PCNE Practice Test 12 — 15 Questions

Question 1

A company uses Dedicated Interconnect to connect their on-premises data center to Google Cloud. They have enabled Private Google Access on the VPC subnet to allow on-premises hosts to access Google APIs via private IPs over the interconnect. Performance tests show that throughput to Google APIs is lower than expected, and the interconnect link utilization is below 30%. What should they do to improve throughput?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Private Service Connect endpoint for Google APIs with multiple IP addresses.. Private Google Access (PGA) uses the default Internet Gateway to route traffic to Google APIs, which can lead to throughput limitations due to source NAT and flow hashing constraints. Creating a Private Service Connect (PSC) endpoint for Google APIs with multiple IP addresses allows traffic to be load-balanced across multiple endpoints, improving throughput by enabling ECMP (Equal-Cost Multi-Path) routing over the Dedicated Interconnect, thus better utilizing the available bandwidth.

Answer

Reduce the MTU on the interconnect to reduce packet loss.

Answer

Add another Dedicated Interconnect attachment.

Answer

Enable Cloud NAT to provide multiple public IPs.

Question 2

A company is setting up VPC peering between two VPCs. They need the peered VPC to be able to reach the entire subnets of their VPC, including those that may be added in the future. Which configuration is required?

Accepted Answer

Enable 'Export custom routes' on the peering connection. Exporting custom routes from the VPC ensures that any future subnets (which create custom routes) are advertised to the peer.

Answer

Create static routes in the peer VPC for each subnet

Answer

Use a VPN instead of VPC peering

Answer

Enable 'Import custom routes' on the peering connection

Question 3

A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?

Accepted Answer

Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.. Cloud NAT uses source network address translation (SNAT) and maps internal IPs to the NAT IP using ports. By default, Cloud NAT allocates a range of ports per VM. If the instances are making many connections, they may exhaust the allocated ports. The symptom that only some instances fail suggests that the failing instances may have run out of ephemeral ports. Option D is correct: Increase the number of NAT IP addresses or increase the minimum ports per VM.

Answer

The instances are using different service accounts, and the NAT is not configured to allow all.

Answer

The Cloud NAT's idle timeout is set too low, causing connections to be dropped.

Answer

The external API endpoint has a rate limit that is being hit by the NAT IP.

Question 4

A company has deployed a Global External Application Load Balancer with Premium Tier and enables Cloud CDN. Users in Europe report high latency, while users in the US have good performance. The backend is a regional NEG in us-west1. What is the most likely cause?

Accepted Answer

The origin server is sending 'Cache-Control: private' headers, preventing Cloud CDN from caching.. Cloud CDN cannot cache responses that include a 'Cache-Control: private' header. This header instructs intermediate caches (including CDN nodes) not to store the response, forcing all requests to go to the origin server in us-west1. Users in Europe experience high latency because their requests must traverse the long distance to the US origin, while US users benefit from shorter paths. Enabling Cloud CDN alone does not guarantee caching; the origin must also allow caching by omitting 'private' or setting appropriate 'Cache-Control: public' and 'max-age' directives.

Answer

The load balancer is using Premium Tier, which routes to the nearest backend; the backend is only in us-west1.

Answer

Cloud CDN is not enabled on the load balancer.

Answer

The load balancer is using Standard Tier, which does not support global anycast.

Question 5

An organization has multiple VPC networks in a project and wants to centrally manage firewall rules across all networks using a single set of rules. Which approach should they take?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules are per network. To centrally manage rules, you can use hierarchical firewall policies (part of VPC Firewall Policies) applied at the organization or folder level, which override network-specific rules.

Answer

Use firewall rules with global scope

Answer

Create a single VPC network and use subnetting

Answer

Use shared VPC and apply firewall rules to the host project

Question 6

A company has deployed a web application behind an External HTTP(S) Load Balancer with Cloud Armor. They want to restrict access to a specific URL path /admin to only users from a specific IP range (198.51.100.0/24). The engineer creates a Cloud Armor security policy with two rules: Rule 1 (priority 1000) with match expression "request.path == '/admin' && inIpRange(source.ip, '198.51.100.0/24')" and action "allow". Rule 2 (priority 2147483647) with match "request.path == '/admin'" and action "deny". After testing, users from the allowed IP range receive a 403 error when accessing /admin. The Cloud Armor logs show that the request was denied. The engineer confirms that the policy is attached to the backend service and that the source IP in the logs matches the allowed range. What is the most likely cause of the denial?

Accepted Answer

The user's source IP is being translated by a NAT or proxy, so it doesn't match the allowed range.. The most likely cause is that the user's source IP is being translated by a NAT or proxy before reaching the load balancer. Cloud Armor evaluates the source IP as seen by the load balancer, which may differ from the original client IP if traffic passes through an intermediate device. The logs confirm the source IP matches the allowed range, but if the request arrives via a proxy, the actual source IP in the packet could be the proxy's IP, not the user's, causing the deny rule to match.

