PCNE Practice Test 20 — 15 Questions

Question 1

Which THREE statements about Shared VPC are correct?

Accepted Answer

The Shared VPC admin role can be assigned to manage the host VPC network.. Option A is correct because the Shared VPC Admin role (roles/compute.xpnAdmin) is the IAM role granted at the organization or host project level that allows a principal to enable Shared VPC, designate host projects, and manage the host VPC network configuration. Option B is correct because the core purpose of Shared VPC is to let service projects deploy resources (such as Compute Engine VMs) into subnetworks that are defined and centrally managed in the host project's VPC network. Option C is correct because Shared VPC requires that the host project and all attached service projects belong to the same Google Cloud organization; cross-organization attachment is not supported. Option D is not correct because subnet administration, including creating and deleting subnets, is performed by the Shared VPC Admin in the host project, not by service projects, which only consume the shared subnets. Option E is not correct because service projects do not create their own VPCs to peer with the host VPC; instead they attach to the host project's VPC and use its subnetworks directly.

Answer

Service projects can delete subnets in the host VPC.

Answer

Service projects can create their own VPCs that peer with the host VPC.

Question 2

A network engineer is configuring an HA VPN tunnel pair between an on-premises VPN device and Google Cloud. The engineer wants to use IKEv2 with pre-shared keys. After configuring both ends, the tunnels do not come up. The engineer sees 'IKE SA negotiation failed - no proposal chosen' in the logs. What is the most likely cause?

Accepted Answer

The encryption algorithm (e.g., AES256) or DH group (e.g., 14) does not match between the two ends.. This error typically indicates a mismatch in IKE proposal parameters such as encryption algorithm, integrity algorithm, DH group, or SA lifetime.

Answer

The on-premises device is behind NAT and the VPN gateway does not support NAT traversal.

Answer

The IKE version on the on-premises device is set to IKEv1 while Cloud VPN expects IKEv2.

Answer

The pre-shared keys on both ends are different.

Question 3

A network engineer wants to test reachability between a Compute Engine instance in VPC A and a Cloud SQL instance in VPC B, which are connected via VPC peering. Which Google Cloud tool should be used to check if firewall rules or routes are blocking traffic?

Accepted Answer

Connectivity Tests. Connectivity Tests in Google Cloud allows you to run a diagnostic test between a source and destination endpoint to verify reachability and identify misconfigured firewall rules or routes. It simulates the packet's path and provides detailed information about which firewall rules or routes are blocking traffic, making it ideal for troubleshooting VPC peering scenarios.

Answer

Packet Mirroring

Answer

VPC Flow Logs

Answer

Firewall Insights

Question 4

A gaming company uses Cloud Armor with an external HTTP(S) load balancer to protect against DDoS attacks. They need to restrict access to the load balancer based on geographic region. What should they configure?

Accepted Answer

Geo-match custom rule in Cloud Armor. Cloud Armor supports geo-match custom rules that allow you to allow or deny traffic based on the geographic region of the client IP address. When attached to an external HTTP(S) load balancer, these rules are evaluated at the edge before traffic reaches the backend, providing effective geo-based access control against DDoS attacks.

Answer

Geo-based routing policy on the backend service

Answer

A firewall rule that blocks IPs from certain countries

Answer

Use Cloud CDN with geo filtering

Question 5

An organization has a Dedicated Interconnect with Cloud Router configured for BGP. The on-premises network advertises a prefix that overlaps with an existing VPC subnet. How does Google Cloud handle the overlapping prefix?

Accepted Answer

It rejects the prefix and does not install a dynamic route for it.. When a Dedicated Interconnect with Cloud Router receives a BGP advertisement for a prefix that overlaps with an existing VPC subnet, Google Cloud rejects the prefix and does not install a dynamic route for it. This is because VPC subnet routes always take precedence over dynamically learned routes, and accepting an overlapping prefix would create ambiguity in forwarding decisions. The Cloud Router enforces this behavior to maintain the integrity of the VPC's internal addressing.

Answer

It accepts the prefix but static routes have higher priority.

Answer

It accepts the prefix and gives it higher priority than the VPC subnet.

