PCNE Practice Test 3 — 25 Questions

Question 1

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

Accepted Answer

Specify a subnet in the same region as the backend instances.. An internal load balancer (ILB) in GCP requires a regional forwarding rule that routes traffic to backend instances within the same VPC. Specifying a subnet in the same region as the backend instances is mandatory because the ILB's internal IP address is allocated from that subnet, and the forwarding rule must reference a subnet to enable internal-only routing. Without a subnet, the ILB cannot be provisioned as an internal load balancer.

Answer

Assign a static external IP address to the forwarding rule.

Answer

Upload an SSL certificate to the load balancer.

Answer

Create a Cloud NAT gateway for the backend instances.

Question 2

A company is planning to migrate their on-premises application to Google Cloud. The application requires consistent high bandwidth and low latency to on-premises databases. They have a Dedicated Interconnect connection with a 10 Gbps link. To improve availability, they decide to add a second Interconnect connection. Which of the following is a best practice for configuring BGP sessions?

Accepted Answer

Configure two BGP sessions, each on a separate connection, with different ASNs and MED values to influence path selection. Option B is correct because using different ASNs on each BGP session allows the on-premises router to treat the two Dedicated Interconnect connections as separate routing peers, enabling path selection control via MED values. This ensures that if one connection fails, traffic can be rerouted through the other, improving availability without relying on ECMP or a single session, which would not provide the desired redundancy and traffic engineering.

Answer

Configure two BGP sessions with the same ASN and MED values

Answer

Enable ECMP across the two connections with a single BGP session

Answer

Use a single BGP session across both connections

Question 3

An engineer creates a Cloud NAT configuration as shown in the exhibit. The test-instance is created without an external IP address. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The subnet subnet-a is in a region different from us-central1. Option A is correct because Cloud NAT is a regional resource that applies to all instances within a given region. The exhibit shows subnet-a is in a different region than us-central1, so the NAT gateway cannot route traffic from instances in that subnet. Even though the instance is in us-central1, the subnet's region mismatch means the NAT configuration does not apply, leaving the instance without internet access.

Answer

The Cloud Router is not in the same zone as the instance

Answer

A firewall rule is blocking outbound traffic from the instance

Answer

Logging is enabled but not configured to send logs to Cloud Logging

Question 4

A network engineer is designing a VPC in Google Cloud with multiple subnets across different regions. The application requires low-latency communication between instances in the same region but not across regions. Which VPC network configuration should be used?

Accepted Answer

Custom mode VPC with regional subnets. Custom mode VPC with regional subnets (D) is correct because it allows you to explicitly define subnets in specific regions, ensuring that instances within the same region communicate over low-latency paths without cross-region traffic. This design avoids the automatic creation of subnets in every region (as in auto mode) and prevents the use of deprecated legacy networks, giving you full control over regional placement for latency-sensitive applications.

Answer

Auto mode VPC with global subnets

Answer

Legacy network

Answer

Auto mode VPC with regional subnets

Question 5

A company is deploying a global application on Google Cloud using Cloud Load Balancing. They want to serve traffic from multiple regions and require the lowest possible latency for users worldwide. The application serves HTTP traffic and uses a static IP address. Which load balancing solution should they use?

Accepted Answer

External HTTP(S) Load Balancer with Premium Tier. The External HTTP(S) Load Balancer with Premium Tier is correct because it uses Google's global anycast IP address to route user traffic to the nearest frontend, minimizing latency worldwide. Premium Tier leverages Google's global network backbone, ensuring traffic enters and exits at the closest Google edge point of presence (PoP) for HTTP(S) traffic, which is essential for a global application requiring low latency and a static IP.

Answer

Network Load Balancer

Answer

Internal HTTP(S) Load Balancer

Answer

SSL Proxy Load Balancer

Question 6

Refer to the exhibit. The Cloud Router shows one BGP peer as ESTABLISHED and one as IDLE. The best routes show two routes to the same destination with different priorities. What is the most likely reason the IDLE peer is not establishing?

Accepted Answer

BGP configuration mismatch between Cloud Router and on-premises router for the IDLE peer. The IDLE state in BGP indicates that the session has not been established, typically due to a configuration mismatch. Since the Cloud Router shows one peer as ESTABLISHED and another as IDLE, the most likely cause is a mismatch in BGP parameters (such as AS number, peer IP, or authentication) between the Cloud Router and the on-premises router for the IDLE peer. This prevents the BGP session from transitioning out of the IDLE state.

Answer

The on-premises router is not sending routes for the IDLE peer

Answer

The IDLE peer has a higher priority route, so it is not needed

Answer

The IDLE peer is not configured on the Cloud Router

Question 7

A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?

Accepted Answer

Enable MACsec on the Dedicated Interconnect. MACsec (IEEE 802.1AE) provides Layer 2 encryption on the Dedicated Interconnect link itself, encrypting all traffic between the on-premises router and the Google Cloud edge router without requiring any changes to applications or additional VPN gateways. This meets the encryption requirement with minimal overhead and complexity because MACsec operates transparently at the data link layer, adding negligible latency and no per-packet processing overhead compared to IPsec or TLS.

