PCNE Practice Test 27 — 15 Questions

Question 1

A retail company uses an external HTTPS load balancer with a single backend service that has two managed instance groups: one in us-central1 and one in europe-west1. The security team requires that all incoming requests be inspected for SQL injection and cross-site scripting before they reach the backends, and they want IP addresses of attackers blocked automatically. Which Google Cloud service should you attach to the load balancer to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Armor security policy. The requirement combines Layer 7 inspection for SQL injection and XSS with automatic blocking of attacker IP addresses at the Google edge. Cloud Armor security policies are the only listed mechanism designed to attach to an external HTTPS load balancer backend service and provide preconfigured WAF rules plus adaptive protection. Firewall rules, Cloud IDS, and IAP address different layers or purposes and cannot fulfill both conditions.

Answer

Identity-Aware Proxy enabled on the backend service

Answer

Cloud IDS endpoint in each region

Answer

VPC firewall rules applied to the backend instance groups

Question 2

A company is planning to connect multiple VPCs in different projects to a common on-premises network using a hub-and-spoke topology. They want to use Network Connectivity Center (NCC). Which TWO components are required to set up this topology?

Accepted Answer

NCC hub. Option B (NCC hub) is correct because Network Connectivity Center requires a hub resource that acts as the central management point for the hub-and-spoke topology, connecting the on-premises network to the spokes. Option E (VPC spokes) is correct because each VPC in the different projects must be attached to the hub as a VPC spoke, which enables the hub to route traffic between the VPCs and the on-premises connection. Option A (VPC Network Peering) is not required because NCC uses its own spoke attachment mechanism rather than VPC peering to connect VPCs to the hub. Option C (Dedicated Interconnect VLAN attachments) is not required because the question does not specify the on-premises connection type; NCC supports multiple hybrid connectivity options, and VLAN attachments are only needed for Dedicated Interconnect, not as a mandatory NCC component. Option D (Cloud Router) is not required as a distinct NCC component because Cloud Router is used with VLAN attachments for BGP route exchange, but it is not a required part of the NCC hub-and-spoke topology itself.

Answer

VPC Network Peering

Answer

Dedicated Interconnect VLAN attachments

Answer

Cloud Router

Question 3

A company needs to map multiple domain names to different backend services on a single Global HTTPS Load Balancer. Which resource should they configure to direct traffic based on the requested hostname?

Accepted Answer

URL map. A URL map is the routing resource on a Global HTTPS Load Balancer that matches incoming requests based on hostname and path, then forwards them to the appropriate backend service. Host and path rules are defined inside the URL map, making it the correct place to map multiple domain names to different backends. The target proxy and SSL certificate handle TLS termination and certificate selection, not request routing.

Answer

Backend service

Answer

Target proxy

Answer

SSL certificate

Question 4

Which TWO statements are true about VPC Network Peering? (Choose 2)

Accepted Answer

You can export custom routes to a peered VPC.. Option A is correct because VPC Network Peering allows you to import and export custom routes (static and dynamic) between peered VPC networks by configuring the export/import custom routes settings, enabling on-premises reachability through the peer. Option B is correct because peering is non-transitive: if VPC A is peered with VPC B and VPC B is peered with VPC C, A cannot reach C through B unless a direct peering between A and C is established. Option C is incorrect because peering does not have a 'global routing mode' setting; global routing is a VPC-level dynamic routing mode for Cloud Router, and peering connectivity depends on subnet ranges and peering configuration, not a global routing mode toggle. Option D is incorrect because peering is explicitly non-transitive, not transitive by default. Option E is incorrect because peered VPC networks cannot have overlapping subnet IP ranges; overlapping CIDR blocks cause peering creation to fail.

Answer

Peering supports global routing mode.

Answer

Peering is transitive by default.

Answer

Peered VPCs can have overlapping IP ranges.

Question 5

An organization has multiple projects and wants to apply a consistent set of firewall rules across all VPC networks in the organization. Which approach should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization level and are inherited by all folders and projects, ensuring consistent rules across the entire hierarchy.

