PCNE Practice Test 3 — 25 Questions

Question 1

A company has a Dedicated Interconnect connection with a VLAN attachment in their GCP VPC. They want to use BGP to exchange routes with their on-premises router. Which GCP resource must be configured to establish the BGP session?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Router. A Cloud Router is required to establish BGP sessions over VLAN attachments. The Cloud Router manages BGP peers and route advertisements.

Answer

VPC peering

Answer

Network Connectivity Center

Answer

Cloud VPN gateway

Question 2

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

Accepted Answer

The engineer forgot to add firewall rules to allow traffic from the peer range.. The most likely cause is that the engineer forgot to add firewall rules to allow traffic from the peer range. Even though VPC peering is ACTIVE, the default ingress deny all firewall rule blocks incoming traffic. To allow communication between instances in peered VPCs, you must create ingress firewall rules in each VPC that permit traffic from the other VPC's subnet CIDR ranges.

Answer

The VPCs use different routing modes.

Answer

The IAM permissions for the peering are missing.

Answer

The VPCs have overlapping subnet CIDR ranges.

Question 3

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Accepted Answer

Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.. Cloud NAT in Google Cloud can be scoped to specific instances using network tags. By applying a network tag to the instances that should use NAT and then creating a Cloud NAT gateway with that tag, only those tagged instances will have their traffic NATed. This allows granular control without affecting other instances in the same subnet.

Answer

Assign external IPs to non-NAT instances.

Answer

Use firewall rules to allow NAT for tagged instances.

Answer

Create separate subnets for NAT instances.

Question 4

A company wants to resolve DNS queries from their on-premises network for a privately hosted zone in Google Cloud (e.g., example.internal). They also want on-premises DNS servers to resolve GCP internal VM hostnames. Which two Cloud DNS features should they implement? (Choose TWO.)

Accepted Answer

DNS peering. DNS peering allows on-premises to query GCP private zones, and DNS forwarding (inbound) allows GCP to forward queries to on-premises DNS servers.

Answer

Public zone delegation

Answer

DNS forwarding (outbound)

Answer

Split-horizon DNS

Question 5

A company is using a Classic VPN with static routing to connect to GCP. They need to add a new subnet in GCP and make it reachable from on-premises without manual configuration changes on-premises. What is the limitation of Classic VPN in this scenario?

Accepted Answer

Classic VPN requires manual route updates on-premises. Classic VPN with static routing requires manual configuration of routes on both the GCP side and the on-premises side. When adding a new subnet in GCP, the on-premises router must be manually updated to include the new subnet in its routing table, otherwise traffic to that subnet will not be routed through the VPN. This is a limitation because it does not support dynamic route advertisement.

Answer

Classic VPN does not support IKEv2

Answer

Classic VPN supports BGP, so routes are automatically advertised

Answer

Classic VPN cannot be used with multiple subnets

Question 6

An organization has multiple VPCs in different projects that need to share subnets to create a common network segment. They want central control over network administration while allowing individual project teams to deploy resources. Which approach should they use?

Accepted Answer

Shared VPC with a host project and service projects. Shared VPC allows a host project to share subnets with service projects, providing central network administration while allowing teams to deploy resources independently.

Answer

VPN tunnels connecting all VPCs

Answer

VPC Network Peering between all VPCs

Answer

Creating a single VPC in one project and granting IAM permissions to other projects

Question 7

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

Accepted Answer

Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.. A Google Cloud HA VPN gateway has two interfaces, each with its own external IP, and requires two VPN tunnels — one per interface — to achieve 99.99% availability. Each tunnel must have its own BGP session with the on-premises VPN device, and the on-premises device must be configured to peer with both. This creates the redundant tunnel pair that HA VPN is designed for.

Answer

Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.

Answer

Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.

Answer

Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.

Question 8

A company has two HA VPN tunnels between GCP and on-premises. They want to use both tunnels simultaneously for load balancing traffic. Which BGP feature should they configure on the Cloud Router to achieve equal-cost multipath (ECMP)?

Accepted Answer

Advertise identical routes with equal BGP metrics (AS path length, MED, etc.) from both tunnels.. ECMP is achieved by having multiple BGP paths with equal MED and AS path length. The Cloud Router automatically load balances if routes have equal metrics.

Answer

Use AS path prepending on one tunnel.

Answer

Set different MED values on each tunnel to prefer one.

Answer

Enable policy-based VPN instead of route-based.

Question 9

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's edge security service that attaches to HTTP(S) Load Balancers and provides WAF capabilities via preconfigured rules such as the OWASP ModSecurity Core Rule Set, which specifically detects and blocks SQL injection (SQLi) and cross-site scripting (XSS). Because it operates at the load balancer layer (Layer 7), it can inspect HTTP request headers, URLs, and bodies where these web exploits live. Firewall rules and Cloud IDS operate at different layers and cannot perform application-layer payload inspection for these attack types.

Answer

Firewall Rules

Answer

Cloud IDS

Answer

VPC Service Controls

Question 10

Which Google Cloud hybrid connectivity option can be configured without using BGP?

Accepted Answer

Classic VPN with static routes. Classic VPN can be configured with static routes and does not require BGP. Partner Interconnect and Dedicated Interconnect require BGP for routing. HA VPN also typically uses BGP for dynamic routing, making D the only option that can operate without BGP.

Answer

Partner Interconnect

Answer

Dedicated Interconnect

Answer

HA VPN

Question 11

An organization wants to use Shared VPC but restrict access to certain subnets for specific service projects. Which GCP feature should they use?

Accepted Answer

Subnet-level IAM bindings. Subnet-level IAM bindings allow you to grant roles (e.g., compute.networkUser) on specific subnets within a Shared VPC to service project principals. This restricts access to only those subnets, while the service project can still use the shared network. It is the native GCP mechanism for fine-grained subnet access control in a Shared VPC environment.

