PCNE Practice Test 15 — 15 Questions

Question 1

A company needs to design a split-horizon DNS solution where internal queries resolve to private IPs and external queries resolve to public IPs for the same domain. Which TWO services or configurations should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud DNS public managed zone. Split-horizon DNS is achieved by having a public zone for external resolution and a private zone for internal resolution within the same domain.

Answer

Shared VPC

Answer

DNS peering

Answer

DNS forwarding

Question 2

An organization wants to publish a private service using Private Service Connect (PSC) so that consumers in other VPCs can access it via private IPs. Which TWO resources are required on the producer side? (Choose TWO.)

Accepted Answer

A Private Service Connect service attachment. To publish a service via PSC, the producer creates a service attachment on a regional internal load balancer (ILB) and also configures a private service connection (or simply the service attachment). The service attachment is associated with the ILB's forwarding rule.

Answer

A Cloud NAT gateway

Answer

A Private Service Connect endpoint

Answer

A Cloud Router

Question 3

An organization is migrating on-premises workloads to GCP. They need a dedicated, high-bandwidth connection with a 99.99% SLA. They have a co-location facility near a Google Cloud region. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct physical connections (10G or 100G links) between on-premises and Google's network, offering a 99.99% SLA when using redundant connections.

Answer

HA VPN

Answer

Cloud VPN (Classic VPN)

Answer

Partner Interconnect

Question 4

A startup is setting up a new GCP project and needs to create a VPC that will have predictable IP ranges for future peering with other VPCs. They do not anticipate needing to grow the network beyond the initial IP range. Which VPC type should they choose?

Accepted Answer

Custom mode VPC. Custom mode VPCs allow you to define your own subnets with specific IP ranges. Auto mode VPCs automatically create subnets in every region, which can cause IP overlap when peering. For controlled, predictable IP ranges, custom mode is appropriate.

Answer

Auto mode VPC

Answer

Shared VPC

Answer

Legacy network

Question 5

A company is planning to connect their on-premises data center to Google Cloud using a Dedicated Interconnect. They require 20 Gbps of total bandwidth and want to achieve the highest SLA. What is the minimum number of 10 Gbps connections needed?

Accepted Answer

Two 10 Gbps links. Dedicated Interconnect offers 10 Gbps or 100 Gbps per link. To achieve 20 Gbps, at least two 10 Gbps links are needed. For the highest SLA (99.99%), two connections are required (one must be redundant).

Answer

One 10 Gbps link and one Partner Interconnect 10 Gbps link

Answer

One 100 Gbps link

Answer

Four 10 Gbps links

Question 6

A company is planning a hybrid connectivity solution with 200 Gbps total bandwidth between their data center and Google Cloud. They need the highest SLA and lowest latency. Which combination of services would meet these requirements?

Accepted Answer

Two 100 Gbps Dedicated Interconnect connections. Dedicated Interconnect provides up to 100 Gbps per link. To achieve 200 Gbps, they need two 100 Gbps connections. Two connections provide redundancy and the 99.99% SLA.

Answer

One 100 Gbps Dedicated Interconnect and one 100 Gbps Partner Interconnect

Answer

Twenty 10 Gbps Dedicated Interconnect connections

Answer

Four 50 Gbps Partner Interconnect connections

Question 7

A company wants to resolve DNS queries from their on-premises DNS servers for a private zone hosted in Cloud DNS. They also need GCP resources to resolve on-premises hostnames. Which combination of Cloud DNS features should they configure?

Accepted Answer

Both inbound and outbound DNS server policies. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS private zones. Outbound DNS server policy allows GCP to forward queries to on-premises DNS servers.

Answer

Outbound DNS server policy only

Answer

DNS peering with the on-premises network

Answer

Inbound DNS server policy only

Question 8

A company is planning to use Partner Interconnect to connect their on-premises network to GCP. Which TWO of the following are characteristics of Partner Interconnect?

