PCNE Practice Test 10 — 10 Questions

Question 1

A company has a VPC with a single subnet in us-central1 (10.0.0.0/24). They have a Compute Engine instance running a database that uses an internal IP address 10.0.0.10. They need to ensure that this database instance can be accessed by a legacy on-premises application via a Cloud VPN tunnel. The on-premises network uses 192.168.0.0/16. They have set up a HA VPN gateway with two tunnels and BGP routing. The Cloud Router is configured to advertise the subnet 10.0.0.0/24. On the on-premises side, the router receives the route for 10.0.0.0/24 and has a static route for 10.0.0.0/24 pointing to the VPN tunnel. However, the on-premises application cannot reach the database. The application's server can ping the on-premises gateway, but not the database IP. The database instance's OS firewall allows all traffic from 0.0.0.0/0. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC firewall rules are blocking ingress from on-premises; add a rule allowing traffic from 192.168.0.0/16 to the database IP.. The VPC firewall rules are the most likely cause. Google Cloud VPC firewall rules are stateful and must explicitly allow ingress traffic from the on-premises CIDR (192.168.0.0/16) to the database instance's internal IP (10.0.0.10) on the required port. Even though the OS firewall allows all traffic, the VPC-level firewall is evaluated first and will drop packets if no allow rule matches. Since the on-premises server can ping the on-premises gateway but not the database, the issue is likely at the VPC ingress firewall, not routing or BGP.

Answer

The database instance's OS firewall is blocking the traffic despite the setting.

Answer

The Cloud Router is not advertising the specific database IP 10.0.0.10, only the subnet 10.0.0.0/24.

Answer

The BGP session is not establishing properly; check the shared secret and IP addresses.

Question 2

A company has a Shared VPC setup with a host project and several service projects. They want to grant a service project's network admin the ability to create VM instances using a specific subnet from the host project. Which IAM role should they assign at the subnet level?

Accepted Answer

Compute Network User (roles/compute.networkUser) on the specific subnet. In a Shared VPC, the Compute Network User role (roles/compute.networkUser) granted on a specific subnet in the host project allows a principal in a service project to use that subnet when creating VM instances. This is the least-privilege role designed exactly for this cross-project subnet consumption.

Answer

Project Owner on the host project

Answer

Compute Instance Admin (roles/compute.instanceAdmin) on the service project

Answer

Compute Network Admin (roles/compute.networkAdmin) on the host project

Question 3

A company runs a Kubernetes cluster on GKE with a VPC-native cluster (alias IP ranges). They have pods that need to communicate with on-premises services via a Cloud VPN tunnel. Which networking configuration is required to enable pod-to-on-premises communication?

Accepted Answer

Advertise the pod IP ranges over the Cloud Router BGP session to the on-premises router.. VPC-native clusters assign alias IP ranges to pods directly from the VPC subnet's secondary CIDR ranges. To enable on-premises routing to these pods, the pod IP ranges must be advertised over the Cloud Router BGP session to the on-premises router. This ensures the on-premises network learns the routes to the pod CIDRs and can forward traffic back through the Cloud VPN tunnel.

Answer

Enable VPC Flow Logs for the subnets to allow traffic to be routed.

Answer

Configure a firewall rule allowing traffic from pod CIDR to on-premises subnets.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Question 4

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Accepted Answer

URL map. The scenario requires an external Application Load Balancer (HTTP(S)) in front of GKE, and that architecture is built from a specific set of resources. Option B, a URL map, is required because it defines the routing rules that map incoming request paths/hosts to backend services and is a mandatory component of the HTTP(S) load balancer. Option D, a backend service pointing to the GKE NEG, is required because the backend service is what binds the load balancer to the GKE workloads via a Network Endpoint Group and is where Cloud CDN is enabled for static content. Option E, a Google-managed SSL certificate, is required because the custom domain must be served over HTTPS and a Google-managed certificate provides automatic provisioning and renewal for that domain. Option A, a Cloud NAT gateway, is not part of exposing an inbound HTTP service; Cloud NAT provides outbound internet access for private instances and is unrelated to this load balancing path. Option C, a target TCP proxy, belongs to a TCP/SSL proxy load balancer (Layer 4), not to the global HTTP(S) load balancer that this scenario requires.

Answer

Cloud NAT gateway

Answer

Target TCP proxy

Question 5

An organization uses Shared VPC with a host project and multiple service projects. They want to allow a service project team to create Compute Engine instances using a specific subnet, but not manage other subnets. Which IAM role should they grant at the subnet level?

