PCNE Practice Test 18 — 15 Questions

Question 1

A company uses a Shared VPC host project with three service projects: Prod, Staging, and Dev. All service projects have similar network requirements except that Prod requires Private Google Access to access Google APIs from VM instances without external IP addresses. The network team creates a single subnet in the Shared VPC with Private Google Access enabled. However, Staging and Dev teams report that their VMs cannot reach external IP addresses on the internet because the subnet's route has a next hop of default internet gateway. What is the most cost-effective solution that meets all requirements?

Accepted Answer

Configure Cloud NAT in the Shared VPC for the Staging and Dev service projects to allow outbound internet access from their VMs without external IPs.. Option C is correct because Cloud NAT provides outbound internet connectivity for VM instances without external IP addresses, which is exactly what Staging and Dev need. Since Private Google Access is already enabled on the shared subnet, Prod VMs can reach Google APIs without external IPs, while Cloud NAT handles the general internet access for the other projects. This is the most cost-effective solution because Cloud NAT incurs only egress data processing charges and does not require additional subnets or complex routing changes.

Answer

Create a separate subnet for each service project in the Shared VPC and enable Private Google Access only on the Prod subnet.

Answer

Enable Private Google Access on the Shared VPC's subnet for all projects and configure Cloud Router with BGP to advertise a default route.

Answer

Disable Private Google Access on the subnet and create a separate subnet for Prod with Private Google Access enabled.

Question 2

You are a cloud network engineer for a company that runs a web application on Compute Engine instances in a managed instance group (MIG) behind an external HTTP(S) load balancer. The backend instances are in a subnet with CIDR 10.0.2.0/24 and are tagged 'web-backend'. The health checks are configured to use TCP port 80. Recently, the security team added new firewall rules to restrict traffic, and now the health checks are failing. The current firewall rules (in order of priority) are:

1. Priority 100: Deny ingress from 0.0.0.0/0 to all instances (deny-all).
2. Priority 200: Allow ingress from 130.211.0.0/22 and 35.191.0.0/16 to instances with tag 'health-checked' on TCP port 80.
3. Priority 300: Allow ingress from 0.0.0.0/0 to instances with tag 'web-backend' on TCP port 80.

The MIG instances are tagged 'web-backend' but not 'health-checked'. The health checks are failing. What is the most efficient course of action to fix the health checks while maintaining security?

Accepted Answer

Modify the existing priority 200 rule to set target tags to 'web-backend' instead of 'health-checked'.. The health check probes originate from Google's health checker IP ranges (130.211.0.0/22 and 35.191.0.0/16) and must reach the instances. The current priority 200 rule allows these ranges only to instances tagged 'health-checked', but the MIG instances are tagged 'web-backend'. By modifying the priority 200 rule to target 'web-backend' instead, you permit health check traffic to the correct instances without creating a new rule or lowering security, as the deny-all rule (priority 100) remains in place and the more specific allow rule (priority 200) will match first.

Answer

Change the priority 300 rule to allow from 0.0.0.0/0 to instances with tag 'health-checked' on TCP port 80.

Answer

Add a new ingress firewall rule with priority 150 that allows traffic from 130.211.0.0/22 and 35.191.0.0/16 to instances with tag 'web-backend' on TCP port 80.

Answer

Delete the deny-all rule (priority 100) because it is blocking health checks.

Question 3

A company is deploying a new application across three VPCs in the same project, using Shared VPC. The security team wants to restrict traffic such that only the frontend subnet (10.0.1.0/24) can send traffic to the backend subnet (10.0.2.0/24) on TCP port 8080. The backend instances have the service account 'backend-sa@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations achieve this goal?

Accepted Answer

Create an ingress firewall rule on the backend VPC with source service account 'frontend-sa@project.iam.gserviceaccount.com', protocol tcp:8080, and target service account 'backend-sa@project.iam.gserviceaccount.com'.. Option A is correct because it uses service accounts as both source and target in an ingress rule on the backend VPC. This allows only instances with the frontend service account to send traffic to instances with the backend service account on TCP 8080, meeting the security requirement without relying on IP addresses or network tags.

Answer

Create an egress firewall rule on the frontend VPC with source CIDR 10.0.1.0/24, protocol tcp:8080, and target CIDR 10.0.2.0/24.

Answer

Create an ingress firewall rule on the backend VPC with source tag 'frontend-tag', protocol tcp:8080, and target tag 'backend-tag'.

Answer

Create a VPC firewall rule with priority 1000 that denies all traffic from 10.0.1.0/24 to 10.0.2.0/24, and then a higher priority rule allowing tcp:8080.

