PCNE Practice Test 23 — 15 Questions

Question 1

An engineer is configuring a Google Compute Engine instance that needs to send traffic to the internet. The instance has no external IP address. Which service must be configured to allow this outbound connectivity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud NAT. Cloud NAT provides outbound internet connectivity for instances without external IPs. It translates private IPs to a public IP and allows instances to reach the internet.

Answer

Cloud VPN

Answer

VPC peering

Answer

Private Google Access

Question 2

An organization needs to prevent exfiltration of data from a Cloud Storage bucket to external IPs. The bucket is accessed by Compute Engine instances in a VPC. The instances need to read and write data to the bucket but should not be able to copy data to external networks. Which combination of controls meets this requirement?

Accepted Answer

Configure VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. VPC Service Controls create a service perimeter that restricts data movement between Google services and external networks. Within the perimeter, data can flow between authorized services. IAM conditions can further restrict access based on context. This is the primary method to prevent data exfiltration from Google Cloud-managed services.

Answer

Use Cloud Armor with a WAF rule to block outbound traffic.

Answer

Set up Private Google Access and restrict IAM permissions to the bucket.

Answer

Use Cloud NAT with a firewall rule that denies all egress except to Google APIs.

Question 3

A company wants to restrict access to Google Cloud APIs from a specific VPC network so that only the Google APIs listed in the VPC Service Controls perimeter can be accessed. Which configuration should be used?

Accepted Answer

VPC Service Controls with VPC accessible services. VPC Service Controls allow you to define perimeters around Google Cloud resources, restricting access to Google APIs based on the perimeter's configuration. VPC accessible services is a feature within VPC Service Controls that limits access to only the APIs listed in the perimeter.

Answer

Private Service Connect

Answer

Private Google Access

Answer

Cloud NAT with a firewall rule

Question 4

What is the default MTU for Compute Engine instances on Google Cloud?

Accepted Answer

1460. The default MTU for Google Cloud VMs is 1460 bytes to accommodate encapsulation overhead.

Answer

9000

Answer

1400

Answer

1500

Question 5

A company has a VPC with a subnet in us-central1. They launched a Compute Engine instance named "app-server" in that subnet without an external IP. They need the instance to be able to download updates from the internet. Which two steps must be taken?

Accepted Answer

Create a Cloud NAT gateway and a Cloud Router in us-central1.. The instance needs outbound internet access via Cloud NAT, which requires a Cloud Router in the region.

Answer

Configure Private Google Access on the subnet.

Answer

Create a VPC firewall rule to allow egress to 0.0.0.0/0.

Answer

Assign a static external IP to the instance.

Question 6

A company wants to resolve DNS queries from their on-premises network for a privately hosted zone in Google Cloud (e.g., example.internal). They also want on-premises DNS servers to resolve GCP internal VM hostnames. Which two Cloud DNS features should they implement? (Choose TWO.)

Accepted Answer

DNS peering. DNS peering allows on-premises to query GCP private zones, and DNS forwarding (inbound) allows GCP to forward queries to on-premises DNS servers.

Answer

Public zone delegation

Answer

DNS forwarding (outbound)

Answer

Split-horizon DNS

Question 7

You are deploying a third-party network appliance (e.g., firewall) in a GCP VPC. The appliance requires multiple network interfaces for traffic isolation. You create a VM with three NICs in different subnets. What is a key consideration for routing traffic through the appliance?

Accepted Answer

Custom routes must be created to direct traffic to a specific NIC using the VM's IP as next hop.. Each NIC in a multi-NIC VM is assigned to a different subnet. By default, the VM only sends traffic out of the NIC that matches the destination subnet's route. To route traffic through a specific NIC, custom routes with next hop set to the VM's IP on that NIC are required.

Answer

The VM must have an external IP on each NIC.

Answer

The VM must have IP forwarding disabled.

Answer

All NICs must be in the same subnet.

Question 8

Which THREE of the following are benefits of using hierarchical firewall policies? (Select 3)

Accepted Answer

They can be applied at the organization, folder, or project level. Hierarchical firewall policies provide centralized management, inherit down the resource hierarchy, and can apply at the organization level. They support both allow and deny rules, and can be used to enforce baseline security.

Answer

They can be used to restrict access to specific Google APIs

Answer

They override network firewall rules with the same priority

Question 9

A company wants to apply consistent firewall rules across all projects in an organization. They need to block all traffic to ports 22 and 3389 from the internet to any VMs in any project. Which approach is most scalable and maintainable?

Accepted Answer

Use a hierarchical firewall policy at the organization level with deny rules for ports 22 and 3389 from 0.0.0.0/0.. Hierarchical firewall policies allow you to define firewall rules at the organization or folder level that apply to all VPCs under that node. This ensures consistency and avoids duplication across projects. The policy is evaluated before VPC firewall rules.

Answer

Configure OS-level firewall on each VM using startup scripts.

Answer

Use Cloud Armor security policies attached to load balancers.

Answer

Create a VPC firewall rule in each project's VPC.

Question 10

A company is designing a VPC for a multi-tier web application. They need to ensure that the web servers can be reached from the internet, but the database servers should only be accessible from the web servers. Which three components should they use to achieve this? (Choose THREE.)

Accepted Answer

External IP addresses on the web servers. Firewall rules control traffic between tiers; Cloud NAT provides outbound internet for private instances; and external IPs allow inbound internet traffic to web servers.

Answer

VPC Network Peering with a partner network

Answer

Shared VPC

Question 11

A company is designing hybrid connectivity between on-premises and GCP. The on-premises network has multiple VPN gateways that support BGP. They require high availability with an SLA of 99.99% and want to use Cloud VPN. Which TWO configurations are required? (Choose two.)

Accepted Answer

Two Cloud VPN gateways. HA VPN provides 99.99% SLA with two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP. Two Cloud VPN gateways and four tunnels are needed.

Answer

Static routing

Answer

One Cloud VPN gateway with two interfaces

Answer

Policy-based VPN

Question 12

An organization needs to protect a web application behind an HTTPS Load Balancer from SQL injection attacks. They want to use a managed WAF solution. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities including preconfigured rules for SQL injection (OWASP) and custom rules.

Answer

VPC Service Controls

Answer

Cloud Firewall Rules

Answer

Cloud CDN

Question 13

Which Cloud DNS zone type is used to resolve DNS names for resources within a VPC network, and is not accessible from the internet?

Accepted Answer

Private managed zone. Private managed zones are associated with one or more VPC networks and are used for internal DNS resolution. Public managed zones are for internet-facing DNS.

Answer

Peering zone

Answer

Forwarding zone

Answer

Public managed zone

Question 14

A company wants to protect its external HTTPS load balancer from SQL injection and cross-site scripting attacks. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities including preconfigured rules for OWASP Top 10 threats like SQLi and XSS, and can be attached to HTTPS load balancers.

Answer

VPC Service Controls

Answer

Cloud Firewall

Answer

Cloud IDS

Question 15

A company uses Shared VPC to centralize network management. The host project contains subnets for production and development environments. Which two statements accurately describe the capabilities of Shared VPC? (Choose TWO.)

Accepted Answer

Service project VMs can use internal IP addresses from the shared subnets.. Shared VPC allows a host project to share subnets with service projects. IAM on shared subnets can be delegated to service project administrators, and VMs in service projects can use internal IPs from the shared subnets.

Answer

Shared VPC supports transitive peering across service projects.

Answer

Service project administrators can create subnets in the host project.

Answer

Service projects cannot have their own VPCs when using Shared VPC.