PCNE Practice Test 16 — 15 Questions

Question 1

An on-premises DNS server is configured to forward queries for a private zone in GCP. They set up inbound DNS forwarding from on-prem to GCP using Cloud DNS forwarding. What must be configured on the VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inbound DNS server policy. Inbound DNS forwarding requires a Cloud DNS inbound server policy that specifies the VPC and the IP addresses of the on-premises DNS resolvers.

Answer

DNS peering zone

Answer

Outbound DNS server policy

Answer

Private zone with an authoritative name server

Question 2

A company needs to connect multiple on-premises sites and cloud VPCs in a hub-and-spoke topology using a fully managed service. Which Google Cloud service should they use?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) provides a hub-and-spoke model for connecting on-premises networks and VPCs, reducing configuration complexity.

Answer

VPC Network Peering

Answer

Cloud Interconnect

Answer

Cloud VPN

Question 3

A company is designing IP address plans for multiple VPCs that will be connected via VPC Network Peering and to an on-premises network via HA VPN with dynamic routing. Which three practices should be followed to avoid IP address conflicts?

Accepted Answer

Reserve IP ranges for future VPCs and on-premises expansion. To avoid overlap, use unique private IP ranges per VPC, plan for future growth, and document all ranges. Using RFC 1918 addresses and avoiding overlapping CIDRs ensures successful peering and VPN connectivity.

Answer

Use only public IP addresses for all GCP resources

Answer

Use the same IP range for all VPCs to simplify management

Question 4

An organization has multiple VPCs in different projects that need to share subnets to create a common network segment. They want central control over network administration while allowing individual project teams to deploy resources. Which approach should they use?

Accepted Answer

Shared VPC with a host project and service projects. Shared VPC allows a host project to share subnets with service projects, providing central network administration while allowing teams to deploy resources independently.

Answer

VPN tunnels connecting all VPCs

Answer

VPC Network Peering between all VPCs

Answer

Creating a single VPC in one project and granting IAM permissions to other projects

Question 5

A company has a GKE cluster that needs to be accessed by pods and services. The cluster is deployed in a VPC with a primary subnet 10.0.0.0/16. To avoid IP exhaustion, they want to use separate IP ranges for pods and services. Which approach should they take?

Accepted Answer

Create secondary IP ranges on the subnet for pods and services.. GKE supports secondary IP ranges for pods and services, which are defined on the subnet and allocated separately from the primary range.

Answer

Use a separate VPC for the GKE cluster with its own subnet.

Answer

Use the primary subnet range for pods and create a separate subnet for services.

Answer

Use alias IP ranges on the VM instances for pods and services.

Question 6

An organization needs to connect two VPCs in different projects so that all subnets can communicate using internal IPs, but the connection must not be transitive (i.e., VPC A cannot use VPC B's connection to reach VPC C). Which GCP networking feature should they use?

Accepted Answer

VPC Network Peering. VPC peering is non-transitive and directly connects two VPCs. Shared VPC is transitive; VPN and Interconnect are for hybrid connectivity.

Answer

Cloud VPN

Answer

Shared VPC

Answer

Dedicated Interconnect

Question 7

Which three of the following are best practices for designing a highly available Dedicated Interconnect connection to Google Cloud? (Choose three.)

Accepted Answer

Ensure that the on-premises routers are in different failure zones.. Deploying on-premises routers in different failure zones ensures that a single zone failure does not disrupt both BGP sessions. This aligns with Google Cloud's recommendation to use diverse failure domains for on-premises equipment to maintain high availability for Dedicated Interconnect.

Answer

Use a single Cloud Router for both interconnect attachments.

Answer

Configure both connections to use the same BGP session.

Question 8

Match each network pricing model to its description.

Accepted Answer

Egress pricing: Charges for data leaving Google Cloud to the internet. Correct matches: Egress charges for outbound data; Ingress is free; Cloud Interconnect charges by bandwidth; VPN charges hourly plus egress. Common confusions include swapping egress/ingress definitions and confusing Interconnect with VPN.

Answer

Egress pricing: No charge for data leaving Google Cloud

Answer

Cloud Interconnect pricing: Charges include hourly tunnel fee

Question 9

A company runs a Kubernetes cluster on GKE with a VPC-native cluster (alias IP ranges). They have pods that need to communicate with on-premises services via a Cloud VPN tunnel. Which networking configuration is required to enable pod-to-on-premises communication?

