PCNE Practice Test 17 — 15 Questions

Question 1

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

Accepted Answer

Ingress rule: source 203.0.113.5/32, destination 10.0.1.2/32, tcp:22. Option D is correct because firewall rules in GCP are stateful and applied at the instance level, not the VPN tunnel. The rule must allow ingress traffic from the on-premises source IP (203.0.113.5/32) to the Compute Engine instance's internal IP (10.0.1.2/32) on TCP port 22. The Cloud VPN and Cloud Router handle routing, but the firewall rule explicitly defines the allowed traffic flow.

Answer

Ingress rule: source 203.0.113.5/32, destination 169.254.0.1/32, tcp:22

Answer

Ingress rule: source 10.0.1.2/32, destination 203.0.113.5/32, tcp:22

Answer

Ingress rule: source 0.0.0.0/0, destination 203.0.113.5/32, tcp:22

Question 2

A network engineer is designing a Google Cloud network for a financial services company that requires strict compliance with PCI DSS. They need to isolate development, staging, and production environments. Which approach should they use to meet these requirements?

Accepted Answer

Use separate VPCs for each environment, connected via VPC Network Peering. Option D is correct because PCI DSS requires strict network segmentation between environments handling cardholder data. Separate VPCs provide complete isolation at the network layer, preventing any accidental cross-environment traffic. VPC Network Peering allows controlled, encrypted communication between these isolated VPCs without reducing the security boundary, as peering does not merge routing domains or security policies.

Answer

Use a single VPC with separate subnets for each environment and firewall rules to restrict traffic

Answer

Use a single VPC with separate firewall rules for each environment

Answer

Use a Shared VPC with separate service projects for each environment

Question 3

A company wants to connect two VPC networks (vpc-a and vpc-b) that both reside in the same Google Cloud project. They need to ensure that all IP ranges in both VPCs can communicate using internal private IP addresses. Which solution should they implement?

Accepted Answer

Enable VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering directly connects two VPCs within the same project using internal RFC 1918 IP addresses, with no bandwidth limitations and no single point of failure. It allows all subnets in both VPCs to communicate privately without requiring external connectivity, VPN tunnels, or NAT gateways.

Answer

Use Dedicated Interconnect to connect the VPCs.

Answer

Set up Cloud VPN tunnels between the two VPCs.

Answer

Configure Cloud NAT to allow the VPCs to communicate through NAT.

Question 4

Drag and drop the steps to create a VPC with custom subnet mode in Google Cloud into the correct order.

Question 5

Drag and drop the steps to configure Cloud Router with BGP for on-premises connectivity into the correct order.

Question 6

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Question 7

Drag and drop the steps to configure a global external HTTP(S) load balancer in Google Cloud into the correct order.

Question 8

Match each Cloud Load Balancing type to its description.

Question 9

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify the BGP session status on the Cloud Router.. Option A is correct because BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Answer

Check the MTU configuration on the on-premises router.

Answer

Verify the physical interconnect location and cable connections.

Answer

Review the Cloud NAT configuration for the VPC network.

Question 10

A company is deploying a Dedicated Interconnect with a 10 Gbps circuit to Google Cloud. They need to ensure high availability. Which configuration is required by Google Cloud to meet the high availability SLA?

Accepted Answer

Provision two VLAN attachments on two separate Cloud Routers in different zones. To meet the high availability SLA for Dedicated Interconnect, Google Cloud requires at least two VLAN attachments, each on a separate Cloud Router in different zones. This ensures that if one zone or Cloud Router fails, traffic can still flow through the other attachment, providing redundancy. A single VLAN attachment or a single Cloud Router does not meet the 99.99% availability SLA because it creates a single point of failure.

Answer

Combine Dedicated Interconnect with a Cloud VPN tunnel for failover

Answer

Use Partner Interconnect instead of Dedicated Interconnect

Answer

Provision a single VLAN attachment on one Cloud Router

Question 11

A company wants to connect their VPC to an on-premises network using Cloud VPN. They need to ensure that traffic from Google Cloud to on-premises uses a specific route only when the primary path is available, and otherwise fails over to a backup path. Which configuration should they use?

