PCNE Practice Test 13 — 15 Questions

Question 1

A company has a VPC with subnet 10.1.0.0/24 in us-central1. They created a Cloud NAT gateway named 'nat-us-central1' attached to that subnet. During peak hours, many VM instances in the subnet cannot connect to the internet. The NAT configuration shows only one NAT IP. Firewall rules allow egress traffic, and health checks confirm the NAT gateway is functioning. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Port exhaustion due to insufficient NAT IP addresses.. With only one NAT IP address and many VM instances sharing it, the available source ports (65,535 per IP) are quickly exhausted during peak hours. Each concurrent outbound connection consumes a unique source port; once all ports are in use, new connections fail. This is a classic port exhaustion scenario, not a configuration or firewall issue.

Answer

The Cloud Router is missing or misconfigured.

Answer

The NAT gateway is not attached to the correct subnet.

Answer

An egress firewall rule blocks ICMP packets.

Question 2

A network engineer is troubleshooting a failing HA VPN tunnel. They need to view VPN gateway logs to identify the issue. Which Google Cloud service should they use to access the logs?

Accepted Answer

Cloud Logging. Cloud Logging captures logs from Cloud VPN gateways, including tunnel events, IKE negotiations, and error messages.

Answer

Cloud Audit Logs

Answer

Cloud Debugger

Answer

Cloud Monitoring

Question 3

An organization uses Dedicated Interconnect with VLAN attachments in multiple regions. They need to ensure that traffic from one region to another flows over the interconnect backbone instead of the internet. Which configuration is required?

Accepted Answer

Enable global routing mode on the VPC. C is correct because enabling global routing mode on the VPC allows the VPC to use the same Dedicated Interconnect VLAN attachments across all regions. With global routing, routes learned via BGP over the interconnect are propagated to every region, ensuring that inter-region traffic is forwarded through the interconnect backbone rather than the public internet. Without global routing, each region would have its own VPC and would not share the interconnect routes, causing traffic to egress via the internet.

Answer

Use Partner Interconnect instead

Answer

Configure Network Connectivity Center

Answer

Set BGP MED values on Cloud Router

Question 4

A company wants to connect two VPC networks using VPC Network Peering. What is required for this setup?

Accepted Answer

The VPCs must have non-overlapping IP ranges.. VPC Network Peering requires that the IP address ranges of the two VPC networks do not overlap. This is because peering creates a direct private connection between the VPCs, and overlapping CIDR blocks would cause routing ambiguity and conflicts. Google Cloud validates this at peering creation time and rejects the peering if any subnet ranges overlap.

Answer

A Cloud VPN tunnel must be established.

Answer

Both VPCs must belong to the same organization.

Answer

Both VPCs must be in the same region.

Question 5

A company needs to connect on-premises to Google Cloud with overlapping IP ranges. The on-premises network uses 10.0.0.0/16 and the VPC uses 10.0.0.0/16. What is the best approach?

Accepted Answer

Use Cloud VPN with source NAT on the on-premises side.. When on-premises and VPC CIDR ranges overlap (both 10.0.0.0/16), routing breaks because the same destination prefix exists on both sides and Cloud Router/VPN cannot distinguish them. The only way to make a Cloud VPN work is to hide the on-premises addresses behind a non-overlapping range before they enter the tunnel — i.e., apply source NAT (SNAT) on the on-premises VPN gateway so packets arrive at the Google Cloud VPN with a translated source IP (e.g., 192.168.0.0/24). Google Cloud then routes return traffic back to that translated range, and the on-premises device un-NATs it. This preserves connectivity without renumbering either network.

Answer

Use Cloud NAT.

Answer

Use VPC peering.

Answer

Use Private Google Access.

Question 6

A company has a Shared VPC with a host project and several service projects. They want to allow a service project's Network Engineer to create and manage Cloud Load Balancers, but not modify other networking resources in the shared VPC. Which IAM role should be granted at the service project level?

Accepted Answer

Compute Load Balancer Admin (roles/compute.loadBalancerAdmin). The Compute Load Balancer Admin role (roles/compute.loadBalancerAdmin) grants permissions to create, update, and delete load balancers. The Network Admin role (roles/compute.networkAdmin) would allow modifying other network resources, which is not desired.

Answer

Project Editor (roles/editor)

Answer

Compute Network Admin (roles/compute.networkAdmin)

Answer

Compute Security Admin (roles/compute.securityAdmin)

Question 7

A company uses Shared VPC with a host project and multiple service projects. A service project administrator wants to create a VM with an internal IP from a specific subnet in the host project. The operation fails with a permission error. What is the most likely missing permission?

Accepted Answer

compute.subnetworks.use on the host project subnet.. In a Shared VPC, a service project administrator needs permission to use a subnet from the host project. The specific IAM permission required to use a subnet when creating a VM is 'compute.subnetworks.use' on the host project's subnet. Without this permission, the VM creation fails with a permission error even if the user has instance creation rights in the service project.

Answer

resourcemanager.projects.get on the host project.

Answer

compute.instances.create on the service project.

Answer

compute.networks.use on the host project VPC.

Question 8

A company has a Cloud VPN tunnel to on-premises. They want on-premises clients to resolve private DNS names in the VPC. Which service should they configure?

