PCNE Practice Exam 3 — 20 Questions

Question 1

A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?

Accepted Answer

Export logs to BigQuery. For long-term analysis and ad-hoc querying of HTTP load balancer access logs, exporting them to BigQuery is the recommended approach because BigQuery is a fully managed, petabyte-scale analytics data warehouse that supports fast SQL queries over massive datasets. Cloud Logging is designed for real-time monitoring and short-term retention (default 30 days), not for the complex, historical, large-scale analytical queries that user-behavior and traffic-pattern analysis requires.

Answer

Use VPC Flow Logs instead

Answer

View logs in the Cloud Logging dashboard

Answer

Store logs in Cloud Storage and use grep

Question 2

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

Accepted Answer

Specify a subnet in the same region as the backend instances.. An internal load balancer (ILB) in GCP requires a regional forwarding rule that routes traffic to backend instances within the same VPC. Specifying a subnet in the same region as the backend instances is mandatory because the ILB's internal IP address is allocated from that subnet, and the forwarding rule must reference a subnet to enable internal-only routing. Without a subnet, the ILB cannot be provisioned as an internal load balancer.

Answer

Assign a static external IP address to the forwarding rule.

Answer

Upload an SSL certificate to the load balancer.

Answer

Create a Cloud NAT gateway for the backend instances.

Question 3

An organization has multiple VPCs in different projects that need to consume a common internal service hosted in a central project. The service runs on a set of Compute Engine instances with internal IPs. Which architecture allows the consumers to access the service using private IPs without VPC peering?

Accepted Answer

Create a Private Service Connect endpoint in each consumer VPC and publish the service as a Private Service Connect service from the central project.. Private Service Connect allows you to publish internal services via Private Service Connect endpoints in consumer VPCs. Consumers access the service using internal IPs without needing VPC peering or VPNs. This is the recommended architecture for publishing and consuming internal services across projects.

Answer

Use Cloud VPN to connect each consumer VPC to the central VPC.

Answer

Expose the service through an external IP and use IAM to restrict access.

Answer

Set up VPC peering between each consumer VPC and the central VPC.

Question 4

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

Accepted Answer

gRPC. For gRPC backends, the health check should use the gRPC protocol because gRPC health checking is defined by the standard grpc.health.v1.Health service, which returns a structured status that load balancers can interpret. HTTP or TCP checks cannot properly validate gRPC service health since gRPC uses HTTP/2 with binary framing and its own status semantics.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 5

A company wants to resolve DNS queries from their on-premises network for Google Cloud private zones (e.g., example.internal) without duplicating DNS data. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS forwarding. Inbound DNS forwarding allows on-premises DNS resolvers to send queries to Cloud DNS for private zones (e.g., example.internal) without duplicating records. The on-premises resolver forwards queries to a Cloud DNS inbound forwarder IP, which resolves the private zone and returns the answer. This is the correct feature for on-prem to cloud private zone resolution.

Answer

DNS peering

Answer

Private DNS zones

Answer

Outbound DNS forwarding

Question 6

A network engineer needs to test connectivity after setting up a Dedicated Interconnect VLAN attachment and BGP session. Which tool should they use to verify that Google Cloud can reach an on-premises IP address?

Accepted Answer

ping and traceroute from a Google Cloud VM to the on-premises IP.. After configuring a Dedicated Interconnect VLAN attachment and BGP session, the most direct way to verify connectivity from Google Cloud to an on-premises IP is to use ping and traceroute from a Google Cloud VM. These tools test actual data-plane reachability and path, confirming that routes are exchanged and traffic flows.

Answer

gcloud compute interconnect list command.

Answer

Cloud Monitoring dashboard for interconnect metrics.

Answer

tcpdump on the on-premises router.

Question 7

A media streaming company uses Cloud CDN with signed URLs to protect content. They want to invalidate cached content for a specific file after a security incident. The file is stored in a Cloud Storage bucket and the CDN cache key includes the URL. They run: gcloud compute url-maps invalidate-cdn-cache URL_MAP --path "/videos/incident.mp4". The invalidation succeeds but the old content is still served. What is the most likely reason?

Accepted Answer

The invalidation path does not match the cache key because signed URLs include query parameters.. Cloud CDN's cache key for signed URLs includes the query parameters (e.g., `?Expires=...&Signature=...`). The invalidation command specifies only the path `/videos/incident.mp4`, which does not match the full cache key that includes the query string. As a result, the invalidation does not purge the cached entry for the signed URL, and the old content continues to be served.

Answer

The Cloud CDN cache key does not include query parameters, so the invalidation should work.

Answer

The Cache-Control header on the object is set to public, max-age=31536000.

Answer

The Cloud Storage bucket requires object versioning to be enabled for invalidation.

Question 8

An organization has multiple VPCs in different regions that need to connect to a single on-premises data center via Dedicated Interconnect. They want to minimize cost and complexity. What is the recommended architecture?

Accepted Answer

Create a single interconnect connection and use multiple VLAN attachments, one per VPC.. A single Dedicated Interconnect connection can support multiple VLAN attachments (each with a unique VLAN ID) to connect multiple VPCs in different regions to the same on-premises data center. This minimizes cost by using one physical connection and reduces complexity by avoiding separate interconnects or VPNs for each VPC.

Answer

Use a single VPC and then use VPC Peering to connect to the other VPCs.

Answer

Use Cloud VPN for the additional VPCs to avoid additional interconnect costs.

Answer

Create a separate interconnect connection for each VPC.

Question 9

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The metric 'interconnect/link/operational_status' provides the operational status of each interconnect link (e.g., operational, degraded).

