Sample questions
Gcp Networking VpcDifficulty 1
In Google Cloud, what is the scope of a VPC network resource itself (not its subnets)?
- aZonal — a VPC network exists in exactly one zone
- bGlobal — spans all regions without VPN or peering✓
- cRegional — a VPC network exists in exactly one region
- dProject-less — a VPC network is not tied to any single project
Explanation:A VPC network in GCP is a global resource: it is not confined to any single region or zone, and its subnets can be created in any region worldwide under the same network, all reachable without VPN or peering.
Gcp Networking VpcDifficulty 1
What is the scope of a subnet within a GCP VPC network — the key structural difference from AWS's subnet model?
- aZonal — a subnet exists in exactly one availability zone
- bGlobal — a subnet's IP range is usable from any region
- cRegional — spans all zones within one region✓
- dMulti-regional — a subnet can span two adjacent regions for HA
Explanation:Unlike AWS (where a subnet is zonal), a GCP subnet is a regional resource: its IP range is available to resources in any zone within that region, so a single subnet already spans multiple zones for redundancy.
Gcp Networking VpcDifficulty 1
What is the difference between an auto mode and a custom mode VPC network at creation time?
- aAuto mode creates one subnet per region automatically; custom mode starts empty and you create subnets manually✓
- bAuto mode creates subnets only in the region you specify; custom mode creates subnets in every region automatically
- cAuto mode and custom mode are identical except for billing — custom mode is more expensive
- dAuto mode disables firewall rules by default; custom mode enables them
Explanation:An auto mode network automatically creates one subnet in each GCP region using a predefined IP range for each; a custom mode network starts with zero subnets, requiring you to explicitly create subnets with the region and IP ranges you choose.
Gcp Networking VpcDifficulty 2
By default, what does GCP's implied firewall rule set do for a VPC network with no explicit rules added?
- aIt implicitly allows all ingress and denies all egress
- bIt implicitly allows all ingress and all egress
- cIt implicitly denies all egress and all ingress equally, with no distinction
- dIt implicitly denies all ingress and implicitly allows all egress✓
Explanation:Every VPC network has two implied rules that cannot be removed: an implied deny-all for ingress (lowest possible priority) and an implied allow-all for egress (lowest possible priority) — explicit rules you add can override these by using a higher priority (lower number).
Gcp Networking VpcDifficulty 2
In GCP firewall rule priority numbering, which rule takes effect when two rules match the same traffic?
- aThe rule with the higher numeric priority value always wins
- bThe rule with the lower numeric priority value wins — priority ranges from 0 (highest) to 65535 (lowest)✓
- cPriority numbers are only advisory; GCP always applies deny rules before allow rules regardless of number
- dTies are broken alphabetically by rule name
Explanation:GCP firewall rule priority is an integer from 0 to 65535, where a LOWER number means HIGHER priority. When multiple rules match the same traffic, the rule with the lowest priority number is applied.
Gcp Networking VpcDifficulty 1
At what scope are GCP firewall rules defined and applied?
- aAt the VPC network level — applies network-wide via tags or service accounts✓
- bAt the subnet level — each subnet has its own independent firewall rule set
- cAt the individual instance level only — rules must be attached one-by-one to each VM
- dAt the zone level — rules apply only within a single zone
Explanation:GCP firewall rules are defined at the VPC network level (not per-subnet like AWS Security Groups/NACLs). A rule can target all instances in the network, or be scoped to specific instances using target tags or target service accounts.