PCNE Practice Test 2 — 25 Questions

Question 1

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. Option A is correct because Network Connectivity Center uses a hub-and-spoke model in which the hub dynamically exchanges and propagates routes between all attached spokes, so VPC spokes and hybrid spokes learn each other's reachable prefixes without manual route configuration. Option E is correct because NCC spokes can be VPC networks from different Google Cloud projects, allowing cross-project connectivity through a single hub as long as the appropriate IAM permissions and spoke attachments are configured. Option B is incorrect because NCC is a hub-and-spoke transit solution, not a direct VPC-to-VPC peering mechanism; VPC peering is a separate feature that does not involve an NCC hub. Option C is incorrect because NCC hybrid spokes can use HA VPN, Cloud Interconnect (Dedicated or Partner), and other supported connectivity methods, not only Dedicated Interconnect. Option D is incorrect because NCC spokes can be in different regions; the hub-and-spoke topology is global and does not require all spokes to share a region.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.

Question 2

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the return route via BGP, causing asymmetric routing.. The symptom — traffic reaches on-premises but return traffic is dropped — is the classic signature of asymmetric routing. If the on-premises router doesn't advertise the 10.0.0.0/… prefix back through BGP over the Cloud VPN, it has no route for the return path and either drops the packet or sends it out a different interface. The Cloud VPN tunnel itself is up (traffic is flowing one way), so the issue is route propagation, not tunnel state.

Answer

The Cloud VPN tunnel is down.

Answer

The MTU is set to 1500 on the VPN tunnel.

Answer

The instance's firewall is blocking ICMP.

Question 3

Match each network troubleshooting command/tool to its function.

Accepted Answer

ping: Tests reachability of a host and measures round-trip time. Common network troubleshooting tools: ping tests connectivity, traceroute maps the route, nslookup resolves DNS, netstat shows connections. The distractors swap ping and traceroute functions.

Answer

ping: Displays network connections and routing tables

Answer

traceroute: Tests reachability and measures round-trip time

Question 4

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

Accepted Answer

DNS peering. DNS peering in Cloud DNS allows a VPC network to resolve records from a managed zone in another project without transferring ownership of the zone. The consumer VPC creates a peering zone that points to the producer's managed zone, enabling cross-project name resolution while the producer retains full control of the zone. This is the intended feature for centralized DNS architectures where zone ownership must remain with the owning project.

Answer

DNS forwarding (inbound)

Answer

Managed zone with cross-project binding

Answer

Global DNS configuration

Question 5

A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?

Accepted Answer

IAM conditions on the bucket. VPC Service Controls can restrict access to Google APIs to only specified VPCs and projects, creating a service perimeter. IAM conditions can further restrict access based on the caller's service account. This combination ensures that only instances with the correct service account in the correct VPC can access the bucket.

Answer

Hierarchical firewall policy

Answer

Cloud Armor

Answer

Cloud NAT

Question 6

A financial services company has a Shared VPC setup where the host project contains a central VPC, and multiple service projects attach to it. The network team wants to monitor all VPC Flow Logs from the host project's subnets and analyze traffic patterns across all service projects. They need to aggregate logs in a central location for long-term analysis and querying with SQL. What should they do?

Accepted Answer

Enable VPC Flow Logs on each subnet in the host project, then create a log sink in the host project that exports to a BigQuery dataset in a centralized logging project.. In a Shared VPC, the host project owns the subnets, so VPC Flow Logs are generated there. To centralize these logs for SQL analysis, a log sink in the host project should export to a BigQuery dataset, which can reside in a separate logging project. This pattern aggregates all flow logs from the host project's subnets into one location, enabling cross-project traffic analysis and long-term retention with BigQuery's querying capabilities.

Answer

Enable VPC Flow Logs on each service project's subnets, then create a log sink in each service project that exports to a BigQuery dataset in the host project.

Answer

Enable VPC Flow Logs on the host project's subnets, then use Cloud Logging's log viewer to filter and analyze the logs, and schedule regular exports to Cloud Storage for long-term retention.

Answer

Use Cloud Monitoring's VPC Flow Logs dashboard to view traffic across all projects, and export the dashboard data to BigQuery using the Monitoring API.

Question 7

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

Accepted Answer

Configure Cloud Router in the host project to advertise all subnets via BGP.. In a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Answer

Configure Cloud NAT in each service project for on-prem access.

Answer

Use VPC peering between the host project and each service project.

Answer

Create separate Interconnect VLAN attachments for each service project.

Question 8

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to create service perimeters that restrict access to Google Cloud APIs and prevent data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

IAM Conditions

Question 9

A company wants to publish a custom internal service running in their VPC so that consumers in other VPCs can access it using private IP addresses. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows publishing internal services via private endpoints in your VPC and enabling consumption from other VPCs using private IPs.

