PCNE Practice Test 28 — 15 Questions

Question 1

A company has a VPC that is connected to an on-premises network via a Cloud VPN tunnel using dynamic routing (BGP). They have set up a Cloud Router with an advertised IP range of 10.0.0.0/8. The on-premises network advertises 172.16.0.0/12. They also have a custom static route in the VPC for 10.0.0.0/8 that points to a next-hop VPN tunnel (the same tunnel) with priority 100. Recently, they added a new subnet 10.1.0.0/24 in the VPC. Traffic from on-premises to 10.1.0.0/24 is not working. Which THREE steps should they take to troubleshoot and resolve the issue? (Choose 3.)

Accepted Answer

Verify that the Cloud Router is advertising the 10.1.0.0/24 subnet to on-premises.. The issue is that the static route for 10.0.0.0/8 with priority 100 may be overwriting the dynamically learned routes for the new subnet. Dynamic routes from Cloud Router have a higher priority (1000) by default, but the static route with lower priority (100) will take precedence. However, since the static route points to the same VPN tunnel, it should still work, but if the static route is for the entire range, it may not be specific enough for the new subnet? Actually, the most specific route wins. The subnet 10.1.0.0/24 is more specific than 10.0.0.0/8, so a dynamic route for 10.1.0.0/24 should be propagated. But since the static route covers 10.0.0.0/8, it does not prevent more specific routes. The problem might be that the Cloud Router is not advertising the new subnet to on-premises, or the on-premises router is not accepting the update, or the BGP session is down. Option A is correct: check if the Cloud Router is advertising the subnet. Option B is correct: check the BGP session status. Option E is correct: check on-premises route tables. Option C is incorrect because changing priority might not help, and Option D is incorrect because you can keep the static route for other subnets.

Answer

Change the static route priority to 1000 to match dynamic routes.

Answer

Delete the static route for 10.0.0.0/8 and rely solely on dynamic routing.

Question 2

A company is designing a multi-region architecture with Active/Active failover across two regions using Cloud VPN. They want to ensure that traffic from on-premises to a global external HTTPS load balancer is routed to the nearest region based on latency. What should they configure on the on-premises side?

Accepted Answer

BGP AS Path prepending to make one path appear longer.. To direct traffic to the nearest region based on latency, on-premises routers should use BGP with AS Path prepending to influence path selection. Option D is correct. Option A is wrong because static routes don't consider latency. Option B is wrong because MED is used for inbound traffic, not outbound. Option C is wrong because local preference influences outbound traffic from on-premises but is not the primary method for latency-based routing.

Answer

Local preference on the on-premises router.

Answer

Multi-Exit Discriminator (MED) on the Google Cloud side.

Answer

Static routes pointing to the VPC subnet in each region.

Question 3

Which of the following is a benefit of using Shared VPC?

Accepted Answer

Centralized network administration and separation from application projects.. Shared VPC allows centralized network administration with separation of application projects.

Answer

Lower cost compared to VPC peering.

Answer

Automatic failover for applications.

Answer

Reduced latency between instances.

Question 4

A company is designing a Shared VPC architecture for multiple projects. The host project hosts three VPC networks: 'prod', 'staging', 'dev'. Each service project needs access to a specific network. Some service projects require access to multiple networks. The security team wants to minimize the number of firewall rules and use IAM for centralized control. Which approach meets these requirements?

Accepted Answer

Attach each service project to one host project network and use IAM roles to grant access to specific subnets in other networks with a cross-project service account.. Shared VPC allows service projects to be attached to a single host project, but a service project can only be attached to one VPC network in the host project. To access multiple networks, the service project must be attached to multiple host projects or use separate networks per project. Using IAM at the subnet level with roles like compute.networkUser allows granular access. Option C is correct because it limits service projects to one network each and uses IAM to grant cross-network access as needed.

Answer

Use VPC Network Peering between each service project's VPC and the host project's networks.

Answer

Create a separate host project for each environment and attach service projects accordingly.

Answer

Create a single VPC network that encompasses all environments, and use subnet-level firewall rules to isolate environments.

Question 5

A company has a multi-region VPC with subnets in us-central1 (10.0.0.0/24) and europe-west1 (10.0.1.0/24). They have deployed a global Application Load Balancer (ALB) with backend services in both regions. The backends are instance groups with instances in each subnet. The ALB uses internal IP addresses from a subnet in each region for the backend services. The company wants to restrict access to the ALB so that only traffic from a specific list of external IP addresses (e.g., corporate VPN) can reach the load balancer. They have created a firewall rule allowing ingress from those IP addresses to the ALB's forwarding rule IP (which is a global IP). However, external traffic from allowed IPs is still being blocked. What is the most likely reason?

Accepted Answer

VPC firewall rules do not apply to global load balancer's frontend; use Cloud Armor with IP whitelist.. The Global Application Load Balancer uses a frontend IP that is a global anycast IP. Firewall rules are applied at the network level and cannot filter traffic to global forwarding rules because the traffic is routed through Google's frontend infrastructure before reaching the VPC. To restrict access to a global ALB, you should use Cloud Armor or IAP, not VPC firewall rules. Option C is correct: Use Cloud Armor with an IP whitelist to restrict access.

Answer

The firewall rule should be created with priority lower than 1000 to override default deny.

Answer

The firewall rule must allow ingress from the allowed IPs to the backend instance's internal IPs.

Answer

The firewall rule must be applied to the backend instances' tags, not the forwarding rule IP.

Question 6

An organization has two Cloud VPN tunnels from the same on-premises router to a Cloud Router in Google Cloud. Both tunnels are using BGP, and the on-premises router is sending the same routes over both tunnels. The Cloud Router is configured to use 'route propagation' from a VPC network. Which of the following is true regarding route priority?

Accepted Answer

Cloud Router will use both tunnels for load balancing (ECMP) if the routes are identical. When both BGP routes are identical in prefix, AS path, local preference, MED, and other attributes, Cloud Router uses ECMP (Equal-Cost Multi-Path) to load balance traffic across both Cloud VPN tunnels. Route propagation in the VPC network does not alter the BGP best-path selection; it simply injects the learned routes into the VPC routing table. Since the on-premises router advertises the same routes over both tunnels, Cloud Router treats them as equal-cost paths and distributes traffic across both tunnels.

Answer

The tunnel with the lower local preference value will be used

Answer

The tunnel with the higher BGP MED value will be preferred

Answer

Only the tunnel with the lowest IP address will be used

Question 7

A company has a VPC with subnets in us-east1 and us-west1. They have established a Cloud VPN tunnel to their on-premises network through a Cloud Router in us-east1. They want to ensure that traffic from on-premises to resources in us-west1 uses the VPN tunnel and not the public internet. What must be configured?

Accepted Answer

Add a route on the on-premises router for us-west1 subnets with next hop pointing to the VPN tunnel. The correct answer is C because the on-premises router must have a route for the us-west1 subnets with the VPN tunnel as the next hop. Without this, the on-premises router will use its default route (typically the public internet) to reach us-west1, bypassing the VPN tunnel. The Cloud Router in us-east1 advertises the us-west1 subnets via BGP over the VPN tunnel, but the on-premises router must be explicitly configured to forward traffic for those subnets into the tunnel.

Answer

Configure a custom dynamic route on the Cloud Router for us-west1 subnets

Answer

Create a separate VPN tunnel from on-premises to a Cloud Router in us-west1

Answer

Configure VPC firewall rules to allow traffic from on-premises to us-west1

Question 8

A global application uses a global external HTTPS load balancer with backend NEGs in multiple regions. The content is static and must be cached at edge locations to reduce latency. Which GCP service should be enabled?

Accepted Answer

Cloud CDN. Cloud CDN is the correct service because it leverages Google's global edge cache network to cache static content from an external HTTPS load balancer with backend NEGs. When enabled, Cloud CDN intercepts requests at edge locations and serves cached responses, reducing latency and offloading origin servers. This directly addresses the requirement to cache static content at edge locations for a global application.

Answer

Cloud Storage

Answer

Cloud NAT

Answer

Cloud Memorystore

Question 9

A company has deployed a web application on Compute Engine instances in a VPC with subnet 10.1.0.0/20. The instances need to access an external API that whitelists IP addresses. The company uses Cloud NAT to provide outbound connectivity. The API integration tests are failing, and the operations team suspects that the source IP addresses seen by the API are not consistent. What is the most likely cause and solution?

