PCNE Practice Test 30 — 15 Questions

Question 1

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

Accepted Answer

Use Cloud NAT to allow outbound internet access without public IPs. Cloud NAT enables outbound internet access for private VMs without assigning them public IP addresses, which reduces the attack surface. This is a secure alternative to direct internet access because it allows outbound connections initiated by the VMs while blocking unsolicited inbound traffic from the internet. It works by translating private IP addresses to a set of ephemeral public IPs managed by Google Cloud.

Answer

Assign public IP addresses to all VMs for direct internet access

Answer

Enable VPC Flow Logs to block malicious traffic

Question 2

A team is deploying a new service in a Compute Engine instance without an external IP in subnet-b. The service needs to access Google Cloud Storage using internal IPs. What must the team do to enable this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a Compute Engine instance without an external IP address to reach Google APIs and services (including Cloud Storage) over the internal VPC network using RFC 1918 addresses. By enabling this feature on subnet-b, the instance can access Cloud Storage via internal IPs without needing an external IP or NAT gateway. This is the correct and minimal configuration for the requirement.

Answer

Assign an external IP address to the instance.

Answer

Move the instance to subnet-a where Private Google Access is already enabled.

Answer

Set up Cloud NAT on the VPC to allow outbound access to Google APIs.

Question 3

A company wants to connect their VPC to an on-premises network using Cloud VPN. They need to ensure that traffic from Google Cloud to on-premises uses a specific route only when the primary path is available, and otherwise fails over to a backup path. Which configuration should they use?

Accepted Answer

Configure BGP on Cloud Router and advertise custom routes with appropriate metrics. Cloud VPN with dynamic routing (BGP) allows you to control path selection by advertising custom routes with different metrics (MED values) for the primary and backup paths. When the primary path is available, the lower metric route is preferred; if the BGP session fails, the route is withdrawn and traffic automatically fails over to the backup path with a higher metric. This meets the requirement for active/passive failover without manual intervention.

Answer

Configure Cloud NAT to route traffic through the backup path

Answer

Use static routes with a higher priority for the primary path

Answer

Create firewall rules to allow failover traffic

Question 4

A large enterprise has a Google Cloud environment with multiple projects under an organization. They have a Shared VPC host project with a VPC named 'shared-vpc' that has subnets in us-central1 and europe-west1. Several service projects are attached to this host project. One service project, 'proj-analytics', has a Compute Engine instance 'vm-analytics' in us-central1 that needs to connect to a Cloud SQL PostgreSQL instance (private IP) also in us-central1, but within a different service project 'proj-db'. The Cloud SQL instance is configured with a private IP address 10.0.1.5 from a subnet in 'shared-vpc' (the same VPC). The vm-analytics instance has an internal IP 10.0.0.5 from a different subnet in 'shared-vpc'. The two subnets are in the same region, and there is a firewall rule allowing all traffic from 10.0.0.0/16 (the entire VPC range) to the Cloud SQL subnet. However, vm-analytics cannot connect to the Cloud SQL instance. The error on vm-analytics is 'Connection timed out'. There are no firewall rules blocking egress from vm-analytics. What is the most likely cause and solution?

Accepted Answer

Grant the service project's compute engine default service account the Compute Network User role on the host project.. The most likely cause is that the service project's Compute Engine default service account lacks the necessary IAM permissions to use the Shared VPC network resources. The Cloud SQL instance with a private IP is accessible via the Shared VPC, but the service project's instances need the Compute Network User role on the host project to allow them to use the VPC network and its subnets. Without this role, the traffic from vm-analytics cannot reach the Cloud SQL private IP, resulting in a timeout. Option A is correct because granting the Compute Network User role to the service project's default compute service account enables the necessary network access. Option B is incorrect because Private Google Access is for accessing Google APIs without external IPs, not for Cloud SQL private connectivity. Option C is unnecessary because firewall rules already allow traffic from the entire VPC range to the Cloud SQL subnet. Option D is incorrect because Cloud Router is used for hybrid connectivity and dynamic routing, but the issue is IAM, not routing.

Answer

Enable Private Google Access on the vm-analytics subnet.

Answer

Create a firewall rule in the host project allowing ingress from the service project's subnets to the Cloud SQL subnet.

