PCNE Practice Test 4 — 25 Questions

Question 1

A company wants to connect two VPC networks (vpc-a and vpc-b) that both reside in the same Google Cloud project. They need to ensure that all IP ranges in both VPCs can communicate using internal private IP addresses. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering directly connects two VPCs within the same project using internal RFC 1918 IP addresses, with no bandwidth limitations and no single point of failure. It allows all subnets in both VPCs to communicate privately without requiring external connectivity, VPN tunnels, or NAT gateways.

Answer

Use Dedicated Interconnect to connect the VPCs.

Answer

Set up Cloud VPN tunnels between the two VPCs.

Answer

Configure Cloud NAT to allow the VPCs to communicate through NAT.

Question 2

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

Accepted Answer

Private Service Connect endpoint. When a consumer wants to connect to a managed SaaS application published via Private Service Connect (PSC), they must create a Private Service Connect endpoint in their own VPC. This endpoint is a regional resource that uses an internal IP address from the consumer's VPC and establishes a connection to the service attachment published by the provider. The endpoint effectively makes the SaaS service accessible as if it were a resource inside the consumer's VPC, without requiring public IPs or VPNs.

Answer

Service attachment

Answer

Internal forwarding rule

Answer

Cloud VPN tunnel

Question 3

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

Accepted Answer

Check VPC firewall rules to ensure ingress traffic from the on-premises subnet is allowed to the VM. VPC firewall rules are the first line of defense for controlling traffic to GCE VMs. Even though the VPN tunnel is established, the default-deny ingress posture of GCP means that traffic from the on-premises subnet must be explicitly allowed by a VPC firewall rule. Without this rule, packets arriving via the tunnel are dropped before they ever reach the VM's network interface.

Answer

Check the VM's OS firewall to see if it is blocking incoming traffic

Answer

Verify that the VPN tunnel is using the correct pre-shared key

Answer

Review Cloud Armor security policies that may be blocking the traffic

Question 4

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Answer

Change the stack type of subnet-b to IPV4_IPV6.

Answer

Configure Cloud NAT in the region of subnet-b.

Answer

Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.

Question 5

A company wants to connect two VPCs in different GCP projects so that they can exchange traffic using internal IP addresses. They do not need centralized management or transitive routing between the VPCs. Which GCP networking feature should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering in Google Cloud allows two VPC networks in different projects (or organizations) to connect privately using internal IP addresses. It provides full mesh connectivity without a gateway or VPN, and it does not require centralized management or transitive routing. This exactly matches the requirement to connect two VPCs in different GCP projects for internal IP traffic.

Answer

Network Connectivity Center

Answer

Cloud VPN

Answer

Shared VPC

Question 6

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between services. Which configuration must be enabled?

Accepted Answer

Enable mTLS in the Traffic Director mesh configuration. To enforce mTLS between services in Traffic Director, you must enable mTLS in the Traffic Director mesh configuration. This setting automatically configures Envoy sidecars to use mutual TLS for service-to-service communication.

Answer

Configure SSL certificates on each Envoy sidecar manually

Answer

Use Cloud NAT to hide internal IPs

Answer

Enable Cloud Armor on the service

Question 7

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

Accepted Answer

The VM has a custom route that does not use the default route through Cloud NAT. Cloud NAT relies on the default route (0.0.0.0/0) pointing to the Cloud Router to direct traffic through the NAT gateway. If a VM has a custom route that overrides the default route (e.g., a more specific route to an external IP or a route to a different next hop), the VM's outbound traffic will bypass Cloud NAT entirely, resulting in the source IP being the VM's private IP instead of the Cloud NAT IP. This causes external firewalls to block the traffic as the source IP is not the expected NAT IP.

Answer

The VM is in a different zone than the Cloud NAT gateway

Answer

The VPC firewall rules are blocking outbound traffic from the VM to the Cloud NAT IP

Answer

Cloud Router is misconfigured and not advertising the Cloud NAT IP

Question 8

You are configuring a health check for a backend service that expects gRPC health probing. Which protocol should the health check use to verify gRPC service health?

Accepted Answer

gRPC. gRPC health checking uses the gRPC Health Checking Protocol (defined in the grpc.health.v1 package) over HTTP/2, so the health check must use the gRPC protocol to invoke the Check method and receive SERVING/NOT_SERVING status. Using gRPC ensures the probe speaks the same protocol and can query the service's health endpoint correctly. This is the standard approach for Kubernetes gRPC liveness/readiness probes via tools like grpc-health-probe.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 9

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides a direct, private connection between your on-premises network and Google Cloud, supporting bandwidth up to 100 Gbps (via multiple 10 Gbps or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant attachments. This solution requires you to manage your own physical infrastructure in a Google colocation facility, meeting the organization's requirement for self-managed hardware.

