PCNE Practice Test 10 — 10 Questions

Question 1

A company is using Partner Interconnect to connect their on-premises network to Google Cloud. They need to choose between Layer 2 and Layer 3 connectivity options offered by the service provider. Which statement correctly describes the difference between Layer 2 and Layer 3 connectivity in Partner Interconnect?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Layer 3 connectivity requires the customer to have a BGP session with the partner's router, while Layer 2 allows direct BGP with Google Cloud.. With Layer 2, the partner provides a transparent VLAN; with Layer 3, the partner handles the IP routing, requiring a BGP session from the customer's on-prem router to the partner's router.

Answer

Layer 2 connectivity requires the customer to configure BGP with Google Cloud, while Layer 3 does not require any BGP on the customer side.

Answer

Layer 2 connectivity is only available for Dedicated Interconnect, not Partner Interconnect.

Answer

Both Layer 2 and Layer 3 require the customer to manage VLAN attachments inside GCP.

Question 2

An engineer is planning IP address ranges for two VPCs that will be connected via VPC peering. One VPC uses 10.1.0.0/16 and the other uses 10.2.0.0/16. They also plan to use HA VPN to an on-premises network using 10.0.0.0/8. Which IP range assignment could cause a conflict?

Accepted Answer

Conflict between on-premises (10.0.0.0/8) and both VPCs. The on-premises range 10.0.0.0/8 overlaps with both VPC ranges; VPC peering and VPN both require non-overlapping ranges.

Answer

Conflict between the two VPCs (10.1.0.0/16 and 10.2.0.0/16)

Answer

Conflict between VPC1 (10.1.0.0/16) and on-premises (10.0.0.0/8)

Answer

No conflict; all ranges are non-overlapping

Question 3

An organization wants to use Cloud DNS to resolve queries for a custom domain 'example.internal' across multiple projects in the same organization. They have a private zone in project A and want project B to be able to resolve records in that zone. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows a private zone in one project to be shared with other projects for DNS resolution.

Answer

Shared VPC

Answer

Public zone with visibility

Answer

DNS forwarding

Question 4

An engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They want to control which on-premises subnets are advertised to GCP. Which TWO methods can they use?

Accepted Answer

Apply BGP filters on the on-premises router to limit advertised prefixes. Custom learned routes can be configured to filter prefixes, and BGP filters can be applied on the on-premises side.

Answer

Change the Cloud Router ASN

Answer

Use route priority in the VPC

Answer

Set MED on the on-premises router

Question 5

An organization has two Dedicated Interconnect connections in an active-passive configuration. They want to make the passive connection active for maintenance. What should they do to fail over traffic?

Accepted Answer

Configure as-path prepending on the active Cloud Router BGP session to make it less preferred. To fail over traffic, the engineer can use as-path prepending on the active connection to make it less preferred, or adjust MED, or use local preference on the on-premises side. The question implies a GCP-side action: using as-path prepending via Cloud Router BGP configuration.

Answer

Shut down the Cloud Router on the active connection

Answer

Set the MED metric to 0 on the active connection

Answer

Delete the VLAN attachment on the active connection

Question 6

An engineer has set up a Dedicated Interconnect with a VLAN attachment and a Cloud Router BGP session. They can ping the on-premises gateway IP but cannot reach an on-premises subnet 10.0.0.0/24 from a GCE instance. The on-premises router is advertising the subnet via BGP. What is the most likely cause?

Accepted Answer

The GCE instance does not have a route to the on-premises subnet. The GCE instance can ping the on-premises gateway IP because the Cloud Router has a BGP session and the gateway IP is directly reachable via the VLAN attachment. However, to reach the on-premises subnet 10.0.0.0/24, the GCE VPC needs a route for that subnet pointing to the Cloud Router as the next hop. Without an automatically propagated or manually configured route in the VPC, traffic from the GCE instance to 10.0.0.0/24 will be dropped, even though the on-premises router is advertising the subnet via BGP.

Answer

The VLAN attachment is in the wrong region

Answer

The on-premises firewall is blocking ICMP

Answer

The on-premises router is not using the correct BGP AS number

Question 7

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

Accepted Answer

gRPC. Health checks support HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC. For gRPC backends, a gRPC health check is the most appropriate as it reflects the application health. The other protocols may not accurately indicate gRPC service health.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 8

An engineer is deploying a Regional External HTTP(S) Load Balancer to serve a web application on Compute Engine. They want to maintain the highest availability by automatically rerouting traffic away from unhealthy instances. Which additional configuration is required?

Accepted Answer

Configure a health check on the backend service. Health checks are required to detect unhealthy instances. Without them, the load balancer will route traffic to any instance in the backend service. Autoscaling and managed instance groups are not mandatory for basic health checking but are recommended.

Answer

Enable connection draining on the backend service

Answer

Use a global load balancer instead

Answer

Set up a managed instance group with autoscaling

Question 9

A company wants to expose a web application running on Cloud Run globally with a single anycast IP address, using HTTP(S) load balancing and Cloud CDN for static content. The application should be accessible at https://app.example.com. What is the correct configuration?

Accepted Answer

Create a global external HTTP(S) load balancer with a serverless NEG that points to the Cloud Run service.. Global HTTPS LB with serverless NEG targeting Cloud Run is the best practice for globally exposing serverless workloads with CDN. The other options either lack CDN (SSL Proxy), are regional (regional LB), or use incorrect NEG type (hybrid NEG for on-prem).

Answer

Create a global SSL Proxy load balancer with a Cloud Run backend bucket.

Answer

Create a global TCP Proxy load balancer with a hybrid connectivity NEG.

Answer

Create a regional external HTTP(S) load balancer with a serverless NEG.

Question 10

A company wants to serve private content from Cloud CDN using signed URLs that expire after 1 hour. Which steps are required to enable this?

Accepted Answer

Create a signing key in Cloud CDN, then generate signed URLs with expiration using that key.. Signed URLs require a signing key (created via Cloud CDN backend bucket configuration) and generating URLs programmatically with expiration. Enabling IAP is not required. The key is not passed in the header but as query parameters. Just setting cache mode does not enable signed URLs.

Answer

Set the cache mode to FORCE_CACHE_ALL and enable private access.

Answer

Pass the signing key in the X-Goog-Signed-URL header on each request.

Answer

Enable IAP on the backend and generate signed URLs using the IAP client ID.