Answer

interconnect/vlan_attachment/outbound_bytes

Answer

interconnect/network/packet_drop_count

Answer

interconnect/network/received_bytes_count

Question 10

A company wants to use Cloud DNS to resolve DNS queries from their on-premises network for a private zone that contains internal GCP resource names. They do not want to manage DNS servers on-premises. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS server policy. Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS private zones, enabling resolution without managing on-premises DNS servers.

Answer

Private DNS zone

Answer

Outbound DNS server policy

Answer

DNS peering

Question 11

A company has a Dedicated Interconnect connection with a VLAN attachment in their GCP VPC. They want to use BGP to exchange routes with their on-premises router. Which GCP resource must be configured to establish the BGP session?

Accepted Answer

Cloud Router. A Cloud Router is required to establish BGP sessions over VLAN attachments. The Cloud Router manages BGP peers and route advertisements.

Answer

VPC peering

Answer

Network Connectivity Center

Answer

Cloud VPN gateway

Question 12

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

Accepted Answer

The engineer forgot to add firewall rules to allow traffic from the peer range.. The most likely cause is that the engineer forgot to add firewall rules to allow traffic from the peer range. Even though VPC peering is ACTIVE, the default ingress deny all firewall rule blocks incoming traffic. To allow communication between instances in peered VPCs, you must create ingress firewall rules in each VPC that permit traffic from the other VPC's subnet CIDR ranges.

Answer

The VPCs use different routing modes.

Answer

The IAM permissions for the peering are missing.

Answer

The VPCs have overlapping subnet CIDR ranges.

Question 13

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Accepted Answer

Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.. Cloud NAT in Google Cloud can be scoped to specific instances using network tags. By applying a network tag to the instances that should use NAT and then creating a Cloud NAT gateway with that tag, only those tagged instances will have their traffic NATed. This allows granular control without affecting other instances in the same subnet.

Answer

Assign external IPs to non-NAT instances.

Answer

Use firewall rules to allow NAT for tagged instances.

Answer

Create separate subnets for NAT instances.

Question 14

A company wants to resolve DNS queries from their on-premises network for a privately hosted zone in Google Cloud (e.g., example.internal). They also want on-premises DNS servers to resolve GCP internal VM hostnames. Which two Cloud DNS features should they implement? (Choose TWO.)

Accepted Answer

DNS peering. DNS peering allows on-premises to query GCP private zones, and DNS forwarding (inbound) allows GCP to forward queries to on-premises DNS servers.

Answer

Public zone delegation

Answer

DNS forwarding (outbound)

Answer

Split-horizon DNS

Question 15

A company is using a Classic VPN with static routing to connect to GCP. They need to add a new subnet in GCP and make it reachable from on-premises without manual configuration changes on-premises. What is the limitation of Classic VPN in this scenario?

Accepted Answer

Classic VPN requires manual route updates on-premises. Classic VPN with static routing requires manual configuration of routes on both the GCP side and the on-premises side. When adding a new subnet in GCP, the on-premises router must be manually updated to include the new subnet in its routing table, otherwise traffic to that subnet will not be routed through the VPN. This is a limitation because it does not support dynamic route advertisement.

Answer

Classic VPN does not support IKEv2

Answer

Classic VPN supports BGP, so routes are automatically advertised

Answer

Classic VPN cannot be used with multiple subnets

Question 16

An organization has multiple VPCs in different projects that need to share subnets to create a common network segment. They want central control over network administration while allowing individual project teams to deploy resources. Which approach should they use?

Accepted Answer

Shared VPC with a host project and service projects. Shared VPC allows a host project to share subnets with service projects, providing central network administration while allowing teams to deploy resources independently.

Answer

VPN tunnels connecting all VPCs

Answer

VPC Network Peering between all VPCs

Answer

Creating a single VPC in one project and granting IAM permissions to other projects

Question 17

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

Accepted Answer

Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.. A Google Cloud HA VPN gateway has two interfaces, each with its own external IP, and requires two VPN tunnels — one per interface — to achieve 99.99% availability. Each tunnel must have its own BGP session with the on-premises VPN device, and the on-premises device must be configured to peer with both. This creates the redundant tunnel pair that HA VPN is designed for.

Answer

Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.

Answer

Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.

Answer

Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.

Question 18

A company has two HA VPN tunnels between GCP and on-premises. They want to use both tunnels simultaneously for load balancing traffic. Which BGP feature should they configure on the Cloud Router to achieve equal-cost multipath (ECMP)?

Accepted Answer

Advertise identical routes with equal BGP metrics (AS path length, MED, etc.) from both tunnels.. ECMP is achieved by having multiple BGP paths with equal MED and AS path length. The Cloud Router automatically load balances if routes have equal metrics.

Answer

Use AS path prepending on one tunnel.

Answer

Set different MED values on each tunnel to prefer one.

Answer

Enable policy-based VPN instead of route-based.

Question 19

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's edge security service that attaches to HTTP(S) Load Balancers and provides WAF capabilities via preconfigured rules such as the OWASP ModSecurity Core Rule Set, which specifically detects and blocks SQL injection (SQLi) and cross-site scripting (XSS). Because it operates at the load balancer layer (Layer 7), it can inspect HTTP request headers, URLs, and bodies where these web exploits live. Firewall rules and Cloud IDS operate at different layers and cannot perform application-layer payload inspection for these attack types.

Answer

Firewall Rules

Answer

Cloud IDS

Answer

VPC Service Controls

Question 20

Which Google Cloud hybrid connectivity option can be configured without using BGP?

Accepted Answer

Classic VPN with static routes. Classic VPN can be configured with static routes and does not require BGP. Partner Interconnect and Dedicated Interconnect require BGP for routing. HA VPN also typically uses BGP for dynamic routing, making D the only option that can operate without BGP.

Answer

Partner Interconnect

Answer

Dedicated Interconnect

Answer

HA VPN