PCNE Practice Test 23 — 15 Questions

Question 1

A global application uses a global external HTTPS load balancer with backend NEGs in multiple regions. The content is static and must be cached at edge locations to reduce latency. Which GCP service should be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud CDN. Cloud CDN is the correct service because it leverages Google's global edge cache network to cache static content from an external HTTPS load balancer with backend NEGs. When enabled, Cloud CDN intercepts requests at edge locations and serves cached responses, reducing latency and offloading origin servers. This directly addresses the requirement to cache static content at edge locations for a global application.

Answer

Cloud Storage

Answer

Cloud NAT

Answer

Cloud Memorystore

Question 2

A developer wants to allow HTTP (port 80) traffic from the internet to a set of Compute Engine instances that have a tag "web-server". Which firewall rule should they create?

Accepted Answer

Ingress rule: source 0.0.0.0/0, target tag "web-server", tcp:80. To allow HTTP traffic from the internet to specific instances, you need an ingress firewall rule. Ingress rules control incoming traffic, and you specify the source IP range (0.0.0.0/0 for internet), the target tags (web-server), and the protocol/port (tcp:80). This matches option B.

Answer

Egress rule: source 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Egress rule: destination 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Ingress rule: source 0.0.0.0/0, target service account "web-server", tcp:80

Question 3

A Compute Engine instance has multiple network interfaces. Which interface is considered the primary (NIC0)?

Accepted Answer

The interface with the lowest index number (nic0).. By default, the first interface attached (nic0) is the primary interface and used for default routes and internal DNS.

Answer

The interface configured first in the instance creation.

Answer

The interface with the highest index number.

Answer

All interfaces are primary.

Question 4

A company has a TCP-based application running on a group of Compute Engine VMs in us-central1. They need to provide a static internal IP address to clients within the VPC, while preserving the client source IP for logging. Which load balancer should they use?

Accepted Answer

Regional Internal TCP/UDP Load Balancer. The Regional Internal TCP/UDP Load Balancer is a pass-through load balancer that preserves client IP. It provides a static internal IP and operates at L4.

Answer

Regional Internal HTTP(S) Load Balancer

Answer

Regional External TCP/UDP Network Load Balancer

Answer

Global Internal HTTP(S) Load Balancer

Question 5

An organization wants to publish an internal web service running on Compute Engine to consumers in different VPCs. The service must be accessible via private IPs without VPC peering. Which THREE components are required to set this up using Private Service Connect?

Accepted Answer

A service attachment in the producer VPC that points to a load balancer. Private Service Connect requires a service attachment in the producer VPC (option C), which references a supported load balancer and exposes the service to consumers via a private IP; this is the producer-side resource that publishes the service. The referenced load balancer must be an internal TCP/UDP load balancer (option D), since PSC service attachments only support internal passthrough Network Load Balancers (and internal HTTP(S) LBs in newer configurations) as the backing target for the service. On the consumer side, a Private Service Connect endpoint (option E) is created in the consumer VPC, giving consumers a private IP that forwards traffic to the service attachment without requiring VPC peering. Option A is incorrect because PSC is specifically designed to avoid VPC peering between producer and consumer VPCs. Option B is incorrect because Cloud NAT provides outbound internet access for private instances and plays no role in publishing or consuming a service through Private Service Connect.

Answer

VPC peering between producer and consumer VPCs

Answer

A Cloud NAT gateway in the producer VPC

Question 6

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Accepted Answer

Cloud NAT logging with filter for errors

Answer

Firewall Rules logging

Answer

VPC Flow Logs on the subnet

Answer

Cloud Armor request logs

Question 7

A company has a GKE cluster with pods and services that need to communicate with on-premises resources over a VPN. The on-premises firewall requires the source IP of the pods to be from a specific range. Which secondary IP ranges should be configured on the VPC subnet?

Accepted Answer

Secondary pod range and secondary service range. In GKE, pods are assigned IP addresses from the secondary pod range, and services (of type ClusterIP) are assigned IPs from the secondary service range. For on-premises resources to allow traffic from pods via a VPN, the firewall must see the pod IPs (not node IPs), so the secondary pod range must be configured on the VPC subnet. The secondary service range is also required for service discovery and proper routing, but the source IP seen by on-premises will be the pod IP from the secondary pod range.

Answer

Primary IP range and secondary pod range

Answer

Only the secondary service range

Answer

Primary IP range and secondary service range

Question 8

You are troubleshooting a failing HA VPN tunnel between GCP and on-premises. The tunnel status shows 'Tunnel is down' in Cloud Console. Which TWO steps should you take to diagnose the issue? (Choose two.)

Accepted Answer

Check the on-premises firewall rules to ensure UDP ports 500 and 4500 are allowed. Checking Cloud VPN gateway logs for IKE errors helps identify authentication or configuration mismatch. Verifying that the on-premises firewall allows UDP 500 and 4500 for IPsec is necessary because many failures are due to firewall blocking.

