PCNE Practice Test 25 — 15 Questions

Question 1

A company uses Cloud NAT to enable outbound connectivity for private VMs. They notice that some VMs are not able to reach a specific external IP range. The VMs have no tags or service accounts. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VMs might be in a different subnet than the one where Cloud NAT is configured.. Cloud NAT is configured at the subnet level (or at the NAT gateway level with subnet scope). If a VM resides in a subnet that is not included in the Cloud NAT configuration, it will not have NAT applied and cannot reach external IP ranges. Since the VMs have no tags or service accounts, they rely on subnet-level NAT, making D the most likely cause.

Answer

Cloud NAT requires each VM to have a unique external IP address.

Answer

The VMs need a default route pointing to the NAT gateway.

Answer

A static route must be created for the external IP range via the NAT gateway.

Question 2

A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises network does not have a route back to the VPC subnet.. The VM can initiate and reach the on-premises server, which proves the forward path (VPC route, Cloud VPN tunnel, and on-prem firewall) is working. Return traffic is dropped because the on-premises network has no route pointing back to the VPC subnet range, so replies are either dropped or sent to a default gateway that discards them. In a Cloud VPN, routing is bidirectional and must be configured on both sides — the VPC side has a route to on-prem, but the on-prem router needs a matching route to the VPC CIDR.

Answer

A firewall rule is blocking ingress traffic from the on-premises network.

Answer

The BGP session is down.

Answer

The Cloud Router is not configured.

Question 3

A company has two Dedicated Interconnect connections from different metro areas to their GCP VPC. They want to use both connections actively (active-active load balancing) without manual intervention. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Advertise the same on-premises prefix with the same MED on both BGP sessions. To use active-active, you must configure ECMP on the Cloud Router to load balance across both BGP sessions, and advertise the same prefixes with equal priority (same MED) from both on-premises routers.

Answer

Use AS path prepending on one of the BGP sessions

Answer

Create two separate Cloud Routers

Answer

Set different MED values on each BGP session

Question 4

A company is deploying a global application on Google Cloud using Cloud Load Balancing. They want to serve traffic from multiple regions and require the lowest possible latency for users worldwide. The application serves HTTP traffic and uses a static IP address. Which load balancing solution should they use?

Accepted Answer

External HTTP(S) Load Balancer with Premium Tier. The External HTTP(S) Load Balancer with Premium Tier is correct because it uses Google's global anycast IP address to route user traffic to the nearest frontend, minimizing latency worldwide. Premium Tier leverages Google's global network backbone, ensuring traffic enters and exits at the closest Google edge point of presence (PoP) for HTTP(S) traffic, which is essential for a global application requiring low latency and a static IP.

Answer

Network Load Balancer

Answer

Internal HTTP(S) Load Balancer

Answer

SSL Proxy Load Balancer

Question 5

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

Accepted Answer

Use Cloud NAT to allow outbound internet access without public IPs. Option B is correct because Cloud NAT lets instances in a private subnet initiate outbound connections to the internet for updates and patches without exposing them via external (public) IP addresses, which reduces the attack surface of the public-facing VPC. Option D is correct because Cloud Armor is Google Cloud's edge security service that provides WAF rules and DDoS protection for HTTP(S) load-balanced applications, directly shielding public-facing web apps from application-layer and volumetric attacks. Option E is correct because Private Google Access allows VMs with only internal IP addresses to reach Google APIs and services (such as Cloud Storage or BigQuery) over Google's internal network, so backend instances never need public IPs to use those APIs. Option A is not appropriate because assigning public IPs to all VMs directly exposes every instance to the internet and increases risk rather than securing the VPC. Option C is incorrect because VPC Flow Logs only record and export metadata about IP traffic for monitoring and forensics; they do not inspect payloads or block malicious traffic.

Answer

Assign public IP addresses to all VMs for direct internet access

Answer

Enable VPC Flow Logs to block malicious traffic

Question 6

A company has deployed a network appliance (e.g., firewall) as a Compute Engine instance with two NICs: NIC0 for management and NIC1 for data traffic. The appliance must forward traffic from instances in subnet A to subnet B. The engineer has enabled IP forwarding on the appliance. What additional configuration is required on the VPC for the appliance to route traffic between subnets?

