PCNE Practice Test 3 — 30 Questions

Question 1

An organization wants to use Shared VPC but restrict access to certain subnets for specific service projects. Which GCP feature should they use?

Accepted Answer

Subnet-level IAM bindings. Subnet-level IAM bindings allow you to grant roles (e.g., compute.networkUser) on specific subnets within a Shared VPC to service project principals. This restricts access to only those subnets, while the service project can still use the shared network. It is the native GCP mechanism for fine-grained subnet access control in a Shared VPC environment.

Answer

VPC Network Peering

Answer

VPC Service Perimeters

Answer

Firewall rules

Question 2

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

Accepted Answer

Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.. Traffic Director uses Envoy's fault injection capabilities, which are configured via route rules in the URL map. To inject a 50% failure rate, you configure a fault injection policy with a percentage and an abort or fixed delay. This is done in the route rule, not via backend service flags or circuit breakers.

Answer

Use the gcloud compute backend-services update command with the --fault-injection flag.

Answer

Set a circuit breaker with a max pending requests threshold.

Answer

Create a backend service with connection draining and set the drain timeout.

Question 3

Which Cloud DNS zone type is used to resolve DNS names for resources within a VPC network, and is not accessible from the internet?

Accepted Answer

Private managed zone. A private managed zone in Cloud DNS is used to resolve DNS names for resources within a VPC network and is explicitly not accessible from the internet. It is scoped to one or more VPC networks, and only resources within those authorized networks can query the zone. This makes it the correct answer for internal-only DNS resolution.

Answer

Peering zone

Answer

Forwarding zone

Answer

Public managed zone

Question 4

Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?

Accepted Answer

Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.. The preconfigured WAF rule for SQL injection (sqli-stable) uses a default sensitivity level that may be too aggressive, causing false positives on legitimate traffic. By lowering the sensitivity level or excluding specific request attributes (e.g., headers, cookies, or URI paths), you can reduce false positives while still blocking actual SQL injection attempts. Cloud Armor allows fine-tuning of preconfigured rules via the `sensitivity` parameter and `exclude` lists, which is the correct approach here.

Answer

Add a rate-based rule to limit the number of requests per second.

Answer

Create a rule with higher priority to allow the legitimate traffic before the WAF rule.

Answer

Enable TLS inspection for the load balancer to fully inspect encrypted traffic.

Question 5

A network engineer wants to test whether a Compute Engine VM can reach a Cloud SQL instance in a different VPC network, considering firewall rules and VPC peering. Which Google Cloud tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests is a Network Intelligence Center tool that performs a live, simulated reachability analysis between a source and destination, evaluating firewall rules, routes, VPC peering, and other configuration along the path. It explicitly supports testing connectivity from a Compute Engine VM to a Cloud SQL instance across VPC networks, including peered topologies, and reports exactly where traffic would be allowed or dropped.

Answer

VPC Flow Logs

Answer

Firewall Insights

Answer

Packet Mirroring

Question 6

A company wants to publish an internal service (e.g., a database) in their VPC so that consumers in other VPCs can connect to it privately via Private Service Connect (PSC). What must be created on the producer side?

Accepted Answer

A Service Attachment that exposes the service.. Private Service Connect allows producers to publish services via a Service Attachment. The service attachment is created on a Network Endpoint Group (NEG) that points to the internal service (e.g., a backend service). Consumers then create PSC endpoints to connect.

Answer

A Cloud VPN tunnel to the consumer VPC.

Answer

A VPC peering connection.

Answer

A Private Service Connect endpoint in the producer VPC.

Question 7

You are designing DNS resolution for a hybrid cloud. On-premises DNS servers must resolve GCP private VM hostnames, and GCP VMs must resolve on-premises hostnames. Which Cloud DNS feature should you use?

Accepted Answer

DNS forwarding (inbound and outbound). DNS forwarding with inbound and outbound policies is the correct choice because it enables bidirectional resolution between on-premises and GCP VMs. Outbound forwarding sends queries from GCP to on-premises DNS servers, while inbound forwarding allows on-premises clients to resolve GCP private VM hostnames by forwarding queries to Cloud DNS. This creates a seamless hybrid DNS namespace without exposing private zones to the internet.

Answer

DNS peering

Answer

Cloud DNS public zones

Answer

Split-horizon DNS

Question 8

An organization needs to restrict access to Google Cloud APIs such that only traffic from a specific set of VMs inside a VPC can reach the APIs, and all other traffic (including from other VPCs) must be denied. The VMs do not have external IPs. Which combination of services should they use?