Accepted Answer

Cloud NAT is configured with a default rule that does not include the subnet; add a custom NAT rule that specifically includes subnet 10.1.0.0/20.. Option D is correct because if Cloud NAT's default rule does not include the subnet 10.1.0.0/20, instances in that subnet will not have their outbound traffic translated through the NAT gateway, causing them to use their ephemeral public IPs (if any) or fail to reach the external API. Adding a custom NAT rule that explicitly includes the subnet ensures all outbound traffic from those instances uses the consistent NAT IP address that the API whitelist expects.

Answer

Cloud NAT is configured with endpoint-independent mapping; change to endpoint-dependent mapping to ensure consistent source IP.

Answer

Cloud NAT is configured with dynamic port allocation; use static port allocation instead.

Answer

Cloud NAT is using a manual NAT IP address that is not assigned to the instances; assign the NAT IP to the instances as an alias IP range.

Question 10

An organization wants to use Shared VPC but restrict access to certain subnets for specific service projects. Which GCP feature should they use?

Accepted Answer

Subnet-level IAM bindings. Subnet-level IAM bindings allow you to grant roles (e.g., compute.networkUser) on specific subnets within a Shared VPC to service project principals. This restricts access to only those subnets, while the service project can still use the shared network. It is the native GCP mechanism for fine-grained subnet access control in a Shared VPC environment.

Answer

VPC Network Peering

Answer

VPC Service Perimeters

Answer

Firewall rules

Question 11

A company wants to migrate an on-premises application that uses IPsec VPN tunnels to Google Cloud. They need to ensure encrypted connectivity between the on-premises network and a VPC. Which GCP service should they use?

Accepted Answer

Cloud VPN. Cloud VPN (D) is the correct service because it securely extends an on-premises network to a Google Cloud VPC over the public internet using IPsec VPN tunnels. It provides encrypted connectivity that matches the existing IPsec-based architecture, ensuring data confidentiality and integrity between the two sites.

Answer

Cloud Router

Answer

Cloud Interconnect

Answer

VPC Network

Question 12

Which GCP service provides a dedicated, low-latency connection from an on-premises data center to Google Cloud?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, low-latency connection from an on-premises data center to Google Cloud, bypassing the public internet. It offers two options: Dedicated Interconnect (a direct physical connection via a colocation facility) and Partner Interconnect (via a supported service provider). This ensures consistent bandwidth and lower latency compared to VPN-based solutions.

Answer

Cloud Router

Answer

Cloud VPN

Answer

VPC Network

Question 13

A company needs to connect their on-premises data center to Google Cloud using a VPN with high availability. They have two VPN appliances on-premises in different locations. What is the best design on the GCP side?

Accepted Answer

Deploy two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.. Option D is correct because it provides true high availability by using two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance. This design ensures that if one region or gateway fails, traffic can still flow through the other region, meeting the requirement for high availability. Using separate Cloud Routers allows for dynamic routing with BGP, enabling automatic failover and load balancing across the two tunnels.

Answer

Deploy one Cloud VPN gateway with two tunnels to both on-premises appliances, using one Cloud Router.

Answer

Deploy two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.

Answer

Deploy one Cloud VPN gateway with a single tunnel to one on-premises appliance.

Question 14

A company has a VPC with subnets in us-east1 and europe-west1. They need low-latency communication between instances in these regions using private IPs only. Which solution should they use?

Accepted Answer

Use a Global VPC (default VPC mode).. A Global VPC (default VPC mode) allows subnets in multiple regions to communicate using private IPs natively, without any additional VPN or peering configuration. This is because a Global VPC spans all regions, and instances within the same VPC can reach each other via internal IPs using Google's global network, providing low-latency communication.

Answer

Use Cloud VPN to connect the regions.

Answer

Use Cloud Interconnect to connect the regions.

Answer

Use VPC Network Peering between the two regional subnets.

Question 15

Which TWO of the following are benefits of using Shared VPC?

Accepted Answer

Automatic cross-project routing. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling automatic cross-project routing. This is because all subnets in the host project are directly reachable from any service project attached to that host, without needing additional VPC peering or VPN tunnels. Option B is correct because this inherent routing simplifies network connectivity and reduces administrative overhead.

Answer

Enhanced security through VPC Service Perimeters

Answer

Reduced IP address usage

Answer

Separation of network and application teams