PCNE Practice Test 29 — 15 Questions

Question 1

A company has two VPC networks connected via VPC Network Peering. They observe asymmetric routing causing connectivity issues. Which configuration is most likely to be the root cause?

Accepted Answer

One VPC has a static route pointing to the peering connection, and the other has a static route pointing to a VPN tunnel.. Asymmetric routing in VPC peering often occurs when both sides have overlapping or conflicting routes, such as custom static routes that point to different next hops. VPC peering requires symmetric routing.

Answer

One VPC has a custom route for 0.0.0.0/0 pointing to a NAT gateway.

Answer

Dynamic routing mode is set to regional on both sides.

Answer

Both VPCs have default internet gateways.

Question 2

An engineer needs to verify that a Compute Engine instance can reach a specific IP address on the internet, considering firewall rules and routes. Which Network Intelligence Center tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests allow you to test reachability between a source and a destination, checking firewall rules, routes, and VPC peering configurations.

Answer

Performance Dashboard

Answer

Firewall Insights

Answer

Network Topology

Question 3

A company is experiencing periodic packet loss between two Compute Engine instances in the same region but different zones. They have enabled VPC Flow Logs and see that the flows are marked with 'RTT' latency. Which THREE actions should they take to diagnose the issue? (Choose three.)

Accepted Answer

Check the Performance Dashboard for packet loss between the two zones. VPC Flow Logs provide RTT latency for TCP flows. Analyzing the RTT values can indicate congestion. Checking the Performance Dashboard can show packet loss between zones. Checking instance CPU metrics can reveal if one instance is overwhelmed. Checking firewall rules is less likely to cause intermittent loss; firewall rules either block or allow. Checking BGP sessions is irrelevant for intra-region traffic.

Answer

Verify that the firewall rules are not blocking ICMP

Answer

Check BGP session status on the Cloud Router

Question 4

A company has a VPC with 200 custom routes and wants to set up VPC peering with another VPC. The VPC peering quota limits the number of routes per VPC. What should the engineer do to avoid hitting the quota?

Accepted Answer

Request a VPC route quota increase. VPC quota for routes per VPC is 200 by default. To exceed this, a quota increase request must be submitted to Google Cloud Support.

Answer

Use subnet routes instead of custom routes

Answer

Delete unused routes

Answer

Use a shared VPC to consolidate routes

Question 5

A network engineer is troubleshooting high latency between two VM instances in different GCP regions. Which TWO tools can help identify packet loss and latency issues? (Choose TWO.)

Accepted Answer

Performance Dashboard. Performance Dashboard shows latency and packet loss between regions. Connectivity Tests can also report latency and packet loss along the path.

Answer

VPC Flow Logs

Answer

Network Topology

Answer

Firewall Insights

Question 6

An organization has a VPC with several subnets and wants to monitor firewall rule usage to identify rules that are overly permissive (e.g., allowing all traffic from 0.0.0.0/0). Which Google Cloud service provides this insight?

Accepted Answer

Firewall Insights. Firewall Insights in Network Intelligence Center provides analytics on firewall rules, including overly permissive rules and shadowed rules.

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Answer

Cloud Logging

Question 7

A company is hitting the quota for number of firewall rules per VPC network. They need to add more rules without requesting a quota increase. Which approach can reduce the number of rules?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules can be consolidated using service accounts or tags. By grouping instances with tags and applying rules to those tags, you can reduce the number of rules. Also, hierarchical firewall policies (at folder or org level) have separate quotas and can offload rules from VPC-level quotas.

Answer

Convert all deny rules to allow rules

Answer

Use Cloud Firewall to manage rules

Answer

Delete unused subnets

Question 8

Drag and drop the steps to configure Cloud Router with BGP for on-premises connectivity into the correct order.

Accepted Answer

1. Create a Cloud Router, 2. Create a VPN tunnel, 3. Configure BGP session, 4. Configure custom route advertisements, 5. Verify connectivity. Cloud Router requires a router first, then a tunnel, followed by BGP configuration. Custom advertisements and verification complete the setup.

Answer

1. Create a VPN tunnel, 2. Create a Cloud Router, 3. Configure BGP session, 4. Configure custom route advertisements, 5. Verify connectivity

Answer

1. Create a Cloud Router, 2. Configure BGP session, 3. Create a VPN tunnel, 4. Configure custom route advertisements, 5. Verify connectivity

Answer

1. Create a Cloud Router, 2. Create a VPN tunnel, 3. Configure custom route advertisements, 4. Configure BGP session, 5. Verify connectivity

Question 9

A company is using Cloud Router with BGP for connectivity to an on-premises network via Partner Interconnect. The BGP session is flapping. Which THREE actions should the engineer take to diagnose the issue?

Accepted Answer

Verify BGP timers (keepalive/hold) match on both sides. Common causes of BGP flaps include MTU mismatch, misconfigured timers, or routing policy issues. Checking MTU, BGP timers, and route advertisements helps identify the root cause.

