PCNE Practice Test 19 — 15 Questions

Question 1

An engineer needs to provide outbound internet access to a set of Compute Engine instances that have only internal IP addresses. The instances must use a static IP address for outbound traffic. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud NAT gateway with static IP address and configure it on the VPC network.. Cloud NAT with a static IP address allows instances with only internal IPs to access the internet using a reserved static external IP. It provides outbound NAT without requiring external IPs on the instances themselves. This meets the requirement for a static IP for outbound traffic.

Answer

Assign a static external IP to each instance and configure a firewall rule to allow egress.

Answer

Configure Private Google Access on the subnet to route traffic to Google APIs.

Answer

Deploy a Compute Engine instance as a NAT instance with IP forwarding enabled.

Question 2

Which TWO are necessary components for setting up Dedicated Interconnect? (Choose two.)

Accepted Answer

A Cloud Router in the same region as the VLAN attachment. Option C is correct because a Dedicated Interconnect VLAN attachment must be associated with a Cloud Router in the same region as the attachment; the Cloud Router is required to exchange routes (via BGP) between the on-premises network and the VPC. Option E is correct because the VLAN attachment is the logical link that maps the Dedicated Interconnect connection to a specific VPC network, enabling traffic to flow into that VPC. Option A is not required, since Cloud VPN is a separate connectivity method and is not needed for management traffic on Dedicated Interconnect. Option B is not required, as QoS policies are not a prerequisite for Dedicated Interconnect bandwidth guarantees. Option D is not required, because redundancy with two physical connections is a best practice but not a necessary component for initial setup.

Answer

A Cloud VPN tunnel for management traffic

Answer

A QoS policy to ensure bandwidth guarantee

Answer

Two physical interconnect connections for redundancy

Question 3

Refer to the exhibit. A VM in the default VPC with an internal IP 10.0.1.2 tries to SSH (tcp:22) from a host at 10.0.2.5. What is the result?

Accepted Answer

The traffic is allowed because it matches the allow-internal rule.. In Google Cloud VPC, firewall rules are stateful and evaluated based on priority (lower priority number = higher priority). The default VPC includes an 'allow-internal' rule (priority 65534) that allows all TCP traffic from any source in the 10.0.0.0/8 range. Since the source IP (10.0.2.5) is within 10.0.0.0/8 and the destination VM (10.0.1.2) is also in that range, the SSH traffic matches this allow rule. If a deny-ssh rule were present with a lower priority number (e.g., 1000), it would take precedence over the allow-internal rule. However, no such deny rule is specified in the question, so the traffic is allowed because it matches the allow-internal rule.

Answer

The traffic is denied because the source IP is not in the same subnet as the VM.

Answer

The traffic is denied because the deny-ssh rule has a lower priority number and blocks all SSH traffic.

Answer

The traffic is denied due to the implicit deny rule at the end.

Question 4

An organization is planning a hybrid network between an on-premises data center and Google Cloud. They require a dedicated, high-bandwidth connection with 99.99% availability SLA and the ability to scale up to 100 Gbps. They have a co-location facility that is connected to a Google Cloud region. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection between the on-premises network and Google Cloud, offering high bandwidth (up to 100 Gbps per link) and a 99.99% availability SLA when configured with redundancy. Since the organization has a co-location facility connected to a Google Cloud region, Dedicated Interconnect is the appropriate choice.

Answer

HA VPN

Answer

Partner Interconnect

Answer

Classic VPN

Question 5

Refer to the exhibit. A network engineer is unable to SSH to instance-1 using IAP TCP forwarding. What is the most likely reason?

Accepted Answer

The instance does not have the 'ssh-iap' tag that the firewall rule applies to.. The exhibit shows a firewall rule that allows IAP TCP forwarding traffic from the IAP source range (35.235.240.0/20) to instances with the network tag 'ssh-iap'. Since instance-1 lacks this tag, the firewall rule does not apply, and SSH traffic from IAP is blocked. Without the tag, the instance's firewall policy drops the forwarded TCP connections, preventing SSH access.

Answer

IAP TCP forwarding is not enabled for the project.

Answer

The instance's service account does not have the necessary IAP permissions.

Answer

SSH keys are not configured on the instance.

Question 6

Refer to the exhibit. An engineer is troubleshooting a dual-tunnel HA VPN. The BGP session on one interface is established (State/PfxRcd 1) but the other is stuck in Active state. What can cause this?

