PCNE Practice Test 24 — 15 Questions

Question 1

A company uses Cloud NAT with a static NAT IP address. They notice that connections from their instances are failing after a few minutes. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway is using dynamic port allocation and running out of ports. Cloud NAT with a static NAT IP address uses dynamic port allocation, and if the number of concurrent connections exceeds the available ports, new connections fail. The most likely cause of connections failing after a few minutes is that the Cloud NAT gateway is running out of ports due to dynamic port allocation. This is a common issue when many instances share a single NAT IP and the port range is exhausted.

Answer

The instance's external IP is conflicting with the NAT IP

Answer

The NAT IP address is not whitelisted on the target

Answer

The VPC network has a firewall rule blocking egress

Question 2

Which statement about Cloud Armor security policies is true?

Accepted Answer

They support both allow and deny actions for incoming requests.. Cloud Armor security policies are applied at the HTTP(S) Load Balancer layer and support both allow and deny rules for incoming requests, enabling granular control over traffic based on IP ranges, geographic regions, and other attributes. The deny action is essential for blocking malicious traffic, while allow rules permit legitimate requests. This dual-action capability distinguishes Cloud Armor from simple firewall rules that primarily allow or deny based on network-level criteria.

Answer

They can be attached to any GCP resource, including Compute Engine instances.

Answer

They are evaluated after the firewall rules.

Answer

They cannot be used with internal load balancers.

Question 3

A media company runs a stateless video transcoding service on a managed instance group in europe-west1. The service must accept inbound connections from any source over TCP port 8443, and the operations team wants to minimize the attack surface by allowing only that port. Which Google Cloud firewall rule configuration should you deploy?

Accepted Answer

Create an ingress rule with action allow, direction INGRESS, source ranges 0.0.0.0/0, allowed protocol tcp and port 8443, and target tags applied to the instance template.. Inbound client traffic to a stateless service requires an ingress allow rule scoped to the workload. Specifying direction INGRESS, source 0.0.0.0/0, TCP port 8443, and a target tag that is applied to the managed instance group confines the permission to the transcoding VMs while the implied deny covers all other ports. Egress rules, private-only source ranges, or deny actions cannot satisfy the stated connectivity and least-privilege goals.

Answer

Create an egress rule with action allow, direction EGRESS, destination ranges 0.0.0.0/0, allowed protocol tcp and port 8443, and a target service account.

Answer

Create an ingress rule with action allow, direction INGRESS, source ranges 10.0.0.0/8, allowed protocol tcp and port 8443, with priority 1000 and no target specification.

Answer

Create an ingress rule with action deny, direction INGRESS, source ranges 0.0.0.0/0, denied protocol tcp and port 8443, and a target tag on the instance template.

Question 4

Which THREE considerations are important when designing a Cloud CDN configuration for a global web application that serves both static and dynamic content?

Accepted Answer

Configure the cache key to ignore query parameters that are session-specific to improve cache hit ratio.. Option B is correct because including session-specific query parameters in the cache key fragments the cache and lowers the hit ratio; excluding them via a custom cache key lets Cloud CDN serve the same cached object to many users. Option C is correct because FORCE_CACHE_ALL overrides origin Cache-Control headers so static assets are cached aggressively, while USE_ORIGIN_HEADERS respects the origin's directives for dynamic content that may need short or no caching. Option D is correct because Cloud CDN origin shield adds an intermediate caching layer that collapses requests from multiple edge locations into fewer origin fetches, reducing origin load and latency. Option A is not appropriate here because negative caching of 404s can mask legitimate content and is not a core design consideration for mixed static/dynamic delivery. Option E is not appropriate because signing all content would break public caching and defeat the CDN's ability to serve shared cached objects to anonymous users.

Answer

Enable negative caching for 404 responses to prevent unnecessary backend hits.

Answer

Use signed URLs for all content to ensure only authenticated users can access it.

Question 5

An organization wants to distribute incoming HTTPS traffic across a set of Compute Engine instances in multiple regions, with SSL termination at the Google Cloud edge. They also need to protect against DDoS attacks at the edge. Which load balancing solution should they choose?

