PCNE Practice Test 13 — 15 Questions

Question 1

A company is migrating an on-premises DNS service to Cloud DNS. They want to resolve on-premises hostnames from GCP VMs and resolve Google Cloud private zone names from on-premises. They have a Cloud VPN with BGP. Which architecture should they implement?

Accepted Answer

Configure a Cloud DNS forwarding zone for on-premises names and a private zone for GCP names. Then create an inbound server policy for on-premises to query Cloud DNS.. Option A is correct because Cloud DNS supports inbound server policies that allow on-premises DNS resolvers to forward queries for private zone names (e.g., `gcp.internal`) to Cloud DNS via the Cloud VPN. A forwarding zone in the VPC directs queries for on-premises hostnames (e.g., `corp.example.com`) to the on-premises DNS servers. This bidirectional resolution is achieved without exposing DNS to the internet, leveraging BGP for routing.

Answer

Configure a split-horizon DNS with separate DNS servers for each environment.

Answer

Set up Cloud DNS peering zones between the VPC and on-premises.

Answer

Use DNS over HTTPS from on-premises to Google's public DNS.

Question 2

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

Accepted Answer

It reduces latency by serving content from edge locations.. Cloud CDN caches content at Google's global edge locations, which are geographically closer to end users. By serving static content from these edge caches instead of the origin HTTP load balancer, the request latency is significantly reduced because the data travels a shorter distance over the network.

Answer

It eliminates the need for SSL certificates.

Answer

It provides DDoS protection only.

Answer

It increases compute instance capacity.

Question 3

A company has Compute Engine instances in a VPC that only have internal IP addresses. They need to access Google Cloud services like Cloud Storage and BigQuery. They also have on-premises servers that need to access the same instances via a Cloud VPN tunnel. What must be enabled for the instances to access Google APIs without public IPs?

Accepted Answer

Private Google Access. Private Google Access enables Compute Engine instances that have only internal IP addresses (no external IPs) to reach Google APIs and services such as Cloud Storage and BigQuery. It works by routing traffic destined for Google API IP ranges through the default internet gateway, using the VPC's internal DNS resolution to map the API hostnames to Google's internal IP addresses, without requiring a public IP on the instance.

Answer

Cloud Router

Answer

VPC peering

Answer

Cloud NAT

Question 4

A company has a single VPC with subnets in us-central1 and europe-west1. They have Compute Engine instances in both subnets that need to communicate with each other. The security team wants to ensure that only specific instances in us-central1 can connect to a database instance in europe-west1 on port 3306. Currently, the default firewall rules allow all internal traffic (priority 65535). The network engineer first creates a new ingress firewall rule to allow TCP traffic on port 3306 from instances with the network tag 'app' to instances with the tag 'db', with priority 1000. Then, to enforce the restriction, they delete the default allow internal rule (priority 65535). However, after applying the changes, the app instances (tagged 'app') in us-central1 cannot connect to the database instance (tagged 'db') in europe-west1. The engineer verifies that the tags are correctly applied to the instances. What is the most likely cause of the connectivity failure?

Accepted Answer

The app instances need a firewall rule to allow egress traffic to the database on port 3306.. B is correct because in Google Cloud VPC, firewall rules are stateful for ingress but not for egress. The ingress rule allowing traffic from 'app' to 'db' on port 3306 only controls incoming packets to the database instance. The app instance still needs an egress firewall rule to allow outbound traffic on port 3306, otherwise the outbound SYN packet is dropped before it reaches the database. Deleting the default allow internal rule (priority 65535) removed the implicit egress permission, so a specific egress rule is required.

Answer

The firewall rule only allows ingress from instances with tag 'app' but the egress traffic from app instances is blocked.

Answer

The firewall rule is applied to the wrong VPC network.

Answer

The database instance's network tag 'db' was not applied to the database instance.

