PCNE Practice Test 26 — 15 Questions

Question 1

An organization wants to consume a third-party SaaS service via a private endpoint in their VPC, using Private Service Connect. Which type of Private Service Connect endpoint should they create?

Accepted Answer

PSC consumer endpoint (forwarding rule). A PSC consumer endpoint (forwarding rule) is the correct resource to create in the consumer VPC to connect to a third-party SaaS service published via Private Service Connect. The consumer creates a forwarding rule that targets the service attachment provided by the producer, enabling private connectivity without exposing traffic to the public internet.

Answer

PSC producer endpoint

Answer

Cloud VPN tunnel

Answer

VPC peering connection

Question 2

Which TWO are best practices for securing a VPC network? (Choose 2.)

Accepted Answer

Use firewall rules to restrict ingress traffic to only necessary ports and IPs.. Firewall rules are the primary mechanism for controlling ingress traffic in a VPC. By restricting traffic to only necessary ports and source IPs, you minimize the attack surface and enforce the principle of least privilege. This is a fundamental security best practice for network segmentation and access control.

Answer

Use VPC Network Peering to connect to other projects.

Answer

Create a VPC with default firewall rules.

Answer

Enable Private Google Access on all subnets.

Question 3

An organization uses Cloud DNS private zones for internal service discovery. They want to override DNS responses for a specific domain (e.g., 'internal.example.com') to block access to malicious domains and redirect certain queries to a different IP for compliance. Which Cloud DNS feature should they use?

Accepted Answer

Response Policies (RPZ). Response Policies (RPZ) in Cloud DNS allow you to override DNS responses for specific domains, enabling blocking of malicious domains and redirecting queries to different IPs for compliance. RPZ (Response Policy Zones) lets you define rules that modify or block responses based on the queried name, source, or other criteria. This is the correct feature for overriding DNS responses at the private zone level.

Answer

DNSSEC

Answer

Routing policies (weighted round robin, geolocation, failover)

Answer

Cloud DNS peering

Question 4

Which THREE of the following are requirements for VPC Network Peering?

Accepted Answer

The VPCs must have non-overlapping subnet IP ranges.. VPC Network Peering requires non-overlapping subnet IP ranges to prevent routing conflicts and ensure that traffic is correctly directed between the peered VPCs. Overlapping CIDR blocks would cause ambiguous routing, as the same IP address could exist in both VPCs, making it impossible for the VPC routers to determine the correct destination.

Answer

Peering supports transitive routing.

Answer

The VPCs must be in the same project.

Question 5

A company wants to cache static content globally to reduce latency for their users. They are using a Global HTTPS Load Balancer with a backend bucket. Which Cloud CDN cache mode should they use?

Accepted Answer

CACHE_ALL_STATIC. CACHE_ALL_STATIC is the Cloud CDN cache mode designed to automatically cache static content (based on file extension and content type) while respecting origin cache-control headers for other content. It is the recommended default for backend buckets serving static assets like images, CSS, and JS.

Answer

None: Cloud CDN cannot be used with backend buckets

Answer

USE_ORIGIN_HEADERS

Answer

FORCE_CACHE_ALL

Question 6

A company wants to connect two VPCs in the same region so that they can communicate using internal IP addresses without transiting the internet. They have no overlapping IP ranges. Which GCP networking feature should they use?

Accepted Answer

VPC peering. VPC peering allows two VPCs to communicate using internal IPs without a VPN or internet gateway, as long as there is no IP overlap.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Cloud Interconnect

Question 7

A company uses a Global HTTPS Load Balancer with Cloud CDN. They need to purge specific cached objects for all users immediately after a content update. Which method should they use?

Accepted Answer

Cache invalidation. Cache invalidation allows purging specific URLs or URL prefixes from Cloud CDN caches.

Answer

Delete the objects from the backend bucket

Answer

Use signed URLs

Answer

Reduce TTL on the origin

Question 8

A company runs a web application on Compute Engine instances without external IPs. They need to ensure the instances can access Google APIs (e.g., Cloud Storage) and also provide outbound internet access for software updates. Which two features should be configured? (Choose two.)

Accepted Answer

Cloud NAT. Private Google Access (E) is correct because it allows Compute Engine instances that have no external IP addresses to reach Google APIs and services such as Cloud Storage using their internal IP addresses, which directly satisfies the requirement to access Google APIs. Cloud NAT (C) is correct because it provides outbound internet connectivity for instances without external IPs, enabling software updates from the internet while keeping the instances private. Together, Private Google Access handles Google API traffic and Cloud NAT handles general internet egress. VPC Service Controls (A) is a security perimeter mechanism for mitigating data exfiltration and does not provide API or internet connectivity. Private Service Connect (B) is used to privately access specific published services via endpoints, not to give instances general outbound internet access. Cloud VPN (D) creates encrypted tunnels to remote networks and does not by itself provide internet egress or Google API access for instances without external IPs.

Answer

VPC Service Controls

Answer

Private Service Connect

Answer

Cloud VPN

Question 9

An organization wants to direct traffic from a global load balancer to an on-premises data center using a hybrid connectivity NEG. Which connectivity option must be in place for this to work?

