PCNE Practice Test 23 — 15 Questions

Question 1

A company wants to connect two VPCs in the same project using VPC Network Peering. Each VPC has non-overlapping subnets. What is the minimum number of peering connections required to enable full bidirectional communication?

Accepted Answer

Two peering connections: one from VPC1 to VPC2, and one from VPC2 to VPC1.. VPC Network Peering requires a peering connection to be established in each direction to enable full bidirectional communication. A single peering connection from VPC1 to VPC2 only allows VPC1 to initiate traffic to VPC2; for VPC2 to initiate traffic back to VPC1, a separate peering connection from VPC2 to VPC1 is needed. Therefore, two peering connections (one from each VPC to the other) are the minimum required.

Answer

One peering connection from VPC1 to VPC2.

Answer

Two peering connections from each VPC to the other (total four).

Answer

A Shared VPC with subnetworks from both VPCs.

Question 2

A startup is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose a service to the internet using a load balancer that provides SSL termination and supports WebSocket. Which type of Service should they use?

Accepted Answer

Create a Service of type LoadBalancer with an HTTP(S) load balancer.. A Service of type LoadBalancer with an HTTP(S) load balancer is correct because it provides a public IP address, handles SSL termination at the load balancer level, and natively supports WebSocket connections without additional configuration. This is the simplest and most direct way to expose a microservice to the internet with these requirements on GKE.

Answer

Create a Service of type ClusterIP and use an Ingress resource with a backendConfig.

Answer

Create a Service of type NodePort and configure an external TCP/UDP load balancer.

Answer

Create a Headless Service with an external DNS A record pointing to the pod IPs.

Question 3

Which THREE components are necessary to configure a global external HTTP(S) load balancer with Cloud CDN and an origin backend that requires authentication? (Choose three.)

Accepted Answer

An origin access identity (e.g., service account) to authenticate to the backend.. Option C is correct because when the origin backend (e.g., an external HTTP server or a custom origin) requires authentication, you must configure an origin access identity, typically a Google-managed service account, to authenticate requests from Cloud CDN to the origin. This ensures that only authorized CDN edge caches can fetch content from the backend, preventing direct unauthenticated access.

Answer

A TCP or SSL proxy for protocol optimization.

Answer

A regional external HTTP(S) load balancer as the entry point.

Question 4

A company wants to serve global static content from a Cloud Storage bucket. They need low latency worldwide and SSL termination at the edge. Which solution should they choose?

Accepted Answer

Configure a global external HTTP(S) load balancer with a backend bucket.. A global external HTTP(S) load balancer with a backend bucket is the correct choice because it provides SSL termination at the edge (using Google Front Ends) and routes traffic over Google's global network to the nearest Cloud Storage bucket, ensuring low latency worldwide. The HTTP(S) load balancer supports global anycast IP addresses and integrates natively with Cloud Storage backends, making it ideal for serving static content globally.

Answer

Use a TCP/UDP network load balancer with the bucket as backend.

Answer

Deploy an internal TCP/UDP load balancer with the bucket as backend.

Answer

Set up Cloud CDN directly on the bucket without a load balancer.

Question 5

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

Accepted Answer

Configure Cloud Router in the host project to advertise all subnets via BGP.. Option C is correct because in a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Answer

Configure Cloud NAT in each service project for on-prem access.

Answer

Use VPC peering between the host project and each service project.

Answer

Create separate Interconnect VLAN attachments for each service project.

Question 6

A company has an on-premises data center connected to GCP via Cloud VPN with dynamic routing (BGP). Recently, connectivity to a specific subnet (10.1.0.0/16) in GCP became intermittent. The VPN tunnel is up, and BGP sessions are established. What is the most likely cause?

Accepted Answer

The Cloud Router is not advertising the correct subnet range to the on-premises router.. Since the VPN tunnel is up and BGP sessions are established, the issue is not with the tunnel or BGP peering itself. Intermittent connectivity to a specific subnet (10.1.0.0/16) while other subnets remain reachable strongly indicates a route advertisement problem. The Cloud Router must be configured to advertise the correct subnet range to the on-premises router via BGP; if it is not, the on-premises router will lack a route for that subnet, causing intermittent or no connectivity.

Answer

The shared secret is misconfigured.

Answer

The VPN tunnel is flapping due to packet loss.

Answer

A firewall rule is blocking traffic from on-premises.

Question 7

An organization is deploying a Shared VPC with one host project and three service projects. Each service project has multiple VPC networks. They want to ensure that only the host project's network admin can create firewall rules affecting the shared VPC network. Which architecture satisfies this requirement?

Accepted Answer

Create the shared VPC network in the host project and grant the network admin IAM role only to host project users.. In a Shared VPC architecture, the host project owns the shared VPC network, and only IAM roles granted in the host project can manage that network's resources. By creating the shared VPC network in the host project and granting the network admin IAM role exclusively to host project users, you ensure that only those users can create firewall rules for the shared VPC. Service project users cannot modify the shared network's firewall rules because they lack the necessary IAM permissions on the host project.

Answer

Use VPC Network Peering between each service project and the host project, and allow each service project admin to manage their own firewall rules.

Answer

Assign the network admin role to users in each service project for the shared VPC network.

Answer

Create separate VPC networks in each service project and use VPC Network Peering to interconnect them.

Question 8

A network engineer notices unusual traffic patterns from a VM. They want to capture detailed information about each packet sent and received by the VM, including source and destination IPs, protocols, and ports. Which feature should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IPs, protocols, and ports. This feature is designed specifically for analyzing traffic patterns and troubleshooting connectivity issues at the network layer, making it the correct choice for the described requirement.