Accepted Answer

roles/compute.networkUser. The roles/compute.networkUser role grants read-only access to VPC networks, subnets, and firewall rules, and allows the creation of resources like Compute Engine instances on a specific subnet without granting management permissions over other subnets. This is the correct choice because it provides the minimum required permissions for a service project team to use a designated subnet while preventing them from modifying or viewing other subnets in the host project.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/compute.networkAdmin

Answer

roles/iam.securityAdmin

Question 6

A company wants to connect their VPC to an on-premises network using Cloud VPN. They need to ensure that traffic from Google Cloud to on-premises uses a specific route only when the primary path is available, and otherwise fails over to a backup path. Which configuration should they use?

Accepted Answer

Configure BGP on Cloud Router and advertise custom routes with appropriate metrics. Cloud VPN with dynamic routing (BGP) allows you to control path selection by advertising custom routes with different metrics (MED values) for the primary and backup paths. When the primary path is available, the lower metric route is preferred; if the BGP session fails, the route is withdrawn and traffic automatically fails over to the backup path with a higher metric. This meets the requirement for active/passive failover without manual intervention.

Answer

Configure Cloud NAT to route traffic through the backup path

Answer

Use static routes with a higher priority for the primary path

Answer

Create firewall rules to allow failover traffic

Question 7

You are using Traffic Director with Envoy sidecars for a microservices application. You want to inject artificial delays into requests from service A to service B for testing purposes. Which Traffic Director feature should you use?

Accepted Answer

Fault injection. Traffic Director supports fault injection, which allows you to inject delays and abort requests into the traffic between services.

Answer

Traffic splitting

Answer

Circuit breakers

Answer

Outlier detection

Question 8

You are deploying a new internal HTTP(S) load balancer for a microservice that runs on Compute Engine instances within the same region. The load balancer must be accessible only from within the VPC network. Which components are required? (Choose two.)

Accepted Answer

Regional internal HTTP(S) load balancer. Option B is correct because a regional internal HTTP(S) load balancer is the Google Cloud product designed to distribute HTTP(S) traffic to backends within the same region and expose a private IP address reachable only from inside the VPC network, matching the requirement that the load balancer be accessible only internally. Option C is correct because any HTTP(S) load balancer, including an internal one, requires a backend service that references the instance groups or NEGs and includes a health check to determine which backends are healthy and eligible to receive traffic. Option A is incorrect because a global external HTTP(S) load balancer uses a public anycast IP address and is reachable from the internet, which violates the internal-only requirement. Option D is incorrect because Cloud CDN is an optional caching feature and is not required to build an internal HTTP(S) load balancer. Option E is incorrect because an SSL certificate is only needed if you terminate TLS on the load balancer; it is not a mandatory component for the internal HTTP(S) load balancer itself, and the question does not require HTTPS termination.

Answer

Global external HTTP(S) load balancer

Answer

Cloud CDN enabled

Answer

SSL certificate

Question 9

A network engineer notices unexpected traffic being allowed through a VPC firewall rule. They want to analyze the logs to identify the source and destination. What is the best way to enable detailed logging for firewall rules?

Accepted Answer

Enable firewall rule logging on the specific rule and view logs in Cloud Logging.. Firewall rule logging in VPC is designed specifically to log metadata (source IP, destination IP, action, etc.) for each packet matched by a firewall rule. Enabling it on the specific rule and viewing logs in Cloud Logging provides the granular, per-rule detail needed to identify the source and destination of unexpected traffic. This is the direct and intended method for firewall rule analysis.

Answer

Enable VPC Flow Logs for the subnet.

Answer

Create a custom router with a log export.

Answer

Use Packet Mirroring to capture all traffic.

Question 10

Which two of the following are prerequisites for configuring an HA VPN tunnel to an on-premises network? (Choose two.)

Accepted Answer

A Cloud Router with BGP configured in the same region as the VPN gateway.. Option B is correct because HA VPN uses dynamic routing via BGP, so a Cloud Router must exist in the same region as the HA VPN gateway to establish BGP sessions and exchange routes with the on-premises peer. Option E is correct because an HA VPN gateway in Google Cloud is provisioned with two external IP addresses (one per interface), and each tunnel must terminate on one of these distinct addresses to provide the 99.99% SLA. Option A is incorrect because VLAN attachments are used for Cloud Interconnect (Dedicated/Partner), not for HA VPN tunnels. Option C is incorrect because the pre-shared key requirement is not a 20-character minimum; IKE pre-shared keys have their own length constraints and this is not a stated prerequisite for HA VPN configuration. Option D is incorrect because HA VPN requires the on-premises device to support dynamic routing (BGP), not static routing only.

Answer

A VLAN attachment in the same region.

Answer

A pre-shared key that is at least 20 characters long.

Answer

An on-premises VPN device that supports static routing only.