Preparing for Your

Professional Cloud
Network Engineer
Journey

Course Workbook
Certification Exam Guide Sections
1 Designing, planning, and prototyping a Google Cloud network

2 Implementing a Virtual Private Cloud (VPC)

3 Configuring network services

4 Implementing hybrid interconnectivity

5 Managing, monitoring, and optimizing network operations

Section 1:
Designing, planning, and
prototyping a Google Cloud
network
1.1 Diagnostic Question 01

You are a network engineer designing a network IP plan A. 10.1.1.0/24

and need to select an IP address range to use for a B. 10.1.240.0/21
subnet. The subnet will need to host up to 2000 virtual
C. 10.1.1.0/21
machines, each to be assigned one IP address from the
subnet range. It will also need to fit in the network IP D. 10.1.240.0/20
range 10.1.0.0/16 and be as small as possible.

What subnet range should you use?

1.1 Diagnostic Question 02

Cymbal Bank has a network support A. The Compute Admin role bound at
engineering team which will need the project level for the project that
access to create or change subnet owns the VPC network
names, locations, and IP address B. The Compute Network Admin role bound at the project level for
ranges for some but not all the Project that owns the VPC network
subnetworks of a VPC network in a
C. The Compute Network Admin role bound at the resource level
Google Cloud project. Cymbal Bank
for the subnetworks of the VPC network that will be created or
uses the principle of least privilege and
changed by the team
would like to restrict role usage to
Google predefined roles. D. The Compute Admin role bound at the resource level for the
subnetworks of the VPC network that will be created or
Which role should be assigned changed by the team
to this group?
1.1 Diagnostic Question 03
You are a network engineer designing a A. Cloud CDN could be used to cache static
solution for hosting a Cymbal Bank web content resources at edge locations close to
application in Google Cloud. The end-users, increasing their availability and
application will serve a collection of static minimizing their latency.
and dynamic web resources served over B. Cloud NAT could be used to provide outbound connectivity to the internet
HTTPS to users worldwide. You need to for resources with only internal IP addresses, thereby increasing their
design a solution that maximizes availability.
availability while minimizing average user
latency. C. Cloud Armor could be used to provide protection against DDoS and
injection attacks and thereby minimize solution latency.
D. An HTTPS load balancer with a backend service connected to a set of
Which of the following features of regional MIGs, distributed over the regions closest to the users, to improve
Google Cloud networking can you availability and minimize latency.
utilize? (Select 2) E. Network Intelligence Center could be used to provide network insights,
enabling the web application to be deployed in a configuration with
maximum availability and minimal latency.
 Designing an overall network
1.1 architecture

Courses

Documentation

Networking in Google Cloud Networking in Google Cloud: Hybrid Compute Engine IAM roles and
● M2 Controlling access to connectivity and network management permissions
VPC networks ● M2 Controlling access to VPC Cloud CDN overview
● M4 Load balancing networks
Cloud NAT overview
● M5 Hybrid connectivity ● M4 Load balancing
● M7 Network design and Cloud Load Balancing overview
deployment Networking in Google Cloud: Hybrid Google Cloud Armor overview
connectivity and network management
Network Intelligence Center
● M1 Hybrid connectivity
● M3 Network design and deployment
1.2 Diagnostic Question 04
Cymbal Bank needs to create one or more A. 3 custom VPC networks, one in each
VPC networks to host their cloud services region with one subnet each. The VPC
in 3 regions: Northeastern US, Western networks all connected with VPC peering with
Europe, and Southeast Asia. The services default firewall rules, and custom routes added to
require bi-directional inter-regional support the traffic requirements.
communication on port 8443. The services B. 3 custom VPC networks, one in each region with one subnet each.
receive external internet traffic on port The VPC networks all connected with VPC peering with default routes,
443. and firewall rules added to support the traffic requirements.
C. 1 custom VPC network, with a subnet in each region. The VPC network has
the default routes, and the appropriate firewall rules added to support the
traffic requirements.
What is the minimal network
topology in Google Cloud that D. 1 custom VPC network, with a subnet in each region. The VPC network has
would satisfy these requirements? default firewall rules and custom routes added to support the
traffic requirements.
1.2 Diagnostic Question 05
Sarah is a network architect responsible A. Shared VPC network connecting
for the network design between Cymbal Google Cloud resources for Cymbal Bank
Bank’s on-premises network and Google and the partner company
Cloud resources, and also between B. VPC peering between VPC networks for Cymbal Bank and the partner
Cymbal Bank’s Google Cloud resources company
and a partner company’s Google Cloud
resources. These connections must C. A Dedicated Interconnect connection between Cymbal Bank’s on-premises
provide private IP connectivity and network and their Google Cloud VPC network
support up to 100 Gbps of data exchange D. A Cloud VPN tunnel between Cymbal Bank’s on-premises network and their
with minimum possible latency. Google Cloud VPC network
E. 50 Cloud VPN tunnels between Cymbal Bank’s on-premises network and
their Google Cloud VPC network
Which options satisfy these
requirements? (Select 2)
1.2 Diagnostic Question 06

You are selecting Google Cloud locations to deploy A. Deploy instances in multiple
Google Cloud VMs. You have general requirements zones in the northamerica-
to maximize availability and reduce average user northeast1 (Montreal) and
latency with a lower priority goal of reducing northamerica-northeast2 regions.
networking costs. The users served by these VMs B. Deploy instances in a single zone in the
will be in Toronto and Montreal. You must deploy northamerica-northeast1 and northamerica-northeast2
workloads requiring instances at 99.5% availability regions.
in Toronto and 99.99% availability in Montreal.
C. Deploy instances in a single zone in the
These instances all exchange a large amount of
northamerica-northeast1 region and multiple zones in the
traffic among themselves.
northamerica-northeast2 region.

Which deployment option D. Deploy instances in multiple zones in the

satisfies these requirements? northamerica-northeast1 region and a single zone in the
northamerica-northeast2.
1.2 Designing a VPC
Documentation

VPC network overview

VPC firewall rules overview

Courses Routes overview | VPC

Shared VPC overview
VPC Network Peering overview
Choosing a Network Connectivity product
Global Locations - Regions & Zones
Networking in Google Cloud Networking in Google Cloud: Defining and
● M1 Google Cloud VPC implementing networks Regions and zones | Compute Engine
Documentation
networking fundamentals ● M1 Google Cloud VPC networking
● M3 Sharing networks Global, regional, and zonal resources |
fundamentals Compute Engine Documentation
across projects ● M3 Sharing networks across projects
● M5 Hybrid connectivity Networking in Google Cloud: Hybrid
All networking pricing | Virtual Private
● M7 Network design and Cloud
connectivity and network management
deployment Compute Engine Service Level Agreement
● M1 Hybrid connectivity (SLA)
● M3 Network design and deployment
1.3 Diagnostic Question 07

You are designing a VPN solution to A. Classic VPN with route-based static routing
connect Cymbal Bank’s on-premises B. Classic VPN with policy-based static routing
data center to Google Cloud. You have
a BGP-capable VPN gateway installed C. Classic VPN with Cloud Router and dynamic routing
in the data center and require 99.99% D. HA VPN with Cloud Router and dynamic routing
availability for the VPN link.

What Cloud VPN configuration meets

these requirements while requiring the
least setup and maintenance?
1.3 Diagnostic Question 08
To reduce latency, you will be replacing an existing Cloud A. A 10 Gbps Dedicated
VPN Classic VPN connection. You will connect your Interconnect connection
organization’s on-premises data center to Google Cloud with one 10 Gbps
resources in a VPC network with all resources in a single VLAN attachments
subnet and region using private/internal IP connectivity. B. A 2 Gbps Dedicated Interconnect connection with one 2
The connection will need to support 1.5 Gbps of traffic. Gbps VLAN attachments
Due to cost considerations, you would like to order the
option that provides just enough bandwidth and not C. A Partner Interconnect connection with 1 or 2 VLAN
more but must have significantly lower latency than the attachments
existing Cloud VPN connection. D. A Cloud VPN HA VPN connection with Cloud Router

What should you use?

