PCNE Practice Test 18 — 15 Questions

Question 1

A developer needs to create a subnet for GKE pods that will be used by a cluster. They need to specify a secondary IP range for pods. What is the purpose of the 'purpose' field when creating a subnet?

Accepted Answer

It indicates the subnet is used for GKE pods or services. The 'purpose' field in a Google Cloud subnet is used to designate the subnet's role, specifically for GKE secondary ranges. When set to 'GKE_PODS' or 'GKE_SERVICES', it indicates that the secondary IP range is reserved for GKE pods or services, respectively. This allows GKE to automatically discover and use these ranges when creating clusters, ensuring proper IP allocation for pods and services.

Answer

It enables private Google access

Answer

It defines whether the subnet is auto or custom

Answer

It sets the region for the subnet

Question 2

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address. Option B is correct because a BGP session stuck in CONNECT state typically means the underlying TCP three-way handshake to port 179 cannot complete; the on-premises router must have a valid route to the Cloud Router's BGP peer IP address (reachable via the VPN tunnel or Interconnect) for the TCP connection to be established. Option E is correct because the BGP session between the on-premises router and Cloud Router rides over the Cloud VPN tunnel, so if the tunnel is not established and passing traffic (IKE/IPsec SAs up, no firewall blocking ESP/500/4500), the TCP connection for BGP cannot form and the session will remain in CONNECT. Option A is incorrect because the scenario already states both peers share the same BGP ASN, and changing the ASN would not fix a CONNECT-state problem (it would affect OPEN negotiation, not TCP establishment). Option C is incorrect because hold timers only matter after the session reaches ESTABLISHED; they do not affect the CONNECT state. Option D is incorrect because keepalive intervals are negotiated in the OPEN message and only apply once the session is ESTABLISHED, so they cannot resolve a session stuck in CONNECT.

Answer

Change the BGP ASN on the Cloud Router to a different number

Answer

Increase the BGP hold timer on the Cloud Router

Answer

Change the BGP keepalive interval to 10 seconds

Question 3

An organization has multiple VPCs in different projects that need to resolve DNS names across projects. They want to use Cloud DNS without creating a separate managed zone for each VPC. Which feature should they use?

Accepted Answer

DNS peering. DNS peering in Google Cloud allows a VPC network to resolve names from a private managed zone that belongs to another VPC network (in the same or a different project) without duplicating the zone. It is the correct feature when you want cross-project name resolution without creating a separate managed zone per VPC.

Answer

Private managed zones

Answer

Shared VPC

Answer

DNS forwarding

Question 4

You are designing a global web application that uses Cloud Run for the backend and Cloud Storage for static assets. You need to serve content securely over HTTPS with a custom domain, using Cloud CDN for caching. Which resources must be created or configured? (Choose three.)

Accepted Answer

SSL certificate resource. The scenario requires serving a custom domain over HTTPS with Cloud CDN in front of Cloud Run, which is achieved through an external HTTP(S) load balancer architecture. Option B (SSL certificate resource) is correct because HTTPS on a custom domain requires a Google-managed or self-managed SSL certificate attached to the load balancer's target HTTPS proxy. Option C (URL map) is correct because the URL map defines routing rules that direct requests to the appropriate backend service (the Cloud Run backend and/or Cloud Storage backend bucket) behind the load balancer. Option E (Global external HTTP(S) load balancer) is correct because Cloud CDN and custom-domain HTTPS with Cloud Run require a global external HTTP(S) load balancer, whose target proxy, URL map, and backend services tie the certificate, CDN, and backends together. Option A is not required because Cloud Run backends use a serverless NEG, which is regional rather than zonal, so a zonal NEG is incorrect here. Option D is not required because Identity-Aware Proxy provides identity-based access control, which is unrelated to serving public HTTPS content with CDN caching.

Answer

Zonal NEG for Cloud Run

Answer

Identity-Aware Proxy (IAP)

Question 5

A company wants to audit firewall rules for security best practices. They need to identify overly permissive rules (e.g., allowing all traffic from 0.0.0.0/0) and rules that are never used. Which two Google Cloud tools can help? (Choose two.)

Accepted Answer

Firewall Insights. Firewall Insights (A) is correct because it analyzes VPC firewall rules and surfaces metrics such as shadowed rules, overly permissive rules (e.g., allow from 0.0.0.0/0), and rules with no hits, directly matching the audit requirement. VPC Flow Logs (D) is correct because it records sampled traffic for subnets, and analyzing these logs lets you determine which firewall rules are actually being used versus never matched. Packet Mirroring (B) only copies traffic to collector instances for deep inspection and does not evaluate rule permissiveness or usage. Cloud Armor (C) provides WAF/edge security policies for HTTP(S) load balancing, not VPC firewall rule auditing. Connectivity Tests (E) diagnoses connectivity paths and configuration issues but does not report overly permissive or unused firewall rules.

Answer

Packet Mirroring

Answer

Cloud Armor

Answer

Connectivity Tests

Question 6

An engineer wants to use Traffic Director to split traffic between two versions of a microservice running on Compute Engine with Envoy sidecars. They want to send 10% of traffic to the new version. Which configuration should they apply?

Accepted Answer

Create a weighted backend service with versionA weight 90 and versionB weight 10. Traffic Director supports weighted traffic splitting through a backend service with multiple backends, each assigned a weight. Setting versionA weight 90 and versionB weight 10 routes 10% of traffic to the new version, enabling canary deployments.

