Practice Questions

Question 1

Your team manages a VPC named Studio that was created in auto mode for a global video-rendering platform; auto-mode VPCs reserve 10.128.0.0/9 for their subnets across regions. You must create a new VPC named Archive in the same project and connect it to Studio using VPC Network Peering so that internal RFC1918 traffic routes privately end-to-end without NAT; the two VPCs must have non-overlapping IP ranges now and as they scale. How should you configure the Archive VPC?

Question 2

You are a network engineer at a global streaming company migrating core APIs to Google Cloud. These are the connectivity requirements:

On-premises connectivity with at least 20 Gbps from a single metro data center
Lowest-latency private access to Google Cloud (target: <5 ms one-way to nearest POP)
A centralized Network Engineering team must administer all WAN links and routing New product groups are creating separate Google Cloud projects and require private access to on-prem services from their workloads. You need the most cost-efficient design to connect the data center to Google Cloud while meeting the above requirements. What should you do?

Question Analysis

Core concept: This question tests hybrid connectivity design using Cloud Interconnect (Dedicated or Partner), VLAN attachments, Cloud Router/BGP, and Shared VPC for multi-project private connectivity with centralized administration. Why the answer is correct: A single metro data center needing >=20 Gbps and <5 ms one-way latency to the nearest Google POP strongly points to Cloud Interconnect rather than VPN. Dedicated Interconnect provides 10/100 Gbps per link and is designed for lowest-latency private connectivity at a colocation facility; Partner Interconnect can also meet bandwidth needs depending on provider offerings, but Dedicated is the typical choice for strict latency/throughput targets. To keep WAN links and routing centrally administered while enabling many product teams to use separate projects, you should place the Interconnect and all VLAN attachments in a Shared VPC host project. This centralizes ownership of the physical connectivity, VLAN attachments, Cloud Router sessions, and route exchange policies, while service projects consume the shared subnets and automatically gain access to on-prem routes (subject to IAM and firewall policy). Key features / best practices: - Use Shared VPC to separate network administration (host project) from application ownership (service projects), aligning with the Google Cloud Architecture Framework principle of centralized governance with delegated usage. - Terminate Interconnect VLAN attachments in the host project VPC and use Cloud Router with BGP to exchange routes. Apply consistent routing policy (advertised prefixes, BGP communities, route priority) centrally. - For >=20 Gbps, deploy redundant Interconnect connections (and redundant VLAN attachments/Cloud Routers) to meet HA best practices and avoid single points of failure. Consider quotas/limits for VLAN attachments and Cloud Router sessions per region. - Cost efficiency: one set of Interconnect resources shared across many projects is typically cheaper and operationally simpler than duplicating attachments per project. Common misconceptions: It may seem appealing to create VLAN attachments in each service project for autonomy, but that fragments routing control and increases operational overhead and cost. Another misconception is that “isolation” requires separate Interconnects per project; isolation is usually achieved with IAM, firewall policies, and segmentation (subnets, VPC design), not duplicating physical connectivity. Exam tips: When you see multi-project private hybrid access plus centralized network control, think Shared VPC host project owns the hybrid connectivity (Interconnect/VLAN attachments/Cloud Router). Use Dedicated Interconnect for strict latency and high throughput from a single metro, and design for redundancy (at least two connections and dual attachments) even if not explicitly asked.

Question 3

Your security team now requires capturing packet payloads for all egress traffic originating from Compute Engine instances in region europe-west4 within VPC prod-vpc, limited to subnets app-euw4 (10.70.0.0/20) and jobs-euw4 (10.70.16.0/20). You have deployed an IDS virtual appliance as a regional managed instance group with 3 VMs (ids-mig) in europe-west4. You must integrate the IDS so it receives mirrored packets for egress traffic only and production routing remains unchanged. What should you do?

Question Analysis

Core concept: This question tests Google Cloud Packet Mirroring for out-of-band network security monitoring. Packet Mirroring copies packets (including payload) from selected sources (VM NICs, instance tags, or subnets) to a collector without changing routing or requiring inline appliances. This aligns with the Google Cloud Architecture Framework security principle of centralized visibility and detection while preserving reliability by avoiding inline dependencies. Why the answer is correct: The requirement is to capture packet payloads for egress traffic originating from Compute Engine instances in europe-west4, limited to two subnets, and to send mirrored packets to an IDS MIG, while keeping production routing unchanged. Packet Mirroring is the only option that provides full packet copies (payload) rather than metadata logs. In Google Cloud, mirrored traffic is delivered to a Packet Mirroring collector, which is implemented using a regional internal passthrough Network Load Balancer (internal TCP/UDP load balancer). You then configure a regional packet mirroring policy in europe-west4, select the two subnets as the mirrored sources, and set direction=EGRESS to mirror only outbound traffic. Key features/configuration points: - Scope: Packet mirroring policy is regional; sources and collector must be in the same region (europe-west4). - Sources: select subnets app-euw4 and jobs-euw4 to constrain coverage. - Direction: set to EGRESS to meet “egress only” requirement. - Collector: use a regional internal TCP/UDP load balancer (passthrough) targeting the ids-mig instance group so traffic is distributed across the 3 IDS VMs. - Routing unchanged: mirroring is a copy; it does not affect forwarding decisions or introduce latency to production flows. Common misconceptions: Flow Logs and firewall logs are often confused with packet capture. They provide metadata (5-tuple, bytes, actions) but not payload, so they cannot satisfy “packet payloads.” Also, HTTP(S) load balancers are proxy-based L7 services and are not used as packet mirroring collectors. Exam tips: When you see “payload,” “IDS,” “out-of-band,” and “routing remains unchanged,” think Packet Mirroring. Remember collectors use internal passthrough (TCP/UDP) load balancing, and policies are regional with selectable direction (INGRESS/EGRESS/BOTH). Also consider quotas/cost: mirrored traffic can be high-volume and billed; scope mirroring tightly (subnets, direction, optional filters) to control cost and capacity.

Question 4

Your company is deploying a new 20-Gbps Dedicated Interconnect with two VLAN attachments in us-east4 and BGP peering to on-premises ASN 65010; three departments (R&D, HR, and Finance) each use separate service projects attached to a single Shared VPC host project that owns the central VPC, and you need all departments to exchange routes with on-premises over this Interconnect—where should you create the Cloud Router instance?

Question 5

You are deploying a new VPC in europe-west1 to host internal microservices that must bind to two distinct private IP ranges. Your application VMs will reside in a subnet using 10.20.0.0/24, but a legacy client integration requires the same VMs to also listen on IPs from 192.168.70.0/24 for inbound connections. Without adding a second NIC or introducing new gateways, you need the instances to have addresses in both ranges; what should you do?

Want to practice all questions on the go?

Download Cloud Pass — includes practice tests, progress tracking & more.

Question 6

You are deploying an internal-only metrics ingestion HTTP endpoint on a Compute Engine VM named collector-01 in zone us-central1-b within the project analytics-prd, the VM has no external IP and must be reachable only by multiple client VMs in the same VPC network, and you need a simple, built-in way for those clients to obtain the service’s IP address without creating public DNS records or exposing the service; what should you do?

Question 7

(Select 2)

Your company uses a third-party virtual firewall appliance to inspect egress traffic. In a spoke VPC in us-central1, you configured a custom default route 0.0.0.0/0 (priority 100) that sends all egress to the firewall in a hub VPC via next hop instance. None of the VM instances in the spoke subnets have external IP addresses. The data team needs VM instances in subnet analytics-subnet (10.50.1.0/24) to access the Cloud Storage JSON API and the Cloud Logging API directly without traversing the firewall, but all other internet-bound traffic must continue to use the firewall route. You must not assign public IPs to any VMs and must retain the existing 0.0.0.0/0 to the firewall for general egress. Which two actions should you take? (Choose two.)

Question 8

Helios Labs operates three product squads—API, Batch, and Analytics—each requiring Compute Engine instances in us-central1, europe-west1, and asia-east1 (up to 20 VMs per squad per region) and separate projects for billing isolation and least-privilege access. Your 2-person network/security team must retain centralized control of IP space 10.64.0.0/12, including subnets, routes, and firewall rules, avoid overlapping subnets, and minimize operational overhead for inter-squad connectivity. How should you design the Google Cloud network topology?

Question 9

Your company runs a manufacturing plant with an on-premises Juniper SRX gateway in Tokyo (ASN 65010) that must exchange routes dynamically with a Google Cloud VPC in asia-northeast1. You have already created an HA VPN gateway in Google Cloud and a peer VPN gateway that points to the SRX public IPs. The on-prem network advertises 172.20.0.0/16, and the VPC will advertise 10.60.0.0/16 and 10.61.0.0/16, with the requirement that any future subnets be learned automatically without manual updates. What should you do next to complete the setup for dynamic routing?

Question 10

(Select 2)

Aurora Analytics ordered two 10-Gbps Dedicated Interconnect circuits at the Equinix TY2 facility in Tokyo under project net-prod-123 and named the first interconnect aurora-ty2-ic1; you must provide the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to the colocation provider within 5 business days to complete the cross-connect. During the order, you specified noc-aurora@aurora.example as the NOC contact email. Which two actions will allow you to obtain the LOA-CFA documents? (Choose two.)

Practice Test #1

Triple AI-Verified Answers & Explanations

Practice Questions

Success Stories(5)

Start Practicing Now