PCNE Practice Test 30 — 15 Questions

Question 1

An engineer is deploying a Regional External HTTP(S) Load Balancer to serve a web application on Compute Engine. They want to maintain the highest availability by automatically rerouting traffic away from unhealthy instances. Which additional configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a health check on the backend service. A health check is required on the backend service so the load balancer can probe instance health and automatically stop sending traffic to unhealthy instances. Without a health check, the load balancer cannot detect failures and will continue routing to unhealthy backends. Health checks are the mechanism that enables automatic failover and high availability.

Answer

Enable connection draining on the backend service

Answer

Use a global load balancer instead

Answer

Set up a managed instance group with autoscaling

Question 2

Refer to the exhibit. A Cloud Router has two BGP sessions. The first session is UP, the second is DOWN. What is the most likely cause for the second session being down?

Accepted Answer

The session initialization mode is set to PASSIVE.. The second session has sessionInitializationMode set to PASSIVE. If the peer router is also configured as PASSIVE, the BGP session will never establish. The first session is ACTIVE, so it came up. This is a common misconfiguration.

Answer

The advertised route priority is too low.

Answer

The peer IP address 169.254.1.2 is not routable.

Answer

The BFD multiplier is too low (3).

Question 3

Which TWO of the following are required steps to set up a Dedicated Interconnect?

Accepted Answer

Create an interconnect (physical connection) in the colocation facility. Option A is correct because setting up a Dedicated Interconnect begins with provisioning the physical interconnect in a colocation facility where Google has a point of presence, which is the actual dedicated circuit between your on-premises network and Google's edge. Option C is correct because after the physical connection exists, you must create a Cloud Router and a VLAN attachment (the interconnect attachment) to establish the logical link and enable dynamic BGP route exchange between your network and Google Cloud. Option B is not required — a VPN backup is an optional redundancy design, not a mandatory setup step. Option D is incorrect because Google does not deploy a router in your colocation cage; you provide your own router that peers with Google's edge via BGP. Option E is incorrect because MD5 authentication on BGP is optional and not a required step to bring up a Dedicated Interconnect.

Answer

Establish a VPN tunnel as a backup

Answer

Deploy a Google-provided router in the colocation facility

Answer

Configure MD5 authentication on the BGP session

Question 4

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

Accepted Answer

One VPC has a more specific route that overrides the peering route. In VPC peering, each VPC's local routes are used to reach the peer, but if one VPC has a more specific route (longer prefix match) that also matches the destination — such as a static route or a route learned via VPN/Interconnect — that route takes precedence over the peering route. This causes outbound traffic to leave via the more specific path while return traffic comes back over the peering link, producing asymmetric routing.

Answer

VPC Flow Logs are not enabled

Answer

The MTU is mismatched between the VPCs

Answer

Firewall rules are blocking the return traffic

Question 5

An organization is connecting their on-premises data center to Google Cloud via Partner Interconnect. The partner offers both Layer 2 and Layer 3 connectivity options. The organization wants to manage their own BGP sessions and IP addressing. Which connectivity option should they choose?

Accepted Answer

Layer 2 connectivity. With Layer 2, the service provider delivers a transparent VLAN, and the customer manages the BGP session with Google Cloud Router. Layer 3 would mean the partner manages the routing, which is not desired here.

Answer

Any Layer option because they can manage BGP regardless

Answer

Neither; they must use Dedicated Interconnect

Answer

Layer 3 connectivity

Question 6

An organization wants to restrict which Google APIs can be accessed by resources in a specific VPC. They also want to prevent data exfiltration to unauthorized projects. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that restrict API access and prevent data exfiltration based on projects and VPCs.

Answer

Cloud Armor

Answer

Private Google Access

Answer

Firewall Rules

Question 7

A company is designing a highly available hybrid network using HA VPN. They need to ensure that if one VPN tunnel fails, traffic automatically fails over to the other tunnel. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable BGP on both tunnels. Option B is correct because Cloud HA VPN relies on BGP (Border Gateway Protocol) to dynamically exchange routes between the Cloud Router and the on-premises router; when a tunnel fails, BGP withdraws its routes and the surviving tunnel's routes are used, enabling automatic failover without manual intervention. Option E is correct because a highly available HA VPN topology requires two tunnels terminating on two different interfaces (each with its own external IP) of the HA VPN gateway, so that the failure of one interface or tunnel does not take down all connectivity. Option A is incorrect because static routes do not provide dynamic failover in HA VPN; they lack the health-based route withdrawal that BGP offers. Option C is incorrect because each tunnel must terminate on a distinct peer IP address on the on-premises side to provide redundancy; using the same peer IP would defeat the purpose of separate tunnels. Option D is incorrect because pre-shared keys are per-tunnel IKE credentials and do not need to be identical; matching PSKs do not enable failover.

