PCNE Practice Test 15 — 15 Questions

Question 1

You need to configure firewall rules to allow HTTP (TCP 80) traffic from the internet to instances in a VPC. The instances are in different subnets and have a network tag 'web-server'. You want to minimize the number of rules. Which rule configuration is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an ingress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.. Firewall rules are global, so one ingress rule can apply to all instances with the tag 'web-server' regardless of subnet. The direction must be ingress, source 0.0.0.0/0, protocol tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule with source 0.0.0.0/0, protocol tcp:0-65535, and target tags 'web-server'.

Answer

Create an egress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule for each subnet with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Question 2

Refer to the exhibit. The Cloud Router shows one BGP peer as ESTABLISHED and one as IDLE. The best routes show two routes to the same destination with different priorities. What is the most likely reason the IDLE peer is not establishing?

Accepted Answer

BGP configuration mismatch between Cloud Router and on-premises router for the IDLE peer. The IDLE state in BGP indicates that the session has not been established, typically due to a configuration mismatch. Since the Cloud Router shows one peer as ESTABLISHED and another as IDLE, the most likely cause is a mismatch in BGP parameters (such as AS number, peer IP, or authentication) between the Cloud Router and the on-premises router for the IDLE peer. This prevents the BGP session from transitioning out of the IDLE state.

Answer

The on-premises router is not sending routes for the IDLE peer

Answer

The IDLE peer has a higher priority route, so it is not needed

Answer

The IDLE peer is not configured on the Cloud Router

Question 3

An organization has a VPC with multiple subnets. They want to log all outbound connections from instances to the internet for compliance. They also want to use a cost-effective solution that doesn't require a proxy. Which three components are needed? (Choose three.)

Accepted Answer

Cloud NAT. Option A (Cloud NAT) is correct because Cloud NAT provides outbound internet connectivity for instances in private subnets without requiring an external IP or a proxy, and it is a managed, cost-effective service. Option B (Cloud Logging) is correct because Cloud NAT logs (sent to Cloud Logging) capture details of outbound connections, such as source/destination IPs and ports, which satisfies the compliance logging requirement. Option D (Cloud Router) is correct because Cloud NAT is configured on a Cloud Router, which is a required component to enable NAT and its logging. Option C (Cloud VPN) is not needed because it provides encrypted tunnels to on-premises or other networks, not outbound internet access for logging. Option E (VPC Flow Logs) is not required because it logs traffic at the subnet/VM level and does not provide the NAT translation details needed for outbound connection logging in this scenario.

Answer

Cloud VPN

Answer

VPC Flow Logs

Question 4

A company wants to protect its external HTTPS load balancer from SQL injection and cross-site scripting attacks. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's managed WAF that attaches to external HTTPS load balancers and provides protection against Layer 7 attacks including SQL injection and cross-site scripting. It uses preconfigured OWASP ModSecurity rules and custom rules to inspect HTTP traffic at the edge. This directly addresses the requirement to protect an external HTTPS load balancer from these application-layer attacks.

Answer

VPC Service Controls

Answer

Cloud Firewall

Answer

Cloud IDS

Question 5

You are designing a multi-tier application where an internal HTTP(S) load balancer should route requests to a backend service based on the URL path (e.g., /api/* to one service, /web/* to another). Which component is essential for this routing?

Accepted Answer

URL map. A URL map is essential for routing requests based on URL path in an internal HTTP(S) load balancer. It defines rules that map incoming URL patterns to specific backend services. Without a URL map, path-based routing cannot be configured.

Answer

Cloud NAT

Answer

VPC peering

Answer

Firewall rules

Question 6

A security team wants to enforce a policy that blocks all egress traffic to the internet from a specific set of VMs across multiple projects in an organization. The policy should be centrally managed and override VPC-level firewall rules. Which approach should they use?

Accepted Answer

Deploy a hierarchical firewall policy at the organization level with a deny egress rule targeting the VMs.. Hierarchical firewall policies are organization-level or folder-level resources that can contain rules to allow or deny traffic, and they are evaluated before VPC firewall rules. A deny egress rule in a hierarchical policy at the organization level will override any VPC-level allow rules, enforcing the block across all projects in the organization. This provides centralized management and ensures the policy cannot be overridden by project-level admins.

Answer

Create VPC firewall rules with deny egress for the specific VMs in each VPC.

Answer

Use a network firewall policy attached to each VPC network.

Answer

Configure Cloud Armor security policies on the load balancer to block egress.

Question 7

A company needs to connect multiple on-premises sites and cloud VPCs in a hub-and-spoke topology using a fully managed service. Which Google Cloud service should they use?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) provides a hub-and-spoke model for connecting on-premises networks and VPCs, reducing configuration complexity.

