PCNE Practice Exam 4 — 20 Questions

Question 1

A company has a VPC with subnets in us-central1 and europe-west1. They want to deploy a Cloud NAT to allow VMs in both regions to access the internet. How many Cloud NAT gateways are needed?

Accepted Answer

Two Cloud NAT gateways, one per region.. Cloud NAT is a regional resource; each region requires its own Cloud NAT gateway. A single gateway cannot cover multiple regions because Cloud NAT does not support global scope. For VMs in us-central1 and europe-west1 to access the internet, you need one Cloud NAT gateway per region, totaling two. Therefore, option C is correct. Option A is incorrect because Cloud NAT is necessary for private VMs to reach the internet without external IP addresses. Option B is incorrect because Cloud NAT operates at the region level, not per subnet; a regional gateway serves all subnets in that region. Option D is incorrect because Cloud NAT is regional, not global.

Answer

None; Cloud NAT is not required for internet access.

Answer

One Cloud NAT gateway per subnet.

Answer

One Cloud NAT gateway covering both regions.

Question 2

A company wants to expose a globally distributed application using Cloud Run via a single anycast IP address, with SSL termination and content-based routing to different backend services. Which load balancer should they use?

Accepted Answer

Global External HTTPS Load Balancer. The Global External HTTPS Load Balancer provides a single anycast IP, SSL termination, and content-based routing via URL maps to backends like serverless NEGs pointing to Cloud Run.

Answer

Global External SSL Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global External TCP Proxy Load Balancer

Question 3

An organization is experiencing high latency on their Partner Interconnect connection. Which TWO tools or features can they use to diagnose the issue from within Google Cloud? (Choose two.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic flowing to and from VPC instances, including latency-related metrics such as packet loss and retransmissions. By analyzing these logs, you can identify if high latency is caused by dropped packets or congestion on the Partner Interconnect link. This makes VPC Flow Logs a direct diagnostic tool for latency issues from within Google Cloud.

Answer

Network Intelligence Center performance dashboard

Answer

Cloud Router logs

Answer

Cloud Load Balancing logs

Question 4

A company has a VPC with subnets in us-east1 and europe-west1. They need low-latency communication between instances in these regions using private IPs only. Which solution should they use?

Accepted Answer

Use a Global VPC (default VPC mode).. A Global VPC (default VPC mode) allows subnets in multiple regions to communicate using private IPs natively, without any additional VPN or peering configuration. This is because a Global VPC spans all regions, and instances within the same VPC can reach each other via internal IPs using Google's global network, providing low-latency communication.

Answer

Use Cloud VPN to connect the regions.

Answer

Use Cloud Interconnect to connect the regions.

Answer

Use VPC Network Peering between the two regional subnets.

Question 5

A company needs to connect multiple VPCs in different projects and regions to a common hub VPC for centralized inspection. They want to avoid complex mesh peering configurations. Which service should they use?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is the correct choice because it provides a hub-and-spoke topology that connects multiple VPCs across projects and regions to a central hub VPC for centralized inspection, without requiring complex mesh peering. NCC uses a software-defined networking (SDN) controller to manage inter-VPC connectivity and routing, enabling traffic to flow through the hub VPC for inspection appliances like firewalls or IDS/IPS.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 6

A company uses Traffic Director with Envoy sidecars for service mesh. They want to gradually shift traffic from version 1 to version 2 of a service, starting with 10% traffic to version 2. Which Traffic Director feature should they use?

Accepted Answer

Traffic splitting. Traffic Director supports traffic splitting via the service routing API (TrafficDirectorService). You can define weighted destinations in the routing rule to split traffic between versions.

Answer

Circuit breakers

Answer

Fault injection

Answer

mTLS authentication

Question 7

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Accepted Answer

Use a global external HTTP(S) load balancer with an anycast IP and enable Cloud CDN.. A global external HTTP(S) load balancer uses a single anycast IP address, which directs each user to the closest healthy backend based on the user's geographic location and backend health. Enabling Cloud CDN further reduces latency by caching content at Google's global edge locations, ensuring that static and dynamic content is served from the nearest point of presence.