Answer

VPC Network Peering

Answer

VPC Service Perimeters

Answer

Firewall rules

Question 12

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

Accepted Answer

Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.. Traffic Director uses Envoy's fault injection capabilities, which are configured via route rules in the URL map. To inject a 50% failure rate, you configure a fault injection policy with a percentage and an abort or fixed delay. This is done in the route rule, not via backend service flags or circuit breakers.

Answer

Use the gcloud compute backend-services update command with the --fault-injection flag.

Answer

Set a circuit breaker with a max pending requests threshold.

Answer

Create a backend service with connection draining and set the drain timeout.

Question 13

Which Cloud DNS zone type is used to resolve DNS names for resources within a VPC network, and is not accessible from the internet?

Accepted Answer

Private managed zone. A private managed zone in Cloud DNS is used to resolve DNS names for resources within a VPC network and is explicitly not accessible from the internet. It is scoped to one or more VPC networks, and only resources within those authorized networks can query the zone. This makes it the correct answer for internal-only DNS resolution.

Answer

Peering zone

Answer

Forwarding zone

Answer

Public managed zone

Question 14

Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?

Accepted Answer

Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.. The preconfigured WAF rule for SQL injection (sqli-stable) uses a default sensitivity level that may be too aggressive, causing false positives on legitimate traffic. By lowering the sensitivity level or excluding specific request attributes (e.g., headers, cookies, or URI paths), you can reduce false positives while still blocking actual SQL injection attempts. Cloud Armor allows fine-tuning of preconfigured rules via the `sensitivity` parameter and `exclude` lists, which is the correct approach here.

Answer

Add a rate-based rule to limit the number of requests per second.

Answer

Create a rule with higher priority to allow the legitimate traffic before the WAF rule.

Answer

Enable TLS inspection for the load balancer to fully inspect encrypted traffic.

Question 15

A network engineer wants to test whether a Compute Engine VM can reach a Cloud SQL instance in a different VPC network, considering firewall rules and VPC peering. Which Google Cloud tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests is a Network Intelligence Center tool that performs a live, simulated reachability analysis between a source and destination, evaluating firewall rules, routes, VPC peering, and other configuration along the path. It explicitly supports testing connectivity from a Compute Engine VM to a Cloud SQL instance across VPC networks, including peered topologies, and reports exactly where traffic would be allowed or dropped.

Answer

VPC Flow Logs

Answer

Firewall Insights

Answer

Packet Mirroring

Question 16

A company wants to publish an internal service (e.g., a database) in their VPC so that consumers in other VPCs can connect to it privately via Private Service Connect (PSC). What must be created on the producer side?

Accepted Answer

A Service Attachment that exposes the service.. Private Service Connect allows producers to publish services via a Service Attachment. The service attachment is created on a Network Endpoint Group (NEG) that points to the internal service (e.g., a backend service). Consumers then create PSC endpoints to connect.

Answer

A Cloud VPN tunnel to the consumer VPC.

Answer

A VPC peering connection.

Answer

A Private Service Connect endpoint in the producer VPC.

Question 17

You are designing DNS resolution for a hybrid cloud. On-premises DNS servers must resolve GCP private VM hostnames, and GCP VMs must resolve on-premises hostnames. Which Cloud DNS feature should you use?

Accepted Answer

DNS forwarding (inbound and outbound). DNS forwarding with inbound and outbound policies is the correct choice because it enables bidirectional resolution between on-premises and GCP VMs. Outbound forwarding sends queries from GCP to on-premises DNS servers, while inbound forwarding allows on-premises clients to resolve GCP private VM hostnames by forwarding queries to Cloud DNS. This creates a seamless hybrid DNS namespace without exposing private zones to the internet.

Answer

DNS peering

Answer

Cloud DNS public zones

Answer

Split-horizon DNS

Question 18

An organization needs to restrict access to Google Cloud APIs such that only traffic from a specific set of VMs inside a VPC can reach the APIs, and all other traffic (including from other VPCs) must be denied. The VMs do not have external IPs. Which combination of services should they use?

Accepted Answer

Private Google Access and VPC Service Controls. Private Google Access allows VMs without external IPs to reach Google APIs. VPC Service Controls can create a service perimeter that restricts access to APIs from only authorized VPCs.

Answer

Private Service Connect and VPC Service Controls

Answer

Cloud NAT and VPC Service Controls

Answer

Cloud NAT and Private Google Access

Question 19

You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?

Accepted Answer

The domain is not verified for the Google-managed certificate on the frontend.. When a Google-managed certificate is used on the frontend of an SSL proxy load balancer, the domain must be verified via DNS or a challenge file. If the domain is not verified, the certificate cannot be provisioned or validated, causing a mismatch between the certificate's Subject Alternative Names (SANs) and the domain clients are connecting to, resulting in SSL errors.

Answer

The SSL policy is configured to require TLS 1.3 only.

Answer

The backend self-managed certificate is not signed by a public CA.

Answer

The backend service must use a Google-managed certificate as well.

Question 20

An organization has an internal application that runs on Compute Engine and needs to be load balanced within the same region using a Layer 7 load balancer. They want the load balancer to be accessible only from within their VPC. Which THREE components are needed? (Choose three.)

Accepted Answer

A Regional Internal HTTP(S) Load Balancer forwarding rule. The three required components for a Regional Internal HTTP(S) Load Balancer are the forwarding rule, backend service, and URL map. While a health check is necessary to define in the backend service, it is not a separate component of the load balancer itself. The SSL certificate is optional and only needed if HTTPS is used, not for basic internal load balancing.

Answer

A health check

Answer

An SSL certificate