Question 5

A company has a Dedicated Interconnect connection from their on-premises data center to GCP. They have set up BGP sessions over VLAN attachments to peer with their VPC. Traffic from on-premises to GCP works, but return traffic from GCP to on-premises is dropped at the on-premises firewall. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the on-premises prefix to GCP via BGP.. The most likely cause is that the on-premises router is not advertising the on-premises prefix to GCP via BGP. For return traffic from GCP to be routed correctly, GCP must learn the on-premises network prefix through a BGP advertisement from the on-premises router. Without this advertisement, GCP has no route to send traffic back, causing the firewall to drop the packets as they have no valid path.

Answer

The VLAN attachment is in a different region than the GCP resources.

Answer

A GCP firewall rule is blocking the return traffic.

Answer

The MTU size is inconsistent between the on-premises router and GCP.

Question 6

Which TWO of the following are benefits of using Cloud NAT?

Accepted Answer

Enables outbound traffic from instances without public IPs. Cloud NAT enables outbound connectivity from private instances that lack public IP addresses. It translates private source IPs to a single or a pool of external IPs, allowing instances to reach the internet while remaining unreachable from outside. This is essential for security and compliance in VPC networks.

Answer

Supports static IP addresses for all instances

Answer

Provides inbound port forwarding

Answer

Automatically scales with the number of instances

Question 7

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

Accepted Answer

Private Service Connect endpoint. When a consumer wants to connect to a managed SaaS application published via Private Service Connect (PSC), they must create a Private Service Connect endpoint in their own VPC. This endpoint is a regional resource that uses an internal IP address from the consumer's VPC and establishes a connection to the service attachment published by the provider. The endpoint effectively makes the SaaS service accessible as if it were a resource inside the consumer's VPC, without requiring public IPs or VPNs.

Answer

Service attachment

Answer

Internal forwarding rule

Answer

Cloud VPN tunnel

Question 8

Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?

Accepted Answer

Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.. The preconfigured WAF rule for SQL injection (sqli-stable) uses a default sensitivity level that may be too aggressive, causing false positives on legitimate traffic. By lowering the sensitivity level or excluding specific request attributes (e.g., headers, cookies, or URI paths), you can reduce false positives while still blocking actual SQL injection attempts. Cloud Armor allows fine-tuning of preconfigured rules via the `sensitivity` parameter and `exclude` lists, which is the correct approach here.

Answer

Add a rate-based rule to limit the number of requests per second.

Answer

Create a rule with higher priority to allow the legitimate traffic before the WAF rule.

Answer

Enable TLS inspection for the load balancer to fully inspect encrypted traffic.

Question 9

A company has deployed Cloud HA VPN between their on-premises network and Google Cloud. They have two tunnels from the on-premises VPN appliance to the HA VPN gateway. The on-premises appliance uses a single public IP address for both tunnels, while the Cloud VPN gateway uses two different public IPs. BGP sessions are established over both tunnels, and the Cloud Router is configured with 'active/active' mode. The network team notices that all outbound traffic from Google Cloud to on-premises is using only one of the two tunnels, even though both tunnels are up. BGP metrics are identical for routes received over both sessions. What is the most likely cause?

Accepted Answer

The Cloud Router does not support ECMP when both BGP sessions have the same peer IP address.. Option C is correct because Cloud Router uses the BGP peer IP address as part of the ECMP hash key. When both BGP sessions originate from the same on-premises public IP (the single IP used for both tunnels), Cloud Router sees them as the same peer and does not load-balance across them. Even though the tunnels use different Cloud VPN gateway IPs, the BGP sessions share a common peer IP, which prevents ECMP from being enabled.

Answer

The BGP sessions have different hold timers causing one to be preferred.

Answer

The on-premises appliance must use two different public IPs for ECMP to work.

Answer

The Cloud Router must be configured with 'active/standby' mode instead of 'active/active'.