Answer

Configure static routes for failover

Answer

Configure both tunnels with the same peer IP address on the on-premises side

Answer

Use the same pre-shared key for both tunnels

Question 8

Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?

Accepted Answer

Enable Private Google Access on the subnet.. A VM without an external IP cannot reach Google APIs because it lacks a path to the internet. Enabling Private Google Access on the subnet allows VMs to reach Google APIs and services using internal IP addresses, without needing an external IP or Cloud NAT. This is the correct configuration.

Answer

Create a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Add a default route to the internet gateway.

Question 9

An organization wants to connect their on-premises network to Google Cloud using Partner Interconnect. Which of the following is a requirement that must be met before the partner can provision the connection?

Accepted Answer

The organization must have a VLAN attachment created and share the pairing key.. Partner Interconnect requires the customer to create a VLAN attachment in their Google Cloud project and share the generated pairing key with the service provider. The partner uses this key to provision the connection on their side, ensuring the correct mapping to the customer's VPC. Without the VLAN attachment and pairing key, the partner cannot establish the Layer 2 circuit.

Answer

The organization must purchase a cross-connect at a colocation facility.

Answer

The organization must have a Dedicated Interconnect connection already set up.

Answer

The organization must have a Cloud Router configured with BGP sessions.

Question 10

A company uses an external HTTP Load Balancer with Cloud Armor. They want to log all requests that are blocked by Cloud Armor security policies for compliance auditing. What should they enable?

Accepted Answer

Cloud Armor request logs. Cloud Armor request logs capture details about requests that are allowed or blocked by security policies. Enabling these logs provides the required auditing.

Answer

VPC Flow Logs

Answer

Load balancer access logs

Answer

Firewall rule logging

Question 11

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have already ordered a cross-connect from their co-location facility to a Google Point of Presence (PoP). What is the NEXT step to establish the connection?

Accepted Answer

Create a VLAN attachment in Google Cloud. After the physical cross-connect to the Google PoP is ordered, the next logical step in the Dedicated Interconnect workflow is to create a VLAN attachment in Google Cloud, which binds the interconnect to a Cloud Router in the VPC. The VLAN attachment is what actually establishes the logical link over the physical circuit. Only after the attachment exists can BGP sessions be configured and verified.

Answer

Create a Cloud Router and BGP session

Answer

Run a ping test to verify connectivity

Answer

Configure BGP on the on-premises router

Question 12

An organization needs to prevent exfiltration of data from a Cloud Storage bucket to external IPs. The bucket is accessed by Compute Engine instances in a VPC. The instances need to read and write data to the bucket but should not be able to copy data to external networks. Which combination of controls meets this requirement?

Accepted Answer

Configure VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. VPC Service Controls with a service perimeter that includes both the VPC network and the Cloud Storage bucket creates a security boundary that prevents data exfiltration to external IPs. It enforces that access to the bucket is only allowed from within the perimeter, and any attempt to copy data outside the perimeter is blocked. This directly addresses the requirement to prevent exfiltration while allowing internal instances to read and write.

Answer

Use Cloud Armor with a WAF rule to block outbound traffic.

Answer

Set up Private Google Access and restrict IAM permissions to the bucket.

Answer

Use Cloud NAT with a firewall rule that denies all egress except to Google APIs.

Question 13

An engineer is configuring a Global HTTPS Load Balancer with a backend service that points to a serverless NEG for Cloud Functions. The health checks are failing. What is the most likely cause?

Accepted Answer

Serverless NEGs do not support health checks. Serverless NEGs do not support health checks. The load balancer relies on the underlying Cloud Functions being healthy. Health checks must be disabled for serverless backends.

Answer

The health check path is incorrect

Answer

The backend service is not associated with the correct URL map

Answer

The health check protocol is set to HTTP instead of HTTPS

Question 14

A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?

Accepted Answer

Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'. It defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.

Answer

Ingress rule: allow tcp:3306, source IP range 10.0.0.0/8, target tags 'db'

Answer

Ingress rule: allow tcp:3306, source tags 'web', target service account 'db-sa'

Answer

Egress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'

Question 15

You need to create a load balancer that distributes traffic across Compute Engine instances in multiple regions for a TCP application without SSL offload. The clients should connect to a single anycast IP. Which load balancer should you use?

Accepted Answer

Global external TCP Proxy Load Balancer. The Global external TCP Proxy Load Balancer is the correct choice because it provides a single global anycast IP address that clients connect to, and it proxies TCP traffic (without SSL offload) to backend instances distributed across multiple regions. It operates at Layer 4 but terminates TCP connections at the proxy, enabling global load balancing with automatic cross-region failover. Unlike the External TCP/UDP Network Load Balancer, it supports a global anycast IP rather than regional IPs.

Answer

External TCP/UDP Network Load Balancer

Answer

Global external SSL Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer