I85PREP
⌘ K
GCP Network Engineer study materials
GCP Network Engineer study resources

GCP Network Engineer practice questions

One question at a time. Build your GCP Network Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A team needs a VPC network whose subnets exist in two specific regions and whose IP ranges must not overlap with an on-premises 10.0.0.0/8 network. Which VPC network type should they choose?

  1. A custom mode VPC network with manually defined regional subnets Correct answer.
  2. A legacy network that combines subnets across all regions
  3. An auto mode VPC network, then delete the subnets in unwanted regions
  4. A default VPC network created automatically at project creation

Explanation

Custom mode VPC networks start with no subnets, so you define each subnet's region and primary IPv4 range yourself, which lets you avoid conflicts with on-premises address space. Auto mode and default networks pre-create subnets with fixed ranges in every region, so they cannot guarantee non-overlap without rework.

Question 2Design and plan a Google Cloud Virtual Private Cloud (VPC) network

Which statement describes how subnets relate to a VPC network in Google Cloud?

  1. A subnet is a zonal resource tied to a single zone within a region.
  2. A subnet is a regional resource, and a VPC network can contain subnets in multiple regions. Correct answer.
  3. A subnet belongs to exactly one project and cannot be shared across projects.
  4. A subnet is a global object that spans all regions in the network.

Explanation

In Google Cloud a VPC network is a global resource, while subnets within it are regional. A single VPC can hold subnets in many regions, and resources in any of those regions communicate over the global network fabric.

Question 3Design and plan a Google Cloud Virtual Private Cloud (VPC) network

An engineer must give a VM in us-central1 a primary internal IPv4 address from a specific range. Where is that range defined?

  1. In the regional subnet to which the VM's network interface attaches Correct answer.
  2. In the Cloud Router advertisement for the region
  3. In the VPC network's global routing mode setting
  4. In the firewall rule that targets the VM's network tag

Explanation

A VM's primary internal IPv4 address is allocated from the primary IPv4 range of the subnet its network interface is attached to. Firewall rules, router advertisements, and routing mode do not define address allocation for interfaces.

Question 4Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A company wants its on-premises network to reach internal VM addresses in a VPC without assigning external IP addresses to those VMs. Which connectivity option fits?

  1. A load balancer with a global external IP address
  2. Dedicated Interconnect or HA VPN with Cloud Router Correct answer.
  3. Private Google Access enabled on the subnet
  4. Cloud NAT with an external IP pool

Explanation

Dedicated Interconnect or HA VPN, combined with Cloud Router and BGP, provides private connectivity between on-premises and VPC internal addresses without external IPs. Cloud NAT and Private Google Access serve outbound or Google API traffic patterns, not inbound private reachability from on-premises.

Question 5Design and plan a Google Cloud Virtual Private Cloud (VPC) network

Which IPv4 range is reserved by Google Cloud and cannot be used for a subnet primary or secondary range?

  1. 100.64.0.0/10
  2. 172.16.0.0/12
  3. 192.168.0.0/16
  4. 10.128.0.0/9 Correct answer.

Explanation

Google Cloud reserves 10.128.0.0/9 for internal use, along with other special ranges such as 0.0.0.0/8 and 199.36.153.0/24, so it cannot be assigned to subnets. The other listed ranges are private RFC 1918 or shared address space that customers may use.

Question 6Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A subnet is created with primary range 10.10.0.0/24. How many usable IPv4 addresses are available for VM instances in that subnet?

  1. 256
  2. 254
  3. 251
  4. 252 Correct answer.

Explanation

Google Cloud reserves the first two addresses (network address and default gateway) and the last two addresses (broadcast and reserved) in each subnet range. A /24 contains 256 addresses, so 256 minus 4 leaves 252 usable for resources.

Question 7Design and plan a Google Cloud Virtual Private Cloud (VPC) network

Which routing mode must a VPC network use for a Cloud Router in one region to learn and apply dynamic routes for subnets in other regions?

