PCNE Practice Exam 2 — 20 Questions

Question 1

An organization wants to migrate legacy on-premises applications to Google Cloud but must maintain low-latency connectivity for real-time data synchronization. The on-premises data center is in a colocation facility that is not directly served by Google Cloud. Which hybrid connectivity option is most cost-effective while meeting the latency requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Partner Interconnect. Partner Interconnect is the most cost-effective option because it provides a dedicated, low-latency connection through a supported service provider that can extend connectivity from the colocation facility to a Google Cloud region. Unlike Dedicated Interconnect, it does not require physical cross-connects in a Google Cloud colocation facility, making it ideal when the on-premises site is not directly served by Google Cloud. It meets the real-time synchronization latency requirement by offering a reliable, high-bandwidth connection with SLA-backed uptime.

Answer

Direct Peering

Answer

Cloud VPN with dynamic routing

Answer

Dedicated Interconnect

Question 2

A company wants to forward DNS queries from their on-premises network to Google Cloud for resolution of private zone names. Which configuration is required?

Accepted Answer

DNS inbound server policy. A DNS inbound server policy allows an on-premises DNS resolver to forward queries to Google Cloud, enabling resolution of private zone names. This policy creates a forwarding path from on-premises to Cloud DNS using a specific inbound endpoint, which is required for hybrid cloud DNS resolution.

Answer

DNS peering

Answer

DNS forwarding zone

Answer

Managed private zone

Question 3

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

Accepted Answer

HA VPN with a single VPN gateway and a dynamic peer IP. HA VPN supports dynamic peer IP addresses through its use of IKEv2 and route-based VPN tunnels. When the branch office has a dynamic public IP, HA VPN can establish tunnels using the peer's current IP address, which is discovered during IKE negotiation. Classic VPN (option A) requires a static peer IP, and option D requires two static peer IPs, making them unsuitable for a dynamic IP scenario.

Answer

Classic VPN with a static IP on the peer

Answer

A custom SSL VPN appliance on Compute Engine

Answer

HA VPN with two VPN gateways and static peer IPs

Question 4

A company wants to run a DNS resolution service for their hybrid cloud environment. They need on-premises servers to resolve GCP private VM hostnames, and GCP VMs to resolve on-premises hostnames. Which Google Cloud service should they use?

Accepted Answer

Cloud DNS with inbound and outbound DNS forwarding. Cloud DNS with inbound and outbound DNS forwarding enables bidirectional DNS resolution between on-premises and GCP.

Answer

Cloud DNS public zone

Answer

Cloud DNS private zone with DNS peering

Answer

Cloud NAT

Question 5

You are configuring an HA VPN tunnel between GCP and on-premises. The on-premises VPN device only supports IKEv1 and static routing. Which of the following is true regarding this setup?

Accepted Answer

Classic VPN must be used. HA VPN requires IKEv2 and dynamic routing (BGP). Classic VPN supports IKEv1 and static routing.

Answer

Partner Interconnect can be used instead

Answer

HA VPN can be used with static routing if you disable BGP

Answer

HA VPN can be configured with IKEv1 and static routes

Question 6

A company uses Traffic Director with Envoy sidecars to manage traffic in their service mesh. They want to perform canary deployments where 10% of traffic goes to the new version and 90% to the stable version. Which TWO Traffic Director resources should they configure? (Choose two.)

Accepted Answer

A TrafficDirectorService with a traffic splitting policy (weighted clusters). Traffic splitting is achieved through TrafficDirectorService with a weighted traffic policy. BackendService defines the service backends. Envoy Route Configuration is used for routing, but Traffic Director configures it automatically. HTTPRoute and gRPC filters are not used for traffic splitting.

Answer

A gRPC filter in the Envoy configuration

Answer

An HTTPRoute resource

Answer

An Envoy Route Configuration with weighted clusters

Question 7

A company wants to ensure that only traffic from specific source IP ranges can reach a Cloud Load Balancer. How should they enforce this?

