PCNE Practice Test 5 — 25 Questions

Question 1

Your company is deploying a multi-tier web application on Google Kubernetes Engine (GKE) with a regional cluster. You need to design network policies to allow traffic only from the frontend pods to the backend pods on port 8080. Which of the following is the most secure and recommended approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define a Kubernetes NetworkPolicy that allows ingress to backend pods from frontend pods on port 8080.. A Kubernetes NetworkPolicy is the native and most secure way to control pod-to-pod traffic within a GKE cluster. By defining an ingress rule that allows traffic only from frontend pods (selected via pod labels) to backend pods on TCP port 8080, you enforce micro-segmentation at the pod level, which is the recommended practice for multi-tier applications. This approach works regardless of the underlying node or VPC configuration and is fully integrated with GKE's network policies engine (Calico or Cilium).

Answer

Configure Private Service Connect to restrict access to backend pods.

Answer

Create VPC firewall rules to allow ingress from frontend pods to backend pods on port 8080.

Answer

Use Cloud Armor security policies to restrict traffic to backend pods.

Question 2

A company wants to serve private content over Cloud CDN with access control. They need to generate time-limited URLs that allow users to download files from Cloud Storage. Which TWO methods can they use? (Choose two.)

Accepted Answer

Use Cloud CDN signed cookies with a key defined in the backend bucket. Options D and E are correct because Cloud CDN supports two mechanisms for serving private content from a Cloud Storage backend bucket: signed URLs and signed cookies, both of which require configuring a signing key on the backend bucket. Signed URLs (option E) generate a time-limited URL containing a signature that authorizes access to a specific resource, which is exactly what the company needs for time-limited downloads. Signed cookies (option D) work similarly but authorize access to multiple resources via a cookie, and they are also a valid Cloud CDN access-control method using a key defined in the backend bucket. Option A is incorrect because a CNAME record only maps a custom domain to the CDN IP; it does not provide access control or time-limited URLs. Option B is incorrect because IAM conditions on Cloud Storage govern identity-based access to buckets/objects, not CDN-signed time-limited URLs. Option C is incorrect because Cloud Armor IP allowlists filter traffic at the edge and do not generate time-limited signed URLs for private content.

Answer

Create a CNAME record pointing to the Cloud CDN IP

Answer

Use IAM conditions on Cloud Storage to restrict access

Answer

Use Cloud Armor with IP allowlists

Question 3

An organization wants to publish a private service using Private Service Connect (PSC) so that consumers in other VPCs can access it via private IPs. Which TWO resources are required on the producer side? (Choose TWO.)

Accepted Answer

A Private Service Connect service attachment. Option A is correct because the producer must create a Private Service Connect service attachment, which is the resource that exposes a service to consumer VPCs and allows PSC endpoints to connect to it via private IPs. Option E is correct because a service attachment must reference a regional internal load balancer (specifically, an internal passthrough Network Load Balancer or an internal regional load balancer) that fronts the producer's backend service, since PSC forwards consumer traffic through this load balancer to the service. Option B is not required because Cloud NAT provides outbound internet access for private instances and plays no role in publishing a service via PSC. Option C is not required on the producer side because a PSC endpoint is the consumer-side resource that connects to the service attachment. Option D is not required because a Cloud Router is used for dynamic routing such as Cloud VPN or Interconnect, not for PSC service publication.

Answer

A Cloud NAT gateway

Answer

A Private Service Connect endpoint

Answer

A Cloud Router

Question 4

Your organization has a site-to-site Cloud VPN connection between an on-premises network with CIDR 10.0.0.0/8 and a VPC in us-central1 with subnet 192.168.1.0/24. The VPN tunnel is established, but you cannot reach a Compute Engine instance with internal IP 192.168.1.10 from a server on-premises with IP 10.0.0.50. Cloud VPN logs show no errors. On-premises firewall rules allow all outbound traffic. What is the most likely cause of the problem?

Accepted Answer

Missing a static route on the on-premises router for 192.168.1.0/24 pointing to the VPN gateway. The VPN tunnel is established and Cloud VPN logs show no errors, indicating the cloud side is configured correctly. However, the on-premises server at 10.0.0.50 cannot reach 192.168.1.10 because the on-premises router lacks a static route for the VPC subnet 192.168.1.0/24 pointing to the VPN gateway. Without this route, the on-premises router does not know to send traffic destined for 192.168.1.0/24 through the VPN tunnel, so packets are dropped or sent to the default gateway instead.

