PCNE Practice Test 4 — 25 Questions

Question 1

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises firewall is blocking health check probes from Google Cloud. Hybrid connectivity NEGs require that the on-premises endpoint is reachable via a Cloud VPN or Interconnect. If Traffic Director cannot reach the endpoint, it might be due to missing firewall rules allowing health check probes or the NEG endpoint being misconfigured. The most common cause is that health checks are failing because the firewall rules on-premises are not allowing the health check source ranges.

Answer

The hybrid connectivity NEG is not supported with Traffic Director

Answer

The Cloud VPN tunnel is not established

Answer

Traffic Director requires mTLS for all hybrid endpoints

Question 2

A financial company requires encrypted traffic between on-premise and GCP. They have strict compliance requiring that encryption keys are managed on-premise and rotated every 30 days. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect with MACsec. B is correct because MACsec (IEEE 802.1AE) provides encryption at Layer 2, which is required for Cloud Interconnect to secure traffic between on-premise and GCP. Unlike VPN solutions, MACsec allows the customer to manage encryption keys on-premise and rotate them every 30 days, meeting strict compliance requirements. Cloud Interconnect with MACsec ensures low-latency, high-bandwidth connectivity while keeping key management under the customer's control.

Answer

Cloud VPN with certificate-based authentication using on-prem CA

Answer

Cloud VPN with IKEv2 and pre-shared keys

Answer

Cloud Interconnect with VLAN attachments

Answer

Partner Interconnect with a service provider that supports MACsec

Question 3

A company wants to deploy an HTTP application on Compute Engine instances in us-east1 and europe-west1, and use a global external HTTP(S) load balancer. How should they configure the backend?

Accepted Answer

Create one backend service and add two instance groups, one from each region.. A global external HTTP(S) load balancer requires a single backend service that can span multiple regions. By adding one instance group from us-east1 and another from europe-west1 to the same backend service, the load balancer automatically routes traffic to the closest healthy backend based on the client's geographic location and the load balancer's anycast IP. This configuration leverages Google's global network infrastructure for optimal latency and failover.

Answer

Create a regional load balancer in each region and use DNS round-robin.

Answer

Create one backend service and add one instance group with instances in both regions.

Answer

Create two backend services, one per region, and attach to the same URL map.

Question 4

You need to configure a health check for a backend service that uses HTTP2. Which THREE settings must be configured correctly for the health check to work? (Select three.)

Accepted Answer

Request path. For an HTTP2 health check, you need to specify the protocol (HTTP2), a port, and a request path.

Answer

Proxy protocol

Answer

SSL certificate

Question 5

Which Cloud DNS routing policy should you use to direct users to the nearest healthy backend based on their geographic location?

Accepted Answer

Geolocation. Geolocation routing policy directs traffic based on the user's geographic location. Weighted round robin distributes by weight, failover is for primary/backup.

Answer

Failover

Answer

Weighted round robin

Answer

Response policy

Question 6

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

Accepted Answer

Configure Cloud NAT with a static NAT IP address and ensure all traffic uses that IP.. Cloud NAT with a static NAT IP address ensures that all outbound traffic from private instances uses a consistent, predictable source IP. This satisfies the external API's requirement for a static source IP without needing to assign public IPs directly to instances. Option C correctly configures Cloud NAT to use a static IP, which is the intended solution for this scenario.

Answer

Use Private Google Access instead of Cloud NAT.

Answer

Assign a static external IP to the instances and use Cloud NAT with static IPs.

Answer

Use a VPN tunnel to the API provider's network.

Question 7

A company is deploying a GKE cluster with Dataplane V2 and wants to enforce micro-segmentation using network policies. They also need to monitor policy violations. What should they do?

Accepted Answer

Enable GKE Dataplane V2 and use Kubernetes Network Policies with audit logging.. Dataplane V2 uses eBPF to implement Kubernetes Network Policies directly in the kernel, providing native support for micro-segmentation. Enabling audit logging on the cluster captures denied or allowed policy actions, allowing the company to monitor policy violations without additional infrastructure.

Answer

Enable Packet Mirroring.

Answer

Use Cloud IDS to monitor traffic.

Answer

Use VPC firewall rules with pod IP ranges.

Question 8

A company is using Partner Interconnect to connect their data center to Google Cloud. They notice that traffic from their on-premises network to a specific subnet in VPC is taking a suboptimal path. Which action should they take to influence the routing preference?

Accepted Answer

Configure BGP MED values on the on-premises router for the prefixes advertised to the Cloud Router.. BGP MED (Multi-Exit Discriminator) is the standard mechanism for influencing inbound traffic path selection when multiple connections exist between two autonomous systems. By setting a lower MED value on the on-premises router for prefixes advertised to the Cloud Router, the on-premises network can signal Google Cloud to prefer that specific VLAN attachment for traffic destined to the subnet, thereby correcting the suboptimal path.