Answer

Deploy a regional external HTTP(S) load balancer in each region and use Cloud CDN to cache content.

Answer

Configure an internal TCP/UDP load balancer in each region with DNS-based geolocation routing.

Answer

Set up a global external TCP proxy load balancer with SSL termination at each backend.

Question 8

Based on the exhibit, what is the purpose of Cloud Router's BGP configuration?

Accepted Answer

To advertise the VPC's IP range to the on-premises network.. Cloud Router uses BGP to dynamically exchange routes between a VPC network and an on-premises network over a VPN tunnel or Dedicated Interconnect. In this configuration, the purpose is to advertise the VPC's IP range (the custom or auto-mode subnet CIDR) to the on-premises router, enabling on-premises hosts to route traffic back to the VPC. This is achieved by configuring the Cloud Router with a BGP session and setting the advertised route for the VPC's IP range.

Answer

To load balance traffic across multiple VPN tunnels.

Answer

To receive a default route from the on-premises network.

Answer

To advertise a default route to the on-premises network.

Question 9

A developer wants to log all denied firewall rule events for security auditing purposes. What is the simplest way to achieve this without modifying existing firewall rules?

Accepted Answer

Create a deny-all firewall rule with logging enabled at the lowest priority. Firewall rules logging can be enabled per rule. However, if you want to log all denied traffic without modifying existing rules, you can create a high-priority deny-all rule (e.g., priority 65535) with logging enabled. This will log any traffic not explicitly allowed.

Answer

Use Cloud NAT logging

Answer

Enable firewall rule logging on existing rules

Answer

Enable VPC Flow Logs on all subnets

Question 10

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

Accepted Answer

MED (Multi-Exit Discriminator). MED (Multi-Exit Discriminator) is used to influence inbound route preference. A lower MED value is preferred. Setting a lower MED for the specific subnet will make it preferred over the less specific route.

Answer

Local preference

Answer

AS path prepend

Answer

Weight

Question 11

Drag and drop the steps to set up a Private Service Connect for accessing Google APIs privately into the correct order.

Accepted Answer

Reserve a static internal IP address, then create a Private Service Connect endpoint using that IP, then configure DNS to point to the endpoint IP, then test connectivity.. Private Service Connect involves creating an endpoint, assigning IP, setting DNS, and testing.

Answer

Create a Private Service Connect endpoint, then reserve a static internal IP address, then configure DNS, then test.

Answer

Reserve a static internal IP address, then configure DNS, then create a Private Service Connect endpoint, then test.

Answer

Create a Private Service Connect endpoint, then configure DNS, then reserve a static internal IP address, then test.

Question 12

A company is designing a global web application that must serve users worldwide with low latency. They plan to use a Global HTTPS Load Balancer with Cloud CDN. Which TWO features should they enable to further reduce latency for users connecting from various regions? (Choose two.)

Accepted Answer

Anycast IP address. CDN Interconnect provides dedicated connectivity to CDN caches, reducing latency. Anycast IP ensures users connect to the nearest edge location. Cloud Armor is security, not performance.

Answer

Reserve a static IP address

Answer

Enable IAP for backend services

Answer

Cloud Armor with rate limiting

Question 13

You are designing a multi-tier application where an internal HTTP(S) load balancer should route requests to a backend service based on the URL path (e.g., /api/* to one service, /web/* to another). Which component is essential for this routing?

Accepted Answer

URL map. The Internal HTTP(S) Load Balancer uses a URL map to define path-based routing rules to backend services.

Answer

Cloud NAT

Answer

VPC peering

Answer

Firewall rules

Question 14

A company wants to allow on-premises servers to access Google APIs and services through a Dedicated Interconnect without using public IPs. What should they configure?

Accepted Answer

Enable Private Google Access on the VPC subnet.. Private Google Access enables on-premises hosts connected via Dedicated Interconnect to reach Google APIs and services using internal IP addresses. When enabled on the VPC subnet, traffic destined for Google APIs is routed through the interconnect without needing public IPs, as the VPC uses its default routes and Cloud NAT-like functionality to forward requests to Google's internal addresses.

Answer

Set up VPC Network Peering.

Answer

Configure Private Service Connect.

Answer

Configure Cloud Router with custom route advertisement.

Question 15

A company has a VPC with a subnet in us-central1 (10.0.0.0/16) and a Cloud VPN tunnel to an on-premises network (192.168.0.0/16). They also have a static route for 0.0.0.0/0 internet gateway. On-premises traffic to 10.0.0.0/16 is working. However, traffic from a GCE instance in the VPC to an on-premises IP 192.168.1.10 is timing out. What is the most likely cause?

Accepted Answer

Missing a custom static route in the VPC for destination 192.168.0.0/16 with next hop VPN gateway. The VPC has a default route (0.0.0.0/0) pointing to the internet gateway, but no specific route for the on-premises network (192.168.0.0/16). Without a custom static route with next hop set to the VPN gateway, traffic from the GCE instance to 192.168.1.10 will be forwarded to the internet gateway instead of the VPN tunnel, causing a timeout.

Answer

Cloud NAT is not configured for the VPC

Answer

The VPN tunnel is down and BGP session is not established

Answer

Firewall rule does not allow inbound traffic from on-premises to the instance

Question 16

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking health check probes from Google Cloud. Hybrid connectivity NEGs require that the on-premises endpoint is reachable via a Cloud VPN or Interconnect. If Traffic Director cannot reach the endpoint, it might be due to missing firewall rules allowing health check probes or the NEG endpoint being misconfigured. The most common cause is that health checks are failing because the firewall rules on-premises are not allowing the health check source ranges.

Answer

The hybrid connectivity NEG is not supported with Traffic Director

Answer

The Cloud VPN tunnel is not established

Answer

Traffic Director requires mTLS for all hybrid endpoints

Question 17

A financial company requires encrypted traffic between on-premise and GCP. They have strict compliance requiring that encryption keys are managed on-premise and rotated every 30 days. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect with MACsec. B is correct because MACsec (IEEE 802.1AE) provides encryption at Layer 2, which is required for Cloud Interconnect to secure traffic between on-premise and GCP. Unlike VPN solutions, MACsec allows the customer to manage encryption keys on-premise and rotate them every 30 days, meeting strict compliance requirements. Cloud Interconnect with MACsec ensures low-latency, high-bandwidth connectivity while keeping key management under the customer's control.

Answer

Cloud VPN with certificate-based authentication using on-prem CA

Answer

Cloud VPN with IKEv2 and pre-shared keys

Answer

Cloud Interconnect with VLAN attachments

Answer

Partner Interconnect with a service provider that supports MACsec

Question 18

A company wants to deploy an HTTP application on Compute Engine instances in us-east1 and europe-west1, and use a global external HTTP(S) load balancer. How should they configure the backend?

Accepted Answer

Create one backend service and add two instance groups, one from each region.. A global external HTTP(S) load balancer requires a single backend service that can span multiple regions. By adding one instance group from us-east1 and another from europe-west1 to the same backend service, the load balancer automatically routes traffic to the closest healthy backend based on the client's geographic location and the load balancer's anycast IP. This configuration leverages Google's global network infrastructure for optimal latency and failover.

Answer

Create a regional load balancer in each region and use DNS round-robin.

Answer

Create one backend service and add one instance group with instances in both regions.

Answer

Create two backend services, one per region, and attach to the same URL map.

Question 19

You need to configure a health check for a backend service that uses HTTP2. Which THREE settings must be configured correctly for the health check to work? (Select three.)

Accepted Answer

Request path. For an HTTP2 health check, you need to specify the protocol (HTTP2), a port, and a request path.

Answer

Proxy protocol

Answer

SSL certificate

Question 20

Which Cloud DNS routing policy should you use to direct users to the nearest healthy backend based on their geographic location?

Accepted Answer

Geolocation. Geolocation routing policy directs traffic based on the user's geographic location. Weighted round robin distributes by weight, failover is for primary/backup.

Answer

Failover

Answer

Weighted round robin

Answer

Response policy