Answer

VPC Network Peering

Answer

Cloud Interconnect

Answer

Cloud VPN

Question 8

An organization wants to connect multiple on-premises sites to multiple VPCs in GCP using a hub-and-spoke model. Which GCP service provides a centralized hub for managing such connectivity?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is GCP's hub-and-spoke connectivity service that centralizes management of connectivity between on-premises sites and multiple VPCs. It acts as a global hub where spokes (VPN tunnels, Interconnect attachments, VPC spokes, router appliances) are attached and managed centrally. This is exactly the hub-and-spoke model the organization needs for multi-site, multi-VPC connectivity.

Answer

Cloud Router

Answer

VPC Peering

Answer

Cloud VPN

Question 9

An engineer needs to configure a Cloud Router for a VPN tunnel to an on-premises network. The on-premises BGP ASN is 64512. Which ASN should the engineer assign to the Cloud Router?

Accepted Answer

64513. A Cloud Router peering with an on-premises BGP speaker must use a different Autonomous System Number than the peer to form an eBGP session. Since the on-premises ASN is 64512, the Cloud Router must be assigned a distinct ASN such as 64513. Google Cloud requires the Cloud Router ASN to differ from the peer ASN; using the same ASN would attempt to form an iBGP session, which is not supported for Cloud VPN/Interconnect peering.

Answer

64512

Answer

Any public ASN

Answer

0

Question 10

Which TWO network services are required to enable private Google access for on-premises hosts using a Dedicated Interconnect connection? (Choose two.)

Accepted Answer

Cloud Router with BGP. Cloud Router with BGP is required because Dedicated Interconnect uses BGP sessions between the on-premises router and Google's edge router to exchange routes. Without BGP, the on-premises network cannot advertise or receive the routes necessary for private Google access, such as the 199.36.153.4/30 or 199.36.153.8/30 ranges used for Private Google Access for on-premises.

Answer

Cloud NAT

Answer

VPC Flow Logs

Answer

Cloud VPN

Question 11

An organization has a VPC with multiple subnets and Cloud NAT configured for outbound internet access. They need to analyze which instances are using the most egress bandwidth to optimize costs. Which approach is most effective?

Accepted Answer

Export VPC Flow Logs to BigQuery and query by source instance. VPC Flow Logs capture per-connection metadata including source instance, destination, and bytes sent, and exporting them to BigQuery enables SQL-based aggregation to identify which instances generate the most egress traffic. This is the most granular and queryable approach for cost optimization analysis.

Answer

Enable Cloud NAT logging and analyze logs in Cloud Logging

Answer

Use Firewall Insights to identify high-traffic instances

Answer

Use the Performance Dashboard to see bandwidth usage per region

Question 12

A network engineer is using Connectivity Tests to diagnose a reachability issue between two instances in the same VPC but different subnets. The test indicates that traffic is denied by firewall rules. However, the engineer cannot find any firewall rule denying the traffic. What is a possible explanation?

Accepted Answer

The firewall rule is in a different project that is not being checked. Connectivity Tests in Google Cloud evaluate firewall rules across the relevant project and network scope, but if the denying rule lives in a different project that the test is not configured to inspect, the engineer will see a denial with no visible cause in the current project. Shared VPC and cross-project firewall configurations are common sources of this confusion. The fix is to verify the test's project scope and check firewall rules in all projects attached to the VPC.

Answer

The subnet is in a different region

Answer

VPC Flow Logs are not enabled

Answer

The instances have external IPs

Question 13

An engineer has configured a firewall rule with priority 1000 that allows ingress traffic on TCP port 443 from source IP range 10.0.0.0/8. Another rule with priority 500 denies ingress on TCP port 443 from source IP 10.0.1.0/24. What will happen to traffic from 10.0.1.5 destined to the instance on port 443?

Accepted Answer

The traffic is denied because the deny rule has higher priority. Firewall rules are evaluated by priority (lower number = higher priority). Rule with priority 500 (deny) takes precedence over priority 1000 (allow). So traffic from 10.0.1.5 is denied.

Answer

The traffic is allowed because allow rules override deny rules

Answer

The traffic is allowed because the allow rule covers a broader range

Answer

The traffic is denied only if the instance has a tag matching the deny rule

Question 14

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocol, and whether traffic was allowed or denied. Enabling Flow Logs provides the detailed traffic data needed to diagnose packet drops and high latency.

Answer

Cloud NAT logging

Answer

Packet Mirroring

Answer

Traffic Director

Question 15

A network engineer needs to create a firewall rule that denies all inbound traffic to instances with the tag 'web-server' from source IP range 10.0.0.0/8. They also have an existing allow rule with priority 1000 that permits traffic from 10.0.0.0/8 to those instances. To ensure the deny rule takes precedence, what priority should the new rule have?

Accepted Answer

500. Firewall rules are evaluated in ascending priority order, where lower numbers indicate higher precedence. The existing allow rule has priority 1000, so the new deny rule must have a priority number lower than 1000 to be evaluated first. Priority 500 satisfies this requirement and ensures the deny is matched before the allow.

Answer

1000

Answer

0

Answer

2000