PCNE Practice Test 27 — 15 Questions

Question 1

A company has a HA VPN gateway in Google Cloud with two tunnels to their on-premises router. They want to ensure that if one tunnel fails, all traffic automatically fails over to the other tunnel. What configuration is necessary on the on-premises router?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a higher local preference on the primary tunnel. For failover, the on-premises router should prefer one tunnel over the other using BGP attributes like local preference or AS path prepending. Typically, one tunnel is primary and the other is backup. Both tunnels should be established with BGP sessions, and the on-premises router should learn the same routes from both, but with different local preference values to determine the primary path.

Answer

Use AS path prepending on the primary tunnel to make it preferred

Answer

Configure the same MED value on both tunnels

Answer

Configure ECMP to load balance across both tunnels

Question 2

A company is deploying a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They require 99.99% availability for the interconnect. Which two actions must they take to meet this SLA?

Accepted Answer

Order two 10 Gbps circuits in different metro areas. To achieve 99.99% availability for Dedicated Interconnect, you need two connections with at least 10 Gbps each, placed in different metropolitan areas (different metro zones). This provides redundancy even if a whole metro area fails.

Answer

Order four 10 Gbps circuits in the same metro area

Answer

Order a single 10 Gbps circuit

Answer

Order two 10 Gbps circuits in the same metro area

Question 3

An organization is connecting their on-premises data center to Google Cloud via Partner Interconnect. The partner offers both Layer 2 and Layer 3 connectivity options. The organization wants to manage their own BGP sessions and IP addressing. Which connectivity option should they choose?

Accepted Answer

Layer 2 connectivity. With Layer 2, the service provider delivers a transparent VLAN, and the customer manages the BGP session with Google Cloud Router. Layer 3 would mean the partner manages the routing, which is not desired here.

Answer

Any Layer option because they can manage BGP regardless

Answer

Neither; they must use Dedicated Interconnect

Answer

Layer 3 connectivity

Question 4

A company is using Partner Interconnect with a service provider that requires the use of VLAN attachments. Which type of VLAN attachment should they create in Google Cloud to use the partner's connection?

Accepted Answer

PARTNER. For Partner Interconnect, you create a VLAN attachment of type PARTNER. This attachment represents the logical connection to the partner's network. The partner can also use PARTNER_PROVIDER type if they manage the attachment, but from the customer side, it's PARTNER.

Answer

DEDICATED

Answer

PARTNER_PROVIDER

Answer

CUSTOMER

Question 5

A company has set up a route-based HA VPN tunnel between Google Cloud and their on-premises network. They are experiencing packet loss and need to troubleshoot. Which logs or metrics would provide the MOST relevant information to diagnose the issue?

Accepted Answer

Cloud VPN gateway logs (syslog). Cloud VPN gateway logs provide detailed information about tunnel establishment, IKE negotiations, and BGP messages. They can help identify packet loss causes like MTU issues, encryption mismatches, or routing problems. Cloud Monitoring metrics for VPN tunnels show traffic volume and errors, but logs provide more granular detail.

Answer

Cloud Monitoring metric: interconnect/network/received_bytes_count

Answer

Cloud Load Balancing logs

Answer

VPC flow logs

Question 6

A company uses Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer needs to establish BGP peering between the on-premises router and Cloud Router. What must be created in Google Cloud to enable this?

Accepted Answer

A VLAN attachment of type PARTNER_PROVIDER.. With Layer 2 Partner Interconnect, the service provider extends a VLAN to Google. You create a VLAN attachment of type PARTNER_PROVIDER, which allows you to configure the Cloud Router and BGP session.

Answer

An HA VPN gateway.

Answer

A Dedicated Interconnect attachment.

Answer

A VLAN attachment of type PARTNER.

Question 7

A company has two Dedicated Interconnect connections from different metro areas to their GCP VPC. They want to use both connections actively (active-active load balancing) without manual intervention. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Advertise the same on-premises prefix with the same MED on both BGP sessions. To use active-active, you must configure ECMP on the Cloud Router to load balance across both BGP sessions, and advertise the same prefixes with equal priority (same MED) from both on-premises routers.