Answer

Cloud VPN with multiple tunnels

Answer

Partner Interconnect

Answer

HA VPN

Question 10

A company has two VPCs in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). They want to allow SSH from VPC-A to instances in VPC-B. The network admin creates a firewall rule with source range 10.0.0.0/16 and protocol tcp:22, but connectivity fails. What is the most likely cause?

Accepted Answer

The rule is created in VPC-A instead of VPC-B.. Firewall rules in Google Cloud are applied at the network level, not the instance level. To allow inbound SSH traffic from VPC-A to instances in VPC-B, the firewall rule must be created in VPC-B (the destination network) with the source range set to 10.0.0.0/16. Creating the rule in VPC-A would only affect traffic destined for instances in VPC-A, not VPC-B.

Answer

The source range should be 10.0.0.0/8.

Answer

The target tag is not specified.

Answer

The source tag is missing.

Question 11

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

Accepted Answer

The passive VLAN attachment does not have BGP session configured with Cloud Router.. For a Dedicated Interconnect failover to occur, the passive connection must have a VLAN attachment with a configured BGP session peering with Cloud Router. Without BGP, the passive connection cannot advertise routes or receive routes, so traffic will not fail over even if the physical link is up. The most likely reason is that the passive VLAN attachment lacks a BGP session.

Answer

The SLA requires two circuits in different metro areas for failover.

Answer

The on-premises router is not configured to use the passive connection.

Answer

The passive connection is in a different metro area, causing higher latency.

Question 12

An organization has two VPC networks in different Google Cloud organizations. They need to allow private IP communication between instances in these VPCs without using public IPs or VPNs. Which solution should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering allows private IP connectivity between two VPC networks across different organizations without requiring public IPs, VPNs, or gateways. It uses the Google Cloud internal infrastructure to route traffic directly between instances, leveraging RFC 1918 addresses and supporting global peering.

Answer

Cloud NAT

Answer

Shared VPC

Answer

Cloud VPN

Question 13

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

Accepted Answer

Ingress rule: source 203.0.113.5/32, destination 10.0.1.2/32, tcp:22. Firewall rules in GCP are stateful and applied at the instance level, not the VPN tunnel. The rule must allow ingress traffic from the on-premises source IP (203.0.113.5/32) to the Compute Engine instance's internal IP (10.0.1.2/32) on TCP port 22. The Cloud VPN and Cloud Router handle routing, but the firewall rule explicitly defines the allowed traffic flow.

Answer

Ingress rule: source 203.0.113.5/32, destination 169.254.0.1/32, tcp:22

Answer

Ingress rule: source 10.0.1.2/32, destination 203.0.113.5/32, tcp:22

Answer

Ingress rule: source 0.0.0.0/0, destination 203.0.113.5/32, tcp:22

Question 14

A network engineer is troubleshooting a Cloud VPN gateway that is not establishing a VPN tunnel with an on-premises device. The engineer checks the Cloud VPN gateway logs and sees the error 'IKE SA negotiation failed due to mismatched authentication method'. What is the most likely cause?

Accepted Answer

The authentication method is set to 'pre-shared key' on one side and 'certificate' on the other.. The error 'IKE SA negotiation failed due to mismatched authentication method' indicates that the two VPN peers are configured with different authentication methods. One side is using pre-shared key (PSK) and the other is using certificates, so they cannot agree on how to authenticate. This is a common misconfiguration in Cloud VPN setups.

Answer

The pre-shared keys on both ends do not match.

Answer

The VPN gateway is using the wrong external IP address.

Answer

The IKE version configured on the on-premises device is IKEv1 while Cloud VPN only supports IKEv2.

Question 15

A security team wants to block traffic from specific geographic regions (e.g., Country A) to their HTTP(S) load balancer. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS protection service that integrates with HTTP(S) load balancers. It allows you to create security policies with rules that can block or allow traffic based on various criteria, including geographic location (country/region). Therefore, Cloud Armor is the correct service to block traffic from specific geographic regions.