Accepted Answer

Uses VLAN attachments. Partner Interconnect supports bandwidth from 50 Mbps to 10 Gbps and provides a 99.9% or 99.99% SLA depending on configuration. It does not require colocation facility presence; the partner handles that.

Answer

Requires colocation facility presence

Answer

Supports up to 100 Gbps

Answer

Provides 99.99% SLA with a single connection

Question 9

A company wants to restrict access to Google Cloud Storage from a specific VPC only, using VPC Service Controls. Which TWO components are required to create a service perimeter? (Choose two.)

Accepted Answer

A VPC accessible service configuration. A service perimeter is defined by a set of projects (the protected projects) and a set of VPCs (via VPC accessible services) that are allowed to access the protected APIs. Also, access levels can be used but are optional.

Answer

A VPC network with Private Google Access enabled

Answer

An access level

Answer

A list of allowed APIs (restricted services)

Question 10

A company is planning to connect multiple VPCs in different projects to a common on-premises network using a hub-and-spoke topology. They want to use Network Connectivity Center (NCC). Which TWO components are required to set up this topology?

Accepted Answer

NCC hub. NCC uses a hub (NCC hub) and spokes (VPC spokes). Spokes are VPCs that connect to the hub. The hub acts as a central point for routing.

Answer

VPC Network Peering

Answer

Dedicated Interconnect VLAN attachments

Answer

Cloud Router

Question 11

An organization needs DNS resolution for on-premises hosts to resolve GCP private zone names (e.g., myinstance.gcp.internal). They have Cloud DNS private zones in GCP. Which Cloud DNS feature should they configure to forward queries from on-premises to GCP?

Accepted Answer

Inbound DNS forwarding. Cloud DNS inbound server policy enables on-premises DNS resolvers to forward queries to Cloud DNS for resolution of private zones. This is the appropriate feature for on-premises to GCP DNS resolution.

Answer

Split-horizon DNS

Answer

DNS peering

Answer

Outbound DNS forwarding

Question 12

A startup is creating a new VPC for their production environment. They want to minimize management overhead and plan to use multiple regions. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region and manage IP ranges, reducing management overhead. Custom mode requires manual subnet creation.

Answer

Custom mode VPC

Answer

Shared VPC

Answer

VPC Network Peering

Question 13

A company is designing a Shared VPC environment with a host project and several service projects. Which two steps are required to allow a service project team to create Compute Engine instances with internal IP addresses from a shared subnet?

Accepted Answer

Ensure the host project and service project are in the same organization. To use a shared subnet, the host project must grant the service project's Compute Engine service account the necessary IAM role on the subnet. The service project team must also have permissions to use the subnet.

Answer

Create a VPC peering connection between the host and service projects

Answer

Grant the service project's network team the roles/compute.networkAdmin role on the host project

Answer

Assign the roles/compute.securityAdmin role to the service project team

Question 14

An organization has two VPCs, VPC-A and VPC-B, in the same project. They need to allow communication between instances in these VPCs without using the public internet. The solution must support dynamic routes and be non-transitive. What should they configure?

Accepted Answer

Configure VPC Network Peering between the two VPCs. VPC Network Peering allows direct connectivity between two VPCs with non-transitive peering. It supports dynamic routes via custom route exchange and does not use the internet.

Answer

Add a route in each VPC pointing to the other's subnet via the default internet gateway

Answer

Create a VPN tunnel between VPC-A and VPC-B

Answer

Use Shared VPC with a host project and attach both VPCs as service projects

Question 15

A developer wants to create a GKE cluster with a separate subnet for pods and services to avoid IP address exhaustion. What type of secondary IP ranges should they configure on the VPC subnet?

Accepted Answer

Secondary IP ranges for pods and services. GKE uses secondary IP ranges for pods and services. You specify these ranges when creating the subnet.

Answer

Primary IP ranges

Answer

External IP ranges

Answer

Alias IP ranges