PCNE Practice Test 25 — 15 Questions

Question 1

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

Accepted Answer

The subnet routes are exported from VPC-B to VPC-A.. Option D is correct because VPC Network Peering requires that subnet routes be exported from the peered VPC. By default, subnet routes are automatically exported, but if the peering configuration was modified (e.g., exportSubnetRoutesWithPublicIp set to false), routes may not be exported. The engineer should verify that VPC-B exports its subnet routes to VPC-A. Option A is incorrect because MTU mismatch is unlikely to cause complete lack of connectivity. Option B is incorrect because BGP is not used in VPC peering. Option C is incorrect because the route tables themselves are not the issue; the missing routes are due to export settings.

Answer

The BGP session status on the Cloud Router.

Answer

The MTU size of the instances.

Answer

The route tables for the peered network.

Question 2

A developer needs to allow a VM in subnet A to reach a VM in subnet B in the same VPC. What is the default behavior?

Accepted Answer

The default firewall rule allows all internal traffic within the VPC.. By default, VPC networks allow all internal traffic between subnets. Option B correctly states this. Option A is wrong because no firewall rule is needed for internal traffic. Option C is wrong because VPC peering is for cross-VPC connectivity. Option D is wrong because custom routes are not required for internal subnet communication.

Answer

A custom route must be added to route between subnets.

Answer

A firewall rule must be added to allow traffic between subnets.

Answer

VPC peering is required for communication between subnets.

Question 3

A company wants to enable Private Google Access for an on-premises network connected via Cloud VPN. Which configuration step is required?

Accepted Answer

Enable Private Google Access on the VPC subnet that hosts the Cloud VPN gateway.. Option B is correct because Private Google Access must be enabled on the VPC subnet that hosts the Cloud VPN gateway. This allows on-premises hosts to use internal IPs to access Google APIs through the VPN tunnel. Option A is incorrect because a default route to the internet is not required; the traffic goes through the VPN. Option C is incorrect because Cloud NAT is for outbound internet from private instances, not for on-premises access. Option D is incorrect because VPC Flow Logs are for logging, not enabling access.

Answer

Enable VPC Flow Logs for the VPN tunnel.

Answer

Create a default route with next hop set to the internet gateway.

Answer

Configure a Cloud NAT gateway for the on-premises network.

Question 4

An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?

Accepted Answer

The firewall rules have a source or destination filter that excludes the new subnet's CIDR.. Option C is correct because firewall rules may include source or destination IP range filters. Even if tags match, if the rule also specifies a source or destination IP range that does not include 192.168.1.0/24, the rule will not apply. Option A is incorrect because firewall rules are scoped to the VPC, not to subnets, so tags work across subnets. Option B is incorrect because there is no such concept as firewall rule enforcement on subnets. Option D is incorrect because instances do not need to be recreated; changes to firewall rules apply immediately.

Answer

Firewall rules are scoped to a VPC, not to subnets.

Answer

The new subnet was created without enabling firewall rule enforcement.

Answer

The instances need to be recreated for the new rules to apply.

Question 5

A company wants to deploy a web application with a public-facing load balancer and a private backend. The backend instances must not have external IPs. Which statement about the VPC configuration is correct?

Accepted Answer

No additional configuration is required beyond creating the subnet.. Option D is correct because instances without external IPs can still receive traffic from a public load balancer. No additional configuration such as NAT or Private Google Access is needed for this purpose. Option A is incorrect because Private Google Access is for accessing Google APIs, not for load balancer traffic. Option B is incorrect because Cloud NAT provides outbound internet access, which is not required. Option C is incorrect because the backend subnet does not need a default route; traffic from the load balancer comes through the VPC internal routing.

Answer

Cloud NAT must be configured for the backend subnet.

Answer

The backend subnet must have a default route to the internet.

Answer

Private Google Access must be enabled on the backend subnet.

Question 6

An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?

Accepted Answer

The firewall rules in the VPC allowing incoming traffic from the on-premises CIDR.. Option C is correct because even with BGP routes, the VPC firewall rules must permit incoming traffic from the on-premises CIDR. If no appropriate ingress rule exists, traffic will be blocked. Option A is incorrect because MTU might cause packet loss but not complete failure. Option B is incorrect because advertised routes from the on-premises router are being learned (BGP is up). Option D is incorrect because the VPN gateway's external IP is necessary for the tunnel but not the immediate cause of connectivity failure.

Answer

The advertised route from the on-premises router is a default route.

Answer

The MTU size of the VPN tunnel.

Answer

The Cloud VPN gateway is assigned an external IP address.

Question 7

A company uses Shared VPC with a host project and multiple service projects. A service project administrator wants to create a VM with an internal IP from a specific subnet in the host project. The operation fails with a permission error. What is the most likely missing permission?

Accepted Answer

compute.subnetworks.use on the host project subnet.. Option D is correct because the service project needs the compute.subnetworks.use permission on the specific subnet in the host project. This permission is part of the roles/compute.networkUser role. Option A is incorrect because compute.networks.use is needed for using the VPC network, but the error is more specific to subnet use. Option B is incorrect because compute.instances.create is for creating instances, not for using a subnet. Option C is incorrect because resourcemanager.projects.get is not related to subnet usage.