Answer

Firewall rules

Answer

VPC Service Controls

Answer

Cloud CDN

Question 16

A company has a VPC with a single subnet in us-central1 (10.0.0.0/24). They have a Compute Engine instance running a database that uses an internal IP address 10.0.0.10. They need to ensure that this database instance can be accessed by a legacy on-premises application via a Cloud VPN tunnel. The on-premises network uses 192.168.0.0/16. They have set up a HA VPN gateway with two tunnels and BGP routing. The Cloud Router is configured to advertise the subnet 10.0.0.0/24. On the on-premises side, the router receives the route for 10.0.0.0/24 and has a static route for 10.0.0.0/24 pointing to the VPN tunnel. However, the on-premises application cannot reach the database. The application's server can ping the on-premises gateway, but not the database IP. The database instance's OS firewall allows all traffic from 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The VPC firewall rules are blocking ingress from on-premises; add a rule allowing traffic from 192.168.0.0/16 to the database IP.. The VPC firewall rules are the most likely cause. Google Cloud VPC firewall rules are stateful and must explicitly allow ingress traffic from the on-premises CIDR (192.168.0.0/16) to the database instance's internal IP (10.0.0.10) on the required port. Even though the OS firewall allows all traffic, the VPC-level firewall is evaluated first and will drop packets if no allow rule matches. Since the on-premises server can ping the on-premises gateway but not the database, the issue is likely at the VPC ingress firewall, not routing or BGP.

Answer

The database instance's OS firewall is blocking the traffic despite the setting.

Answer

The Cloud Router is not advertising the specific database IP 10.0.0.10, only the subnet 10.0.0.0/24.

Answer

The BGP session is not establishing properly; check the shared secret and IP addresses.

Question 17

A company has a Shared VPC setup with a host project and several service projects. They want to grant a service project's network admin the ability to create VM instances using a specific subnet from the host project. Which IAM role should they assign at the subnet level?

Accepted Answer

Compute Network User (roles/compute.networkUser) on the specific subnet. In a Shared VPC, the Compute Network User role (roles/compute.networkUser) granted on a specific subnet in the host project allows a principal in a service project to use that subnet when creating VM instances. This is the least-privilege role designed exactly for this cross-project subnet consumption.

Answer

Project Owner on the host project

Answer

Compute Instance Admin (roles/compute.instanceAdmin) on the service project

Answer

Compute Network Admin (roles/compute.networkAdmin) on the host project

Question 18

A company runs a Kubernetes cluster on GKE with a VPC-native cluster (alias IP ranges). They have pods that need to communicate with on-premises services via a Cloud VPN tunnel. Which networking configuration is required to enable pod-to-on-premises communication?

Accepted Answer

Advertise the pod IP ranges over the Cloud Router BGP session to the on-premises router.. VPC-native clusters assign alias IP ranges to pods directly from the VPC subnet's secondary CIDR ranges. To enable on-premises routing to these pods, the pod IP ranges must be advertised over the Cloud Router BGP session to the on-premises router. This ensures the on-premises network learns the routes to the pod CIDRs and can forward traffic back through the Cloud VPN tunnel.

Answer

Enable VPC Flow Logs for the subnets to allow traffic to be routed.

Answer

Configure a firewall rule allowing traffic from pod CIDR to on-premises subnets.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Question 19

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Accepted Answer

URL map. The scenario requires an external Application Load Balancer (HTTP(S)) in front of GKE, and that architecture is built from a specific set of resources. Option B, a URL map, is required because it defines the routing rules that map incoming request paths/hosts to backend services and is a mandatory component of the HTTP(S) load balancer. Option D, a backend service pointing to the GKE NEG, is required because the backend service is what binds the load balancer to the GKE workloads via a Network Endpoint Group and is where Cloud CDN is enabled for static content. Option E, a Google-managed SSL certificate, is required because the custom domain must be served over HTTPS and a Google-managed certificate provides automatic provisioning and renewal for that domain. Option A, a Cloud NAT gateway, is not part of exposing an inbound HTTP service; Cloud NAT provides outbound internet access for private instances and is unrelated to this load balancing path. Option C, a target TCP proxy, belongs to a TCP/SSL proxy load balancer (Layer 4), not to the global HTTP(S) load balancer that this scenario requires.

Answer

Cloud NAT gateway

Answer

Target TCP proxy

Question 20

An organization uses Shared VPC with a host project and multiple service projects. They want to allow a service project team to create Compute Engine instances using a specific subnet, but not manage other subnets. Which IAM role should they grant at the subnet level?

Accepted Answer

roles/compute.networkUser. The roles/compute.networkUser role grants read-only access to VPC networks, subnets, and firewall rules, and allows the creation of resources like Compute Engine instances on a specific subnet without granting management permissions over other subnets. This is the correct choice because it provides the minimum required permissions for a service project team to use a designated subnet while preventing them from modifying or viewing other subnets in the host project.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/compute.networkAdmin

Answer

roles/iam.securityAdmin