PCNE Practice Test 3 — 30 Questions

Question 1

A company has a Hybrid Connectivity setup using Cloud VPN with BGP. They want to migrate to Dedicated Interconnect for better performance. During the migration, they need to avoid downtime. Which THREE steps should they take?

Accepted Answer

Provision the Dedicated Interconnect and VLAN attachments. Option C is correct because provisioning the Dedicated Interconnect and VLAN attachments is the foundational step to establish the new high-performance connection. Without this, there is no physical or logical path to migrate traffic onto. This must be done before any BGP configuration or route manipulation can occur.

Answer

Set a lower local preference on the Interconnect BGP session

Answer

Remove the VPN tunnels immediately after Interconnect is up

Question 2

A company has a VPC with several subnets and wants to force traffic between two specific subnets (A and B) to be inspected by a third-party firewall appliance in a separate subnet (C). The firewall has source/destination check disabled. What is the best way to route traffic from A to B through C?

Accepted Answer

Use a policy-based route to redirect traffic from A to B to the firewall's IP.. Policy-based routes allow you to define a forwarding rule that matches traffic based on source and destination IP ranges, then sends it to a next-hop instance (the firewall). Since the firewall has source/destination check disabled, it can forward the inspected traffic to the final destination. This is the only option that directly forces traffic between subnets A and B through the firewall in subnet C.

Answer

Use Cloud NAT to route traffic through the firewall.

Answer

Use a custom route with a lower priority for the destination subnet.

Answer

Use VPC flow logs to monitor traffic.

Question 3

An organization is deploying a global application and wants to use an Internal Load Balancer (ILB) across multiple regions. What is the correct configuration?

Accepted Answer

Deploy ELB in each region and use DNS to route traffic. Option C is correct because Google Cloud does not support a native cross-region Internal Load Balancer (ILB). To distribute traffic across multiple regions, you must deploy a separate Internal TCP/UDP Load Balancer in each region and use DNS-based routing (e.g., Cloud DNS with geo-routing or weighted record sets) to direct clients to the appropriate regional ILB. This approach provides regional high availability and global reach without exposing internal IPs externally.

Answer

Use a cross-region ILB by enabling global access

Answer

Use an Internal TCP/UDP Load Balancer in one region and route traffic via Cloud VPN

Answer

Use a global External Load Balancer with internal backend

Question 4

Which TWO of the following are valid reasons to use a Shared VPC architecture?

Accepted Answer

To prevent individual projects from creating their own VPCs and force them to use a common VPC. Option C is correct because a Shared VPC architecture allows an organization to enforce that individual projects cannot create their own VPCs; instead, they must use a common VPC that is centrally managed. This is achieved by designating a host project that contains the shared VPC network, and attaching service projects to it, which prevents the service projects from having their own independent VPC networks.

Answer

To reduce latency by placing resources in the same region within a single VPC

Answer

To improve network connectivity between different organizational units without using VPN or peering

Answer

To reduce egress costs by having all resources in one VPC

Question 5

A company is designing a global application that requires low-latency access to GCP services like Cloud Storage and BigQuery. They also need to minimize egress costs for traffic to the internet. Which network service tier should they choose for their GCP resources?

Accepted Answer

Premium Tier for all resources. The Premium Tier routes traffic over Google's global network backbone, providing lower latency and higher performance for accessing GCP services like Cloud Storage and BigQuery. It also minimizes egress costs to the internet by keeping traffic on Google's private network for as long as possible, reducing reliance on public transit.

Answer

Use a CDN to reduce latency and no specific tier

Answer

Premium Tier for Compute Engine instances and Standard Tier for Cloud Storage

Answer

Standard Tier for all resources

Question 6

A company uses VPC Service Controls to protect a managed service (e.g., BigQuery) within a service perimeter. Developers need to access the service from an on-premises network via a Cloud VPN tunnel with a specific IP address. However, access is being denied. What is the most likely cause?

Accepted Answer

The on-premises source IP is not included in the allowed external IP addresses list in the perimeter.. VPC Service Controls enforce access to managed services like BigQuery by restricting which source IPs can reach the service. When accessing from on-premises via Cloud VPN, the source IP seen by the service is the on-premises client's IP, not the VPN gateway's IP. If that on-premises source IP is not explicitly added to the allowed external IP addresses list in the service perimeter, access is denied, even though the VPN tunnel is established.

Answer

The project containing the VPN tunnel is not in the same perimeter.

Answer

The VM instances in the perimeter do not have public IP addresses.

Answer

The Cloud VPN tunnel is not using IKEv2.