Answer

It accepts the prefix and load balances traffic between the two locations.

Question 6

An organization has a Dedicated Interconnect with one VLAN attachment. They want to add a second VLAN attachment on the same interconnect circuit for additional capacity. What is the correct approach?

Accepted Answer

Create a second VLAN attachment with a different VLAN ID. A single Dedicated Interconnect circuit supports multiple VLAN attachments, each identified by a unique VLAN ID (802.1Q tag). To add capacity, you create a second VLAN attachment on the same circuit with a different VLAN ID, then associate it with a Cloud Router for BGP peering. No new physical cross-connect is required.

Answer

Order a second physical cross-connect

Answer

Upgrade the existing VLAN attachment to increase bandwidth

Answer

Create a new Cloud Router and associate it with the existing VLAN attachment

Question 7

A company wants to optimize costs for egress traffic from Compute Engine instances to the internet. They are considering using Cloud CDN and Private Google Access. Which TWO statements correctly describe how these services can reduce egress costs?

Accepted Answer

Cloud CDN reduces egress costs by serving cached content from edge locations closer to users.. Option A is correct because Cloud CDN caches content at Google's globally distributed edge points of presence, so subsequent requests for that content are served from the edge rather than from the origin Compute Engine instances, reducing the volume of egress billed at the higher internet egress rate. Option E is correct because Private Google Access lets VM instances with only internal IP addresses reach Google APIs and services (such as Cloud Storage) through Google's internal network, so traffic to those APIs does not traverse the public internet and avoids internet egress charges. Option B is not correct as a cost-reduction statement: Cloud CDN does require a global external Application Load Balancer (or the classic Application Load Balancer) as its front end, but that is an architectural requirement, not a mechanism for reducing egress costs. Option C is inaccurate because Private Google Access only routes traffic to Google APIs and services, not general internet traffic, so a NAT gateway (Cloud NAT) is still needed for VMs without external IPs to reach arbitrary internet destinations. Option D overstates the benefit: Cloud CDN reduces egress costs for cache hits, but cache misses, uncacheable content, and cache-fill traffic from the origin are still billed, so it does not eliminate all egress costs.

Answer

Cloud CDN requires a global load balancer to function.

Answer

Private Google Access eliminates the need for a NAT gateway.

Answer

Cloud CDN eliminates all egress costs for cached content.

Question 8

An organization needs to monitor and analyze firewall rule activity for security auditing. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Enable firewall rules logging for the rules to monitor.. Option C is correct because firewall rules logging must be explicitly enabled on each firewall rule (via the --enable-logging flag or the console) to record allow/deny events, connection details, and rule matches that security auditing requires. Option E is correct because exporting those firewall logs from Cloud Logging to BigQuery enables long-term retention, SQL-based analysis, and correlation of rule activity across the environment, which is essential for auditing. Option A is wrong because Cloud NAT logging records NAT translation events (address/port allocation), not firewall rule activity. Option B is wrong because VPC Flow Logs capture IP traffic metadata at the subnet level, not which firewall rule allowed or denied a connection. Option D is wrong because Packet Mirroring copies packet payloads for deep inspection/IDS, not firewall rule activity logs, and it is far more expensive and operationally heavy than needed for auditing rule usage.

Answer

Enable Cloud NAT logging.

Answer

Enable VPC Flow Logs on all subnets.

Answer

Use Packet Mirroring to capture all traffic.

Question 9

A company is designing a global web application that must serve users worldwide with low latency. They plan to use a Global HTTPS Load Balancer with Cloud CDN. Which TWO features should they enable to further reduce latency for users connecting from various regions? (Choose two.)

Accepted Answer

Anycast IP address. Option A (Anycast IP address) is correct because a Global HTTPS Load Balancer uses a single global anycast IP that advertises the same address from Google's edge PoPs worldwide, so each user's packets are routed via BGP to the nearest edge location, minimizing network distance and latency. Option D (Cloud CDN with CDN Interconnect) is correct because Cloud CDN caches content at Google's edge caches close to users, and CDN Interconnect provides direct, high-performance peering links between third-party CDN/ISP networks and Google's edge, reducing hops and improving cache-fill and delivery latency across regions. Option B (reserve a static IP address) is not correct because a static IP only provides address persistence, not any latency reduction. Option C (Enable IAP for backend services) is not correct because Identity-Aware Proxy is an access-control mechanism for securing applications, unrelated to performance. Option E (Cloud Armor with rate limiting) is not correct because Cloud Armor provides WAF/DDoS protection and rate limiting for security, not latency optimization.