Accepted Answer

The on-premises router does not have a BGP configuration for the second peer IP address (169.254.x.x).. In a dual-tunnel HA VPN, each tunnel uses a separate BGP session with its own peer IP address (typically from the 169.254.x.x link-local range). If the on-premises router only has a BGP neighbor statement for the first peer IP, it will ignore incoming BGP packets from the second peer. The Cloud Router sees the session stuck in Active state because it is sending BGP OPEN messages but never receiving a response, as the on-premises router is not listening on that IP.

Answer

The Cloud Router is using the same BGP identifier for both sessions, causing a conflict.

Answer

The on-premises router is configured with BGP MD5 authentication that only matches the first peer.

Answer

The MTU on the second tunnel is not matching between the two ends.

Question 7

A network engineer is setting up a Dedicated Interconnect with a 10 Gbps circuit. They need to achieve 99.99% availability SLA. Which of the following configurations meets the SLA requirements?

Accepted Answer

Two 10 Gbps circuits in different metro areas. Google Cloud's 99.99% SLA for Dedicated Interconnect requires two or more connections in different metro areas, so this configuration is the only one that meets the requirement. Metro diversity ensures that a single metro-level failure cannot take down both circuits, which is the condition for the higher SLA tier.

Answer

One 10 Gbps circuit and one VPN as backup

Answer

Single 10 Gbps circuit in one metro area

Answer

Two 10 Gbps circuits in the same metro area

Question 8

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Accepted Answer

Service projects. Shared VPC (E) is the correct architecture because it lets a host project centrally own and administer the VPC network while attaching multiple service projects to it, satisfying the centralized network administration requirement. The host project (B) is the project that owns the Shared VPC network and its subnets, and it is where network administrators manage the shared resources. Service projects (A) are the projects that are attached to the host project's Shared VPC, allowing each project to deploy resources into shared subnets and apply its own firewall rules, which meets the multiple-projects and per-project firewall requirements. Cloud VPN (C) is only a connectivity mechanism for encrypted tunnels to a VPC and does not provide multi-project network sharing or centralized administration. VPC peering (D) connects separate VPC networks but does not centralize network administration or give each project its own firewall rules within a single shared network.

Answer

Cloud VPN

Answer

VPC peering

Question 9

A company wants to deploy a network appliance (e.g., firewall) on a Compute Engine instance that requires inspecting traffic between two VPCs. The instance must have interfaces in both VPCs. Which three configurations are required? (Choose three.)

Accepted Answer

Attach at least two network interfaces (NIC0 and NIC1). Option B is correct because a Compute Engine instance can only inspect traffic between two VPCs if it has a network interface in each VPC, so you must attach at least two NICs (NIC0 and NIC1), each placed in a different VPC network. Option D is correct because, after the appliance has interfaces in both VPCs, each VPC needs static routes whose next hop is the appliance's interface IP in that VPC, so traffic destined for the other VPC is directed through the firewall instance. Option E is correct because IP forwarding must be enabled on the instance (for example, via `gcloud compute instances create --can-ip-forward` or by setting `canIpForward` to true) so the VM can forward packets that are not addressed to its own interfaces, which is essential for a routing appliance. Option A is not required because external IPs are only needed for internet reachability, not for inter-VPC inspection, and interfaces can communicate internally without them. Option C is incorrect because the two interfaces must be in different VPC networks (and therefore different subnets), since using the same subnet would not bridge two separate VPCs.

Answer

Assign an external IP to each interface

Answer

Use the same subnet for both interfaces

Question 10

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

Accepted Answer

Configure Cloud NAT with a static NAT IP address and ensure all traffic uses that IP.. Cloud NAT with a static NAT IP address ensures that all outbound traffic from private instances uses a consistent, predictable source IP. This satisfies the external API's requirement for a static source IP without needing to assign public IPs directly to instances. Option C correctly configures Cloud NAT to use a static IP, which is the intended solution for this scenario.

Answer

Use Private Google Access instead of Cloud NAT.

Answer

Assign a static external IP to the instances and use Cloud NAT with static IPs.

Answer

Use a VPN tunnel to the API provider's network.

Question 11

An organization is deploying a Shared VPC with one host project and three service projects. Each service project has multiple VPC networks. They want to ensure that only the host project's network admin can create firewall rules affecting the shared VPC network. Which architecture satisfies this requirement?