Accepted Answer

Create a route in the VPC with destination subnet B and next hop set to the appliance's internal IP address.. In Google Cloud VPC, even with IP forwarding enabled on the appliance instance, the VPC network needs a custom static route that directs traffic destined for subnet B to the appliance's internal IP address as the next hop. This route ensures that packets from subnet A are sent to the appliance for forwarding. Without this route, the VPC would not know to use the appliance as a gateway.

Answer

Configure the appliance's guest OS to enable packet forwarding by setting net.ipv4.ip_forward=1.

Answer

Create a firewall rule allowing egress from the appliance to both subnets.

Answer

Attach the appliance to a Cloud Router and configure BGP sessions.

Question 7

A company wants to use Cloud DNS with a failover routing policy. They have two IP addresses serving the same application: primary in us-east1 and secondary in us-west1. They want traffic to go to primary unless health check fails, then fail over to secondary. Which configuration is required?

Accepted Answer

Create a failover routing policy with primary and secondary targets, each associated with a health check. Cloud DNS failover routing requires a failover routing policy with a primary and secondary target, and each target must be associated with a health check so Cloud DNS can detect when the primary is unhealthy and switch to the secondary. This is the only configuration that provides automatic health-check-driven failover between the two IPs.

Answer

Create a geo routing policy with us-east1 as primary and us-west1 as secondary

Answer

Use a response policy to override the DNS response

Answer

Create two A records with weighting 100 and 0

Question 8

You run the command shown in the exhibit. Your on-premises network is connected to your VPC via a Cloud Router with two BGP sessions. You notice that your on-premises network receives routes for only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) but not for other subnets in the VPC. What is the most likely cause?

Accepted Answer

The Cloud Router is configured with custom route advertisement that only includes the two specified ranges.. The Cloud Router's custom route advertisement configuration explicitly controls which routes are advertised to on-premises via BGP. If only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) are included in the custom advertisement, other VPC subnets will not be advertised, even if they exist. The exhibit shows that the on-premises network receives only those two ranges, which directly matches a custom advertisement setup rather than the default ALL_SUBNETS behavior.

Answer

The BGP interface IP addresses 169.254.x.x are not reachable from the on-premises side.

Answer

The BGP peer ASN 65001 is not recognized by the on-premises router.

Answer

The advertisedGroups includes ALL_SUBNETS but the router is ignoring it because of a misconfiguration.

Question 9

A company uses Cloud NAT for outbound internet access. Engineering notices that some VM instances fail to connect to external services during peak hours. The network engineer suspects port exhaustion. Which action would best mitigate this issue?

Accepted Answer

Increase the number of NAT IP addresses assigned to the NAT gateway.. Port exhaustion occurs when the NAT gateway runs out of available source ports to map outbound connections. Increasing the number of NAT IP addresses assigned to the gateway multiplies the available port range (each IP provides 64,512 ports), directly alleviating port exhaustion during peak traffic. This is the standard mitigation for port exhaustion in Cloud NAT.

Answer

Change the NAT type from standard to public.

Answer

Enable TCP keepalive on the NAT gateway.

Answer

Reduce the number of NAT gateways in the region.

Question 10

Drag and drop the steps to configure Cloud Router with BGP for on-premises connectivity into the correct order.

Accepted Answer

1. Create a Cloud Router, 2. Create a VPN tunnel, 3. Configure BGP session, 4. Configure custom route advertisements, 5. Verify connectivity. Cloud Router requires a router first, then a tunnel, followed by BGP configuration. Custom advertisements and verification complete the setup.