Accepted Answer

Inbound DNS policy. An inbound DNS policy in Google Cloud allows on-premises clients (via Cloud VPN or Interconnect) to query the VPC's private DNS zone through the inbound DNS forwarding feature. This is the correct service when the goal is for external/on-premises clients to resolve private DNS names hosted in the VPC. Outbound DNS policies handle the reverse direction — forwarding queries from VPC resources to on-premises DNS.

Answer

Outbound DNS policy

Answer

Cloud NAT

Answer

Private Google Access

Question 9

Your company has a VPC with two subnets: 10.0.1.0/24 in us-central1 and 10.0.2.0/24 in us-east1. They have a Cloud VPN tunnel to the on-premises data center using dynamic routing (BGP). The Cloud Router was created in the us-central1 region with default settings. On-premises hosts can successfully communicate with instances in the 10.0.1.0/24 subnet, but cannot reach instances in the 10.0.2.0/24 subnet. All instances have appropriate firewall rules allowing traffic from on-premises. The BGP session is established and routes from on-premises are received in Cloud Router. What is the most likely reason for the issue?

Accepted Answer

Cloud Router by default only advertises subnets in its own region.. Cloud Router with default settings only advertises subnets that are in the same region as the Cloud Router itself. Since the Cloud Router was created in us-central1, it only advertises the 10.0.1.0/24 subnet to the on-premises BGP peer. The 10.0.2.0/24 subnet in us-east1 is not advertised, so on-premises hosts have no route to it, even though the BGP session is up and firewall rules are correct.

Answer

The firewall rules in us-east1 are blocking incoming traffic from on-premises.

Answer

The BGP session is down for the us-east1 region.

Answer

The VPN tunnel is only configured to route traffic for us-central1.

Question 10

A network engineer wants to capture all traffic to and from a specific Compute Engine instance for security analysis and forward it to an IDS appliance in another VPC. Which GCP service should they use?

Accepted Answer

Packet Mirroring. Google Cloud Packet Mirroring clones traffic from specific Compute Engine instances and forwards it to a collector, such as an IDS appliance, even across VPCs. It captures all traffic (ingress and egress) at the instance level, making it ideal for security analysis. VPC Flow Logs only provide metadata, not full packet capture.

Answer

VPC Flow Logs

Answer

Firewall Rules Logging

Answer

Cloud NAT logging

Question 11

A company has a Partner Interconnect connection (Layer 2) with a service provider. They need to configure BGP sessions on their on-premises router and Google Cloud Router. The engineer creates a VLAN attachment of type PARTNER. However, the BGP session does not come up. What is the most likely reason?

Accepted Answer

The Cloud Router BGP IP address is not in the same subnet as the VLAN attachment. For a Partner Interconnect VLAN attachment, the Cloud Router's BGP interface IP address must fall within the same subnet as the VLAN attachment's IP range. If the BGP IP is outside that subnet, the BGP session cannot establish because the two endpoints are not on the same Layer 3 network. This is a common misconfiguration when setting up Partner Interconnect, as the Cloud Router BGP IP must be explicitly assigned from the attachment's subnet.

Answer

The VLAN attachment type should be PARTNER_PROVIDER

Answer

The IAM permissions for the Cloud Router are missing

Answer

The on-premises router is using a different BGP AS number than configured

Question 12

An organization needs to protect a web application behind an HTTPS Load Balancer from SQL injection attacks. They want to use a managed WAF solution. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's managed Web Application Firewall (WAF) that integrates directly with external HTTPS load balancers to protect against Layer 7 attacks including SQL injection and cross-site scripting. It provides preconfigured WAF rules based on the OWASP ModSecurity Core Rule Set, and security policies can be attached to backend services behind the load balancer. This makes it the correct managed WAF solution for the stated requirement.

Answer

VPC Service Controls

Answer

Cloud Firewall Rules

Answer

Cloud CDN

Question 13

A company uses Shared VPC to grant separate teams access to subnets in a host project. They want to allow Team A to create VM instances in subnet-1, but not delete the subnet itself. Which IAM role should be granted to Team A on subnet-1?

Accepted Answer

roles/compute.networkUser. The roles/compute.networkUser role grants permission to use subnets in a Shared VPC host project, including creating VM instances in those subnets, but it does not allow modifying or deleting the subnet itself. This is the least-privilege role for Team A's requirement. It is typically granted at the subnet level to service project members so they can consume network resources without administrative control.

Answer

roles/owner

Answer

roles/compute.networkAdmin

Answer

roles/compute.instanceAdmin.v1

Question 14

A network engineer is setting up a Dedicated Interconnect between an on-premises network and Google Cloud. After the circuit is ordered and the physical connection is established at the co-location facility, what is the first step to configure the interconnect inside GCP?

Accepted Answer

Create a VLAN attachment to associate with the interconnect.. After the physical connection is ready, you must create a VLAN attachment in Google Cloud to define the connection between your VPC and the interconnect.

Answer

Configure a VPN tunnel for backup connectivity.

Answer

Enable Cloud NAT for outbound traffic.

Answer

Create a Cloud Router with BGP sessions.

Question 15

You are using Cloud CDN with a backend bucket and want to cache all responses regardless of Cache-Control headers. Which cache mode should you set?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL overrides origin Cache-Control headers and caches all responses. CACHE_ALL_STATIC attempts to cache static content but respects Cache-Control. USE_ORIGIN_HEADERS respects origin headers.

Answer

CACHE_ALL_STATIC

Answer

USE_ORIGIN_HEADERS

Answer

DISABLED