Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
Which capability best describes Google Cloud's global network backbone?
Understand the underlying network infrastructure of Google Cloud
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Terraform modules and infrastructure blueprints for advanced exploration of Google Cloud design. This is supporting engineering material, not an exam course.
Try it: Read one small VPC or service-account module. Draw the resources and permission boundaries it creates, and explain a least-privilege change without deploying an entire landing zone.
Reading the code is free. Deployment requires suitable permissions and can create billable infrastructure.
Official certification paths with exam-specific guides and preparation links for cloud roles.
Try it: Open the guide for your chosen role. For each weak domain, write one service-selection decision you cannot yet explain and find its product documentation.
Public certification information is free; training, labs, and exam registration may be paid.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
Which capability best describes Google Cloud's global network backbone?
Private fiber links with high capacity and low latency between regions
Shared public internet paths with dynamic routing
Satellite-based connectivity for edge locations
Peer-to-peer connections limited to single zones
Correct answer
Private fiber links with high capacity and low latency between regions
Google's global network backbone uses private fiber to connect regions and zones, providing high throughput and low latency. This infrastructure is designed for reliable, high-performance data transfer across the globe.
When configuring a VPC for hybrid connectivity, which component enables private access to on-premises resources?
Cloud NAT Gateway
Interconnect or Dedicated Interconnect
Cloud Load Balancer
Cloud DNS Forwarding
Correct answer
Interconnect or Dedicated Interconnect
Interconnect or Dedicated Interconnect provides a private connection between your on-premises network and Google Cloud VPC. This allows secure, low-latency communication without traversing the public internet.
Which practice helps reduce network egress costs when serving static content from Google Cloud?
Using higher machine types for compute
Deploying Cloud CDN to cache content at edge points
Increasing the number of firewall rules
Enabling live migration for VMs
Correct answer
Deploying Cloud CDN to cache content at edge points
Cloud CDN caches content at edge points of presence, reducing the need to serve requests from the origin. This lowers egress charges and improves latency for global users.
What is a primary benefit of using Cloud Router in a Google Cloud network?
It automatically scales virtual machines
It exchanges routing information with on-premises BGP peers
It provides encryption for data at rest
It replaces the need for a VPC
Correct answer
It exchanges routing information with on-premises BGP peers
Cloud Router enables dynamic routing using BGP, allowing your on-premises routers to exchange routes with Google Cloud. This keeps routing tables updated without manual configuration.
Which network security practice aligns with the principle of least privilege?
Allowing all ingress traffic to instances for simplicity
Using firewall rules to permit only required ports and sources
Sharing service account keys across teams
Disabling logging to reduce overhead
Correct answer
Using firewall rules to permit only required ports and sources
Applying least privilege means configuring firewall rules to allow only necessary traffic from known sources. This reduces the attack surface and improves security posture.
What is a typical use case for a Google Cloud internal load balancer?
Exposing a service to the global internet
Distributing traffic across instances in the same VPC network
Providing a static public IP for external applications
Encrypting traffic between regions
Correct answer
Distributing traffic across instances in the same VPC network
An internal load balancer distributes traffic among backend services within a VPC, using internal IP addresses. It is ideal for internal applications that should not be exposed externally.
Which feature improves network reliability by providing redundant paths?
Single route propagation
Multi-path routing and ECMP
Static IP assignment
Firewall rule logging
Correct answer
Multi-path routing and ECMP
Equal-cost multi-path (ECMP) routing allows multiple paths between network points, improving resilience and bandwidth utilization. Google's network leverages this for high reliability.
When planning IP addressing for a new VPC, what is a recommended practice?
Use public IP ranges used by other services
Choose RFC 1918 address space to avoid conflicts
Assign addresses sequentially without planning
Reuse on-premises IPs without overlap checks
Correct answer
Choose RFC 1918 address space to avoid conflicts
Using private RFC 1918 address ranges (e.g., 10.0.0.0/8) ensures your VPC IP space does not conflict with public or on-premises networks. This supports flexible peering and hybrid setups.
Which tool is best suited for monitoring network performance and diagnosing connectivity issues?
Cloud Scheduler
Cloud Monitoring with network insights
Cloud Build Triggers
Cloud Asset Inventory
Correct answer
Cloud Monitoring with network insights
Cloud Monitoring provides dashboards and network insights that help visualize traffic, detect anomalies, and troubleshoot connectivity problems. It integrates natively with Google Cloud services.
