PCNE Practice Test 2 — 10 Questions

Question 1

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).. It uses a service account filter to allow traffic from the cloud-services service account, which is the identity used by Cloud Load Balancing to forward traffic to backend instances. This ensures that only traffic originating from the load balancer (including health check probes) is permitted, while also automatically covering the health check ranges (35.191.0.0/16, 130.211.0.0/22) without needing to hardcode IP ranges. This approach is more secure and scalable than IP-based rules, as it avoids the risk of IP range changes and provides identity-based access control.

Answer

Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.

Answer

Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.

Answer

Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.

Question 2

An organization wants to connect its on-premises data center to Google Cloud using Dedicated Interconnect. They require 99.99% availability SLA. Which configuration meets this requirement?

Accepted Answer

Two 10Gbps Dedicated Interconnect connections, each with its own VLAN attachment and BGP session, from the same provider. Dedicated Interconnect offers 99.99% SLA when you have two separate physical connections (each 10Gbps or 100Gbps) from the same provider, each with its own VLAN attachment and BGP session, and they are configured in a redundant manner.

Answer

A single 10Gbps Dedicated Interconnect connection with one VLAN attachment and one BGP session

Answer

A single 100Gbps Dedicated Interconnect connection with two VLAN attachments and two BGP sessions

Answer

Two Partner Interconnect connections with 99.9% SLA each

Question 3

A network engineer is designing a hybrid cloud architecture connecting an on-premises data center to Google Cloud via Dedicated Interconnect. The on-premises network uses BGP for dynamic routing. The engineer needs to configure Cloud Router to exchange routes with the on-premises router. Which two configuration steps are required? (Choose two.)

Accepted Answer

Enable the BGP session on the Cloud Router and configure the peer IP address and ASN.. Cloud Router uses BGP to dynamically exchange routes with the on-premises router over Dedicated Interconnect. Enabling the BGP session requires configuring the peer IP address (the on-premises router's interface IP) and the on-premises ASN, which allows the two routers to establish a BGP peering and exchange prefixes.

Answer

Configure a static route in Google Cloud VPC with the on-premises prefix.

Answer

Assign a primary and secondary IP range to the Cloud Router interface.

Answer

Configure the Cloud Router with the same ASN as the on-premises router.

Question 4

A team is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They need to set up BGP sessions. Which of the following is a required parameter when creating a BGP peer on the Cloud Router?

Accepted Answer

Peer ASN. The peer ASN is required to configure the BGP session; the Cloud Router ASN is set at the router level.

Answer

Route priority (MED)

Answer

VLAN ID

Answer

Peer IP address

Question 5

A developer wants to use Cloud CDN to cache static assets from an external origin (not a GCP bucket). Which backend type supports this?

Accepted Answer

Internet NEG. Internet NEG allows specifying an external FQDN as a backend, enabling Cloud CDN to cache content from external origins. Backend buckets are for GCS. Serverless NEG is for Cloud Run/Functions/App Engine. Zonal NEG is for GCP VMs/containers.

Answer

Backend bucket

Answer

Serverless NEG

Answer

Zonal NEG

Question 6

What is the maximum number of VLAN attachments that can be configured on a single 10 Gbps Dedicated Interconnect connection?

Accepted Answer

8. A single 10 Gbps Dedicated Interconnect connection supports a maximum of 8 VLAN attachments. This limit is defined by Google Cloud's interconnect architecture, where each VLAN attachment consumes a portion of the 10 Gbps bandwidth and is mapped to a unique VLAN ID. The 8-attachment cap ensures predictable performance and avoids oversubscription on the physical link.

Answer

16

Answer

4

Answer

2

Question 7

You are using Cloud CDN with a backend bucket and want to cache all responses regardless of Cache-Control headers. Which cache mode should you set?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL overrides origin Cache-Control headers and caches all responses. CACHE_ALL_STATIC attempts to cache static content but respects Cache-Control. USE_ORIGIN_HEADERS respects origin headers.

Answer

CACHE_ALL_STATIC

Answer

USE_ORIGIN_HEADERS

Answer

DISABLED

Question 8

A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?

Accepted Answer

Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'. It defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.

Answer

Ingress rule: allow tcp:3306, source IP range 10.0.0.0/8, target tags 'db'

Answer

Ingress rule: allow tcp:3306, source tags 'web', target service account 'db-sa'

Answer

Egress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'

Question 9

A developer needs to create a GKE cluster that uses a secondary IP range for pods and another for services. During VPC subnet creation, they set a primary IP range and two secondary ranges. Which flag must be used when creating the subnet to specify the pods range?

Accepted Answer

--secondary-range. When creating a subnet with secondary IP ranges, the '--secondary-range' flag is used to specify the name and range for pods (or services). The CLI command allows multiple secondary ranges.

Answer

--pods-range

Answer

--additional-ip-range

Answer

--auxiliary-range

Question 10

Match each VPC networking concept to its definition.

Accepted Answer

VPC: A global virtual network that spans all regions.. VPC is global, subnets are regional. Firewall rules filter traffic, routes determine paths. Common confusions: swapping global/regional or filtering/routing.

Answer

Subnet: A global resource used for IP address management.

Answer

Routes: A set of rules that control traffic based on source and destination.