PCNE Practice Test 26 — 15 Questions

Question 1

A company wants to load balance TCP traffic (non-HTTP) across a group of Compute Engine instances in a single region, while preserving the client IP address. They also need to support session affinity based on client IP. Which load balancer should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

External TCP/UDP Network Load Balancer. External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and supports session affinity. Other options either terminate connections or are HTTP-specific.

Answer

Global SSL Proxy Load Balancer

Answer

Global TCP Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 2

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

Accepted Answer

Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.. HA VPN requires two tunnels (one per interface) to form a pair. Each tunnel requires a separate BGP session to provide redundancy.

Answer

Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.

Answer

Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.

Answer

Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.

Question 3

An enterprise requires a hybrid connectivity solution that meets a 99.99% SLA. They plan to use Dedicated Interconnect. Which configuration satisfies the SLA requirement?

Accepted Answer

Two Dedicated Interconnect connections in different metro areas with active-active configuration. Google's 99.99% SLA for Dedicated Interconnect requires two connections, each from a different metro area, configured for active-active or active-passive.

Answer

Two Partner Interconnect connections from different providers in the same metro area

Answer

Two Dedicated Interconnect connections in the same metro area with active-passive configuration

Answer

Single Dedicated Interconnect connection with two VLAN attachments

Question 4

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. Both connections are active and they want to use both simultaneously for load balancing traffic. They have configured two VLAN attachments each with a Cloud Router and BGP sessions. How should they configure BGP to achieve active-active load sharing?

Accepted Answer

Configure the on-premises router to enable ECMP for the BGP routes. Equal-cost multipath (ECMP) requires that the routes from both connections have the same next-hop attribute and are learned via different BGP sessions. By default, Cloud Router advertises the same routes with the same MED and AS path. To enable ECMP, the on-premises router must be configured to accept multiple equal-cost paths. The Cloud Router will automatically advertise routes with identical attributes when using separate VLAN attachments, and the on-premises router can then load balance.

Answer

Set different local preference values on the Google Cloud Router

Answer

Use AS path prepending on one connection to make it less preferred

Answer

Assign different MED values to each connection to influence preference

Question 5

A network engineer is setting up a Dedicated Interconnect with a 10 Gbps circuit. They need to achieve 99.99% availability SLA. Which of the following configurations meets the SLA requirements?

Accepted Answer

Two 10 Gbps circuits in different metro areas. Google Cloud's 99.99% SLA for Dedicated Interconnect requires two connections from two different metro areas (redundant locations). Each connection must be 10 Gbps or more. Active-active or active-passive is acceptable, but the key is two circuits in different metros.

Answer

One 10 Gbps circuit and one VPN as backup

Answer

Single 10 Gbps circuit in one metro area

Answer

Two 10 Gbps circuits in the same metro area

Question 6

A company has deployed a Cloud VPN tunnel using route-based VPN (using IKEv2) and has configured BGP on the tunnel. The tunnel is up, but the BGP session is not establishing. What is a likely cause?

Accepted Answer

The BGP IP addresses are not reachable over the tunnel. For route-based VPN tunnels, BGP peering requires that the Cloud VPN gateway and the on-premises router can reach each other's BGP IP addresses. The BGP IPs are typically link-local addresses derived from the tunnel's interface. If the BGP session is not establishing, common issues include incorrect BGP IP configuration, firewall rules blocking BGP (port 179), or the tunnel not passing traffic correctly.

Answer

IKE version mismatch

Answer

The pre-shared key is incorrect

Answer

The Cloud Router is not configured

Question 7

A company is planning a hybrid cloud connectivity strategy with Google Cloud. They need high bandwidth (10 Gbps) and low latency. They also want to avoid internet transit. Which TWO connectivity options meet these requirements? (Choose 2.)

Accepted Answer

Partner Interconnect. Dedicated Interconnect provides direct, high-bandwidth (up to 80 Gbps per circuit) physical connection with low latency, not over the internet. Partner Interconnect also provides high bandwidth via a service provider, often at 1 Gbps or 10 Gbps, and is not internet-based. VPN uses the internet and does not guarantee bandwidth or low latency.

Answer

CDN Interconnect

Answer

Direct Peering

Answer

Cloud VPN

Question 8

A network engineer is configuring a route-based VPN tunnel between an on-premises network and Google Cloud using Cloud VPN. Which two statements are true about route-based VPN compared to policy-based VPN? (Choose two.)