What is a key advantage of using alias IP ranges on a network interface?
They increase the maximum bandwidth of the interface
They allow multiple secondary IP ranges for flexible service binding
They automatically encrypt traffic
They reduce the need for firewalls
Correct answer
They allow multiple secondary IP ranges for flexible service binding
Alias IP ranges let you assign multiple IP ranges to a network interface, enabling services like multiple GKE pods or NAT gateways on the same instance without extra interfaces.
Which statement describes a benefit of Google Cloud's network tiering?
Premium tier uses shared infrastructure for lower costs
Standard tier offers the lowest latency for all traffic
Premium tier provides enhanced performance and lower latency
Network tiering does not affect egress pricing
Correct answer
Premium tier provides enhanced performance and lower latency
The Premium network tier offers better performance, higher packet per second capacity, and lower latency compared to Standard tier. It is suitable for latency-sensitive and high-throughput applications.
What is a common method to secure management traffic to Google Cloud resources?
Allowing unrestricted SSH from all IPs
Using bastion hosts and restricted firewall rules
Relying solely on VPC default settings
Disabling identity-aware proxy
Correct answer
Using bastion hosts and restricted firewall rules
A bastion host with tightly controlled firewall rules, combined with identity-aware proxy, helps protect management traffic. This limits exposure and enforces strong access controls.
Which scenario is best served by using Cloud Interconnect?
Short-term data backup to cloud storage
Consistent high-throughput private connection to Google Cloud
Public website hosting with CDN
Serverless function execution
Correct answer
Consistent high-throughput private connection to Google Cloud
Cloud Interconnect provides a dedicated, private connection with consistent bandwidth and low latency, ideal for high-volume data transfer and hybrid cloud architectures.
What is a recommended practice for firewall rule design in Google Cloud?
Create broad rules to simplify management
Place specific rules before general deny rules
Allow all traffic on all ports for testing
Use only network tags without service accounts
Correct answer
Place specific rules before general deny rules
Firewall rules are evaluated in order of priority, with lower numbers evaluated first. Placing specific allow rules before a general deny ensures intended traffic is permitted while maintaining security.
Which feature enables you to connect multiple VPC networks privately?
Cloud NAT
VPC Peering
Cloud CDN
Cloud Scheduler
Correct answer
VPC Peering
VPC Peering allows private connectivity between two VPC networks, enabling resources to communicate as if they are within the same network. It is useful for multi-network architectures and hybrid designs.
Recall the answer before opening each card.
Private fiber links connecting regions and zones, providing high throughput and low latency.
Cloud Interconnect or Dedicated Interconnect provides a private connection between on-premises and Google Cloud VPC.
Cloud Router uses BGP to dynamically exchange routes with on-premises routers, keeping routing tables updated.
Deploy Cloud CDN to cache content at edge points of presence, reducing origin requests and egress charges.
Configure firewall rules to permit only required ports and sources, reducing the attack surface.
To distribute traffic among instances within the same VPC using internal IP addresses for internal applications.
Equal-cost multi-path (ECMP) routing uses multiple equal-cost paths for improved resilience and bandwidth.
RFC 1918 private address space (e.g., 10.0.0.0/8) to avoid conflicts with public or on-premises networks.
Cloud Monitoring with network insights visualizes traffic, detects anomalies, and aids troubleshooting.
They allow multiple secondary IP ranges per interface, enabling flexible service binding like GKE pods or NAT gateways.
Premium tier offers better performance, higher packet per second capacity, and lower latency than Standard.
Using bastion hosts with restricted firewall rules limits exposure and enforces strong access controls.
For consistent high-throughput private connections to Google Cloud, ideal for high-volume data transfer.
Place specific allow rules before general deny rules because rules are evaluated by priority (lower number first).
VPC Peering allows private connectivity between two VPCs, enabling communication as if within the same network.
It exchanges routes with on-premises BGP peers, enabling dynamic routing and automatic failover.
Caching content at edge points of presence reduces latency for global users and lowers origin load.
They use internal IP addresses and distribute traffic within a VPC, not exposed to the internet.
ECMP provides multiple active paths, increasing fault tolerance and bandwidth utilization.
