure. You don't need to view multiple logs or use third-party tools. You can use Network Topology to help you analyze the performance of your network. You can drill down and view various metrics that can help you identify unexpected patterns. You can use filters to help you highlight and focus on specific resources, especially when you need to diagnose and troubleshoot issues. You can view cross-project metrics for network traffic sent across Shared VPC or VPC Network Peering boundaries within the same organization. You can view insights for entities with high egress metric values for further analysis and troubleshooting.

    Adapted from community discussion by didek1986 · 2023-08-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCNE or CertExamHQ.

    1. D

       didek1986

       2023-08-08

       Selected C2 upvotes

       Using Network Topology provides the following benefits: You can view the topology of your deployments. No additional configurations or agents are required to use Network Topology. You can use Network Topology graphs to understand your Google Cloud infrastructure. You don't need to view multiple logs or use third-party tools. You can use Network Topology to help you analyze the performance of your network. You can drill down and view various metrics that can help you identify unexpected patterns. You can use filters to help you highlight and focus on specific resources, especially when you need to diagnose and troubleshoot issues. You can view cross-project metrics for network traffic sent across Shared VPC or VPC Network Peering boundaries within the same organization. You can view insights for entities with high egress metric values for further analysis and troubleshooting.

    2. F

       FunkyB

       2022-12-15

       1 upvote

       A is correct. Key features Network Topology Visualize the topology of your Virtual Private Cloud (VPC) networks, hybrid connectivity to and from your on-premises networks, connectivity to Google-managed services, and the associated metrics. Connectivity Tests Diagnostics tool that lets you check connectivity between network endpoints like a source or destination of network traffic such as a VM, GKE cluster, load balancer forwarding rule, or an IP address on the internet. Performance Dashboard Visibility into the performance of the entire Google Cloud network and to the performance of your project's resources. Firewall Insights Provides data about how firewall rules are being used, exposes misconfigurations, and identifies rules that could be made more strict. Network Analyzer Automatically monitors your VPC network configurations and detects misconfigurations and suboptimal configurations. Identifies failures caused by the underlying network, provides root cause information, and suggests possible resolutions https://cloud.google.com/network-intelligence-center

    3. L

       Laryoul

       2023-05-29

       Selected C3 upvotes

       remember that Connectivity Tests uses two types of analysis: a configuration analysis, which detects issues in active configurations within your project, and dynamic verification, which sends probes on the data plane. https://cloud.google.com/network-intelligence-center/docs/connectivity-tests/support/troubleshooting

    4. P

       playpacman

       2022-12-02

       3 upvotes

       Its C as A still sends data through the data plane: https://cloud.google.com/network-intelligence-center/docs/connectivity-tests/concepts/overview "For some connectivity scenarios, Connectivity Tests also performs live data plane analysis. This feature sends packets over the data plane to validate connectivity and provides baseline diagnostics of latency and packet loss. If the route is supported for the feature, each test that you run includes a live data plane analysis result."

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 1 of 25