PCNE Practice Test 21 — 15 Questions

Question 1

A developer wants to use Cloud CDN to cache content from an external origin backend. Which TWO configurations are required to set this up? (Choose two.)

Accepted Answer

A backend service or backend bucket with the origin defined. To use Cloud CDN with an external origin, you need a backend service or backend bucket that points to the origin, and enable Cloud CDN on that backend. A Global External HTTPS Load Balancer with Internet NEG is not required; Cloud CDN can be used with external backends via backend service. A custom domain is not required for Cloud CDN to work, though often used.

Answer

A custom domain mapped to the load balancer

Answer

A global static IP address

Answer

A Global External HTTPS Load Balancer with Internet NEG

Question 2

A company's application requires TLS termination at the load balancer, with backend instances in multiple regions running on Compute Engine. The backend instances must see the original client IP address. Which load balancer should be used?

Accepted Answer

Global SSL Proxy load balancer. Global SSL Proxy LB terminates TLS (SSL offload) and adds the Proxy Protocol header to preserve client IP. Global HTTPS LB does not support Proxy Protocol. NLB does not terminate TLS. Internal LB is not external.

Answer

Global external HTTPS load balancer

Answer

Regional external TCP/UDP Network Load Balancer

Answer

Regional internal HTTP(S) load balancer

Question 3

You need to invalidate Cloud CDN cached content for specific URLs after updating files in Cloud Storage. Which command should you use?

Accepted Answer

gcloud compute url-maps invalidate-cdn-cache. gcloud compute url-maps invalidate-cdn-cache invalidates CDN cache for a specific URL map. gcloud compute ssl-certificates is for certificates. gcloud compute backend-buckets update is for updating backend bucket configuration. gcloud compute cdn-cache invalidate does not exist.

Answer

gcloud compute cdn-cache invalidate

Answer

gcloud compute backend-buckets update

Answer

gcloud compute ssl-certificates update

Question 4

A cloud engineer is configuring a Global External HTTPS Load Balancer with a backend service that targets a Cloud Run service via a serverless NEG. They want to enable Cloud CDN and set cache behavior to cache all responses regardless of origin headers. Which THREE steps are required? (Choose three.)

Accepted Answer

Configure a cache key policy that includes the query string. To force cache all, you set cache mode to FORCE_CACHE_ALL. You also need to enable Cloud CDN on the backend service and set the appropriate cache key policy. Signed URL key is not required for basic caching. The URL map is not modified for caching.

Answer

Generate a signed URL key

Answer

Create a backend bucket instead of a backend service

Question 5

An organization needs to route traffic to a group of Compute Engine VM instances in the same zone for a high-throughput TCP application. The solution must preserve the client source IP address and support connection draining. Which load balancer type meets these requirements?

Accepted Answer

Regional external TCP/UDP Network Load Balancer. Regional external TCP/UDP Network Load Balancer (NLB) is pass-through and preserves client IP. Connection draining is supported for NLB backends. Global Proxy LBs rewrite source IP.

Answer

Regional external HTTP(S) load balancer

Answer

Global TCP Proxy load balancer

Answer

Global external HTTP(S) load balancer

Question 6

You are deploying a new internal HTTP(S) load balancer for a microservice that runs on Compute Engine instances within the same region. The load balancer must be accessible only from within the VPC network. Which components are required? (Choose two.)

Accepted Answer

Regional internal HTTP(S) load balancer. Regional internal HTTP(S) LB uses an internal IP address and forwards traffic to a backend service. Backend service requires a health check. An SSL certificate is optional if HTTP is used. Global external LB is for external access.

Answer

Global external HTTP(S) load balancer

Answer

Cloud CDN enabled

Answer

SSL certificate

Question 7

You are troubleshooting an HA VPN connection between Google Cloud and on-premises. The tunnels appear as 'UP' but no routes are exchanged. The Cloud Router logs show 'BGP session state: IDLE'. What is the most likely cause?

Accepted Answer

BGP is not enabled on the Cloud Router. B is correct because the BGP session state IDLE indicates that BGP is not configured or enabled on the Cloud Router. Even though the IPsec tunnels are UP, no BGP routes can be exchanged if the BGP process itself is not running. In Google Cloud, you must explicitly enable BGP on the Cloud Router for each VPN tunnel; otherwise, the BGP session cannot transition from IDLE to any other state.

Answer

The BGP keepalive timer is set too high on the on-premises router

Answer

Firewall rules are blocking UDP port 179

Answer

The on-premises BGP peer is configured with a different next-hop IP

Question 8

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

Accepted Answer

DNS peering. DNS peering allows forwarding DNS queries from one VPC to another VPC's DNS for resolution, without zone transfer.

Answer

DNS forwarding (inbound)

Answer

Managed zone with cross-project binding

Answer

Global DNS configuration

Question 9

A company has two VPCs connected via VPC peering. They want resources in VPC A to be able to reach a service in VPC B that uses a custom static route. What must be configured on the VPC peering connection?

Accepted Answer

Enable export of custom routes in VPC B and import of custom routes in VPC A. By default, custom static routes are not exchanged across VPC peering. You must export custom routes from VPC B and import them into VPC A.

Answer

Enable VPC Flow Logs on both VPCs

Answer

Use a VPN between the VPCs

Answer

Create a Cloud Router in VPC A

Question 10

A company has multiple VPCs in different projects and wants to connect them all to a single on-premises data center using a hub-and-spoke model with Network Connectivity Center (NCC). Which THREE components are required for this setup?

Accepted Answer

NCC hub. NCC requires a hub, spokes (VPC spokes or on-prem spokes via interconnect/VPN), and a Cloud Router for dynamic routing.

Answer

Cloud NAT

Answer

VPC peering between spokes

Question 11

An organization has multiple GCP projects that need to share a common network infrastructure. They want to centralize network administration in a single project while allowing service projects to create their own resources in shared subnets. Which networking approach should they use?

Accepted Answer

Shared VPC. Shared VPC allows a host project to share subnets with service projects, with IAM controls for centralized administration.

Answer

Multi-NIC instances in a single project

Answer

VPC peering between all projects

Answer

Network Connectivity Center

Question 12

Which Google Cloud service allows you to create a hub-and-spoke topology for connecting on-premises networks and VPCs?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) provides a hub-and-spoke model to interconnect on-premises networks and VPCs centrally.

Answer

Cloud VPN

Answer

VPC Network Peering

Answer

Cloud Interconnect

Question 13

An organization is migrating a legacy application to GCP. The application requires static routing and does not support BGP. Which VPN option should they use?

Accepted Answer

Classic VPN. Classic VPN supports static routing (policy-based or route-based) without BGP. Cloud VPN (HA VPN) and Partner Interconnect require BGP, and Dedicated Interconnect uses BGP for VLAN attachments.

Answer

Dedicated Interconnect

Answer

Partner Interconnect

Answer

HA VPN

Question 14

A company wants to connect two VPCs in different GCP projects so that they can communicate using internal IP addresses. The VPCs have overlapping IP ranges. Which approach allows connectivity without changing existing IP addresses?

Accepted Answer

None of these. VPC Network Peering requires non-overlapping subnets. Shared VPC is for multiple projects using a common VPC. Cloud VPN or Interconnect are hybrid connectivity options but also require non-overlapping IP ranges. None of the options allow overlapping IPs.

Answer

VPC Network Peering

Answer

Cloud VPN with dynamic routing

Answer

Shared VPC

Question 15

A company wants to resolve DNS queries from their on-premises network for Google Cloud private zones (e.g., example.internal) without duplicating DNS data. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS forwarding. Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS for resolution of private zones. This avoids the need to replicate zone data on-premises.

Answer

DNS peering

Answer

Private DNS zones

Answer

Outbound DNS forwarding