PCNE Practice Test 1 — 10 Questions

Question 1

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service perimeter. VPC Service Controls perimeters require: 1) A service perimeter that includes the project and services, 2) Access levels that define allowed client attributes (e.g., IP addresses, device policy), and 3) VPC accessible services configuration to restrict access to only requests originating from specified VPC networks. Ingress rules are optional for allowing access from outside the perimeter.

Answer

Cloud NAT gateway

Answer

Private Google Access

Question 2

A company wants to expose a web application running on Cloud Run to the internet with a single global IP address, SSL termination, and Cloud CDN. Which load balancer should they use?

Accepted Answer

Global External HTTP(S) Load Balancer. The Global HTTPS Load Balancer supports serverless backends via serverless NEG, provides SSL termination, Cloud CDN integration, and a single global IP address. The others are either regional or not suitable for serverless backends.

Answer

External TCP/UDP Network Load Balancer

Answer

Global TCP Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 3

An organization needs to design a hybrid connectivity solution with 99.99% availability for a mission-critical application. They have a co-location facility near a GCP region. Which THREE components are required to meet this SLA?

Accepted Answer

Two VLAN attachments. For 99.99% SLA with Dedicated Interconnect, you need two links in different edge availability domains, two VLAN attachments, and BGP sessions with Cloud Router.

Answer

One Dedicated Interconnect link with multiple VLAN attachments

Answer

Classic VPN as a backup

Question 4

A company has two VPCs in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). They want to allow SSH from VPC-A to instances in VPC-B. The network admin creates a firewall rule with source range 10.0.0.0/16 and protocol tcp:22, but connectivity fails. What is the most likely cause?

Accepted Answer

The rule is created in VPC-A instead of VPC-B.. Firewall rules in Google Cloud are applied at the network level, not the instance level. To allow inbound SSH traffic from VPC-A to instances in VPC-B, the firewall rule must be created in VPC-B (the destination network) with the source range set to 10.0.0.0/16. Creating the rule in VPC-A would only affect traffic destined for instances in VPC-A, not VPC-B.

Answer

The source range should be 10.0.0.0/8.

Answer

The target tag is not specified.

Answer

The source tag is missing.

Question 5

A developer needs to create a subnet for GKE pods that will be used by a cluster. They need to specify a secondary IP range for pods. What is the purpose of the 'purpose' field when creating a subnet?

Accepted Answer

It indicates the subnet is used for GKE pods or services. The purpose field determines the subnet's usage; for GKE pods, you set purpose to 'PRIVATE_RFC_1918' or use a secondary range with specific purpose.

Answer

It enables private Google access

Answer

It defines whether the subnet is auto or custom

Answer

It sets the region for the subnet

Question 6

A network engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but different subnets (us-east1 and europe-west1). The engineer suspects an MTU issue. What is the default MTU for traffic within Google Cloud, and what MTU should the engineer expect when packets traverse the internet?

Accepted Answer

1460 bytes internally, 1500 bytes internet. Google Cloud uses an MTU of 1460 bytes (64 bytes less than the standard 1500) to accommodate encapsulation headers. Internet traffic typically uses 1500 bytes. Fragmentation can occur if a packet larger than 1460 bytes is sent over a path that expects 1500 but the internal path is 1460.

Answer

1400 bytes internally, 1500 bytes internet

Answer

1500 bytes both internally and internet

Answer

1500 bytes internally, 1460 bytes internet

Question 7

A network engineer configured a Cloud Router with the BGP configuration shown. The on-premises router (AS 64512) is peering with the Cloud Router (AS 65001) over a Dedicated Interconnect VLAN attachment. The engineer notices that traffic from on-premises to Google Cloud is not being routed via this interconnect as expected. What is the most likely cause?

Accepted Answer

The update-source loopback0 command is invalid for Cloud Router BGP sessions. Cloud Router does not support the `update-source loopback0` command. BGP sessions on Cloud Router must use the primary IP address of the interface that is directly connected to the VLAN attachment; loopback interfaces are not supported for BGP peering. This command would cause the Cloud Router to attempt to source BGP packets from a loopback address that is not reachable by the on-premises router, breaking the BGP session.

Answer

The route-map SET-MED sets the MED attribute incorrectly

Answer

The ebgp-multihop 2 command is not supported on Cloud Router

Answer

The local-preference is set in the outbound direction, which is not allowed

Question 8

An organization has a Shared VPC with several service projects. They want to restrict which service projects can create firewall rules in the host project. What should they do?

Accepted Answer

Use IAM roles with compute.firewalls.create permission at the host project level.. IAM roles with the `compute.firewalls.create` permission at the host project level allow you to precisely control which service projects can create firewall rules in the Shared VPC host project. By assigning a custom or predefined role (e.g., Compute Security Admin) that includes this permission to specific service project identities, you can restrict firewall rule creation to only authorized service projects while preventing others from doing so.

Answer

Use VPC Service Controls.

Answer

Use hierarchical firewall policies.

Answer

Use organization policies to deny firewall rule creation.

Question 9

A company is using Cloud VPN to connect to Google Cloud. They notice that traffic from their on-premises network to Google Cloud is not being routed correctly after a recent change. On the on-premises router, they verify that the BGP session is established and routes are received. Which step should they take next to troubleshoot?

Accepted Answer

Verify that the routes learned via BGP are being propagated to the VPC network by examining Cloud Router details. Since the BGP session is established and routes are received on the on-premises router, the issue is likely that those routes are not being propagated into the VPC network. Cloud Router acts as the BGP speaker for the VPC; even if the VPN tunnel is up and BGP peering is successful, the learned routes must be advertised into the VPC’s routing tables. Verifying Cloud Router details (e.g., using `gcloud compute routers get-status` or checking the Cloud Console) confirms whether the routes are being accepted and propagated, which directly addresses the routing failure.

Answer

Check the on-premises firewall logs

Answer

Disable and re-enable the VPN tunnel

Answer

Check the tunnel status in Cloud Console

Question 10

A company is designing a hybrid network with Cloud VPN. Which TWO best practices should they follow? (Choose TWO.)

Accepted Answer

Use pre-shared keys for authentication.. Pre-shared keys (PSKs) are a valid and commonly used authentication method for IPsec VPN tunnels in Google Cloud. They provide a simple, symmetric key-based mechanism to authenticate the VPN peers without requiring a PKI infrastructure, making them a best practice for straightforward deployments.

Answer

Use a VPN tunnel per subnet.

Answer

Use static routes for simplicity.

Answer

Use a single VPN tunnel for all traffic.