PCNE Practice Test 2 — 25 Questions

Question 1

A company uses Traffic Director with Envoy sidecars to manage traffic in their service mesh. They want to perform canary deployments where 10% of traffic goes to the new version and 90% to the stable version. Which TWO Traffic Director resources should they configure? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A TrafficDirectorService with a traffic splitting policy (weighted clusters). Traffic splitting is achieved through TrafficDirectorService with a weighted traffic policy. BackendService defines the service backends. Envoy Route Configuration is used for routing, but Traffic Director configures it automatically. HTTPRoute and gRPC filters are not used for traffic splitting.

Answer

A gRPC filter in the Envoy configuration

Answer

An HTTPRoute resource

Answer

An Envoy Route Configuration with weighted clusters

Question 2

A company wants to ensure that only traffic from specific source IP ranges can reach a Cloud Load Balancer. How should they enforce this?

Accepted Answer

Configure Cloud Armor with IP allowlist.. Cloud Armor is a web application firewall (WAF) that can be attached to a Cloud Load Balancer to filter incoming traffic based on IP addresses, including allowlisting specific source IP ranges. This directly meets the requirement to restrict access to the load balancer by source IP without affecting backend instance configurations.

Answer

Use IAP.

Answer

Set up Cloud NAT.

Answer

Use VPC firewall rules on the load balancer's backend.

Question 3

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Accepted Answer

Cloud NAT logging with filter for errors

Answer

Firewall Rules logging

Answer

VPC Flow Logs on the subnet

Answer

Cloud Armor request logs

Question 4

You need to create a load balancer that distributes traffic across Compute Engine instances in multiple regions for a TCP application without SSL offload. The clients should connect to a single anycast IP. Which load balancer should you use?

Accepted Answer

Global external TCP Proxy Load Balancer. Global external TCP Proxy Load Balancer provides a single anycast IP and handles TCP traffic without SSL offload (though it supports SSL offload optionally). It is the only global TCP load balancer that does not require SSL termination.

Answer

External TCP/UDP Network Load Balancer

Answer

Global external SSL Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 5

A startup is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose a service to the internet using a load balancer that provides SSL termination and supports WebSocket. Which type of Service should they use?

Accepted Answer

Create a Service of type LoadBalancer with an HTTP(S) load balancer.. A Service of type LoadBalancer with an HTTP(S) load balancer is correct because it provides a public IP address, handles SSL termination at the load balancer level, and natively supports WebSocket connections without additional configuration. This is the simplest and most direct way to expose a microservice to the internet with these requirements on GKE.

Answer

Create a Service of type ClusterIP and use an Ingress resource with a backendConfig.

Answer

Create a Service of type NodePort and configure an external TCP/UDP load balancer.

Answer

Create a Headless Service with an external DNS A record pointing to the pod IPs.

Question 6

An organization wants to enforce that only instances with specific service accounts can be accessed via SSH (TCP 22) from the internet. Which two attributes should be used in the firewall rule to achieve this? (Choose two.)

Accepted Answer

--source-ranges 0.0.0.0/0. To target instances based on service account, use --target-service-accounts. To specify the source from internet, use --source-ranges with 0.0.0.0/0.

Answer

--source-service-accounts

Answer

--target-tags

Answer

--destination-ranges

Question 7

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

Accepted Answer

It depends on the redundancy requirements; typically two per attachment for active-active.. With a Dedicated Interconnect using two VLAN attachments in different edge availability domains (EADs), the recommended best practice for high availability is to establish two BGP sessions per VLAN attachment (one active and one redundant) on the same Cloud Router, resulting in four sessions total. However, the question asks 'how many BGP sessions should be established' and the correct answer acknowledges that it depends on the redundancy requirements; typically two per attachment for active-active, but if active-passive is acceptable, fewer sessions may suffice. This flexibility makes 'It depends' the most accurate choice.

Answer

Four: two per VLAN attachment.

Answer

Two: one per VLAN attachment.

Answer

One: one session per Cloud Router.

Question 8

An engineer is troubleshooting a VPC Network Peering connection between two VPCs. The peering is established, but traffic from VPC A to VPC B is not reaching a specific subnet. Both VPCs have custom routes. What is the most likely cause?

Accepted Answer

Export custom routes is not enabled on the VPC B side. A common issue is that the subnet's custom routes are not exported. VPC peering allows exporting custom routes, but this must be explicitly enabled. If not, only system-generated routes (subnet routes) are exchanged.

Answer

The subnet has overlapping IP with VPC A

Answer

The subnet in VPC B is in a different region

Answer

Export custom routes is not enabled on the VPC A side

Question 9

A company wants to set up a Regional Internal HTTP(S) Load Balancer to serve an internal web application. Which two components are required? (Choose two.)

Accepted Answer

An Envoy-based proxy. Regional Internal HTTP(S) LB requires an Envoy-based proxy and a backend service with a NEG of type GCE_VM_IP_PORT or GCE_VM_IP.

Answer

Cloud CDN

Answer

An SSL certificate

Answer

A global forwarding rule

Question 10

A company needs to load balance TCP traffic without SSL termination for a gaming application where client IP preservation is critical. The backend is a group of Compute Engine instances. Which load balancer types meet these requirements? (Choose TWO.)

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Global TCP Proxy Load Balancer terminates SSL? Actually, TCP Proxy LB does not terminate SSL; it forwards TCP traffic but does not preserve client IP by default (uses Proxy Protocol). Regional External TCP/UDP Network Load Balancer is pass-through and preserves client IP. The Internal TCP/UDP LB is pass-through but internal. For external TCP without SSL termination and client IP preservation, the best options are the Regional External TCP/UDP NLB (pass-through) and a Global TCP Proxy with Proxy Protocol enabled (which can preserve IP via Proxy Protocol).

