PCNE Practice Test 13 — 15 Questions

Question 1

An engineer needs to create a firewall rule that applies only to instances with the tag 'web-server' in a specific VPC network. The rule should allow ingress from any source on TCP port 80. Which combination of fields must be set in the gcloud command?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-tags=web-server --source-ranges=0.0.0.0/0. To target instances by tag, use --target-tags. For source, --source-ranges (any source: 0.0.0.0/0). For protocol/port, --allow tcp:80. Network is specified with --network. Direction is implied by 'ingress'.

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-tags=web-server --source-tags=0.0.0.0/0

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-service-accounts=web-server@project.iam.gserviceaccount.com

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --source-tags=web-server

Question 2

An engineer has configured a firewall rule with priority 1000 that allows ingress traffic on TCP port 443 from source IP range 10.0.0.0/8. Another rule with priority 500 denies ingress on TCP port 443 from source IP 10.0.1.0/24. What will happen to traffic from 10.0.1.5 destined to the instance on port 443?

Accepted Answer

The traffic is denied because the deny rule has higher priority. Firewall rules are evaluated by priority (lower number = higher priority). Rule with priority 500 (deny) takes precedence over priority 1000 (allow). So traffic from 10.0.1.5 is denied.

Answer

The traffic is allowed because allow rules override deny rules

Answer

The traffic is allowed because the allow rule covers a broader range

Answer

The traffic is denied only if the instance has a tag matching the deny rule

Question 3

A company wants to publish a custom internal service running in their VPC so that consumers in other VPCs can access it using private IP addresses. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows publishing internal services via private endpoints in your VPC and enabling consumption from other VPCs using private IPs.

Answer

Cloud Load Balancing

Answer

VPC Peering

Answer

Cloud VPN

Question 4

You have a Cloud NAT gateway configured in a region with 256 available ports. You allocate static NAT ports to a specific VM for outbound connections. What is the minimum number of ports you should allocate to ensure the VM can handle 500 concurrent connections?

Accepted Answer

512. Cloud NAT uses ports for source NAT. A single connection uses one port. To support 500 concurrent connections, you need at least 500 ports. However, Cloud NAT allows port sharing for the same destination IP and port, but static port allocation per VM typically reserves ports exclusively. To be safe, allocate at least 500 ports.

Answer

128

Answer

256

Answer

64

Question 5

An engineer is configuring a Compute Engine instance with multiple network interfaces for use as a network appliance. Which interface is considered the primary interface for default routes and instance metadata?

Accepted Answer

NIC0. NIC0 is the primary interface; default routes and instance metadata are tied to it. Adding extra interfaces (NIC1, NIC2, etc.) is for specific networking scenarios like network appliances.

Answer

Any interface with an external IP

Answer

The interface with the lowest subnet CIDR

Answer

The interface attached to the default VPC

Question 6

An organization wants to restrict which Google APIs can be accessed by resources in a specific VPC. They also want to prevent data exfiltration to unauthorized projects. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that restrict API access and prevent data exfiltration based on projects and VPCs.

Answer

Cloud Armor

Answer

Private Google Access

Answer

Firewall Rules

Question 7

An organization has multiple VPCs in different projects that need to consume a common internal service hosted in a central project. The service runs on a set of Compute Engine instances with internal IPs. Which architecture allows the consumers to access the service using private IPs without VPC peering?

Accepted Answer

Create a Private Service Connect endpoint in each consumer VPC and publish the service as a Private Service Connect service from the central project.. Private Service Connect allows you to publish internal services via Private Service Connect endpoints in consumer VPCs. Consumers access the service using internal IPs without needing VPC peering or VPNs. This is the recommended architecture for publishing and consuming internal services across projects.

Answer

Use Cloud VPN to connect each consumer VPC to the central VPC.

Answer

Expose the service through an external IP and use IAM to restrict access.

Answer

Set up VPC peering between each consumer VPC and the central VPC.