Answer

Confirm that the GCP VPC has a firewall rule allowing inbound IPsec traffic

Answer

Verify that the Cloud Router BGP session is established

Answer

Ensure that the on-premises VPN gateway has a static route to the GCP VPC

Question 9

A media company uses Cloud CDN with signed URLs to distribute premium video content. They need to revoke access for a specific user immediately. Which approach should they take?

Accepted Answer

Delete the signed URL key that was used to sign the user's URL. Signed URLs are based on keys; to revoke access, you can either remove the key (invalidates all URLs signed with that key) or wait for expiration. There is no per-user revocation. The correct approach is to delete or disable the signing key, which invalidates all URLs signed with that key.

Answer

Use Cloud CDN cache invalidation to remove the user's content

Answer

Add the user's IP address to a deny list in the load balancer

Answer

Change the signing algorithm to SHA512

Question 10

A company has Compute Engine instances in a VPC that only have internal IP addresses. They need to access Google Cloud services like Cloud Storage and BigQuery. They also have on-premises servers that need to access the same instances via a Cloud VPN tunnel. What must be enabled for the instances to access Google APIs without public IPs?

Accepted Answer

Private Google Access. Private Google Access enables Compute Engine instances that have only internal IP addresses (no external IPs) to reach Google APIs and services such as Cloud Storage and BigQuery. It works by routing traffic destined for Google API IP ranges through the default internet gateway, using the VPC's internal DNS resolution to map the API hostnames to Google's internal IP addresses, without requiring a public IP on the instance.

Answer

Cloud Router

Answer

VPC peering

Answer

Cloud NAT

Question 11

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

Accepted Answer

Check VPN tunnel status, then Verify BGP session status, then Check firewall rules, then Verify routing tables, then Perform connectivity tests. Troubleshooting starts with tunnel status, then BGP, firewall, routing, and finally connectivity tests.

Answer

Verify routing tables, then Check firewall rules, then Check VPN tunnel status, then Verify BGP session status, then Perform connectivity tests

Answer

Verify BGP session status, then Check VPN tunnel status, then Check firewall rules, then Verify routing tables, then Perform connectivity tests

Answer

Perform connectivity tests, then Check VPN tunnel status, then Verify BGP session status, then Check firewall rules, then Verify routing tables

Question 12

A company has a VPC with subnets in us-central1 and europe-west1. They want to deploy a Cloud NAT to allow VMs in both regions to access the internet. How many Cloud NAT gateways are needed?

Accepted Answer

Two Cloud NAT gateways, one per region.. Cloud NAT is a regional resource; each region requires its own Cloud NAT gateway. A single gateway cannot cover multiple regions because Cloud NAT does not support global scope. For VMs in us-central1 and europe-west1 to access the internet, you need one Cloud NAT gateway per region, totaling two. Therefore, option C is correct. Option A is incorrect because Cloud NAT is necessary for private VMs to reach the internet without external IP addresses. Option B is incorrect because Cloud NAT operates at the region level, not per subnet; a regional gateway serves all subnets in that region. Option D is incorrect because Cloud NAT is regional, not global.

Answer

None; Cloud NAT is not required for internet access.

Answer

One Cloud NAT gateway per subnet.

Answer

One Cloud NAT gateway covering both regions.

Question 13

A developer needs to allow a VM in subnet A to reach a VM in subnet B in the same VPC. What is the default behavior?

Accepted Answer

The default firewall rule allows all internal traffic within the VPC.. In a VPC, the default firewall rule (often called 'default-allow-internal' or equivalent) permits all internal traffic between instances within the VPC, including across subnets. Since subnets in the same VPC are connected by the VPC's implicit routing, a VM in subnet A can reach a VM in subnet B without adding routes or firewall rules, provided the default rule is intact.

Answer

A custom route must be added to route between subnets.

Answer

A firewall rule must be added to allow traffic between subnets.

Answer

VPC peering is required for communication between subnets.

Question 14

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

Accepted Answer

Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.. Deploying two Cloud VPN tunnels from two Cloud Routers with BGP sessions provides high availability and automatic failover. The two Cloud Routers in different zones ensure redundancy, and BGP (Border Gateway Protocol) dynamically advertises routes and detects tunnel failures, allowing traffic to automatically switch to the healthy tunnel without manual intervention. This meets the requirement for an IPsec VPN connection to a third-party SaaS provider that only supports IPsec VPN.

Answer

Use Dedicated Interconnect with VLAN attachments to the SaaS provider.

Answer

Deploy a Classic VPN tunnel with policy-based routing.

Answer

Deploy a single Cloud VPN tunnel and use static routing.

Question 15

Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?

Accepted Answer

Create a Private Service Connect service attachment and publish the service.. The producer (VPC-A) must create a Private Service Connect service attachment that publishes the service. This attachment is associated with a load balancer or a service. Option A is incorrect because the endpoint is created in the consumer VPC (VPC-B). Option B is incorrect because VPC peering is not used with Private Service Connect (the services can be across organizations without peering). Option D is incorrect because Private Google Access is unrelated to publishing services.

Answer

Create a Private Service Connect endpoint in VPC-A.

Answer

Enable Private Google Access on the subnet where the service resides.

Answer

Create a VPC peering connection with VPC-B.