1.3 Designing a hybrid and multi-cloud network

Courses Documentation

Cloud VPN overview

Cloud Interconnect overview
Networking in Google Cloud Networking in Google Cloud: Hybrid
● M5 Hybrid connectivity Dedicated Interconnect overview
connectivity and network management
Partner Interconnect overview
● M1 Hybrid connectivity
Key terms | Cloud Interconnect
Pricing | Cloud Interconnect
Choosing a Network Connectivity product
1.4 Diagnostic Question 09

You need to create a GKE cluster, be able A. A GKE route-based cluster in a subnet with
to connect to pod IP addresses from your primary IP range 10.0.240.0/20 and pod IP
on-premises environment, and control range of 10.1.0.0/16
access to pods directly using firewall B. A GKE route-based cluster in a subnet with primary IP range 10.0.240.0/20
rules. You will need to support 300 nodes, and pod IP range of 10.252.0.0/14
30000 pods, and 2000 services.
C. A GKE VPC-native cluster in a subnet with primary IP range 10.0.240.0/20,
pod IP range of 10.252.0.0/15, and service IP range of 10.0.224.0/20

Which configuration satisfies these D. A GKE VPC-native cluster in a subnet with primary IP range 10.0.240.0/20,
requirements? pod IP range of 10.252.0.0/16, and service IP range of 10.0.224.0/20
1.4 Diagnostic Question 10
Cymbal Bank wants to ensure communication A. Deploy a private GKE cluster with public
from their on-premises data centers to the GKE endpoint access enabled and authorized
control plane stays private using internal IP networks disabled.
communication and their Dedicated B. Deploy a private GKE cluster with public endpoint access
Interconnect links. However, they will need to enabled and authorized networks enabled. Configure authorized networks for the
allow administrators to periodically connect to cluster to include all remote source IP ranges that administrators may connect from.
the cluster control plane from remote
internet-accessible locations that don’t have C. Deploy a private GKE cluster with public endpoint access disabled. Create a VM in the
access to the on-premises private network. You same subnet with only an internal IP address and provide IAP tunnel based SSH access
want to select a configuration and connection to remote administrators for this VM. Have remote administrators connect via IAP
approach that will enable these requirements tunnel SSH to this VM when requiring access to the GKE cluster control plane.
while providing the highest security. D. Deploy a private GKE cluster with public endpoint access disabled. Provide remote
administrators IAP tunnel based SSH access to a node in the cluster. Have remote
administrators connect via an IAP tunnel SSH to this node when requiring access to the
What should you do? GKE cluster control plane.
 Designing an IP addressing plan
1.4 for Google Kubernetes Engine

Skill Badge Documentation

Types of clusters | Kubernetes Engine

Documentation
Google Cloud
VPC-native clusters | Kubernetes Engine
Security and Identity Documentation
Fundamentals Quest Creating a VPC-native cluster |
Kubernetes Engine Documentation
Creating a routes-based cluster |
Kubernetes Engine Documentation
Private clusters | Kubernetes Engine
Documentation
Creating a private cluster | Kubernetes
Engine Documentation
Section 2:
Planning and configuring a
cloud solution
21
. Diagnostic Question 01

Cymbal Bank has a custom VPC network with two subnets A. Create a new subnet in us-central1 with
(in us-central1 and us-east1) hosting 500 VMs each. The primary IP range 10.128.128.0/22, delete
primary ranges for each are 10.128.128.0/23 and the VMs in the existing subnets one at a
10.128.192.0/23. The VPC has default routes and 3 firewall time and re-create them in the new subnet, delete the old subnets, update the B
rules (all at priority 1000), one (A) allowing ingress on TCP and C firewall rules to use the single new subnet primary range.
port 443 from any IP address, another (B) allowing ingress
B. Create a new subnet in us-central1 with primary IP range 10.192.128.0/22, delete
on TCP port 8443 from the primary ranges of each subnet,
the VMs in the existing subnets one at a time and re-create them in the new
and a third (C) denying egress to the primary ranges for
subnet, delete the old subnets, update the B and C firewall rules to use the single
each subnet for all ports and protocols except for TCP port
new subnet primary range.
8443. To reduce networking costs, Cymbal Bank would like
to consolidate the 1000 VMs into a single subnet in C. Expand the subnet in us-central1 to a primary IP range 10.128.128.0/22, delete the
us-central1 (and use a primary IP range for that subnet to VMs in the us-east1 subnet one at a time and re-create them in the new subnet,
support that) and delete the us-east1 subnet. You would delete the us-east1 subnet, update the B and C firewall rules to use the single new
like to ensure the simplest possible firewall rules in the new subnet primary range.
configuration providing the same traffic control. D. Expand the existing subnet in us-central1 to a primary IP range 10.192.128.0/22,
delete the VMs in the us-east1 subnet one at a time and re-create them in the new
Select the sequence of configuration steps that can subnet, delete the us-east1 subnet, update the B and C rules to use the single new
accomplish this with minimal interruption to the workloads. subnet primary range.
21
. Diagnostic Question 02

You are designing a networking scheme for A. Connect the VMs across the Cymbal
Cymbal Bank with the requirement to use projects and partner organization using
internal IP addresses for communication, VPCs in each project (V1, V2, V3, V4, V5) and
with the lowest possible latency. Cymbal VPC peering (peering V1 to V2, V2 to V3, V3 to V4, and V4 to V5).
Bank has several teams, each with their own B. Connect the VMs across the Cymbal projects (P1-P3) using Shared VPC
projects: P1, P2, and P3. Cymbal Bank would (Shared VPC host project P6 with VPC V6, and P1-P3 are the service
like consolidated network billing, projects) and then peer that Shared VPC to the partner organization
administration, and access control for the VPCs (V6 peered to V4 and V4 to V5).
cloud environment. VMs in these projects
need to connect to VMs in a partner C. Connect the VMs across Cymbal and partner organization projects
organization, in projects P4 and P5. (P1-P5) using Shared VPC (Shared VPC host project P6 with VPC V6, and
P1-P5 are the service projects).
D. Connect the VMs across the Cymbal projects (P1-P3) using Shared VPC
Which networking option best satisfies (Shared VPC host project P6 with VPC V6, and P1-P3 are the service
these requirements? projects) and then peer that Shared VPC to the partner organization
VPCs (V6 peered to V4 and V6 to V5).
21
. Configuring VPCs

Courses Skill Badges Documentation

Networking in Google Cloud
● M1 Google Cloud VPC networking VPC network overview
fundamentals
Google Cloud Using VPC networks
● M2 Controlling access to VPC networks
● M3 Sharing networks across projects VPC firewall rules overview
● M7 Network design and deployment Security & Identity
Fundamentals Quest Using firewall rules | VPC

Networking in Google Cloud: Defining and

implementing networks
● M1 Google Cloud VPC networking
fundamentals
● M2 Controlling access to VPC networks
● M3 Sharing networks across projects

