PCNE Practice Test 21 — 15 Questions

Question 1

A company wants to reduce egress costs for traffic going to Google APIs (e.g., Cloud Storage, BigQuery) from Compute Engine instances. Which configuration should they use?

Accepted Answer

Enable Private Google Access on the subnet. Enabling Private Google Access on the subnet allows Compute Engine instances without external IPs to reach Google APIs (Cloud Storage, BigQuery, etc.) using internal IP addresses, avoiding egress charges associated with going through the public internet. This is the recommended configuration to reduce egress costs for Google API traffic.

Answer

Use VPC Flow Logs to monitor traffic

Answer

Assign external IPs to the instances

Answer

Set up Cloud NAT for the instances

Question 2

An engineer wants to use Cloud DNS to override DNS responses for a specific domain within their VPC. Which feature should they use?

Accepted Answer

Response policy zone (RPZ). Response policy zones (RPZ) allow overriding DNS responses for specified domains within a VPC.

Answer

Private zone

Answer

DNSSEC

Answer

Routing policy

Question 3

An organization has multiple GCP projects that need to share a common network infrastructure. They want to centralize network administration in a single project while allowing service projects to create their own resources in shared subnets. Which networking approach should they use?

Accepted Answer

Shared VPC. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling centralized network administration in a host project while service projects can create resources in shared subnets. This matches the requirement to centralize network administration and allow service projects to use shared subnets.

Answer

Multi-NIC instances in a single project

Answer

VPC peering between all projects

Answer

Network Connectivity Center

Question 4

An engineer needs to monitor the operational status of a Dedicated Interconnect link. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The Cloud Monitoring metric interconnect/link/operational_status reports the operational state of a Dedicated Interconnect link (e.g., LINK_OPERATIONAL, LINK_DOWN), which is exactly what is needed to monitor link health. It is the link-level status metric, distinct from attachment-level metrics.

Answer

interconnect/attachment/operational_status

Answer

interconnect/network/sent_bytes_count

Answer

interconnect/network/received_bytes_count

Question 5

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

Accepted Answer

Enable Private Google Access on subnets that host instances without external IP addresses.. Private Google Access allows VM instances that have only internal IP addresses (no external IPs) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through the Google Cloud network. This eliminates the need for an external IP address, reducing the attack surface and supporting a defense-in-depth strategy by keeping traffic within Google's internal infrastructure.

Answer

Configure firewall rules with stateful packet inspection disabled to maximize throughput.

Answer

Use VPC Network Peering to isolate the sensitive workloads from other projects.

Answer

Create a Cloud NAT gateway to filter inbound traffic from the internet.

Question 6

A financial services company requires a dedicated, low-latency connection between their on-premises data center and Google Cloud. They need a 99.99% SLA and bandwidth of 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides 10 Gbps or 100 Gbps links with a 99.99% SLA when configured with two connections.

Answer

HA VPN

Answer

Partner Interconnect

Answer

Classic VPN

Question 7

A company uses an HTTPS load balancer with SSL certificates. They want to ensure only strong cipher suites are accepted. Which Google Cloud service should they use to enforce this?

Accepted Answer

SSL policies on the target HTTPS proxy.. SSL policies on the target HTTPS proxy allow you to define a set of allowed SSL/TLS cipher suites and protocols for the load balancer. By configuring an SSL policy with a 'RESTRICTED' profile or a custom list of strong ciphers, you can enforce that only secure cipher suites (e.g., TLS 1.2+ with ECDHE and AES-GCM) are accepted, rejecting weak or deprecated ciphers like RC4 or 3DES.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud Armor security policy.

Answer

Firewall rules on the backend instances.

Question 8

A company deploys a web application behind a global external HTTP(S) load balancer and wants to protect against SQL injection attacks. Which Google Cloud security product should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities, including pre-configured rules to filter SQL injection (SQLi) attacks at the edge of Google's network, before traffic reaches the backend. It integrates directly with the global external HTTP(S) load balancer to inspect HTTP/HTTPS requests and block malicious payloads based on OWASP Top 10 signatures.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Answer

Cloud IDS

Question 9

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They notice that traffic from Google Cloud to on-premises is not using the VPN tunnel but instead going through the internet. They have verified that the VPN tunnel is up and BGP sessions are established. Which configuration issue is most likely causing this behavior?

Accepted Answer

The on-premises router is not advertising the on-premises CIDR via BGP. If the on-premises router does not advertise the on-premises CIDR via BGP, the Cloud Router will not have a route to that network in its routing table. Even though the VPN tunnel is up and BGP sessions are established, without the specific prefix being advertised, Google Cloud will use its default route (0.0.0.0/0) to send traffic to on-premises over the internet instead of through the VPN tunnel.