Answer

Packet Mirroring

Answer

Cloud Audit Logs

Answer

Firewall Rules Logging

Question 9

An organization has a Dedicated Interconnect with Cloud Router configured for BGP. The on-premises network advertises a prefix that overlaps with an existing VPC subnet. How does Google Cloud handle the overlapping prefix?

Accepted Answer

It rejects the prefix and does not install a dynamic route for it.. When a Dedicated Interconnect with Cloud Router receives a BGP advertisement for a prefix that overlaps with an existing VPC subnet, Google Cloud rejects the prefix and does not install a dynamic route for it. This is because VPC subnet routes always take precedence over dynamically learned routes, and accepting an overlapping prefix would create ambiguity in forwarding decisions. The Cloud Router enforces this behavior to maintain the integrity of the VPC's internal addressing.

Answer

It accepts the prefix but static routes have higher priority.

Answer

It accepts the prefix and gives it higher priority than the VPC subnet.

Answer

It accepts the prefix and load balances traffic between the two locations.

Question 10

Which THREE factors should be considered when choosing between a global external HTTP(S) load balancer and a regional external HTTP(S) load balancer? (Choose 3.)

Accepted Answer

SSL termination at the edge (global) vs. at the backend (regional).. Regional external HTTP(S) load balancers terminate SSL at the backend (the backend service or instance), meaning the encrypted traffic must travel to the backend before decryption. Global external HTTP(S) load balancers terminate SSL at the edge (Google Front End), decrypting traffic at the closest point of presence and forwarding plaintext HTTP to the backend. This architectural difference impacts security, latency, and backend processing requirements, making it a key factor in choosing between the two.

Answer

Support for multiple backend types (Compute Engine, GKE, serverless).

Answer

Ability to use health checks.

Question 11

A company uses Cloud NAT for outbound internet access. Engineering notices that some VM instances fail to connect to external services during peak hours. The network engineer suspects port exhaustion. Which action would best mitigate this issue?

Accepted Answer

Increase the number of NAT IP addresses assigned to the NAT gateway.. Port exhaustion occurs when the NAT gateway runs out of available source ports to map outbound connections. Increasing the number of NAT IP addresses assigned to the gateway multiplies the available port range (each IP provides 64,512 ports), directly alleviating port exhaustion during peak traffic. This is the standard mitigation for port exhaustion in Cloud NAT.

Answer

Change the NAT type from standard to public.

Answer

Enable TCP keepalive on the NAT gateway.

Answer

Reduce the number of NAT gateways in the region.

Question 12

You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?

Accepted Answer

The domain is not verified for the Google-managed certificate on the frontend.. When a Google-managed certificate is used on the frontend of an SSL proxy load balancer, the domain must be verified via DNS or a challenge file. If the domain is not verified, the certificate cannot be provisioned or validated, causing a mismatch between the certificate's Subject Alternative Names (SANs) and the domain clients are connecting to, resulting in SSL errors.

Answer

The SSL policy is configured to require TLS 1.3 only.

Answer

The backend self-managed certificate is not signed by a public CA.

Answer

The backend service must use a Google-managed certificate as well.

Question 13

A gaming company uses Cloud Armor with an external HTTP(S) load balancer to protect against DDoS attacks. They need to restrict access to the load balancer based on geographic region. What should they configure?

Accepted Answer

Geo-match custom rule in Cloud Armor. Cloud Armor supports geo-match custom rules that allow you to allow or deny traffic based on the geographic region of the client IP address. When attached to an external HTTP(S) load balancer, these rules are evaluated at the edge before traffic reaches the backend, providing effective geo-based access control against DDoS attacks.

Answer

Geo-based routing policy on the backend service

Answer

A firewall rule that blocks IPs from certain countries

Answer

Use Cloud CDN with geo filtering

Question 14

Refer to the exhibit. A Cloud Router has two BGP sessions. The first session is UP, the second is DOWN. What is the most likely cause for the second session being down?

Accepted Answer

The session initialization mode is set to PASSIVE.. The second session has sessionInitializationMode set to PASSIVE. If the peer router is also configured as PASSIVE, the BGP session will never establish. The first session is ACTIVE, so it came up. This is a common misconfiguration.

Answer

The advertised route priority is too low.

Answer

The peer IP address 169.254.1.2 is not routable.

Answer

The BFD multiplier is too low (3).

Question 15

Your company uses Network Connectivity Center (NCC) to manage multiple on-premises sites connected via Cloud VPN and Partner Interconnect. You create a NCC hub and attach spokes (VPN tunnels and VLAN attachments). Traffic between two on-premises sites (Site A and Site B) should flow through Google Cloud. However, traffic is not passing between the sites. What is the most likely cause?

Accepted Answer

The VPN spokes do not have custom dynamic route exchange enabled, so routes from Site A are not advertised to Site B.. Option A is correct because NCC routes will only propagate if the spokes are configured with the proper route exchange options. By default, custom dynamic route exchange is not enabled for VPN tunnels; you need to configure advertisement of routes. Option B is wrong because NCC supports VPN and Interconnect. Option C is wrong because NCC uses dynamic routing; static routes are not required. Option D is wrong because VPC networks are not directly involved if using NCC hub-and-spoke.

Answer

The on-premises routers need static routes pointing to the Google Cloud VPC for inter-site traffic.

Answer

Network Connectivity Center does not support Cloud VPN as a spoke type.

Answer

The NCC hub must be in the same VPC network as the sites' VPCs.