PCNE Practice Test 1 — 10 Questions

Question 1

A company is designing IP address plans for multiple VPCs that will be connected via VPC Network Peering and to an on-premises network via HA VPN with dynamic routing. Which three practices should be followed to avoid IP address conflicts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reserve IP ranges for future VPCs and on-premises expansion. To avoid overlap, use unique private IP ranges per VPC, plan for future growth, and document all ranges. Using RFC 1918 addresses and avoiding overlapping CIDRs ensures successful peering and VPN connectivity.

Answer

Use only public IP addresses for all GCP resources

Answer

Use the same IP range for all VPCs to simplify management

Question 2

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

Accepted Answer

USE_ORIGIN_HEADERS. USE_ORIGIN_HEADERS respects the origin's Cache-Control headers, so only objects with headers indicating public cacheability (e.g., Cache-Control: public) will be cached. This mode ensures that the CDN does not cache content that the origin marks as private or no-store. It is the most conservative caching mode and is suitable when the origin's caching directives are authoritative.

Answer

CACHE_ALL_STATIC

Answer

None of the above

Answer

FORCE_CACHE_ALL

Question 3

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking health check probes from Google Cloud. Hybrid connectivity NEGs rely on health checks from Google Cloud to determine endpoint health. If the on-premises firewall blocks these health check probes (which originate from Google's health check IP ranges), the NEG marks the endpoint as unhealthy, and Traffic Director stops routing traffic, causing connection timeouts. The most likely cause is the firewall blocking these probes.

Answer

The hybrid connectivity NEG is not supported with Traffic Director

Answer

The Cloud VPN tunnel is not established

Answer

Traffic Director requires mTLS for all hybrid endpoints

Question 4

An engineer is configuring a Global HTTPS Load Balancer with a serverless NEG pointing to Cloud Run. The deployment fails with a health check error. What is the most likely cause?

Accepted Answer

The serverless NEG does not support health checks. Serverless NEGs (Network Endpoint Groups) for Cloud Run do not support health checks because Cloud Run services are fully managed and inherently highly available. The load balancer cannot perform health checks on serverless backends; instead, it relies on the serverless platform's own health management. Therefore, attempting to configure a health check for a serverless NEG will cause a deployment failure. The most likely cause is that the serverless NEG does not support health checks.

Answer

The Cloud Run service is not deployed

Answer

The health check interval is too short

Answer

The SSL certificate is misconfigured

Question 5

A company wants to resolve DNS queries from their on-premises DNS servers for a private zone hosted in Cloud DNS. They also need GCP resources to resolve on-premises hostnames. Which combination of Cloud DNS features should they configure?

Accepted Answer

Both inbound and outbound DNS server policies. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS private zones. Outbound DNS server policy allows GCP to forward queries to on-premises DNS servers.

Answer

Outbound DNS server policy only

Answer

DNS peering with the on-premises network

Answer

Inbound DNS server policy only

Question 6

A company uses Shared VPC with a host project and several service projects. They want to allow only a specific team to create subnets in the host project, and another team to use those subnets in their service projects. Which IAM roles should be assigned?

Accepted Answer

Compute Network Admin on host project for subnet creators; Compute Network User on host project for subnet users.. To create subnets, a user needs the Compute Network Admin role on the host project. To use subnets, a user needs the Compute Network User role on the host project or specific subnets.

Answer

Compute Network Admin on host project for both teams.

Answer

Compute Shared VPC Admin on host project for subnet creators; Compute Network User on host project for subnet users.

Answer

Compute Network User on host project for subnet creators; Compute Network Admin on service projects for subnet users.

Question 7

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

Accepted Answer

Use a Cloud Router with BGP and establish multiple BGP sessions over each Interconnect. Cloud Router with BGP enables dynamic routing, allowing multiple BGP sessions over each Cloud Interconnect. When one interconnect fails, BGP withdraws the affected routes, and traffic is automatically redistributed across the remaining BGP sessions without manual intervention. This meets the requirement for automatic failover and load balancing across the five 10 Gbps connections.

Answer

Configure multiple VLAN attachments on a single Cloud Router and rely on link aggregation

Answer

Deploy Cloud VPN tunnels as backup and configure static routes with lower priority

Answer

Configure VPC Network Peering between all data centers and Google Cloud

Question 8

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

Accepted Answer

Reserve a static internal IP address in the same region and subnetwork.. A static internal IP address is reserved within a specific region and subnetwork, ensuring the IP persists even after the VM is stopped or deleted. This meets the requirement for a fixed internal address that remains available for reassignment to the same or a different VM in the same subnet. Ephemeral IPs are released on VM stop/delete, and external IPs are not relevant for internal-only communication.

Answer

Configure an alias IP range on the VM's network interface.

Answer

Assign an ephemeral external IP and configure a firewall rule.

Answer

Use a regional internal IP address with auto-delete set to false.

Question 9

An engineer manages a global application using Global external HTTP(S) Load Balancer with URL map routing to multiple backend services. They want to enable Cloud CDN for the /images/* path. What is the correct way to enable CDN for that specific path?

Accepted Answer

Enable CDN on the backend service that serves /images/*. Cloud CDN is enabled at the backend service level, not at the load balancer or URL map level. Because the URL map routes /images/* to a specific backend service, enabling CDN on that backend service scopes caching precisely to that path. This is the supported and documented configuration model.

Answer

Use the gcloud compute url-maps add-path-matcher command with --cache-mode

Answer

Set a cache key header for /images/* in the URL map

Answer

Enable Cloud CDN at the load balancer level

Question 10

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

Accepted Answer

No additional configuration is needed.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs. Once enabled on the subnet, Google automatically adds a private route for the Google API IP ranges, so no further configuration is required. Therefore, option C is correct. Option A is incorrect because a default route to the internet would send traffic to the internet, not to Google APIs via private access. Option B is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.

Answer

A default route to the internet must be created.

Answer

A Cloud NAT must be configured.

Answer

The instances must have external IPs.