Answer

Configure a Cloud Router in the service project to advertise routes to the Cloud SQL subnet.

Question 5

An organization has a Dedicated Interconnect with one VLAN attachment. They want to add a second VLAN attachment on the same interconnect circuit for additional capacity. What is the correct approach?

Accepted Answer

Create a second VLAN attachment with a different VLAN ID. A single Dedicated Interconnect circuit can have multiple VLAN attachments (up to 8 for 10 Gbps, up to 64 for 100 Gbps). You simply create another VLAN attachment on the same interconnect, using a different VLAN ID and a different Cloud Router if desired.

Answer

Order a second physical cross-connect

Answer

Upgrade the existing VLAN attachment to increase bandwidth

Answer

Create a new Cloud Router and associate it with the existing VLAN attachment

Question 6

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Accepted Answer

Place both instances in the same VPC, using internal IP addresses.. Placing both Compute Engine instances in the same VPC and using internal IP addresses ensures traffic stays within Google's private network backbone, bypassing any external gateways or internet hops. This configuration leverages Google's internal routing with sub-millisecond latency between zones in the same region, as traffic is forwarded at the hypervisor level without encapsulation or additional network hops.

Answer

Use VPC Network Peering between two different VPCs.

Answer

Place instances in different VPCs and use a VPN between them.

Answer

Assign external IP addresses to both instances and communicate over the internet.

Question 7

Refer to the exhibit. A VM in the default VPC with tag 'internal' and IP 10.128.1.2 is unable to communicate with another VM with IP 10.132.0.3 and tag 'internal'. What is the most likely cause?

Accepted Answer

The source range 10.128.0.0/14 does not include 10.132.0.3.. The firewall rule shown allows ingress traffic from source range 10.128.0.0/14, which covers IP addresses from 10.128.0.0 to 10.131.255.255. The destination VM with IP 10.132.0.3 is outside this range (10.132.0.3 is in 10.132.0.0/16, not within 10.128.0.0/14). Therefore, traffic from the source VM (10.128.1.2) to the destination VM (10.132.0.3) is blocked because the destination IP is not allowed by the rule's source range. Option D correctly identifies this. Option A is incorrect because the rule direction is ingress, which is correct for receiving traffic; the issue is the source range. Option B is incorrect because even though ICMP may be used, the fundamental problem is the IP range mismatch. Option C is incorrect because priority 1000 is valid and does not cause blocking.

Answer

The rule only applies to ingress traffic.

Answer

The rule only allows TCP and UDP, not ICMP.

Answer

The rule priority is too low.

Question 8

Refer to the exhibit. A DNS managed zone is configured with private visibility and associated with a VPC network. A Compute Engine instance in a different VPC network tries to resolve 'test.example.com' but fails. What is the most likely reason?

Accepted Answer

The instance's VPC is not in the list of authorized networks.. Private zones only respond to queries from authorized VPC networks. The instance is in a different VPC, so resolution fails.

Answer

The zone is not set as authoritative for example.com.

Answer

The Cloud DNS name servers are not reachable from the instance.

Answer

The instance does not have the required IAM permissions.

Question 9

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They notice that traffic from Google Cloud to on-premises is not using the VPN tunnel but instead going through the internet. They have verified that the VPN tunnel is up and BGP sessions are established. Which configuration issue is most likely causing this behavior?

Accepted Answer

The on-premises router is not advertising the on-premises CIDR via BGP. If the on-premises router does not advertise the on-premises CIDR via BGP, the Cloud Router will not have a route to that network in its routing table. Even though the VPN tunnel is up and BGP sessions are established, without the specific prefix being advertised, Google Cloud will use its default route (0.0.0.0/0) to send traffic to on-premises over the internet instead of through the VPN tunnel.

Answer

The Cloud Router BGP IP address is misconfigured

Answer

The pre-shared key for the VPN tunnel is mismatched

Answer

The on-premises BGP ASN is incorrect

Question 10

A company is using Cloud DNS for private zone resolution within their VPC. They have a private zone for 'example.internal' and have attached it to the VPC. When they create a new Compute Engine VM and try to resolve 'myapp.example.internal', it fails. What is the most likely cause?