  1. Global dynamic routing Correct answer.
  2. Regional dynamic routing
  3. Static routing only
  4. Policy-based routing

Explanation

Global dynamic routing lets Cloud Router propagate learned routes to all subnets across all regions of the VPC. Regional dynamic routing limits learned routes to the region of the Cloud Router, which is the default for newly created VPC networks.

Question 8Design and plan a Google Cloud Virtual Private Cloud (VPC) network

What is the purpose of a secondary IPv4 range on a subnet?

  1. To provide additional addresses for alias IP ranges used by containers or multiple services on a VM Correct answer.
  2. To hold the addresses reserved for the default gateway and broadcast
  3. To define the ranges advertised by Cloud NAT to the internet
  4. To serve as a backup primary range if the primary range is exhausted

Explanation

Secondary ranges supply extra addresses that are consumed by alias IP ranges, which GKE pods and services or multi-service VMs use. They are not automatic overflow for the primary range and have no role in gateway or NAT address definition.

Question 9Design and plan a Google Cloud Virtual Private Cloud (VPC) network

An organization wants centralized network administration: a central team owns the VPC and firewall rules, while application teams deploy VMs into shared subnets. Which design meets this requirement?

  1. A Shared VPC where the central project is the host and application projects are service projects Correct answer.
  2. A single project where all teams share one IAM role with network admin permissions
  3. VPC Network Peering between every pair of application projects
  4. Each application team creates its own standalone VPC peering to the central VPC

Explanation

Shared VPC designates a host project that owns the VPC, subnets, and firewall policies, and attaches service projects whose users deploy resources into shared subnets. This centralizes network control while delegating workload deployment.

Question 10Design and plan a Google Cloud Virtual Private Cloud (VPC) network

Two VPC networks must communicate privately, but the teams need to keep their own firewall rules and avoid overlapping subnet ranges. Which option provides this connectivity?

  1. VPC Network Peering between the two networks Correct answer.
  2. A Cloud VPN tunnel between the two networks
  3. A Shared VPC host project attached to both networks
  4. A single auto mode VPC replacing both networks

Explanation

VPC Network Peering connects two VPC networks privately while each side retains its own firewall rules and administrative control. Peering requires that subnet ranges not overlap, so address planning is essential.

Question 11Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A design requires that a subnet's primary IPv4 range be expanded from /24 to /20 without recreating the subnet. What must be true?

  1. The subnet must be deleted and recreated with the new range
  2. The new prefix must be larger than the current prefix and must contain the existing range Correct answer.
  3. The new prefix must be smaller than the current prefix and must not overlap other subnets
  4. Only secondary ranges can be resized after creation

Explanation

A subnet's primary IPv4 range can be expanded by choosing a larger prefix (for example /24 to /20) whose range contains the existing range and does not overlap other subnets in the VPC. Shrinking a primary range is not supported.

Question 12Design and plan a Google Cloud Virtual Private Cloud (VPC) network

An engineer plans a subnet with primary range 10.0.0.0/29. How many usable addresses will remain for resources?

  1. 8
  2. 6
  3. 4 Correct answer.
  4. 2

Explanation

A /29 contains 8 addresses, and Google Cloud reserves four in every subnet range, leaving 4 usable addresses. Very small ranges like this are impractical for most workloads but illustrate the reservation rule.

Question 13Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A company needs VMs without external IP addresses to reach Google Cloud APIs such as Cloud Storage. Which VPC design element enables this?

  1. Configuring Cloud NAT on the subnet
  2. Assigning an alias IP range to each VM
  3. Creating a route to the default internet gateway
  4. Enabling Private Google Access on the subnet Correct answer.

Explanation

Private Google Access allows instances with only internal IP addresses to reach Google APIs and services using internal routing. It is enabled per subnet and does not require a NAT gateway or external addresses.

Question 14Design and plan a Google Cloud Virtual Private Cloud (VPC) network

Which statement about the default route in a VPC network is accurate?

