PCNE Practice Test 22 — 15 Questions

Question 1

Which THREE are valid considerations when planning IP address ranges for VPCs that will be connected via VPC Peering and Cloud VPN? (Choose 3)

Accepted Answer

Plan for future growth by leaving unused CIDR blocks.. Avoid overlapping ranges, use RFC 1918 addresses, and ensure unique ranges for each subnet.

Answer

Use overlapping IP ranges to conserve address space.

Answer

Use public IP ranges for all VMs.

Question 2

A network engineer is configuring HA VPN between an on-premises network and GCP. They have created two external VPN gateways in GCP (one per region) and two Cloud Routers. How many IKEv2 tunnels and BGP sessions are required to achieve the 99.99% SLA?

Accepted Answer

Four tunnels, four BGP sessions. HA VPN requires four tunnels (two per gateway) and four BGP sessions (one per tunnel) to achieve 99.99% SLA.

Answer

Two tunnels, two BGP sessions

Answer

Four tunnels, two BGP sessions

Answer

Two tunnels, four BGP sessions

Question 3

A company has multiple GCP projects that need to resolve DNS queries for a private zone (e.g., example.internal) that is hosted in a central project. They want to avoid copying zone data. Which TWO features can be used to achieve this? (Choose TWO.)

Accepted Answer

DNS peering. DNS peering allows a zone to be shared from one project to another. Shared VPC can also enable DNS resolution if the private zone is attached to the shared VPC host project and service projects use that VPC. However, DNS peering is more direct. Outbound forwarding is for on-premises resolution, not cross-project. Inbound forwarding is for on-premises to Cloud DNS. Private zones are per-project and don't automatically resolve cross-project.

Answer

Outbound DNS forwarding

Answer

Creating duplicate private zones in each project

Answer

Inbound DNS forwarding

Question 4

A company uses Shared VPC to grant separate teams access to subnets in a host project. They want to allow Team A to create VM instances in subnet-1, but not delete the subnet itself. Which IAM role should be granted to Team A on subnet-1?

Accepted Answer

roles/compute.networkUser. The Compute Network User role (roles/compute.networkUser) grants permissions to use existing networks and subnets (create VMs, attach disks, etc.) but not to delete or modify network resources.

Answer

roles/owner

Answer

roles/compute.networkAdmin

Answer

roles/compute.instanceAdmin.v1

Question 5

An engineer needs to plan IP address ranges for a new GCP environment that will connect to an on-premises network via Dedicated Interconnect. The on-premises network uses 10.0.0.0/8. The GCP VPC must support GKE pods and services and future expansion. Which THREE best practices should the engineer follow? (Choose three.)

Accepted Answer

Plan secondary IP ranges for GKE pods and services. Best practices: Use RFC 1918 private ranges, avoid overlapping with on-premises, plan secondary ranges for GKE (pods and services), and use non-overlapping ranges for future expansion.

Answer

Use the same IP range as on-premises for simplicity

Answer

Use a public IP range for the VPC to avoid overlap

Question 6

An organization needs to create a VPC that automatically creates subnets in every region as new regions become available. Which VPC type should they use?

Accepted Answer

Auto mode VPC. Auto mode VPCs create subnets in all regions automatically and expand to new regions as they become available.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Custom mode VPC

Question 7

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.0.0.0/16). They want to establish VPC Network Peering between them. What is the outcome?

Accepted Answer

Peering fails because subnets overlap. VPC Network Peering requires that the subnets in the two VPCs do not overlap. Since both VPCs use the same CIDR block (10.0.0.0/16), peering will fail due to subnet overlap.

Answer

Peering succeeds, and only non-overlapping subnets are used

Answer

Peering succeeds, and routes are exchanged, but traffic may be unpredictable

Answer

Peering succeeds, but routes are not exchanged

Question 8

A company wants to create a new VPC for a production environment. They need predictable IP addresses and want to avoid any automatic subnet creation. Which type of VPC should they use?

Accepted Answer

Custom mode VPC. Custom mode VPCs do not create subnets automatically, giving full control over IP ranges.