Accepted Answer

Global External HTTP(S) Load Balancer. The Global External HTTP(S) Load Balancer is a Layer 7 proxy that terminates SSL at Google's edge, distributes HTTPS traffic across backends in multiple regions, and integrates with Google Cloud Armor for edge DDoS protection. It is the only option that combines global anycast, SSL termination at the edge, and HTTP(S) awareness. SSL Proxy and Network Load Balancers operate at lower layers and do not provide HTTP(S) routing or Cloud Armor integration.

Answer

SSL Proxy Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 6

A team is deploying a new service in a Compute Engine instance without an external IP in subnet-b. The service needs to access Google Cloud Storage using internal IPs. What must the team do to enable this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a Compute Engine instance without an external IP address to reach Google APIs and services (including Cloud Storage) over the internal VPC network using RFC 1918 addresses. By enabling this feature on subnet-b, the instance can access Cloud Storage via internal IPs without needing an external IP or NAT gateway. This is the correct and minimal configuration for the requirement.

Answer

Assign an external IP address to the instance.

Answer

Move the instance to subnet-a where Private Google Access is already enabled.

Answer

Set up Cloud NAT on the VPC to allow outbound access to Google APIs.

Question 7

A company wants to allow instances in a VPC without external IPs to access Google APIs like BigQuery and Cloud Storage. Which configuration is required?

Accepted Answer

Enable Private Google Access on the subnet. Private Google Access enables instances without external IPs to reach Google APIs via internal IP addresses using the private.googleapis.com (199.36.153.8/30) or restricted.googleapis.com (199.36.153.4/30) VIPs. It must be enabled per subnet.

Answer

Create a VPC peering with the Google APIs VPC

Answer

Assign external IPs to all instances

Answer

Configure a Cloud NAT gateway in the region

Question 8

A company needs to connect multiple on-premises sites to Google Cloud using a single Cloud VPN gateway. What is the recommended approach?

Accepted Answer

Create multiple VPN tunnels, each with its own BGP session to a Cloud Router.. When connecting multiple on-premises sites to Google Cloud using a single Cloud VPN gateway, the recommended approach is to create multiple VPN tunnels, each with its own BGP session to a Cloud Router. This allows the Cloud VPN gateway to terminate multiple tunnels, and each tunnel can have a unique BGP session for dynamic route exchange, enabling the gateway to learn and advertise routes for each site independently. Using a single tunnel with multiple BGP sessions or policy-based routing is not supported because a Cloud VPN tunnel is a point-to-point connection that can only have one BGP session per tunnel, and static routes would not provide the redundancy or dynamic failover needed for multiple sites.

Answer

Create a single VPN tunnel and use policy-based routing to direct traffic.

Answer

Use a single VPN tunnel with multiple BGP sessions.

Answer

Create a single VPN tunnel and use static routes for each site.

Question 9

A company runs a stateful TCP application on a zonal Managed Instance Group (MIG). They need to expose it to the internet using a load balancer that preserves the client IP address. Which TWO load balancer types meet this requirement? (Choose two.)

Accepted Answer

Regional External TCP/UDP Network Load Balancer. The requirement is for a load balancer that exposes a stateful TCP application to the internet while preserving client IP. The Regional External TCP/UDP Network Load Balancer (option E) is a passthrough load balancer that forwards packets directly to the backend instances, preserving the client IP. The other options (A, B, D) are proxy load balancers that terminate connections and do not preserve client IP. Option C is an internal load balancer that cannot directly expose the application to the internet.

Answer

Global External HTTPS Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Regional Internal TCP/UDP Network Load Balancer

Answer

Global SSL Proxy Load Balancer

Question 10

A company needs to connect their on-premises network to Google Cloud with high availability and load balancing across multiple tunnels. They plan to use HA VPN. Which TWO of the following are required to achieve active-active load balancing across multiple tunnels?

Accepted Answer

Configure the on-premises router to enable ECMP. For active-active load balancing, Cloud Router BGP must advertise the same routes with identical attributes, and the on-premises router must support ECMP. Often, two tunnels are configured as a pair. The on-premises router must be configured to accept equal-cost routes.

