PCNE Practice Test 19 — 15 Questions

Question 1

A company uses Shared VPC with multiple service projects. They need to allow certain service projects to create internal load balancers (ILBs) that are accessible from all projects in the organization. What is the best practice?

Accepted Answer

Create the ILB in the host project and share the backend. In a Shared VPC architecture, the host project owns the VPC network and its resources, including internal load balancers (ILBs). By creating the ILB in the host project and sharing its backend (e.g., instance groups from service projects), the ILB becomes accessible from all projects in the organization without additional connectivity. This approach centralizes network control and ensures the ILB's IP address is routable within the shared VPC, meeting the requirement for cross-project access.

Answer

Deploy ILB in each service project and use global access

Answer

Use Cloud NAT for outbound connectivity

Answer

Use VPC peering between each service project and the host project

Answer

Enable Private Service Connect

Question 2

A network engineer is designing a VPC with custom subnet mode. They need to allocate IP addresses for three tiers: web (100 instances), app (200 instances), and db (50 instances). The VPC will be in the us-central1 region. Which subnet plan is most cost-effective and scalable?

Accepted Answer

Create three subnets: 10.0.1.0/24 (web), 10.0.2.0/23 (app), 10.0.4.0/26 (db). Option D is correct because it allocates IP addresses efficiently for each tier: a /24 (256 IPs) for web (100 instances), a /23 (512 IPs) for app (200 instances), and a /26 (64 IPs) for db (50 instances). This minimizes wasted IP space while providing room for growth, and using separate subnets per tier allows granular firewall rules and routing. In a custom VPC, this design is both cost-effective (no over-provisioning) and scalable (each tier can expand within its subnet).

Answer

Use one subnet per zone: us-central1-a: 10.0.0.0/22, us-central1-b: 10.0.4.0/22, us-central1-c: 10.0.8.0/22

Answer

Create two subnets: 10.0.1.0/24 (web+app) and 10.0.3.0/24 (db)

Answer

Create one subnet 10.0.0.0/20 and use network tags to isolate tiers via firewall rules

Question 3

A company needs a dedicated, low-latency connection from their on-premises data center to GCP with a 10 Gbps capacity. They require the highest availability and service level agreement (SLA). Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect with two connections to different meet-me rooms.. Dedicated Interconnect provides a direct, private connection between the on-premises data center and GCP with 10 Gbps capacity. By using two connections to different meet-me rooms, the company achieves the highest availability and meets the 99.99% SLA, as this eliminates single points of failure at the physical layer and within a single facility.

Answer

Carrier Peering using Equinix or other carrier.

Answer

Partner Interconnect with two VLAN attachments from different providers.

Answer

Cloud VPN with two tunnels from different VPN gateways.

Question 4

Refer to the exhibit. A network engineer checks the BGP status of a Cloud Router. The on-prem router has two BGP peers configured. What is the most likely cause of the IDLE session for the second peer?

Accepted Answer

The peer router's firewall is blocking TCP port 179. The IDLE state in BGP indicates that the session has not been established or has been reset. Since the on-prem router has two BGP peers and only one is IDLE, a per-peer issue like a firewall blocking TCP port 179 on the second peer's router is the most likely cause. This prevents the TCP three-way handshake required for BGP session establishment, leaving the session stuck in IDLE.

Answer

The VLAN attachment is not configured

Answer

The BGP timers are misconfigured

Answer

The peer router is not configured with the correct BGP ASN

Question 5

A company is designing a VPC for a multi-tier application. The web tier must be accessible from the internet, the app tier only from the web tier, and the db tier only from the app tier. Which combination of firewall rules is appropriate?

Accepted Answer

Ingress allow from 0.0.0.0/0 to web, ingress allow from web subnets to app, ingress allow from app subnets to db. Option B is correct because it follows the principle of least privilege for a multi-tier VPC. The web tier must be accessible from the internet (0.0.0.0/0) on ingress, the app tier must only accept ingress from the web tier subnets, and the db tier must only accept ingress from the app tier subnets. This ensures that each tier is isolated and only reachable from the immediate upstream tier, which is a fundamental security best practice for multi-tier architectures in Google Cloud.

