Cloud Engineer Cloud Engineer Networking & Connectivity 2 — Questions and Answers
Question 1: What is the main difference between a regional and a global external HTTP(S) load balancer?
- Global LB uses Anycast IPs and routes to the nearest backend; regional LB is confined to one region (Correct answer)
- Global LB only supports HTTP; regional LB supports HTTPS
- Regional LB uses Anycast; global LB uses unicast IPs
- There is no difference — they use the same infrastructure
Correct answer: Global LB uses Anycast IPs and routes to the nearest backend; regional LB is confined to one region
The global HTTP(S) LB uses Anycast to route users to the closest healthy backend worldwide, while the regional version serves traffic within a single region.
Question 2: Which VPC firewall rule component is used to apply the rule only to specific VM instances?
- Source IP ranges
- Target tags or target service accounts (Correct answer)
- Priority value
- Protocol and port
Correct answer: Target tags or target service accounts
Target tags (or target service accounts) on a firewall rule ensure it applies only to VM instances that carry the matching network tag or service account.
Question 3: Your organization uses Shared VPC. Where must the Shared VPC host project's subnets be configured?
- In each service project separately
- In the host project, then shared to service projects (Correct answer)
- In the organization resource node
- In a dedicated networking project outside the Shared VPC structure
Correct answer: In the host project, then shared to service projects
In a Shared VPC setup, subnets are created and managed in the host project and then shared with one or more service projects, centralizing network administration.
Question 4: What Cloud Armor policy type protects against common web attacks like SQL injection and cross-site scripting?
- Adaptive Protection policy
- WAF (Web Application Firewall) preconfigured rules (Correct answer)
- Rate-based rules
- Custom IP allow/deny rules
Correct answer: WAF (Web Application Firewall) preconfigured rules
Cloud Armor includes preconfigured WAF rules based on OWASP ModSecurity Core Rule Set to block common web exploits like SQLi and XSS.
Question 5: Which networking mode allows a GCP VM to receive packets destined for IP addresses other than its own (used for NAT VMs or VPN gateways)?
- Promiscuous mode
- IP forwarding (Correct answer)
- Alias IP ranges
- Multi-NIC mode
Correct answer: IP forwarding
Enabling IP forwarding on a VM instance allows it to route and forward packets whose destination IP does not match the VM's own IP address.
Question 6: What is the purpose of a Cloud Router in Google Cloud networking?
- Route traffic between subnets in the same VPC
- Dynamically exchange routing information with on-premises networks via BGP (Correct answer)
- Act as a software-defined firewall
- Balance traffic between multiple backend VMs
Correct answer: Dynamically exchange routing information with on-premises networks via BGP
Cloud Router uses BGP (Border Gateway Protocol) to dynamically advertise and learn routes between your VPC and on-premises networks connected via VPN or Interconnect.
Cloud Engineer Cloud Engineer Networking & Connectivity 2
What is the main difference between a regional and a global external HTTP(S) load balancer?