PCNE Practice Test 3 — 25 Questions

Question 1

A company wants to enforce that all HTTPS load balancer traffic uses TLS 1.2 or higher. Which Google Cloud resource should they configure?

Accepted Answer

SSL policy attached to the target HTTPS proxy. An SSL policy in Google Cloud can be attached to a target HTTPS proxy to enforce minimum TLS version requirements, such as TLS 1.2 or higher. This policy directly controls the TLS handshake parameters at the load balancer level, ensuring that only clients supporting TLS 1.2 or above can establish HTTPS connections.

Answer

SSL certificate resource

Answer

VPC firewall rule to block TLS 1.0/1.1

Answer

Identity-Aware Proxy (IAP)

Question 2

A company has a VPC with subnets in us-east1 and us-west1. They have established a Cloud VPN tunnel to their on-premises network through a Cloud Router in us-east1. They want to ensure that traffic from on-premises to resources in us-west1 uses the VPN tunnel and not the public internet. What must be configured?

Accepted Answer

Add a route on the on-premises router for us-west1 subnets with next hop pointing to the VPN tunnel. The on-premises router must have a route for the us-west1 subnets with the VPN tunnel as the next hop. Without this, the on-premises router will use its default route (typically the public internet) to reach us-west1, bypassing the VPN tunnel. The Cloud Router in us-east1 advertises the us-west1 subnets via BGP over the VPN tunnel, but the on-premises router must be explicitly configured to forward traffic for those subnets into the tunnel.

Answer

Configure a custom dynamic route on the Cloud Router for us-west1 subnets

Answer

Create a separate VPN tunnel from on-premises to a Cloud Router in us-west1

Answer

Configure VPC firewall rules to allow traffic from on-premises to us-west1

Question 3

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

Accepted Answer

Inbound DNS policy. Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Answer

DNS peering

Answer

Outbound DNS forwarding zone

Answer

Private zone with DNS forwarding

Question 4

An organization wants to reduce egress costs for data sent from Compute Engine instances to users worldwide. Which TWO approaches should they consider? (Choose TWO.)

Accepted Answer

Deploy instances in multiple regions closer to users.. Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network routes traffic over Google's network, which may not reduce egress cost but improves performance; however, Standard Tier egress is cheaper than Premium Tier for internet egress. For reducing costs, Cloud CDN and using Standard Tier (if acceptable) can help. But among the options, Cloud CDN and placing instances in multiple regions (to serve users locally) reduce egress.

Answer

Enable Private Google Access to avoid internet egress for Google APIs.

Answer

Use global load balancers instead of regional load balancers.

Answer

Use Premium Tier networking to route traffic over Google's network.

Question 5

Which THREE of the following are valid use cases for VPC Service Controls?

Accepted Answer

Controlling access to a Cloud SQL database from a specific VPC.. VPC Service Controls allow you to define a service perimeter that restricts access to a Cloud SQL database (or other Google Cloud services) to requests originating from a specific VPC network. This is achieved by configuring an access level that references the VPC network, ensuring that only traffic from that VPC can reach the database, even if the database is exposed via private IP.

Answer

Allowing access to a managed instance group from the internet.

Answer

Enabling private access to Cloud APIs from on-premises.

Question 6

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

Accepted Answer

Traffic is taking one tunnel for outbound and the other for return, causing stateful firewall to drop packets.. The most likely cause is asymmetric routing, where outbound traffic from GCP to on-premises takes one VPN tunnel while return traffic takes the other. Stateful firewalls track connection state based on the first packet seen; if return packets arrive via a different tunnel (and thus a different source IP or interface), the firewall does not recognize them as part of an existing session and drops them. This is a classic symptom of asymmetric routing with multiple BGP sessions over separate tunnels.

Answer

BGP keepalive timers are set too low, causing session flapping.

Answer

The MTU is mismatched between the tunnels.

Answer

The on-premises router is not receiving the VPC routes via BGP.

Question 7

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify the BGP session status on the Cloud Router.. BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Answer

Check the MTU configuration on the on-premises router.

Answer

Verify the physical interconnect location and cable connections.

Answer

Review the Cloud NAT configuration for the VPC network.

