PCNE Practice Test 18 — 15 Questions

Question 1

A company has a VPC with a Cloud Router using BGP to advertise prefixes to an on-premises network. The BGP session keeps flapping. What is a likely cause?

Accepted Answer

There is an MTU mismatch causing packet drops. MTU mismatch can cause packets to be dropped, leading to BGP session instability. Ensure consistent MTU across the path.

Answer

VPC Flow Logs are enabled on the subnet

Answer

The firewall rules are blocking BGP traffic

Answer

The Cloud Router is configured with the wrong ASN

Question 2

A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?

Accepted Answer

Export logs to BigQuery. Load balancing logs can be exported to BigQuery for powerful SQL-based analysis and long-term retention.

Answer

Use VPC Flow Logs instead

Answer

View logs in the Cloud Logging dashboard

Answer

Store logs in Cloud Storage and use grep

Question 3

An organization wants to mirror all traffic from a set of Compute Engine instances to a third-party IDS appliance running on a separate instance in the same VPC. The IDS appliance must receive a copy of both ingress and egress traffic without impacting production traffic. Which Google Cloud service should they use?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from source instances (mirror source) to a collector (IDS appliance) for monitoring. It is designed for this purpose without affecting production.

Answer

Firewall Insights

Answer

VPC Flow Logs

Answer

Cloud NAT logging

Question 4

An organization needs to reduce egress costs for a global application serving users worldwide. The application serves static content from Compute Engine instances. Which action is most cost-effective?

Accepted Answer

Use Cloud CDN to cache content at edge locations

Answer

Move all instances to a single region to reduce cross-region traffic

Answer

Upgrade to premium tier networking

Answer

Enable Private Google Access

Question 5

An organization is using Cloud CDN to deliver content globally. Which of the following is a primary benefit of using Cloud CDN?

Accepted Answer

Reduces latency for users by caching content at edge locations. Cloud CDN caches content at edge locations, reducing egress costs from the origin and improving latency for users.

Answer

Provides DDoS protection only

Answer

Increases bandwidth to the origin server

Answer

Eliminates the need for SSL certificates

Question 6

Your company has a hybrid network architecture with two Cloud VPN tunnels (tunnel-a and tunnel-b) from an on-premises router to a Cloud VPN gateway in us-central1, and one Dedicated Interconnect connection from the same on-premises router to a VLAN attachment in us-east1. All connections use BGP to exchange routes. The on-premises router advertises the same CIDR block 10.0.0.0/8 to both VPN and Interconnect. Google Cloud routes for on-premises prefixes are learned via both paths with the same priority. You notice that traffic from Google Cloud VMs in us-central1 to on-premises destinations sometimes fails during periods of high load. Additionally, you observe ICMP redirects from the VMs. What is the most likely cause and recommended action?

Accepted Answer

Configure BGP ASN prepending on the Cloud Router associated with the VPN tunnels to make the Interconnect path more preferred for on-premises traffic back to Google Cloud.. The issue is asymmetric routing: traffic from Google Cloud VMs in us-central1 to on-premises destinations uses the Interconnect (us-east1) due to equal-cost multipath (ECMP) or routing decisions, but return traffic from on-premises may prefer the VPN tunnels (tunnel-a/tunnel-b) because BGP path selection (e.g., local preference, AS path length) is not influenced. This causes ICMP redirects and failures under load. Option A corrects this by using BGP ASN prepending on the Cloud Router for the VPN tunnels, artificially lengthening the AS path for routes learned via VPN, making the Interconnect path more preferred for return traffic, ensuring symmetric routing.

Answer

Create a second Cloud VPN gateway in us-east1 and establish a separate VPN tunnel from on-premises to that gateway to provide symmetric routing.

Answer

Enable source NAT on the Cloud VPN gateway so that VMs' source IPs are rewritten, preventing ICMP redirects.

Answer

Disable route propagation on the Cloud Router in us-east1 to force all traffic through the VPN tunnels.

Question 7

A company uses VPC Flow Logs to analyze traffic patterns. They notice that the logs show only 50% of the actual flows. What is the most likely cause?

Accepted Answer

The default sampling rate of 50% is applied.. By default, VPC Flow Logs sample 50% of flows. This is a known behavior and can be adjusted by configuring the sampling rate.

Answer

The subnet does not have Flow Logs enabled.

Answer

Flow Logs are only generated for incoming traffic.

Answer

Logs are being filtered by a log sink.

Question 8

A company uses Cloud NAT for outbound internet access. They want to ensure that all connections from their VMs use a predictable public IP address for whitelisting with third-party services. Which TWO configurations should be applied? (Choose two.)

Accepted Answer

Reserve and assign static external IP addresses to the Cloud NAT gateway. To ensure a predictable public IP address for whitelisting, you must manually reserve static external IP addresses and assign them to the Cloud NAT gateway. This guarantees that all outbound traffic uses those specific IPs. Option C (logging) does not affect the IP address used; it only provides visibility, so it does not help ensure predictability. Therefore, the correct answer is D only.

Answer

Assign external IPs to each VM and disable Cloud NAT

Answer

Use dynamic NAT IP addresses assigned automatically by Cloud NAT

Answer

Enable Cloud NAT logging to monitor traffic

Answer

Use Private Google Access instead of Cloud NAT

Question 9

A company is migrating to Google Cloud and needs to connect their on-premises data center to a VPC using Cloud VPN with dynamic routing (BGP). They want high availability and automatic failover. Which THREE components are required? (Choose THREE.)

Accepted Answer

Cloud Router with BGP enabled. For HA VPN with dynamic routing, you need two VPN gateways (HA), Cloud Router for BGP, and two tunnels (one to each gateway) for redundancy. A single tunnel would be a single point of failure.

Answer

A single VPN tunnel

Answer

VPC Network Peering

Question 10

A security team needs to capture all traffic to and from a specific Compute Engine instance for forensic analysis. They want to send the mirrored traffic to a third-party IDS appliance running on a separate VM in the same VPC. Which GCP feature should they use, and what is a key consideration?

Accepted Answer

Packet Mirroring, and the collector must be in the same VPC network as the mirrored instance. Packet Mirroring allows copying all traffic from a source instance (the mirrored instance) and sending it to a collector. A key consideration is that the collector must be in the same VPC network and must not be the same instance as the source.

Answer

Firewall Rules Logging, which logs allow/deny events

Answer

VPC Flow Logs, since logs are stored in Stackdriver and can be exported

Answer

Cloud NAT logging, which logs all outbound connections

Question 11

A company is deploying an internal HTTP application on Compute Engine instances. The application must be load-balanced across multiple instances in different regions, but only accessible from within the same VPC. Which load balancer type meets these requirements?

Accepted Answer

Internal HTTP(S) Load Balancer. An Internal HTTP(S) Load Balancer is a regional, internal-only load balancer that distributes HTTP/HTTPS traffic among Compute Engine instances within the same VPC network. It uses an internal IP address and is not accessible from outside the VPC, meeting the requirement for internal-only access while providing cross-region load balancing via a multi-region backend service.

Answer

External TCP/UDP Load Balancer

Answer

External HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 12

Which two of the following are prerequisites for configuring an HA VPN tunnel to an on-premises network? (Choose two.)

Accepted Answer

A Cloud Router with BGP configured in the same region as the VPN gateway.. B is correct because an HA VPN tunnel uses dynamic routing via BGP to provide active-active or active-passive failover. A Cloud Router with BGP configured in the same region as the VPN gateway is required to exchange routes with the on-premises network, enabling automatic failover and load balancing across the two tunnels.

Answer

A VLAN attachment in the same region.

Answer

A pre-shared key that is at least 20 characters long.

Answer

An on-premises VPN device that supports static routing only.