To assign multiple IP addresses to a single network interface for services like multiple containers or NAT.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
This section focuses on the foundational network infrastructure and connectivity methods to link on-premises and multi-VPC environments. The practice bank emphasizes the private fiber backbone that provides low-latency global connectivity. It also tests knowledge of hybrid connectivity components like Interconnect and Cloud Router for dynamic BGP routing. Additionally, VPC Peering is highlighted as a method for private multi-network communication. Understanding these options is critical for designing cost-effective, high-performance hybrid and multi-network architectures that leverage Google's premium tier for enhanced performance.
This section addresses security best practices applied to network configurations. The practice bank tests the principle of least privilege by permitting only required ports and sources via firewall rules. It also covers rule evaluation order—placing specific allow rules before general deny rules. Secure management is achieved through bastion hosts with restricted firewall rules. These practices reduce the attack surface and enforce strong access controls for administrative traffic, aligning with enterprise security requirements.
This section focuses on optimizing network performance and cost while diagnosing issues. The practice bank highlights deploying Cloud CDN to cache static content at edge points, reducing egress costs. It also covers the Premium network tier for low-latency applications. Alias IP ranges enable flexible service binding on a single interface, improving resource utilization. Monitoring is done via Cloud Monitoring with network insights to visualize traffic and detect anomalies, enabling proactive issue resolution.
This section covers load distribution within a VPC, network resilience, and proper IP addressing. The practice bank indicates that internal load balancers distribute traffic among instances within the same VPC using internal IPs, suitable for internal applications. ECMP routing provides redundant paths, enhancing reliability. For IP addressing, RFC 1918 private ranges are recommended to avoid conflicts and support peering/hybrid connectivity. Alias IP ranges further extend IP flexibility for advanced setups.
Study workflow
Begin by assessing your bandwidth and latency requirements. For consistent high-throughput private connections, provision Cloud Interconnect or Dedicated Interconnect between your on-premises router and Google Cloud. Then deploy Cloud Router to establish dynamic BGP sessions, allowing automatic route exchange and failover without manual updates.
Identify required traffic flows and source IP ranges. Create firewall rules with high priority (low number) to allow specific traffic, and a low-priority deny-all rule as a catch-all. Ensure rules are placed in order: specific allows before general denies. Use service accounts and tags for granular control.
For static content, enable Cloud CDN with an external HTTP(S) load balancer. Cache content at edge locations to reduce origin load and egress costs. For latency-sensitive workloads, select Premium network tier to leverage Google's global backbone. Monitor egress usage to adjust caching policies.
For internal applications, create an internal TCP/UDP or HTTP(S) load balancer with a backend service targeting instance groups in the same VPC. Assign an internal IP address from the VPC subnet. Ensure health checks are configured to route traffic only to healthy instances.
To connect multiple VPC networks privately, use VPC Network Peering. Ensure IP ranges do not overlap. Initiate peering from one VPC to another, then accept from the other side. Configure firewall rules to allow traffic between peered networks as needed.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Both provide private connections to Google Cloud. Dedicated Interconnect offers a direct physical connection with higher bandwidth options (10 Gbps or 100 Gbps) and is a single-tenant link. Cloud Interconnect (partner) uses a service provider to connect, offering lower bandwidth and flexibility. Both support VLAN attachments and dynamic routing via Cloud Router.
Cloud Router uses the Border Gateway Protocol (BGP) to exchange routes between your on-premises network and Google Cloud VPC. It learns new subnets and updates routes automatically, enabling failover and load balancing without manual intervention when you add or remove connections.
RFC 1918 specifies private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not routable on the public internet. Using these for your VPC avoids IP conflicts with public addresses and simplifies hybrid connectivity by reserving space for future VPC peering or Cloud Interconnect without renumbering.
Alias IP ranges allow you to assign multiple IP addresses to a single network interface. In GKE, each pod gets an IP from the alias range, enabling direct pod-to-pod communication without NAT. This simplifies network policies and supports services like VPC-native clusters.
A bastion host is a hardened instance with tightly controlled access that serves as a secure entry point for administrative traffic. It typically has a single, restricted source IP and uses IAP (Identity-Aware Proxy) or SSH keys. All management traffic to other instances is proxied through the bastion, reducing exposure.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