Answer

Ingress allow from web to app, ingress allow from app to db, no rule for web

Answer

Ingress allow from 0.0.0.0/0 to web, ingress allow from all subnets to app, ingress allow from app to db

Answer

Ingress allow from web to app, ingress allow from web to db, ingress allow from app to db

Question 6

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

Accepted Answer

Cloud NAT on the subnet or VPC. Cloud NAT (Network Address Translation) allows private Compute Engine instances to initiate outbound connections to the internet without assigning them public IP addresses. It translates the instance's private IP to a Cloud NAT external IP address for outbound traffic, while unsolicited inbound connections from the internet are blocked. This is the correct solution because the requirement explicitly states no public IP on the instance, yet outbound internet access is needed.

Answer

Configure a private Google access for the subnet

Answer

Assign a static external IP address to the instance

Answer

Set up an internal HTTP(S) load balancer

Question 7

Which TWO statements are true about VPC Network Peering?

Accepted Answer

Each VPC can have up to 25 peerings by default. Option A is correct because the default limit for VPC Network Peering per VPC is 25, as documented in Google Cloud's quotas and limits. This is a soft limit that can be increased by requesting a quota adjustment, but by default, each VPC can have up to 25 peerings. Option B is correct because VPC Network Peering allows direct communication between VPCs using RFC 1918 private IP addresses without requiring VPN tunnels or Cloud Interconnect, as the peering connection uses Google's internal network infrastructure.

Answer

Firewall rules in one VPC are automatically applied to the peered VPC

Answer

VPC peering incurs additional cost beyond standard egress charges

Answer

Custom static routes are automatically exchanged between peered VPCs

Question 8

A company uses Shared VPC. They want to restrict which service project's VMs can use a specific subnet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Use IAM roles on the subnet resource to grant 'compute.subnetUser' to specific service projects.. Option B is correct because IAM roles on a subnet resource allow you to grant the `compute.subnetUser` role to specific service projects, which controls which projects can create VM instances in that subnet. This is a direct method to restrict subnet usage within a Shared VPC environment, as the role grants permission to use the subnet without granting broader network access.

Answer

Use VPC network peering.

Answer

Use firewall rules to deny traffic from other service projects.

Answer

Use network tags on VMs and associate the subnet with those tags.

Question 9

A company has a complex on-premises network with multiple BGP AS numbers. They are connecting to GCP using Cloud VPN and wish to advertise specific prefixes. They want to ensure that only selected on-prem prefixes are advertised to GCP and no other prefixes leak. What is the best approach?

Accepted Answer

Configure Cloud Router with custom advertised route maps to filter prefixes. Cloud Router with custom advertised route maps allows you to explicitly define which on-premises prefixes are advertised to GCP via Cloud VPN. This ensures only the selected prefixes are propagated, preventing route leaks. Unlike relying on GCP's import policy, this approach gives you direct control over outbound advertisements from your on-premises network.

Answer

Use route advertisements from on-prem routers and rely on GCP's route import policy

Answer

Use VPC firewall rules to restrict incoming traffic

Answer

Set up a separate Cloud Router for each prefix

Question 10

Which THREE actions are required to configure a High-Availability Cloud VPN (HA VPN) with dynamic routing to an on-premises peer?

Accepted Answer

Create two VPN tunnels, each associated with a different Cloud VPN gateway interface. Option A is correct because HA VPN requires two tunnels, each attached to a different interface of the Cloud VPN gateway, to provide redundancy and failover. This ensures that if one tunnel or interface fails, traffic can continue through the other tunnel, maintaining connectivity to the on-premises peer.

Answer

Create two separate Cloud Routers, one for each tunnel

Answer

Configure static routes for the remote network in the VPC

Question 11

Which TWO of the following are advantages of using the Premium Tier of Google Cloud's Network Service Tiers? (Choose TWO.)

Accepted Answer

Global load balancing with a single anycast IP address.. Options B and D are correct. Premium Tier offers lower latency by leveraging Google's global network. Option A is wrong because Premium Tier costs more. Option C is wrong because Premium Tier allows global load balancing with anycast IP. Option E is wrong because Premium Tier supports both global and regional load balancers, but the advantage is global.

Answer

Reduced cost compared to Standard Tier.

Answer

Supports regional load balancers only.

Answer

Public IP addresses are assigned from a regional pool.

Question 12

A startup wants to minimize costs for their development VPC. They have a few VMs that need occasional internet access for updates. What is the most cost-effective approach?

