PCNE Practice Test 17 — 15 Questions

Question 1

A network engineer has set up a Cloud Router with BGP for an HA VPN. The BGP session is flapping. Which log should be examined to diagnose the issue?

Accepted Answer

Cloud Router logs. Cloud Router logs capture BGP session state changes, route advertisements, and peering errors, making them the correct source for diagnosing a flapping BGP session. BGP runs on the Cloud Router, so any session reset, hold-timer expiry, or ASN mismatch will be recorded there. VPN tunnel logs only show IPsec/IKE events, not BGP-level behavior.

Answer

Firewall Rules logs

Answer

VPN tunnel logs

Answer

VPC Flow Logs

Question 2

Match each Google Cloud interconnect or peering type to its description.

Accepted Answer

Dedicated Interconnect: Direct physical connection between your on-premises network and Google's network, providing high bandwidth and a SLA.. Dedicated Interconnect offers a direct physical link with SLA. Partner Interconnect uses a service provider. Direct Peering is a direct BGP session, while Carrier Peering uses a carrier partner. Common confusion occurs between Dedicated and Partner Interconnect.

Answer

Dedicated Interconnect: Connectivity through a service provider with flexible bandwidth and no SLA.

Answer

Partner Interconnect: Direct physical connection between on-premises and Google with high bandwidth and SLA.

Question 3

A company wants to protect its HTTP(S) Load Balancer against DDoS attacks and common web exploits like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it is the only Google Cloud service in the list that provides both DDoS protection at the edge and WAF capabilities (SQLi, XSS) for HTTP(S) Load Balancers. It integrates directly with external HTTP(S) Load Balancers and inspects Layer 7 traffic before it reaches backends. The preconfigured OWASP rules and adaptive protection make it purpose-built for this scenario.

Answer

VPC Service Controls

Answer

Firewall Rules

Answer

Cloud NAT

Question 4

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.0.0.0/16). They want to establish VPC Network Peering between them. What is the outcome?

Accepted Answer

Peering fails because subnets overlap. VPC Network Peering in Google Cloud requires that the two VPC networks have non-overlapping subnet CIDR ranges. Since VPC-A and VPC-B both use 10.0.0.0/16, the peering request will be rejected because overlapping IP ranges would make routing ambiguous. Google validates this at peering creation time and fails the operation.

Answer

Peering succeeds, and only non-overlapping subnets are used

Answer

Peering succeeds, and routes are exchanged, but traffic may be unpredictable

Answer

Peering succeeds, but routes are not exchanged

Question 5

An organization needs to create a VPC that automatically creates subnets in every region as new regions become available. Which VPC type should they use?

Accepted Answer

Auto mode VPC. An Auto mode VPC in Google Cloud automatically creates one subnet in each region (using a predefined 10.128.0.0/9 range divided into per-region /20 subnets) and continues to add subnets in new regions as Google opens them. This is the defining behavior of auto mode, so it directly satisfies the requirement of automatic subnet creation across all regions. Custom mode VPCs require the administrator to manually define every subnet and region.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Custom mode VPC

Question 6

A company wants to create a new VPC for a production environment. They need predictable IP addresses and want to avoid any automatic subnet creation. Which type of VPC should they use?

Accepted Answer

Custom mode VPC. A custom mode VPC in Google Cloud is created with no subnets by default, so the administrator explicitly defines every subnet, its region, and its CIDR range. This gives fully predictable IP addressing and guarantees that no subnets are auto-created, which is exactly what a production environment with strict IP planning requires. Auto mode VPCs, by contrast, automatically create one subnet per region with predefined ranges.

Answer

Legacy VPC

Answer

Shared VPC

Answer

Auto mode VPC

Question 7

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. Both connections are active and they want to use both simultaneously for load balancing traffic. They have configured two VLAN attachments each with a Cloud Router and BGP sessions. How should they configure BGP to achieve active-active load sharing?

Accepted Answer

Configure the on-premises router to enable ECMP for the BGP routes. To use both Dedicated Interconnect connections simultaneously for load balancing, the on-premises router must enable Equal-Cost Multi-Path (ECMP) so BGP routes with equal attributes are installed and traffic is distributed across both paths. Google Cloud's side already advertises and accepts both paths; the on-prem router is what decides whether to load-share.

Answer

Set different local preference values on the Google Cloud Router

Answer

Use AS path prepending on one connection to make it less preferred

Answer

Assign different MED values to each connection to influence preference

Question 8

You need to configure SSL certificates for a Global HTTPS Load Balancer. The certificate should be automatically provisioned and managed by Google. Which type of certificate should you use?

Accepted Answer

Google-managed certificate. Google-managed certificates are automatically provisioned, renewed, and managed by Google for use with Google Cloud load balancers. They are designed for HTTPS load balancers and require a domain you control. This matches the requirement for automatic provisioning and management.

Answer

Compute Engine instance certificate

Answer

Certificate Authority Service certificate

Answer

Self-managed certificate

Question 9

A developer needs to store a TLS certificate for use with a load balancer. Which Google Cloud service is used to create and manage SSL certificates?

Accepted Answer

Certificate Manager. Certificate Manager is the Google Cloud service designed to provision, manage, and deploy SSL/TLS certificates, including Google-managed and self-managed certificates, for use with load balancers and other services. It integrates directly with external Application Load Balancers and provides automatic renewal for Google-managed certificates.