Answer

resourcemanager.projects.get on the host project.

Answer

compute.instances.create on the service project.

Answer

compute.networks.use on the host project VPC.

Question 8

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

Accepted Answer

VPC Flow Logs. Option A is correct because VPC Flow Logs capture information about IP traffic going to and from network interfaces. They help diagnose packet drops and latency issues. Option B is incorrect because Cloud NAT logging provides logs about NAT connections. Option C is incorrect because Packet Mirroring is for capturing and inspecting traffic, not for logging. Option D is incorrect because Traffic Director is a service mesh control plane, not a traffic logging tool.

Answer

Cloud NAT logging

Answer

Packet Mirroring

Answer

Traffic Director

Question 9

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

Accepted Answer

No additional configuration is needed.. Option A is correct because enabling Private Google Access on the subnet allows instances without external IPs to access Google APIs via the automatically generated default route for the private Google access ranges. No additional configuration is needed. Option B is incorrect because an explicit default route to the internet would send traffic to the internet, not to Google APIs via private access. Option C is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.

Answer

A default route to the internet must be created.

Answer

A Cloud NAT must be configured.

Answer

The instances must have external IPs.

Question 10

Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?

Accepted Answer

Create a Private Service Connect service attachment and publish the service.. Option C is correct because the producer (VPC-A) must create a Private Service Connect service attachment that publishes the service. This attachment is associated with a load balancer or a service. Option A is incorrect because the endpoint is created in the consumer VPC (VPC-B). Option B is incorrect because VPC peering is not used with Private Service Connect (the services can be across organizations without peering). Option D is incorrect because Private Google Access is unrelated to publishing services.

Answer

Create a Private Service Connect endpoint in VPC-A.

Answer

Enable Private Google Access on the subnet where the service resides.

Answer

Create a VPC peering connection with VPC-B.

Question 11

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

Accepted Answer

Ingress rule with source IP range of the company's public IPs and allow tcp:443. Options C and E are correct because ingress rules with source IP ranges from known company IPs on the required ports (HTTP/HTTPS) restrict access appropriately. Option A is incorrect because it allows all traffic. Option B is incorrect because a source tag is not used to identify source IPs; tags are for target instances. Option D is incorrect because it uses destination IP range, which is not the correct way to restrict incoming traffic.

Answer

Ingress rule with source IP range 0.0.0.0/0 and allow tcp:80

Answer

Ingress rule with source tag 'web' and allow tcp:80

Answer

Ingress rule with destination IP range 0.0.0.0/0 and allow tcp:80

Question 12

Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?

Accepted Answer

Enable Private Google Access on the subnet.. The subnet has privateIpGoogleAccess set to false, which must be enabled for VMs without external IPs to access Google APIs via Private Google Access. Option A is correct. Option B is not needed because egress to 0.0.0.0/0 is allowed by default. Option C is not required for Private Google Access (Cloud NAT is for outbound internet to non-Google destinations). Option D is not missing; a default route exists as indicated by gatewayAddress.

Answer

Create a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Add a default route to the internet gateway.

Question 13

A company uses VPC Flow Logs for traffic analysis. They notice that logs are missing for a specific Compute Engine instance that handles high traffic. The subnet has Flow Logs enabled. What is the most likely reason?

Accepted Answer

Flow Logs are sampled and may drop high-throughput traffic.. VPC Flow Logs use sampling; high throughput can lead to sampling reduction or dropped logs.

Answer

The instance is using Private Google Access.

Answer

The instance's network interface has an external IP.

Answer

The instance is in a different region from the log sink.

Question 14

Refer to the exhibit. You have two VPCs, vpc-a and vpc-b, with VPC peering configured and custom route import/export enabled. An instance in subnet-a (10.0.1.2) cannot ping an instance in subnet-b (10.0.2.2) using internal IP. Firewall rules are default (deny all ingress). What is the required action?

Accepted Answer

Add a firewall rule allowing ICMP from 10.0.1.0/24 to 10.0.2.0/24.. Even with peering, firewall rules are needed to allow traffic. Default deny all ingress blocks the ping.

Answer

Add a static route for the peer range.

Answer

Enable Private Google Access.

Answer

Create a Cloud VPN tunnel.

Question 15

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Accepted Answer

Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.. Options A, C, and D are correct. Option A: Cloud NAT supports both TCP and UDP. Option C: Cloud NAT requires a default route (0.0.0.0/0) to the internet gateway to function. Option D: Cloud NAT can be configured with a manual list of NAT IP addresses. Option B is incorrect because Cloud NAT provides NAT for instances without external IPs; it does not assign external IPs to instances. Option E is incorrect because Cloud NAT is regional, not per subnet; it applies to all subnets in the region that are configured to use it.

Answer

Cloud NAT can be configured per subnet or per region.

Answer

Cloud NAT automatically assigns external IP addresses to instances.