Networking in Google Cloud: Hybrid

connectivity and network management
● M3 Network design and deployment
2.2 Diagnostic Question 03
Cymbal Bank needs to connect two A. Configure the VPC for regional dynamic routing
on-premises networks to a single VPC mode, create a Cloud Router in each of the two
network in Google Cloud. One on-premises regions, connect each office to its closest region
network supports BGP routing and is located via an HA VPN gateway with dynamic routing in that region.
near the us-central1 region. The other B. Configure the VPC for regional dynamic routing mode, create one Cloud Router in
on-premises network does not support BGP the us-central1 region, connect the office close to us-central1 to the VPC using an
routing and is located near us-east1. The VPC HA VPN gateway with dynamic routing in us-central1, and connect the other office
network has subnets in each of these via a Classic VPN gateway using static routing in us-east1.
regions. You will use Cloud VPN to enable
private communication between the C. Configure the VPC for global dynamic routing mode, create Cloud Routers in each of
on-premises networks and the VPC network. the 2 regions, connect each office to its closest region via an HA VPN gateway with
dynamic routing in that region.
D. Configure the VPC for global dynamic routing mode, create Cloud Routers in each of
Which configuration provides the highest
the 2 regions, connect the office close to us-central1 to the VPC using an HA VPN
availability and the lowest average
gateway with dynamic routing in us-central1, and connect the other office via a
latency?
Classic VPN gateway using static routing in us-east1.
2.2 Diagnostic Question 04

You are designing a VPC network with the A. Create a custom route to the destination
requirement that all external traffic 0.0.0.0/0 and specify the next hop as the proxy VM.
destined for the Internet be passed B. Delete the system-generated default route, then create a custom route
through a proxy VM. The proxy will have to destination 0.0.0.0/0 and specify the next hop as the proxy VM.
software installed to scan, detect, and
drop invalid egress traffic, to help C. Create a custom route to the destination 0.0.0.0/0 and specify the next
prevent data exfiltration, outbound hop as the proxy VM and configure the scanning VM to enable IP
attacks, or access to blocked websites. forwarding.
D. Delete the system-generated default route, then create a custom route
to destination 0.0.0.0/0. Specify the next hop as the proxy VM, and
Select the configuration that can configure the proxy VM to enable IP forwarding.
most easily accomplish this.
2.2 Configuring routing

Courses Skill Badges Documentation

Cloud VPN overview
Networking in Google Cloud
● M1 Google Cloud VPC networking Best practices for Cloud VPN
fundamentals Google Cloud HA VPN topologies
● M3 Sharing networks across
projects Build and Secure Networks in
Classic VPN topologies
Google Cloud Quest
● M5 Hybrid connectivity
Creating an HA VPN gateway to a peer VPN
● M7 Network design and deployment
gateway
Creating an HA VPN between Google Cloud
Networking in Google Cloud: Defining
Google Cloud networks
and implementing networks
● M1 Google Cloud VPC networking Security & Identity Creating a Classic VPN using static routing
fundamentals Fundamentals Quest
Networks and tunnel routing | Cloud VPN
● M3 Sharing networks across
projects Cloud Router overview

Networking in Google Cloud: Hybrid Routes overview | VPC

Google Cloud
connectivity and network management Using routes | VPC
● M1 Hybrid connectivity Network Performance and
● M3 Network design and deployment Optimization Quest
2.3 Diagnostic Question 05

Cymbal Bank has an existing subnet that A. Expand the subnet primary IP address range to 10.128.0.0/16, create a
you’d like to use for a new VPC-native secondary range in the subnet of size /14 for pods and another of size
GKE cluster. The subnet primary IP /17 for services, create the GKE VPC-native cluster in the subnet using
address range is 10.128.128.0/20. these secondary ranges.
Currently there are 1000 other VMs using B. Create a secondary range in the subnet of size /13 for pods and another
that subnet and have taken 1000 of the of size /16 for services, create the GKE VPC-native cluster in the subnet
available IP addresses. The new GKE using these secondary ranges.
cluster should support 200,000 pods
and 30,000 services. C. Create a GKE VPC-native cluster in the subnet, specifying the pod range
to be of size /14 and services range to be of size /17.
Select the minimal set of D. Create a GKE VPC-native cluster in the subnet, specifying the pod range
configuration steps and the smallest to be of size /13 and services range to be of size /17.
possible IP ranges to enable this.
2.3 Diagnostic Question 06
A. Assign the service-{serviceProjectNumber}@
You will be deploying a VPC-native GKE
container-engine-robot.iam.gserviceaccount.com
cluster into an existing service project of
service account (where serviceProjectNumber is the
a Shared VPC. You will create an Ingress project number of the service project) the
to trigger the automatic creation, Compute Network User role (in the host project).
connection, and firewall configuration of
B. Assign the service-{serviceProjectNumber}@container-engine-robot.iam.
an HTTP(S) load balancer to a service
gserviceaccount.com service account (where serviceProjectNumber is the project
deployed in the cluster for number of the service project) the Host Service Agent User (in the host project).
container-native load balancing.
C. Assign the service-{serviceProjectNumber}@container-engine-robot.iam.
gserviceaccount.com service account (where serviceProjectNumber is the project
Select the option corresponding to number of the service project) the Host Service Agent User and the Compute
the IAM policy binding of least Network User (in the host project).
privilege necessary. D. Assign the service-{serviceProjectNumber}@container-engine-robot.iam.
gserviceaccount.com service account (where serviceProjectNumber is the project
number of the service project) the Host Service Agent User (in the host project)
and the Compute Network User (for the subnet of the GKE cluster in the shared
VPC in the host project).
 Configuring and maintaining Google
2.3 Kubernetes Engine clusters

Skill Badge Documentation

Types of clusters | Kubernetes Engine Documentation
VPC-native clusters | Kubernetes Engine Documentation
Google Cloud Creating a VPC-native cluster | Kubernetes Engine Documentation

Security and Identity Optimizing IP address allocation | Kubernetes Engine Documentation

Fundamentals Quest Setting up clusters with Shared VPC | Kubernetes Engine
Documentation
Network overview | Kubernetes Engine Documentation
GKE Ingress for HTTP(S) Load Balancing
Configuring Ingress features | Kubernetes Engine Documentation
Best practices for GKE networking | Kubernetes Engine Documentation
Container-native load balancing | Kubernetes Engine Documentation
2.4 Diagnostic Question 07
A. Create service accounts (S1, S2, S3) for the microservices
You are configuring firewall rules for
and assign those service accounts to the instance template
securing a set of microservices (MS1, for the MIG used by each microservice, create 3 ingress allow
MS2, MS3) running in separate managed firewall rules, the first for TCP 8443 from source S1 to target S2,
instance groups (MIGs) of VMs in a single the second for TCP 8663 from source S2 to target S3, the third for TCP
subnet of a VPC network. The primary 8883 from source S3 to target S1.
range of the VPC network is B. Create network tags (T1, T2. T3) for the microservices and assign those network tags to the instance
10.128.128.0/20. MS1 will send requests to template for the MIG used by each microservice, create 3 ingress allow firewall rules, the first for TCP
MS2 on TCP port 8443, MS2 will send 8443 from source T1 to target T2, the second for TCP 8663 from source T2 to target T3, the third for
requests to MS3 on TCP port 8663, and TCP 8883 from source T3 to target T4.
MS3 will need to send requests to MS1 on C. Create service accounts (S1, S2, S3) for the microservices and assign those service accounts to the
TCP port 8883. There will be no other instance template for the MIG used by each microservice, create 3 ingress allow firewall rules, the
communication to or between these first for TCP 8443 from source 10.128.128.0/20 to target S2, the second for TCP 8663 from source
microservices. 10.128.128.0/20 to target S3, the third for TCP 8883 from source 10.128.128.0/20 to target S1’.
D. Create network tags (T1, T2. T3) for the microservices and assign those network tags to the instance
Select a simple and secure firewall template for the MIG used by each microservice, create 3 ingress allow firewall rules, the first for TCP
8443 from source 10.128.128.0/20 to target T2, the second for TCP 8663 from source 10.128.128.0/20
configuration to support this traffic
to target T3, the third for TCP 8883 from source 10.128.128.0/20 to target T1.
requirement.
2.4 Diagnostic Question 08
You are trying to determine which firewall A. Go to the Firewall Insights landing page of the Cloud Console.
rule(s) is/are incorrectly blocking requests Find the names of the deny firewall rules with hits to identify
between two VMs running within a VPC rules that are blocking requests. Go to the Legacy Logs Viewer
or Logs Explorer page, view the firewall logs, and filter for logs
network: VM1 and VM2. Firewall logging is
matching those rules by name using jsonPayload.rule_details.
enabled for all firewall rules, including
reference field, matching the names of the deny firewall rules with hits.
metadata. The Firewall Insights and
B. Go to the Logs Explorer or Legacy Logs Viewer page, view the firewall logs, and filter for logs
Recommendations API also have been
matching the source and destination VMs VM1 and VM2 using the jsonPayload.instance.project_id,
enabled. All insights have been enabled,
jsonPayload.instance.vm_name, jsonPayload.instance.region, and jsonPayload.instance.zone,
and observation period set over a period jsonPayload.remote_instance.vm_name, jsonPayload.remote_instance.region, and
capturing the blocked requests. jsonPayload.remote_instance.zone.
C. Go to the Logs Explorer or Legacy Logs Viewer page, view the firewall logs, and filter for logs
matching the destination VM2 in the VPC using the jsonPayload.instance.project_id,
jsonPayload.instance.vm_name, jsonPayload.instance.region, and jsonPayload.instance.zone fields.
Select a valid troubleshooting D. Go to the Firewall Insights landing page of the Cloud Console and find the names of the allow firewall
approach to find the incorrectly rules with no hits to identify rules that are not allowing requests. Go to the Logs Viewer or Explorer
configured firewall rule. page to view the firewall logs and filter for logs matching those rules by name using
jsonPayload.rule_details.reference field (matching the names of the allow firewall rules with no hits).
 Configuring and managing
2.4 firewall rules