Question 7

A company deploys a web application behind a global external HTTP(S) load balancer and wants to protect against SQL injection attacks. Which Google Cloud security product should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities, including pre-configured rules to filter SQL injection (SQLi) attacks at the edge of Google's network, before traffic reaches the backend. It integrates directly with the global external HTTP(S) load balancer to inspect HTTP/HTTPS requests and block malicious payloads based on OWASP Top 10 signatures.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Answer

Cloud IDS

Question 8

Which THREE of the following are required to use Private Google Access for on-premises hosts through a Cloud VPN or Interconnect? (Choose THREE)

Accepted Answer

Firewall rules allowing traffic from on-premises to the restricted VIP IP range.. Private Google Access for on-premises hosts requires firewall rules that allow traffic from on-premises to the restricted VIP IP range (199.36.153.4/30). This is necessary because on-premises hosts must be able to reach the restricted Google APIs VIP over the VPN or Interconnect, and firewall rules control which source IPs can access that VIP. Without these rules, traffic from on-premises would be blocked at the Google Cloud perimeter.

Answer

VPC Flow Logs enabled on the VPC.

Answer

Cloud NAT configured for the on-premises subnet.

Question 9

An organization wants to restrict data exfiltration from a GCP project. They need to prevent users from copying data to external cloud storage services like AWS S3, but allow access to Google Cloud Storage. Which VPC Service Controls (VPC-SC) configuration should they use?

Accepted Answer

Combine VPC Service Controls with a Cloud Firewall that denies egress to non-Google IPs.. Option A is correct because VPC Service Controls (VPC-SC) can create a perimeter that restricts data movement to only Google Cloud Storage, while Cloud Firewall egress rules can deny traffic to non-Google IP ranges (including AWS S3 endpoints). This combination ensures that even if a user attempts to copy data to an external cloud storage service, the firewall blocks the egress traffic, and VPC-SC prevents access to Google Cloud Storage from outside the perimeter.

Answer

Use Cloud Firewall rules to block egress to AWS IP ranges.

Answer

Enable Data Loss Prevention (DLP) API to inspect outgoing data.

Answer

Create a VPC Service Controls perimeter that includes the project and set access levels to allow only Google Cloud Storage.

Question 10

Which TWO of the following are required steps to set up a Dedicated Interconnect?

Accepted Answer

Create an interconnect (physical connection) in the colocation facility. Creating an interconnect (physical connection) in the colocation facility is a required step because Dedicated Interconnect requires a direct, physical cross-connect between your on-premises router and a Google Cloud edge router at a colocation facility. This physical link is the foundation of the dedicated, high-bandwidth connection, and without it, no Layer 2 or Layer 3 connectivity can be established.

Answer

Establish a VPN tunnel as a backup

Answer

Deploy a Google-provided router in the colocation facility

Answer

Configure MD5 authentication on the BGP session

Question 11

An enterprise uses HA VPN to connect their on-premises network to Google Cloud. The on-premises side has a single VPN device that supports BGP. They want to maximize availability. What is the recommended Google Cloud configuration?

Accepted Answer

Deploy a single Cloud VPN gateway with two interfaces, each with its own external IP, and configure two BGP sessions to the single on-premises device.. Option C is correct because it provides high availability by using a single Cloud VPN gateway with two interfaces, each with its own external IP, and two BGP sessions to the on-premises device. This configuration allows active/active failover: if one interface or BGP session fails, traffic automatically switches to the other, maximizing availability without requiring multiple regions.

Answer

Deploy two Cloud VPN gateways in different regions to provide regional failover.

Answer

Deploy a single Cloud VPN gateway with one interface and one BGP session.

Answer

Deploy a single Cloud VPN gateway with two interfaces, but only use one BGP session for simplicity.

Question 12

A company is using Cloud DNS for private zone resolution within their VPC. They have a private zone for 'example.internal' and have attached it to the VPC. When they create a new Compute Engine VM and try to resolve 'myapp.example.internal', it fails. What is the most likely cause?

Accepted Answer

The record 'myapp.example.internal' does not exist in the zone. Option D is correct because the most likely cause of a resolution failure for a specific record is that the record does not exist in the private zone. The question states the zone is attached to the VPC, so the zone itself is accessible; the failure is specific to the record name. Cloud DNS will return an NXDOMAIN response if the record is not defined, even if the zone is properly configured.

Answer

The private zone is not attached to the VPC

Answer

The VM's /etc/resolv.conf does not point to Cloud DNS

Answer

Firewall rule blocking DNS traffic (UDP 53) to the metadata server

Question 13

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

Accepted Answer

Check the MTU size on the VPN tunnel or interconnect.. Option A is correct because an MTU mismatch on the VPN tunnel or interconnect can cause packet fragmentation or drops, leading to BGP session flapping. Cloud Router uses Google's internal infrastructure, and if the MTU is set too low, large BGP update packets may be silently discarded, triggering hold timer expiry and session resets. Checking and adjusting the MTU ensures that BGP packets can traverse the path without fragmentation.