Question 10

Your company has a hybrid cloud architecture with two on-premises data centers: DC1 and DC2. Each DC is connected to Google Cloud via separate Cloud VPN tunnels (tunnel1 from DC1, tunnel2 from DC2) to a VPC in us-west1. The VPC has two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). DC1 has a subnet 192.168.1.0/24 and DC2 has 192.168.2.0/24. You configure BGP on both tunnels with the VPC dynamic routing, and each on-premises router advertises its local subnet. The VPC automatically imports the learned routes. You notice that traffic from DC1 to an instance in subnet-a (10.0.1.5) works, but traffic from DC2 to the same instance fails intermittently. Additionally, traffic from DC2 to DC1 (192.168.1.0/24) fails completely. You check the route tables and see that both tunnels have learned the routes for the remote subnets. What is the most likely cause and solution?

Accepted Answer

Configure each Cloud VPN tunnel with a separate Cloud Router and assign different BGP priorities to influence route selection, or use distinct regions for the VPN gateways.. The issue is that both Cloud VPN tunnels are using the same Cloud Router, causing BGP to learn identical routes for the on-premises subnets from both tunnels. This leads to asymmetric routing and potential black-holing, especially when traffic from DC2 to DC1 or to subnet-a is routed via DC1's tunnel due to equal-cost multi-path (ECMP) or default BGP tie-breaking. By configuring separate Cloud Routers with different BGP priorities (MED or local preference), you can force traffic from each DC to use its own tunnel, ensuring symmetric routing and consistent connectivity.

Answer

Create a new VPN tunnel from DC2 to a different VPC and use VPC peering.

Answer

Increase the MTU on the VPN tunnels to avoid fragmentation.

Answer

Disable dynamic routing on both tunnels and use static routes instead.

Question 11

A company has deployed an external HTTPS load balancer with a Cloud CDN backend. The load balancer uses a managed SSL certificate. Recently, the company updated their DNS record to point to a different IP address of a new load balancer. After the change, some users are still being served from the old load balancer's cache. The network engineer has confirmed that the DNS TTL has expired. What is the most likely cause of this issue?

Accepted Answer

Cloud CDN cached responses from the old load balancer may still be served until their cache TTL expires.. Cloud CDN caches content at Google's edge caches based on the cache-control headers or default cache TTL. When the DNS record is updated to point to a new load balancer, the old load balancer's cached responses may still be served from edge caches until their cache TTL expires, even after the DNS TTL has expired. This is because Cloud CDN caches are independent of DNS resolution and are governed by HTTP caching rules.

Answer

The old load balancer's SSL certificate is still cached by clients.

Answer

The DNS change has not propagated globally despite the TTL expiring.

Answer

The old load balancer's IP address is still being served by Google's edge network due to anycast.

Question 12

A multinational corporation has deployed a multi-region application on Google Kubernetes Engine (GKE) clusters in us-central1 and europe-west1. The application serves global users and requires low-latency access to a shared database hosted on Cloud SQL in us-central1. The network team has configured Cloud VPN tunnels between each region and the on-premises data center for administrative access. The application instances in europe-west1 are experiencing high latency when connecting to the Cloud SQL instance in us-central1. The team wants to reduce latency without migrating the database. The team has already verified that the Cloud SQL instance has private IP enabled and is peered to a shared VPC that spans both regions. The GKE clusters are in the same shared VPC. What should the team do?

Accepted Answer

Configure Private Service Connect to expose the Cloud SQL instance from us-central1 and access it via a service attachment from europe-west1.. Option A is correct because Private Service Connect (PSC) allows the Cloud SQL instance in us-central1 to be accessed from europe-west1 via a service attachment and a private endpoint, enabling traffic to traverse Google's internal network without backhauling through the on-premises data center. This reduces latency by keeping the traffic within Google's backbone, avoiding the longer path through the Cloud VPN and on-premises network. PSC supports cross-region connectivity with private IP, which aligns with the requirement to not migrate the database.

Answer

Configure a global external HTTP(S) load balancer in front of the Cloud SQL instance.

Answer

Create a Cloud Interconnect connection from europe-west1 to the on-premises data center and route traffic through the on-premises network to reach us-central1.

Answer

Enable Cloud SQL public IP and allow the GKE nodes in europe-west1 to connect over the internet using Cloud NAT.

Question 13

A company has a VPC with a subnet in us-central1. They have several private Compute Engine instances (no external IP) that need to download updates from a public repository on the internet. The network engineer has created a Cloud NAT gateway in the same region and attached it to the subnet. However, the instances still cannot reach the internet. The engineer has confirmed that the Cloud NAT gateway is correctly configured and that the subnet's Private Google Access is not relevant for this traffic. What should the engineer check first to resolve the issue?

Accepted Answer

Verify that the default route (0.0.0.0/0) is present in the VPC route table pointing to the internet gateway.. Option A is correct because even with a properly configured Cloud NAT, instances require a default route (0.0.0.0/0) in the VPC route table that points to the internet gateway (IGW) to direct outbound traffic to the internet. Cloud NAT translates private IPs to public IPs, but it does not create the route; the route must exist for packets to leave the VPC. Without this route, traffic from the instances to 0.0.0.0/0 will be dropped, as there is no next-hop to forward packets to the internet.

Answer

Confirm that the Cloud NAT router is configured with the correct network and subnet.

Answer

Ensure that the Cloud NAT gateway has a static external IP.

Answer

Check that the firewall rules allow egress traffic for the instances to the internet.

Question 14

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect using VLAN attachments. They have set up a Cloud Router with BGP to exchange routes. The on-premises network advertises a prefix 10.0.0.0/8, and Google Cloud advertises the VPC's subnet ranges (10.0.0.0/24 and 10.0.1.0/24). After configuration, on-premises hosts cannot reach the Google Cloud instances in those subnets. The engineer checks the BGP session status and it is established. The Cloud Router shows that the on-premises prefix is learned, and the on-premises router shows that the specific /24 prefixes are received. However, traffic from on-premises to the Google Cloud subnets is not working. What is the most likely cause?

Accepted Answer

The on-premises router has a local route for 10.0.0.0/8 that overrides the BGP-learned /24 routes.. The most likely cause is that the on-premises router has a local route for the larger prefix 10.0.0.0/8, which is more specific than the BGP-learned /24 routes. Since the local route has a lower administrative distance (typically 0 for directly connected or 1 for static) compared to BGP's administrative distance of 20 for eBGP, the on-premises router prefers the local route and forwards traffic locally instead of sending it over the Dedicated Interconnect to Google Cloud. This results in traffic not reaching the VPC subnets.

Answer

The VPN connection needs to be configured for the Interconnect.

Answer

The Google Cloud VPC has a custom static route that overrides the dynamically learned route.

Answer

The on-premises firewall is blocking the traffic.

Question 15

A company uses Cloud Armor with an external HTTPS load balancer to protect their web application. They have a security policy 'my-policy' attached to the backend service. The policy includes an allow rule (priority 1000) for their corporate IP range (203.0.113.0/24) and a deny rule (priority 2000) for all other IPs. The company has an office at a remote location that uses a different IP range (198.51.100.0/24). Employees from the remote office report they cannot access the application. Meanwhile, employees from the corporate office (203.0.113.0/24) can access. The engineer checks the Cloud Armor policy and sees the rule configuration as shown. What is the most likely cause?

Accepted Answer

The remote office IP range is not included in an allow rule in the security policy.. The remote office IP range (198.51.100.0/24) is not explicitly allowed by any rule in the security policy. The only allow rule (priority 1000) permits traffic from the corporate IP range (203.0.113.0/24), and the deny rule (priority 2000) blocks all other IPs. Since the remote office IPs are not covered by the allow rule, they are denied by default, which explains their inability to access the application.

Answer

The rule evaluation order is wrong; the deny rule should have higher priority (lower number).

Answer

The deny rule uses 'SRC_IPS_V2' which is an invalid expression.

Answer

The load balancer's frontend IP blocks traffic from certain geographic regions.