Courses Skill Badges Documentation

Networking in Google Cloud
● M1 Google Cloud VPC networking
VPC firewall rules overview
fundamentals Using firewall rules | VPC
● M2 Controlling access to VPC networks Google Cloud
● M3 Sharing networks across projects Firewall Rules Logging overview | VPC
● M4 Load balancing Build and Secure Networks in
● M7 Network design and deployment Google Cloud Quest Using Firewall Rules Logging | VPC
● M8 Network monitoring and
troubleshooting Using Firewall Insights
Firewall Insights overview
Networking in Google Cloud: Defining and
implementing networks Google Cloud
● M1 Google Cloud VPC networking
fundamentals
Security & Identity
● M2 Controlling access to VPC networks Fundamentals Quest
● M3 Sharing networks across projects
● M4 Load balancing

Networking in Google Cloud: Hybrid

connectivity and network management Google Cloud
● M3 Network design and deployment
● M4 Network monitoring and Network Performance and
troubleshooting Optimization Quest
2.5 Diagnostic Question 09
Cymbal Bank requires restricting access to
A. Create a VPC service controls service perimeter
the the Cloud Storage buckets in a project
that includes the project and restricts access to
to ensure that the only way the buckets or
Cloud Storage APIs and enable VPC accessible
objects within can be accessed is via users
services configuring Cloud Storage APIs as accessible.
(who also have the necessary IAM role or
ACL access to the bucket or object) first B. Create a VPC service controls service perimeter that includes the project and restricts
connecting to a VM running in a VPC in the access to Cloud Storage APIs.
project via SSH. You would also like to C. Create a VPC service controls service perimeter that includes an ingress rule for all
ensure that users and service accounts are users ingressFrom.identityType: ANY_USER_ACCOUNT, ingressFrom.sources.resource
blocked from access to other Google Cloud set to the project full path, ingressTo.operations.serviceName is set to
APIs in the same project from VMs in the storage.googleapis.com, ingressTo.operations.methodSelectors.permission set to
project VPCs, regardless of whether or not google.storage.buckets.get and ingressTo.resources set to \"*\"
they have access via Cloud IAM roles.
D. Update the IAM role bindings for all users with access to the buckets to add an IAM
condition of the access level attribute type.
Which approach can accomplish this
with minimal configuration effort and
complexity?
2.5 Diagnostic Question 10
Cymbal Bank has a set of VPC service A. Create a service perimeter bridge connecting
control service perimeters around the service perimeters of all the projects.
several projects with BigQuery B. Create a service perimeter bridge connecting the service perimeters of all
datasets, with each project in its own the projects, and update all the service perimeters to add an access level
separate service perimeter. You would providing the external access for the specified users.
like to restrict access to these
projects’ BigQuery datasets to VMs in C. Update the service perimeter configurations for all the projects to add an
the VPCs of one of these projects ingress rule with an access level to provide the external access for the
(project P1,) and for a small set of specified users.
users to have external access from a D. Update the service perimeter configurations for all the projects to add an
combination of a specific IP range, ingress rule to provide the external access for the specified users, and
geo-location, and device type. another ingress rule to provide the access from the VPCs of the specified
project P1.
Which configuration that satisfies
these requirements with minimal
configuration?
 Implementing VPC Service Controls and
2.5 Access Contexts

Documentation
Overview of VPC Service Controls Ingress and egress rules | VPC Service Controls
Service perimeter details and configuration | VPC Service Sharing across perimeters with bridges | VPC Service
Controls Controls
Ingress and egress rules | VPC Service Controls Creating a perimeter bridge | VPC Service Controls
Sharing across perimeters with bridges | VPC Service Secure data exchange with ingress and egress rules
Controls Context-aware access with ingress rules | VPC Service
Creating a service perimeter | VPC Service Controls Controls
Dry run mode for Service Perimeters | VPC Service Access level attributes | Access Context Manager
Controls Custom access level specification | Access Context
Manager
Section 3:
Configuring network
services
3.1 Diagnostic Question 01

Cymbal Bank wants a web application A. A global external HTTP(S) load balancer
to have global anycast load balancing with one global forwarding rule,
across multiple regions. The web forwarding to one target proxy with one
application will serve static asset files URL map connected to 2 backend services
and will also use REST APIs that serve B. A global external HTTP(S) load balancer with two global forwarding
dynamic responses. The load balancer rules, forwarding to two target proxies, one with URL map and no
should support HTTP and HTTPS backend service and the other with URL map and 2 backend services
requests and redirect HTTP to HTTPS.
C. 2 global external HTTP(S) load balancers, each with one global
The load balancer should also serve all
forwarding rule forwarding to one target proxy with one URL map
the requests from the same domain
connected to 1 backend service
name, with different paths indicating
static versus dynamic resources. D. A global external HTTP(S) load balancer with two global forwarding
rules, forwarding to two target proxies, one with URL map and no
Select the load balancer configuration that backend service and the other with URL map, one backend service,
would most effectively enable this scenario. and one backend bucket
3.1 Diagnostic Question 02

You are designing a load balanced A. A managed instance group of

autoscaling front-end for Cymbal Bank. It is Kubernetes Engine nodes which
intended to be deployed into Google autoscale using cluster autoscaling
Kubernetes Engine (GKE). You want to use B. A zonal network endpoint group of Kubernetes
container-native load balancing and pods which autoscale using a HorizontalPodAutoscaler
autoscale based on the amount of traffic to
C. A managed instance group of Kubernetes Engine nodes which
the service.
contain pods that autoscale using a HorizontalPodAutoscaler
D. A serverless network endpoint group of Kubernetes pods which
Select the type of backend and autsocale using a HorizontalPodAutoscaler
autoscaling that would accomplish this.
 Documentation

3.1 Configuring load balancing

Cloud Load Balancing overview
Choosing a load balancer | Load Balancing
Load balancer features | Load Balancing
External HTTP(S) Load Balancing overview
Internal HTTP(S) Load Balancing overview
Courses Skill Badges External TCP/UDP Network Load Balancing
overview
Networking in Google Cloud Internal TCP/UDP Load Balancing overview

● M4 Load balancing SSL Proxy Load Balancing overview

Google Cloud
TCP Proxy Load Balancing overview
Create and Manage Backend services overview | Load Balancing
Networking in Google Cloud:
Defining and implementing Cloud Resources Quest Forwarding rules overview | Load Balancing
networks Instance groups | Compute Engine
Documentation
● M4 Load balancing
Creating managed instance groups | Compute
Engine Documentation
Google Cloud Network endpoint groups overview | Load
Balancing
Build and Secure
Networks in Google Zonal network endpoint groups overview | Load
Cloud Quest Balancing
Internet network endpoint groups overview |
Load Balancing
Serverless network endpoint groups overview |
Load Balancing
3.2 Diagnostic Question 03 Discussion

Cymbal Bank would like to A. Configure Cloud Armor with the

protect their services which appropriate rules.
are deployed behind an B. Configure a VM with appropriate scanning
HTTP(S) load balancer from L7 and filtering software in front of the HTTP(S)
distributed denial of service load balancer.
(DDoS), SQL injection (SQLi),
C. Configure Google Cloud WAF with the
and cross-site scripting (XSS)
appropriate rules.
attacks.
D. Configure Google Cloud NAT with the
appropriate rules.

