I85PREP
⌘ K
ACE Professional study materials
ACE Professional study resources

ACE Professional practice questions

One question at a time. Build your ACE Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Networking

In a Google Cloud VPC, which object directly controls whether traffic is allowed to reach a Compute Engine instance's network interface?

  1. A Cloud NAT gateway
  2. A Cloud Armor security policy
  3. A VPC Service Controls perimeter
  4. A VPC firewall rule Correct answer.

Explanation

VPC firewall rules are stateful and are evaluated against traffic entering or leaving an instance's network interface, so they are the primary control for instance-level reachability. Cloud Armor protects HTTP(S) load balancer backends, Cloud NAT enables outbound internet access, and Service Controls restrict API access at the perimeter.

Question 2Cloud Networking

A company needs a VPC subnet whose primary range provides at least 500 usable host addresses for VM instances. Which CIDR prefix meets the requirement with the smallest range?

  1. /24
  2. /25
  3. /22
  4. /23 Correct answer.

Explanation

A /23 leaves 9 host bits, giving 512 addresses, which is the smallest listed range that still provides at least 500 usable addresses. A /24 provides 256 addresses, which is too few, while a /22 provides 1024 and is larger than necessary.

Question 3Cloud Networking

Which Google Cloud construct provides a global, anycast IP address that routes users to the closest healthy backend?

  1. A global external Application Load Balancer Correct answer.
  2. A Private Service Connect endpoint
  3. A regional external passthrough Network Load Balancer
  4. A Cloud VPN high-availability gateway

Explanation

A global external Application Load Balancer uses a single global anycast IP address and Google's global front-end infrastructure to send each user to the nearest healthy backend. Regional passthrough load balancers and VPN gateways are scoped to a region, and Private Service Connect endpoints provide private access to services rather than global anycast entry.

Question 4Cloud Networking

What is the default routing behavior for a newly created VPC network in Google Cloud?

  1. It contains no routes until a Cloud Router is created
  2. It contains only subnet routes until custom routes are added
  3. It contains routes only for peered networks
  4. It contains a default route to the internet gateway Correct answer.

Explanation

Every VPC network automatically includes a default route (0.0.0.0/0) whose next hop is the internet gateway, along with system-generated subnet routes. Administrators can delete or override the default route, but it exists at creation.

Question 5Cloud Networking

Which service lets instances without external IP addresses initiate outbound connections to the internet while keeping their private addresses?

  1. Private Google Access
  2. Cloud Interconnect
  3. Cloud NAT Correct answer.
  4. VPC peering

Explanation

Cloud NAT performs source address translation so private instances can open outbound internet connections without external IP addresses. It is regional and managed, and return traffic is allowed because the translation is stateful.

Question 6Cloud Networking

A team wants to allow only specific Google APIs to be reached from a subnet without giving instances external IP addresses. Which feature should they enable?

  1. Cloud NAT with logging enabled
  2. Identity-Aware Proxy TCP forwarding
  3. A global external load balancer
  4. Private Google Access on the subnet Correct answer.

Explanation

Private Google Access lets instances that have only internal IP addresses reach Google APIs and services using internal routing. It is enabled per subnet and does not require NAT or external addresses.

Question 7Cloud Networking

Which DNS configuration allows a Compute Engine instance to resolve internal names of other instances in the same VPC?

  1. The VPC network's internal DNS with a metadata server resolver Correct answer.
  2. An external forwarding zone pointing to 8.8.8.8
  3. A public Cloud DNS zone for the project
  4. A BIND server installed on each instance

Explanation

Google Cloud provides an internal DNS resolver reachable at 169.254.169.254 that resolves internal names such as instance hostnames and internal DNS zones within the VPC. Public zones and external forwarders resolve only public names.

Question 8Cloud Networking

What does a VPC network peering connection require to allow traffic in both directions between two VPCs?

  1. Both VPCs must be in the same project
  2. The peering must be created on both sides Correct answer.
  3. A Cloud VPN tunnel must also be established
  4. The default route must be deleted on both sides

Explanation

VPC peering is a two-sided configuration: each network must create a peering to the other before routes are exchanged and traffic flows. The networks may be in different projects and organizations, and no VPN is required.

Question 9Cloud Networking

An application running on a private instance must reach a Cloud Storage bucket using its private IP address. Which configuration makes this possible?