Answer

Delete and recreate the VLAN attachment.

Answer

Revert all BGP routes to static routes.

Answer

Increase the bandwidth of the interconnect.

Question 14

Which TWO of the following are benefits of using Cloud Interconnect over Cloud VPN for hybrid connectivity? (Choose two.)

Accepted Answer

Lower and more consistent latency.. Cloud Interconnect provides a dedicated, private connection between your on-premises network and Google Cloud, bypassing the public internet. This results in lower and more consistent latency compared to Cloud VPN, which relies on the public internet and is subject to variable network conditions and potential congestion.

Answer

Always provides encryption for data in transit.

Answer

Easier to set up as no physical connection is needed.

Answer

Lower cost for small bandwidth requirements.

Question 15

An engineer configured a Cloud Router with the above settings. The VPC network has subnets 10.1.0.0/16 and 10.2.0.0/16, as well as subnets 10.3.0.0/16 and 10.4.0.0/16. The on-premises router is only receiving routes for 10.1.0.0/16 and 10.2.0.0/16 but not for 10.3.0.0/16 and 10.4.0.0/16. What is the cause?

Accepted Answer

The Cloud Router is set to custom advertisement mode, and the missing subnets are not included in the advertised IP ranges. Option C is correct because when a Cloud Router is configured in custom advertisement mode, it only advertises the specific CIDR ranges explicitly listed in the 'Advertised IP ranges' field. Since the missing subnets (10.3.0.0/16 and 10.4.0.0/16) are not included in that list, they are not propagated via BGP to the on-premises router, even though they exist in the VPC.

Answer

The BGP session is not established

Answer

The Cloud Router is in global routing mode, which does not advertise all subnets

Answer

The on-premises router has a filter that blocks the other routes

Question 16

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

Accepted Answer

Enable IP forwarding on the VPN appliance VM instance.. Option C is correct because a third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.

Answer

Create a custom route in the VPC pointing to the VPN appliance's internal IP.

Answer

Enable Private Google Access on the subnet hosting the VPN appliance.

Answer

Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.

Question 17

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

Accepted Answer

The BGP routes for that subnet are not advertised.. The Dedicated Interconnect is up and the organization can ping instances in one subnet, which confirms that Layer 2 and basic Layer 3 connectivity (via the VLAN attachment) are working. However, the inability to reach a service on a different subnet within the same VPC indicates that the on-premises router does not have a route to that specific subnet. This is most likely because the BGP session is not advertising the prefix for that subnet, or the on-premises router is not receiving the route via BGP. Without the route, traffic from on-premises to that subnet will be dropped.

Answer

The MTU is too small.

Answer

The firewall rules are blocking the traffic.

Answer

The VLAN attachment is down.

Question 18

A company with limited public IP addresses on-premises needs to connect to Google Cloud using Cloud VPN. They require high availability. Which solution should they implement?

Accepted Answer

Use HA VPN with two on-premises public IPs and two tunnels.. HA VPN provides high availability by using two tunnels, each terminating on a separate on-premises VPN gateway with a unique public IP address. This ensures that if one on-premises public IP or tunnel fails, traffic can still flow through the other tunnel, meeting the high-availability requirement. Classic VPN (option B) does not support active-active failover, and using the same public IP for both tunnels (option D) creates a single point of failure at the on-premises side.

Answer

Use NAT to map multiple private IPs to one public IP.

Answer

Use Classic VPN with a single tunnel.

Answer

Use HA VPN with the same public IP for both tunnels.

Question 19

A company has set up an HA VPN tunnel between their on-premises router and a Cloud Router in Google Cloud. The on-premises router establishes BGP sessions to both Cloud Router instances, but the routes learned from one Cloud Router instance are not being received. The other instance works fine. What is the most likely cause?

Accepted Answer

The on-premises router has incorrect ASN configured for that BGP session. The most likely cause is that the on-premises router has an incorrect ASN configured for the BGP session with the failing Cloud Router instance. In Google Cloud HA VPN, each Cloud Router instance uses a unique BGP IP address but both must use the same peer ASN as configured on the on-premises side. If the ASN mismatch occurs, BGP will not establish or will reject routes, while the other session with the correct ASN works fine.

Answer

The tunnel is in a failed state

Answer

The on-premises router has a firewall blocking BGP updates only on one IP address

Answer

The Cloud Router is set to advertisement mode 'Custom' and does not advertise all subnets

Question 20

Which TWO network services can be used to provide secure connectivity between a VPC and an on-premises data center without traversing the public internet? (Choose two.)

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (C) provides a direct, private physical connection between your on-premises network and Google's VPC, bypassing the public internet entirely. This ensures low latency, high bandwidth, and consistent network performance for secure hybrid cloud connectivity.

Answer

Cloud VPN with IPsec

Answer

Cloud NAT

Answer

VPC Network Peering