Accepted Answer

Configure Cloud Armor with IP allowlist.. Cloud Armor is a web application firewall (WAF) that can be attached to a Cloud Load Balancer to filter incoming traffic based on IP addresses, including allowlisting specific source IP ranges. This directly meets the requirement to restrict access to the load balancer by source IP without affecting backend instance configurations.

Answer

Use IAP.

Answer

Set up Cloud NAT.

Answer

Use VPC firewall rules on the load balancer's backend.

Question 8

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Accepted Answer

Cloud NAT logging with filter for errors

Answer

Firewall Rules logging

Answer

VPC Flow Logs on the subnet

Answer

Cloud Armor request logs

Question 9

You need to create a load balancer that distributes traffic across Compute Engine instances in multiple regions for a TCP application without SSL offload. The clients should connect to a single anycast IP. Which load balancer should you use?

Accepted Answer

Global external TCP Proxy Load Balancer. Global external TCP Proxy Load Balancer provides a single anycast IP and handles TCP traffic without SSL offload (though it supports SSL offload optionally). It is the only global TCP load balancer that does not require SSL termination.

Answer

External TCP/UDP Network Load Balancer

Answer

Global external SSL Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 10

A startup is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose a service to the internet using a load balancer that provides SSL termination and supports WebSocket. Which type of Service should they use?

Accepted Answer

Create a Service of type LoadBalancer with an HTTP(S) load balancer.. A Service of type LoadBalancer with an HTTP(S) load balancer is correct because it provides a public IP address, handles SSL termination at the load balancer level, and natively supports WebSocket connections without additional configuration. This is the simplest and most direct way to expose a microservice to the internet with these requirements on GKE.

Answer

Create a Service of type ClusterIP and use an Ingress resource with a backendConfig.

Answer

Create a Service of type NodePort and configure an external TCP/UDP load balancer.

Answer

Create a Headless Service with an external DNS A record pointing to the pod IPs.

Question 11

An organization wants to enforce that only instances with specific service accounts can be accessed via SSH (TCP 22) from the internet. Which two attributes should be used in the firewall rule to achieve this? (Choose two.)

Accepted Answer

--source-ranges 0.0.0.0/0. To target instances based on service account, use --target-service-accounts. To specify the source from internet, use --source-ranges with 0.0.0.0/0.

Answer

--source-service-accounts

Answer

--target-tags

Answer

--destination-ranges

Question 12

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

Accepted Answer

It depends on the redundancy requirements; typically two per attachment for active-active.. With a Dedicated Interconnect using two VLAN attachments in different edge availability domains (EADs), the recommended best practice for high availability is to establish two BGP sessions per VLAN attachment (one active and one redundant) on the same Cloud Router, resulting in four sessions total. However, the question asks 'how many BGP sessions should be established' and the correct answer acknowledges that it depends on the redundancy requirements; typically two per attachment for active-active, but if active-passive is acceptable, fewer sessions may suffice. This flexibility makes 'It depends' the most accurate choice.

Answer

Four: two per VLAN attachment.

Answer

Two: one per VLAN attachment.

Answer

One: one session per Cloud Router.

Question 13

An engineer is troubleshooting a VPC Network Peering connection between two VPCs. The peering is established, but traffic from VPC A to VPC B is not reaching a specific subnet. Both VPCs have custom routes. What is the most likely cause?

Accepted Answer

Export custom routes is not enabled on the VPC B side. A common issue is that the subnet's custom routes are not exported. VPC peering allows exporting custom routes, but this must be explicitly enabled. If not, only system-generated routes (subnet routes) are exchanged.

Answer

The subnet has overlapping IP with VPC A

Answer

The subnet in VPC B is in a different region

Answer

Export custom routes is not enabled on the VPC A side

Question 14

A company wants to set up a Regional Internal HTTP(S) Load Balancer to serve an internal web application. Which two components are required? (Choose two.)

