PCNE Practice Test 29 — 15 Questions

Question 1

You need to distribute incoming TCP traffic to a set of Compute Engine instances in the same region while preserving the client IP address. The load balancer must be used for non-HTTP(S) workloads. Which load balancer should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Regional External TCP/UDP Network Load Balancer. The Regional External TCP/UDP Network Load Balancer is a Layer 4 (TCP/UDP) load balancer that distributes incoming traffic to Compute Engine instances in the same region while preserving the client IP address. It is designed for non-HTTP(S) workloads and supports external traffic. This matches the requirement of preserving client IP and handling TCP traffic regionally.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 2

A company wants to load balance TCP traffic (non-HTTP) across a group of Compute Engine instances in a single region, while preserving the client IP address. They also need to support session affinity based on client IP. Which load balancer should they choose?

Accepted Answer

External TCP/UDP Network Load Balancer. The External TCP/UDP Network Load Balancer is a regional, layer-4 load balancer that distributes TCP and UDP traffic across Compute Engine instances in a single region, preserves the client source IP, and supports session affinity based on client IP. It is designed exactly for non-HTTP(S) traffic requiring these features. The other load balancers either operate at layer 7, are global, or are internal-only.

Answer

Global SSL Proxy Load Balancer

Answer

Global TCP Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 3

A company has deployed a Cloud VPN tunnel using route-based VPN (using IKEv2) and has configured BGP on the tunnel. The tunnel is up, but the BGP session is not establishing. What is a likely cause?

Accepted Answer

The BGP IP addresses are not reachable over the tunnel. For a route-based Cloud VPN tunnel with BGP, the BGP session runs over the tunnel's internal IP addresses, so if those addresses are not reachable (e.g., wrong link-local or internal IP configuration, or missing firewall rules), the BGP session cannot establish even though IKE is up. This is the most likely cause when the tunnel is up but BGP is down.

Answer

IKE version mismatch

Answer

The pre-shared key is incorrect

Answer

The Cloud Router is not configured

Question 4

A network engineer is configuring a route-based VPN tunnel between an on-premises network and Google Cloud using Cloud VPN. Which two statements are true about route-based VPN compared to policy-based VPN? (Choose two.)

Accepted Answer

Route-based VPNs automatically route traffic based on the routing table entries.. Option A is correct because a route-based VPN (virtual tunnel interface) selects traffic by looking up the destination in the routing table rather than matching a policy, so any packet whose route points to the tunnel is encrypted and forwarded. Option C is correct because route-based VPNs can run dynamic routing protocols such as BGP over the tunnel, which is exactly how Cloud VPN (HA VPN) advertises on-premises and VPC routes and supports route exchange. Option B is wrong because route-based VPNs are generally more flexible, not less, since they do not need a policy per subnet pair and can carry any traffic the routing table directs into the tunnel. Option D is wrong because route-based VPNs do not require manually configured static routes; they commonly use dynamic routing (BGP) or learned routes, and static routes are only one optional method. Option E is wrong because route-based VPNs do not need a separate security policy for each traffic flow; traffic selection is handled by the routing table, not by per-flow policy objects.

Answer

Route-based VPNs are less flexible than policy-based VPNs for traffic selection.

Answer

Route-based VPNs require static routes to be configured manually.

Answer

Route-based VPNs require separate security policies for each traffic flow.

Question 5

A company has two VPCs (Production and Development) that are peered. The Development VPC has a custom route to an on-premises network via a VPN tunnel. They want the Production VPC to automatically learn this route. What must be configured on the VPC peering?

Accepted Answer

Enable 'export custom routes' on Development VPC and 'import custom routes' on Production VPC.. For a peered VPC to learn routes that originated in the peer VPC, the originating VPC must export its custom routes and the receiving VPC must import them. Here the Development VPC holds the VPN-learned on-premises route, so Development must export custom routes and Production must import custom routes. This is the standard GCP VPC peering route exchange model.

Answer

Enable 'export custom routes' on Production VPC and 'import custom routes' on Development VPC.

Answer

Enable 'import custom routes' on both VPCs.

Answer

Enable 'export custom routes' on both VPCs.

Question 6

A company is using Traffic Director with Envoy sidecars. They want to enable mutual TLS (mTLS) between services. Which two steps are required? (Choose two.)

Accepted Answer

Enable mTLS in Traffic Director configuration. Option A is correct because Traffic Director's mTLS feature must be explicitly enabled in the Traffic Director (service mesh) configuration so that the control plane programs the Envoy sidecars to use mutual TLS for service-to-service authentication. Option C is correct because the Envoy sidecars themselves must be configured with the appropriate certificates (via SDS or file-based secrets) so they can present and validate peer certificates during the mTLS handshake. Option B is incorrect because Traffic Director already provides the service mesh control plane; deploying Istio is not required. Option D is incorrect because a Global HTTPS Load Balancer handles external client traffic, not sidecar-to-sidecar mTLS. Option E is incorrect because Cloud DNS is for name resolution and is unrelated to enabling mTLS.

Answer

Deploy a service mesh with Istio

Answer

Use a Global HTTPS Load Balancer

Answer

Set up Cloud DNS

Question 7

An organization configures a Global external HTTP(S) Load Balancer with Cloud CDN. They notice that some users are getting stale content even after they have invalidated the cache for specific objects. What is the most likely reason?

Accepted Answer

Invalidation requests are queued and take time to propagate globally. When you invalidate cached content in Cloud CDN, the invalidation request is not instantaneous. It is queued and propagated to all edge locations globally, which can take some time. During this propagation window, some users may still receive stale content from edge caches that have not yet processed the invalidation. This is the most likely reason for the observed behavior.