Answer

Disable ECMP on Cloud Router

Answer

Enable VPC Flow Logs on the interconnect subnet

Question 10

A company wants to connect on-premise to GCP via Cloud VPN with dynamic routing. They have two on-prem routers for redundancy. Which configuration ensures automatic failover?

Accepted Answer

Create two VPN tunnels using Cloud Router with BGP and the same ASN. Creating two VPN tunnels with Cloud Router using BGP and the same ASN on both on-prem routers enables dynamic routing and automatic failover. Cloud Router establishes BGP sessions with each on-prem router, and when both tunnels advertise the same routes with the same ASN, Cloud Router can detect a BGP session failure and automatically route traffic through the remaining healthy tunnel. This setup ensures seamless failover without manual intervention.

Answer

Create two VPN tunnels each with static routes pointing to the other router

Answer

Create one VPN tunnel with BGP and two interfaces

Answer

Create two VPN tunnels with BGP but different ASNs on each tunnel

Question 11

An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?

Accepted Answer

The firewall rules have a source or destination filter that excludes the new subnet's CIDR.. In Google Cloud, firewall rules can include source or destination IP range filters. Even if target tags match, if the rule also specifies a source or destination range that does not include the new subnet's CIDR (192.168.1.0/24), the rule will not apply to instances in that subnet. Option A is incorrect because although firewall rules are scoped to the VPC, that does not explain the issue; the rules still apply to all subnets, but specific IP range filters can limit applicability. Option B is incorrect because there is no concept of 'firewall rule enforcement' on subnets. Option C is incorrect because firewall rule changes apply immediately; instances do not need to be recreated.

Answer

Firewall rules are scoped to a VPC, not to subnets.

Answer

The new subnet was created without enabling firewall rule enforcement.

Answer

The instances need to be recreated for the new rules to apply.

Question 12

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They have deployed Compute Engine instances that need to communicate with an on-premises database via a Cloud VPN tunnel using BGP. The on-premises network advertises the database subnet 192.168.0.0/16. The instances can reach the database for a few minutes after reboot, but then connectivity drops. The Cloud VPN logs show no errors. The BGP session remains established. What is the most likely issue?

Accepted Answer

The on-premises firewall has an idle timeout that kills the TCP session.. The on-premises firewall is likely configured with an idle timeout that terminates TCP sessions when no traffic is exchanged for a certain period. After the instances reboot, they initiate new connections that work briefly, but once the session becomes idle (e.g., no keepalives or application traffic), the firewall drops the stateful session, causing connectivity loss. The Cloud VPN and BGP session remain up, indicating the issue is at the application or firewall layer, not the tunnel or routing.

Answer

The GCP route to the on-premises database is being preempted by a more specific route.

Answer

The VPN tunnel's IKE session expires.

Answer

The BGP session is flapping.

Question 13

A company uses Cloud NAT to allow private instances to reach the internet. They notice that egress traffic from Compute Engine VMs is intermittently failing. The VMs are in us-central1-a and use the default VPC network. Cloud NAT is configured with a single NAT IP address. What is the most likely cause?

Accepted Answer

Port exhaustion due to insufficient NAT IP addresses. Cloud NAT uses source network address translation (SNAT) to map private VM IPs to a public NAT IP. With only a single NAT IP address, the available port range (typically 64,512 ephemeral ports per NAT IP per VM) can be exhausted under high egress traffic, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures and the single IP configuration.

Answer

Missing default route to Internet gateway

Answer

Cloud NAT not configured in the correct region

Answer

Firewall rule blocking egress traffic from VM

Question 14

A company is designing a hybrid connectivity solution between an on-premises data center and Google Cloud. They have a high bandwidth requirement of 20 Gbps and need a service level agreement (SLA) of 99.99% availability. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect with two 10 Gbps connections. Dedicated Interconnect provides direct, private connections between your on-premises network and Google Cloud, supporting up to 10 Gbps per circuit. By using two 10 Gbps connections in an active-active or active-passive configuration, you can achieve the required 20 Gbps aggregate bandwidth and meet the 99.99% SLA, as Google guarantees this SLA when you have at least two redundant connections.

Answer

Cloud VPN with two tunnels each using 1 Gbps

Answer

Direct Peering

Answer

Partner Interconnect with two 10 Gbps connections

Question 15

A company has two VPC networks connected via VPC Network Peering. They observe asymmetric routing causing connectivity issues. Which configuration is most likely to be the root cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Both VPCs have a default route (0.0.0.0/0) pointing to different next hops. VPC peering does not enforce symmetric routing by default. If both networks have subnet CIDRs that overlap, or if one network has a route that sends traffic to the other via a different next hop (e.g., VPN or NAT), asymmetric routing can occur. The most common cause is when both VPCs have a default route pointing to different next hops (e.g., one to the internet, one to a VPN), causing different paths.

Answer

The peering connection is in an inactive state

Answer

The firewall rules in Network A are more permissive than in Network B

Answer

There is a Cloud NAT configured in Network A but not in Network B