Select the simplest approach

to accomplish this.
3.2 Configuring Google Cloud Armor policies

Courses Skill Badges Documentation

Networking in Google Cloud
● M4 Load balancing Security policy overview
● M7 Network design and Google Cloud
Configuring Google Cloud Armor security
deployment policies
Build and Secure Google Cloud Armor custom rules language
Networks in Google reference
Networking in Google Cloud: Cloud Quest Tuning Google Cloud Armor WAF rules
Defining and implementing
networks
● M4 Load balancing
Networking in Google Cloud:
Hybrid connectivity and
network management
● M3 Network design and
deployment
3.3 Diagnostic Question 04

Cymbal Bank uses Cloud CDN to cache A. Set the Cloud CDN cache mode for
a web application served from a the backend bucket to CACHE_ALL_STATIC.
backend bucket connected to a Cloud B. Set the Cloud CDN cache mode for the
Storage bucket. You need to cache all backend bucket to FORCE_CACHE_ALL, and ensure the
the web-app files with appropriate Cache-Control metadata for index.html is set to private.
time to live (TTL) except for the
C. Set the Cloud CDN cache mode for the backend bucket to
index.html file. The index.html file
CACHE_ALL_STATIC, and ensure the Cache-Control metadata for
contains links to versioned files and
index.html is not set or set to no-store, no-cache, or private.
should always be fetched or
re-validated from the origin. D. Set the Cloud CDN cache mode to USE_ORIGIN_HEADERS,
set the Cache-Control metadata for index.html to no-store, and
Which configuration option satisfies these set the Cache-Control headers for all the other files with
requirements with minimal effort? appropriate TTL values.
3.3 Diagnostic Question 05
Cymbal Bank is serving files from a
backend bucket and wants to ensure
time-limited read access without
authentication. The backend bucket A. Perform cache invalidation for the
uses signed URLs to access those files. file using the full path.
The files are also being cached in Cloud B. Perform cache invalidation for the file using the path
CDN. There is a problem with one of the excluding the query parameters used for the signed URL.
files. You want to delete the file. You also
C. Update the expiry time for the signed URL to be
want to immediately ensure no read
the current time.
access via the signed URL to the
cached file copy in Cloud CDN, D. Delete the key used to create the signed URL.
although the expiry time is currently set
to sometime in the future.

Select the option that accomplishes

this with lowest cost and effort.
3.3 Configuring Cloud CDN

Courses Skill Badges Documentation

Networking in Google Cloud Cloud CDN overview

● M4 Load balancing
Cloud CDN features
● M7 Network design and Google Cloud

deployment Best practices for content delivery |

Network Performance Cloud CDN
and Optimization Quest Caching overview | Cloud CDN
Networking in Google Cloud:
Signed URLs and signed cookies
Defining and implementing
overview | Cloud CDN
networks
● M4 Load balancing Using signed URLs | Cloud CDN
Using signed cookies | Cloud CDN
Networking in Google Cloud:
Hybrid connectivity and Cache invalidation overview | Cloud CDN
network management
Invalidating cached content | Cloud CDN
● M3 Network design and
deployment
3.4 Diagnostic Question 06
Cymbal Bank will use a hybrid DNS A. Create an single Cloud DNS managed
approach. Cymbal has a VPC in Google zone in Google Cloud configured for private
Cloud that connects to their on-premises DNS for gcp.cymbalbank.com and public
networks via Interconnect. You will use DNS for cymbalbank.com, and also acts as a forwarding zone to the
Google Cloud DNS for Cymbal’s public on-premise DNS for corp.cymbalbank.com DNS requests.
DNS zone at cymbalbank.com, and also B. Create a Cloud DNS private managed zone for gcp.cymbalbank.com, a
for private DNS for resources at public managed zone for cymbalbank.com, and a third forwarding zone for
gcp.cymbalbank.com. You will use corp.cymbalbank.com that forwards DNS requests to the on-premise DNS.
Cymbal’s on-premises DNS, which is
configured as authoritative for C. Create a Cloud DNS private managed zone for gcp.cymbalbank.com that
on-premises private resources at also forwards DNS requests for corp.cymbalbank.com to the on-premises
corp.cymbalbank.com. DNS, and a public managed zone for cymbalbank.com.
D. Create a Cloud DNS private managed zone for gcp.cymbalbank.com, and a
Which Cloud DNS managed zone
public managed zone for cymbalbank.com that also forwards DNS requests
configuration will satisfy the
for corp.cymbalbank.com to the on-premises DNS.
requirements?
3.4 Diagnostic Question 07

You are configuring hybrid DNS for A. For the VPC in one of the projects,
Google Cloud using Cloud DNS and create a Cloud DNS forwarding zone for
your on-premises DNS. You have three its VPC. For the VPC in each of the other
VPC networks in Google Cloud in three projects, create a Cloud DNS peering zone that targets the
different projects that will need to VPC with the forwarding zone.
forward DNS requests for a particular B. Create a forwarding zone in one of the projects that is visible to
private domain to the on-premises the VPCs in all of the projects.
DNS. All 3 projects have Cloud VPN
C. Create a forwarding zone in each of the projects that is visible
connections to the on-premises
to the VPC in that project.
network.
D. Create a forwarding zone and a peering zone in each project.
Select the Google recommended approach Make the forwarding zone visible to the VPC in the same
for enabling this requirement. project and the peering managed zones associated with the
VPCs in the other projects.
3.4 Configuring and maintaining Cloud DNS

Documentation

Cloud DNS overview Name resolution order | Cloud DNS

General DNS overview DNS policies overview
DNS best practices Cross-project binding zones |
Key terms | Cloud DNS Cloud DNS

Manage zones | Cloud DNS DNS server policies

Manage records | Cloud DNS Manage response policies and rules |

Cloud DNS
DNS Security Extensions
(DNSSEC) overview Manage DNS routing policies
3.5 Diagnostic Question 08

Cymbal is using Cloud NAT to provide A. Set the minimum ports per VM to 1000
internet connectivity to a group of VMs and the number of IP addresses used by
in a subnet. There are 500 VMs in the the Cloud NAT Gateway to 8.
subnet and each VM may have up to B. Set the minimum ports per VM to 2000 and the number of IP
1000 internet bound connections addresses used by the Cloud NAT Gateway to 8.
simultaneously.
C. Set the minimum ports per VM to 2000 and the number of IP
addresses used by the Cloud NAT Gateway to 10.
D. Set the minimum ports per VM to 1000 and the number of IP
What Cloud NAT configuration will addresses used by the Cloud NAT Gateway to 6.
support this requirement?
3.5 Configuring Cloud NAT

Courses Documentation

Cloud NAT overview

Cloud NAT address and port overview
Networking in Google Cloud Networking in Google Cloud: Configure Cloud NAT
● M7 Network design and Hybrid connectivity and network Example Compute Engine setup | Cloud NAT
deployment management Using Cloud NAT rules
● M3 Network design and
deployment
3.6 Diagnostic Question 09