Answer

Cloud Load Balancing

Answer

VPC Peering

Answer

Cloud VPN

Question 10

A startup is creating a new VPC for their production environment. They want to minimize management overhead and plan to use multiple regions. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region and manage IP ranges, reducing management overhead. Custom mode requires manual subnet creation.

Answer

Custom mode VPC

Answer

Shared VPC

Answer

VPC Network Peering

Question 11

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 12

An engineer needs to verify that a Compute Engine instance can reach a specific IP address on the internet, considering firewall rules and routes. Which Network Intelligence Center tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests allow you to test reachability between a source and a destination, checking firewall rules, routes, and VPC peering configurations.

Answer

Performance Dashboard

Answer

Firewall Insights

Answer

Network Topology

Question 13

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Answer

Cloud NAT logging

Question 14

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

Accepted Answer

Configure active-active BGP with multiple sessions using the same ASN.. The best practice for HA VPN is to use active-active BGP with multiple sessions, using the same ASN on all on-premises routers. This enables ECMP and ensures symmetric routing. Option B correctly describes this configuration.

Answer

Configure active-passive BGP with a single session.

Answer

Use policy-based routing to fail between tunnels.

Answer

Use static routes with a primary and backup route.

Question 15

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

Accepted Answer

Cloud NAT on the subnet or VPC. Cloud NAT (Network Address Translation) allows private Compute Engine instances to initiate outbound connections to the internet without assigning them public IP addresses. It translates the instance's private IP to a Cloud NAT external IP address for outbound traffic, while unsolicited inbound connections from the internet are blocked. This is the correct solution because the requirement explicitly states no public IP on the instance, yet outbound internet access is needed.

Answer

Configure a private Google access for the subnet

Answer

Assign a static external IP address to the instance

Answer

Set up an internal HTTP(S) load balancer

Question 16

A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?

Accepted Answer

Export logs to BigQuery. For long-term analysis and ad-hoc querying of HTTP load balancer access logs, exporting them to BigQuery is the recommended approach because BigQuery is a fully managed, petabyte-scale analytics data warehouse that supports fast SQL queries over massive datasets. Cloud Logging is designed for real-time monitoring and short-term retention (default 30 days), not for the complex, historical, large-scale analytical queries that user-behavior and traffic-pattern analysis requires.

Answer

Use VPC Flow Logs instead

Answer

View logs in the Cloud Logging dashboard

Answer

Store logs in Cloud Storage and use grep

Question 17

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

Accepted Answer

Specify a subnet in the same region as the backend instances.. An internal load balancer (ILB) in GCP requires a regional forwarding rule that routes traffic to backend instances within the same VPC. Specifying a subnet in the same region as the backend instances is mandatory because the ILB's internal IP address is allocated from that subnet, and the forwarding rule must reference a subnet to enable internal-only routing. Without a subnet, the ILB cannot be provisioned as an internal load balancer.

Answer

Assign a static external IP address to the forwarding rule.

Answer

Upload an SSL certificate to the load balancer.

Answer

Create a Cloud NAT gateway for the backend instances.

Question 18

An organization has multiple VPCs in different projects that need to consume a common internal service hosted in a central project. The service runs on a set of Compute Engine instances with internal IPs. Which architecture allows the consumers to access the service using private IPs without VPC peering?

Accepted Answer

Create a Private Service Connect endpoint in each consumer VPC and publish the service as a Private Service Connect service from the central project.. Private Service Connect allows you to publish internal services via Private Service Connect endpoints in consumer VPCs. Consumers access the service using internal IPs without needing VPC peering or VPNs. This is the recommended architecture for publishing and consuming internal services across projects.

Answer

Use Cloud VPN to connect each consumer VPC to the central VPC.

Answer

Expose the service through an external IP and use IAM to restrict access.

Answer

Set up VPC peering between each consumer VPC and the central VPC.

Question 19

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

Accepted Answer

gRPC. For gRPC backends, the health check should use the gRPC protocol because gRPC health checking is defined by the standard grpc.health.v1.Health service, which returns a structured status that load balancers can interpret. HTTP or TCP checks cannot properly validate gRPC service health since gRPC uses HTTP/2 with binary framing and its own status semantics.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 20

A company wants to resolve DNS queries from their on-premises network for Google Cloud private zones (e.g., example.internal) without duplicating DNS data. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS forwarding. Inbound DNS forwarding allows on-premises DNS resolvers to send queries to Cloud DNS for private zones (e.g., example.internal) without duplicating records. The on-premises resolver forwards queries to a Cloud DNS inbound forwarder IP, which resolves the private zone and returns the answer. This is the correct feature for on-prem to cloud private zone resolution.

Answer

DNS peering

Answer

Private DNS zones

Answer

Outbound DNS forwarding