Answer

Create a network firewall policy and attach it to each VPC

Answer

Use VPC peering to share rules

Answer

Apply firewall rules using tags in each project

Question 6

A company wants to allow HTTP traffic from the internet to a web server running on a Compute Engine VM in a VPC. The web server should only be accessible on port 80. Which firewall rule should be created?

Accepted Answer

Ingress rule: allow tcp:80 from 0.0.0.0/0 (target tags: web-server). HTTP traffic from the internet (source 0.0.0.0/0) must be allowed by an ingress firewall rule targeting the web server VM. The rule specifies TCP port 80, which is the standard HTTP port, and uses target tags 'web-server' to apply the rule only to VMs with that tag, ensuring the web server is accessible on port 80 from any source.

Answer

Egress rule: allow tcp:80 from 0.0.0.0/0 (target tags: web-server)

Answer

Ingress rule: allow tcp:443 from 0.0.0.0/0 (target tags: web-server)

Answer

Ingress rule: allow tcp:80 from 0.0.0.0/0 (target tags: default)

Question 7

A network engineer needs to configure firewall rules to allow health checks from Google Cloud's health check systems to a backend service. Which two source IP ranges should they allow? (Choose two.)

Accepted Answer

130.211.0.0/22. Options C (130.211.0.0/22) and D (35.191.0.0/16) are correct because these are the two documented source IP ranges used by Google Cloud's health check systems (including HTTP(S), TCP, SSL, and HTTP/2 health checks) when probing backend services; firewall rules must permit inbound traffic from both ranges for health checks to succeed. Option A (169.254.0.0/16) is the link-local range used for metadata and internal routing, not for health check probes. Option B (10.0.0.0/8) is a private RFC 1918 range that is not the source of Google's health check traffic. Option E (0.0.0.0/0) would allow all sources and is overly permissive, not the specific required ranges.

Answer

169.254.0.0/16

Answer

10.0.0.0/8

Answer

0.0.0.0/0

Question 8

A security team wants to restrict which Google services can be accessed from their VPC without external IPs. They use Private Google Access. What should they use to block access to specific services?

Accepted Answer

VPC Service Controls. VPC Service Controls allows creating security perimeters that restrict access to services.

Answer

Firewall rules blocking destination IPs

Answer

Cloud NAT with a specific IP range

Answer

Private Google Access with restricted VIPs

Question 9

An organization uses VPC Service Controls to protect Google Cloud APIs. They need to allow a specific service account in a peripheral project to access a managed service in a protected service perimeter. What should they configure?

Accepted Answer

Ingress and egress rules in the perimeter.. VPC Service Controls uses ingress and egress rules to control data exchange between a protected service perimeter and resources outside it. To allow a specific service account in a peripheral project to access a managed service inside the perimeter, you configure an ingress rule that permits traffic from that service account to the protected service. Ingress rules define which identities and sources from outside the perimeter are allowed to access protected services. Egress rules would be used for the opposite direction (from inside to outside).

Answer

IAM conditions on the service account.

Answer

Access levels in VPC Service Controls.

Answer

Private Google Access.

Question 10

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Accepted Answer

Assign an external IP address to the VM.. Option B is correct because a VM instance needs an external (public) IP address to be directly reachable from the internet; without one, inbound connections from internet clients cannot be routed to the instance. Option E is correct because Google Cloud VPC firewall rules are required to permit ingress traffic, and a rule allowing TCP port 80 from 0.0.0.0/0 explicitly authorizes HTTP traffic from any internet source to reach the VM. Together, the external IP provides the routable address and the firewall rule provides the permission, satisfying both the addressing and access-control requirements. Option A is incorrect because Cloud NAT provides outbound internet access for instances without external IPs and does not enable inbound connections. Option C is incorrect because Private Google Access only allows instances without external IPs to reach Google APIs and services, not general internet HTTP clients. Option D is incorrect because a static internal IP address is only routable within the VPC and cannot be reached from the internet.

Answer

Configure Cloud NAT for the VPC.

Answer

Enable Private Google Access on the subnet.