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global SSL Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Question 11

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address. When the BGP session state is stuck in 'CONNECT', it indicates that the router is actively trying to initiate a TCP connection to the peer but is not receiving a response. For BGP to establish a TCP session (port 179), the on-premises router must have a valid IP route to the Cloud Router's BGP peer IP address. Without this route, TCP SYN packets are dropped, preventing the session from transitioning to 'ESTABLISHED'.

Answer

Change the BGP ASN on the Cloud Router to a different number

Answer

Increase the BGP hold timer on the Cloud Router

Answer

Change the BGP keepalive interval to 10 seconds

Question 12

A company has Compute Engine instances without external IPs in a VPC. They need to reach Google APIs such as Cloud Storage and BigQuery. Which configuration will meet this requirement with minimal cost and operational overhead?

Accepted Answer

Configure the subnet to have Private Google Access enabled. Ensure the instances have the appropriate DNS resolution for private.googleapis.com.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs via the default internet gateway or VPC peering. Configuring a Private Google Access enabled subnet is the simplest and cheapest option, as it does not require NAT or additional instances.

Answer

Set up a Squid proxy on a bastion host with an external IP and route all API traffic through it.

Answer

Create a Cloud NAT gateway in the same region and attach it to the VPC.

Answer

Assign external IPs to the instances and create firewall rules to allow traffic to Google APIs.

Question 13

A company is designing a VPC network to support multiple projects that require isolation but also need to communicate with a shared services project. Which approach should the company use to minimize administrative overhead while ensuring isolation?

Accepted Answer

Implement a Shared VPC in the host project and attach all service projects to it.. A Shared VPC (XPN) allows an organization to connect resources from multiple service projects to a common host project's VPC network, enabling isolated projects to communicate with shared services while centralizing network administration. This minimizes administrative overhead because network policies, firewall rules, and routing are managed in one place, and service projects do not need to manage their own VPC infrastructure.

Answer

Assign all projects to a single VPC with separate subnets for each project.

Answer

Use dedicated VPCs for each project and connect via Cloud VPN tunnels.

Answer

Create a separate VPC for each project and peer them with the shared services VPC.

Question 14

A company is creating a new VPC to host a set of microservices on Compute Engine. The network architect wants to minimize operational overhead and allow automatic subnet creation as new regions are added. Which VPC mode should be used?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region as they become available, reducing operational overhead. Custom mode requires manual subnet creation.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 15

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

Accepted Answer

Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.. Traffic Director uses Envoy's fault injection filter, configured via the Envoy xDS API or through GKE configuration. The correct approach is to apply a traffic policy with fault injection percentage. The other options are not valid Traffic Director features or do not achieve fault injection.

Answer

Use the gcloud compute backend-services update command with the --fault-injection flag.

Answer

Set a circuit breaker with a max pending requests threshold.

Answer

Create a backend service with connection draining and set the drain timeout.

Question 16

A company wants to connect an on-premises network to Google Cloud using Cloud VPN. The on-premises network has a single subnet and no dynamic routing capabilities. The company needs a simple, low-cost solution. Which VPN configuration should they choose?

Accepted Answer

Classic VPN with route-based configuration. Classic VPN with route-based configuration is the correct choice because the on-premises network lacks dynamic routing capabilities and requires a simple, low-cost solution. Route-based VPNs use static routes and do not require BGP, making them ideal for environments without dynamic routing support. Classic VPN is the legacy, lower-cost option compared to HA VPN, and route-based configuration allows traffic to be forwarded based on routing table entries rather than policy-based selectors.

Answer

HA VPN with dynamic routing (BGP)

Answer

HA VPN with static routing

Answer

Classic VPN with policy-based configuration

Question 17

A company uses Shared VPC. They want to restrict which service project's VMs can use a specific subnet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Use IAM roles on the subnet resource to grant 'compute.subnetUser' to specific service projects.. IAM roles on a subnet resource allow you to grant the `compute.subnetUser` role to specific service projects, which controls which projects can create VM instances in that subnet. This is a direct method to restrict subnet usage within a Shared VPC environment, as the role grants permission to use the subnet without granting broader network access.

Answer

Use VPC network peering.

Answer

Use firewall rules to deny traffic from other service projects.

Answer

Use network tags on VMs and associate the subnet with those tags.

Question 18

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Accepted Answer

Create a Cloud Router in the region, then create a Cloud NAT gateway using that router, then assign static IP addresses to the NAT, then apply the NAT to the desired subnets, then test connectivity from a private instance.. Cloud NAT requires a Cloud Router first. Then create NAT, assign IPs, and apply to subnets. Testing confirms internet access.

Answer

Create a Cloud NAT gateway first, then create a Cloud Router, then assign IP addresses, then apply to subnets, then test connectivity.

Answer

Create a Cloud Router, then assign IP addresses to the NAT, then create the Cloud NAT, then apply to subnets, then test.

Answer

Create a Cloud Router, then create a Cloud NAT and apply it to subnets, then assign IP addresses, then test connectivity.

Question 19

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Accepted Answer

Mismatched BGP hold timer values. BGP session flapping can be caused by mismatched parameters, MTU issues, or authentication problems.

Answer

Incorrect VLAN ID on the VLAN attachment

Answer

Duplicate AS number on the on-premises router

Question 20

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. NCC supports both VPC spokes and hybrid spokes (VPN/Interconnect). It does not support direct VPC-to-VPC peering; that's VPC peering. Route propagation is automatic within NCC.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.