Question 8

Which TWO of the following are valid ways to target firewall rules in Google Cloud? (Select 2)

Accepted Answer

Target by service account. Firewall rules can target instances by network tags or by service accounts. Tags are key-value pairs, and service accounts provide identity-based targeting.

Answer

Target by zone

Answer

Target by instance name

Answer

Target by machine type

Question 9

A company wants to provide outbound internet access to Compute Engine instances without external IPs, while minimizing IP address consumption. Which Cloud NAT feature should be used to achieve minimal static IP usage?

Accepted Answer

Dynamic port allocation. Cloud NAT supports dynamic port allocation, which uses ephemeral IP addresses from the NAT IP pool. Static port allocation reserves ports per VM and may require more IPs. The question asks to minimize IP consumption, so using dynamic allocation with a small number of NAT IPs is optimal.

Answer

Using a single NAT IP for all VMs

Answer

Enabling Cloud NAT logging

Answer

Static port allocation

Question 10

An engineer needs to deploy a VM that acts as a internet gateway for other instances in the same VPC. The VM must have IP forwarding enabled and must be able to accept traffic on multiple NICs. Which TWO actions are required? (Choose 2)

Accepted Answer

Create firewall rules to allow traffic to the VM's NICs.. To use a VM as a gateway, IP forwarding must be enabled on the VM. Additionally, firewall rules must allow ingress traffic to the VM's NICs that will forward traffic. The VM itself must have routes pointing to it as next hop.

Answer

Disable the VM's source/destination check.

Answer

Create a Cloud NAT gateway.

Answer

Assign an external IP to each NIC.

Question 11

A company runs a web application on Compute Engine instances without external IPs. They need to ensure the instances can access Google APIs (e.g., Cloud Storage) and also provide outbound internet access for software updates. Which two features should be configured? (Choose two.)

Accepted Answer

Cloud NAT. Private Google Access enables access to Google APIs without external IPs. Cloud NAT provides outbound internet access for instances without external IPs.

Answer

VPC Service Controls

Answer

Private Service Connect

Answer

Cloud VPN

Question 12

What is the internal DNS name format for a Compute Engine instance named 'web-server' in zone 'us-central1-a' within project 'my-project'?

Accepted Answer

web-server.us-central1-a.c.my-project.internal. GCP internal DNS uses the format vm-name.zone.c.project-id.internal. For the given example, it is web-server.us-central1-a.c.my-project.internal.

Answer

web-server.us-central1-a.my-project.internal

Answer

web-server.my-project.c.us-central1-a.internal

Answer

web-server.internal

Question 13

A company wants to ensure that Compute Engine instances in a VPC can resolve internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. What is required for this to work?

Accepted Answer

No additional configuration is required; internal DNS resolution works by default.. Google Cloud provides internal DNS resolution for instances within the same VPC network. By default, instances can resolve DNS names for other instances in the same VPC if they are in the same network. There is no additional setup needed; it works out of the box. The DNS name format is [vm-name].[zone].c.[project-id].internal.

Answer

Assign a custom DNS server to the VPC using Cloud DNS inbound server policy.

Answer

Configure a DNS managed zone in Cloud DNS.

Answer

Enable Private Google Access on the subnet.

Question 14

What is the default Maximum Transmission Unit (MTU) for Compute Engine virtual machines?

Accepted Answer

1460. GCP uses an MTU of 1460 for both VMs and the underlying network infrastructure.

Answer

1500

Answer

9001

Answer

1400

Question 15

A company wants to deploy a network appliance (e.g., firewall) on a Compute Engine instance that requires inspecting traffic between two VPCs. The instance must have interfaces in both VPCs. Which three configurations are required? (Choose three.)

Accepted Answer

Attach at least two network interfaces (NIC0 and NIC1). For a multi-NIC network appliance, you need at least two network interfaces (NIC0, NIC1) attached to different VPCs. Each interface must be in a different subnet. Also, IP forwarding must be enabled on the instance to allow it to forward traffic between interfaces.

Answer

Assign an external IP to each interface

Answer

Use the same subnet for both interfaces