PCNE Practice Test 16 — 15 Questions

Question 1

A security team wants to capture all traffic from a Compute Engine instance for intrusion detection. Which service should be used to copy traffic to a third-party IDS appliance running on another instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Packet Mirroring. Packet Mirroring is the Google Cloud feature designed to copy ingress and egress traffic from a Compute Engine instance (or set of instances) and deliver it to a collector instance for inspection. It mirrors the full packet payload, which is exactly what a third-party IDS appliance needs to perform deep packet inspection and signature matching. The mirrored traffic is sent to the target instance's internal IP, so the IDS can run on another VM in the same VPC.

Answer

Firewall Rules logging

Answer

VPC Flow Logs

Answer

Cloud NAT logging

Question 2

A company is planning a hybrid cloud connectivity strategy with Google Cloud. They need high bandwidth (10 Gbps) and low latency. They also want to avoid internet transit. Which TWO connectivity options meet these requirements? (Choose 2.)

Accepted Answer

Partner Interconnect. Partner Interconnect (B) is correct because it provides a private connection between your on-premises network and Google Cloud through a supported service provider, supporting bandwidths up to 50 Gbps per attachment (including 10 Gbps) with low latency and no internet transit. Dedicated Interconnect (C) is correct because it offers a direct physical connection at a Google colocation facility, supporting 10 Gbps or 100 Gbps circuits with low latency and traffic that bypasses the public internet entirely. CDN Interconnect (A) is not a general hybrid connectivity option; it is designed to optimize content delivery from Google Cloud CDN to specific ISP networks. Direct Peering (D) exchanges traffic between a customer network and Google's edge at an internet exchange, but it does not provide the dedicated 10 Gbps private path to a VPC that the scenario requires. Cloud VPN (E) tunnels traffic over the public internet, so it fails the requirement to avoid internet transit and does not natively deliver 10 Gbps per tunnel.

Answer

CDN Interconnect

Answer

Direct Peering

Answer

Cloud VPN

Question 3

A network engineer needs to design a VPC network for a global application that will have Compute Engine instances in multiple regions. The instances need to communicate with each other using internal IP addresses. What is the simplest way to enable this communication?

Accepted Answer

Create a single VPC network with subnets in each region.. A single VPC network is global and can contain subnets in any region. By placing subnets in each required region within the same VPC, instances can communicate using internal IP addresses (RFC 1918) without any additional connectivity services. This is the simplest and most scalable approach because VPCs inherently provide global routing between subnets.

Answer

Use Dedicated Interconnect to connect regions.

Answer

Use Cloud VPN to connect the instances.

Answer

Create separate VPC networks per region and peer them.

Question 4

A company has deployed a Cloud Armor security policy with the following rules: Rule 1: allow from IP range 10.0.0.0/8 (priority 1000); Rule 2: deny from all (priority 2000). What will be the action for traffic from IP 10.1.1.1?

Accepted Answer

Allow. Cloud Armor evaluates rules in priority order (lower number = higher priority). Rule 1 matches and allows the traffic, so Rule 2 is not evaluated.

Answer

Deny

Answer

Error: conflicting rules

Answer

Depends on the default rule

Question 5

A company wants to expose a globally distributed application using Cloud Run via a single anycast IP address, with SSL termination and content-based routing to different backend services. Which load balancer should they use?

Accepted Answer

Global External HTTPS Load Balancer. The Global External HTTPS Load Balancer provides a single anycast IP, SSL termination, and content-based routing via URL maps to backends like serverless NEGs pointing to Cloud Run.

Answer

Global External SSL Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global External TCP Proxy Load Balancer

Question 6

Refer to the exhibit. A Compute Engine instance has the network tags 'http-server' and 'ssh-server'. It also has a public IP address. Which of the following statements about traffic to this instance is true?

Accepted Answer

HTTP traffic from the internet is allowed.. The instance has the network tag 'http-server', which is used by the default VPC firewall rule 'default-allow-http' to permit inbound TCP traffic on port 80 from any source (0.0.0.0/0). Since the instance also has a public IP address, HTTP traffic from the internet can reach it. The other tags and the public IP do not override this allow rule.

Answer

All traffic from the internet is denied because of the deny-all rule.

Answer

SSH traffic from the internet is allowed.

Answer

HTTPS traffic from the internet is allowed.

Question 7

A company runs a microservices application on Google Kubernetes Engine (GKE) with an Envoy sidecar proxy for each service. They want to use Traffic Director to apply traffic policies such as traffic splitting between versions and fault injection. Which API does Traffic Director use to configure Envoy proxies?

Accepted Answer

Traffic Director xDS API. Traffic Director uses the xDS API (a set of discovery service APIs) to configure Envoy proxies. Specifically, it implements the Envoy xDS protocol, including LDS (Listener Discovery Service), RDS (Route Discovery Service), CDS (Cluster Discovery Service), and EDS (Endpoint Discovery Service), to dynamically push traffic policies such as traffic splitting and fault injection to the Envoy sidecars.

Answer

gRPC API

Answer

Kubernetes Ingress API

Answer

Cloud Endpoints API

Question 8

An organization has deployed an internal TCP/UDP load balancer in their VPC. They need to ensure that the load balancer preserves the client IP address when forwarding traffic to backend instances. Which configuration is required?