Answer

The allow rule is missing a condition to also check the request path because the path condition is not supported in Cloud Armor.

Answer

The allow rule's condition is incorrect because it should use "origin.ip" instead of "source.ip".

Answer

The allow rule's priority is 1000, which is lower than the deny rule, but the deny rule still overrides.

Question 7

Refer to the exhibit. A Cloud Armor security policy with the shown rules is applied to an HTTPS load balancer. Users from IP 10.0.1.1 are reporting they cannot access the website. What is the issue?

Accepted Answer

The deny rule has higher priority and blocks traffic from 10.0.0.0/8.. Cloud Armor security policies evaluate rules in priority order, with lower numbers having higher priority. The deny rule at priority 1000 matches the source IP range 10.0.0.0/8, which includes the user's IP 10.0.1.1, and is evaluated before the allow rule at priority 2000. Since the deny rule is matched first, the request is blocked, preventing access to the HTTPS load balancer.

Answer

The load balancer is not configured to use the security policy.

Answer

The allow rule with priority 2000 does not apply because the deny rule is evaluated first.

Answer

The IP range in the deny rule is too broad.

Question 8

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

Accepted Answer

Configure Cloud Router in the host project to advertise all subnets via BGP.. In a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Answer

Configure Cloud NAT in each service project for on-prem access.

Answer

Use VPC peering between the host project and each service project.

Answer

Create separate Interconnect VLAN attachments for each service project.

Question 9

Drag and drop the steps to configure a global external HTTP(S) load balancer in Google Cloud into the correct order.

Accepted Answer

Create backend service, then health check, then URL map, then target proxy, then forwarding rule.. Load balancer setup: backend, health check, URL map, target proxy, forwarding rule.

Answer

Create health check, then backend service, then URL map, then target proxy, then forwarding rule.

Answer

Create backend service, then URL map, then health check, then target proxy, then forwarding rule.

Answer

Create backend service, then health check, then target proxy, then URL map, then forwarding rule.

Question 10

A company wants to publish an internal service (e.g., a database) in their VPC so that consumers in other VPCs can connect to it privately via Private Service Connect (PSC). What must be created on the producer side?

Accepted Answer

A Service Attachment that exposes the service.. Private Service Connect allows producers to publish services via a Service Attachment. The service attachment is created on a Network Endpoint Group (NEG) that points to the internal service (e.g., a backend service). Consumers then create PSC endpoints to connect.

Answer

A Cloud VPN tunnel to the consumer VPC.

Answer

A VPC peering connection.

Answer

A Private Service Connect endpoint in the producer VPC.

Question 11

A Compute Engine instance is running a network appliance that requires multiple network interfaces. What is the primary purpose of attaching additional NICs (e.g., NIC1, NIC2) to the instance?

Accepted Answer

To separate traffic between different subnets or networks. Multiple NICs are used to separate traffic planes such as management, data, and control, and to route traffic through different subnets without relying on internal routing.

Answer

To provide failover if one NIC fails

Answer

To enable load balancing across interfaces

Answer

To increase network throughput

Question 12

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to create service perimeters that restrict access to Google Cloud APIs and prevent data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

IAM Conditions

Question 13

A company has two Dedicated Interconnect connections in different metro areas to meet the 99.99% SLA. They want to ensure that traffic uses both connections in an active-active manner. Which three configurations are required? (Choose three.)

Accepted Answer

Configure BGP on both VLAN attachments with equal MED values.. For active-active, you need two VLAN attachments (one per connection), both attached to the same Cloud Router, and you must configure BGP on both attachments with the same route preferences (e.g., equal MED) to enable ECMP.

Answer

Create a single VLAN attachment shared across both connections.

Answer

Set the VLAN attachments to use static routing instead of BGP.

Question 14

A company wants to publish a service running on Compute Engine instances in their VPC so that consumers in other VPCs can access it via private IPs without needing VPC peering. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows a producer to publish a service via a private endpoint that consumers can access from their own VPCs without peering.

Answer

VPC peering

Answer

Cloud VPN

Answer

Cloud NAT

Question 15

A network engineer wants to restrict access to a Cloud Storage bucket from only a specific set of Compute Engine instances in a VPC. The instances have no external IPs. What is the most effective way to enforce this restriction?

Accepted Answer

Enable Private Google Access on the subnet and use VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. Using Private Google Access with Private Service Connect allows instances to reach Google APIs via internal IPs. By using VPC Service Controls, you can create a service perimeter that restricts access to the Cloud Storage bucket from the specific VPC and projects. This provides a defense-in-depth approach.

Answer

Assign a unique service account to the instances and use IAM conditions to allow the service account access to the bucket only when connecting from the VPC network.

Answer

Configure a firewall rule that allows egress traffic to the Cloud Storage API only from the instances' subnet.

Answer

Create an IAM condition that restricts access based on the instance's internal IP address range.