Answer

A firewall rule on the VPC blocking inbound traffic from 10.0.0.0/8

Answer

The Compute Engine instance's OS firewall blocking ICMP

Answer

Incorrect IAM permissions on the Cloud VPN gateway

Question 5

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between all services. Which component is responsible for issuing and distributing certificates to the Envoy proxies?

Accepted Answer

Google Cloud Certificate Authority Service. In a Traffic Director with Envoy sidecar architecture, Google Cloud Certificate Authority Service (CA Service) is the component that issues and distributes certificates to the Envoy proxies. Traffic Director integrates with CA Service to provide a managed private CA that automatically issues and rotates mTLS certificates for each service identity. The Envoy sidecars receive these certificates via the xDS API from Traffic Director, enabling mutual TLS authentication between services.

Answer

Envoy's built-in certificate management

Answer

Secret Manager

Answer

Cloud KMS

Question 6

A network engineer wants to test whether a VM in VPC A can reach a VM in VPC B that is connected via VPC peering. The engineer suspects that firewall rules or routes are blocking traffic. Which Google Cloud service should they use to test the path and identify the blocking rule?

Accepted Answer

Connectivity Tests. Connectivity Tests in Google Cloud allows you to test the connectivity between two endpoints, such as VMs in different VPCs connected via VPC peering. It simulates the path and identifies blocking rules, including firewall rules and routes. This is the correct service for diagnosing connectivity issues.

Answer

Performance Dashboard

Answer

VPC Flow Logs

Answer

Firewall Insights

Question 7

An engineer has multiple projects with overlapping IP ranges. They want to create a single Cloud NAT gateway to provide outbound internet access for instances in two different VPCs that are connected via VPC Network Peering. Is this possible?

Accepted Answer

No, each VPC must have its own Cloud NAT gateway. Cloud NAT is a regional resource that belongs to a single VPC network and router. It cannot be shared across VPCs via peering. Each VPC needs its own Cloud NAT gateway. Peering does not allow using the other VPC's NAT.

Answer

Yes, by enabling 'NAT support' on the VPC peering connection

Answer

No, but you can use a single instance with an external IP as a NAT instance

Answer

Yes, by configuring the Cloud NAT gateway in one VPC and adding a route in the peered VPC with next hop as the NAT gateway

Question 8

A company runs a global e-commerce platform with a monolithic application deployed on Compute Engine. They want to modernize by splitting the monolith into microservices running on Cloud Run and Cloud Functions, and expose them externally via a single anycast IP with Google-managed SSL certificates. Which load balancer should they use?

Accepted Answer

Global External HTTPS Load Balancer. The Global External HTTPS Load Balancer is the correct choice because it provides a single global anycast IP, terminates HTTPS with Google-managed SSL certificates, and supports serverless backends such as Cloud Run and Cloud Functions. It operates at layer 7, enabling URL-based routing and integration with Cloud CDN and Cloud Armor, which are essential for a modern microservices e-commerce platform exposed externally.

Answer

Global TCP Proxy Load Balancer

Answer

Regional External HTTPS Load Balancer

Answer

Global SSL Proxy Load Balancer

Question 9

Which THREE are true regarding Cloud HA VPN when used with dynamic routing (BGP)? (Choose three.)

Accepted Answer

Cloud HA VPN requires two interfaces per VPN gateway.. Option C is correct because a Cloud HA VPN gateway is created with exactly two interfaces (interface 0 and interface 1), each with its own external IP, and each interface must be paired with a tunnel to the peer gateway to achieve 99.99% availability. Option D is correct because the BGP sessions established over HA VPN tunnels use link-local addresses in the 169.254.0.0/16 range, which are automatically assigned to the tunnel interfaces for peering. Option E is correct because Cloud HA VPN supports multiple tunnels between the same pair of gateways, and Google Cloud Router can distribute traffic across those tunnels using ECMP (Equal-Cost Multi-Path) when the routes have equal priority. Option A is not required: HA VPN does not mandate two Cloud Routers in the same region; a single Cloud Router can manage BGP sessions for both tunnels, and two routers are only needed for certain redundancy designs. Option B is not supported: Cloud Router uses fixed, non-configurable BGP timer values (keepalive 20 seconds, hold time 60 seconds), so custom BGP timers cannot be set on Cloud HA VPN.