Question 8

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

Accepted Answer

Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.. Deploying two Cloud VPN tunnels from two Cloud Routers with BGP sessions provides high availability and automatic failover. The two Cloud Routers in different zones ensure redundancy, and BGP (Border Gateway Protocol) dynamically advertises routes and detects tunnel failures, allowing traffic to automatically switch to the healthy tunnel without manual intervention. This meets the requirement for an IPsec VPN connection to a third-party SaaS provider that only supports IPsec VPN.

Answer

Use Dedicated Interconnect with VLAN attachments to the SaaS provider.

Answer

Deploy a Classic VPN tunnel with policy-based routing.

Answer

Deploy a single Cloud VPN tunnel and use static routing.

Question 9

A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?

Accepted Answer

Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.. Firewall rules are evaluated in order of priority (lower number = higher priority). The deny rule at priority 1000 will deny all IPs. To allow the VPN IP, a higher priority (lower number) allow rule must be created for that specific IP, before the deny rule is evaluated. The correct approach is to create an allow rule with priority 100 (or any lower number) for source IP 203.0.0.0/8 (or the specific IP) targeting web-server.

Answer

Modify the existing deny rule to include an exception for the VPN IP in the source IP field.

Answer

Delete the deny rule and create a single rule that denies all IPs except the VPN IP using the 'except' option.

Answer

Change the priority of the existing deny rule to 1 and create an allow rule with priority 2 for the VPN IP.

Question 10

A company uses Cloud VPN tunnels to connect multiple sites to Google Cloud. They have a primary and a backup tunnel for redundancy, each with a different Cloud Router (both in the same region). BGP sessions are established on both routers. The network team notices that during a failover test, traffic fails over to the backup tunnel but then after 30 seconds, the backup tunnel traffic stops and does not recover until the primary tunnel comes back. The engineer finds that the backup Cloud Router is advertising the same routes as the primary, but the backup tunnel's BGP session shows that the routes are being withdrawn after 30 seconds. Additionally, the BGP session remains established. What is the most likely cause?

Accepted Answer

The backup Cloud Router's BGP session is experiencing a keepalive timeout due to incorrect timers.. The backup Cloud Router's BGP session remains established, but routes are withdrawn after 30 seconds. This is classic behavior of a BGP keepalive or hold timer mismatch: if the backup router expects a keepalive within a shorter interval than the peer sends, the hold timer expires, causing the router to withdraw all routes learned from that peer while keeping the TCP session alive (or re-establishing it). The 30-second interval matches the default BGP hold timer (90 seconds) divided by three, suggesting a timer misconfiguration on the backup router.

Answer

The backup Cloud Router is configured with a lower MED value, causing the routes to be withdrawn.

Answer

The backup tunnel is using a static routing method instead of dynamic BGP.

Answer

The backup tunnel's Cloud Router is in a different region, and the routes are not propagated globally.

Question 11

A company has a VPC with subnets in us-central1 and europe-west1. They want to deploy a Cloud NAT to allow VMs in both regions to access the internet. How many Cloud NAT gateways are needed?

Accepted Answer

Two Cloud NAT gateways, one per region.. Cloud NAT is a regional resource; each region requires its own Cloud NAT gateway. A single gateway cannot cover multiple regions because Cloud NAT does not support global scope. For VMs in us-central1 and europe-west1 to access the internet, you need one Cloud NAT gateway per region, totaling two. Therefore, option C is correct. Option A is incorrect because Cloud NAT is necessary for private VMs to reach the internet without external IP addresses. Option B is incorrect because Cloud NAT operates at the region level, not per subnet; a regional gateway serves all subnets in that region. Option D is incorrect because Cloud NAT is regional, not global.

Answer

None; Cloud NAT is not required for internet access.

Answer

One Cloud NAT gateway per subnet.

Answer

One Cloud NAT gateway covering both regions.

Question 12

A company wants to expose a globally distributed application using Cloud Run via a single anycast IP address, with SSL termination and content-based routing to different backend services. Which load balancer should they use?

Accepted Answer

Global External HTTPS Load Balancer. The Global External HTTPS Load Balancer provides a single anycast IP, SSL termination, and content-based routing via URL maps to backends like serverless NEGs pointing to Cloud Run.

Answer

Global External SSL Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global External TCP Proxy Load Balancer

Question 13

An organization is experiencing high latency on their Partner Interconnect connection. Which TWO tools or features can they use to diagnose the issue from within Google Cloud? (Choose two.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic flowing to and from VPC instances, including latency-related metrics such as packet loss and retransmissions. By analyzing these logs, you can identify if high latency is caused by dropped packets or congestion on the Partner Interconnect link. This makes VPC Flow Logs a direct diagnostic tool for latency issues from within Google Cloud.

