PCNE Practice Exam 2 — 20 Questions

Question 1

A startup needs to connect its on-premises office network to a Google Cloud VPC. They require a cost-effective solution with minimal setup and can tolerate up to 3 Gbps throughput per tunnel. They also need dynamic routing. What should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud VPN with HA VPN and Cloud Router. HA VPN with Cloud Router provides dynamic routing via BGP and supports up to 3 Gbps per tunnel. It is cost-effective, requires minimal setup compared to Interconnect options, and meets the need for a reliable, dynamically routed connection from an on-premises network to a VPC.

Answer

Cloud VPN with Classic VPN and static routing

Answer

Partner Interconnect with a 1 Gbps circuit

Answer

Dedicated Interconnect with a 10 Gbps circuit

Question 2

A retail company is deploying a new application that must be accessible globally with a single anycast IP address. The application runs on managed instance groups in three regions: us-central1, europe-west1, and asia-east1. The company wants to minimize latency for users and ensure automatic failover if a region becomes unavailable. They also need to terminate SSL certificates at the Google edge. Which load balancing solution should they use?

Accepted Answer

Global external HTTP(S) load balancer with a global anycast IP address and Google-managed SSL certificates.. A global external HTTP(S) load balancer is the correct choice because it provides a single anycast IP, global load balancing, Google-managed SSL certificates, and automatic failover across regions. It is designed for HTTP(S) workloads that require low latency and high availability. The other options either lack anycast, are regional, or do not support external HTTP(S) traffic with SSL termination.

Answer

Internal HTTP(S) load balancer with a global anycast IP address and Google-managed SSL certificates.

Answer

Regional external HTTP(S) load balancer in each region with separate IP addresses and self-managed SSL certificates.

Answer

Global external TCP proxy load balancer with a global anycast IP address and Google-managed SSL certificates.

Question 3

A company has a VPC with multiple subnets and uses Cloud VPN tunnels to connect to on-premises. They want to ensure that only traffic destined for on-premises is sent through the VPN tunnels; all other traffic should use the internet. Which route configuration should they implement?

Accepted Answer

Use Cloud Router with BGP to exchange specific routes with on-premises, and keep the default internet route for other traffic.. Using Cloud Router with BGP allows the VPC to dynamically learn specific routes from the on-premises network via the VPN tunnels. The default route (0.0.0.0/0) remains pointing to the internet gateway, so only traffic destined for the learned on-premises prefixes is sent through the VPN, while all other traffic uses the internet. This provides precise control without overriding the default route.

Answer

Add a static route for 0.0.0.0/0 with next hop VPN gateway, and set a lower priority than the internet default route.

Answer

Configure the Cloud VPN to advertise a default route to on-premises, and rely on local preference.

Answer

Use VPC Network Peering with the on-premises network and configure custom route exchange.

Question 4

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

Accepted Answer

Pre-configured WAF rules. Pre-configured WAF rules in Cloud Armor include a SQL injection (SQLi) rule that inspects HTTP(S) request bodies, headers, and URIs for SQL injection patterns. This rule uses a set of signatures to detect and block malicious SQL queries, directly addressing the requirement to protect against SQL injection attacks on an external HTTP(S) load balancer.

Answer

IP allowlist/denylist

Answer

Named IP address lists

Answer

Rate limiting

Question 5

A startup is setting up a new GCP project and needs to create a VPC that will have predictable IP ranges for future peering with other VPCs. They do not anticipate needing to grow the network beyond the initial IP range. Which VPC type should they choose?

Accepted Answer

Custom mode VPC. Custom mode VPCs allow you to define your own subnets with specific IP ranges. Auto mode VPCs automatically create subnets in every region, which can cause IP overlap when peering. For controlled, predictable IP ranges, custom mode is appropriate.

Answer

Auto mode VPC

Answer

Shared VPC

Answer

Legacy network

Question 6

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. Option A is correct because Network Connectivity Center uses a hub-and-spoke model in which the hub dynamically exchanges and propagates routes between all attached spokes, so VPC spokes and hybrid spokes learn each other's reachable prefixes without manual route configuration. Option E is correct because NCC spokes can be VPC networks from different Google Cloud projects, allowing cross-project connectivity through a single hub as long as the appropriate IAM permissions and spoke attachments are configured. Option B is incorrect because NCC is a hub-and-spoke transit solution, not a direct VPC-to-VPC peering mechanism; VPC peering is a separate feature that does not involve an NCC hub. Option C is incorrect because NCC hybrid spokes can use HA VPN, Cloud Interconnect (Dedicated or Partner), and other supported connectivity methods, not only Dedicated Interconnect. Option D is incorrect because NCC spokes can be in different regions; the hub-and-spoke topology is global and does not require all spokes to share a region.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.

Question 7

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the return route via BGP, causing asymmetric routing.. The symptom — traffic reaches on-premises but return traffic is dropped — is the classic signature of asymmetric routing. If the on-premises router doesn't advertise the 10.0.0.0/… prefix back through BGP over the Cloud VPN, it has no route for the return path and either drops the packet or sends it out a different interface. The Cloud VPN tunnel itself is up (traffic is flowing one way), so the issue is route propagation, not tunnel state.