Accepted Answer

The record 'myapp.example.internal' does not exist in the zone. The most likely cause of a resolution failure for a specific record is that the record does not exist in the private zone. The question states the zone is attached to the VPC, so the zone itself is accessible; the failure is specific to the record name. Cloud DNS will return an NXDOMAIN response if the record is not defined, even if the zone is properly configured.

Answer

The private zone is not attached to the VPC

Answer

The VM's /etc/resolv.conf does not point to Cloud DNS

Answer

Firewall rule blocking DNS traffic (UDP 53) to the metadata server

Question 11

An organization wants to implement a hub-and-spoke network topology in Google Cloud using VPC Network Peering. The hub VPC hosts shared services and the spoke VPCs host application workloads. They need to ensure that spokes can communicate with each other through the hub. Which additional configuration is required?

Accepted Answer

Configure a managed VPN between the hub and each spoke, and enable dynamic routing. VPC Network Peering does not support transitive routing by default. To enable spoke-to-spoke communication through the hub, you must configure a managed VPN (Cloud VPN) between the hub and each spoke with dynamic routing (BGP). This creates a routed overlay that allows the hub to forward traffic between spokes, effectively achieving transitive routing.

Answer

Enable 'Export custom routes' on the hub VPC and 'Import custom routes' on the spoke VPCs

Answer

Use a shared VPC instead of VPC Network Peering

Answer

Create a peering connection between each pair of spokes

Question 12

A company uses Cloud NAT to allow private VMs to access the internet. They notice that some VMs are unable to reach a specific set of external IP addresses, but other VMs can. The firewall rules are correctly configured. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway uses a static IP address that is not allowed by the external service's firewall.. Cloud NAT uses a source IP address (either a static IP you assign or an ephemeral IP from the NAT gateway's IP range) when translating outbound traffic from private VMs. If the external service's firewall only allows traffic from specific IP addresses, and the Cloud NAT gateway is using a static IP that is not on that allowlist, the affected VMs' traffic will be blocked. Other VMs might reach the service if they use a different NAT gateway or if the service's firewall permits their translated IP.

Answer

The default route (0.0.0.0/0) is missing for the VPC.

Answer

The VPC firewall rules have a deny rule for the source IP range of the affected VMs.

Answer

The VMs have a tag that overrides the Cloud NAT routing.

Question 13

A company is planning to migrate to Google Cloud and needs to design a VPC network for a multi-tier application (web, app, database). Which THREE best practices should they follow? (Choose THREE.)

Accepted Answer

Create separate subnets for each tier and use firewall rules to control traffic between them.. Separating each application tier into its own subnet allows you to apply VPC firewall rules to control ingress and egress traffic between tiers based on source and destination CIDR ranges or service accounts. This follows the principle of least privilege, ensuring that only necessary traffic (e.g., web-to-app on TCP port 8080, app-to-database on TCP port 3306) is permitted, while all other traffic is denied by default.

Answer

Use one subnet for all tiers to simplify routing.

Answer

Use instance-level firewalls instead of VPC firewall rules.

Question 14

A company wants to use Cloud CDN to cache content from a backend bucket. They need to cache all objects, including those with cookies, to maximize performance. Which cache mode should they select?

Accepted Answer

FORCE_CACHE_ALL. Cloud CDN cache modes: CACHE_ALL_STATIC caches static content based on cache directives, USE_ORIGIN_HEADERS respects origin headers, FORCE_CACHE_ALL forces caching for all responses regardless of headers. FORCE_CACHE_ALL is used to override origin headers and cache everything.

Answer

CACHE_ALL_STATIC

Answer

USE_ORIGIN_HEADERS

Answer

CACHE_ALL

Question 15

A company wants to expose a web application running on Compute Engine behind a global HTTPS load balancer with Cloud CDN enabled. They need to ensure that only authenticated users can access certain content. Which approach should they use?

Accepted Answer

Generate signed URLs or signed cookies for Cloud CDN.. Cloud CDN supports signed URLs and signed cookies to restrict access to content. Signed URLs are used for individual files, while signed cookies work for multiple files. IAP is for access control at the load balancer level but not specifically for CDN content.

Answer

Use Cloud Armor to restrict access by IP address.

Answer

Use Cloud IAP to authenticate users at the load balancer.

Answer

Configure the backend bucket with a custom header for authentication.