Accepted Answer

Use Cloud NAT with a static IP. Cloud NAT with a static IP is the most cost-effective approach because it allows multiple VMs to share a single static IP address for outbound internet access, eliminating the need for individual external IPs. This reduces costs since external IP addresses incur charges, and Cloud NAT provides managed, scalable outbound connectivity without requiring a VPN or dedicated gateway.

Answer

Use Private Google Access

Answer

Use a VPN to an on-prem network for internet

Answer

Assign external IPs to each VM

Question 13

A company needs to ensure that all traffic between GCP VMs in different regions is encrypted in transit. What is the recommended approach?

Accepted Answer

By default, traffic between GCP VMs is encrypted. Google Cloud encrypts all traffic between VMs at the hypervisor level, regardless of region, using application-layer encryption (e.g., TLS) and network-layer encryption (e.g., IPSec) by default. This encryption is transparent, always-on, and does not require any configuration, making option B the correct answer. The encryption covers all VM-to-VM traffic within the same VPC or across VPCs, including inter-region communication.

Answer

Use VPC peering with encryption enabled

Answer

Use Cloud VPN between the two regions

Answer

Enable IPsec on the VPC

Question 14

An enterprise uses Shared VPC with a host project and multiple service projects. A service project team wants to create a Cloud VPN tunnel to their on-premises network. What must the network team configure in the host project to allow this?

Accepted Answer

The VPN gateway and Cloud Router must be created in the host project's VPC, and the service project must be granted compute.networkUser role on the host project. In a Shared VPC setup, the VPN gateway and Cloud Router must reside in the host project's VPC because the host project owns the underlying network infrastructure. The service project can then use the VPN tunnel by being granted the `compute.networkUser` role on the host project, which allows it to create forwarding rules and use the VPN resources. This ensures that the VPN termination point is within the shared VPC network, enabling connectivity to on-premises networks.

Answer

The service project can create the VPN gateway directly in its own project as long as it uses a VPC that is peered with the host project

Answer

The service project cannot use Cloud VPN with Shared VPC; they must use Dedicated Interconnect instead

Answer

A Cloud Router must be created in the service project, and the VPN gateway in the host project

Question 15

A large multinational corporation uses a Shared VPC in Google Cloud with multiple service projects. They have a central Cloud NAT configured in the host project in the us-central1 region to provide internet egress for all VMs. Recently, the IT team added a new subnet (10.0.10.0/24) in a service project and deployed VMs there. All other VMs in the same project but in different subnets (e.g., 10.0.1.0/24) can reach the internet, but the new VMs in 10.0.10.0/24 cannot. The Cloud NAT gateway is configured in us-central1 with all IP ranges allowed. The VPC firewall rules allow egress traffic to the internet. The team verified that the VMs have a default route (0.0.0.0/0) with next-hop 'default-internet-gateway' and that the Cloud NAT router's NAT IPs are properly assigned. However, the new subnet's VMs are unable to connect to any external IP. The network engineer suspects that the Cloud NAT's NAT reservations might be the issue, but all NAT IPs are ephemeral. Further investigation shows that the Cloud Router used by Cloud NAT is advertising custom IP ranges via BGP to an on-premises router for a different use case. What is the most likely cause and solution?

Accepted Answer

Remove the new subnet range (10.0.10.0/24) from the custom advertised routes on the Cloud Router associated with the Cloud NAT.. The Cloud Router associated with Cloud NAT is advertising custom IP ranges via BGP to an on-premises router. If the new subnet range (10.0.10.0/24) is included in those custom advertised routes, the on-premises router may advertise a more specific route back to the VPC, causing the VMs in that subnet to prefer the on-premises route over the default route (0.0.0.0/0) for internet-bound traffic. Since the on-premises router does not have internet access, the traffic is blackholed. Removing the subnet range from the custom advertised routes on the Cloud Router resolves the issue by ensuring the default route remains the preferred path for internet egress.

Answer

Add a static route for 0.0.0.0/0 with next-hop set to the Cloud NAT gateway's IP address in the VPC.

Answer

Update the VPC firewall rules to explicitly allow egress traffic from the new subnet's IP range to 0.0.0.0/0.

Answer

Reserve static NAT IPs for the new subnet in the Cloud NAT configuration to ensure that the VMs have a consistent egress IP.