PCNE Practice Test 3 — 10 Questions

Question 1

A startup needs to connect its on-premises office network to a Google Cloud VPC. They require a cost-effective solution with minimal setup and can tolerate up to 3 Gbps throughput per tunnel. They also need dynamic routing. What should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud VPN with HA VPN and Cloud Router. HA VPN with Cloud Router provides dynamic routing via BGP and supports up to 3 Gbps per tunnel. It is cost-effective, requires minimal setup compared to Interconnect options, and meets the need for a reliable, dynamically routed connection from an on-premises network to a VPC.

Answer

Cloud VPN with Classic VPN and static routing

Answer

Partner Interconnect with a 1 Gbps circuit

Answer

Dedicated Interconnect with a 10 Gbps circuit

Question 2

A retail company is deploying a new application that must be accessible globally with a single anycast IP address. The application runs on managed instance groups in three regions: us-central1, europe-west1, and asia-east1. The company wants to minimize latency for users and ensure automatic failover if a region becomes unavailable. They also need to terminate SSL certificates at the Google edge. Which load balancing solution should they use?

Accepted Answer

Global external HTTP(S) load balancer with a global anycast IP address and Google-managed SSL certificates.. A global external HTTP(S) load balancer is the correct choice because it provides a single anycast IP, global load balancing, Google-managed SSL certificates, and automatic failover across regions. It is designed for HTTP(S) workloads that require low latency and high availability. The other options either lack anycast, are regional, or do not support external HTTP(S) traffic with SSL termination.

Answer

Internal HTTP(S) load balancer with a global anycast IP address and Google-managed SSL certificates.

Answer

Regional external HTTP(S) load balancer in each region with separate IP addresses and self-managed SSL certificates.

Answer

Global external TCP proxy load balancer with a global anycast IP address and Google-managed SSL certificates.

Question 3

A company has a VPC with multiple subnets and uses Cloud VPN tunnels to connect to on-premises. They want to ensure that only traffic destined for on-premises is sent through the VPN tunnels; all other traffic should use the internet. Which route configuration should they implement?

Accepted Answer

Use Cloud Router with BGP to exchange specific routes with on-premises, and keep the default internet route for other traffic.. Using Cloud Router with BGP allows the VPC to dynamically learn specific routes from the on-premises network via the VPN tunnels. The default route (0.0.0.0/0) remains pointing to the internet gateway, so only traffic destined for the learned on-premises prefixes is sent through the VPN, while all other traffic uses the internet. This provides precise control without overriding the default route.

Answer

Add a static route for 0.0.0.0/0 with next hop VPN gateway, and set a lower priority than the internet default route.

Answer

Configure the Cloud VPN to advertise a default route to on-premises, and rely on local preference.

Answer

Use VPC Network Peering with the on-premises network and configure custom route exchange.

Question 4

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

Accepted Answer

Pre-configured WAF rules. Pre-configured WAF rules in Cloud Armor include a SQL injection (SQLi) rule that inspects HTTP(S) request bodies, headers, and URIs for SQL injection patterns. This rule uses a set of signatures to detect and block malicious SQL queries, directly addressing the requirement to protect against SQL injection attacks on an external HTTP(S) load balancer.

Answer

IP allowlist/denylist

Answer

Named IP address lists

Answer

Rate limiting

Question 5

A startup is setting up a new GCP project and needs to create a VPC that will have predictable IP ranges for future peering with other VPCs. They do not anticipate needing to grow the network beyond the initial IP range. Which VPC type should they choose?

Accepted Answer

Custom mode VPC. Custom mode VPCs allow you to define your own subnets with specific IP ranges. Auto mode VPCs automatically create subnets in every region, which can cause IP overlap when peering. For controlled, predictable IP ranges, custom mode is appropriate.

Answer

Auto mode VPC

Answer

Shared VPC

Answer

Legacy network

Question 6

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. Option A is correct because Network Connectivity Center uses a hub-and-spoke model in which the hub dynamically exchanges and propagates routes between all attached spokes, so VPC spokes and hybrid spokes learn each other's reachable prefixes without manual route configuration. Option E is correct because NCC spokes can be VPC networks from different Google Cloud projects, allowing cross-project connectivity through a single hub as long as the appropriate IAM permissions and spoke attachments are configured. Option B is incorrect because NCC is a hub-and-spoke transit solution, not a direct VPC-to-VPC peering mechanism; VPC peering is a separate feature that does not involve an NCC hub. Option C is incorrect because NCC hybrid spokes can use HA VPN, Cloud Interconnect (Dedicated or Partner), and other supported connectivity methods, not only Dedicated Interconnect. Option D is incorrect because NCC spokes can be in different regions; the hub-and-spoke topology is global and does not require all spokes to share a region.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.

Question 7

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the return route via BGP, causing asymmetric routing.. The symptom — traffic reaches on-premises but return traffic is dropped — is the classic signature of asymmetric routing. If the on-premises router doesn't advertise the 10.0.0.0/… prefix back through BGP over the Cloud VPN, it has no route for the return path and either drops the packet or sends it out a different interface. The Cloud VPN tunnel itself is up (traffic is flowing one way), so the issue is route propagation, not tunnel state.

Answer

The Cloud VPN tunnel is down.

Answer

The MTU is set to 1500 on the VPN tunnel.

Answer

The instance's firewall is blocking ICMP.

Question 8

Match each network troubleshooting command/tool to its function.

Accepted Answer

ping: Tests reachability of a host and measures round-trip time. Common network troubleshooting tools: ping tests connectivity, traceroute maps the route, nslookup resolves DNS, netstat shows connections. The distractors swap ping and traceroute functions.

Answer

ping: Displays network connections and routing tables

Answer

traceroute: Tests reachability and measures round-trip time

Question 9

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

Accepted Answer

DNS peering. DNS peering in Cloud DNS allows a VPC network to resolve records from a managed zone in another project without transferring ownership of the zone. The consumer VPC creates a peering zone that points to the producer's managed zone, enabling cross-project name resolution while the producer retains full control of the zone. This is the intended feature for centralized DNS architectures where zone ownership must remain with the owning project.

Answer

DNS forwarding (inbound)

Answer

Managed zone with cross-project binding

Answer

Global DNS configuration

Question 10

A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?

Accepted Answer

IAM conditions on the bucket. VPC Service Controls can restrict access to Google APIs to only specified VPCs and projects, creating a service perimeter. IAM conditions can further restrict access based on the caller's service account. This combination ensures that only instances with the correct service account in the correct VPC can access the bucket.

Answer

Hierarchical firewall policy

Answer

Cloud Armor

Answer

Cloud NAT