PCNE Practice Test 12 — 15 Questions

Question 1

Refer to the exhibit. A Cloud VPN tunnel is configured between an on-premises router and Google Cloud. The BGP session is not established. The on-premises router shows 'Connection refused'. What is the most likely cause?

Accepted Answer

The Cloud Router is not configured to accept BGP connections from this on-premises peer.. The 'Connection refused' error on the on-premises router indicates that the Cloud Router is actively rejecting the TCP connection attempt for the BGP session. This typically occurs when the Cloud Router does not have a BGP peer configured with the on-premises router's IP address, or the peer is in an 'inactive' state. Since the Cloud VPN tunnel itself can be established (option A is not necessarily true), the most likely cause is that the Cloud Router is not configured to accept BGP connections from this specific on-premises peer.

Answer

The Cloud VPN tunnel is not established.

Answer

The on-premises router's BGP configuration has the wrong ASN.

Answer

The BGP MD5 password is mismatched between the two peers.

Question 2

Which TWO statements about HA VPN are correct?

Accepted Answer

It supports both active-active and active-passive modes.. Option C is correct because HA VPN supports both active-active and active-passive modes. In active-active mode, both tunnels forward traffic simultaneously, while in active-passive mode, one tunnel is used as a standby. This flexibility allows HA VPN to meet different high-availability and load-balancing requirements.

Answer

Both VPN gateways must be in the same region.

Answer

It uses IKEv1 by default.

Answer

It supports static routing as well as dynamic routing.

Question 3

Which THREE factors can affect the throughput of a Cloud VPN tunnel? (Choose three.)

Accepted Answer

Tunnel type (route-based vs policy-based). Tunnel type (route-based vs policy-based) affects throughput because route-based tunnels (e.g., using BGP or static routes) can leverage ECMP and do not require per-flow policy lookups, reducing CPU overhead. Policy-based tunnels require the VPN gateway to evaluate each packet against a security policy, which adds latency and can limit throughput, especially under high traffic loads.

Answer

VM instance types

Answer

Number of tunnels

Question 4

Which THREE components are required to set up a Partner Interconnect connection?

Accepted Answer

A VLAN attachment. A VLAN attachment (option B) is required because it defines the connection between your VPC and the partner's network over a Partner Interconnect, specifying the VLAN ID and IP addressing for the BGP session. Without a VLAN attachment, the Layer 2 and Layer 3 parameters for the interconnect cannot be established.

Answer

A Dedicated Interconnect connection

Answer

A Cloud VPN gateway

Question 5

Which TWO statements about Cloud Router BGP are correct? (Choose two.)

Accepted Answer

Cloud Router can use a private ASN.. Option B is correct because Cloud Router can use a private ASN (64512-65534) for BGP peering, which is common when connecting to on-premises networks that do not require a public ASN. This allows flexibility in hybrid interconnectivity without needing to register a public ASN.

Answer

Cloud Router uses multi-hop eBGP by default.

Answer

Cloud Router requires a public ASN.

Answer

Cloud Router only supports MED for routes it sends to on-premises.

Question 6

A company has two Dedicated Interconnects in different metro regions connecting to Google Cloud. They want to use BGP communities to influence Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises. Which community action can they apply on the on-premises routers?

Accepted Answer

Set BGP community 79ba:100 on routes from the preferred interconnect. Option C is correct because Google Cloud uses 16-bit ASN format for BGP communities, and the well-known community 79ba:100 (equivalent to 31210:256 in decimal) is a Google-defined community that sets a higher local preference on routes received from the preferred interconnect. This influences Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises, as higher local preference is evaluated before MED or AS-path length.

Answer

Set BGP community 2:100 on routes to indicate MED change

Answer

Set BGP community 0:100 on routes to mark them as high preference

Answer

Set BGP community 79ba:101 on routes from the preferred interconnect

Question 7

When setting up a Partner Interconnect, which Google Cloud resource is used to connect to the partner's network?

Accepted Answer

VLAN attachment. When setting up a Partner Interconnect, the correct Google Cloud resource is a VLAN attachment. This attachment is provisioned on a Cloud Interconnect connection that is managed by a supported service provider, and it defines the VLAN and the Cloud Router configuration used to exchange routes via BGP. The VLAN attachment is the logical construct that connects your VPC network to the partner's network through the partner's physical infrastructure.

Answer

Cloud VPN gateway

Answer

Cloud Interconnect attachment

Answer

Cloud Router

Question 8

An organization is experiencing high latency on their Partner Interconnect connection. Which TWO tools or features can they use to diagnose the issue from within Google Cloud? (Choose two.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic flowing to and from VPC instances, including latency-related metrics such as packet loss and retransmissions. By analyzing these logs, you can identify if high latency is caused by dropped packets or congestion on the Partner Interconnect link. This makes VPC Flow Logs a direct diagnostic tool for latency issues from within Google Cloud.

Answer

Network Intelligence Center performance dashboard

Answer

Cloud Router logs

Answer

Cloud Load Balancing logs

Question 9

Which TWO are valid methods to allow on-premises traffic to reach Google Cloud resources that only have internal (private) IP addresses? (Choose two.)

