PCNE question patterns

External passthrough Network Load Balancer (regional).

Proxy load balancers terminate the connection, so backends see the proxy address.

Global external Application Load Balancer in Premium Tier with a URL map.

It is the only option that is global, layer 7 and URL-map aware.

Global external proxy Network Load Balancer.

Passthrough LBs have no global form and Application LBs only handle HTTP(S).

Regional internal Application Load Balancer with a proxy-only subnet.

External LBs are reachable from the internet; passthrough has no layer 7 routing.

Shared VPC with Compute Network User granted on individual subnets.

Subnet-level grants limit each service project to its own subnets.

Network Connectivity Center with VPC spokes (mesh) instead of VPC peering.

Peering is non-transitive, so a hub peering never links spokes.

Private NAT (with NCC) or Private Service Connect to publish only the needed service.

Peering and VPN need non-overlapping ranges.

Private services access plus a Cloud Router custom advertisement of the allocated range and custom route export on the peering.

PSA is a non-transitive peering, so on-premises needs the range advertised.

A PSC endpoint to the producer's service attachment.

PSC uses one internal IP and does not need non-overlapping ranges or peering.

Direct VPC egress, or a Serverless VPC Access connector on a /28 subnet.

Serverless runs outside your VPC by default.

Expand the subnet's primary range with expand-ip-range.

Subnets can grow in place but can never shrink.

Align MTU or clamp TCP MSS; VPC default is 1460 and VPN gateway MTU 1460.

Tunnel overhead reduces the payload size and fragmented packets drop.

Multi-NIC VMs behind an internal passthrough Network LB used as the next hop of a custom route.

The LB health-checks and distributes to appliances; a single VM is a single point of failure.

Add an additional Pod IPv4 range to the cluster or node pool.

Existing ranges cannot be shrunk and a new cluster is unnecessary.

Use the control plane DNS endpoint secured with IAM.

It is reachable over HTTPS from anywhere and enforced by IAM and VPC-SC.

Create the cluster with GKE Dataplane V2.

Cilium-based, includes policy enforcement and cannot be enabled later.

Cloud NAT for node and Pod ranges (or Private Google Access for Google registries).

Nodes without external IPs have no direct egress.

Dedicated Interconnect with VLAN attachments.

Direct physical link at 10 or 100 Gbps.

Partner Interconnect (layer 2 if you want to run BGP yourself).

A service provider carries the link; attachments are 50 Mbps to 50 Gbps.

Cross-Cloud Interconnect, or HA VPN if bandwidth is small.

Google provisions the link at 10 or 100 Gbps.

Four Interconnect connections across two metros and two regions with global dynamic routing.

Two connections in one metro only reach 99.9%.

HA VPN with two tunnels on both interfaces to a redundant peer using BGP.

A single peer interface only reaches 99.9%.

MACsec on the Dedicated connection.

It encrypts at layer 2 without the IPsec throughput limit.

IPsec tunnels over encrypting VLAN attachments.

MACsec is not available for Partner Interconnect.

Advertise VPN routes with a higher MED (less preferred) than Interconnect routes.

Lower MED wins; VPN is used only on failure.

Enable BFD on both sides.

It detects failure in about a second versus BGP hold timers.

A PSC endpoint for Google APIs or private/restricted.googleapis.com advertised from Cloud Router.

Public API addresses would use the internet.

NCC with router appliance and hybrid spokes plus site-to-site data transfer.

It turns Google's network into the transit WAN.

Inbound server policy and on-premises forwarding to the entry point IPs.

On-premises resolvers cannot see private zones by themselves.

A private forwarding zone to the on-premises servers, with 35.199.192.0/19 allowed and advertised.

Cloud DNS queries originate from that range.

Peering zones from spokes to a hub VPC that holds forwarding zones.

One place to manage; peering is one hop only.

Bind the private zone to the other projects' VPCs.

No copying of zones across Shared VPC service projects.

Same-named public and private zones.

The private zone takes precedence for attached VPCs.

Failover routing policy tied to internal load balancer health with a low TTL.

Health is read from the LB.

Custom static route with network tags and a lower priority number.

Tags limit the route to selected VMs.

Policy-based route to the internal LB.

PBR is evaluated before regular routes.

Enable export on the hub and import on spokes.

Default peering shares only subnet routes.

Star topology with a center group and edge group.

Edge spokes are isolated from each other.

Cloud Armor preconfigured WAF rules (sqli, xss) with the right sensitivity.

The edge filters before traffic hits the backend.

Cloud Armor Enterprise advanced network DDoS protection with a network edge security policy.

Backend policies only cover proxy LBs.

Cloud Armor throttle, or rate-based ban for repeat offenders.

Throttle returns 429; a ban blocks the key for a period.

Hierarchical firewall policy with allow or deny.

Evaluated before project rules; goto_next delegates.

Secure tags (IAM-controlled) in network firewall policy.

Network tags can be set by any VM editor.

Cloud NGFW Enterprise: firewall endpoints, security profile group, TLS inspection.

It provides layer 7 IPS.

Secure Web Proxy policy with URL matchers.

It filters web egress by URL and identity.

Allow 130.211.0.0/22 and 35.191.0.0/16 (and the proxy-only subnet).

Probes are blocked by the implied deny.

Add NAT IPs, raise min ports or turn on dynamic port allocation.

Ports are consumed per destination.

A perimeter with restricted services, tested in dry-run first.

IAM alone does not stop stolen credentials.

Network Intelligence Center Connectivity Tests.

It traces routes, firewall rules and LBs.

Packet Mirroring to an internal passthrough LB collector in the same region.

Flow logs only hold metadata.