Answer

Enable TLS encryption on all applications

Answer

Use Cloud VPN over the internet instead of Dedicated Interconnect

Answer

Establish an IPsec VPN tunnel over the Dedicated Interconnect

Question 8

A company has a Hybrid Connectivity setup using Cloud VPN with dynamic routing (BGP). They notice that traffic from their on-premises network to Google Cloud is intermittently dropping. The on-premises BGP speaker is sending routes with a higher local preference (200) than the Google Cloud router (default 100). What is the most likely cause of the intermittent drops?

Accepted Answer

Asymmetric routing is causing traffic to be dropped by stateful firewalls. The on-premises BGP speaker is sending routes with a higher local preference (200) than the default on Cloud Router (100). This makes the on-premises route preferred for return traffic from Google Cloud, but the forward traffic from on-premises may still use the Cloud VPN tunnel. This asymmetry causes stateful firewalls (e.g., on-premises firewall or Google Cloud firewall) to drop packets that do not match an existing session, leading to intermittent drops.

Answer

AS path prepending is causing route flapping

Answer

Cloud Router is not configured for ECMP

Answer

The BGP MED attribute is misconfigured

Question 9

An organization wants to migrate legacy on-premises applications to Google Cloud but must maintain low-latency connectivity for real-time data synchronization. The on-premises data center is in a colocation facility that is not directly served by Google Cloud. Which hybrid connectivity option is most cost-effective while meeting the latency requirement?

Accepted Answer

Partner Interconnect. Partner Interconnect is the most cost-effective option because it provides a dedicated, low-latency connection through a supported service provider that can extend connectivity from the colocation facility to a Google Cloud region. Unlike Dedicated Interconnect, it does not require physical cross-connects in a Google Cloud colocation facility, making it ideal when the on-premises site is not directly served by Google Cloud. It meets the real-time synchronization latency requirement by offering a reliable, high-bandwidth connection with SLA-backed uptime.

Answer

Direct Peering

Answer

Cloud VPN with dynamic routing

Answer

Dedicated Interconnect

Question 10

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

Accepted Answer

Confirm that the subnet routes for the instance IP ranges are present in the VPC. Option B is correct because for on-premises traffic to reach Compute Engine instances over Dedicated Interconnect, the VPC must have a subnet route (either automatically created or custom static/dynamic route) that matches the instance IP ranges. Without this route, packets from the on-premises network will be dropped by the VPC router, even if the VLAN attachment is reachable.

Answer

Verify that the on-premises network has IAM permissions to access instances

Answer

Ensure that the VLAN attachment IP is in the same subnet as the instances

Answer

Check that BGP sessions are established between Cloud Router and on-premises router

Question 11

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

Accepted Answer

Use a Cloud Router with BGP and establish multiple BGP sessions over each Interconnect. Option D is correct because Cloud Router with BGP enables dynamic routing, allowing multiple BGP sessions over each Cloud Interconnect. When one interconnect fails, BGP withdraws the affected routes, and traffic is automatically redistributed across the remaining BGP sessions without manual intervention. This meets the requirement for automatic failover and load balancing across the five 10 Gbps connections.

Answer

Configure multiple VLAN attachments on a single Cloud Router and rely on link aggregation

Answer

Deploy Cloud VPN tunnels as backup and configure static routes with lower priority

Answer

Configure VPC Network Peering between all data centers and Google Cloud

Question 12

A company is planning to connect multiple VPCs in different regions to their on-premises network using a single Dedicated Interconnect. Which TWO configurations are required to achieve this?

Accepted Answer

Create a Cloud Router in each VPC. Option C is correct because each VPC requires its own Cloud Router to establish dynamic routing (BGP) over the Dedicated Interconnect. A Cloud Router is a per-VPC resource that manages BGP sessions and routes for that specific VPC, and since the interconnect is shared, each VPC must have its own router to participate in routing independently.

Answer

Create a single Cloud Router for all VPCs

Answer

Set up Cloud VPN tunnels for regional connectivity

Answer

Use a global VLAN attachment

Question 13

A company has a Hybrid Connectivity setup using Cloud VPN with BGP. They want to migrate to Dedicated Interconnect for better performance. During the migration, they need to avoid downtime. Which THREE steps should they take?

Accepted Answer

Provision the Dedicated Interconnect and VLAN attachments. Option C is correct because provisioning the Dedicated Interconnect and VLAN attachments is the foundational step to establish the new high-performance connection. Without this, there is no physical or logical path to migrate traffic onto. This must be done before any BGP configuration or route manipulation can occur.

Answer

Set a lower local preference on the Interconnect BGP session

Answer

Remove the VPN tunnels immediately after Interconnect is up

Question 14

A company has a VPC with several subnets and wants to force traffic between two specific subnets (A and B) to be inspected by a third-party firewall appliance in a separate subnet (C). The firewall has source/destination check disabled. What is the best way to route traffic from A to B through C?

Accepted Answer

Use a policy-based route to redirect traffic from A to B to the firewall's IP.. Policy-based routes allow you to define a forwarding rule that matches traffic based on source and destination IP ranges, then sends it to a next-hop instance (the firewall). Since the firewall has source/destination check disabled, it can forward the inspected traffic to the final destination. This is the only option that directly forces traffic between subnets A and B through the firewall in subnet C.

Answer

Use Cloud NAT to route traffic through the firewall.

Answer

Use a custom route with a lower priority for the destination subnet.

Answer

Use VPC flow logs to monitor traffic.

Question 15

An organization is deploying a global application and wants to use an Internal Load Balancer (ILB) across multiple regions. What is the correct configuration?

Accepted Answer

Deploy ELB in each region and use DNS to route traffic. Option C is correct because Google Cloud does not support a native cross-region Internal Load Balancer (ILB). To distribute traffic across multiple regions, you must deploy a separate Internal TCP/UDP Load Balancer in each region and use DNS-based routing (e.g., Cloud DNS with geo-routing or weighted record sets) to direct clients to the appropriate regional ILB. This approach provides regional high availability and global reach without exposing internal IPs externally.

Answer

Use a cross-region ILB by enabling global access

Answer

Use an Internal TCP/UDP Load Balancer in one region and route traffic via Cloud VPN

Answer

Use a global External Load Balancer with internal backend

Question 16

Which TWO of the following are valid reasons to use a Shared VPC architecture?

Accepted Answer

To prevent individual projects from creating their own VPCs and force them to use a common VPC. Option C is correct because a Shared VPC architecture allows an organization to enforce that individual projects cannot create their own VPCs; instead, they must use a common VPC that is centrally managed. This is achieved by designating a host project that contains the shared VPC network, and attaching service projects to it, which prevents the service projects from having their own independent VPC networks.

Answer

To reduce latency by placing resources in the same region within a single VPC

Answer

To improve network connectivity between different organizational units without using VPN or peering

Answer

To reduce egress costs by having all resources in one VPC

Question 17

A company is designing a global application that requires low-latency access to GCP services like Cloud Storage and BigQuery. They also need to minimize egress costs for traffic to the internet. Which network service tier should they choose for their GCP resources?

Accepted Answer

Premium Tier for all resources. The Premium Tier routes traffic over Google's global network backbone, providing lower latency and higher performance for accessing GCP services like Cloud Storage and BigQuery. It also minimizes egress costs to the internet by keeping traffic on Google's private network for as long as possible, reducing reliance on public transit.

Answer

Use a CDN to reduce latency and no specific tier

Answer

Premium Tier for Compute Engine instances and Standard Tier for Cloud Storage

Answer

Standard Tier for all resources

Question 18

A company uses VPC Service Controls to protect a managed service (e.g., BigQuery) within a service perimeter. Developers need to access the service from an on-premises network via a Cloud VPN tunnel with a specific IP address. However, access is being denied. What is the most likely cause?

Accepted Answer

The on-premises source IP is not included in the allowed external IP addresses list in the perimeter.. VPC Service Controls enforce access to managed services like BigQuery by restricting which source IPs can reach the service. When accessing from on-premises via Cloud VPN, the source IP seen by the service is the on-premises client's IP, not the VPN gateway's IP. If that on-premises source IP is not explicitly added to the allowed external IP addresses list in the service perimeter, access is denied, even though the VPN tunnel is established.

Answer

The project containing the VPN tunnel is not in the same perimeter.

Answer

The VM instances in the perimeter do not have public IP addresses.

Answer

The Cloud VPN tunnel is not using IKEv2.

Question 19

A company deploys a web application behind a global external HTTP(S) load balancer and wants to protect against SQL injection attacks. Which Google Cloud security product should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities, including pre-configured rules to filter SQL injection (SQLi) attacks at the edge of Google's network, before traffic reaches the backend. It integrates directly with the global external HTTP(S) load balancer to inspect HTTP/HTTPS requests and block malicious payloads based on OWASP Top 10 signatures.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Answer

Cloud IDS

Question 20

Which THREE of the following are required to use Private Google Access for on-premises hosts through a Cloud VPN or Interconnect? (Choose THREE)

Accepted Answer

Firewall rules allowing traffic from on-premises to the restricted VIP IP range.. Private Google Access for on-premises hosts requires firewall rules that allow traffic from on-premises to the restricted VIP IP range (199.36.153.4/30). This is necessary because on-premises hosts must be able to reach the restricted Google APIs VIP over the VPN or Interconnect, and firewall rules control which source IPs can access that VIP. Without these rules, traffic from on-premises would be blocked at the Google Cloud perimeter.

Answer

VPC Flow Logs enabled on the VPC.

Answer

Cloud NAT configured for the on-premises subnet.