  1. Assign an external IP address to the instance
  2. Enable Private Google Access on the instance's subnet Correct answer.
  3. Create a Cloud NAT gateway with the default settings
  4. Add a firewall rule allowing egress to 0.0.0.0/0

Explanation

Private Google Access allows instances with only internal IP addresses to reach Google APIs and services, including Cloud Storage, using Google's internal routing. Neither external addresses nor NAT is needed for this path.

Question 10Cloud Networking

A company wants to connect its on-premises network to a VPC with a dedicated, private connection that does not traverse the public internet. Which service should they choose?

  1. VPC peering
  2. Cloud NAT
  3. Cloud VPN with HA VPN gateways
  4. Cloud Interconnect Correct answer.

Explanation

Cloud Interconnect provides dedicated physical or partner-provided connectivity between on-premises networks and Google Cloud, avoiding the public internet. HA VPN uses encrypted tunnels over the internet, and peering and NAT operate within or between cloud networks.

Question 11Cloud Networking

Which load balancer type is appropriate for distributing non-HTTP TCP traffic across backends in a single region while preserving the client source IP address?

  1. Internal Application Load Balancer
  2. Cloud CDN
  3. Global external Application Load Balancer
  4. Regional external passthrough Network Load Balancer Correct answer.

Explanation

A regional external passthrough Network Load Balancer forwards TCP and UDP traffic without terminating the connection, which preserves the client source IP address. Application load balancers operate at layer 7 and terminate HTTP(S) connections.

Question 12Cloud Networking

An engineer needs to route traffic from a VPC to an on-premises network using BGP and wants automatic failover between two tunnels. Which setup satisfies this?

  1. HA VPN with two tunnels and a Cloud Router Correct answer.
  2. A single classic VPN tunnel with static routes
  3. A Cloud NAT gateway with two IP addresses
  4. VPC peering with custom routes

Explanation

HA VPN provides two tunnels in different availability domains, and Cloud Router exchanges routes dynamically over BGP so traffic can fail over between tunnels. Classic VPN with static routes lacks this dynamic redundancy.

Question 13Cloud Networking

What is the purpose of a Cloud Router in a VPC network?

  1. To assign external IP addresses to instances
  2. To cache content at edge locations
  3. To enforce firewall rules on egress traffic
  4. To exchange routes dynamically using BGP Correct answer.

Explanation

Cloud Router runs BGP sessions and dynamically exchanges routes between a VPC network and peers such as on-premises routers over VPN or Interconnect. It does not assign addresses, cache content, or enforce firewall rules.

Question 14Cloud Networking

A subnet has a secondary range configured. What is the primary use of a secondary range in Google Cloud?

  1. To extend the subnet's primary range into another region
  2. To assign external IP addresses to instances
  3. To provide additional addresses for alias IPs such as GKE pods Correct answer.
  4. To define the range used by Cloud NAT

Explanation

Secondary ranges provide additional CIDR blocks within a subnet that are used for alias IP ranges, commonly for GKE pods and services. They do not change the primary range or assign external addresses.

Question 15Cloud Networking

Which statement describes the scope of a VPC firewall rule's target?

  1. It applies to instances selected by network tags or service accounts in one VPC Correct answer.
  2. It applies only to instances in the same zone
  3. It applies to all projects in an organization
  4. It applies to all instances in every VPC of the project

Explanation

A firewall rule belongs to one VPC network and targets instances using network tags or service accounts, so it applies only to matching instances within that network. It is not organization-wide and is not limited to a single zone.

Question 16Cloud Networking

An application needs to accept traffic only from a specific partner VPC while denying all other sources. Which approach is most precise?

  1. Enable Cloud NAT for all subnets
  2. Allow the full RFC 1918 range on the firewall
  3. Disable the default route in the VPC
  4. Allow only the partner's specific source ranges on the firewall Correct answer.

Explanation

Firewall rules evaluate source ranges, so permitting only the partner's specific CIDR blocks restricts access precisely to that source. Broad private-range allowances admit many unintended sources, and route or NAT changes do not filter inbound sources.

Question 17Cloud Networking

What distinguishes an internal passthrough Network Load Balancer from an external one?

  1. It uses a private IP address reachable only within the VPC or connected networks Correct answer.
  2. It can distribute traffic only across regions
  3. It requires Cloud CDN to function
  4. It operates only at layer 7

Explanation

An internal passthrough Network Load Balancer is assigned a private IP address and serves clients inside the VPC or networks connected to it. External load balancers expose public addresses, and passthrough load balancers operate at layer 4 rather than layer 7.

Question 18Cloud Networking

A company wants private connectivity from its VPC to a third-party SaaS service without exposing traffic to the internet. Which feature is designed for this?

  1. VPC peering with the SaaS provider
  2. A global external load balancer
  3. Cloud NAT
  4. Private Service Connect Correct answer.

Explanation

Private Service Connect lets consumers reach published services through private endpoints inside their VPC, keeping traffic on Google's network. It supports third-party and Google-managed services without requiring public exposure.

Question 19Cloud Networking

Which Cloud DNS feature allows a private zone to be visible to more than one VPC network?

  1. A private zone with multiple authorized networks Correct answer.
  2. A public zone with split-horizon records
  3. DNSSEC signing
  4. DNS peering

Explanation

A private managed zone can list multiple VPC networks as authorized networks, making the same private records resolvable from each of them. DNS peering forwards queries between networks, while DNSSEC and public zones serve different purposes.

Question 20Cloud Networking

An engineer notices that instances in VPC A cannot reach instances in VPC B despite an active peering connection. What is the most likely cause?

  1. Cloud NAT is disabled in VPC A
  2. The firewall rules in the target VPC do not allow the source range Correct answer.
  3. The instances lack external IP addresses
  4. The default route was removed from VPC B

Explanation

Peering establishes routes, but traffic must still be permitted by firewall rules in the destination network. External addresses and NAT are not required for private VPC-to-VPC traffic, and removing the default route affects internet egress rather than peering routes.

Question 21Cloud Networking

Which configuration enables a global external Application Load Balancer to serve traffic over HTTPS?

  1. A Cloud NAT gateway with port 443 allowed
  2. An internal load balancer with a private certificate authority
  3. A regional static IP and a self-signed certificate on each backend
  4. A frontend with a reserved global static IP and a Google-managed certificate Correct answer.

Explanation

An HTTPS frontend on a global external Application Load Balancer uses a global static IP address and an SSL certificate, which can be Google-managed. Backends terminate or pass through traffic according to the chosen scheme, and NAT or internal load balancers do not provide a public HTTPS front end.

Question 22Cloud Networking

A company needs transitive routing so that VPC A can reach VPC C through VPC B. Which approach supports this requirement?

  1. Standard VPC peering between A-B and B-C
  2. Cloud NAT deployed in all three VPCs
  3. Private Google Access enabled on every subnet
  4. A hub-and-spoke topology using Network Connectivity Center or a shared VPC with routing appliances Correct answer.

Explanation

Standard VPC peering is non-transitive, so A cannot reach C through B using peering alone. A hub-and-spoke design with Network Connectivity Center or a shared VPC plus routing appliances provides the transit path needed for transitive reachability.

Question 23Cloud Networking

An organization wants to centrally enforce egress firewall rules across many projects while allowing project owners to add their own rules. Which mechanism should they use?

  1. Hierarchical firewall policies attached at the organization or folder level Correct answer.
  2. Cloud Armor policies on each load balancer
  3. Individual VPC firewall rules in each project
  4. VPC Service Controls perimeters

Explanation

Hierarchical firewall policies are applied at organization or folder nodes and are evaluated before VPC-level rules, letting central teams enforce baseline egress controls while projects add their own rules. They are designed for centralized governance across projects.

Question 24Cloud Networking

A workload must resolve on-premises DNS names from within a VPC while on-premises systems must resolve Cloud DNS private zone names. Which design achieves bidirectional resolution?

  1. A single public Cloud DNS zone shared by both environments
  2. DNSSEC signing on the private zone only
  3. A VPC peering connection without DNS configuration
  4. A Cloud DNS forwarding zone plus an on-premises conditional forwarder to the Cloud DNS inbound server Correct answer.

Explanation

Bidirectional resolution requires a Cloud DNS forwarding zone that sends on-premises queries to on-premises DNS servers, plus an inbound DNS server policy in the VPC so on-premises resolvers can query Cloud DNS. On-premises conditional forwarders direct queries to that inbound address.

Question 25Cloud Networking

A company uses Shared VPC and wants a service project's instances to use a Cloud NAT gateway owned by the host project. Which statement is accurate?

  1. Cloud NAT requires the instances to have external IP addresses
  2. Cloud NAT in the host project can provide egress for instances in attached service projects Correct answer.
  3. Cloud NAT cannot be used with Shared VPC at all
  4. Each service project must create its own Cloud NAT gateway

Explanation

In Shared VPC, the host project owns the network resources, and a Cloud NAT gateway created in the host project can translate traffic for instances in attached service projects. Service projects do not need their own gateways, and instances must not have external addresses for NAT to be used.

Question 26Cloud Networking

Which Google Cloud resource provides a regional, managed NAT service that lets instances without external IP addresses initiate outbound connections to the internet?

  1. Private Service Connect
  2. VPC firewall policy
  3. Cloud Router
  4. Cloud NAT Correct answer.

Explanation

Cloud NAT is a distributed, software-defined managed service that performs source NAT for outbound traffic from resources that have no external IP address. It is configured on a Cloud Router in a region and handles outbound flows only, so unsolicited inbound connections cannot be established through it.

Question 27Cloud Networking

What is the scope of a VPC network in Google Cloud?

  1. Multi-regional
  2. Global Correct answer.
  3. Zonal
  4. Regional

Explanation

A VPC network is a global resource whose subnets are regional, so a single VPC can span all regions and resources in different regions can communicate over the internal network. Firewall rules and routes are also global objects attached to the VPC.

Question 28Cloud Networking

Which type of IP address range does a subnet use to allocate addresses to the primary network interfaces of its instances?

  1. An alias IP range
  2. A bring-your-own IPv6 range
  3. A primary IPv4 range Correct answer.
  4. A secondary IPv4 range

Explanation

Each subnet has one primary IPv4 range from which primary internal IP addresses are assigned to VM network interfaces. Secondary ranges are optional and are used for alias IP addresses, such as those needed by containers.

Question 29Cloud Networking

Which Google Cloud load balancer distributes HTTP(S) traffic across backends in multiple regions from a single global anycast IP address?

  1. Regional internal Application Load Balancer
  2. Global external Application Load Balancer Correct answer.
  3. Internal passthrough Network Load Balancer
  4. Regional external Application Load Balancer

Explanation

The global external Application Load Balancer uses a single global anycast virtual IP address and routes requests to backends in multiple regions based on proximity and capacity. Regional variants keep the frontend confined to one region.

Question 30Cloud Networking

What does a VPC firewall rule's priority value determine?

  1. The number of instances the rule can target
  2. The geographic region where the rule is enforced
  3. The order in which the rule is evaluated relative to other rules Correct answer.
  4. The maximum bandwidth allowed for matching traffic

Explanation

Firewall rules are evaluated in order of priority, where a lower number means higher precedence, and the first matching rule decides whether traffic is allowed or denied. Once a rule matches, evaluation stops and lower-priority rules have no effect on that flow.

Question 31Cloud Networking

Which Cloud DNS zone type is used to host records that are resolvable only from within the VPC networks it is authorized for?

  1. A forwarding zone
  2. A private zone Correct answer.
  3. A public zone
  4. A peering zone

Explanation

A private managed zone holds records that are served only to queries originating from the VPC networks listed in its authorized networks. Public zones, by contrast, are visible to any resolver on the internet.

Question 32Cloud Networking

Which Google Cloud construct lets you define a set of subnets and policies once and share them with many projects in an organization?

  1. VPC Network Peering
  2. Private Service Connect
  3. Cloud VPN
  4. Shared VPC Correct answer.

Explanation

Shared VPC designates a host project that owns the VPC network and its subnets, and attaches service projects whose resources use those subnets. This centralizes network administration while letting service project teams deploy workloads.

Question 33Cloud Networking

Which route type does a VPC network use to deliver traffic to the internet for instances that have an external IP address?

  1. A dynamic route learned over BGP
  2. A default route whose next hop is the default internet gateway Correct answer.
  3. A policy-based route
  4. A static route whose next hop is a Cloud Router

Explanation

A VPC network includes a default route to the internet gateway, and instances with an external IP can use it for outbound traffic. Without an external IP, traffic can still reach the internet only through a NAT service such as Cloud NAT.

Question 34Cloud Networking

An engineer wants to send all traffic from a VPC to a specific destination prefix through an on-premises appliance rather than the default internet gateway. Which mechanism should be used?

  1. A DNS forwarding policy
  2. A static route with a custom next hop Correct answer.
  3. A Cloud NAT gateway
  4. A firewall egress rule

Explanation

A static route maps a destination prefix to a next hop such as an instance or VPN tunnel, so traffic matching that prefix follows the chosen path. Firewall rules only permit or deny traffic and cannot change where packets are routed.

Question 35Cloud Networking

Which configuration allows a VM in one region to reach a service in another region over internal IP addresses within the same VPC?

  1. VPC Network Peering between two separate VPC networks
  2. A Cloud VPN tunnel between the two regions
  3. Subnets in both regions attached to the same VPC network Correct answer.
  4. A Cloud NAT gateway in each region

Explanation

Because a VPC network is global, subnets in different regions are part of the same routing domain and internal IP traffic flows between them automatically. No tunnel, peering, or NAT is needed for intra-VPC cross-region communication.

Question 36Cloud Networking

A team needs to allow inbound SSH only from a management subnet's range to instances that carry a specific label-like identity. Which firewall target should they use?

  1. A target service account assigned to the instances Correct answer.
  2. The default target tag applied to every instance
  3. The VPC network name
  4. The region of the subnet

Explanation

Firewall rules can target instances by service account, which applies the rule to all instances running as that account regardless of tags. This is more robust than tags because the identity follows the workload.

Question 37Cloud Networking

Which statement describes how VPC Network Peering handles route exchange between two peered networks?

  1. All routes, including custom static and dynamic routes, are exchanged automatically
  2. Only routes explicitly exported by BGP are exchanged
  3. No routes are exchanged; peering only permits DNS queries
  4. Subnet routes are exchanged automatically, but custom routes are not imported by default Correct answer.

Explanation

Peering automatically exchanges subnet routes so resources can reach each other's subnets, but custom routes such as static routes and routes learned over VPN or Interconnect are not imported by default. Separate options control the import and export of custom routes.

Question 38Cloud Networking

A company needs to connect many VPC networks to a single on-premises network and wants a topology that avoids a full mesh of peerings. Which approach is most appropriate?

  1. A separate Cloud VPN tunnel between every pair of VPCs
  2. A full mesh of VPC Network Peering connections
  3. A hub-and-spoke design using Network Connectivity Center Correct answer.
  4. Cloud NAT in each VPC network

Explanation

Network Connectivity Center lets you attach VPC spokes and hybrid spokes to a central hub, so spokes can reach each other and on-premises through the hub without pairwise peering. This scales better than a full mesh, which grows quadratically with the number of networks.

Question 39Cloud Networking

Which feature lets an instance in a VPC reach a Google API such as Cloud Storage using an internal endpoint without an external IP address?

  1. Private Google Access Correct answer.
  2. Cloud NAT
  3. An external passthrough Network Load Balancer
  4. A public DNS zone

Explanation

Private Google Access allows instances that have only internal IP addresses to reach the internal endpoints of Google APIs and services. Traffic stays on Google's network and does not require an external IP or a NAT gateway.

Question 40Cloud Networking

An engineer needs to make a private Cloud DNS zone resolvable from a second VPC network without duplicating the records. Which configuration achieves this?

  1. Convert the zone to a public zone
  2. Add the second network to the zone's authorized networks Correct answer.
  3. Add a forwarding zone in the second network
  4. Create a duplicate private zone in the second network

Explanation

A private zone can list multiple authorized VPC networks, so adding the second network makes the same records resolvable there without copying them. Duplicating the zone risks drift between record sets.

Question 41Cloud Networking

A company wants to give a partner access to one specific service in its VPC without exposing the whole network or using peering. Which approach fits best?

  1. Publish the service through Private Service Connect Correct answer.
  2. Share the VPC using Shared VPC
  3. Create a VPC Network Peering connection with the partner
  4. Attach the partner to a Cloud VPN tunnel

Explanation

Private Service Connect lets a producer publish a service behind a private endpoint that consumers reach from their own VPC, exposing only that service. Peering and Shared VPC expose broader network reachability than a single service requires.

Question 42Cloud Networking

Which Cloud Router capability is required for a dynamic route to be programmed into a VPC when using a Partner Interconnect VLAN attachment?

  1. A BGP session between the Cloud Router and the peer router Correct answer.
  2. A firewall rule allowing BGP traffic
  3. A static route configured on the VLAN attachment
  4. A Cloud NAT gateway on the same router

Explanation

Cloud Router learns and advertises routes over BGP sessions established with the on-premises or partner router across the VLAN attachment. Without an established BGP session, no dynamic routes are exchanged.

Question 43Cloud Networking

An organization wants to apply hierarchical firewall policies so that rules at the organization level take precedence over project-level rules. Which feature should be used?

  1. VPC firewall rules with high priority numbers
  2. Network tags applied at the folder level
  3. Hierarchical firewall policies Correct answer.
  4. Cloud Armor security policies

Explanation

Hierarchical firewall policies are attached at the organization or folder level and are evaluated before VPC firewall rules, giving central teams enforcement power. Lower-level policies and VPC rules can only add restrictions or allowances below that precedence.

Question 44Cloud Networking

A team wants to route traffic from a VPC to a peered VPC's on-premises network through a VPN attached to the peered VPC. Which statement is accurate?

  1. Peering does not provide transitive routing, so a hub design is needed Correct answer.
  2. Peering supports transitive routing only for IPv6 traffic
  3. Peering supports transitive routing when custom route import is enabled
  4. Peering automatically imports VPN routes from the peered network

Explanation

VPC Network Peering is non-transitive: a network can reach only the subnets and imported routes of its direct peer, not networks beyond it. To reach a peer's on-premises network, traffic must terminate in a hub that owns the hybrid connection or use a connectivity hub such as Network Connectivity Center.

Question 45Cloud Networking

An engineer must ensure that traffic from a subnet to a specific external CIDR is denied even if a broader allow rule exists, without affecting other traffic. Which configuration accomplishes this?

  1. An egress deny rule with a lower priority number than the allow rule Correct answer.
  2. A route that blackholes the external CIDR
  3. An ingress deny rule matching the external CIDR
  4. A Cloud NAT rule excluding the CIDR

Explanation

Firewall rules are evaluated by priority, and the first match wins, so an egress deny rule with a numerically lower priority than the broader allow rule takes precedence for that destination. Ingress rules do not affect outbound flows, and routes cannot selectively deny a destination while preserving other traffic.

Question 46Cloud Networking

A company needs DNS resolution so that on-premises clients can resolve names in a Cloud DNS private zone. Which configuration is required?

  1. A forwarding zone pointing to the on-premises DNS servers
  2. A peering zone in the on-premises network
  3. A DNS server policy with inbound forwarding enabled on the VPC Correct answer.
  4. A public zone containing the same records

Explanation

Inbound DNS forwarding configures Cloud DNS to accept queries from on-premises resolvers over an interconnect or VPN and answer them from private zones. A forwarding zone handles the opposite direction, sending VPC queries to on-premises servers.

Question 47Cloud Networking

Which load balancing choice provides a single internal anycast IP address for TCP traffic across backends in multiple regions while preserving client source IP addresses?

  1. Cross-region internal passthrough Network Load Balancer Correct answer.
  2. Regional external passthrough Network Load Balancer
  3. Global external Application Load Balancer
  4. Regional internal Application Load Balancer

Explanation

The cross-region internal passthrough Network Load Balancer offers a global internal anycast virtual IP for TCP or UDP backends in multiple regions and preserves client source addresses. Application load balancers terminate connections and do not preserve the source IP in the same way.

Question 48Cloud Networking

A service project's instances must use a Cloud NAT gateway that lives in the Shared VPC host project. Which statement describes the required setup?

  1. The NAT gateway must be recreated in every service project's region
  2. The NAT gateway is created in the host project on a Cloud Router in the shared network, and service project instances use it automatically Correct answer.
  3. Each service project must create its own Cloud NAT gateway in its own VPC
  4. The service project must peer with the host project to use the NAT gateway

Explanation

In Shared VPC the host project owns the VPC network, subnets, and Cloud Router, so Cloud NAT is configured there and applies to all instances using those subnets, including service project instances. Service projects do not own the network resources and cannot create NAT for the shared network themselves.

Question 49Cloud Networking

Which statement correctly describes how a global external Application Load Balancer selects a backend region for an incoming request?

  1. It uses proximity and backend capacity to choose among healthy backends in multiple regions Correct answer.
  2. It always sends traffic to the region closest to the client's billing address
  3. It routes only to backends in the region where the forwarding rule was created
  4. It requires a separate IP address for each backend region

Explanation

The global external Application Load Balancer terminates the connection at the anycast frontend and then chooses a backend based on factors such as proximity and available capacity. Backends in multiple regions can serve the same global IP address.

Question 50Cloud Networking

Which Google Cloud service provides a managed, private connection to Google APIs and services from an on-premises network without using the public internet?

  1. Cloud DNS private zones
  2. Cloud NAT
  3. VPC Network Peering
  4. Private Service Connect for Google APIs Correct answer.

Explanation

Private Service Connect for Google APIs lets you create private endpoints to Google APIs that are reachable from on-premises over Interconnect or VPN. Traffic stays on Google's network and does not traverse the public internet.