PCNE Practice Test 14 — 15 Questions

Question 1

A company wants to establish a dedicated physical connection between their on-premises network and Google Cloud. They need a 10 Gbps connection and are willing to manage the circuit and colocation facility themselves. Which Google Cloud service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection between the on-premises network and Google's network via a colocation facility and Google Partner PoP. It is managed by the customer for circuit ordering and colocation.

Answer

Partner Interconnect

Answer

Cloud CDN

Answer

Cloud VPN

Question 2

An organization needs to reduce egress costs for a global application serving users worldwide. The application serves static content from Compute Engine instances. Which action is most cost-effective?

Accepted Answer

Use Cloud CDN to cache content at edge locations. Cloud CDN caches content at Google's globally distributed edge locations, reducing the distance data must travel to reach users. This decreases egress traffic from the origin Compute Engine instances because repeated requests are served from cache, directly lowering egress costs. It also improves latency and offloads origin servers.

Answer

Move all instances to a single region to reduce cross-region traffic

Answer

Upgrade to premium tier networking

Answer

Enable Private Google Access

Question 3

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Accepted Answer

Create a new VPC in Google Cloud, then establish a VPN connection between on-premises and the new VPC, then configure BGP for dynamic routing, then set up VPC peering (if needed), and finally migrate workloads to the new VPC.. In a typical migration using VPN and VPC peering, you first create a VPC in Google Cloud as the target environment. Then, you set up a VPN connection between the on-premises network and this new VPC. After establishing VPN connectivity, configure BGP for dynamic routing to exchange routes. If needed, set up VPC peering to connect the new VPC to other VPCs in Google Cloud. Finally, migrate workloads from on-premises to the new VPC. The given common mistake sequence (VPN, BGP, new VPC) is incorrect because a VPC must exist before VPN can be created.

Answer

Establish a VPN connection first, then configure BGP, then create a new VPC, then set up VPC peering, then migrate workloads.

Answer

Configure BGP first, then create a new VPC, then establish VPN, then set up VPC peering, then migrate workloads.

Answer

Create a new VPC, then set up VPC peering, then establish VPN, then configure BGP, then migrate workloads.

Question 4

Refer to the exhibit. You are troubleshooting an on-premises to Cloud VPN connection with dynamic routing. The BGP session is CONNECTED, but no routes are received from the on-premises router. What is the most likely cause?

Accepted Answer

The on-premises router is not configured to advertise routes.. The BGP session being CONNECTED means that TCP port 179 is open and the BGP handshake completed successfully, so firewall rules are not blocking BGP traffic and the VPN tunnel is up. The lack of received routes indicates that the on-premises router is not sending any BGP UPDATE messages with network layer reachability information (NLRI). This is typically because the on-premises router is not configured to advertise its local routes to the BGP peer, either due to missing network statements, redistribution, or outbound filters. Therefore, option B is the most likely cause.

Answer

The firewall rules are blocking BGP traffic.

Answer

The VPN tunnel is down.

Answer

The cloud router is not advertising any routes.

Question 5

Which VPC type allows you to specify custom IP ranges and regions for subnets during creation, and does not automatically create subnets in every region?

Accepted Answer

Custom mode VPC. Custom mode VPCs let you define subnets manually. Auto mode creates a subnet per region automatically.

Answer

Auto mode VPC

Answer

Legacy Network

Answer

Shared VPC

Question 6

Which Google Cloud service allows you to create a hub-and-spoke topology for connecting on-premises networks and VPCs?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is Google Cloud's purpose-built service for building hub-and-spoke topologies that connect on-premises networks (via VPN or Interconnect) to multiple VPC networks through a central hub. It supports both VPC spokes and hybrid spokes (Router appliance or VPN tunnels), enabling transitive routing between spokes that VPC peering alone cannot provide. This makes it the correct answer for a hub-and-spoke design spanning on-prem and VPCs.

Answer

Cloud VPN

Answer

VPC Network Peering

Answer

Cloud Interconnect

Question 7

An organization uses Cloud DNS with a managed zone for example.com. They want to block or override DNS queries for a specific malicious domain (malware.com) to return a sinkhole IP address. Which Cloud DNS feature should they use?

Accepted Answer

Response Policy Zone (RPZ). Response Policy Zones (RPZs) in Google Cloud DNS allow you to define custom rules that override DNS responses for specific domains. By creating an RPZ and associating it with a managed zone, you can intercept queries for malicious domains like malware.com and return a sinkhole IP address instead of the real one. This is the intended feature for DNS-based blocking and sinkholing in Cloud DNS.

Answer

DNS forwarding

Answer

DNS peering

Answer

Managed zone with DNSSEC

Question 8

An organization has a VPC with several subnets and wants to monitor firewall rule usage to identify rules that are overly permissive (e.g., allowing all traffic from 0.0.0.0/0). Which Google Cloud service provides this insight?

Accepted Answer

Firewall Insights. Firewall Insights in Network Intelligence Center provides analytics on firewall rules, including overly permissive rules and shadowed rules.

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Answer

Cloud Logging

Question 9

A company wants to serve private content from Cloud CDN using signed URLs that expire after 1 hour. Which steps are required to enable this?

Accepted Answer

Create a signing key in Cloud CDN, then generate signed URLs with expiration using that key.. Cloud CDN signed URLs require a signing key that is created and managed in Cloud CDN. The key is used to generate a URL with an expiration timestamp (and optionally other restrictions). The CDN edge validates the signature and expiration before serving the private content. This is the standard mechanism for time-limited access to cached private content.

Answer

Set the cache mode to FORCE_CACHE_ALL and enable private access.

Answer

Pass the signing key in the X-Goog-Signed-URL header on each request.

Answer

Enable IAP on the backend and generate signed URLs using the IAP client ID.

Question 10

A team needs to perform a health check for a gRPC backend service. Which health check type should they use?

Accepted Answer

gRPC health check. A gRPC health check is specifically designed to test gRPC services by using the gRPC health checking protocol. This protocol allows the load balancer to send a standard health check request to the service, which responds with its status. It is the most appropriate method for gRPC backends because it understands the gRPC protocol and can accurately determine service health.

Answer

HTTP health check

Answer

TCP health check

Answer

SSL health check

Question 11

An organization needs to distribute incoming traffic across multiple GCE instances in the same region while preserving the client IP address. Which load balancer should they use?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves the client IP.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 12

A company wants to run a DNS resolution service for their hybrid cloud environment. They need on-premises servers to resolve GCP private VM hostnames, and GCP VMs to resolve on-premises hostnames. Which Google Cloud service should they use?

Accepted Answer

Cloud DNS with inbound and outbound DNS forwarding. Cloud DNS with inbound and outbound DNS forwarding enables bidirectional DNS resolution between on-premises and GCP.

Answer

Cloud DNS public zone

Answer

Cloud DNS private zone with DNS peering

Answer

Cloud NAT

Question 13

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

Accepted Answer

It reduces latency by serving content from edge locations.. Cloud CDN caches content at Google's global edge locations, which are geographically closer to end users. By serving static content from these edge caches instead of the origin HTTP load balancer, the request latency is significantly reduced because the data travels a shorter distance over the network.

Answer

It eliminates the need for SSL certificates.

Answer

It provides DDoS protection only.

Answer

It increases compute instance capacity.

Question 14

A company uses Cloud CDN with an external HTTP(S) load balancer. They have two origin server groups: a primary in us-central1 and a backup in europe-west1. They want traffic directed to the primary unless it is unhealthy, in which case traffic should fail over to the backup. Which configuration is required?

Accepted Answer

Create a backend service with two backends (primary and failover) and a failover policy that marks the primary as failover when unhealthy.. Cloud CDN with an external HTTP(S) load balancer uses a backend service that can contain multiple backends (e.g., instance groups or NEGs) with a failover policy. When the primary backend is marked as unhealthy by the health check, the load balancer automatically routes traffic to the failover backend. This configuration meets the requirement without manual intervention.

Answer

Create a Cloud CDN with two origins and enable failover in the CDN settings.

Answer

Use a TCP/UDP network load balancer with two target pools.

Answer

Configure a weighted round-robin with primary weight 100 and backup weight 0, and change weights manually.

Question 15

A company uses Cloud Armor with WAF rules to protect an HTTPS load balancer. They notice that legitimate traffic from certain IPs is being blocked. How should they troubleshoot?

Accepted Answer

Review Cloud Armor security policy logs.. Cloud Armor security policy logs record the actions taken by WAF rules, including which requests were blocked and why. By reviewing these logs, you can identify the specific rule that is blocking legitimate traffic and adjust its configuration, such as modifying IP allowlists or threshold values.

Answer

Check firewall rule logs.

Answer

Enable Packet Mirroring.

Answer

Use VPC Flow Logs.