PCNE Practice Test 11 — 15 Questions

Question 1

A company deploys a web application on Google Kubernetes Engine (GKE) with an Ingress resource handled by an external HTTPS load balancer. They want to enforce mutual TLS (mTLS) authentication where the load balancer verifies the client certificate and then passes the client's identity to the backend using a header. Which configuration should be used?

Accepted Answer

Enable Client Certificate Validation on the HTTPS backend service and configure the backend to read the X-Forwarded-Client-Cert header.. Option A is correct because Google Cloud's external HTTPS load balancer supports mTLS by enabling Client Certificate Validation on the backend service. When enabled, the load balancer terminates TLS, validates the client certificate, and injects the client certificate details into the X-Forwarded-Client-Cert (XFCC) header, which the backend application can read to identify the client. This approach offloads certificate validation to the load balancer and passes identity via a standard header, meeting the requirement without modifying the GKE Ingress or backend application logic.

Answer

Use an SSL policy with mTLS and set the backend service to require client certificates.

Answer

Use Cloud Armor with mTLS and configure a custom request header to include the client certificate.

Answer

Configure the GKE Ingress to use an SSL certificate and set the annotation for client certificate validation.

Question 2

Drag and drop the steps to set up a Private Service Connect for accessing Google APIs privately into the correct order.

Question 3

Drag and drop the steps to set up a Cloud Interconnect connection for dedicated on-premises connectivity into the correct order.

Question 4

Refer to the exhibit. A user within the perimeter project '111111111111' tries to access BigQuery from a VM that has an external IP address. The request is denied. What is the most likely reason?

Accepted Answer

The VPC Accessible Services restriction requires that the request originate from an internal IP address or through VPC-controlled access.. The VPC Accessible Services restriction, when enabled, forces all traffic to Google APIs to use internal IP addresses or VPC-controlled access (such as Private Google Access or Private Service Connect). Since the VM has an external IP address and the request is denied, the most likely reason is that this restriction is in place, requiring the request to originate from an internal IP or through a VPC endpoint, not from a public external IP.

Answer

BigQuery is not listed in the restricted services, so it is blocked.

Answer

The user does not meet the access level conditions defined in 'trusted_ips'.

Answer

The VM's project is not in the resources list.

Question 5

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Question 6

A network engineer notices unexpected traffic being allowed through a VPC firewall rule. They want to analyze the logs to identify the source and destination. What is the best way to enable detailed logging for firewall rules?

Accepted Answer

Enable firewall rule logging on the specific rule and view logs in Cloud Logging.. Firewall rule logging in VPC is designed specifically to log metadata (source IP, destination IP, action, etc.) for each packet matched by a firewall rule. Enabling it on the specific rule and viewing logs in Cloud Logging provides the granular, per-rule detail needed to identify the source and destination of unexpected traffic. This is the direct and intended method for firewall rule analysis.

Answer

Enable VPC Flow Logs for the subnet.

Answer

Create a custom router with a log export.

Answer

Use Packet Mirroring to capture all traffic.

Question 7

Refer to the exhibit. A request arrives with User-Agent 'GoodBot' and path '/admin'. What action does Cloud Armor take?

Accepted Answer

Allow the request because the rule with priority 200 matches and allows it.. Option D is correct because Cloud Armor evaluates rules in order of priority (lowest number = highest priority). The rule with priority 200 matches the request (User-Agent 'GoodBot' and path '/admin') and explicitly allows it. Once a matching allow rule is found, evaluation stops, and the request is allowed, overriding any lower-priority rules.

Answer

Deny the request because the rule with priority 300 has a higher priority number but matches path.

Answer

Allow the request because of the default rule at priority 1000.

Answer

Deny the request because both rules match and deny takes precedence.

Question 8

An organization wants to connect their on-premises network to Google Cloud using Partner Interconnect. Which of the following is a requirement that must be met before the partner can provision the connection?

Accepted Answer

The organization must have a VLAN attachment created and share the pairing key.. Partner Interconnect requires the customer to create a VLAN attachment in their Google Cloud project and share the generated pairing key with the service provider. The partner uses this key to provision the connection on their side, ensuring the correct mapping to the customer's VPC. Without the VLAN attachment and pairing key, the partner cannot establish the Layer 2 circuit.

Answer

The organization must purchase a cross-connect at a colocation facility.

Answer

The organization must have a Dedicated Interconnect connection already set up.

Answer

The organization must have a Cloud Router configured with BGP sessions.

Question 9

A network engineer has configured a Dedicated Interconnect with a VLAN attachment and Cloud Router. BGP sessions are up and routes are exchanged. However, traffic from a specific on-premises subnet is not reaching a VPC instance. The route table shows a custom static route with priority 1000 for that subnet pointing to a VPN tunnel, and a BGP learned route with priority 100 for the same subnet via Interconnect. What is the most likely reason for the traffic not using the Interconnect route?