Accepted Answer

An Envoy-based proxy. Regional Internal HTTP(S) LB requires an Envoy-based proxy and a backend service with a NEG of type GCE_VM_IP_PORT or GCE_VM_IP.

Answer

Cloud CDN

Answer

An SSL certificate

Answer

A global forwarding rule

Question 15

A company needs to load balance TCP traffic without SSL termination for a gaming application where client IP preservation is critical. The backend is a group of Compute Engine instances. Which load balancer types meet these requirements? (Choose TWO.)

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Global TCP Proxy Load Balancer terminates SSL? Actually, TCP Proxy LB does not terminate SSL; it forwards TCP traffic but does not preserve client IP by default (uses Proxy Protocol). Regional External TCP/UDP Network Load Balancer is pass-through and preserves client IP. The Internal TCP/UDP LB is pass-through but internal. For external TCP without SSL termination and client IP preservation, the best options are the Regional External TCP/UDP NLB (pass-through) and a Global TCP Proxy with Proxy Protocol enabled (which can preserve IP via Proxy Protocol).

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global SSL Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Question 16

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address. When the BGP session state is stuck in 'CONNECT', it indicates that the router is actively trying to initiate a TCP connection to the peer but is not receiving a response. For BGP to establish a TCP session (port 179), the on-premises router must have a valid IP route to the Cloud Router's BGP peer IP address. Without this route, TCP SYN packets are dropped, preventing the session from transitioning to 'ESTABLISHED'.

Answer

Change the BGP ASN on the Cloud Router to a different number

Answer

Increase the BGP hold timer on the Cloud Router

Answer

Change the BGP keepalive interval to 10 seconds

Question 17

A company has Compute Engine instances without external IPs in a VPC. They need to reach Google APIs such as Cloud Storage and BigQuery. Which configuration will meet this requirement with minimal cost and operational overhead?

Accepted Answer

Configure the subnet to have Private Google Access enabled. Ensure the instances have the appropriate DNS resolution for private.googleapis.com.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs via the default internet gateway or VPC peering. Configuring a Private Google Access enabled subnet is the simplest and cheapest option, as it does not require NAT or additional instances.

Answer

Set up a Squid proxy on a bastion host with an external IP and route all API traffic through it.

Answer

Create a Cloud NAT gateway in the same region and attach it to the VPC.

Answer

Assign external IPs to the instances and create firewall rules to allow traffic to Google APIs.

Question 18

A company is designing a VPC network to support multiple projects that require isolation but also need to communicate with a shared services project. Which approach should the company use to minimize administrative overhead while ensuring isolation?

Accepted Answer

Implement a Shared VPC in the host project and attach all service projects to it.. A Shared VPC (XPN) allows an organization to connect resources from multiple service projects to a common host project's VPC network, enabling isolated projects to communicate with shared services while centralizing network administration. This minimizes administrative overhead because network policies, firewall rules, and routing are managed in one place, and service projects do not need to manage their own VPC infrastructure.

Answer

Assign all projects to a single VPC with separate subnets for each project.

Answer

Use dedicated VPCs for each project and connect via Cloud VPN tunnels.

Answer

Create a separate VPC for each project and peer them with the shared services VPC.

Question 19

A company is creating a new VPC to host a set of microservices on Compute Engine. The network architect wants to minimize operational overhead and allow automatic subnet creation as new regions are added. Which VPC mode should be used?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region as they become available, reducing operational overhead. Custom mode requires manual subnet creation.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 20

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

Accepted Answer

Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.. Traffic Director uses Envoy's fault injection filter, configured via the Envoy xDS API or through GKE configuration. The correct approach is to apply a traffic policy with fault injection percentage. The other options are not valid Traffic Director features or do not achieve fault injection.

Answer

Use the gcloud compute backend-services update command with the --fault-injection flag.

Answer

Set a circuit breaker with a max pending requests threshold.

Answer

Create a backend service with connection draining and set the drain timeout.