Question 4

A company has a Cloud VPN tunnel with dynamic routing (BGP) connecting their on-premises network to a VPC in us-central1. They recently added a new subnet (10.2.0.0/16) to the VPC. The on-premises network still cannot reach resources in the new subnet. The Cloud Router BGP session is established and routes from on-prem are being received. What is the most likely cause?

Accepted Answer

The new subnet range is not included in the Cloud Router's advertised routes. When a new subnet is added to a VPC, the Cloud Router must be configured to advertise that subnet's CIDR range to the on-premises BGP peer. Even though the BGP session is established and routes from on-premises are received, the Cloud Router will not automatically advertise the new subnet unless its advertised route list is updated. Without the new subnet in the Cloud Router's advertised routes, the on-premises network has no path to reach 10.2.0.0/16, causing connectivity failure.

Answer

The Cloud Router does not support more than 10 custom dynamic routes

Answer

BGP session is not established

Answer

Firewall rules are blocking traffic

Question 5

A network engineer is designing a hybrid cloud architecture connecting an on-premises data center to Google Cloud via Dedicated Interconnect. The on-premises network uses BGP for dynamic routing. The engineer needs to configure Cloud Router to exchange routes with the on-premises router. Which two configuration steps are required? (Choose two.)

Accepted Answer

Enable the BGP session on the Cloud Router and configure the peer IP address and ASN.. Option A is correct because Cloud Router uses BGP to dynamically exchange routes with the on-premises router over Dedicated Interconnect. Enabling the BGP session requires configuring the peer IP address (the on-premises router's interface IP) and the on-premises ASN, which allows the two routers to establish a BGP peering and exchange prefixes.

Answer

Configure a static route in Google Cloud VPC with the on-premises prefix.

Answer

Assign a primary and secondary IP range to the Cloud Router interface.

Answer

Configure the Cloud Router with the same ASN as the on-premises router.

Question 6

Refer to the exhibit. A network team has created this load balancer. Clients inside the VPC are unable to connect to the load balancer's IP address from a Compute Engine instance in the same VPC. What is the most likely cause?

Accepted Answer

The load balancer is configured with network tier STANDARD, which does not support internal traffic.. Option B is correct because a load balancer configured with network tier STANDARD uses the Premium Tier's external IP addressing, which does not support internal traffic routing within the same VPC. Clients inside the VPC attempting to connect to the load balancer's IP address from a Compute Engine instance in the same VPC will fail because STANDARD tier IPs are designed for external internet-facing traffic and cannot be reached from within the VPC without a public IP and appropriate routing. The load balancer must use the Premium Tier (network tier PREMIUM) to support internal client traffic within the same VPC.

Answer

The target HTTPS proxy is not properly configured to use a backend service.

Answer

The load balancer is using INTERNAL_MANAGED scheme, which requires the clients to be in a different region.

Answer

The load balancer does not have a backend service configured.

Question 7

A company wants to establish a VPC peering connection between two VPCs in different projects. Which two steps are mandatory to create the peering connection?

Accepted Answer

Ensure the VPCs have non-overlapping subnet IP address ranges.. Option B is correct because VPC peering relies on private IP routing between the two VPCs. If the IP address ranges overlap, the VPC route tables cannot distinguish which VPC a packet belongs to, causing routing conflicts and preventing the peering connection from being established. Google Cloud requires that the VPCs have non-overlapping subnet CIDR blocks for successful peering.

Answer

Assign a public IP to the VMs in both VPCs.

Answer

Create a firewall rule allowing all traffic between the VPCs.

Answer

Configure a Cloud Router with BGP sessions.

Question 8

Refer to the exhibit. A VM in the my-vpc network is unable to reach an external HTTPS server. What is the most likely cause?

Accepted Answer

The deny-all-egress firewall rule blocks all outbound traffic.. The default VPC configuration includes a deny-all-egress firewall rule with the lowest priority (65535) that blocks all outbound traffic not explicitly allowed. Since no higher-priority rule permits outbound traffic to the external HTTPS server (port 443), the VM's HTTPS requests are dropped by this implicit deny rule, preventing connectivity.

Answer

The allow-custom-internal rule only allows inbound traffic.

Answer

No rule allows outbound traffic to port 443.

Answer

The default-allow-ssh rule has a low priority.

Question 9

A company has Compute Engine instances without external IPs that need to access the internet for updates. They do not want any inbound traffic. What is the best design?

Accepted Answer

Configure Cloud NAT and add firewall rules to allow only necessary egress and deny all ingress.. Option B is correct because Cloud NAT provides outbound internet connectivity for instances without external IPs, and the explicit firewall rules ensure only necessary egress traffic is allowed while denying all ingress, meeting the requirement of no inbound traffic. Default firewall rules allow some ingress (e.g., ICMP), so they must be overridden with a deny-all-ingress rule to fully block inbound traffic.