Accepted Answer

Private Google Access and VPC Service Controls. Private Google Access allows VMs without external IPs to reach Google APIs. VPC Service Controls can create a service perimeter that restricts access to APIs from only authorized VPCs.

Answer

Private Service Connect and VPC Service Controls

Answer

Cloud NAT and VPC Service Controls

Answer

Cloud NAT and Private Google Access

Question 9

You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?

Accepted Answer

The domain is not verified for the Google-managed certificate on the frontend.. When a Google-managed certificate is used on the frontend of an SSL proxy load balancer, the domain must be verified via DNS or a challenge file. If the domain is not verified, the certificate cannot be provisioned or validated, causing a mismatch between the certificate's Subject Alternative Names (SANs) and the domain clients are connecting to, resulting in SSL errors.

Answer

The SSL policy is configured to require TLS 1.3 only.

Answer

The backend self-managed certificate is not signed by a public CA.

Answer

The backend service must use a Google-managed certificate as well.

Question 10

An organization has an internal application that runs on Compute Engine and needs to be load balanced within the same region using a Layer 7 load balancer. They want the load balancer to be accessible only from within their VPC. Which THREE components are needed? (Choose three.)

Accepted Answer

A Regional Internal HTTP(S) Load Balancer forwarding rule. The three required components for a Regional Internal HTTP(S) Load Balancer are the forwarding rule, backend service, and URL map. While a health check is necessary to define in the backend service, it is not a separate component of the load balancer itself. The SSL certificate is optional and only needed if HTTPS is used, not for basic internal load balancing.

Answer

A health check

Answer

An SSL certificate

Question 11

A large multinational corporation uses a Shared VPC in Google Cloud with multiple service projects. They have a central Cloud NAT configured in the host project in the us-central1 region to provide internet egress for all VMs. Recently, the IT team added a new subnet (10.0.10.0/24) in a service project and deployed VMs there. All other VMs in the same project but in different subnets (e.g., 10.0.1.0/24) can reach the internet, but the new VMs in 10.0.10.0/24 cannot. The Cloud NAT gateway is configured in us-central1 with all IP ranges allowed. The VPC firewall rules allow egress traffic to the internet. The team verified that the VMs have a default route (0.0.0.0/0) with next-hop 'default-internet-gateway' and that the Cloud NAT router's NAT IPs are properly assigned. However, the new subnet's VMs are unable to connect to any external IP. The network engineer suspects that the Cloud NAT's NAT reservations might be the issue, but all NAT IPs are ephemeral. Further investigation shows that the Cloud Router used by Cloud NAT is advertising custom IP ranges via BGP to an on-premises router for a different use case. What is the most likely cause and solution?

Accepted Answer

Remove the new subnet range (10.0.10.0/24) from the custom advertised routes on the Cloud Router associated with the Cloud NAT.. The Cloud Router associated with Cloud NAT is advertising custom IP ranges via BGP to an on-premises router. If the new subnet range (10.0.10.0/24) is included in those custom advertised routes, the on-premises router may advertise a more specific route back to the VPC, causing the VMs in that subnet to prefer the on-premises route over the default route (0.0.0.0/0) for internet-bound traffic. Since the on-premises router does not have internet access, the traffic is blackholed. Removing the subnet range from the custom advertised routes on the Cloud Router resolves the issue by ensuring the default route remains the preferred path for internet egress.

Answer

Add a static route for 0.0.0.0/0 with next-hop set to the Cloud NAT gateway's IP address in the VPC.

Answer

Update the VPC firewall rules to explicitly allow egress traffic from the new subnet's IP range to 0.0.0.0/0.

Answer

Reserve static NAT IPs for the new subnet in the Cloud NAT configuration to ensure that the VMs have a consistent egress IP.

Question 12

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Accepted Answer

Geo routing policy. Geo routing policy (B) is correct because it lets Cloud DNS return answers based on the geographic location of the querying client, which directly satisfies the requirement to direct users by region. Failover policy (C) is correct because it enables health-checked primary/backup routing, so traffic automatically shifts to a healthy backup region when the primary endpoint is unhealthy. Together, these two policies match the stated need for location-based steering plus regional failover. Weighted round-robin (A) only distributes traffic by configured weights and does not provide geographic targeting or health-based failover. DNSSEC (D) is a security extension for authenticating DNS responses, not a routing policy. Response policy zone (E) is used to override or rewrite DNS answers for policy/filtering purposes, not for geo-based routing or failover.

