PCNE Practice Test 28 — 15 Questions

Question 1

Which TWO of the following methods can be used to encrypt traffic between VPC networks?

Accepted Answer

Use of SSL/TLS at the application layer.. Option A (Use of SSL/TLS at the application layer) is correct because encrypting at the application layer with SSL/TLS protects the data end-to-end regardless of the underlying network path, so traffic traversing between VPC networks is encrypted by the application itself. Option D (Cloud VPN with IPsec) is correct because Cloud VPN establishes an IPsec-encrypted tunnel between two VPC networks (or between a VPC and on-premises), encrypting all traffic that passes through the tunnel. Option B (VPC peering) is not correct because it only provides private IP connectivity between VPC networks without any encryption of the traffic. Option C (Cloud Interconnect with VLAN attachments) is not correct because it provides dedicated private connectivity but does not itself encrypt traffic; encryption would require an additional layer such as IPsec or application-level TLS. Option E (Cloud NAT) is not correct because it only provides outbound internet access for instances without external IPs and performs no encryption.

Answer

VPC peering.

Answer

Cloud Interconnect with VLAN attachments.

Answer

Cloud NAT.

Question 2

Which THREE components are required when configuring an internal TCP/UDP load balancer? (Choose THREE.)

Accepted Answer

Health check. For an internal TCP/UDP load balancer in Google Cloud, the required components are a health check (A), a backend service (B), and a forwarding rule (E). The health check (A) is mandatory because the internal load balancer uses it to determine which backend instances are healthy and eligible to receive traffic. The backend service (B) is required because it defines the group of backends (instance groups or NEGs) that will handle the traffic, along with the load balancing and session affinity settings. The forwarding rule (E) is required because it specifies the internal IP address, port, and protocol on which the load balancer listens and directs traffic to the backend service. An external IP address (C) is not required because an internal load balancer uses an internal (private) IP address, not an external one. An SSL certificate (D) is not required because internal TCP/UDP load balancing operates at Layer 4 and does not terminate TLS/SSL; SSL certificates are used with HTTPS/SSL proxy load balancers.

Answer

External IP address

Answer

SSL certificate

Question 3

You are using Serverless VPC Access to connect Cloud Run services to a VPC network. The connector is in us-central1 with a /28 subnet. You have a Cloud SQL instance (private IP) in the same region but in a different VPC network (peered). The Cloud Run service cannot reach the Cloud SQL instance. What is the most likely cause?

Accepted Answer

The VPC connector's subnet does not have a route to the peered VPC where Cloud SQL resides.. Serverless VPC Access connectors only route traffic to resources within the VPC network they are attached to. When Cloud SQL resides in a different VPC that is connected via VPC peering, the connector's subnet must have a route (and the peering must be configured to export/import custom routes) to reach the peered VPC's CIDR range. Without that route, packets from the Cloud Run service are dropped before reaching Cloud SQL.

Answer

The Cloud SQL instance must have the Cloud SQL Proxy configured.

Answer

Serverless VPC Access requires Private Google Access to be enabled on the connector's subnet.

Answer

Cloud SQL requires an external IP for Serverless VPC Access connectivity.

Question 4

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect using VLAN attachments. They have set up a Cloud Router with BGP to exchange routes. The on-premises network advertises a prefix 10.0.0.0/8, and Google Cloud advertises the VPC's subnet ranges (10.0.0.0/24 and 10.0.1.0/24). After configuration, on-premises hosts cannot reach the Google Cloud instances in those subnets. The engineer checks the BGP session status and it is established. The Cloud Router shows that the on-premises prefix is learned, and the on-premises router shows that the specific /24 prefixes are received. However, traffic from on-premises to the Google Cloud subnets is not working. What is the most likely cause?

Accepted Answer

The on-premises router has a local route for 10.0.0.0/8 that overrides the BGP-learned /24 routes.. The most likely cause is that the on-premises router has a local route for the larger prefix 10.0.0.0/8, which is more specific than the BGP-learned /24 routes. Since the local route has a lower administrative distance (typically 0 for directly connected or 1 for static) compared to BGP's administrative distance of 20 for eBGP, the on-premises router prefers the local route and forwards traffic locally instead of sending it over the Dedicated Interconnect to Google Cloud. This results in traffic not reaching the VPC subnets.

Answer

The VPN connection needs to be configured for the Interconnect.

Answer

The Google Cloud VPC has a custom static route that overrides the dynamically learned route.

Answer

The on-premises firewall is blocking the traffic.

Question 5

A company wants to restrict access to Google Cloud APIs from a specific set of VMs based on the VM's service account. Which type of firewall rule target should be used?

Accepted Answer

Target service accounts. Firewall rules can target instances by service account, allowing fine-grained control based on identity rather than network tags.

Answer

Target tags

Answer

All instances

Answer

Source service accounts

Question 6

You are configuring an HA VPN tunnel between GCP and on-premises. The on-premises VPN device only supports IKEv1 and static routing. Which of the following is true regarding this setup?

Accepted Answer

Classic VPN must be used. HA VPN requires IKEv2 and dynamic routing (BGP). Classic VPN supports IKEv1 and static routing.

