PCNE Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. A company uses a Cloud Router with two BGP sessions for an HA VPN to on-premises. Traffic is not flowing correctly to the on-premises network. What is the most likely issue?

Accepted Answer

The BGP session with vpn-tunnel-2 is down, causing asymmetric routing.. One BGP session (vpn-tunnel-2) is down, which can cause asymmetric routing or loss of connectivity. Option A identifies this. Option B is incorrect because ASN 65000 is private and valid for Cloud Router. Option C is incorrect because priority 100 is fine. Option D is incorrect because keepalive interval 20 seconds is within typical range.

Answer

The advertised route priority is too low.

Answer

The keepalive interval is too high.

Answer

The ASN 65000 is private and not allowed.

Question 2

An organization needs to connect two VPCs in different regions using Google's backbone. What is the recommended solution?

Accepted Answer

VPC Peering. VPC Peering uses Google's backbone to connect VPCs across regions without public internet.

Answer

Cloud VPN

Answer

Dedicated Interconnect

Answer

Cloud NAT

Question 3

Refer to the exhibit. You are troubleshooting an on-premises to Cloud VPN connection with dynamic routing. The BGP session is CONNECTED, but no routes are received from the on-premises router. What is the most likely cause?

Accepted Answer

The on-premises router is not configured to advertise routes.. The BGP session is up, but routesReceived is 0, indicating the on-premises router is not advertising routes.

Answer

The firewall rules are blocking BGP traffic.

Answer

The VPN tunnel is down.

Answer

The cloud router is not advertising any routes.

Question 4

A company is designing a VPC routing strategy. Which three are valid route types in Google Cloud VPC? (Choose three.)

Accepted Answer

System-generated routes. Options A, B, and C are correct. System-generated routes are created automatically (e.g., subnet routes, default internet gateway routes). Custom static routes are manually created. Dynamic routes are learned through BGP. Option D is incorrect because 'VPN tunnel routes' is not a route type; VPN tunnels use BGP or static routes. Option E is incorrect because 'Peering routes' are not a separate type; they are system-generated routes imported from peered VPCs.

Answer

VPN tunnel routes

Answer

Peering routes

Question 5

A company wants to connect two VPC networks using VPC Network Peering. What is required for this setup?

Accepted Answer

The VPCs must have non-overlapping IP ranges.. VPC Network Peering requires that the IP ranges of the peered networks do not overlap. Option B is correct. Option A is wrong because peering is not dependent on region. Option C is wrong because Cloud VPN is a separate technology. Option D is wrong because peering can be within the same organization or across different organizations.

Answer

A Cloud VPN tunnel must be established.

Answer

Both VPCs must belong to the same organization.

Answer

Both VPCs must be in the same region.

Question 6

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Accepted Answer

Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.. Cloud NAT uses network tags to filter which instances use it.

Answer

Assign external IPs to non-NAT instances.

Answer

Use firewall rules to allow NAT for tagged instances.

Answer

Create separate subnets for NAT instances.

Question 7

Refer to the exhibit. Instances in subnet-b cannot access the internet through Cloud NAT. What is the most likely reason?

Accepted Answer

Subnet-b is not included in the Cloud NAT configuration.. The Cloud NAT configuration only includes subnet-a, so subnet-b is not NATed.

Answer

The firewall rules in subnet-b block egress.

Answer

The NAT IP address pool is exhausted.

Answer

Subnet-b has overlapping subnets.

Question 8

A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?

Accepted Answer

The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.. Option B is correct because a custom route with destination 10.1.0.0/16 and next-hop set to the specific VPN tunnel interface is required to direct traffic through that interface. Option A is incorrect because firewall rules control access but not routing. Option C is incorrect because on-premises BGP advertisement is for routes from on-premises, not Google Cloud routes. Option D is incorrect because Cloud NAT is used for outbound internet access, not routing to on-premises.

Answer

Cloud NAT is enabled.

Answer

Firewall rules allow ingress from on-premises IPs.

Answer

The on-premises router is advertising the route via BGP.

Question 9

A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises network does not have a route back to the VPC subnet.. Option C is correct because on-premises routes must include the VPC subnet to ensure return traffic is sent to the VPN gateway. Option A is wrong because firewall rules can be separate for ingress/egress. Option B is wrong because BGP session being down would cause no connectivity. Option D is wrong because Cloud Router is needed for dynamic routing, but not having one does not cause asymmetric dropping specifically.

Answer

A firewall rule is blocking ingress traffic from the on-premises network.

Answer

The BGP session is down.

Answer

The Cloud Router is not configured.

Question 10

An engineer runs 'gcloud compute networks peerings list' and sees state 'INACTIVE' for a peering connection. Which is the most likely cause?

Accepted Answer

The subnet CIDR ranges overlap.. Overlapping subnet CIDRs cause the peering to be INACTIVE.

Answer

The IAM permissions for the peer are insufficient.

Answer

The dynamic routing mode differs.

Answer

The firewall rules are missing.