Accepted Answer

The BGP route's next hop is not reachable due to a missing firewall rule on the on-premises side. The BGP route with priority 100 is preferred over the static route with priority 1000. However, if the BGP route's next hop is not reachable (e.g., due to a missing firewall rule on the on-premises side blocking the necessary ICMP or BGP session traffic), the route will be considered invalid and not installed in the routing table. This causes traffic to fall back to the less preferred static route via the VPN tunnel, explaining why the Interconnect path is not used.

Answer

Route propagation is disabled on the Cloud Router

Answer

VPC firewall rules are blocking traffic on the Interconnect VLAN attachment

Answer

The BGP route has a lower MED than the static route

Question 10

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides a direct, private connection between your on-premises network and Google Cloud, supporting bandwidth up to 100 Gbps (via multiple 10 Gbps or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant attachments. This solution requires you to manage your own physical infrastructure in a Google colocation facility, meeting the organization's requirement for self-managed hardware.

Answer

Cloud VPN with multiple tunnels

Answer

Partner Interconnect

Answer

HA VPN

Question 11

An on-premises router uses BGP ASN 64512. The Cloud Router is also configured with ASN 64512. When the BGP peering is established, what behavior is expected?

Accepted Answer

The BGP session will fail or behave unpredictably.. BGP requires each router in a peering session to have a unique ASN to properly enforce loop prevention and path selection. When both the on-premises router and Cloud Router use the same ASN 64512, the BGP session will fail or behave unpredictably because each router will see its own ASN in received updates, triggering the BGP loop detection mechanism (RFC 4271, Section 9.3) and causing the session to drop or routes to be rejected.

Answer

The session works but routes are not exchanged.

Answer

Cloud Router will automatically prepend its ASN to avoid conflict.

Answer

The BGP session works normally since ASN 64512 is a private ASN.

Question 12

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

Accepted Answer

Dedicated Interconnect with static routing. Dedicated Interconnect supports static routing, which is required because the on-premises router does not support BGP. This solution provides direct, private connectivity to a single Google Cloud VPC without relying on dynamic routing protocols, making it the correct choice for this scenario.

Answer

Cloud VPN with dynamic routing (BGP)

Answer

Ha VPN with policy-based routing

Answer

Partner Interconnect with BGP

Question 13

Which TWO configurations provide high availability for Dedicated Interconnect? (Choose two.)

Accepted Answer

Two connections to different PoPs.. Option A is correct because connecting to two different Points of Presence (PoPs) provides geographic redundancy; if one PoP fails, traffic can be rerouted through the other. Option E is correct because two connections to the same PoP provide link-level redundancy; if one circuit fails, the other can continue carrying traffic, and BGP can be used to load-balance or failover between them.

Answer

A single circuit with L2 redundancy.

Answer

Using Cloud NAT for failover.

Answer

A single connection from one provider.

Question 14

A network engineer is troubleshooting an HA VPN setup between Google Cloud and an on-premises data center. The two tunnels are established, and BGP sessions are up on both tunnels. However, traffic from Google Cloud to the on-premises network is only using one tunnel, even though both BGP sessions are advertising the same routes. What is the most likely cause?

Accepted Answer

The on-premises router is sending different BGP metrics (MED) for the same route on the two BGP sessions.. When both BGP sessions are up and advertising the same routes, but traffic only uses one tunnel, the most likely cause is that the on-premises router is sending different Multi-Exit Discriminator (MED) values for the same route on the two BGP sessions. MED is a metric that influences inbound traffic to an AS; a lower MED value is preferred. If one tunnel's BGP update carries a lower MED, Google Cloud's Cloud Router will select that path for all traffic, even though both tunnels are functional.

Answer

The Cloud Router is not configured for dynamic routing.

Answer

One of the IPsec tunnels is in a dead state.

Answer

The on-premises router is setting a higher local preference on one route.

Question 15

A company wants to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have ordered a 10 Gbps connection and plan to use a single VLAN attachment. How many Cloud Router interfaces are required for a single VLAN attachment with active/active BGP?

Accepted Answer

1 interface. For a single VLAN attachment using Dedicated Interconnect with active/active BGP, only one Cloud Router interface is required. The Cloud Router interface represents the VLAN attachment itself, and BGP sessions are configured as sub-interfaces under that single interface. Active/active BGP does not require multiple interfaces; it uses two BGP sessions (one for each router in the pair) but both sessions share the same VLAN attachment and Cloud Router interface.

Answer

4 interfaces (two for each BGP session)

Answer

2 interfaces (one for each VLAN)

Answer

2 interfaces (one for each BGP session)