Answer

Partner Interconnect can be used instead

Answer

HA VPN can be used with static routing if you disable BGP

Answer

HA VPN can be configured with IKEv1 and static routes

Question 7

An enterprise is planning a Dedicated Interconnect connection to GCP. They require 99.99% availability and expect to use multiple VLAN attachments. What is the minimum number of 10 Gbps links and VLAN attachments needed to meet the availability goal?

Accepted Answer

Two 10 Gbps links and two VLAN attachments. To achieve 99.99% availability with Dedicated Interconnect, Google Cloud requires at least two 10 Gbps links in different edge availability domains (metros) and two VLAN attachments, one on each link, to provide redundancy. This configuration ensures that if one link or attachment fails, traffic can fail over to the other, meeting the 99.99% SLA.

Answer

Two 10 Gbps links and one VLAN attachment

Answer

One 100 Gbps link and one VLAN attachment

Answer

One 10 Gbps link and one VLAN attachment

Question 8

A company wants to expose a web application running on Cloud Run to the internet with a single global IP address, SSL termination, and Cloud CDN. Which load balancer should they use?

Accepted Answer

Global External HTTP(S) Load Balancer. The Global External HTTP(S) Load Balancer is the only GCP load balancer that provides a single global anycast IP, integrates natively with Cloud CDN, and performs SSL/TLS termination at the edge for HTTP(S) workloads. It supports serverless backends such as Cloud Run (via serverless NEGs), so it can front a Cloud Run service directly. Regional HTTP(S) LBs lack the global anycast IP and Cloud CDN integration, and TCP/UDP/TCP Proxy LBs operate at L4 and cannot terminate SSL or use Cloud CDN.

Answer

External TCP/UDP Network Load Balancer

Answer

Global TCP Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 9

A company wants to use HA VPN with route-based VPN. Which VPN configuration option must be enabled?

Accepted Answer

Route-based VPN by selecting Dynamic Routing (BGP) or using static routes.. Route-based VPN uses routing (BGP or static routes) to determine which traffic goes through the tunnel, as opposed to policy-based which uses security policies.

Answer

IKEv1 with pre-shared keys.

Answer

Using certificates instead of pre-shared keys.

Answer

Policy-based VPN with multiple policies for each subnet.

Question 10

An organization needs to set up a Regional Internal HTTPS Load Balancer for internal microservices. They want to use Envoy-based load balancing. Which backend type must the backend service use?

Accepted Answer

Zonal NEG. For a Regional Internal HTTPS Load Balancer using Envoy-based load balancing, the backend service must use a zonal network endpoint group (NEG). Zonal NEGs are required for Envoy-based load balancers to enable advanced traffic management and container-native load balancing. They allow the load balancer to route traffic directly to Pods in GKE, providing better performance and granularity.

Answer

Instance group

Answer

Internet NEG

Answer

Hybrid connectivity NEG

Question 11

To enable DNSSEC for a Cloud DNS managed zone, what must be configured?

Accepted Answer

Set the DNSSEC state to 'on' for the zone. To enable DNSSEC for a Cloud DNS managed zone, you must set the DNSSEC state to 'on' for the zone. This activates DNSSEC signing for the zone, generating keys and signing records. After enabling, you must also add the DS record to the parent zone to complete the chain of trust, but the question asks what must be configured on the zone itself.

Answer

Create a response policy

Answer

Add DS records to the parent zone

Answer

Set the zone type to private

Question 12

A network engineer wants to see a real-time graphical representation of the topology of their VPC network, including instances, subnets, and load balancers. Which Network Intelligence Center tool should they use?

Accepted Answer

Network Topology. Network Topology in Network Intelligence Center provides a real-time graphical representation of the VPC network, including instances, subnets, load balancers, and their connections. It visualizes the network infrastructure and traffic flows, making it the correct tool for this requirement.

Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Firewall Insights

Question 13

Which Cloud DNS routing policy should you use to direct users to the nearest healthy backend based on their geographic location?

Accepted Answer

Geolocation. Geolocation routing policy directs users to the nearest healthy backend based on their geographic location. This is ideal for directing users to the closest resource to reduce latency and improve performance.

Answer

Failover

Answer

Weighted round robin

Answer

Response policy

Question 14

An organization uses a hierarchical firewall policy at the organization level with a deny-all egress rule (priority 100). They also have a VPC-level firewall rule allowing egress to a specific external IP (priority 1000). Will traffic to that external IP be allowed?

Accepted Answer

No, because hierarchical firewall policies take precedence over VPC firewall rules.. Hierarchical firewall policies are evaluated before VPC firewall rules in the GCP firewall evaluation order. A deny at the organization level with priority 100 is evaluated first, so the more permissive VPC rule at priority 1000 is never reached and the traffic is blocked.

Answer

Yes, because VPC firewall rules override hierarchical policies for the same traffic.

Answer

Yes, because the VPC rule has a higher priority number and is more specific.

Answer

No, because both rules deny and allow cancel out, resulting in default deny.

Question 15

You need to configure Cloud CDN to cache all content from a backend bucket, ignoring any Cache-Control headers sent by the origin. Which cache mode should you use?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL mode in Cloud CDN caches all content from the backend bucket, ignoring any Cache-Control headers sent by the origin. This ensures that all content is cached according to the CDN's TTL settings, overriding origin directives.

Answer

USE_ORIGIN_HEADERS

Answer

CACHE_ALL_STATIC

Answer

DYNAMIC_MODE