You are designing a system A. Create the 2 subnets in the same VPC. Create a VM
in Google Cloud to ensure running the 3rd party scanning software in one of the
all traffic being sent subnets. Create custom routes in the VPC to send traffic for
between two subnets is each subnet from the opposite subnet through that VM.
passed through a security B. Create the 2 subnets in the same VPC. Create a VM running the 3rd party scanning software in
gateway VM. The VM runs each of the subnets. Create custom routes in the VPC to send traffic destined for each subnet
3rd party software that originating in the opposite subnet through the VM in its subnet.
scans traffic for known C. Create the 2 subnets in 2 separate VPCs. Create a VM with 2 network interfaces (NICs), with
attack signatures, then each NIC connected to the subnet in each VPC. Create custom routes in each VPC to send
forwards or drops traffic traffic destined for each subnet originating in the opposite subnet through the VM.
based on the scan results. D. Create the 2 subnets in the same VPC. Create 2 VMs running the 3rd party scanning software,
with one in each of the subnets. Create custom routes in the VPC to send traffic destined for
each subnet originating in the opposite subnet through the VM in the opposite subnet.
Which configuration satisfies
these requirements?
3.6 Diagnostic Question 10

A. A packet mirroring policy and a collector instance

Select the list of the resources that
must be created or configured to B. A packet mirroring policy, An internal TCP/UDP load balancer
enable packet mirroring. configured for packet mirroring, an instance group of collector
instances, and firewall rules
C. A packet mirroring policy, a collector instance, and firewall
rules
D. A packet mirroring policy, an instance group of collector
instances, and firewall rules
3.6 Configuring network packet inspection

Courses Skill Badges Documentation

Networking in Google Cloud
● M1 Google Cloud VPC networking Multiple network interfaces overview and
fundamentals examples | VPC
● M3 Sharing networks across projects Google Cloud
● M7 Network design and deployment Creating instances with multiple network
interfaces | VPC
● M8 Network monitoring and Security and Identity
troubleshooting Fundamentals Quest Internal TCP/UDP load balancers as next
hops | Load Balancing
Networking in Google Cloud: Defining
and implementing networks Setting up Internal TCP/UDP Load Balancing
● M1 Google Cloud VPC networking for third-party appliances
fundamentals Packet Mirroring overview | VPC
● M3 Sharing networks across projects
Networking in Google Cloud: Hybrid
Using Packet Mirroring | VPC
connectivity and network management Monitoring Packet Mirroring | VPC
● M3 Network design and deployment
● M4 Network monitoring and
troubleshooting
Section 4:
Implementing hybrid
interconnectivity
4.1 Diagnostic Question 01

Cymbal Bank is configuring a A. Establish connection to selected partner service

Layer 3 Partner Interconnect provider. Create and activate VLAN attachments and receive
connection to Google Cloud. Google-generated pairing keys. Request connections for
VLAN attachments providing pairing keys.
B. Establish connection to selected partner service provider. Create and activate VLAN
attachments and receive Google-generated pairing keys. Request connections for
VLAN attachments from partner specifying region and capacity and providing
attachment pairing key. Configure BGP for on-premises routers.
C. Establish connection to selected partner service provider. Create VLAN attachments
Select the sequence of and receive Google-generated pairing keys. Request connections for VLAN
high-level activities you will attachments from partner specifying region and capacity and providing attachment
need to perform in order to pairing key. Activate VLAN attachments. Configure BGP for on-premises routers.
accomplish this. D. Establish connection to selected partner service provider. Create VLAN attachments
and receive Google-generated pairing keys. Request connections for VLAN
attachments from partner specifying region and capacity and providing attachment
pairing key. Activate VLAN attachments.
4.1 Diagnostic Question 02

You are setting up a Dedicated Interconnect connection A. 1 200 Gbps circuit

and need to provide the highest capacity possible. B. 2 100 Gbps circuits
C. 8 10 Gbps circuits
D. 8 50 Gbps circuits

Select the circuit configuration that achieves this.

4.1 Diagnostic Question 03

Cymbal Bank wants to achieve 99.9% A. 2 100 Gbps connections in separate edge availability zones of
availability with Dedicated the co-location facility, 4 50 Gbps VLAN attachments
Interconnect. You want to support 100 B. 2 100 Gbps connections in separate edge availability zones of
Gbps of throughput, even if a single the co-location facility, 2 100 Gbps VLAN attachments
interconnect connection were to fail.
C. 1 200 Gbps connection in a single edge availability zone of the
co-location facility, 4 50 Gbps VLAN attachments
What is the simplest and least D. 2 50 Gbps connections in separate edge availability zones of
expensive configuration that can the co-location facility, 4 25 Gbps VLAN attachments
meet these requirements?
 Proprietary + Confidential

Configuring Google Cloud Documentation

4.1 Interconnect Best practices for Cloud Interconnect
Key terms | Cloud Interconnect
Partner Interconnect overview

Courses Partner Interconnect provisioning overview

Creating VLAN attachments | Cloud Interconnect
Requesting connections | Cloud Interconnect
Activating connections | Cloud Interconnect

Networking in Google Cloud Networking in Google Cloud: Configuring on-premises routers | Cloud
● M5 Hybrid connectivity Hybrid connectivity and network Interconnect Best practices for Cloud Interconnect

management Creating VLAN attachments | Cloud Interconnect

● M1 Hybrid connectivity Creating VLAN attachments | Cloud Interconnect
Establishing 99.99% availability for Dedicated
Interconnect
Establishing 99.99% availability for Partner
Interconnect
Establishing 99.9% availability for Dedicated
Interconnect
Establishing 99.9% availability for Partner
Interconnect
4.2 Diagnostic Question 04

Cymbal Bank is connecting A. Create the Cloud Routers in the Shared VPC
one of their Shared VPC host project and the VLAN attachments in
networks to their the Shared VPC service projects.
on-premises network via B. Create the VLAN attachments and Cloud Routers in the Shared VPC
Dedicated Interconnect. host project.
C. Create the VLAN attachments in the Shared VPC host project and the
Cloud Routers in the Shared VPC service projects.

Select the recommended D. Create the VLAN attachments and Cloud Routers in the Shared VPC
approach for configuring service projects.
their VLAN attachments and
Cloud Routers.
4.2 Diagnostic Question 05

Cymbal Bank is connecting a branch A. Configure an HA VPN gateway to connect to the on-premises
office with an old VPN gateway that gateway and use dynamic routing.
doesn’t support BGP. The old VPN B. Configure a Classic VPN gateway to connect to the on-premises
gateway only supports IKEv1 and does gateway using static routing with a route-based tunnel.
not support local and remote traffic
C. Configure a Classic VPN gateway to connect to the on-premises
selectors to be configured as
gateway using static routing with a policy-based tunnel with
0.0.0.0/0.
local and remote traffic selectors matching the office VPN but
reversed.
Which configuration option can
D. Configure a Classic VPN gateway to connect to the on premise
satisfy these requirements?
gateway and use dynamic routing.
4.2 Diagnostic Question 06

You are using the gcloud tool to A. A Cloud Router with default route advertisements
create a Classic VPN with static B. A Cloud Router with a custom route advertisements including
routing and a route-based tunnel. The the range 192.168.1.0/24
on-premises resources are all in the
C. A route with destination 192.168.1.0/24 and next hop set to the
192.168.1.0/24 range. You have issued
VPN gateway
commands to create the VPN
gateway, IP addresses, forwarding D. A route with destination 0.0.0.0/0 and next hop set to the VPN
rules, and the VPN tunnel. gateway