Answer

Configure Cloud NAT and rely on default firewall rules.

Answer

Configure Cloud NAT and add a firewall rule to allow all egress traffic.

Answer

Configure Cloud NAT and add a firewall rule to deny all ingress and egress.

Question 10

An organization has two VPC networks in different Google Cloud organizations. They need to allow private IP communication between instances in these VPCs without using public IPs or VPNs. Which solution should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering allows private IP connectivity between two VPC networks across different organizations without requiring public IPs, VPNs, or gateways. It uses the Google Cloud internal infrastructure to route traffic directly between instances, leveraging RFC 1918 addresses and supporting global peering.

Answer

Cloud NAT

Answer

Shared VPC

Answer

Cloud VPN

Question 11

An organization has Compute Engine instances in a VPC without external IP addresses. They need to allow these instances to access Google Cloud Storage buckets but not the internet. What should they configure?

Accepted Answer

Enable Private Google Access on the subnets where the instances reside.. Private Google Access allows Compute Engine instances without external IP addresses to reach Google APIs and services, including Cloud Storage, through the VPC network's default route to the internet gateway, but only to Google's published IP ranges. This is the correct solution because it provides the required access without exposing the instances to the general internet.

Answer

Set up Cloud NAT and configure a firewall rule to allow egress to Google Cloud Storage IP ranges.

Answer

Peer the VPC with the Google Cloud Storage service VPC.

Answer

Create an egress firewall rule allowing traffic to 0.0.0.0/0 and a route to the default internet gateway.

Question 12

A request comes from IP 192.0.2.5, with origin region code 'US', and path '/admin/dashboard'. What will be the final action?

Accepted Answer

Deny by rule priority 2000.. The request matches a rule with priority 2000 that denies traffic from IP 192.0.2.5 to path '/admin/dashboard' with origin region 'US'. Since Cloud Armor security policies evaluate rules in ascending priority order, rule 2000 is evaluated before rule 3000 and after rule 1000. Rule 1000 does not match (likely a different condition), so rule 2000 applies and denies the request.

Answer

Deny by rule priority 1000.

Answer

Deny by rule priority 3000.

Answer

Allow (default rule).

Question 13

Which TWO services can be used to provide outbound connectivity to the internet for private VMs in a VPC? (Assume VMs have no external IPs.)

Accepted Answer

Instance with external IP. Option A is correct because an instance with an external IP can provide outbound connectivity for private VMs if it is configured as a NAT gateway or proxy. However, the question specifies that VMs have no external IPs, so this option is technically incorrect in the context of the question's constraint. The intended correct answer for outbound connectivity without external IPs is Cloud NAT, which allows private VMs to access the internet using source network address translation (SNAT) without assigning external IPs to individual VMs.

Answer

Cloud Router

Answer

Private Google Access

Answer

Cloud VPN

Question 14

A company wants to connect on-premise to GCP via Cloud VPN with dynamic routing. They have two on-prem routers for redundancy. Which configuration ensures automatic failover?

Accepted Answer

Create two VPN tunnels using Cloud Router with BGP and the same ASN. Option C is correct because creating two VPN tunnels with Cloud Router using BGP and the same ASN on both on-prem routers enables dynamic routing and automatic failover. Cloud Router establishes BGP sessions with each on-prem router, and when both tunnels advertise the same routes with the same ASN, Cloud Router can detect a BGP session failure and automatically route traffic through the remaining healthy tunnel. This setup ensures seamless failover without manual intervention.

Answer

Create two VPN tunnels each with static routes pointing to the other router

Answer

Create one VPN tunnel with BGP and two interfaces

Answer

Create two VPN tunnels with BGP but different ASNs on each tunnel

Question 15

A company needs to connect on-premises to GCP using Dedicated Interconnect with a 10 Gbps link, and they require high availability. They plan to use a single VLAN attachment. What is the best design?

Accepted Answer

Deploy two interconnects with one VLAN attachment each.. For high availability with Dedicated Interconnect, you need two separate physical connections (interconnects) to avoid a single point of failure. Each interconnect must have its own VLAN attachment and BGP session to ensure that if one link fails, traffic can still flow over the other. A single VLAN attachment cannot provide redundancy because it is tied to one physical interconnect.

Answer

Deploy one interconnect with one VLAN attachment and a VPN as backup.

Answer

Deploy one interconnect with one VLAN attachment and use static routing.

Answer

Deploy two VLAN attachments on the same interconnect with separate BGP sessions.