Answer

1. Create a VPN tunnel, 2. Create a Cloud Router, 3. Configure BGP session, 4. Configure custom route advertisements, 5. Verify connectivity

Answer

1. Create a Cloud Router, 2. Configure BGP session, 3. Create a VPN tunnel, 4. Configure custom route advertisements, 5. Verify connectivity

Answer

1. Create a Cloud Router, 2. Create a VPN tunnel, 3. Configure custom route advertisements, 4. Configure BGP session, 5. Verify connectivity

Question 11

A company is using Traffic Director with Envoy sidecars to manage traffic between microservices. They want to inject faults to test service resilience. Which Traffic Director feature should they use?

Accepted Answer

Fault injection. Fault injection is a feature of Traffic Director that allows injecting delays or abort errors into requests for testing.

Answer

Traffic splitting

Answer

Circuit breakers

Answer

mTLS

Question 12

A company needs to connect multiple on-premises sites and multiple GCP VPCs in a hub-and-spoke topology using Google Cloud. Which service provides a centralized hub for managing such connectivity?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is the correct choice because it provides a centralized hub-and-spoke topology for connecting multiple on-premises sites (via VPN, Interconnect, or third-party SD-WAN appliances) and multiple GCP VPCs. It manages routing and policy distribution across spokes, eliminating the need for individual peering or complex route tables, and supports both intra- and cross-region connectivity.

Answer

VPC Peering

Answer

Shared VPC

Answer

Cloud Router

Question 13

A network engineer is troubleshooting connectivity issues with VPC Flow Logs. Which TWO statements about VPC Flow Logs are correct? (Choose TWO)

Accepted Answer

VPC Flow Logs can be used to diagnose overly permissive firewall rules.. Option C is correct because VPC Flow Logs record connection-level metadata (5-tuple, bytes, packets, and disposition) for flows traversing a subnet or VPC, so analyzing which flows are ACCEPTED lets an engineer spot rules that permit traffic that should be denied, helping identify overly permissive firewall rules. Option E is correct because VPC Flow Logs intentionally exclude certain traffic, including traffic generated by GCP health checks (such as those from Google's health-check source ranges 35.191.0.0/16 and 130.211.0.0/22), so those health-check packets will not appear in the logs. Option A is wrong because VPC Flow Logs capture both ingress and egress traffic, not only egress. Option B is wrong because Flow Logs record both allowed and denied traffic, with the disposition field indicating whether the flow was accepted or rejected by firewall rules. Option D is wrong because Flow Logs do not capture every packet of every flow; they capture sampled flow-level metadata rather than full packet contents, and some traffic types are excluded.

Answer

VPC Flow Logs capture only egress traffic.

Answer

VPC Flow Logs only capture traffic that is allowed by firewall rules.

Answer

VPC Flow Logs capture all packets for every flow in the VPC.

Question 14

Refer to the exhibit. A Cloud VPN tunnel is configured with the above Cloud Router configuration. The on-premises BGP peer is at 169.254.0.2 with ASN 65001. The on-premises router is receiving the route 10.0.0.0/8 from the Cloud Router, but it is not receiving any of the specific subnets (e.g., 10.1.0.0/16) that exist in the VPC. What is the most likely cause?

Accepted Answer

The Cloud Router is configured with custom advertise mode and is only advertising the manually specified ranges.. The Cloud Router is configured with custom advertise mode, which means it only advertises the manually specified CIDR ranges to the on-premises BGP peer. Since the specific subnets (e.g., 10.1.0.0/16) are not included in the custom advertised ranges, the on-premises router receives only the explicitly listed 10.0.0.0/8 route, not the more specific subnets.

Answer

The advertised_route_priority is set too low, causing the routes to be suppressed.

Answer

The BGP session is not established due to ASN mismatch.

Answer

The on-premises peer ASN is incorrect.

Question 15

Match each network pricing model to its description.

Accepted Answer

Egress pricing: Charges for data leaving Google Cloud to the internet. Correct matches: Egress charges for outbound data; Ingress is free; Cloud Interconnect charges by bandwidth; VPN charges hourly plus egress. Common confusions include swapping egress/ingress definitions and confusing Interconnect with VPN.

Answer

Egress pricing: No charge for data leaving Google Cloud

Answer

Cloud Interconnect pricing: Charges include hourly tunnel fee