Select the correct final resource

that must be created.
4.2 Diagnostic Question 07
Cymbal Bank is connecting a branch A. An external VPN gateway resource with
office with a modern VPN gateway that 2 interfaces, a Cloud Router in the same
supports BGP to Google Cloud in a region, a cloud HA VPN gateway with one tunnel
region. The office VPN gateway has two from each interface to each external VPN gateway interface, and BGP
interfaces and only requires a single sessions for both tunnels
tunnel to each to provide 99.99% B. An external VPN gateway resource with 2 interfaces, 2 Cloud Routers in the
availability. same region, a cloud HA VPN gateway with one tunnel from each interface to
each external VPN gateway interface, and BGP sessions for both tunnels
C. An external VPN gateway resource with 4 interfaces, a Cloud Router in the
same region, 2 cloud HA VPN gateway with one tunnel from each interface to
Select the simplest Google Cloud VPN each external VPN gateway interface, and BGP sessions for all 4 tunnels
configuration that will provide 99.99% D. An external VPN gateway resource with 4 interfaces, 2 Cloud Routers in the
availability. same region, 2 cloud HA VPN gateways with one tunnel from each interface to
each external VPN gateway interface, and BGP sessions for all 4 tunnels
 Proprietary + Confidential

Configuring a site-to-site
4.2 IPsec VPN

Courses Skill Badges Documentation

Networking in Google Cloud VPC Network Peering overview

● M4 Load balancing Shared VPC overview

Google Cloud
● M7 Network design and Enabling multiple VPC networks to access the
deployment Network Performance same VLAN attachment
and Optimization Quest Cloud VPN overview
Networking in Google Cloud:
Defining and implementing Creating a Classic VPN using static routing
networks Networks and tunnel routing | Cloud VPN

● M4 Load balancing HA VPN topologies

Creating an HA VPN gateway to a peer VPN
Networking in Google Cloud: gateway
Hybrid connectivity and network
management
● M3 Network design and
deployment
4.3 Diagnostic Question 08

You have an HA VPN gateway with 2 A. Remove the BGP session for one of the HA VPN tunnels.
interfaces in active/active mode. You B. Disable the BGP session for one of the HA VPN tunnels.
would like to reconfigure them to
C. Update the base advertised route priorities for both of the
active/passive mode.
HA VPN tunnels’ BGP sessions.
D. Update the base advertised route priority for one of the
HA VPN tunnel’s BGP sessions.

What is the simplest configuration

change that will satisfy this
requirement?
4.3 Diagnostic Question 09
Cymbal Bank has a Cloud Router in a A. Update the Cloud Router custom
region; the VPC advertises some of its advertisements by advertising the IP ranges
subnets. The VPC advertises none of the for all the subnets across all regions, then
subnets in other regions. You require an update the configured list whenever subnets are added or removed.
update to advertise all subnets in all B. Check the dynamic routing mode of the VPC and update it to global if it
regions for that VPC. You also want to is currently regional. Update the Cloud Router custom advertisements by
automatically advertise newly added advertising the IP ranges for all the subnets across all regions, then
subnets, as well as stop advertising update the configured list whenever subnets are added or removed.
removed subnets in the future. C. Check the dynamic routing mode of the VPC and update it to global if it
is currently regional. Configure the Cloud Router to default
advertisement mode.
Select the simplest configuration that
D. Check the dynamic routing mode of the VPC and update it to regional if
will accomplish this goal.
it is currently global. Configure the Cloud Router to default
advertisement mode.
4.3 Diagnostic Question 10

Cymbal Bank would like to achieve A. 1 Cloud Router in one region with the VPC in regional
99.99% availability for their Dedicated dynamic routing mode
Interconnect link from an on-premises B. 2 Cloud Routers in one region, with the VPC in global
network to their VPC. dynamic routing mode
C. 2 Cloud Routers in 2 distinct regions, with the VPC in
regional dynamic routing mode
D. 2 Cloud Routers in 2 distinct regions, with the VPC in
Select the configuration that will global dynamic routing mode.
achieve this.
 Proprietary + Confidential

Documentation
4.3 Configuring Cloud Router Cloud Router overview
Creating Cloud Routers
Establishing BGP sessions | Cloud Router
Courses Skill Badges Updating the base advertised route priority |
Cloud Router
Networking in Google Cloud Custom route advertisements introduction |
● Course labs Cloud Router
Google Cloud
Advertising custom IP ranges | Cloud Router
Network Performance Advertising specific VPC subnets | Cloud Router
Networking in Google Cloud: and Optimization Quest
Creating an HA VPN gateway to a peer VPN
Defining and implementing
gateway
networks
Establishing 99.99% availability for Dedicated
● Course labs Interconnect
Establishing 99.99% availability for Partner
Networking in Google Cloud: Interconnect
Hybrid connectivity and network
Establishing 99.9% availability for Dedicated
management
Interconnect
● Course labs Establishing 99.9% availability for Partner
Interconnect
Section 5:
Managing, monitoring, and
optimizing network
operations
5.1 Diagnostic Question 01

Cymbal Bank needs to log all cache hits and A. Enable logging on the backend bucket
misses for their static assets served from and configure logging sample rate to 1.0.
Cloud CDN via an HTTP(S) load balancer B. Use the default behavior, no configuration required.
backend bucket.
C. Enable logging on the backend bucket.
D. Configure the logging sample rate on the backend
What should you do? bucket to 1.0.
5.1 Diagnostic Question 02

You are designing a A. vpn.googleapis.com/network/sent_bytes_count,

monitoring alert to notify vpn.googleapis.com/network/received_bytes_count,
you when a Cloud VPN vpn.googleapis.com/network/sent_packets_count,
tunnel approaches the
B. vpn.googleapis.com/network/received_packets_count
limits for bandwidth. vpn.googleapis.com/network/dropped_received_packets_count,vpn.googleapis.com
/network/network/dropped_sent_packets_count

C. vpn.googleapis.com/network/sent_bytes_count,
Select the metrics that vpn.googleapis.com/network/received_bytes_count
would be important
to include in the D. vpn.googleapis.com/network/sent_packets_count,
vpn.googleapis.com/network/received_packets_count,
alerting policies.
vpn.googleapis.com/network/dropped_received_packets_count,
vpn.googleapis.com/network/network/dropped_sent_packets_count
 Proprietary + Confidential

Logging and monitoring with

5.1 Google Cloud’s operation suite

Courses Skill Badges Documentation

Networking in Google Cloud HTTP(S) Load Balancing logging and

● M8 Network monitoring and monitoring
troubleshooting Google Cloud
Viewing Cloud Router logs and metrics
Network Performance Using logging and monitoring | Cloud NAT
and Optimization Quest
Networking in Google Cloud: Viewing logs and metrics | Cloud VPN
Hybrid connectivity and Audit Logging | VPC Service Controls
network management
Google Cloud Armor audit logging
● M4 Network monitoring
information
and troubleshooting
Using request logging
Monitoring connections | Cloud
Interconnect
Monitoring Google Cloud Armor security
policies
Google Cloud metrics | Cloud Monitoring
5.2 Diagnostic Question 03

Cymbal Bank has set up A. Enable the Firewall Insights API. Enable the Firewall
firewall rules for a VPC. Rules logging for all rules. Configure an observation
You want to monitor them period starting immediately and lasting 24h. After 24h have passed, view the Firewall
Insights Deny rules with hits page.
to determine which Deny
rules are triggering to B. Enable the Firewall Insights API. Configure an observation period starting
block traffic over the next immediately and lasting 24h. After 24h have passed, view the Firewall Insights Deny
24 hours. rules with hits page.