Accepted Answer

Cloud VPN or Cloud Interconnect. A hybrid connectivity network endpoint group (NEG) requires a private, reliable path between the Google Cloud VPC and the on-premises environment, which is provided by Cloud VPN or Cloud Interconnect. The hybrid NEG uses this connectivity to route traffic from the load balancer to on-premises endpoints via the internal IP ranges reachable over the tunnel or interconnect. Without one of these, the load balancer has no path to reach the on-premises backends.

Answer

Dedicated Interconnect without VLAN attachments

Answer

Direct peering with Google

Answer

VPC Network Peering

Question 10

An organization is deploying a global application and wants to use an Internal Load Balancer (ILB) across multiple regions. What is the correct configuration?

Accepted Answer

Deploy Internal Load Balancer (ILB) in each region and use DNS to route traffic. Google Cloud does not support a native cross-region Internal Load Balancer (ILB). To distribute traffic across multiple regions, you must deploy a separate Internal TCP/UDP Load Balancer in each region and use DNS-based routing (e.g., Cloud DNS with geo-routing or weighted record sets) to direct clients to the appropriate regional ILB. This approach provides regional high availability and global reach without exposing internal IPs externally.

Answer

Use a cross-region ILB by enabling global access

Answer

Use an Internal TCP/UDP Load Balancer in one region and route traffic via Cloud VPN

Answer

Use a global External Load Balancer with internal backend

Question 11

A developer is configuring a Compute Engine VM to host a web server. They want to ensure that only HTTP (port 80) and HTTPS (port 443) traffic from the internet is allowed. Which firewall rule should they create?

Accepted Answer

Ingress allow rule for TCP ports 80 and 443 from 0.0.0.0/0.. To allow HTTP and HTTPS traffic from the internet to a Compute Engine VM, you need an ingress allow rule for TCP ports 80 and 443 from 0.0.0.0/0. This permits inbound traffic on those ports from any source, which is necessary for a public web server.

Answer

Egress allow rule for TCP ports 80 and 443 to 0.0.0.0/0.

Answer

Ingress deny rule for all ports except 80 and 443.

Answer

Egress deny rule for all ports.

Question 12

An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?

Accepted Answer

The firewall rules have a source or destination filter that excludes the new subnet's CIDR.. In Google Cloud, firewall rules can include source or destination IP range filters. Even if target tags match, if the rule also specifies a source or destination range that does not include the new subnet's CIDR (192.168.1.0/24), the rule will not apply to instances in that subnet. Option A is incorrect because although firewall rules are scoped to the VPC, that does not explain the issue; the rules still apply to all subnets, but specific IP range filters can limit applicability. Option B is incorrect because there is no concept of 'firewall rule enforcement' on subnets. Option C is incorrect because firewall rule changes apply immediately; instances do not need to be recreated.

Answer

Firewall rules are scoped to a VPC, not to subnets.

Answer

The new subnet was created without enabling firewall rule enforcement.

Answer

The instances need to be recreated for the new rules to apply.

Question 13

A company wants to route traffic to different backend services based on the geographic location of the client. Which Cloud DNS routing policy should they use?

Accepted Answer

Geolocation. Geolocation routing policy directs traffic to different backends based on the geographic location of the DNS resolver.

Answer

Weighted round robin

Answer

Failover

Answer

Cloud CDN

Question 14

While configuring a health check for a backend service, an engineer notices that the health check is failing even though the instances are healthy. The health check is HTTP on port 80 with a request path of /health. The instances respond to curl http://localhost:80/health with 200 OK. What is a likely cause?

Accepted Answer

Firewall rules are blocking traffic from health check ranges. Health checks originate from Google's centralized health-check source ranges (e.g., 35.191.0.0/16 and 130.211.0.0/22), not from the local host or the VPC's internal traffic. If firewall rules don't explicitly allow ingress from these ranges on port 80, the health check probes are dropped even though the instance itself is healthy and responds to localhost curl. The localhost test bypasses the network path entirely, so it cannot validate external reachability.

Answer

The backend service is not using an instance group

Answer

The health check protocol should be HTTPS

Answer

The health check interval is too long

Question 15

Which TWO of the following could cause a Dedicated Interconnect BGP session to go to the 'IDLE' state?

Accepted Answer

BGP is not enabled on the Cloud Router. Option B is correct because a Cloud Router must have BGP explicitly enabled (via the BGP configuration on the router and its interfaces/peers) for any BGP session to be attempted; without BGP enabled, the session never leaves IDLE. Option E is correct because the Cloud Router must be configured with a BGP peer matching the on-premises peer (correct ASN and peer IP) to initiate the session; if no such peer/session is configured, the state remains IDLE. Option A is not correct because BGP uses TCP port 179, not UDP 179, so a rule blocking UDP 179 would not affect the BGP session. Option C is not correct because a keepalive timer mismatch does not prevent session establishment; it can cause the session to drop after it is established (e.g., to ACTIVE/IDLE later), but the initial IDLE state is due to configuration/peer issues. Option D is not correct because MED is an optional path-attribute used for route selection and has no role in bringing up or keeping a BGP session in IDLE.

Answer

Firewall rules blocking UDP port 179

Answer

BGP keepalive timer mismatch

Answer

Multi-Exit Discriminator (MED) mismatch