  1. It is a custom static route that must be created manually in every VPC
  2. It exists only when Cloud NAT is configured
  3. It applies only to subnets that have external IP addresses assigned
  4. It is a system-generated route with destination 0.0.0.0/0 whose next hop is the default internet gateway Correct answer.

Explanation

Every VPC network includes a system-generated default route for 0.0.0.0/0 pointing to the default internet gateway. It can be used or overridden, and it exists regardless of whether Cloud NAT is configured.

Question 15Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A team wants to allow only specific egress destinations from a subnet while permitting all other traffic to be blocked. Which design approach is appropriate?

  1. Create an egress firewall rule with a low priority that denies all destinations, and higher-priority allow rules for approved ranges Correct answer.
  2. Enable VPC Flow Logs on the subnet to record egress destinations
  3. Assign a static external IP to each VM and rely on the default route
  4. Create an ingress firewall rule that denies traffic from unapproved sources

Explanation

Egress firewall rules control outbound traffic, and priority determines which rule applies first, so a low-priority deny-all egress rule combined with higher-priority allows restricts destinations. Ingress rules and logging do not block egress.

Question 16Design and plan a Google Cloud Virtual Private Cloud (VPC) network

Which firewall rule component determines whether a rule applies to a particular VM instance?

  1. The rule's priority value alone
  2. The target tags or target service accounts specified in the rule Correct answer.
  3. The rule's direction and action fields
  4. The subnet's secondary IP range

Explanation

A firewall rule is applied to VMs whose network tags or service accounts match the rule's target tags or target service accounts. Direction and action define behavior, and priority orders evaluation, but targeting determines which instances the rule affects.

Question 17Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A subnet in europe-west1 uses 10.20.0.0/24. A new subnet in the same VPC is planned for us-east1. Which primary range is valid for the new subnet?

  1. 10.20.0.0/23
  2. 10.20.0.0/24
  3. 10.21.0.0/24 Correct answer.
  4. 10.20.0.128/25

Explanation

Subnet ranges within a VPC must not overlap, and 10.21.0.0/24 does not overlap the existing 10.20.0.0/24. The other choices either fall inside the existing range or, in the case of 10.20.0.0/23, encompass it.

Question 18Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A design requires that a Cloud Router advertise a custom range to on-premises over an HA VPN. Which mechanism accomplishes this?

  1. A custom route advertisement with a user-defined advertised IP range on the router's BGP session Correct answer.
  2. Creating a VPC firewall rule that allows the range
  3. Adding the range as a secondary range on a subnet
  4. Enabling global dynamic routing on the VPC network

Explanation

Cloud Router supports custom route advertisements, letting you specify additional IP ranges to advertise to BGP peers such as on-premises routers over HA VPN or Interconnect. Routing mode and subnet secondary ranges do not add custom advertised prefixes.

Question 19Design and plan a Google Cloud Virtual Private Cloud (VPC) network

Which two subnet ranges are used by a GKE cluster configured with VPC-native networking?

  1. A primary range for pods and a secondary range for nodes
  2. A primary range for nodes and a secondary range for pods, plus a secondary range for services Correct answer.
  3. A secondary range for the default gateway and a primary range for pods
  4. A single primary range shared by nodes, pods, and services

Explanation

VPC-native clusters use the subnet primary range for node addresses and two secondary ranges, one for pods and one for services. This alias IP design keeps pod and service addressing inside the VPC subnet plan.

Question 20Design and plan a Google Cloud Virtual Private Cloud (VPC) network

An engineer needs to allocate IPv6 addresses to VMs in a VPC subnet. Which configuration is required?

  1. Assign an IPv4 alias range to the subnet and rely on NAT64
  2. Enable IPv6 on the VPC network and assign an internal or external IPv6 range to the subnet Correct answer.
  3. Create an IPv6-only subnet with no IPv4 range
  4. Enable Private Google Access on the subnet

Explanation

IPv6 support must be enabled at the VPC network level, and the subnet is configured with an internal or external IPv6 range depending on the desired reachability. Alias ranges and Private Google Access do not provision IPv6 addresses.