Question 13

A company is migrating its on-premises data center to Google Cloud. They currently have a Cloud VPN tunnel with dynamic routing (BGP) connecting their on-premises router (ASN 65001) to a Cloud Router in us-central1 (ASN 64512). The on-premises network uses IP range 10.0.0.0/8, and the Google Cloud VPC uses 172.16.0.0/12. After migration, they notice intermittent connectivity issues: traffic from on-premises to a new VM (172.16.1.2) is sometimes dropped, while other VMs in the same subnet work fine. The VM 172.16.1.2 is fine when accessed from other Google Cloud VMs. The team suspects asymmetric routing. Investigation shows that the on-premises router receives two routes for 172.16.1.2/32: one with next-hop as the Cloud VPN tunnel and another with next-hop as the internet (default route). No custom route advertisements are configured on the Cloud Router. The VPC has a default route (0.0.0.0/0) pointing to the internet gateway. What should the network engineer do to resolve the issue without breaking other connectivity?

Accepted Answer

Configure an inbound route filter on the Cloud Router to reject the BGP route 0.0.0.0/0 from the on-premises router.. The intermittent connectivity to 172.16.1.2 is caused by asymmetric routing: on-premises traffic uses the BGP-learned /32 route (via VPN) to reach the VM, but return traffic from the VM follows the VPC's default route (0.0.0.0/0) to the internet gateway, which drops the packet because the source IP is from the on-premises range. By configuring an inbound route filter on the Cloud Router to reject the BGP route 0.0.0.0/0 from the on-premises router, the on-premises router will no longer have a default route pointing to the VPN tunnel, forcing it to use the more specific /32 route for 172.16.1.2 and eliminating the asymmetric path.

Answer

Enable global routing on the VPC and create a more specific static route for 172.16.1.2/32 with next-hop as the VPN tunnel.

Answer

Create a second Cloud VPN tunnel from a different region and establish a new BGP session to load balance traffic.

Answer

Change the Cloud Router's BGP advertise-mode to 'custom' and advertise only the subnets that contain migrated VMs.

Question 14

A company uses hierarchical firewall policies at the organization level. They need to allow SSH (TCP 22) access from a specific range 10.0.0.0/8 to all VMs, but a child folder has a policy that denies all ingress traffic. Which rule priority ordering ensures SSH access is allowed?

Accepted Answer

Organization allow rule priority 100, folder deny rule priority 200.. Hierarchical firewall rules have priorities; higher priority (lower number) wins. To override a deny-all, the allow rule must have a lower priority number than the deny rule. The organization policy can have a lower priority than the folder policy, but the folder's deny-all would block. The organization's allow rule must have higher priority (lower number) than the folder's deny rule.

Answer

Folder allow rule priority 100, folder deny rule priority 200.

Answer

Remove the folder deny rule and use network firewall rules.

Answer

Organization allow rule priority 200, folder deny rule priority 100.

Question 15

Refer to the exhibit. A BGP session between a Cloud Router and an on-premises router is not establishing. The Cloud Router logs show 'BGP_OPEN_MSG_ERROR: unsupported capability'. What is the most likely issue?

Accepted Answer

The on-premises router is attempting to negotiate a BGP capability that Cloud Router does not support, such as 4-byte ASNs or IPv6 unicast.. The error message 'BGP_OPEN_MSG_ERROR: unsupported capability' indicates that during the BGP OPEN message exchange, the on-premises router advertised a BGP capability (such as 4-byte ASN support or IPv6 unicast address family) that the Cloud Router does not support. This causes the Cloud Router to reject the OPEN message and reset the session. Option D correctly identifies this mismatch in negotiated capabilities.

Answer

The on-premises router cannot reach the Cloud Router's BGP IP.

Answer

The BGP session is stuck in the Connect state due to firewall blocking TCP port 179.

Answer

The BGP ASN configured on the Cloud Router doesn't match the peer.