Answer

The Cloud Router BGP IP address is misconfigured

Answer

The pre-shared key for the VPN tunnel is mismatched

Answer

The on-premises BGP ASN is incorrect

Question 10

A company needs to resolve on-premises DNS names from Google Cloud VMs. They want to forward DNS queries for a specific domain (example.corp) to an on-premises DNS server. Which Cloud DNS feature should they use?

Accepted Answer

Outbound DNS forwarding (conditional forwarding). Outbound DNS forwarding with conditional forwarding allows Cloud DNS to forward queries for a specific domain (example.corp) to an on-premises DNS server. This is the correct feature because it selectively routes DNS traffic based on the domain name, enabling resolution of private on-premises names from Google Cloud VMs without exposing the entire VPC network.

Answer

Private DNS zones

Answer

DNS peering

Answer

Inbound DNS policy

Question 11

An organization has two VPCs in the same project: VPC-A and VPC-B. They want instances in VPC-A to reach Cloud Storage buckets without external IPs. What is the simplest solution?

Accepted Answer

Enable Private Google Access on the subnets in VPC-A.. Private Google Access, when enabled on a subnet, allows instances in that subnet that have only internal IP addresses to reach Google APIs and services such as Cloud Storage using Google's internal network. Enabling it on the subnets in VPC-A is the simplest solution because it requires no additional gateways, peering, or external IPs — just a subnet-level setting.

Answer

Create a Cloud NAT gateway in VPC-A and configure firewall rules to allow traffic to Cloud Storage.

Answer

Peer VPC-A with VPC-B and enable Private Google Access on VPC-B.

Answer

Assign external IPs to the instances in VPC-A.

Question 12

A company is using Cloud NAT to provide outbound internet access for instances without external IPs. They notice that the NAT gateway is running out of ports for connections to a single external IP address. To minimize port exhaustion, what should the engineer configure?

Accepted Answer

Increase the number of NAT IP addresses assigned to the Cloud NAT gateway.. Cloud NAT uses NAT IP addresses and ports. To increase capacity for connections to a single destination IP, you can either allocate more NAT IP addresses (which increases the number of ports) or use dynamic port allocation. Static port allocation is used for endpoints that require predictable source ports. For minimizing exhaustion, adding more NAT IPs is the direct solution.

Answer

Change the NAT port allocation to static.

Answer

Reduce the endpoint-independent mapping timeout.

Answer

Enable Cloud NAT logging to diagnose the issue.

Question 13

An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?

Accepted Answer

Enable Private Google Access on the subnet and create a VPC Service Controls perimeter that includes the bucket project. D is correct because VPC Service Controls create a security perimeter around the Cloud Storage bucket's project, preventing data exfiltration even if the bucket is publicly accessible. Private Google Access on the subnet allows VMs to reach Google APIs (including storage.googleapis.com) via internal IPs, avoiding the public internet. Together, they ensure only VMs within the specified VPC network can download objects, as the perimeter restricts access to authorized networks and Private Google Access provides the private connectivity path.

Answer

Enable Cloud NAT and configure a firewall rule to allow egress to 0.0.0.0/0

Answer

Configure a Service Directory endpoint and attach an IAM policy to the bucket allowing access only from that endpoint

Answer

Create a firewall rule allowing egress to the storage.googleapis.com service IP range and enable VPC flow logs

Question 14

A security team wants to serve private content through Cloud CDN but restrict access to only authorized users. They need to generate time-limited URLs that do not require users to log in. Which approach should they use?

Accepted Answer

Use Cloud CDN signed URLs. Cloud CDN signed URLs allow you to grant time-limited access to specific cached objects without requiring user authentication. The signature is generated using a cryptographic key (RSA or Ed25519) and includes an expiration timestamp, so only users with the signed URL can access the private content until it expires. This is the standard mechanism for serving private content through Cloud CDN to anonymous users.

Answer

Use IAM permissions on the bucket

Answer

Use Cloud CDN signed cookies

Answer

Enable Cloud CDN and set the bucket to public

Question 15

Refer to the exhibit. You have two VPCs, vpc-a and vpc-b, with VPC peering configured and custom route import/export enabled. An instance in subnet-a (10.0.1.2) cannot ping an instance in subnet-b (10.0.2.2) using internal IP. Firewall rules are default (deny all ingress). What is the required action?

Accepted Answer

Add a firewall rule allowing ICMP from 10.0.1.0/24 to 10.0.2.0/24.. With VPC peering and custom route import/export enabled, routes are exchanged, so connectivity exists at the network layer. However, the default firewall rules deny all ingress, so ICMP traffic from subnet-a to subnet-b is blocked. To allow ping, a firewall rule must be added in vpc-b (or both VPCs) permitting ICMP from 10.0.1.0/24 to 10.0.2.0/24. This is the required action.

Answer

Add a static route for the peer range.

Answer

Enable Private Google Access.

Answer

Create a Cloud VPN tunnel.