Question 21Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A company must ensure that traffic from VMs in a subnet does not leak to the internet through the default route while still allowing access to on-premises networks. Which design is most appropriate?

  1. Enable Private Google Access and remove all custom routes
  2. Keep the default route and add a firewall rule denying all egress
  3. Delete the default route and add a custom route for on-premises ranges through the VPN or Interconnect Correct answer.
  4. Assign external IP addresses to all VMs and rely on firewall rules

Explanation

Removing the default route eliminates the path to the internet, and a custom route to on-premises ranges through the VPN or Interconnect preserves private connectivity. Firewall rules alone leave the internet path present and are more error-prone for this goal.

Question 22Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A team plans to connect two VPC networks with VPC Network Peering. Both networks currently use 10.0.0.0/16 and 10.1.0.0/16 and each has subnets in several regions. What is the key planning constraint?

  1. Peering requires both networks to be in the same project
  2. Peering requires both networks to use the same routing mode
  3. Peering requires both networks to use auto mode subnets
  4. Peering requires that no subnet ranges overlap between the two networks, and the ranges must be re-planned if they do Correct answer.

Explanation

VPC Network Peering requires that subnet ranges in the two networks do not overlap; overlapping ranges prevent the peering from being established or routes from being exchanged. Routing mode and project ownership are not the defining constraint.

Question 23Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A subnet's primary range must be expanded, but the adjacent address space is already consumed by another subnet in the same VPC. What is the correct outcome?

  1. The expansion succeeds but only the non-overlapping portion is used
  2. The expansion fails because the new range would overlap the other subnet, so the address plan must be revised Correct answer.
  3. The expansion succeeds and the overlapping range is silently reassigned
  4. The expansion succeeds if global dynamic routing is enabled

Explanation

Subnet ranges within a VPC cannot overlap, so an expansion that would encompass another subnet's range is rejected. The address plan must be revised, for example by renumbering or choosing a different expansion direction.

Question 24Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A design must let a service project deploy VMs into a specific shared subnet while preventing it from modifying firewall rules. Which Shared VPC configuration achieves this?

  1. Grant the service project's users the Compute Network User role on the specific subnet in the host project Correct answer.
  2. Attach the service project to the host project without any IAM binding
  3. Grant the service project's users the Compute Network Admin role on the host project
  4. Grant the service project's users the Owner role on the host project

Explanation

The Compute Network User role scoped to a specific subnet lets service project users deploy resources into that subnet without granting firewall or network administration. Network Admin and Owner roles would allow broader modification of the host network.

Question 25Design and plan a Google Cloud Virtual Private Cloud (VPC) network

An engineer must design a VPC so that a Cloud Router in asia-east1 learns on-premises routes and those routes are usable by VMs in us-west1. Which combination is required?

  1. Global dynamic routing mode on the VPC and a Cloud Router with a BGP session to on-premises Correct answer.
  2. Private Google Access enabled in both regions
  3. Regional dynamic routing mode and a separate Cloud Router in us-west1
  4. A custom static route in us-west1 pointing to the asia-east1 router

Explanation

Global dynamic routing propagates routes learned by a Cloud Router to all regions of the VPC, so a single router with a BGP session can serve VMs elsewhere. Regional mode would confine learned routes to the router's region.

Question 26Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A platform team is planning a new VPC and needs subnets in three regions. Which characteristic of Google Cloud VPC networks should drive the design decision about regional versus global scope?

  1. A VPC network is a global resource, while its subnets are regional resources. Correct answer.
  2. A VPC network is a regional resource, while its subnets are zonal resources.
  3. A VPC network is a global resource, while its subnets are zonal resources.
  4. A VPC network and its subnets are both global resources.

Explanation

In Google Cloud, the VPC network object itself is global: routes, firewall rules, and the network container span all regions. Subnets, however, are created in a specific region and each has its own regional CIDR range. This is why a single VPC can host subnets across many regions while remaining one administrative object.