Answer

Cloud HA VPN requires two Cloud Routers in the same region for redundancy.

Answer

Cloud HA VPN allows custom BGP timers.

Question 10

An organization wants to mirror all traffic from a set of Compute Engine instances to a third-party IDS appliance running on a separate instance in the same VPC. The IDS appliance must receive a copy of both ingress and egress traffic without impacting production traffic. Which Google Cloud service should they use?

Accepted Answer

Packet Mirroring. Google Cloud Packet Mirroring is designed to copy ingress and egress traffic from specified Compute Engine instances and send it to a collector instance (such as a third-party IDS) for inspection. It operates at the VPC level and does not interfere with production traffic because the mirrored packets are sent out-of-band to the collector. This makes it the correct choice for mirroring traffic to an IDS appliance without impacting performance.

Answer

Firewall Insights

Answer

VPC Flow Logs

Answer

Cloud NAT logging

Question 11

Which TWO of the following are valid ways to target firewall rules in Google Cloud? (Select 2)

Accepted Answer

Target by service account. Option A (target by service account) is correct because VPC firewall rules support a targetServiceAccounts field, allowing rules to apply to all VM instances running as a specified service account, which is the recommended identity-based targeting method. Option E (target by network tag) is correct because firewall rules support a targetTags field, applying the rule to instances that carry the specified network tag. Options B, C, and D are incorrect: firewall rules cannot be scoped by zone, by individual instance name, or by machine type — targeting is limited to network tags, service accounts, or all instances in the network.

Answer

Target by zone

Answer

Target by instance name

Answer

Target by machine type

Question 12

A company has two VPC networks in the same project: 'vpc-a' (us-central1) and 'vpc-b' (us-east1). They are connected via VPC Network Peering. An instance in vpc-a can ping the internal IP of an instance in vpc-b, but cannot reach it on TCP port 8080. The firewall rule in vpc-b allows ingress from the peered network's subnets. What is the most likely cause?

Accepted Answer

The firewall rule for port 8080 is missing or uses an incorrect target tag or service account.. VPC Network Peering is not transitive and does not carry firewall rules across networks — each VPC enforces its own firewall policies. Since ping (ICMP) succeeds, routing and peering are working; the failure is isolated to TCP/8080, which means the ingress rule in vpc-b either doesn't exist for that port or doesn't match the source instance via its target tag or service account. Firewall rules in GCP are stateful and applied per-VM based on target tags/service accounts, so a mismatched target is the classic cause of 'some ports work, others don't.'

Answer

The instance in vpc-b has a firewall rule that denies TCP port 8080 explicitly.

Answer

The subnet in vpc-a is in a different region, so peering does not support cross-region communication.

Answer

The firewall rule in vpc-b must allow ingress from the entire CIDR of vpc-a's subnet, not just the peered network.

Question 13

A network engineer wants to monitor the operational status of a Dedicated Interconnect link using Cloud Monitoring. Which metric should they use to check if the physical link is up or down?

Accepted Answer

interconnect/link/operational_status. The metric interconnect/link/operational_status is specifically designed to report the operational state of a Dedicated Interconnect link, indicating whether the physical link is up or down. It provides a boolean or enumerated status that directly reflects the link's health, making it the correct choice for monitoring physical link status. Other metrics focus on traffic volume or errors, not operational state.

Answer

interconnect/network/received_bytes_count

Answer

vpn/tunnel/status

Answer

interconnect/network/packets_dropped_percent

Question 14

An engineer needs to configure Cloud Armor to block requests from a specific IP address (10.1.2.3) while allowing all other traffic. They create a security policy with a deny rule for that IP and an allow rule for all traffic. What priority should the deny rule have relative to the allow rule?

Accepted Answer

The deny rule must have a lower priority number than the allow rule. In Google Cloud Armor, security policy rules are evaluated in priority order from lowest numerical value to highest. The first matching rule is applied and evaluation stops. Therefore, to block a specific IP while allowing all other traffic, the deny rule must have a lower priority number (higher precedence) than the allow-all rule. This ensures the deny rule is evaluated first and matches before the broader allow rule.

Answer

Both rules must have the same priority

Answer

Priority does not matter for deny rules

Answer

The deny rule must have a higher priority number than the allow rule

Question 15

Which TWO statements about Cloud Router BGP are correct? (Choose two.)