Accepted Answer

Advertise the pod IP ranges over the Cloud Router BGP session to the on-premises router.. VPC-native clusters assign alias IP ranges to pods directly from the VPC subnet's secondary CIDR ranges. To enable on-premises routing to these pods, the pod IP ranges must be advertised over the Cloud Router BGP session to the on-premises router. This ensures the on-premises network learns the routes to the pod CIDRs and can forward traffic back through the Cloud VPN tunnel.

Answer

Enable VPC Flow Logs for the subnets to allow traffic to be routed.

Answer

Configure a firewall rule allowing traffic from pod CIDR to on-premises subnets.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Question 10

A company uses High Availability VPN (HA VPN) with two tunnels and BGP to connect to an on-premises network. They notice traffic only flows through one tunnel. They want to ensure both tunnels are used simultaneously. What should they do?

Accepted Answer

Enable equal-cost multipath (ECMP) on the Cloud Router. To use both tunnels simultaneously, ECMP must be enabled in the VPC. By default, HA VPN with BGP uses active-passive if the on-premises router uses a lower local preference for one path. ECMP can be enabled on the Cloud Router.

Answer

Increase the MED value on the active tunnel to make it less preferred

Answer

Configure both tunnels with the same BGP AS number on the on-premises side

Answer

Configure static routes with equal cost for both tunnels

Question 11

A network engineer is setting up a HA VPN between GCP and an on-premises network. They want to use route-based VPN with dynamic routing. Which two resources must be created together to form a functional HA VPN tunnel?

Accepted Answer

Two VPN tunnels, each with a BGP session on the same Cloud Router. An HA VPN gateway has two interfaces, each with its own external IP. For each interface, you create a VPN tunnel and attach it to a Cloud Router with a BGP session. The tunnel and BGP session are paired for each interface.

Answer

One VPN tunnel with two BGP sessions

Answer

Two VPN tunnels without BGP sessions

Answer

Two VPN gateways, each with one tunnel and one BGP session

Question 12

A company has two Dedicated Interconnect circuits in different metro areas to meet the 99.99% SLA. They have configured active-active mode. During a test, they intentionally bring down one circuit. They expect traffic to continue using the other circuit, but they notice packet loss during the failover. What could be the cause?

Accepted Answer

The remaining circuit does not have sufficient bandwidth to handle the combined traffic load.. In active-active mode, both circuits are used simultaneously. When one fails, traffic is re-routed to the remaining one. If there is insufficient bandwidth on the remaining circuit, packet loss may occur due to congestion.

Answer

The VLAN attachments are not configured with the same Cloud Router.

Answer

The BGP timers are set too high, causing slow convergence.

Answer

The on-premises router is not configured with equal-cost multipath (ECMP).

Question 13

A company wants to resolve on-premises DNS names from Google Cloud VMs. They have a Cloud DNS private zone for their domain and on-premises DNS servers at IP 10.1.1.1 and 10.1.1.2. Which Cloud DNS feature should they use?

Accepted Answer

Outbound DNS forwarding using an outbound forwarding zone. DNS forwarding zones allow Cloud DNS to forward queries for a specific domain to on-premises DNS servers.

Answer

Inbound DNS policy

Answer

Peering zones

Answer

Managed reverse lookup zones

Question 14

A company has a Partner Interconnect connection (Layer 2) with a service provider. They need to configure BGP sessions on their on-premises router and Google Cloud Router. The engineer creates a VLAN attachment of type PARTNER. However, the BGP session does not come up. What is the most likely reason?

Accepted Answer

The Cloud Router BGP IP address is not in the same subnet as the VLAN attachment. In Layer 2 Partner Interconnect, the customer must configure BGP sessions. The VLAN attachment type PARTNER requires the customer to manage BGP. Common issues include incorrect VLAN ID or IP addresses.

Answer

The VLAN attachment type should be PARTNER_PROVIDER

Answer

The IAM permissions for the Cloud Router are missing

Answer

The on-premises router is using a different BGP AS number than configured

Question 15

An organization is considering using Partner Interconnect to connect to Google Cloud. They want the service provider to manage the BGP sessions. Which TWO configurations must they choose? (Choose TWO.)

Accepted Answer

Create VLAN attachment of type PARTNER_PROVIDER. For Layer 3 connectivity where the provider manages BGP, the VLAN attachment type must be PARTNER_PROVIDER, and the provider handles BGP.

Answer

Select Layer 2 connectivity option with the provider

Answer

Create VLAN attachment of type PARTNER

Answer

Configure BGP sessions on the Cloud Router