Question 11

A company has two VPC networks in the same project: 'vpc-a' (us-central1) and 'vpc-b' (us-east1). They are connected via VPC Network Peering. An instance in vpc-a can ping the internal IP of an instance in vpc-b, but cannot reach it on TCP port 8080. The firewall rule in vpc-b allows ingress from the peered network's subnets. What is the most likely cause?

Accepted Answer

The firewall rule for port 8080 is missing or uses an incorrect target tag or service account.. The firewall rule in vpc-b allows ingress from the peered network's subnets, but VPC Network Peering does not automatically allow all traffic; firewalls must be configured explicitly. Since ICMP works, the issue is specific to TCP 8080, likely a firewall rule missing or misconfigured for that port. Option D is correct because even if the rule allows from subnets, it may not have the correct port or target tags.

Answer

The instance in vpc-b has a firewall rule that denies TCP port 8080 explicitly.

Answer

The subnet in vpc-a is in a different region, so peering does not support cross-region communication.

Answer

The firewall rule in vpc-b must allow ingress from the entire CIDR of vpc-a's subnet, not just the peered network.

Question 12

An organization uses Shared VPC with multiple service projects. They want to ensure that only certain service projects can use a specific subnet. How can this be achieved?

Accepted Answer

Use IAM roles on the subnet to grant access to specific service projects.. Option A is correct because Shared VPC subnet-level IAM allows granting access to specific service projects. Option B is wrong because firewall rules with service accounts control traffic, not subnet access. Option C is wrong because network tags are used for firewall rules, not subnet permissions. Option D is wrong because secondary IP ranges do not control project access.

Answer

Use VPC subnet secondary IP ranges.

Answer

Use VPC Network Tags on the VM instances.

Answer

Use VPC firewall rules with service accounts to restrict access.

Question 13

A developer wants to create a VM that can communicate with all Google APIs without requiring an external IP address. Which configuration is necessary?

Accepted Answer

Enable Private Google Access on the subnet.. To allow communication with Google APIs without an external IP, Private Google Access must be enabled on the subnet. Option B is correct. Option A is wrong because Cloud NAT is for internet access to non-Google destinations. Option C is wrong because VPC peering is for connecting VPCs. Option D is wrong because firewall rules alone are not sufficient.

Answer

Configure a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Set up VPC peering with the Google APIs service producer.

Question 14

A company needs to connect on-premises to Google Cloud with overlapping IP ranges. The on-premises network uses 10.0.0.0/16 and the VPC uses 10.0.0.0/16. What is the best approach?

Accepted Answer

Use Cloud VPN with source NAT on the on-premises side.. Cloud VPN with source NAT on the on-premises side translates overlapping addresses.

Answer

Use Cloud NAT.

Answer

Use VPC peering.

Answer

Use Private Google Access.

Question 15

A company has an on-premises data center connected to Google Cloud via Dedicated Interconnect. They have a VPC with subnets in us-central1 and us-west1. They want compute instances in us-central1 to access Google APIs (e.g., Cloud Storage) without traversing the internet, but the on-premises network must also be able to access those APIs via the interconnect. They have configured Private Google Access (PGA) on all subnets. However, on-premises users report that they cannot access Cloud Storage buckets using the private IP of a forward proxy in us-central1 (the proxy is configured to use the default internet gateway for egress). What is the most likely reason?

Accepted Answer

There is a custom static route for 199.36.153.4/30 (Google API VIP) that points to the interconnect, overriding the default route for the proxy's outbound traffic.. Private Google Access allows instances with only internal IPs to reach Google APIs via the default internet gateway. However, on-premises traffic coming via interconnect uses the VPC's internal IP range, and if the forward proxy does not have a route for Google API destinations via the internet gateway (default route), it will try to use the interconnect route, which points to on-premises. Since the proxy is configured to use the default internet gateway, but that gateway is only effective for instances with PGA; on-premises traffic does not go through the proxy's default gateway. The issue is that the proxy's egress traffic to Google APIs is being routed via the on-premises network because the VPC's default route (0.0.0.0/0) points to the internet gateway only for instances with PGA, but for traffic sourced from the proxy that is destined to Google APIs, the proxy itself uses its default gateway which is the internet gateway. Actually, the on-premises users are using the proxy's internal IP as a forward proxy. The proxy will make requests to Google APIs. For those requests, the proxy's VPC will route based on the most specific route. If there is a custom route for the Google API IP ranges (e.g., 199.36.153.4/30) that points to the interconnect, the proxy will send traffic to on-premises instead of internet. PGA does not create routes; it only allows the default route to be used for Google API destinations. A common misconfiguration is having a custom route for the Google API IP range (e.g., from a previous VPN setup) that overrides the default route. Option B is correct.

Answer

Private Google Access is not supported on subnets in us-central1.

Answer

The forward proxy must use an external IP address to use Private Google Access.

Answer

The on-premises network must be configured with a default route pointing to the internet.

PCNE Practice Test 26 — 15 Questions

Exhibit

PCNE Practice Test 26 — 15 Questions

Exhibit