Answer

Assign a static internal IP address to the VM.

Question 11

A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud NAT. Cloud NAT (Network Address Translation) allows Compute Engine instances without external IP addresses to initiate outbound connections to the internet. It provides many-to-one IP translation using a NAT gateway in the VPC, enabling internet access while keeping instances private. This is the standard Google Cloud solution for outbound-only internet access from private instances.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering

Question 12

A company is deploying a Dedicated Interconnect with a 10 Gbps circuit to Google Cloud. They need to ensure high availability. Which configuration is required by Google Cloud to meet the high availability SLA?

Accepted Answer

Provision two VLAN attachments on two separate Cloud Routers in different zones. To meet the high availability SLA for Dedicated Interconnect, Google Cloud requires at least two VLAN attachments, each on a separate Cloud Router in different zones. This ensures that if one zone or Cloud Router fails, traffic can still flow through the other attachment, providing redundancy. A single VLAN attachment or a single Cloud Router does not meet the 99.99% availability SLA because it creates a single point of failure.

Answer

Combine Dedicated Interconnect with a Cloud VPN tunnel for failover

Answer

Use Partner Interconnect instead of Dedicated Interconnect

Answer

Provision a single VLAN attachment on one Cloud Router

Question 13

A company uses Cloud Armor with an external HTTPS load balancer to protect their web application. They have a security policy 'my-policy' attached to the backend service. The policy includes an allow rule (priority 1000) for their corporate IP range (203.0.113.0/24) and a deny rule (priority 2000) for all other IPs. The company has an office at a remote location that uses a different IP range (198.51.100.0/24). Employees from the remote office report they cannot access the application. Meanwhile, employees from the corporate office (203.0.113.0/24) can access. The engineer checks the Cloud Armor policy and sees the rule configuration as shown. What is the most likely cause?

Accepted Answer

The remote office IP range is not included in an allow rule in the security policy.. The remote office IP range (198.51.100.0/24) is not explicitly allowed by any rule in the security policy. The only allow rule (priority 1000) permits traffic from the corporate IP range (203.0.113.0/24), and the deny rule (priority 2000) blocks all other IPs. Since the remote office IPs are not covered by the allow rule, they are denied by default, which explains their inability to access the application.

Answer

The rule evaluation order is wrong; the deny rule should have higher priority (lower number).

Answer

The deny rule uses 'SRC_IPS_V2' which is an invalid expression.

Answer

The load balancer's frontend IP blocks traffic from certain geographic regions.

Question 14

A company is setting up HA VPN between GCP and on-premises. They want 99.99% SLA. Which TWO configurations are required? (Choose 2)

Accepted Answer

Four IKEv2 tunnels with BGP. The 99.99% SLA for Cloud HA VPN requires two interfaces on the Cloud VPN gateway, each with a unique external IP address (two external IPs total — option D). Additionally, each interface must have two tunnels, resulting in four tunnels total, and these tunnels must use IKEv2 and BGP dynamic routing (option B). Cloud Router with BGP is required for dynamic routing, but the two specific configurations from the options are two external IP addresses and four IKEv2 tunnels with BGP. Therefore, options B and D are correct.

Answer

One external IP address on the Cloud VPN gateway

Answer

Cloud Router configured with BGP

Answer

Static routing

Question 15

A company has a Dedicated Interconnect with one 10 Gbps connection. They need high availability for critical workloads. Which design is the best practice according to Google Cloud recommendations?

Accepted Answer

Provision a second Dedicated Interconnect connection to a different PoP.. Google Cloud best practice for high availability with Dedicated Interconnect requires at least two physical connections, each to a different edge point of presence (PoP), to eliminate single points of failure at the network edge. A single 10 Gbps connection, even with a backup VPN, does not provide the same SLA or bandwidth guarantees for critical workloads. Option A ensures that if one PoP or provider fails, the other connection can maintain connectivity.

Answer

Add a second connection to the same PoP using the same provider.

Answer

Rely on the single connection and monitor for failures.

Answer

Use Cloud VPN as a backup to the Dedicated Interconnect.