Answer

Use route priorities on the Cloud Router for the learned routes.

Answer

Change the VLAN attachment's mode to active-active.

Answer

Set a lower cost on the Cloud Router interface for the preferred VLAN attachment.

Question 9

A Dedicated Interconnect VLAN attachment is in ACTIVE state. The Cloud Router has learned routes from on-premises, and the on-premises router has learned routes from GCP. However, traffic from on-premises to a GCP VM fails. What should the engineer check first?

Accepted Answer

Both A and C.. Both firewall rules and VPC subnet routes must be in place for traffic to reach a GCP VM. Even if the VLAN attachment is ACTIVE and routes are exchanged, the VPC firewall must permit ingress from the on-premises range, and the VPC subnet routes must exist in the routing table for the VM's subnet. Without both, traffic will be dropped or not forwarded.

Answer

Check firewall rules on the GCP VPC for ingress from the on-premises range.

Answer

Confirm that the Cloud Router is advertising the on-premises subnets back to the VPC.

Answer

Verify that the VPC subnet routes exist in the routing table.

Question 10

A company has a VPC with multiple subnets and uses Cloud VPN tunnels to connect to on-premises. They want to ensure that only traffic destined for on-premises is sent through the VPN tunnels; all other traffic should use the internet. Which route configuration should they implement?

Accepted Answer

Use Cloud Router with BGP to exchange specific routes with on-premises, and keep the default internet route for other traffic.. Using Cloud Router with BGP allows the VPC to dynamically learn specific routes from the on-premises network via the VPN tunnels. The default route (0.0.0.0/0) remains pointing to the internet gateway, so only traffic destined for the learned on-premises prefixes is sent through the VPN, while all other traffic uses the internet. This provides precise control without overriding the default route.

Answer

Add a static route for 0.0.0.0/0 with next hop VPN gateway, and set a lower priority than the internet default route.

Answer

Configure the Cloud VPN to advertise a default route to on-premises, and rely on local preference.

Answer

Use VPC Network Peering with the on-premises network and configure custom route exchange.

Question 11

A customer reports that after setting up HA VPN, some on-premises subnets are not reachable from Google Cloud. The Cloud Router shows the missing routes. What is the most likely cause?

Accepted Answer

BGP route filters are blocking the advertisement of those subnets.. The Cloud Router shows the missing routes, indicating that the VPN tunnel and BGP session are up, but the routes are not being installed. BGP route filters on the Cloud Router or on-premises router can explicitly block the advertisement of specific subnets, preventing them from being learned and installed in the routing table even though the BGP session is established.

Answer

The VPN tunnel is down.

Answer

The on-premises router is not configured to advertise those subnets.

Answer

The shared secret is incorrect.

Question 12

An organization is designing IP address planning for hybrid connectivity. They have three VPCs (Prod, Dev, Test) that will be peered with each other and also connected to an on-premises network via Cloud VPN. Which practice should they follow to avoid IP address overlap?

Accepted Answer

Allocate unique, non-overlapping IP ranges for each VPC and on-premises network. To avoid routing conflicts, each VPC and the on-premises network should use unique, non-overlapping RFC 1918 CIDR blocks. Overlap would cause routing issues and potential traffic blackholing.

Answer

Use overlapping IP ranges but rely on NAT to resolve conflicts

Answer

Use carrier-grade NAT (CGNAT) ranges for all VPCs to avoid private IP conflicts

Answer

Use the same /16 range for all VPCs to simplify route summarization

Question 13

A company with multiple VPCs in a Shared VPC environment wants to connect their on-premises network to all VPCs with high availability and minimal cost. They already have a Dedicated Interconnect. What is the most efficient solution?

Accepted Answer

Use the existing Dedicated Interconnect to create multiple VLAN attachments, one per VPC.. A Dedicated Interconnect can support multiple VLAN attachments (each with a separate VLAN ID and BGP session) to connect to different VPCs in a Shared VPC environment. This approach leverages the existing physical connection, provides high availability through redundant attachments, and minimizes cost by avoiding additional circuits or VPN tunnels.

Answer

Set up Cloud VPN with dynamic routing to each VPC.

Answer

Create an HA VPN gateway for each VPC and peer with on-prem.

Answer

Provision a new Partner Interconnect for each VPC.

Question 14

A company uses a VPC with two subnets: subnet-a (10.0.1.0/24) with VMs tagged 'web', and subnet-b (10.0.2.0/24) with VMs tagged 'db'. They have a Cloud VPN tunnel to an on-premises network (172.16.0.0/16). The VPN tunnel is up and BGP is exchanging routes. A custom route for 172.16.0.0/16 with next hop VPN gateway exists, but it has a tag 'web', meaning it applies only to VMs with the 'web' tag. VMs in subnet-a can reach on-premises, but VMs in subnet-b cannot. Which step should be taken to allow subnet-b VMs to reach on-premises?

Accepted Answer

Add the 'db' tag to the custom route.. The custom route for 172.16.0.0/16 is tagged with 'web', so it only applies to VMs that have the 'web' tag. Subnet-b VMs are tagged 'db', so they do not match the route and cannot reach on-premises. Adding the 'db' tag to the route makes it apply to both tagged groups, enabling connectivity for subnet-b VMs without affecting existing traffic.

Answer

Create a new route for 172.16.0.0/16 with priority 1000 and no tag.

Answer

Remove the tag from the existing route.

Answer

Add a firewall rule to allow egress traffic from subnet-b.

Question 15

Refer to the exhibit. A request arrives with User-Agent 'GoodBot' and path '/admin'. What action does Cloud Armor take?

Accepted Answer

Allow the request because the rule with priority 200 matches and allows it.. Cloud Armor evaluates rules in order of priority (lowest number = highest priority). The rule with priority 200 matches the request (User-Agent 'GoodBot' and path '/admin') and explicitly allows it. Once a matching allow rule is found, evaluation stops, and the request is allowed, overriding any lower-priority rules.

Answer

Deny the request because the rule with priority 300 has a higher priority number but matches path.

Answer

Allow the request because of the default rule at priority 1000.

Answer

Deny the request because both rules match and deny takes precedence.

Question 16

A company is using Partner Interconnect to connect their on-premises network to Google Cloud. They need to choose between Layer 2 and Layer 3 connectivity options offered by the service provider. Which statement correctly describes the difference between Layer 2 and Layer 3 connectivity in Partner Interconnect?

Accepted Answer

Layer 3 connectivity requires the customer to have a BGP session with the partner's router, while Layer 2 allows direct BGP with Google Cloud.. With Layer 2, the partner provides a transparent VLAN; with Layer 3, the partner handles the IP routing, requiring a BGP session from the customer's on-prem router to the partner's router.

Answer

Layer 2 connectivity requires the customer to configure BGP with Google Cloud, while Layer 3 does not require any BGP on the customer side.

Answer

Layer 2 connectivity is only available for Dedicated Interconnect, not Partner Interconnect.

Answer

Both Layer 2 and Layer 3 require the customer to manage VLAN attachments inside GCP.

Question 17

An engineer is planning IP address ranges for two VPCs that will be connected via VPC peering. One VPC uses 10.1.0.0/16 and the other uses 10.2.0.0/16. They also plan to use HA VPN to an on-premises network using 10.0.0.0/8. Which IP range assignment could cause a conflict?

Accepted Answer

Conflict between on-premises (10.0.0.0/8) and both VPCs. The on-premises range 10.0.0.0/8 overlaps with both VPC ranges; VPC peering and VPN both require non-overlapping ranges.

Answer

Conflict between the two VPCs (10.1.0.0/16 and 10.2.0.0/16)

Answer

Conflict between VPC1 (10.1.0.0/16) and on-premises (10.0.0.0/8)

Answer

No conflict; all ranges are non-overlapping

Question 18

An organization wants to use Cloud DNS to resolve queries for a custom domain 'example.internal' across multiple projects in the same organization. They have a private zone in project A and want project B to be able to resolve records in that zone. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows a private zone in one project to be shared with other projects for DNS resolution.

Answer

Shared VPC

Answer

Public zone with visibility

Answer

DNS forwarding

Question 19

An engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They want to control which on-premises subnets are advertised to GCP. Which TWO methods can they use?

Accepted Answer

Apply BGP filters on the on-premises router to limit advertised prefixes. Custom learned routes can be configured to filter prefixes, and BGP filters can be applied on the on-premises side.

Answer

Change the Cloud Router ASN

Answer

Use route priority in the VPC

Answer

Set MED on the on-premises router

Question 20

An organization has two Dedicated Interconnect connections in an active-passive configuration. They want to make the passive connection active for maintenance. What should they do to fail over traffic?

Accepted Answer

Configure as-path prepending on the active Cloud Router BGP session to make it less preferred. To fail over traffic, the engineer can use as-path prepending on the active connection to make it less preferred, or adjust MED, or use local preference on the on-premises side. The question implies a GCP-side action: using as-path prepending via Cloud Router BGP configuration.

Answer

Shut down the Cloud Router on the active connection

Answer

Set the MED metric to 0 on the active connection

Answer

Delete the VLAN attachment on the active connection