PCNE Practice Test 19 — 15 Questions

Question 1

A company has a Shared VPC setup with a host project and several service projects. They want to grant a service project's network admin the ability to create VM instances using a specific subnet from the host project. Which IAM role should they assign at the subnet level?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compute Network User (roles/compute.networkUser) on the specific subnet. Shared VPC allows granting IAM roles on individual subnets. The Compute Network User role (roles/compute.networkUser) allows a principal to use a subnet to create resources, without giving them broader network management permissions.

Answer

Project Owner on the host project

Answer

Compute Instance Admin (roles/compute.instanceAdmin) on the service project

Answer

Compute Network Admin (roles/compute.networkAdmin) on the host project

Question 2

A network engineer is troubleshooting BGP session flaps between a Cloud Router and an on-premises router. The Cloud Router logs show that the session goes down and up repeatedly every few minutes. What is the most common cause of such flapping?

Accepted Answer

The on-premises router is experiencing high CPU load. BGP session flaps often occur due to hold timer expiration caused by network congestion, high CPU on either router, or packet loss. The most common cause in GCP is when the on-premises router does not process keepalives fast enough due to high CPU or memory pressure.

Answer

There is a firewall rule blocking BGP port 179

Answer

The VLAN attachment is misconfigured

Answer

The Cloud Router's BGP timer values are too low

Question 3

A large e-commerce company has a hybrid cloud setup with a Dedicated Interconnect between their on-premises data center in Dallas and Google Cloud us-central1 region. They have a single VLAN attachment with a Cloud Router that uses BGP to exchange routes. The on-premises network uses 10.0.0.0/8, and Google Cloud VPC uses 172.16.0.0/16. They recently deployed a new application in us-west1 that uses IP range 172.17.0.0/16. They created a VPC peering between the us-central1 VPC and the us-west1 VPC. On-premises users can reach the us-central1 workloads but cannot reach the us-west1 application. There are no firewall rules blocking traffic. The on-premises router has a default route pointing to the Interconnect. What is the most likely cause of the issue?

Accepted Answer

The Cloud Router does not have routes for 172.17.0.0/16 because VPC peering does not automatically propagate routes to Cloud Router. The issue is that VPC peering does not automatically propagate routes from the peered VPC (us-west1, 172.17.0.0/16) to the Cloud Router that is used for the Dedicated Interconnect. Cloud Router only learns routes that are present in the VPC’s routing table and that are explicitly advertised via BGP. Since VPC peering routes are not automatically imported into the VPC’s dynamic routing table for Cloud Router, the on-premises router never receives a route for 172.17.0.0/16, even though there are no firewall blocks.

Answer

BGP is not configured between Cloud Router and us-west1 VPC

Answer

Firewall rules in us-west1 are blocking traffic from the on-premises IP range

Answer

The Dedicated Interconnect is only available in us-central1 and cannot reach us-west1

Question 4

A security team wants to serve private content through Cloud CDN but restrict access to only authorized users. They need to generate time-limited URLs that do not require users to log in. Which approach should they use?

Accepted Answer

Use Cloud CDN signed URLs. Signed URLs allow generating time-limited URLs for private content without requiring user login. Signed cookies are for multiple URLs. Public buckets or IAM are not suitable.

Answer

Use IAM permissions on the bucket

Answer

Use Cloud CDN signed cookies

Answer

Enable Cloud CDN and set the bucket to public

Question 5

An organization has deployed an internal TCP/UDP load balancer in their VPC. They need to ensure that the load balancer preserves the client IP address when forwarding traffic to backend instances. Which configuration is required?

Accepted Answer

No configuration is needed; client IP is preserved by default.. Internal TCP/UDP Load Balancers are pass-through load balancers (Layer 4). They preserve the client IP address by default because they forward packets directly without NAT. No special configuration is needed; the backend instances see the original source IP.

Answer

Configure the health check to use the client IP as source.

Answer

Enable Proxy Protocol on the load balancer.

Answer

Use a backend service with session affinity.

Question 6

A company runs a microservices application on Google Kubernetes Engine (GKE) with an Envoy sidecar proxy for each service. They want to use Traffic Director to apply traffic policies such as traffic splitting between versions and fault injection. Which API does Traffic Director use to configure Envoy proxies?

Accepted Answer

Traffic Director xDS API. Traffic Director implements the Envoy xDS (Discovery Service) APIs to dynamically configure Envoy sidecar proxies with routing, load balancing, and health checking policies.

Answer

gRPC API

Answer

Kubernetes Ingress API

Answer

Cloud Endpoints API

Question 7

An organization wants to serve private content via Cloud CDN, ensuring that only authorized users can access cached objects. They need to generate time-limited access for specific URLs. Which method should they use?