Accepted Answer

Cloud Router can use a private ASN.. Option B is correct because Cloud Router allows you to assign either a public or a private Autonomous System Number (ASN); Google recommends using a private ASN (from the 64512–65534 or 4200000000–4294967294 ranges) when you don't need to advertise routes to the public internet, so a private ASN is fully supported. Option D is correct because a single Cloud Router can host multiple BGP sessions — for example, one session per VLAN attachment or per HA VPN tunnel — and each session is configured independently with its own peer IP, peer ASN, and BGP priority. Option A is wrong because Cloud Router uses single-hop eBGP (the BGP peer must be on the same link/subnet), not multi-hop eBGP, by default. Option C is wrong because a public ASN is not mandatory; private ASNs are explicitly supported. Option E is wrong because Cloud Router supports MED (Multi-Exit Discriminator) for routes it sends to on-premises peers as well as other BGP attributes, so it is not limited to MED-only behavior.

Answer

Cloud Router uses multi-hop eBGP by default.

Answer

Cloud Router requires a public ASN.

Answer

Cloud Router only supports MED for routes it sends to on-premises.

Question 16

You are designing a hybrid network using Cloud VPN with dynamic routing (BGP) to connect multiple on-premises sites to Google Cloud. What is a best practice to avoid asymmetric routing when you have multiple VPN tunnels from different on-premises routers?

Accepted Answer

Configure all on-premises routers with the same BGP ASN and enable ECMP on the Cloud Router. Using the same BGP ASN on all on-premises routers and enabling ECMP on the Cloud Router allows the Cloud Router to treat multiple BGP sessions as equal-cost paths. This prevents asymmetric routing by ensuring that return traffic can be load-balanced across any available tunnel, while the same ASN avoids BGP loop-prevention mechanisms that would otherwise reject routes from routers with different ASNs.

Answer

Use static routes instead of BGP to have precise control over path selection

Answer

Use a different BGP ASN for each on-premises router to ensure uniqueness

Answer

Disable ECMP on the Cloud Router to avoid multipath issues

Question 17

A network engineer is configuring a global HTTPS load balancer with Cloud CDN. They want to cache responses based on the request origin, query parameters, and user agent. Which cache key configuration should they use?

Accepted Answer

Enable custom cache keys and include the origin header, query string, and user-agent header. To cache based on origin, query parameters, and user agent, the engineer must enable custom cache keys and explicitly include those components (origin header, query string, user-agent header) in the cache key. Cloud CDN's default cache key only includes host, scheme, and URL, so custom cache keys are required to vary cached content by additional request attributes. This ensures responses are cached and served per the specified dimensions.

Answer

Use the default cache key, which includes host, scheme, and URL

Answer

Set cache mode to CACHE_ALL_STATIC and enable query string whitelist

Answer

Create a signed URL to include the required parameters

Question 18

A network engineer needs to verify that traffic from a specific Compute Engine instance can reach a Cloud SQL database in a different VPC. Which Google Cloud tool should be used to test this reachability?

Accepted Answer

Connectivity Tests. Network Intelligence Center Connectivity Tests allow you to check reachability between source and destination, analyzing firewall rules, routes, and VPC peering. It can pinpoint where traffic is blocked.

Answer

Cloud Monitoring

Answer

Network Topology

Answer

VPC Flow Logs

Question 19

You need to configure health checks for a backend service that uses gRPC for health checking. Which health check type should you use?

Accepted Answer

gRPC. The gRPC health checking protocol is a standard defined by the gRPC community (grpc.health.v1.Health) that allows clients to query the health of a service via a specific RPC method. When a backend service uses gRPC for health checking, the load balancer or health checker must speak that same protocol to correctly interpret the service's health status. Using HTTP, TCP, or HTTPS would not properly invoke the gRPC health check method and would likely result in false positives or negatives. Therefore, the correct health check type is gRPC.

Answer

HTTP

Answer

TCP

Answer

HTTPS

Question 20

Which of the following is a benefit of using Shared VPC?

Accepted Answer

Centralized network administration and separation from application projects.. Shared VPC allows a host project's network to be shared with service projects, enabling centralized network administration (subnets, firewalls, routes managed in one place) while keeping application resources isolated in separate projects. This separation of duties between network admins and app teams is the primary benefit.

Answer

Lower cost compared to VPC peering.

Answer

Automatic failover for applications.

Answer

Reduced latency between instances.