GCP ACE Practice / Study guide / Topics / VPC Networking & Load Balancing
VPC Networking & Load Balancing
What actually gets tested on the Google Cloud Associate Cloud Engineer exam,
the traps to know, and 6 free sample questions with full explanations.
VPC firewall rules default-deny ingress and default-allow egress; a missing ingress rule, not a broken application, is the exam's most common explanation for why a connection "fails" in a scenario question. Rules are evaluated by priority, matched on source ranges and target tags, and — like IAM — this is a topic where knowing the default behavior matters more than memorizing every parameter.
VPC Peering (and most hybrid-connectivity setups) breaks or blackholes traffic when the two sides have overlapping IP ranges, so planning non-overlapping RFC 1918 space up front is the correct move whenever a question mentions connecting VPCs or an on-prem network. Cloud NAT is outbound-only — it lets private instances reach the internet without a public IP, but it does not accept inbound connections, which is a frequent wrong-answer trap when a question actually needs inbound access.
On load balancers, match the layer to the need: the global external Application Load Balancer is Layer 7 — one anycast IP worldwide, TLS termination, URL routing, CDN integration, cross-region failover. A passthrough Network Load Balancer is Layer 4, regional, handles arbitrary TCP/UDP, and preserves the original source IP, unlike the HTTP(S)-only ALB. An internal Application Load Balancer gives you the same L7 routing but scoped to private RFC 1918 addresses inside your VPC — the answer whenever a scenario needs HTTP routing that should never be reachable from the public internet.
Exam tips for this topic
- VPC firewalls default-deny ingress and default-allow egress — a missing ingress rule is the most common reason a scenario says a connection "fails."
- VPC Peering fails or blackholes with overlapping IP ranges; plan non-overlapping RFC 1918 space before connecting VPCs or hybrid networks.
- Cloud NAT is outbound-only — it never accepts inbound connections, which trips up questions that actually need something reachable from outside.
Sample questions — VPC Networking & Load Balancing
These 6 questions are drawn from our full bank of 658 to show the style and
depth you'll get in the app. Each comes with the full explanation you'd see after answering
in a real practice session.
Load balancing
A public website needs a single global anycast IP, HTTPS termination, and routing users to the nearest healthy backend region. Which load balancer?
- Global external Application Load BalancerCorrect
- Regional external passthrough Network Load Balancer
- Internal Application Load Balancer
- Cloud VPN
Why: The global external ALB is Layer 7: one anycast IP worldwide, TLS termination, URL routing, CDN integration, cross-region failover. Network LBs are regional/L4, internal LBs aren't for public traffic, and VPN is connectivity, not load balancing.
Networking
You plan subnets for three regions and future VPC peering with a partner using 10.1.0.0/16. What must you avoid?
- Overlapping CIDR ranges with the partner's 10.1.0.0/16 — peering needs non-overlapping rangesCorrect
- Using RFC 1918 private address space anywhere, since peered networks must use public ranges
- Having more than one subnet per region in the same VPC network
- Using /20 subnets, which are considered too large for peered networks
Why: VPC peering (and most hybrid connectivity) fails or blackholes with overlapping IP ranges, so plan around the partner's space. RFC 1918 is expected, multiple subnets per region are fine, and /20 is a normal size.
Load balancing
You must load-balance non-HTTP TCP traffic (a custom protocol on port 5000) to VMs in one region, preserving client source IPs. Which choice?
- External passthrough Network Load BalancerCorrect
- Global external Application Load Balancer
- Cloud CDN
- Serverless NEG
Why: Passthrough Network LB is Layer 4, handles arbitrary TCP/UDP, and passes packets through with the original source IP. The ALB is HTTP(S)-only; CDN caches HTTP content; a serverless NEG is a backend type, not a load balancer.
Networking
Which firewall rule model does a Google Cloud VPC use?
- Stateful allow/deny rules with priorities, applied VPC-wide, targeting tags or service accountsCorrect
- Stateless access control lists that are applied individually to each subnet in the network
- Per-VM iptables rules that you must configure yourself inside the guest operating system
- Deny-all egress by default, with allow-all ingress unless a rule explicitly blocks it
Why: VPC firewall rules are stateful, prioritized (0–65535), and target instances by tags or service accounts; the implied baseline is deny-all ingress, allow-all egress. Subnets don't carry ACLs, and OS firewalls are extra, not the mechanism.
Load balancing
Traffic between your internal microservice tiers (HTTP, private IPs only) should be load-balanced. Which product?
- Internal Application Load BalancerCorrect
- Global external Application Load Balancer
- Cloud NAT
- External passthrough Network Load Balancer
Why: The internal ALB provides L7 load balancing on private RFC 1918 addresses inside your VPC. External LBs expose public endpoints, and Cloud NAT is outbound-only address translation, not inbound balancing.
Networking
Google Cloud DNS is best described as:
- A scalable, managed authoritative DNS service supporting both public and private zonesCorrect
- A local DNS resolver that runs as a background agent on each individual VM
- Purely a domain registrar for buying and renewing domain names, nothing more
- A content delivery network that happens to also cache DNS record lookups
Why: Cloud DNS hosts public zones (internet-facing) and private zones (visible to chosen VPCs) with a 100% availability SLA. Domain registration is a separate (partner) function, and it doesn't cache/serve content like a CDN.
Practice this for real
The app has dozens more questions on this and every other topic, with instant scoring,
spaced repetition of what you get wrong, and progress tracking across sessions.
Start practicing →
This topic shows up in
Other topics