Accepted Answer

Use signed URLs with a private key. Signed URLs allow you to grant time-limited access to specific URLs. Signed cookies are for sets of URLs, and Cloud Armor is for WAF, not authorization.

Answer

Set the Cache-Control header to private

Answer

Use Cloud Armor to restrict access by IP

Answer

Use signed cookies to restrict access

Question 8

You need to route traffic to different backend services based on the URL path: /api/* goes to a Cloud Run service, /static/* goes to a Cloud Storage bucket, and /* goes to a Compute Engine instance group. Which component of the Global HTTPS Load Balancer should you configure?

Accepted Answer

URL map. The URL map defines how requests are routed to backend services based on host and path rules.

Answer

Backend service

Answer

Target HTTP proxy

Answer

Health check

Question 9

A company is using a Global SSL Proxy Load Balancer to terminate SSL and forward traffic to a backend service on Compute Engine. They need to preserve the client IP address in the backend logs. What should they do?

Accepted Answer

Enable Proxy Protocol on the SSL proxy load balancer and configure the backend to parse it.. SSL Proxy Load Balancer terminates SSL and forwards traffic using TCP. It does not preserve the original client IP by default. To preserve the client IP, you must enable Proxy Protocol on the load balancer and configure the backend to accept Proxy Protocol headers.

Answer

Enable Cloud CDN with origin header forwarding.

Answer

Use a TCP Proxy Load Balancer with the proxy protocol enabled.

Answer

Configure the backend service to use the X-Forwarded-For header.

Question 10

A network engineer is configuring a global HTTPS load balancer with Cloud CDN. They want to cache responses based on the request origin, query parameters, and user agent. Which cache key configuration should they use?

Accepted Answer

Enable custom cache keys and include the origin header, query string, and user-agent header. Custom cache keys allow inclusion of specific request headers, query parameters, and other attributes. The other options are either not valid or insufficient.

Answer

Use the default cache key, which includes host, scheme, and URL

Answer

Set cache mode to CACHE_ALL_STATIC and enable query string whitelist

Answer

Create a signed URL to include the required parameters

Question 11

A company has a global e-commerce platform using a Global HTTPS Load Balancer with Cloud CDN. They want to serve private content, such as user-specific PDFs, with CDN caching while ensuring only authorized users can access it. Which method should they use?

Accepted Answer

Use Cloud CDN signed URLs or signed cookies. Signed URLs or signed cookies allow you to grant time-limited access to private content cached on Cloud CDN. They are the recommended way to serve private content via CDN.

Answer

Use Cloud Armor to restrict access by IP address

Answer

Enable IAM permissions on the backend bucket and restrict access to only authenticated users

Answer

Set the cache mode to FORCE_CACHE_ALL and use a token in the URL

Question 12

A company wants to use Cloud DNS with a failover routing policy. They have two IP addresses serving the same application: primary in us-east1 and secondary in us-west1. They want traffic to go to primary unless health check fails, then fail over to secondary. Which configuration is required?

Accepted Answer

Create a failover routing policy with primary and secondary targets, each associated with a health check. Cloud DNS failover routing policy requires health checks to be attached to the routing policy. The primary and secondary targets are defined under the policy.

Answer

Create a geo routing policy with us-east1 as primary and us-west1 as secondary

Answer

Use a response policy to override the DNS response

Answer

Create two A records with weighting 100 and 0

Question 13

A developer needs to store a TLS certificate for use with a load balancer. Which Google Cloud service is used to create and manage SSL certificates?

Accepted Answer

Certificate Manager. Certificate Manager is the service for managing SSL/TLS certificates for load balancers. Cloud KMS is for encryption keys, Secret Manager for secrets, and Cloud IAM for access control.

Answer

Secret Manager

Answer

Cloud IAM

Answer

Cloud KMS

Question 14

An organization needs to set up a Regional Internal HTTPS Load Balancer for internal microservices. They want to use Envoy-based load balancing. Which backend type must the backend service use?

Accepted Answer

Zonal NEG. A Regional Internal HTTP(S) Load Balancer uses Envoy-based load balancing and requires a backend service that is either a zonal NEG (with GCE VMs or containers) or a serverless NEG. For internal microservices, typically a zonal NEG of Compute Engine instances is used.

Answer

Instance group

Answer

Internet NEG

Answer

Hybrid connectivity NEG

Question 15

An engineer is configuring a Global SSL Proxy Load Balancer to terminate SSL for a non-HTTP TCP application. They want to minimize latency by allowing the load balancer to reuse connections to backends. Which setting should they adjust?

Accepted Answer

Increase the backend service timeout. Connection timeouts and idle timeouts allow reuse of connections. SSL policies are for versions and ciphers. Proxy protocol adds header but does not affect connection reuse.

Answer

Use a regional TCP proxy load balancer instead

Answer

Enable proxy protocol

Answer

Set the SSL policy to use modern ciphers