Answer

Use AS path prepending on one tunnel

Answer

Use different MED values for each tunnel

Answer

Configure static routes instead of BGP

Question 11

An organization wants to isolate development and production environments using separate VPC networks within the same project. They need the development VPC to have access to a shared service, such as a Cloud SQL instance, which resides in a separate project. Which THREE actions are required to achieve this? (Choose THREE.)

Accepted Answer

Configure Shared VPC with the Cloud SQL project as the host project. To allow a development VPC in one project to privately access a Cloud SQL instance in a separate project, the recommended approach is to use Shared VPC. The project containing the Cloud SQL instance becomes the host project (A). Private Services Access must be enabled on the host VPC to allocate private IP addresses for the Cloud SQL instance (D). The development project is then attached as a service project to the shared VPC host project, allowing the development VPC to use subnets from the host project and thereby reach the Cloud SQL instance privately (E). VPC peering is not required because Shared VPC provides the connectivity. Firewall rules are needed but not sufficient alone; the correct three actions are A, D, and E.

Answer

Create a firewall rule allowing ingress from the Cloud SQL instance to the development VPC

Answer

Configure VPC Network Peering between the development VPC and the Cloud SQL VPC

Question 12

An engineer is troubleshooting a firewall rule issue. A VM with network tag 'web' is unable to receive HTTP traffic from the internet. The VPC has an ingress firewall rule allowing tcp:80 from 0.0.0.0/0 to targets with tag 'web' at priority 1000. Another ingress rule denies all ingress traffic at priority 65535. What is the likely cause?

Accepted Answer

The VM does not have the network tag 'web' assigned. The allow rule targets VMs with network tag 'web'. If the VM does not have this tag, the rule does not apply, and the default deny ingress rule (priority 65535) blocks the HTTP traffic. The priority ordering is correct (allow at 1000 is higher than deny at 65535), but the tag mismatch prevents the allow rule from being effective.

Answer

The firewall rule is an egress rule instead of ingress

Answer

The priority of the allow rule is lower (higher number) than the deny rule

Answer

The VM has an external IP but the firewall rule only applies to internal IPs

Question 13

A company wants to expose a web application running on Cloud Run globally with a single anycast IP address, using HTTP(S) load balancing and Cloud CDN for static content. The application should be accessible at https://app.example.com. What is the correct configuration?

Accepted Answer

Create a global external HTTP(S) load balancer with a serverless NEG that points to the Cloud Run service.. A global external HTTP(S) load balancer with a serverless NEG is the correct way to expose Cloud Run globally behind a single anycast IP with Cloud CDN support. Serverless NEGs are the only NEG type that can target Cloud Run services, and the global external HTTP(S) load balancer provides the anycast IP and integrates with Cloud CDN for static content. This configuration also supports the custom domain https://app.example.com via a managed SSL certificate.

Answer

Create a global SSL Proxy load balancer with a Cloud Run backend bucket.

Answer

Create a global TCP Proxy load balancer with a hybrid connectivity NEG.

Answer

Create a regional external HTTP(S) load balancer with a serverless NEG.

Question 14

A company is creating a new VPC to host a set of microservices on Compute Engine. The network architect wants to minimize operational overhead and allow automatic subnet creation as new regions are added. Which VPC mode should be used?

Accepted Answer

Auto mode VPC. Auto mode VPC automatically creates a subnet in each Google Cloud region using predefined IP ranges, so as new regions are added, subnets appear without manual intervention. This minimizes operational overhead and matches the architect's requirement for automatic subnet creation. Custom mode requires manually defining every subnet, and Shared VPC/Peering address different connectivity needs.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 15

A network engineer notices that VPC Flow Logs show connections from a Compute Engine instance to an IP address that should have been blocked by firewall rules. What is the most likely cause?

Accepted Answer

The firewall rule is not applied to the instance's network tag.. If a firewall rule is not applied to the instance's network tag, the rule will not affect that instance. In Google Cloud, firewall rules can target instances by specifying target tags; if the rule's target tag does not match the instance's tag, the rule is not enforced on that instance, allowing traffic that should have been blocked.

Answer

The firewall rule has a lower priority than a deny rule.

Answer

The instance is using an external IP.

Answer

VPC Flow Logs are inaccurate.