Answer

The URL map is routing to the wrong backend

Answer

The objects were cached with a very long TTL

Answer

Cloud CDN does not support invalidation for backend buckets

Question 8

A company uses Cloud DNS private zones for their internal network. They have multiple projects and want to resolve DNS names from one project's private zone in another project. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows you to set up cross-project DNS resolution by peering a private zone in one project to a VPC in another project.

Answer

DNS forwarding

Answer

Shared VPC

Answer

VPC peering

Question 9

An engineer is configuring a Cloud Router for HA VPN. They need to enable BGP on the VPN tunnels. Which BGP configuration is required for the Cloud Router to advertise the VPC subnets to the on-premises network?

Accepted Answer

Create a custom route advertisement for each subnet. Cloud Router uses Border Gateway Protocol (BGP) to dynamically exchange routes with the on-premises network over HA VPN tunnels. By default, Cloud Router advertises only the VPC subnet ranges that are directly connected to the VPC network. To ensure all VPC subnets are advertised, you must create custom route advertisements for each subnet that needs to be reachable from on-premises. This is done by configuring the Cloud Router with a custom advertisement mode and specifying the subnet CIDR ranges as custom advertised IP ranges.

Answer

Set up a VPC peering connection

Answer

Use static routes on the VPN tunnel

Answer

Configure the VPN gateway to advertise the subnets

Question 10

An organization wants to prevent data exfiltration from a project that uses Google Cloud Storage and BigQuery. They need to restrict access to these services from only the authorized VPC networks. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls let you define a service perimeter around Google Cloud services such as Cloud Storage and BigQuery, restricting access so that only resources inside authorized VPC networks (or authorized identities) can reach those services. This directly addresses data exfiltration prevention by blocking access from outside the perimeter, even if IAM permissions would otherwise allow it.

Answer

Cloud NAT

Answer

Private Google Access

Answer

Cloud Armor

Question 11

You want to manage DNS records for a domain that you own in Google Cloud DNS. You create a public managed zone and add A records. After waiting several hours, the domain does not resolve. What is the most likely missing step?

Accepted Answer

Update the registrar's name servers to the Google Cloud DNS name servers.. Creating a public managed zone and adding A records in Google Cloud DNS does not make the domain resolvable on the internet until the domain's registrar is configured to delegate to Google Cloud DNS name servers. The registrar must be updated with the NS records (e.g., ns-cloud-a1.googledomains.com) that Google assigns to the managed zone. Until delegation is updated, resolvers query the registrar's default name servers, which know nothing about the new records.

Answer

Create a private zone for the domain.

Answer

Enable DNSSEC for the zone.

Answer

Set up DNS forwarding to Google's public DNS.

Question 12

A company uses a Shared VPC with a host project and multiple service projects. They have deployed Cloud NAT in the host project's network to provide internet access for service project instances. The Cloud NAT is configured to use a network tag 'nat'. Instances in service projects that have the tag 'nat' can reach the internet. A new service project is added and its instances are created with the same tag 'nat' in a subnet in europe-west1. However, these instances cannot reach the internet. Other service project instances with the tag 'nat' in us-central1 work fine. The Cloud NAT is deployed in us-central1. What is the most likely cause?

Accepted Answer

The Cloud NAT is not in the same region as the new service project's instances.. Cloud NAT is a regional resource; it only provides outbound internet access to instances within the same region. Since the Cloud NAT is deployed in us-central1, instances in europe-west1 cannot use it, regardless of their network tag. The instances in the new service project must have a Cloud NAT deployed in europe-west1 to reach the internet.

Answer

The Cloud NAT's UDP timeout is too short.

Answer

The firewall rules in the host project block traffic from the new service project's subnets.

Answer

The new service project's instances are not tagged with 'nat'.

Question 13

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

Accepted Answer

Add a new allow rule for that region with a lower priority number than the deny rule. Cloud Armor security rules are evaluated in order of priority, where a lower priority number means higher precedence. To allow traffic from a specific region that is currently blocked by a deny rule, you must add an allow rule with a lower priority number (e.g., 100) than the deny rule (e.g., 1000). This ensures the allow rule is evaluated first, permitting the legitimate traffic before the deny rule can block it, while the deny rule still protects against attacks from other regions.

Answer

Remove the deny rule for that region and rely on other security measures

Answer

Remove all rules and add a single allow rule for the legitimate region

Answer

Reorder the rules so that the deny rule is at the bottom of the list

Question 14

A startup is setting up their first GCP VPC. They want minimal manual configuration and need subnets in multiple regions. Which VPC creation mode should they use, and why?

Accepted Answer

Auto mode, because it automatically creates subnets in all regions with predefined IP ranges.. Auto mode VPC networks automatically create one subnet in each GCP region with predefined IP ranges (e.g., 10.128.0.0/20 for us-central1), requiring minimal manual configuration. This is ideal for startups or teams that need quick multi-region deployment without planning IP address spaces. The predefined ranges are non-overlapping and sized appropriately for most workloads, simplifying initial setup.

Answer

Auto mode, because it allows overlapping IP ranges with on-premises networks.

Answer

Custom mode, because it is the only mode that supports Shared VPC.

Answer

Custom mode, because it provides full control over IP ranges.

Question 15

An organization wants to connect two VPCs in different projects so that they can communicate using private IPs. The connection must not be transitive. Which solution meets these requirements?

Accepted Answer

VPC Network Peering. VPC Network Peering connects two VPCs (in the same or different projects) using private RFC 1918 IPs, and by design it is non-transitive — if VPC A peers with B and B peers with C, A cannot reach C through B. This exactly matches the requirement. Shared VPC, by contrast, is a resource-sharing model, not a peering connection, and Cloud VPN/Interconnect are for hybrid connectivity.

Answer

Cloud Interconnect

Answer

Shared VPC

Answer

Cloud VPN