Accepted Answer

Configure BGP on Cloud Router and advertise custom routes with appropriate metrics. Option B is correct because Cloud VPN with dynamic routing (BGP) allows you to control path selection by advertising custom routes with different metrics (MED values) for the primary and backup paths. When the primary path is available, the lower metric route is preferred; if the BGP session fails, the route is withdrawn and traffic automatically fails over to the backup path with a higher metric. This meets the requirement for active/passive failover without manual intervention.

Answer

Configure Cloud NAT to route traffic through the backup path

Answer

Use static routes with a higher priority for the primary path

Answer

Create firewall rules to allow failover traffic

Question 12

A company is using Cloud Interconnect with multiple VLAN attachments. They want to implement traffic shaping to prioritize real-time traffic over bulk transfers. Which THREE actions should they take?

Accepted Answer

Set up Cloud Router with BGP QoS policies to match DSCP values. Option A is correct because Cloud Router with BGP QoS policies can match DSCP values to prioritize traffic. By configuring BGP QoS policies, you can map specific DSCP values to different traffic classes, allowing Cloud Interconnect to apply traffic shaping that prioritizes real-time traffic (e.g., VoIP) over bulk transfers. This leverages BGP community attributes to signal QoS requirements across the hybrid connection.

Answer

Enable Cloud NAT to handle traffic shaping

Answer

Use VPC flow logs to identify heavy traffic flows

Question 13

An enterprise is using a 10 Gbps Dedicated Interconnect between their on-premises data center and Google Cloud. They measure throughput and find it is only 5 Gbps even though there is no congestion. The on-premises router is configured with a single VLAN attachment. What is the most likely cause?

Accepted Answer

The on-premises router does not support full line rate. A single VLAN attachment on a 10 Gbps Dedicated Interconnect means the on-premises router must handle all traffic through one physical interface. If the router lacks the forwarding capacity to process packets at 10 Gbps line rate, throughput will be capped at its maximum switching or routing performance, which in this case is 5 Gbps. This is a common hardware limitation, not a configuration or congestion issue.

Answer

BGP is not configured, causing routing loop

Answer

MTU mismatch between on-premises and Google Cloud

Answer

QoS policy is limiting throughput on Google Cloud side

Question 14

Which TWO statements about VPC Network Peering are correct? (Choose TWO.)

Accepted Answer

Transitive peering is not supported; if Network A is peered with Network B and Network A is peered with Network C, Network B cannot communicate with Network C through Network A.. Option A is correct because VPC Network Peering is non-transitive by design. This means that if Network A is peered with both Network B and Network C, traffic cannot flow from Network B to Network C through Network A. Each peering connection is a direct, point-to-point link, and routing is not propagated across multiple peering hops. This behavior is enforced by the GCP networking stack to prevent complex and unintended routing topologies.

Answer

Peered networks can use globally distributed routing to communicate across regions without additional configuration.

Answer

Default routes (0.0.0.0/0) are automatically exported and imported between peered networks.

Answer

Firewall rules from one network are automatically applied to the peered network.

Question 15

A company plans to connect an on-premises network to Google Cloud using HA VPN with dynamic routing (BGP). The on-premises side supports BGP and has two independent routers for redundancy. The company wants to ensure failover within seconds if one tunnel goes down. Which configuration meets this requirement?

Accepted Answer

Create two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises router, and configure a separate Cloud Router on each gateway with BGP.. Option A is correct because deploying two Cloud VPN gateways in different regions with separate Cloud Routers ensures true regional redundancy. If one gateway or its tunnel fails, BGP sessions on the other gateway remain active, and Google Cloud's network can immediately route traffic via the surviving path. This architecture meets the sub-second failover requirement by avoiding a single point of failure at the gateway level and leveraging BGP's fast convergence.

Answer

Create two VPN tunnels from one Cloud VPN gateway to both on-premises routers, and configure one Cloud Router with active/passive BGP.

Answer

Create two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises router, and use static routing with route metrics for failover.

Answer

Create two VPN tunnels from one Cloud VPN gateway to both on-premises routers, and configure a single Cloud Router with BGP.