Accepted Answer

Set up Cloud VPN or Interconnect and configure proper routing and firewall rules.. Option A is correct because Cloud VPN or Interconnect creates a secure, private connection between on-premises and Google Cloud VPCs. By configuring proper routing (e.g., custom static routes or BGP) and firewall rules, on-premises traffic can reach internal-only IP addresses without needing public IPs, as the traffic traverses the private network path.

Answer

Assign public IP addresses to the resources and use firewall rules to allow on-premises traffic.

Answer

Use Cloud NAT to allow inbound connections from on-premises.

Answer

Use the default internet gateway route for the VPC.

Question 10

A company requires a dedicated connection from their on-premises data center to Google Cloud with a guaranteed SLA of 99.99% and bandwidth starting at 10 Gbps. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google Cloud, supporting bandwidths of 10 Gbps or 100 Gbps per circuit. It offers a 99.99% or 99.999% SLA depending on the configuration (e.g., dual connections with diverse paths), meeting the guaranteed SLA and bandwidth requirements specified in the question.

Answer

Direct Peering

Answer

Cloud VPN

Answer

Partner Interconnect

Question 11

A company has a Cloud VPN between their on-premises network and Google Cloud. They want to ensure that traffic flows symmetrically, meaning that traffic from Google Cloud to on-premises uses the same VPN tunnel as traffic from on-premises to Google Cloud. Which best practice should they implement?

Accepted Answer

Implement policy-based routing that forces traffic to and from specific subnets to use the same tunnel.. Option B is correct because policy-based routing (PBR) allows you to explicitly define forwarding rules based on source/destination IP addresses, ensuring that traffic from Google Cloud to on-premises uses the same VPN tunnel as the reverse direction. This enforces symmetric flow, which is critical for stateful firewalls and NAT devices that expect packets to arrive on the same interface they left. Dynamic routing (BGP) or static routes alone do not guarantee symmetry unless combined with PBR or tunnel interface configurations.

Answer

Use dynamic routing with BGP and ensure that the AS path length is the same on both sides.

Answer

Deploy multiple VPN tunnels and use different priorities for each.

Answer

Use static routes pointing to the VPN tunnel on both sides.

Question 12

Which TWO network services are required to enable private Google access for on-premises hosts using a Dedicated Interconnect connection? (Choose two.)

Accepted Answer

Cloud Router with BGP. Cloud Router with BGP is required because Dedicated Interconnect uses BGP sessions between the on-premises router and Google's edge router to exchange routes. Without BGP, the on-premises network cannot advertise or receive the routes necessary for private Google access, such as the 199.36.153.4/30 or 199.36.153.8/30 ranges used for Private Google Access for on-premises.

Answer

Cloud NAT

Answer

VPC Flow Logs

Answer

Cloud VPN

Question 13

Refer to the exhibit. A VM with the 'ssh-allowed' tag is unreachable via SSH from the internet, while other VMs with the same tag work. What is the most likely cause?

Accepted Answer

A firewall rule with priority 500 denies ingress traffic to the VM's tag or IP range.. The most likely cause is that a firewall rule with priority 500 explicitly denies ingress traffic to the specific VM's tag or IP range, overriding the allow-ssh rule (which has a lower priority, i.e., a higher numerical value). In Google Cloud Platform (GCP), firewall rules are evaluated from lowest to highest priority number, and a deny rule with a lower priority number (e.g., 500) takes precedence over an allow rule with a higher priority number (e.g., 1000). This explains why other VMs with the same 'ssh-allowed' tag remain reachable, as they are not affected by the specific deny rule.

Answer

The rule source range is set to 0.0.0.0/0, which includes all internet IPs, so it should allow SSH.

Answer

The VM is in a different VPC that does not have the allow-ssh rule.

Answer

The firewall rule 'allow-ssh' has a higher priority (1000) than the implicit deny (65535), so it should work.

Question 14

A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?

Accepted Answer

Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'. Option D is correct because it defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.

Answer

Ingress rule: allow tcp:3306, source IP range 10.0.0.0/8, target tags 'db'

Answer

Ingress rule: allow tcp:3306, source tags 'web', target service account 'db-sa'

Answer

Egress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'

Question 15

A company runs a private GKE cluster in us-central1. Pods need to access the internet for updates. Which configuration is required?

Accepted Answer

Enable Cloud NAT on the cluster's subnet.. In a private GKE cluster, nodes do not have external IPs, so pods cannot reach the internet directly. Cloud NAT provides outbound connectivity by translating private IPs to a public IP, allowing pods to fetch updates while keeping the cluster private. This is the standard solution for outbound-only internet access from private GKE clusters.

Answer

Add network tags to allow egress traffic.

Answer

Create a Cloud Router with BGP peering.

Answer

Assign external IPs to the nodes.

PCNE Practice Test 12 — 15 Questions

Exhibit

PCNE Practice Test 12 — 15 Questions

Exhibit