Answer

Weighted round-robin

Answer

DNSSEC

Answer

Response policy zone

Question 13

A company has a global e-commerce platform using a Global HTTPS Load Balancer with Cloud CDN. They want to serve private content, such as user-specific PDFs, with CDN caching while ensuring only authorized users can access it. Which method should they use?

Accepted Answer

Use Cloud CDN signed URLs or signed cookies. Cloud CDN signed URLs or signed cookies are the correct mechanism to serve private content through the CDN while enforcing per-user authorization. They embed a cryptographic signature and expiration that the CDN edge validates before serving cached content, so only users with a valid signed URL/cookie can access the private PDFs. This preserves CDN caching benefits while restricting access.

Answer

Use Cloud Armor to restrict access by IP address

Answer

Enable IAM permissions on the backend bucket and restrict access to only authenticated users

Answer

Set the cache mode to FORCE_CACHE_ALL and use a token in the URL

Question 14

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is GCP's managed hub-and-spoke service that connects multiple on-premises data centers (via Cloud VPN or Interconnect) and multiple VPCs (as spokes) through a central hub. It simplifies topology management, routing, and monitoring for large-scale hybrid and multi-VPC connectivity, which is exactly the requirement.

Answer

Cloud VPN

Answer

VPC peering

Answer

Cloud Router

Question 15

An organization wants to allow only certain users to access a service published via Private Service Connect. They need to restrict access based on the source VPC network. What should they use?

Accepted Answer

Consumer allow lists in the service attachment. Private Service Connect allows publishing services with access control using service attachment with consumer allow lists that specify which projects or VPCs can connect.

Answer

Firewall rules in the consumer VPC

Answer

IAM permissions on the service attachment

Answer

VPC Service Controls

Question 16

A company wants to connect two VPC networks (vpc-a and vpc-b) that both reside in the same Google Cloud project. They need to ensure that all IP ranges in both VPCs can communicate using internal private IP addresses. Which solution should they implement?

Accepted Answer

Enable VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering directly connects two VPCs within the same project using internal RFC 1918 IP addresses, with no bandwidth limitations and no single point of failure. It allows all subnets in both VPCs to communicate privately without requiring external connectivity, VPN tunnels, or NAT gateways.

Answer

Use Dedicated Interconnect to connect the VPCs.

Answer

Set up Cloud VPN tunnels between the two VPCs.

Answer

Configure Cloud NAT to allow the VPCs to communicate through NAT.

Question 17

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

Accepted Answer

Private Service Connect endpoint. When a consumer wants to connect to a managed SaaS application published via Private Service Connect (PSC), they must create a Private Service Connect endpoint in their own VPC. This endpoint is a regional resource that uses an internal IP address from the consumer's VPC and establishes a connection to the service attachment published by the provider. The endpoint effectively makes the SaaS service accessible as if it were a resource inside the consumer's VPC, without requiring public IPs or VPNs.

Answer

Service attachment

Answer

Internal forwarding rule

Answer

Cloud VPN tunnel

Question 18

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

Accepted Answer

Check VPC firewall rules to ensure ingress traffic from the on-premises subnet is allowed to the VM. VPC firewall rules are the first line of defense for controlling traffic to GCE VMs. Even though the VPN tunnel is established, the default-deny ingress posture of GCP means that traffic from the on-premises subnet must be explicitly allowed by a VPC firewall rule. Without this rule, packets arriving via the tunnel are dropped before they ever reach the VM's network interface.

Answer

Check the VM's OS firewall to see if it is blocking incoming traffic

Answer

Verify that the VPN tunnel is using the correct pre-shared key

Answer

Review Cloud Armor security policies that may be blocking the traffic

Question 19

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Answer

Change the stack type of subnet-b to IPV4_IPV6.

Answer

Configure Cloud NAT in the region of subnet-b.

Answer

Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.

Question 20

A company wants to connect two VPCs in different GCP projects so that they can exchange traffic using internal IP addresses. They do not need centralized management or transitive routing between the VPCs. Which GCP networking feature should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering in Google Cloud allows two VPC networks in different projects (or organizations) to connect privately using internal IP addresses. It provides full mesh connectivity without a gateway or VPN, and it does not require centralized management or transitive routing. This exactly matches the requirement to connect two VPCs in different GCP projects for internal IP traffic.

Answer

Network Connectivity Center

Answer

Cloud VPN

Answer

Shared VPC