Answer

Secret Manager

Answer

Cloud IAM

Answer

Cloud KMS

Question 10

A network engineer configures a Global external HTTP(S) Load Balancer with a serverless NEG backend pointing to Cloud Run. The load balancer returns 502 Bad Gateway errors. What is the most likely cause?

Accepted Answer

The Cloud Run service has ingress set to 'internal'. A Global external HTTP(S) Load Balancer with a serverless NEG backend to Cloud Run returns 502 Bad Gateway when the load balancer cannot reach the Cloud Run service. The most likely cause is that the Cloud Run service's ingress setting is 'internal', which blocks traffic from the external load balancer. Setting ingress to 'all' or 'internal-and-cloud-load-balancing' allows the load balancer to forward requests successfully.

Answer

The URL map is misconfigured

Answer

The SSL certificate is expired

Answer

The serverless NEG is not supported for Cloud Run

Question 11

A company is designing a VPC routing strategy. Which three are valid route types in Google Cloud VPC? (Choose three.)

Accepted Answer

System-generated routes. Option A (System-generated routes) is correct because every VPC automatically creates default routes (e.g., a 0.0.0.0/0 route to the default internet gateway and subnet routes for each subnet's primary and secondary CIDR ranges) that are managed by Google Cloud. Option B (Dynamic routes learned through BGP) is correct because Cloud Router uses BGP to dynamically exchange routes with on-premises networks over Cloud VPN or Cloud Interconnect, and these learned routes are installed in the VPC route table. Option D (Custom static routes) is correct because users can manually create static routes in a VPC to direct traffic to specific destinations via next hops such as instances, VPN tunnels, or load balancers. Option C (VPN tunnel routes) is not a distinct route type; routes associated with VPN tunnels are either dynamic BGP-learned routes or custom static routes, so it is not separately valid. Option E (Peering routes) is also not a distinct route type; VPC peering exchanges subnet routes that appear as system-generated or dynamic routes, not as a separate 'peering route' category.

Answer

VPN tunnel routes

Answer

Peering routes

Question 12

A company is using Traffic Director with Envoy sidecar proxies to manage traffic between microservices. They want to gradually shift 5% of traffic from version v1 to v2 of a service for testing. Which Traffic Director resource should they configure?

Accepted Answer

Define a weighted traffic split in the HTTP route rule of the Traffic Director route configuration. Traffic Director uses Envoy's route configuration to define traffic routing rules. To gradually shift a percentage of traffic, you configure a weighted traffic split in the HTTP route rule, specifying weights for different backend services (e.g., v1 and v2). This allows fine-grained control over traffic distribution.

Answer

Use the Envoy runtime to dynamically adjust traffic percentages

Answer

Create a new backend service for v2 and set the traffic split in the backend service

Answer

Configure a weighted round-robin routing policy in Cloud DNS

Question 13

An organization needs to deploy a multi-tier web application on Compute Engine. The web tier must be accessible from the internet, while the database tier must only be accessible from the web tier. The security team requires a defense-in-depth approach. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Use firewall rules to allow ingress from the web subnet to the database subnet on the database port (e.g., 3306). Option B is correct because a firewall rule permitting ingress only from the web subnet's CIDR range to the database subnet on the database port (e.g., 3306 for MySQL) enforces least-privilege access so only web-tier instances can reach the database. Option C is correct because placing the web and database tiers in separate subnets creates distinct network segments that can be governed by different firewall rules, which is a foundational element of defense-in-depth segmentation. Option E is correct because allowing ingress from the internet (0.0.0.0/0) to the web subnet only on ports 80/443 exposes just the web tier as intended while keeping the database tier unreachable from the internet. Option A is incorrect because putting both tiers in the same subnet collapses the segmentation boundary and makes it impossible to write subnet-scoped firewall rules that isolate the database. Option D is incorrect because assigning external IPs to database instances would expose them directly to the internet, violating the requirement that the database tier be reachable only from the web tier.

Answer

Place web and database instances in the same subnet to minimize latency

Answer

Assign external IPs to database instances for easy maintenance

Question 14

Which THREE components are part of a typical Cloud Hybrid Networking architecture?

Accepted Answer

Cloud Router. Cloud Router (B) is correct because in a hybrid networking architecture it dynamically exchanges routes between a Google Cloud VPC and on-premises networks using BGP, which is essential for propagating subnets across the hybrid link. Cloud Interconnect (C) is correct because it provides dedicated, private physical connectivity (via Partner or Dedicated Interconnect) between on-premises infrastructure and Google Cloud, a core hybrid networking building block. Cloud VPN (E) is correct because it establishes encrypted IPsec tunnels over the public internet between on-premises gateways and Google Cloud, another standard hybrid connectivity method. VPC (A) is not one of the three hybrid-connectivity components asked for here, since it is the cloud-side network itself rather than the hybrid link, and Cloud CDN (D) is a content-delivery/caching service unrelated to hybrid connectivity.

Answer

VPC

Answer

Cloud CDN

Question 15

A company wants to use Cloud CDN to serve private content to authenticated users only. Which feature should they use?

Accepted Answer

Signed URLs. Signed URLs let Cloud CDN serve private objects from a backend bucket or backend service by appending a cryptographic signature and expiration to the URL. Only clients holding a valid signed URL can retrieve the cached object, so content stays private while still benefiting from edge caching.

Answer

Cache invalidation

Answer

IAM roles on the backend bucket

Answer

Cloud Armor