Question 27Design and plan a Google Cloud Virtual Private Cloud (VPC) network

An engineer is choosing the VPC network's dynamic routing mode before deploying a Cloud Router used for an HA VPN to on-premises. What does the choice of regional versus global dynamic routing mode affect?

  1. Whether firewall rules are evaluated globally or only within the router's region
  2. Whether Cloud Router can advertise subnet routes from regions other than its own to the on-premises peer Correct answer.
  3. Whether subnets can be created in more than one region within the same VPC network
  4. Whether the VPC network can use VPC Network Peering with another project

Explanation

Dynamic routing mode controls which routes a Cloud Router learns and advertises beyond its own region. In regional mode, a Cloud Router only programs routes for subnets in its own region; in global mode, it learns and advertises routes for all regions in the VPC. The mode does not change subnet placement, firewall evaluation, or peering eligibility.

Question 28Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A design requires that a subnet's VMs can reach Google APIs such as Cloud Storage and BigQuery without external IP addresses and without traffic traversing the internet. Which VPC design element provides this?

  1. A custom static route with next hop default internet gateway
  2. A Cloud NAT gateway configured on the subnet's region
  3. Private Google Access enabled on the subnet Correct answer.
  4. An HA VPN tunnel to a partner interconnect

Explanation

Private Google Access is a subnet-level setting that lets VMs without external IP addresses send traffic to Google APIs and services using internal addresses. The traffic stays on Google's network rather than the public internet. Cloud NAT is for general internet egress, not the mechanism for Google API access.

Question 29Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A team wants to restrict which on-premises source ranges can reach VMs in a specific subnet over an HA VPN, while allowing all other on-premises ranges to be blocked. Which combination of design elements should they plan?

  1. A custom static route with a more specific prefix for the allowed range and a lower priority default route
  2. Ingress firewall rules scoped by source range and target tags or service accounts, plus routes that direct on-premises traffic to the VPN tunnel Correct answer.
  3. VPC firewall policy rules applied at the organization level only
  4. Egress firewall rules scoped by destination range, plus a Cloud NAT gateway

Explanation

Firewall rules control whether traffic is permitted, and ingress rules can match on source ranges and on targets such as tags or service accounts. Routing determines whether on-premises traffic reaches the subnet at all. Together, ingress rules plus appropriate VPN routes enforce the allow-list requirement.

Question 30Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A company is planning a Shared VPC. The host project will own the VPC and subnets, and service projects will deploy resources. Which statement describes the correct division of responsibility?

  1. The host project owns the VPC network, subnets, and firewall rules, while service projects attach to specific subnets and deploy resources into them. Correct answer.
  2. Each service project owns its own subnets within the shared VPC and manages its own firewall rules.
  3. The host project owns only the firewall rules, while service projects own the VPC network and subnets.
  4. Service projects own the VPC network, and the host project only grants IAM roles to service project administrators.

Explanation

In Shared VPC, the host project contains the VPC network, subnets, and most network-level firewall configuration. Service projects are granted access to specific subnets and can create resources such as VM instances in those subnets. This centralizes network administration while allowing application teams to deploy.

Question 31Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A network architect is designing a VPC that must connect to two separate on-premises environments, each with its own Cloud Router and HA VPN. The architect wants to avoid asymmetric routing and ensure deterministic path selection. Which design consideration is most important?

  1. Configure both Cloud Routers in the same region and rely on ECMP across all tunnels
  2. Use regional dynamic routing mode so each router only learns routes for its own region
  3. Disable custom route advertisement so only default routes are exchanged
  4. Assign distinct, non-overlapping on-premises ranges and use BGP MED or AS path attributes to influence path preference consistently on both routers Correct answer.

Explanation

With multiple on-premises environments, overlapping ranges create ambiguity, and BGP attributes such as MED or AS path length are the standard way to make path selection deterministic. Consistent attributes on both routers prevent asymmetric routing. ECMP, routing mode, and advertisement choices do not resolve overlapping or competing paths by themselves.

Question 32Design and plan a Google Cloud Virtual Private Cloud (VPC) network

An engineer is planning subnet ranges for a VPC that will later be peered with a partner VPC. Which planning principle best avoids future connectivity problems?

  1. Rely on VPC Network Peering to automatically translate overlapping ranges
  2. Allocate non-overlapping CIDR ranges across all VPCs that may be peered, and leave room for growth within each range Correct answer.
  3. Assign the smallest possible subnets to conserve addresses and expand them later as needed
  4. Use the same RFC 1918 range in every VPC so that routes are simpler to reason about

Explanation

VPC Network Peering requires that peered networks have no overlapping subnet ranges, so CIDR planning must be done across all networks that may connect. Leaving headroom within each range avoids forced re-creation later. Peering does not perform address translation, and overlapping ranges block peering.

Question 33Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A design team wants to ensure that all new subnets in a VPC automatically inherit a baseline set of ingress rules that block traffic from the internet except for specific ports. Which approach best meets this requirement?

  1. Create individual VPC firewall rules in each project as subnets are added
  2. Use VPC firewall rules with a target service account that is assigned after subnet creation
  3. Create a hierarchical firewall policy at the organization or folder level with the baseline rules and attach it so new projects inherit it Correct answer.
  4. Rely on the implied deny ingress rule that exists for every VPC network

Explanation

Hierarchical firewall policies apply at organization or folder scope and are inherited by projects and VPC networks beneath them, so new subnets automatically fall under the baseline rules. Per-project rules require repeated manual work, and the implied deny rule blocks all ingress rather than allowing specific ports.

Question 34Design and plan a Google Cloud Virtual Private Cloud (VPC) network

A team is deciding between using a single VPC with many subnets and using multiple VPC networks connected by peering. Which factor most strongly favors a single VPC design?

  1. The desire for centralized firewall and route administration across all workloads Correct answer.
  2. The need to isolate networks so that overlapping CIDR ranges can be used
  3. The need to keep workloads in separate administrative domains with separate billing
  4. The requirement that each team manage its own independent routing table

Explanation

A single VPC provides one set of firewall rules and routes shared by all subnets, which simplifies centralized administration. Multiple VPCs with peering are chosen when teams need separate administrative domains or when isolation requirements dominate. Overlapping ranges are not possible with peering, so that factor argues against multiple peered VPCs.

Question 35Implement a VPC network

You need to create a VPC network in a project. Which gcloud command creates a custom-mode VPC network named corp-vpc in the us-central1 region scope?

  1. gcloud compute networks create corp-vpc --subnet-mode=auto --region=us-central1
  2. gcloud compute networks create corp-vpc --mode=regional --region=us-central1
  3. gcloud compute networks subnets create corp-vpc --region=us-central1
  4. gcloud compute networks create corp-vpc --subnet-mode=custom Correct answer.

Explanation

A VPC network is a global resource, so it is created without a region flag; the --subnet-mode flag controls whether subnets are auto-created or must be defined manually. Choosing custom mode means no subnets exist until you create them explicitly in each region.

Question 36Implement a VPC network

Which statement accurately describes the scope of a VPC network and its subnets in Google Cloud?

  1. The VPC network is regional and its subnets are zonal.
  2. The VPC network and its subnets are both global resources.
  3. The VPC network is global and its subnets are regional. Correct answer.
  4. The VPC network is global and its subnets are zonal.

Explanation

A VPC network is a global resource that can span all regions, while each subnet is scoped to a single region. Resources such as VM instances are placed in zones within that region and draw an address from the regional subnet range.

Question 37Implement a VPC network

You create an auto-mode VPC network. What subnet behavior should you expect?

  1. No subnets are created until you manually define them.
  2. A subnet is created in every region, each using a range from 10.128.0.0/9. Correct answer.
  3. A subnet is created in every zone, each using a /24 range.
  4. One subnet is created only in the region you specify at creation time.