Answer

Use HTTP load balancer URL map to route 10% of requests

Answer

Configure a firewall rule to drop 10% of traffic to versionA

Answer

Deploy versionB in a different region and use geo-routing

Question 7

A company is planning a hybrid cloud architecture with GCP. They need a dedicated, high-bandwidth connection from their on-premises data center to GCP with 99.99% SLA and the ability to scale beyond 10 Gbps. Which connection type should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between an on-premises data center and Google Cloud, supporting speeds of 10 Gbps or 100 Gbps per link. It offers a 99.99% SLA when configured with redundant links (two circuits) and can scale beyond 10 Gbps by adding additional 10 Gbps or 100 Gbps connections, meeting the requirement for high bandwidth and high availability.

Answer

Classic VPN

Answer

HA VPN

Answer

Partner Interconnect

Question 8

An engineer wants to allow traffic from a specific service account to a Compute Engine instance. Which firewall rule option should they use for the source?

Accepted Answer

Source service accounts. In Google Cloud firewall rules, the source can be specified as a service account, which allows traffic from VMs associated with that service account. This is the correct option to allow traffic from a specific service account.

Answer

Target service accounts

Answer

Source IP ranges

Answer

Source tags

Question 9

Which THREE components are required to set up a Partner Interconnect connection?

Accepted Answer

A VLAN attachment. To set up a Partner Interconnect connection, you must create a VLAN attachment (B), which is the logical link that connects your on-premises network to the Google Cloud VPC network through the partner's infrastructure. A Cloud Router (C) is also required because it provides the BGP peering and dynamic route exchange for the VLAN attachment, enabling traffic to be routed between the on-premises network and the VPC. The partner's network (E) is essential because Partner Interconnect is delivered through a supported service provider that establishes the physical connectivity to Google's edge, rather than requiring a direct connection to a Google colocation facility. A Dedicated Interconnect connection (A) is not required and is a separate connectivity option that uses a direct physical link to Google, while a Cloud VPN gateway (D) is used for encrypted VPN tunnels over the internet and is not part of the Partner Interconnect architecture.

Answer

A Dedicated Interconnect connection

Answer

A Cloud VPN gateway

Question 10

An organization is migrating on-premises workloads to GCP. They need a dedicated, high-bandwidth connection with a 99.99% SLA. They have a co-location facility near a Google Cloud region. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct physical connections (10G or 100G links) between on-premises and Google's network, offering a 99.99% SLA when using redundant connections.

Answer

HA VPN

Answer

Cloud VPN (Classic VPN)

Answer

Partner Interconnect

Question 11

An engineer needs to set up a VPN between an on-premises network and GCP. The on-premises VPN device does not support BGP and can only support static routing. Which VPN solution should the engineer choose?

Accepted Answer

Classic VPN. Classic VPN supports static routing (policy-based or route-based). HA VPN requires dynamic routing (BGP), and Partner Interconnect is a dedicated connection not a VPN.

Answer

Partner Interconnect

Answer

HA VPN

Answer

Dedicated Interconnect

Question 12

A company wants to expose a set of internal services running on Compute Engine instances in a private VPC to other internal services using HTTP load balancing. They require L7 features like URL-based routing and SSL termination. Which load balancer should they use?

Accepted Answer

Regional Internal HTTP(S) Load Balancer. The Regional Internal HTTP(S) Load Balancer is designed for internal HTTP(S) traffic within a VPC, providing Layer 7 features such as URL-based routing and SSL termination. It uses a regional backend service and is accessible only from within the VPC or connected networks, matching the requirement to expose internal services to other internal services. It supports HTTP/HTTPS protocols and integrates with Google Cloud's internal load balancing architecture.

Answer

Global HTTPS Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 13

A company uses VPC Network Peering between VPC-A (project X) and VPC-B (project Y). They want resources in VPC-A to reach resources in VPC-B, but also need VPC-A to reach an on-premises network connected to VPC-B via Dedicated Interconnect. Which two steps must be configured?

Accepted Answer

Configure VPC-A to import custom routes from VPC-B. By default, VPC peering is non-transitive, so VPC-A cannot reach on-premises through VPC-B. To enable this, VPC-B must export custom routes to VPC-A, and the on-premises network's routes must be learned via BGP on Cloud Router in VPC-B.

Answer

Create a separate VPN tunnel between VPC-A and the on-premises network

Answer

Enable global routing mode in both VPCs

Answer

Configure VPC-A to advertise its subnets to VPC-B

Question 14

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

Accepted Answer

Cloud Router. Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Answer

Cloud NAT

Answer

VPC peering

Answer

VPC Flow Logs

Question 15

A company runs a private GKE cluster in us-central1. Pods need to access the internet for updates. Which configuration is required?

Accepted Answer

Enable Cloud NAT on the cluster's subnet.. In a private GKE cluster, nodes do not have external IPs, so pods cannot reach the internet directly. Cloud NAT provides outbound connectivity by translating private IPs to a public IP, allowing pods to fetch updates while keeping the cluster private. This is the standard solution for outbound-only internet access from private GKE clusters.

Answer

Add network tags to allow egress traffic.

Answer

Create a Cloud Router with BGP peering.

Answer

Assign external IPs to the nodes.