Accepted Answer

No configuration is needed; client IP is preserved by default.. Internal TCP/UDP load balancers in Google Cloud are regional passthrough load balancers that preserve the original client IP address by default when forwarding traffic to backend instances. No additional configuration such as Proxy Protocol is required because the load balancer operates at layer 4 and does not terminate the connection, so the source IP remains intact.

Answer

Configure the health check to use the client IP as source.

Answer

Enable Proxy Protocol on the load balancer.

Answer

Use a backend service with session affinity.

Question 9

An organization has multiple VPC networks and wants to allow traffic between them with fine-grained control over which VMs can communicate. Which solution should they implement?

Accepted Answer

VPC peering with firewall rules.. VPC peering with firewall rules is the correct solution because it allows direct, private connectivity between two VPC networks while enabling fine-grained control over which specific VMs can communicate via firewall rules (ingress/egress). Unlike Shared VPC, which centralizes management but does not inherently provide per-VM granularity across separate VPCs, VPC peering combined with firewall rules allows you to restrict traffic based on source and destination tags, service accounts, or CIDR ranges. This meets the requirement for both inter-VPC traffic and granular VM-level control.

Answer

Cloud Interconnect.

Answer

Shared VPC.

Answer

Cloud VPN between VPCs.

Question 10

You need to route traffic to different backend services based on the URL path: /api/* goes to a Cloud Run service, /static/* goes to a Cloud Storage bucket, and /* goes to a Compute Engine instance group. Which component of the Global HTTPS Load Balancer should you configure?

Accepted Answer

URL map. The URL map is the component of the Global HTTPS Load Balancer that routes requests to different backend services based on URL path patterns. It allows you to define rules that match incoming URL paths (e.g., /api/*, /static/*) and direct them to the appropriate backend service. This is exactly what the scenario requires.

Answer

Backend service

Answer

Target HTTP proxy

Answer

Health check

Question 11

Which THREE actions are required to configure a High-Availability Cloud VPN (HA VPN) with dynamic routing to an on-premises peer?

Accepted Answer

Create two VPN tunnels, each associated with a different Cloud VPN gateway interface. Option A is correct because an HA VPN gateway has two interfaces (interface 0 and interface 1), and to achieve 99.99% availability you must create two tunnels, each terminating on a different gateway interface, so a single interface failure doesn't drop all connectivity. Option C is correct because each HA VPN gateway interface requires its own external (regional) IP address, so you must allocate two external IP addresses for the gateway's two interfaces. Option D is correct because dynamic routing with HA VPN requires a Cloud Router, and the Cloud Router must reside in the same region as the HA VPN gateway to advertise and learn routes via BGP. Option B is not required because a single Cloud Router can serve both tunnels; you don't need one router per tunnel. Option E is not required because dynamic routing uses BGP through the Cloud Router rather than manually configured static routes for the remote network.

Answer

Create two separate Cloud Routers, one for each tunnel

Answer

Configure static routes for the remote network in the VPC

Question 12

A company has two VPCs connected via VPC peering. They want resources in VPC A to be able to reach a service in VPC B that uses a custom static route. What must be configured on the VPC peering connection?

Accepted Answer

Enable export of custom routes in VPC B and import of custom routes in VPC A. For a custom static route in VPC B to be usable by resources in VPC A over VPC peering, the peering connection must be configured to export custom routes from VPC B and import custom routes into VPC A. By default, VPC peering does not exchange custom static routes — only subnet routes are exchanged. Enabling export/import on the peering connection allows the custom route to propagate across the peering link.

Answer

Enable VPC Flow Logs on both VPCs

Answer

Use a VPN between the VPCs

Answer

Create a Cloud Router in VPC A

Question 13

A Compute Engine instance is running a network appliance that requires multiple network interfaces. What is the primary purpose of attaching additional NICs (e.g., NIC1, NIC2) to the instance?

Accepted Answer

To separate traffic between different subnets or networks. Multiple NICs are used to separate traffic planes such as management, data, and control, and to route traffic through different subnets without relying on internal routing.

Answer

To provide failover if one NIC fails

Answer

To enable load balancing across interfaces

Answer

To increase network throughput

Question 14

An organization is migrating a legacy application to GCP. The application requires static routing and does not support BGP. Which VPN option should they use?

Accepted Answer

Classic VPN. Classic VPN supports static routing, which is required by the legacy application that does not support BGP. HA VPN, Dedicated Interconnect, and Partner Interconnect all rely on BGP for dynamic routing and cannot be used with a static-only requirement.

Answer

Dedicated Interconnect

Answer

Partner Interconnect

Answer

HA VPN

Question 15

A company wants to protect its HTTPS Load Balancer from DDoS attacks and common web application attacks like SQL injection and cross-site scripting (XSS). Which Google Cloud service should be used?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and WAF capabilities including preconfigured rules for OWASP, XSS, and SQLi. It attaches to HTTPS Load Balancers.

Answer

Cloud IDS

Answer

VPC Service Controls

Answer

Firewall Rules