Answer

Reserve a static IP address

Answer

Enable IAP for backend services

Answer

Cloud Armor with rate limiting

Question 10

Match each Cloud DNS record type to its use.

Accepted Answer

A: Maps a domain name to an IPv4 address.. Common DNS record types in Cloud DNS include A, AAAA, CNAME, and MX for IP mapping, aliasing, and email routing. Distractors swap definitions between record types.

Answer

A: Maps a domain name to an IPv6 address.

Answer

CNAME: Specifies mail exchange servers for a domain.

Question 11

A company wants to establish a VPC peering connection between two VPCs in different projects. Which two steps are mandatory to create the peering connection?

Accepted Answer

Ensure the VPCs have non-overlapping subnet IP address ranges.. VPC peering relies on private IP routing between the two VPCs. If the IP address ranges overlap, the VPC route tables cannot distinguish which VPC a packet belongs to, causing routing conflicts and preventing the peering connection from being established. Google Cloud requires that the VPCs have non-overlapping subnet CIDR blocks for successful peering.

Answer

Assign a public IP to the VMs in both VPCs.

Answer

Create a firewall rule allowing all traffic between the VPCs.

Answer

Configure a Cloud Router with BGP sessions.

Question 12

A company uses Cloud DNS. They want to override DNS resolution for a specific domain (e.g., mycompany.com) to point to an internal IP for all queries originating from their VPC, while leaving all other domains unaffected. Which Cloud DNS feature should they use?

Accepted Answer

A response policy zone (RPZ). A Cloud DNS response policy zone (RPZ) lets you override or block DNS answers for specific names within a VPC. By creating an RPZ for mycompany.com and attaching it to the VPC, queries from that VPC resolve mycompany.com to the internal IP while all other domains resolve normally through standard DNS. This is the documented GCP mechanism for per-VPC DNS overrides.

Answer

DNSSEC

Answer

A routing policy with a geo location rule

Answer

A managed private zone

Question 13

A company has a VPC with a firewall rule that allows SSH (tcp:22) from 0.0.0.0/0. They want to restrict SSH access to only the public IP address of their Cloud VPN gateway. How should they modify the firewall rule?

Accepted Answer

Change the source IP range to the VPN gateway's public IP address.. The firewall rule currently allows SSH from any source IP (0.0.0.0/0). To restrict access to only the Cloud VPN gateway, you must change the source IP range to the gateway's public IP address, because the SSH connection originates from the VPN gateway's public-facing interface over the internet. Internal IP addresses are not routable over the internet and would not match the source of the incoming SSH traffic.

Answer

Use Cloud Armor to block all SSH except from the VPN IP.

Answer

Change the source IP range to the VPN gateway's internal IP address.

Answer

Use IAP Tunneling instead of SSH firewall rules.

Question 14

A company is planning a hybrid connectivity setup using HA VPN. They want to ensure high availability by using two Cloud VPN gateways. How many tunnels and external IP addresses are required for the HA VPN to achieve 99.99% SLA?

Accepted Answer

2 external IPs, 4 tunnels. HA VPN uses two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP to provide a 99.99% SLA.

Answer

4 external IPs, 4 tunnels

Answer

2 external IPs, 2 tunnels

Answer

1 external IP, 2 tunnels

Question 15

An engineer needs to configure DNS resolution for a Compute Engine instance named "web-1" in zone us-central1-a of project my-project. What is the internal DNS name for this instance?

Accepted Answer

web-1.us-central1-a.c.my-project.internal. GCP internal DNS uses the format: [instance name].[zone].c.[project id].internal

Answer

web-1.us-central1.c.my-project.internal

Answer

web-1.c.my-project.us-central1-a.internal

Answer

web-1.us-central1-a.my-project.internal