Answer

Network Intelligence Center performance dashboard

Answer

Cloud Router logs

Answer

Cloud Load Balancing logs

Question 14

A company has a VPC with subnets in us-east1 and europe-west1. They need low-latency communication between instances in these regions using private IPs only. Which solution should they use?

Accepted Answer

Use a Global VPC (default VPC mode).. A Global VPC (default VPC mode) allows subnets in multiple regions to communicate using private IPs natively, without any additional VPN or peering configuration. This is because a Global VPC spans all regions, and instances within the same VPC can reach each other via internal IPs using Google's global network, providing low-latency communication.

Answer

Use Cloud VPN to connect the regions.

Answer

Use Cloud Interconnect to connect the regions.

Answer

Use VPC Network Peering between the two regional subnets.

Question 15

A company needs to connect multiple VPCs in different projects and regions to a common hub VPC for centralized inspection. They want to avoid complex mesh peering configurations. Which service should they use?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is the correct choice because it provides a hub-and-spoke topology that connects multiple VPCs across projects and regions to a central hub VPC for centralized inspection, without requiring complex mesh peering. NCC uses a software-defined networking (SDN) controller to manage inter-VPC connectivity and routing, enabling traffic to flow through the hub VPC for inspection appliances like firewalls or IDS/IPS.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 16

A company uses Traffic Director with Envoy sidecars for service mesh. They want to gradually shift traffic from version 1 to version 2 of a service, starting with 10% traffic to version 2. Which Traffic Director feature should they use?

Accepted Answer

Traffic splitting. Traffic Director supports traffic splitting via the service routing API (TrafficDirectorService). You can define weighted destinations in the routing rule to split traffic between versions.

Answer

Circuit breakers

Answer

Fault injection

Answer

mTLS authentication

Question 17

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Accepted Answer

Use a global external HTTP(S) load balancer with an anycast IP and enable Cloud CDN.. A global external HTTP(S) load balancer uses a single anycast IP address, which directs each user to the closest healthy backend based on the user's geographic location and backend health. Enabling Cloud CDN further reduces latency by caching content at Google's global edge locations, ensuring that static and dynamic content is served from the nearest point of presence.

Answer

Deploy a regional external HTTP(S) load balancer in each region and use Cloud CDN to cache content.

Answer

Configure an internal TCP/UDP load balancer in each region with DNS-based geolocation routing.

Answer

Set up a global external TCP proxy load balancer with SSL termination at each backend.

Question 18

Based on the exhibit, what is the purpose of Cloud Router's BGP configuration?

Accepted Answer

To advertise the VPC's IP range to the on-premises network.. Cloud Router uses BGP to dynamically exchange routes between a VPC network and an on-premises network over a VPN tunnel or Dedicated Interconnect. In this configuration, the purpose is to advertise the VPC's IP range (the custom or auto-mode subnet CIDR) to the on-premises router, enabling on-premises hosts to route traffic back to the VPC. This is achieved by configuring the Cloud Router with a BGP session and setting the advertised route for the VPC's IP range.

Answer

To load balance traffic across multiple VPN tunnels.

Answer

To receive a default route from the on-premises network.

Answer

To advertise a default route to the on-premises network.

Question 19

A developer wants to log all denied firewall rule events for security auditing purposes. What is the simplest way to achieve this without modifying existing firewall rules?

Accepted Answer

Create a deny-all firewall rule with logging enabled at the lowest priority. Firewall rules logging can be enabled per rule. However, if you want to log all denied traffic without modifying existing rules, you can create a high-priority deny-all rule (e.g., priority 65535) with logging enabled. This will log any traffic not explicitly allowed.

Answer

Use Cloud NAT logging

Answer

Enable firewall rule logging on existing rules

Answer

Enable VPC Flow Logs on all subnets

Question 20

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

Accepted Answer

MED (Multi-Exit Discriminator). MED (Multi-Exit Discriminator) is used to influence inbound route preference. A lower MED value is preferred. Setting a lower MED for the specific subnet will make it preferred over the less specific route.

Answer

Local preference

Answer

AS path prepend

Answer

Weight