Answer

Use AS path prepending on one of the BGP sessions

Answer

Create two separate Cloud Routers

Answer

Set different MED values on each BGP session

Question 8

A network engineer is setting up a Dedicated Interconnect between an on-premises network and Google Cloud. After the circuit is ordered and the physical connection is established at the co-location facility, what is the first step to configure the interconnect inside GCP?

Accepted Answer

Create a VLAN attachment to associate with the interconnect.. After the physical connection is ready, you must create a VLAN attachment in Google Cloud to define the connection between your VPC and the interconnect.

Answer

Configure a VPN tunnel for backup connectivity.

Answer

Enable Cloud NAT for outbound traffic.

Answer

Create a Cloud Router with BGP sessions.

Question 9

A company wants to allow on-premises DNS servers to resolve Google Cloud private VM names. They need to configure a Google-managed forwarding server IP. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS policy. Inbound DNS policy creates a forwarding zone and provides a Google-managed inbound server IP that on-premises servers can use to resolve GCP private DNS names.

Answer

Outbound DNS forwarding

Answer

Cloud Router with BGP

Answer

Private DNS zone with peering

Question 10

A network engineer is troubleshooting a failing HA VPN tunnel. They need to view VPN gateway logs to identify the issue. Which Google Cloud service should they use to access the logs?

Accepted Answer

Cloud Logging. Cloud Logging captures logs from Cloud VPN gateways, including tunnel events, IKE negotiations, and error messages.

Answer

Cloud Audit Logs

Answer

Cloud Debugger

Answer

Cloud Monitoring

Question 11

A company is designing a multi-region application on GCP and wants to optimize egress costs. Which TWO of the following strategies will reduce cross-region egress costs? (Choose two.)

Accepted Answer

Use Cloud CDN to cache content at edge locations. Using Cloud CDN caches content at edge locations, reducing the need to fetch from the origin region. Using a regional load balancer instead of a global one can avoid cross-region traffic if users are in the same region as the backend. However, global LB with CDN is also good; but the question specifically asks for cost reduction. Cloud CDN reduces egress from origin. Regional LB avoids cross-region traffic altogether if the user and backend are in the same region.

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Deploy backends in multiple regions and use a global load balancer

Answer

Use Premium Tier networking

Question 12

A company uses Cloud NAT for outbound internet access from private instances. They want to monitor for connection failures due to NAT resource exhaustion. Which two steps should they take? (Choose two.)

Accepted Answer

Enable Cloud NAT logging. Enable Cloud NAT logging to capture connection and allocation failures. Set up alerts on NAT logs to detect failures. VPC Flow Logs do not capture NAT-specific failures. Firewall Insights are for firewall rules. Packet Mirroring is not relevant.

Answer

Enable VPC Flow Logs on the subnet

Answer

Use Packet Mirroring to capture NAT traffic

Answer

Use Firewall Insights to check for blocked traffic

Question 13

A network engineer needs to verify that traffic from a specific Compute Engine instance can reach a Cloud SQL database in a different VPC. Which Google Cloud tool should be used to test this reachability?

Accepted Answer

Connectivity Tests. Network Intelligence Center Connectivity Tests allow you to check reachability between source and destination, analyzing firewall rules, routes, and VPC peering. It can pinpoint where traffic is blocked.

Answer

Cloud Monitoring

Answer

Network Topology

Answer

VPC Flow Logs

Question 14

An engineer notices that VPC Flow Logs are enabling on a subnet but only a fraction of traffic is logged. What is the most likely cause?

Accepted Answer

Default sampling rate of 50% is applied. VPC Flow Logs use sampling by default (50%) to reduce cost and volume. This means only half of the flows are logged.

Answer

The log export filter is too restrictive

Answer

The subnet has an insufficient sampling rate set to 0.5

Answer

Flow Logs only log TCP traffic

Question 15

An engineer is troubleshooting high latency between a Compute Engine instance in us-central1 and an instance in europe-west1. Which tool can show per-region latency and packet loss?

Accepted Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Network Topology

Answer

Firewall Insights