Answer

The Cloud VPN tunnel is down.

Answer

The MTU is set to 1500 on the VPN tunnel.

Answer

The instance's firewall is blocking ICMP.

Question 8

Match each network troubleshooting command/tool to its function.

Accepted Answer

ping: Tests reachability of a host and measures round-trip time. Common network troubleshooting tools: ping tests connectivity, traceroute maps the route, nslookup resolves DNS, netstat shows connections. The distractors swap ping and traceroute functions.

Answer

ping: Displays network connections and routing tables

Answer

traceroute: Tests reachability and measures round-trip time

Question 9

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

Accepted Answer

DNS peering. DNS peering in Cloud DNS allows a VPC network to resolve records from a managed zone in another project without transferring ownership of the zone. The consumer VPC creates a peering zone that points to the producer's managed zone, enabling cross-project name resolution while the producer retains full control of the zone. This is the intended feature for centralized DNS architectures where zone ownership must remain with the owning project.

Answer

DNS forwarding (inbound)

Answer

Managed zone with cross-project binding

Answer

Global DNS configuration

Question 10

A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?

Accepted Answer

IAM conditions on the bucket. VPC Service Controls can restrict access to Google APIs to only specified VPCs and projects, creating a service perimeter. IAM conditions can further restrict access based on the caller's service account. This combination ensures that only instances with the correct service account in the correct VPC can access the bucket.

Answer

Hierarchical firewall policy

Answer

Cloud Armor

Answer

Cloud NAT

Question 11

A financial services company has a Shared VPC setup where the host project contains a central VPC, and multiple service projects attach to it. The network team wants to monitor all VPC Flow Logs from the host project's subnets and analyze traffic patterns across all service projects. They need to aggregate logs in a central location for long-term analysis and querying with SQL. What should they do?

Accepted Answer

Enable VPC Flow Logs on each subnet in the host project, then create a log sink in the host project that exports to a BigQuery dataset in a centralized logging project.. In a Shared VPC, the host project owns the subnets, so VPC Flow Logs are generated there. To centralize these logs for SQL analysis, a log sink in the host project should export to a BigQuery dataset, which can reside in a separate logging project. This pattern aggregates all flow logs from the host project's subnets into one location, enabling cross-project traffic analysis and long-term retention with BigQuery's querying capabilities.

Answer

Enable VPC Flow Logs on each service project's subnets, then create a log sink in each service project that exports to a BigQuery dataset in the host project.

Answer

Enable VPC Flow Logs on the host project's subnets, then use Cloud Logging's log viewer to filter and analyze the logs, and schedule regular exports to Cloud Storage for long-term retention.

Answer

Use Cloud Monitoring's VPC Flow Logs dashboard to view traffic across all projects, and export the dashboard data to BigQuery using the Monitoring API.

Question 12

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

Accepted Answer

Configure Cloud Router in the host project to advertise all subnets via BGP.. In a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Answer

Configure Cloud NAT in each service project for on-prem access.

Answer

Use VPC peering between the host project and each service project.

Answer

Create separate Interconnect VLAN attachments for each service project.

Question 13

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to create service perimeters that restrict access to Google Cloud APIs and prevent data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

IAM Conditions

Question 14

A company wants to publish a custom internal service running in their VPC so that consumers in other VPCs can access it using private IP addresses. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows publishing internal services via private endpoints in your VPC and enabling consumption from other VPCs using private IPs.

Answer

Cloud Load Balancing

Answer

VPC Peering

Answer

Cloud VPN

Question 15

A startup is creating a new VPC for their production environment. They want to minimize management overhead and plan to use multiple regions. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region and manage IP ranges, reducing management overhead. Custom mode requires manual subnet creation.

Answer

Custom mode VPC

Answer

Shared VPC

Answer

VPC Network Peering

Question 16

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 17

An engineer needs to verify that a Compute Engine instance can reach a specific IP address on the internet, considering firewall rules and routes. Which Network Intelligence Center tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests allow you to test reachability between a source and a destination, checking firewall rules, routes, and VPC peering configurations.

Answer

Performance Dashboard

Answer

Firewall Insights

Answer

Network Topology

Question 18

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Answer

Cloud NAT logging

Question 19

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

Accepted Answer

Configure active-active BGP with multiple sessions using the same ASN.. The best practice for HA VPN is to use active-active BGP with multiple sessions, using the same ASN on all on-premises routers. This enables ECMP and ensures symmetric routing. Option B correctly describes this configuration.

Answer

Configure active-passive BGP with a single session.

Answer

Use policy-based routing to fail between tunnels.

Answer

Use static routes with a primary and backup route.

Question 20

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

Accepted Answer

Cloud NAT on the subnet or VPC. Cloud NAT (Network Address Translation) allows private Compute Engine instances to initiate outbound connections to the internet without assigning them public IP addresses. It translates the instance's private IP to a Cloud NAT external IP address for outbound traffic, while unsolicited inbound connections from the internet are blocked. This is the correct solution because the requirement explicitly states no public IP on the instance, yet outbound internet access is needed.

Answer

Configure a private Google access for the subnet

Answer

Assign a static external IP address to the instance

Answer

Set up an internal HTTP(S) load balancer