C. Enable the Firewall Insights API. After 24h have passed, view the Firewall Insights
Select the simplest Deny rules with hits page.
setup and process to
D. Enable Firewall Rules logging for all rules. Configure an observation period starting
accomplish this.
immediately and lasting 24h. After 24h have passed, view the Firewall Insights Deny
rules with hits page.
5.2 Diagnostic Question 04
Cymbal Bank needs to do A. Use the Policy Troubleshooter to test each user
an analysis to verify which and group against the VPC and each of the
users and groups have permissions in the Network Admin role.
been given the Network
B. Use the Policy Simulator to simulate providing the Network Admin role to
Admin role for a particular
each user and group. Review the results to determine which identities
VPC network. would have access changes.

C. Use the Policy Analyzer with scope set to Organization, and resource set to
the VPC, and role set to Network Admin.

Select the simplest D. Use the Policy Analyzer with scope set to Organization, resource set to the
setup and process to VPC, role set to Network Admin, and identity set to all users and groups.
accomplish this.
 Proprietary + Confidential

Managing and maintaining

5.2 security

Courses Skill Badges Documentation

Networking in Google Cloud Firewall Rules Logging overview | VPC

● M8 Network monitoring and Using Firewall Rules Logging | VPC
troubleshooting Google Cloud
Firewall Insights overview

Build and Secure Working with common use cases | Firewall

Networks in Google Insights
Networking in Google Cloud: Cloud Quest Troubleshooting access | Cloud IAM
Hybrid connectivity and Documentation
network management Policy Intelligence tools | Cloud IAM
● M4 Network monitoring Documentation
and troubleshooting
Google Cloud Analyzing IAM policies | Cloud Asset Inventory
Documentation

Network Performance Policy Simulator | Cloud IAM Documentation

and Optimization Quest Enforce least privilege with role
recommendations

Testing permissions | Cloud IAM Documentation

5.3 Diagnostic Question 05

You are using VPC flow logs to analyze A. Configure them with a sampling rate of 0.1 and a filter expression for the
traffic arriving at a subnet. You need to connection source and destination IP within the IP range of the subnet.
capture approximately 10% of the traffic
B. Configure them with a sampling rate of 1.0 and a filter expression for the
and determine how much traffic
connection source and destination IP within the IP range of the subnet.
originates from outside the subnet. The
VPC flow logs have already been enabled C. Configure them with a sampling rate of 0.1 and a filter expression for the
for the subnet. You want to use the least connection destination IP within the IP range of the subnet.
expensive process.
D. Configure them with a sampling rate of 1.0 and a filter expression for the
connection destination IP within the IP range of the subnet.

How should you configure the

VPC flow logs?
5.3 Diagnostic Question 06
Cymbal Bank has configured a Classic VPN with a
policy-based tunnel to connect to a branch office with A. Investigate the Cloud Router
an older VPN device that does not support BGP. You configuration for advertised subnets.
have completed the configuration of the office VPN
and the logs and monitoring suggest that the tunnel is B. Investigate the Cloud Router BGP session status.
up and functioning correctly. You find when testing
C. Investigate the configuration of the local and remote traffic
with ping and traceroute that you can reach some
selectors in the Classic VPN tunnel and office VPN configuration.
VMs but not others in the VPC across the tunnel from
the office. You can reach some servers but not others D. Search the Classic VPN tunnel logs for IKE events indicating a
in the office from VMs in the VPC. You have verified problem.
the firewall configurations in both environments and
determined that is not the cause of the problem.

What is the next troubleshooting step you

should attempt?
5.3 Diagnostic Question 07

You are debugging a Layer 2 Partner A. Check the ASN configuration of the on-premises router
Interconnect connection that is indicating a and the Cloud Router.
failure to create a BGP session in the Cloud
B. Check the BGP keepalive timer configuration of the
Router for the associated VLAN attachments.
Cloud Router.

C. Check the route advertisement configuration of the

Select the most likely cause to investigate Cloud Router.
when troubleshooting this issue.
D. Check the route configuration of the VPC the Cloud
Router is in.
 Proprietary + Confidential

Maintaining and troubleshooting

5.3 connectivity issues

Courses Skill Badges Documentation

Networking in Google Cloud VPC Flow Logs overview

● M8 Network monitoring and Using VPC Flow Logs
troubleshooting Google Cloud
Viewing logs and metrics | Cloud VPN
Network Performance Troubleshooting | Cloud VPN
and Optimization Quest
Networking in Google Cloud: Viewing Cloud Router logs and metrics
Hybrid connectivity and Troubleshooting | Cloud Router
network management
Troubleshooting | Cloud Interconnect
● M4 Network monitoring
and troubleshooting
5.4 Diagnostic Question 08

You are trying to debug a connectivity issue A. Disable Firewall rules one by one in all combinations to
between VMs in the same VPC using internal determine the problem.
IP addresses. The issue began immediately
B. Remove static routes one by one in all combinations to
after configuring routes and firewall rules.
determine the problem.

C. Review the packet loss statistics in the Network

What should you do to troubleshoot intelligence performance dashboard.
the problem?
D. Create and run a Network intelligence connectivity test to
determine the problem.
5.4 Diagnostic Question 09

Cymbal Bank would like to get a high level A. Network Topology

topological graph of their Google Cloud
network infrastructure. You also want to see B. Performance Dashboard
the typical latencies and throughputs of
C. VPC flow logs
traffic between elements of the
infrastructure. D. Packet mirroring

What is the best tool for this purpose?

 Proprietary + Confidential

Monitoring, maintaining, and troubleshooting

5.4 latency and traffic flow

Courses Skill Badges Documentation

Calculating network throughput
Networking in Google Cloud
Using netperf and ping to measure network
● M8 Network monitoring and latency
troubleshooting Google Cloud
Performance Dashboard overview
Network Performance and
Optimization Quest Network Topology metrics reference

Networking in Google Cloud: Google Cloud Performance Kit Benchmarker

Hybrid connectivity and Routes overview | VPC
network management Troubleshooting VM-VM connectivity with internal
Google Cloud
● M4 Network monitoring IP addresses | VPC
and troubleshooting Security and Identity
Troubleshooting | Cloud Router
Fundamentals Quest
Connectivity Tests overview

Performance Dashboard overview

Firewall Insights overview

Google Cloud
Network Topology overview
Build and Secure Networks
Network Topology metrics reference
in Google Cloud Quest
Connectivity Tests overview
 When will you take the exam?

Plan time How many weeks do you have to

prepare?

to prepare How many hours will you spend

preparing for the exam each week?

How many total hours will you

prepare?
Example 6-week plan

Week 1 Week 2 Week 3 Week 4 Week 5 Week 6

Google Cloud Networking in Networking in Build and secure Network Sample questions
Fundamentals: Google Cloud: Google Cloud: networks in performance and
Core Defining and Hybrid Google Cloud optimization Skill
Infrastructure implementing connectivity and Skill Badge Badge Review
networks network documentation
management Security and
Identity
Fundamentals
Skill Badge
Weekly study plan

Now, consider what you’ve learned about your knowledge and skills
through the diagnostic questions in this course. You should have a
better understanding of what areas you need to focus on and what
resources are available.

Use the template that follows to plan your study goals for each week.
Consider:
● What exam guide section(s) or topic area(s) will you focus on?
● What courses (or specific modules) will help you learn more?
● What Skill Badges or labs will you work on for hands-on practice?
● What documentation links will you review?
● What additional resources will you use - such as sample
questions?
You may do some or all of these study activities each week.

Duplicate the weekly template for the number of weeks in your

individual preparation journey.
Weekly study template (example)

Area(s) of focus: Configuring VPCs

Courses/modules Networking in Google Cloud: Defining and implementing networks M1, M2, M3
to complete: Networking in Google Cloud: Hybrid connectivity and network management M3

Skill Badges/labs Security and Identity Fundamentals Quest

to complete:

Documentation VPC network overview

to review: Using VPC networks
VPC firewall rules overview
Using firewall rules | VPC

Additional study: Sample questions 1-3

Weekly study template

Area(s) of focus:

Courses/modules
to complete:

Skill Badges/labs
to complete:

Documentation
to review:

Additional study: