PCNE Practice Test 14 — 15 Questions

Question 1

An organization wants to allow only certain users to access a service published via Private Service Connect. They need to restrict access based on the source VPC network. What should they use?

Accepted Answer

Consumer allow lists in the service attachment. Private Service Connect allows publishing services with access control using service attachment with consumer allow lists that specify which projects or VPCs can connect.

Answer

Firewall rules in the consumer VPC

Answer

IAM permissions on the service attachment

Answer

VPC Service Controls

Question 2

An engineer is troubleshooting outbound connectivity from a Compute Engine instance that has no external IP. The instance needs to reach an external service on the internet. Cloud NAT is configured on the VPC network. However, the instance cannot connect. What is the most likely cause?

Accepted Answer

Egress firewall rules are blocking the traffic. For Cloud NAT to work, the instance must be in a subnet for which a Cloud NAT gateway is configured, and the instance should not have an external IP. Additionally, firewall rules must allow egress traffic. The most common issue is missing egress firewall rules or incorrect NAT configuration.

Answer

Private Google Access is not enabled

Answer

The instance has an external IP assigned

Answer

The Cloud NAT gateway is in a different region than the instance

Question 3

A security team needs to block traffic from a specific geographic region (country) from reaching their HTTP Load Balancer. Additionally, they need to allow traffic from specific IP ranges that are known to be legitimate, even if they originate from that blocked region. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Attach the security policy to the backend service of the HTTPS Load Balancer. Cloud Armor allows you to create security policies with rules. Geo-blocking can be implemented by denying traffic based on geographic origin. To allow specific IP ranges from the blocked region, you need a rule with higher priority that allows those IPs before the deny rule. Attach the policy to the backend service of the HTTPS Load Balancer.

Answer

Add a firewall rule in the VPC to deny traffic from the country

Answer

Use VPC Service Controls to restrict access from the country

Question 4

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 5

An engineer needs to configure Cloud NAT with logging enabled to monitor traffic from a specific subnet. The NAT gateway uses automatic NAT IP allocation. The engineer wants to ensure that if a single VM uses many connections, it does not exhaust the available ports for other VMs. Which THREE settings should be configured? (Choose THREE.)

Accepted Answer

Set the minimum ports per VM to a reasonable value. To prevent port exhaustion, the engineer should enable manual port allocation to set limits, configure endpoint-independent mapping for UDP (not directly related to port exhaustion), and set a minimum ports per VM to guarantee each VM gets a baseline. Manual allocation allows setting a maximum number of ports per VM, which prevents a single VM from using all ports.

Answer

Enable logging on the NAT gateway

Answer

Enable endpoint-independent mapping

Question 6

An engineer has multiple projects with overlapping IP ranges. They want to create a single Cloud NAT gateway to provide outbound internet access for instances in two different VPCs that are connected via VPC Network Peering. Is this possible?

Accepted Answer

No, each VPC must have its own Cloud NAT gateway. Cloud NAT is a regional resource that belongs to a single VPC network and router. It cannot be shared across VPCs via peering. Each VPC needs its own Cloud NAT gateway. Peering does not allow using the other VPC's NAT.

Answer

Yes, by enabling 'NAT support' on the VPC peering connection

Answer

No, but you can use a single instance with an external IP as a NAT instance

Answer

Yes, by configuring the Cloud NAT gateway in one VPC and adding a route in the peered VPC with next hop as the NAT gateway

Question 7

An organization uses Classic VPN with static routing to connect to GCP. They now need to add a new subnet in GCP and ensure on-premises traffic can reach it without manual updates. What should they do?

Accepted Answer

Convert the Classic VPN to HA VPN with dynamic routing (BGP). Classic VPN supports policy-based routing with static routes. To handle new subnets automatically, they should migrate to HA VPN with dynamic routing (BGP), which advertises routes via BGP.

Answer

Add a static route for the new subnet on the Classic VPN tunnel

Answer

Use Cloud Router with the Classic VPN

Answer

Create a new Classic VPN tunnel for the new subnet

Question 8

A network engineer is configuring an HA VPN tunnel pair between an on-premises VPN device and Google Cloud. The engineer wants to use IKEv2 with pre-shared keys. After configuring both ends, the tunnels do not come up. The engineer sees 'IKE SA negotiation failed - no proposal chosen' in the logs. What is the most likely cause?

Accepted Answer

The encryption algorithm (e.g., AES256) or DH group (e.g., 14) does not match between the two ends.. This error typically indicates a mismatch in IKE proposal parameters such as encryption algorithm, integrity algorithm, DH group, or SA lifetime.

Answer

The on-premises device is behind NAT and the VPN gateway does not support NAT traversal.

Answer

The IKE version on the on-premises device is set to IKEv1 while Cloud VPN expects IKEv2.

Answer

The pre-shared keys on both ends are different.

Question 9

An organization needs to deploy a multi-tier web application on Compute Engine. The web tier must be accessible from the internet, while the database tier must only be accessible from the web tier. The security team requires a defense-in-depth approach. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Use firewall rules to allow ingress from the web subnet to the database subnet on the database port (e.g., 3306). Defense-in-depth includes using separate subnets, firewall rules, and possibly service accounts. Tags help target rules. Using separate subnets isolates tiers. Firewall rules control traffic between tiers. Using service accounts can further restrict access.

Answer

Place web and database instances in the same subnet to minimize latency

Answer

Assign external IPs to database instances for easy maintenance

Question 10

An engineer needs to configure a Compute Engine instance as a network appliance that routes traffic between two subnets within the same VPC. The instance must handle traffic for both subnets. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Enable IP forwarding on the instance. To act as a router between subnets, the instance needs two network interfaces, each attached to a different subnet, and IP forwarding must be enabled so the kernel can forward packets between interfaces.

Answer

Set the MTU to 1500 on both interfaces

Answer

Create a route with a next-hop of the instance's internal IP

Answer

Assign external IPs to both interfaces

Question 11

A company is connecting their on-premises network to GCP via Cloud Interconnect with VLAN attachments and BGP sessions. They want to prefer one attachment over the other for traffic to a specific prefix. Which BGP attribute should they use?

Accepted Answer

MED. Multi-Exit Discriminator (MED) is used to influence inbound traffic from a peer AS. Lower MED values are preferred.

Answer

AS path prepend

Answer

Weight

Answer

Local preference

Question 12

A company is using Partner Interconnect with a 2 Gbps VLAN attachment. They notice that throughput is only about 500 Mbps during peak hours. They have verified that the on-premises link is not saturated. What is the most likely cause?

Accepted Answer

The VLAN attachment is configured with a lower bandwidth cap. Partner Interconnect VLAN attachments have a maximum throughput that depends on the partner's capability. If the throughput is lower than expected, it may be due to the partner limiting the bandwidth or the VLAN attachment configuration. However, a common cause is that the BGP session's route advertisement or Cloud Router configuration is not using multiple paths. Another possibility: the traffic is not using the VLAN attachment because of routing preferences. But given the scenario, the most plausible cause is that the VLAN attachment is configured with a lower bandwidth limit than the physical link.

Answer

Cloud Router is not using the partner's ASN

Answer

The VPC MTU is set to 1500 bytes

Answer

The on-premises router does not support BGP multipath

Question 13

A company uses Cloud DNS private zones for their internal network. They have multiple projects and want to resolve DNS names from one project's private zone in another project. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows you to set up cross-project DNS resolution by peering a private zone in one project to a VPC in another project.

Answer

DNS forwarding

Answer

Shared VPC

Answer

VPC peering

Question 14

A network engineer needs to create a private Google Kubernetes Engine (GKE) cluster with a secondary IP range for pods and another for services. They must ensure the pod CIDR does not conflict with any VPC subnets or on-premises ranges. Which step is essential during cluster creation?

Accepted Answer

Specify the pod and service secondary IP ranges using the --cluster-secondary-range-name and --service-secondary-range-name flags. GKE clusters can specify secondary IP ranges for pods and services during creation. To avoid conflicts, the engineer must explicitly define these ranges using the --cluster-secondary-range-name and --service-secondary-range-name flags.

Answer

Create the cluster in a Shared VPC with automatic subnet creation

Answer

Use VPC-native GKE without secondary ranges

Answer

Use the default pod and service ranges provided by GKE

Question 15

A company uses VPC Network Peering between VPC-A (project X) and VPC-B (project Y). They want resources in VPC-A to reach resources in VPC-B, but also need VPC-A to reach an on-premises network connected to VPC-B via Dedicated Interconnect. Which two steps must be configured?

Accepted Answer

Configure VPC-A to import custom routes from VPC-B. By default, VPC peering is non-transitive, so VPC-A cannot reach on-premises through VPC-B. To enable this, VPC-B must export custom routes to VPC-A, and the on-premises network's routes must be learned via BGP on Cloud Router in VPC-B.

Answer

Create a separate VPN tunnel between VPC-A and the on-premises network

Answer

Enable global routing mode in both VPCs

Answer

Configure VPC-A to advertise its subnets to VPC-B