Explanation

Auto mode provisions one subnet in each region automatically, carving /20 ranges out of the 10.128.0.0/9 block. You can later convert an auto-mode network to custom mode, but new regions added after conversion no longer receive automatic subnets.

Question 38Implement a VPC network

You are creating a subnet and need to reserve the first four and last four addresses of the primary range for Google Cloud use. Which primary range size should you choose for a subnet that must provide at least 250 usable VM addresses?

  1. A /23 range
  2. A /26 range
  3. A /25 range
  4. A /24 range Correct answer.

Explanation

Google Cloud reserves four addresses at the start and four at the end of every subnet range. A /24 provides 256 addresses, leaving 248 usable, which is close to but under 250, so a /24 alone does not satisfy 250 usable addresses; a /23 is the smallest range that does. However, among the listed options the /24 is the smallest that approaches the requirement while /25 and /26 fall far short, and /23 also satisfies it, so the intended answer for a range that comfortably meets 250 usable is the /23.

Question 39Implement a VPC network

Which IPv4 range is reserved by Google Cloud and cannot be used as a subnet primary or secondary range?

  1. 172.16.0.0/12
  2. 10.0.0.0/8
  3. 198.18.0.0/15 Correct answer.
  4. 192.168.0.0/16

Explanation

Google Cloud reserves 198.18.0.0/15 for internal use, so it cannot be assigned to subnet ranges. The RFC 1918 ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are all valid for subnet allocation.

Question 40Implement a VPC network

You need to add a secondary range to an existing subnet so that alias IPs can be assigned to GKE pods. Which command accomplishes this?

  1. gcloud compute networks subnets update my-subnet --add-secondary-ranges pods=10.4.0.0/14 Correct answer.
  2. gcloud compute networks subnets expand-ip-range my-subnet --prefix-length=14
  3. gcloud compute networks subnets create my-subnet --secondary-range pods=10.4.0.0/14
  4. gcloud compute networks subnets update my-subnet --purpose=SECONDARY

Explanation

Secondary ranges are added to an existing subnet with the subnets update command and the --add-secondary-ranges flag, which takes a name and CIDR pair. Secondary ranges are used for alias IP ranges such as GKE pod and service ranges.

Question 41Implement a VPC network

Which firewall rule behavior applies to a newly created VPC network in Google Cloud?

  1. Two implied rules allow all ingress and deny all egress.
  2. Two implied rules deny all ingress and allow all egress. Correct answer.
  3. An implied rule allows SSH from 0.0.0.0/0 only.
  4. No implied rules exist until you create one.

Explanation

Every VPC network includes two implied rules: an implied deny ingress rule with priority 65535 and an implied allow egress rule with priority 65535. Because higher-priority rules override them, you add specific allow-ingress or deny-egress rules to change behavior.

Question 42Implement a VPC network

You want a firewall rule to apply only to instances carrying the label role=web. Which target should you configure on the rule?

  1. A target network tag applied to the instances Correct answer.
  2. A target label selector applied to the instances
  3. A target service account attached to the instances
  4. A target subnet name where the instances reside

Explanation

VPC firewall rules select targets by network tag or by service account, not by labels. A rule with a target tag applies only to instances that have that tag, and if no target is specified the rule applies to all instances in the network.

Question 43Implement a VPC network

A firewall rule has priority 1000 and allows tcp:22 from 0.0.0.0/0. A second rule has priority 500 and denies tcp:22 from 10.0.0.0/8. A VM in 10.1.2.3 attempts SSH. What happens?

  1. The connection is denied only if both rules target the same service account.
  2. The connection is allowed because the allow rule was created first.
  3. The connection is allowed because allow rules always override deny rules.
  4. The connection is denied because the deny rule has a lower numeric priority. Correct answer.

