PCNE Practice Test 17 — 15 Questions

Question 1

A company is deploying a global HTTP load balancer with a backend service that spans multiple regions. The backend instances are in a managed instance group. They want to use Cloud CDN to cache content. What is the minimal set of configurations required on the backend bucket or instance group to enable Cloud CDN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Cloud CDN on the backend service and ensure that the load balancer's frontend uses HTTP or HTTPS protocol. Cloud CDN must be enabled on the backend service of the HTTP(S) load balancer, and the frontend must use HTTP or HTTPS because Cloud CDN only supports HTTP(S) protocols. This is the minimal configuration; no changes to the backend bucket or instance group are required beyond ensuring the backend service is correctly associated with the load balancer.

Answer

Configure Identity-Aware Proxy (IAP) on the backend service to allow cache

Answer

Use the gcloud compute backend-services update command with the --enable-cdn flag on the load balancer itself

Answer

Create a Cloud Storage bucket with public access and set it as the backend

Question 2

A company wants to connect two VPCs in different GCP projects so that they can exchange traffic using internal IP addresses. They do not need centralized management or transitive routing between the VPCs. Which GCP networking feature should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering allows direct connectivity between two VPCs using internal IPs, with no transitive routing. It is a simple, decentralized option for connecting two VPCs.

Answer

Network Connectivity Center

Answer

Cloud VPN

Answer

Shared VPC

Question 3

Which TWO statements about VPC Network Peering are correct? (Choose TWO.)

Accepted Answer

Transitive peering is not supported; if Network A is peered with Network B and Network A is peered with Network C, Network B cannot communicate with Network C through Network A.. VPC Network Peering is non-transitive by design. This means that if Network A is peered with both Network B and Network C, traffic cannot flow from Network B to Network C through Network A. Each peering connection is a direct, point-to-point link, and routing is not propagated across multiple peering hops. This behavior is enforced by the GCP networking stack to prevent complex and unintended routing topologies.

Answer

Peered networks can use globally distributed routing to communicate across regions without additional configuration.

Answer

Default routes (0.0.0.0/0) are automatically exported and imported between peered networks.

Answer

Firewall rules from one network are automatically applied to the peered network.

Question 4

An organization uses Cloud DNS with a managed zone for internal resolution. They want to implement a failover routing policy so that if the primary health-checked endpoint is unhealthy, traffic is directed to a secondary endpoint. Which THREE steps are required? (Choose three.)

Accepted Answer

Create a health check for the secondary endpoint. Failover routing policy requires a primary and secondary target, each with an associated health check to determine health.

Answer

Create a routing policy of type WEIGHTED

Answer

Create a response policy zone

Question 5

A network engineer is configuring BGP on a Cloud Router for a Dedicated Interconnect. They want to apply traffic engineering to prefer one path over another for inbound traffic from on-premises to GCP. Which THREE BGP attributes can be used to influence this inbound traffic? (Choose three.)

Accepted Answer

BGP communities. MED (metric) is the primary attribute to influence inbound traffic. AS path prepending (adding AS numbers) makes a path less preferred. Communities (like no-export) can control route propagation and thus influence path selection.

Answer

Weight

Answer

Local preference

Question 6

You need to monitor the health and performance of a Dedicated Interconnect connection. Which THREE Cloud Monitoring metrics should you use? (Choose three.)

Accepted Answer

interconnect/network/received_bytes_count. Key metrics include received bytes count (for traffic), operational status (link up/down), and packets dropped (indicates errors or congestion). These are standard interconnect metrics.

Answer

interconnect/network/sent_packets_count

Answer

interconnect/link/latency

Question 7

An organization uses Traffic Director with Envoy sidecars in GKE. They want to implement fault injection to test service resilience by injecting a 5-second delay into 10% of requests to a specific backend service. Which Traffic Director configuration resource should they use?

Accepted Answer

A fault injection policy in the TrafficDirectorRoute. Traffic Director supports fault injection via the Envoy HTTP connection manager. The correct approach is to configure a TrafficDirectorRoute with a fault injection policy, which is part of the routing configuration.

Answer

A backend service with outlier detection enabled

Answer

A network endpoint group with a health check that fails intermittently

Answer

A traffic splitting rule in the routing configuration

Question 8

A company wants to analyze VPC Flow Logs to identify the top talkers (source IPs) generating the most traffic to their web servers. They have enabled VPC Flow Logs on the subnet. Where should they export the logs for cost-effective querying and analysis?

Accepted Answer

BigQuery. BigQuery is the best choice for querying large volumes of VPC Flow Logs with SQL, enabling cost-effective analysis of top talkers. Stackdriver (Cloud Monitoring) is for metrics, not log analysis; Cloud Storage is for archival; Pub/Sub for streaming.

Answer

Cloud Monitoring (Stackdriver)

Answer

Cloud Pub/Sub

Answer

Cloud Storage

Question 9

A network engineer wants to test whether a VM in VPC A can reach a VM in VPC B that is connected via VPC peering. The engineer suspects that firewall rules or routes are blocking traffic. Which Google Cloud service should they use to test the path and identify the blocking rule?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to check reachability between source and destination endpoints, analyzing firewall rules, routes, and VPC peering configurations to identify the blocking rule.

Answer

Performance Dashboard

Answer

VPC Flow Logs

Answer

Firewall Insights

Question 10

A network engineer wants to capture all traffic to and from a specific Compute Engine instance for security analysis and forward it to an IDS appliance in another VPC. Which GCP service should they use?

Accepted Answer

Packet Mirroring. Packet Mirroring clones traffic from a source instance and sends it to a collector (IDS appliance) in the same or different VPC. It is designed for security monitoring.

Answer

VPC Flow Logs

Answer

Firewall Rules Logging

Answer

Cloud NAT logging

Question 11

An organization needs to monitor and analyze firewall rule activity for security auditing. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Enable firewall rules logging for the rules to monitor.. Enable firewall rules logging for rules of interest. Export logs to BigQuery for analysis. Cloud Logging captures the logs, and BigQuery allows complex queries.

Answer

Enable Cloud NAT logging.

Answer

Enable VPC Flow Logs on all subnets.

Answer

Use Packet Mirroring to capture all traffic.

Question 12

A company wants to optimize costs for egress traffic from Compute Engine instances to the internet. They are considering using Cloud CDN and Private Google Access. Which TWO statements correctly describe how these services can reduce egress costs?

Accepted Answer

Cloud CDN reduces egress costs by serving cached content from edge locations closer to users.. Cloud CDN caches content at edge locations, reducing the amount of egress from the origin. Private Google Access allows VMs with internal IPs to access Google APIs without using public IPs, thus avoiding internet egress charges for API calls.

Answer

Cloud CDN requires a global load balancer to function.

Answer

Private Google Access eliminates the need for a NAT gateway.

Answer

Cloud CDN eliminates all egress costs for cached content.

Question 13

A developer wants to enable VPC Flow Logs on a subnet to capture metadata about IP traffic. They want to reduce costs by logging only a sample of traffic. What is the default sampling rate for VPC Flow Logs?

Accepted Answer

50%. The default sampling rate for VPC Flow Logs is 50%. This can be adjusted to reduce costs but may miss some flows.

Answer

10%

Answer

100%

Answer

25%

Question 14

You are a cloud network engineer for a company that runs a web application on Compute Engine instances in a managed instance group (MIG) behind an external HTTP(S) load balancer. The backend instances are in a subnet with CIDR 10.0.2.0/24 and are tagged 'web-backend'. The health checks are configured to use TCP port 80. Recently, the security team added new firewall rules to restrict traffic, and now the health checks are failing. The current firewall rules (in order of priority) are:

1. Priority 100: Deny ingress from 0.0.0.0/0 to all instances (deny-all).
2. Priority 200: Allow ingress from 130.211.0.0/22 and 35.191.0.0/16 to instances with tag 'health-checked' on TCP port 80.
3. Priority 300: Allow ingress from 0.0.0.0/0 to instances with tag 'web-backend' on TCP port 80.

The MIG instances are tagged 'web-backend' but not 'health-checked'. The health checks are failing. What is the most efficient course of action to fix the health checks while maintaining security?

Accepted Answer

Modify the existing priority 200 rule to set target tags to 'web-backend' instead of 'health-checked'.. The health check probes originate from Google's health checker IP ranges (130.211.0.0/22 and 35.191.0.0/16) and must reach the instances. The current priority 200 rule allows these ranges only to instances tagged 'health-checked', but the MIG instances are tagged 'web-backend'. By modifying the priority 200 rule to target 'web-backend' instead, you permit health check traffic to the correct instances without creating a new rule or lowering security, as the deny-all rule (priority 100) remains in place and the more specific allow rule (priority 200) will match first.

Answer

Change the priority 300 rule to allow from 0.0.0.0/0 to instances with tag 'health-checked' on TCP port 80.

Answer

Add a new ingress firewall rule with priority 150 that allows traffic from 130.211.0.0/22 and 35.191.0.0/16 to instances with tag 'web-backend' on TCP port 80.

Answer

Delete the deny-all rule (priority 100) because it is blocking health checks.

Question 15

A network engineer wants to test reachability between a Compute Engine instance in VPC A and a Cloud SQL instance in VPC B, which are connected via VPC peering. Which Google Cloud tool should be used to check if firewall rules or routes are blocking traffic?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to define source and destination and checks configurations like firewall rules, routes, and VPC peering to determine if traffic can flow.

Answer

Packet Mirroring

Answer

VPC Flow Logs

Answer

Firewall Insights