Answer

Legacy VPC

Answer

Shared VPC

Answer

Auto mode VPC

Question 9

A company has an on-premises data center connected to GCP via Cloud Interconnect. They want to expose an on-premises service to internet clients through Google Cloud's global load balancer. Which type of network endpoint group should they use?

Accepted Answer

Hybrid connectivity NEG. Hybrid connectivity NEGs allow you to expose on-premises destinations via Cloud Interconnect or VPN to a load balancer.

Answer

Zonal NEG

Answer

Internet NEG

Answer

Serverless NEG

Question 10

A company uses Cloud DNS. They want to override DNS resolution for a specific domain (e.g., mycompany.com) to point to an internal IP for all queries originating from their VPC, while leaving all other domains unaffected. Which Cloud DNS feature should they use?

Accepted Answer

A response policy zone (RPZ). Response Policy Zones (RPZ) allow you to create a local override zone that takes precedence over public DNS for specified domains within a VPC.

Answer

DNSSEC

Answer

A routing policy with a geo location rule

Answer

A managed private zone

Question 11

An engineer needs to provide outbound internet access to Compute Engine instances that do not have external IP addresses. The solution must allow instances to access a specific set of external IPs only. What should the engineer configure?

Accepted Answer

Create a Cloud NAT gateway and configure firewall egress rules to allow traffic only to the specific IPs.. Cloud NAT with firewall rules can restrict outbound traffic to specific destinations. By default, Cloud NAT uses the instance's network tags and firewall egress rules to control traffic. The engineer can create an egress deny rule with higher priority for all destinations, then an egress allow rule for the specific IPs.

Answer

Use Private Google Access only, which provides access to Google APIs and services.

Answer

Assign external IPs to instances and use firewall rules to restrict outbound traffic.

Answer

Deploy a NAT instance with iptables rules to restrict destination IPs.

Question 12

An organization wants to publish an internal web service running on Compute Engine to consumers in different VPCs. The service must be accessible via private IPs without VPC peering. Which THREE components are required to set this up using Private Service Connect?

Accepted Answer

A service attachment in the producer VPC that points to a load balancer. Private Service Connect requires a service producer to create a service attachment (which uses a load balancer as the backend), and consumers to create Private Service Connect endpoints. The producer must also enable Private Service Connect on the subnet where the load balancer resides.

Answer

VPC peering between producer and consumer VPCs

Answer

A Cloud NAT gateway in the producer VPC

Question 13

A company needs a hybrid connectivity solution with a bandwidth of 500 Mbps and a 99.9% SLA. They do not have a presence in a colocation facility that supports Dedicated Interconnect. Which GCP service should they use?

Accepted Answer

Partner Interconnect. Partner Interconnect provides connectivity through a supported service provider with bandwidth from 50 Mbps to 10 Gbps and offers 99.9% or 99.99% SLA. It does not require colocation facility access.

Answer

Classic VPN

Answer

HA VPN

Answer

Dedicated Interconnect

Question 14

A company has two VPCs in the same project: vpc-a (10.0.0.0/8) and vpc-b (10.0.0.0/8). They plan to peer these VPCs using VPC Network Peering. Which two prerequisites are required for the peering to work? (Choose TWO.)

Accepted Answer

The VPCs must have non-overlapping IP CIDR ranges.. For VPC peering, the CIDR ranges must not overlap. Additionally, the 'export custom routes' and 'import custom routes' flags must be set correctly if custom routes are needed; but the basic requirement is no overlapping subnets. Also, VMs must have firewall rules allowing traffic.

Answer

At least one VM must exist in each VPC before peering.

Answer

The project must have a Shared VPC host project configured.

Answer

Both VPCs must be in custom mode.

Question 15

An engineer needs to allow HTTP health checks from the Google Cloud health checker IP ranges to a set of instances. Which two methods can be used to target the firewall rule correctly? (Choose two.)

Accepted Answer

Use target service accounts on the instances.. Firewall rules can target instances using tags or service accounts. The health checker IP ranges are well-known and can be used as source.

Answer

Use source service accounts on the health checkers.

Answer

Use source tags on the health checkers.

Answer

Use instance names in the firewall rule.