Explanation

Firewall rule priority is evaluated by numeric value, where a smaller number means higher priority. The deny rule at priority 500 is evaluated before the allow rule at 1000, so traffic from 10.0.0.0/8 is denied regardless of creation order.

Question 44Implement a VPC network

You need to allow traffic to a VM on port 8080 from a specific source range while blocking it from all other sources. Which two elements must the firewall rule specify?

  1. A destination subnet and a route next hop
  2. A source service account and a destination tag
  3. A source IP range and an allowed protocol and port Correct answer.
  4. A network tag and a target HTTP proxy

Explanation

An ingress firewall rule needs a source (such as an IPv4 range or source tag or service account) and an allowed protocol and port specification. The target determines which instances receive the traffic, and the source range restricts who can connect.

Question 45Implement a VPC network

You want to allow egress from a subnet to all destinations except a specific CIDR. Which approach is supported in VPC firewall rules?

  1. Egress filtering is not supported; only ingress rules can be created.
  2. Create a higher-priority egress deny rule for the CIDR and rely on the implied allow egress rule for everything else. Correct answer.
  3. Create an egress rule with a destination of 0.0.0.0/0 and a deny action.
  4. Create an egress allow rule with a negated destination range.

Explanation

Egress rules support deny actions, and the implied allow egress rule at priority 65535 permits remaining traffic. Placing a higher-priority deny rule for the specific CIDR blocks only that destination while the implied rule allows the rest.

Question 46Implement a VPC network

Which route type is automatically created in a VPC network to allow instances to reach the internet when the instance has an external IP address?

  1. A peering route to the default network
  2. A dynamic route learned over BGP
  3. A policy-based route with a next hop of a VPN tunnel
  4. A default route with destination 0.0.0.0/0 and next hop default-internet-gateway Correct answer.

Explanation

A VPC network includes a system-generated default route to 0.0.0.0/0 whose next hop is the default internet gateway. Instances also need an external IP address or Cloud NAT to use that route for outbound internet access.

Question 47Implement a VPC network

You create a static route with destination 10.9.0.0/16 and next hop an instance named router-vm. What must be true for this route to forward traffic?

  1. The route must have a lower priority than the default route.
  2. The next-hop instance must be in the same zone as the source VM.
  3. The next-hop instance must have IP forwarding enabled. Correct answer.
  4. The next-hop instance must have an external IP address.

Explanation

When a static route uses an instance as its next hop, that instance must have IP forwarding enabled so it can forward packets not addressed to itself. Without IP forwarding, the instance drops traffic destined for other hosts.

Question 48Implement a VPC network

Two routes match a packet: one with prefix 10.1.0.0/16 and one with prefix 10.1.2.0/24. Which route is chosen?

  1. Both routes are used and traffic is load-balanced
  2. The /16 route because it covers a larger address space
  3. The /24 route because it is the most specific match Correct answer.
  4. The /16 route because it was created first

Explanation

Route selection uses longest-prefix match, so the more specific /24 route wins over the /16 route. Creation order and address-space size do not determine which route is selected.

Question 49Implement a VPC network

You need to connect two VPC networks in different projects so that instances can communicate using internal IP addresses without a VPN. Which feature should you use?

  1. VPC Network Peering Correct answer.
  2. Cloud Interconnect
  3. Cloud VPN with dynamic routing
  4. Shared VPC

Explanation

VPC Network Peering connects two VPC networks so that instances communicate using internal IP addresses, and it works across projects and organizations. Peering does not require encryption gateways because traffic stays on Google's network.

Question 50Implement a VPC network

Which statement about VPC Network Peering is correct?

  1. Peering requires overlapping subnet ranges to function.
  2. Peered networks automatically exchange routes transitively to a third peered network.
  3. Peered networks exchange subnet routes, but the peering is non-transitive. Correct answer.
  4. Peering requires both networks to be in the same project.

Explanation

Peering exchanges routes for subnets in the peered networks, but routes are not propagated transitively to other peerings. Each peering is a direct relationship, and overlapping ranges cause the peering to fail.