Accepted Answer

Route-based VPNs automatically route traffic based on the routing table entries.. Route-based VPNs use routing tables (like BGP) to determine which traffic is sent through the tunnel, and they support dynamic routing protocols like BGP.

Answer

Route-based VPNs are less flexible than policy-based VPNs for traffic selection.

Answer

Route-based VPNs require static routes to be configured manually.

Answer

Route-based VPNs require separate security policies for each traffic flow.

Question 9

An engineer needs to monitor the operational status of a Dedicated Interconnect link. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The metric interconnect/link/operational_status reflects if the link is up or down, exactly what is needed to monitor the link status.

Answer

interconnect/attachment/operational_status

Answer

interconnect/network/sent_bytes_count

Answer

interconnect/network/received_bytes_count

Question 10

A company wants to use BGP AS path prepending to influence traffic from Google Cloud to their on-premises network. They have two Dedicated Interconnect connections. Where should they configure the AS path prepending?

Accepted Answer

On the on-premises router by adding extra AS numbers to the AS path.. AS path prepending is configured on the on-premises router when advertising routes to Google Cloud. The router adds extra AS numbers to make a path less preferred.

Answer

On the Cloud Router BGP session.

Answer

In the VLAN attachment configuration.

Answer

In the Cloud Router as a route policy with set as-path prepend.

Question 11

An organization is setting up a Dedicated Interconnect and wants to monitor the health and performance of the connection using Cloud Monitoring. Which THREE metrics are available for Dedicated Interconnect?

Accepted Answer

interconnect/network/received_bytes_count. Cloud Monitoring provides several metrics for Dedicated Interconnect, including traffic volume (received_bytes_count), link operational status, and packet loss. VLAN attachment metrics are also available, but the question asks for interconnect metrics.

Answer

interconnect/network/traffic_drops

Answer

interconnect/vpn/tunnel_status

Question 12

An engineer needs to set up DNS resolution for on-premises resources from Google Cloud. They want to resolve a custom domain (e.g., corp.example.com) using on-premises DNS servers. Which Cloud DNS feature should they use?

Accepted Answer

DNS forwarding zone. DNS forwarding zones in Cloud DNS allow you to forward queries for a specific domain to a set of on-premises DNS server IPs. This is achieved by creating a forwarding zone with the target name servers pointing to the on-premises DNS servers.

Answer

Cloud DNS peering

Answer

Outbound DNS forwarding

Answer

Inbound DNS policy

Question 13

A company wants to use HA VPN with route-based VPN. Which VPN configuration option must be enabled?

Accepted Answer

Route-based VPN by selecting Dynamic Routing (BGP) or using static routes.. Route-based VPN uses routing (BGP or static routes) to determine which traffic goes through the tunnel, as opposed to policy-based which uses security policies.

Answer

IKEv1 with pre-shared keys.

Answer

Using certificates instead of pre-shared keys.

Answer

Policy-based VPN with multiple policies for each subnet.

Question 14

A company has two HA VPN tunnels between GCP and on-premises. They want to use both tunnels simultaneously for load balancing traffic. Which BGP feature should they configure on the Cloud Router to achieve equal-cost multipath (ECMP)?

Accepted Answer

Advertise identical routes with equal BGP metrics (AS path length, MED, etc.) from both tunnels.. ECMP is achieved by having multiple BGP paths with equal MED and AS path length. The Cloud Router automatically load balances if routes have equal metrics.

Answer

Use AS path prepending on one tunnel.

Answer

Set different MED values on each tunnel to prefer one.

Answer

Enable policy-based VPN instead of route-based.

Question 15

A company wants to use AS path prepending to influence traffic from Google Cloud to their on-premises network to prefer one Dedicated Interconnect connection over another. How should they configure AS path prepending?

Accepted Answer

Configure AS path prepending on the on-premises router for the routes advertised to Google Cloud. AS path prepending is done on the on-premises router by adding the on-premises AS number multiple times in the BGP updates sent to Google Cloud. Google Cloud Router will then prefer the path with the shorter AS path length (fewer prepends). To make one connection less preferred, the on-premises router should prepend AS numbers on the BGP updates sent over that connection.

Answer

Configure AS path prepending on the Cloud Router for the routes advertised to on-premises

Answer

Configure AS path prepending on both sides equally

Answer

Use MED instead of AS path prepending