Accepted Answer

Create the shared VPC network in the host project and grant the network admin IAM role only to host project users.. In a Shared VPC architecture, the host project owns the shared VPC network, and only IAM roles granted in the host project can manage that network's resources. By creating the shared VPC network in the host project and granting the network admin IAM role exclusively to host project users, you ensure that only those users can create firewall rules for the shared VPC. Service project users cannot modify the shared network's firewall rules because they lack the necessary IAM permissions on the host project.

Answer

Use VPC Network Peering between each service project and the host project, and allow each service project admin to manage their own firewall rules.

Answer

Assign the network admin role to users in each service project for the shared VPC network.

Answer

Create separate VPC networks in each service project and use VPC Network Peering to interconnect them.

Question 12

Which THREE components are required to set up Identity-Aware Proxy (IAP) for TCP forwarding to a VM?

Accepted Answer

A firewall rule that allows ingress from 35.235.240.0/20 to the VM on the desired port.. Option A is correct because IAP TCP forwarding traffic originates from Google's dedicated range 35.235.240.0/20, so an ingress firewall rule allowing that source range to reach the target VM on the desired port (e.g., 22 for SSH, 3389 for RDP) is mandatory for the tunnel to work. Option B is correct because the user or group establishing the tunnel must be granted the IAP-secured Tunnel User role (roles/iap.tunnelResourceAccessor) on the project, which authorizes them to use IAP TCP forwarding. Option D is correct because the Identity-Aware Proxy API (iap.googleapis.com) must be enabled in the project before IAP TCP forwarding can be configured or used. Option C is not required: IAP TCP forwarding is specifically designed to reach VMs that have only internal IP addresses, so an external IP is unnecessary (and even discouraged). Option E is not required: a NAT gateway is unrelated to IAP tunneling, since IAP traffic is inbound to the VM from Google's proxy range rather than outbound from the VM.

Answer

The VM must have an external IP address.

Answer

A NAT gateway configured for the VPC.

Question 13

An organization is deploying a Global HTTPS Load Balancer with Cloud Armor and Cloud CDN. They want to ensure that only requests with a valid signed cookie can access private content. Which three steps are required? (Choose THREE.)

Accepted Answer

Create the signed cookie using the key and set it in the client.. Option B is correct because Cloud CDN signed cookies must be generated on the origin/application side using the same signing key configured in Cloud CDN, then delivered to the client so the client can present the cookie on subsequent requests. Option C is correct because signed URLs and signed cookies are a Cloud CDN feature, so Cloud CDN must be enabled on the backend bucket or backend service for the load balancer to enforce signed request validation. Option D is correct because Cloud CDN requires a signed request key (created and attached to the backend bucket or service) that is used to compute and validate the HMAC signature in the signed cookie. Option A is not required because Cloud Armor does not validate Cloud CDN signed cookies; it enforces WAF/security policies such as IP allowlists, rate limiting, and preconfigured rules. Option E is not required because Cache-Control: private affects caching behavior but does not implement signed-cookie authentication for private content.

Answer

Configure a Cloud Armor security policy to validate the cookie.

Answer

Set a Cache-Control header to private.

Question 14

Match each Google Cloud networking service to its primary function.

Accepted Answer

Cloud Load Balancing: Distributes incoming traffic across multiple instances. Correct matches: Cloud Load Balancing distributes traffic, Cloud CDN caches content, Cloud DNS resolves domain names. Common confusions: Cloud NAT is for internet access without external IPs, Virtual Private Cloud provides isolated networks, and Cloud Interconnect connects on-premises to Google Cloud.

Answer

Cloud NAT: Caches content at edge locations

Answer

Virtual Private Cloud: Provides dedicated connection between on-premises and VPC

Answer

Cloud Interconnect: Translates domain names to IP addresses

Question 15

A company uses Cloud NAT for outbound internet access from private instances. They want to monitor for connection failures due to NAT resource exhaustion. Which two steps should they take? (Choose two.)

Accepted Answer

Enable Cloud NAT logging. Enable Cloud NAT logging to capture connection and allocation failures. Set up alerts on NAT logs to detect failures. VPC Flow Logs do not capture NAT-specific failures. Firewall Insights are for firewall rules. Packet Mirroring is not relevant.

Answer

Enable VPC Flow Logs on the subnet

Answer

Use Packet Mirroring to capture NAT traffic

Answer

Use Firewall Insights to check for blocked traffic