PCNE Practice Test 31 — 15 Questions

Question 1

A financial services company needs to audit all VPC firewall rule changes in real time. They want to receive notifications whenever a rule is created, modified, or deleted. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud Logging with a filter on firewall rule updates and create a logs-based metric with an alert.. Cloud Logging can capture Admin Activity audit logs for firewall rule changes, and a logs-based metric with an alert provides real-time notifications. Option A is incorrect because VPC Flow Logs capture network traffic, not firewall rule changes. Option C is incorrect because VPC Firewall Rules Logging logs traffic hits, not rule configuration changes. Option D is incorrect because storing Cloud Audit Logs in a bucket requires manual or periodic checking, which is not real-time.

Answer

Enable VPC Flow Logs and export them to BigQuery for analysis.

Answer

Enable VPC Firewall Rules Logging and send logs to Pub/Sub with a Cloud Function trigger.

Answer

Store Cloud Audit Logs in a Cloud Storage bucket and periodically check for changes.

Question 2

An engineer needs to configure a Compute Engine instance as a network appliance that routes traffic between two subnets within the same VPC. The instance must handle traffic for both subnets. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Enable IP forwarding on the instance. Option C is correct because a Compute Engine instance acting as a router must have IP forwarding enabled (via the canIpForward attribute, e.g., gcloud compute instances create --can-ip-forward) so that the guest OS and the VPC network will allow packets whose source or destination is not the instance's own IP to be forwarded rather than dropped. Option D is correct because the instance must be dual-homed with two network interfaces (nic0 and nic1), each attached to a different subnet in the same VPC, so it has a presence and an internal IP in both subnets to send and receive traffic on each side. Option A is not required: MTU 1500 is a common default and MTU tuning is not a prerequisite for routing between subnets. Option B is not required: a custom route with the instance's internal IP as next hop is only needed to direct other VMs' traffic through the appliance, not to make the appliance itself route between its two interfaces. Option E is not required: external IPs are unnecessary for internal inter-subnet routing and would not enable the forwarding function.

Answer

Set the MTU to 1500 on both interfaces

Answer

Create a route with a next-hop of the instance's internal IP

Answer

Assign external IPs to both interfaces

Question 3

Which Network Intelligence Center tool provides a visual representation of your VPC network, including instances, subnets, firewall rules, and routes?

Accepted Answer

Network Topology. Network Topology in Network Intelligence Center provides a visual, interactive representation of your VPC network, showing instances, subnets, firewall rules, routes, and their relationships across projects and regions. It is specifically designed for topology visualization and troubleshooting. Connectivity Tests, Firewall Insights, and Performance Dashboard serve different purposes (path simulation, firewall rule analysis, and latency/performance metrics).

Answer

Connectivity Tests

Answer

Firewall Insights

Answer

Performance Dashboard

Question 4

A company is planning a hybrid connectivity solution with 200 Gbps total bandwidth between their data center and Google Cloud. They need the highest SLA and lowest latency. Which combination of services would meet these requirements?

Accepted Answer

Two 100 Gbps Dedicated Interconnect connections. Dedicated Interconnect provides up to 100 Gbps per link. To achieve 200 Gbps, they need two 100 Gbps connections. Two connections provide redundancy and the 99.99% SLA.

Answer

One 100 Gbps Dedicated Interconnect and one 100 Gbps Partner Interconnect

Answer

Twenty 10 Gbps Dedicated Interconnect connections

Answer

Four 50 Gbps Partner Interconnect connections

Question 5

An organization has a project with multiple VPCs. They need to know the maximum number of firewall rules allowed per VPC. Where should they look?

Accepted Answer

IAM & Admin Quotas page. VPC quotas are documented in the Quotas page under VPC Network, showing limits per VPC such as firewall rules, routes, etc.

Answer

Cloud Logging

Answer

Network Topology

Answer

Firewall Insights

Question 6

A startup is migrating a two-tier application to GCP. The web tier must be accessible from the internet, and the database tier must only be accessible from the web tier. Which network design should be used?

Accepted Answer

Place web servers in a public subnet with external IPs, database in a private subnet, and add a firewall rule allowing traffic from web subnet to database. It places the web servers in a public subnet with external IPs, allowing direct internet access, while the database resides in a private subnet with no external IP, enforcing isolation. A firewall rule (ingress on the database subnet) explicitly permits traffic from the web subnet’s CIDR range, typically on the database port (e.g., TCP 3306 for MySQL), ensuring the database is reachable only from the web tier. This design follows GCP’s best practice of using VPC firewall rules to control east-west traffic between subnets.

Answer

Place both tiers in separate VPCs and use VPC peering with no firewall rules

Answer

Place both tiers in the same subnet and configure firewall rules to restrict database access

Answer

Place web servers in a private subnet with Cloud NAT for outbound, database in the same private subnet

Question 7

Refer to the exhibit. Instances in subnet-b cannot access the internet through Cloud NAT. What is the most likely reason?

Accepted Answer

Subnet-b is not included in the Cloud NAT configuration.. The most likely reason instances in subnet-b cannot access the internet through Cloud NAT is that subnet-b is not included in the Cloud NAT configuration. Cloud NAT in Google Cloud is configured at the region level and requires specifying which subnets (or all subnets) should use the NAT gateway. If subnet-b is not explicitly included, its instances will not have NAT applied, and thus cannot reach the internet.

Answer

The firewall rules in subnet-b block egress.

Answer

The NAT IP address pool is exhausted.

Answer

Subnet-b has overlapping subnets.

Question 8

A company wants to connect two VPCs in different GCP projects so that they can communicate using internal IP addresses. The VPCs have overlapping IP ranges. Which approach allows connectivity without changing existing IP addresses?

Accepted Answer

None of these. When two VPCs have overlapping IP ranges, VPC Network Peering cannot be used because it requires non-overlapping CIDR blocks. Cloud VPN with dynamic routing also requires non-overlapping subnets. Shared VPC is for sharing a VPC across projects within the same organization, not for connecting two separate VPCs with overlapping ranges. Therefore, none of the options allow connectivity without changing IP addresses.

Answer

VPC Network Peering

Answer

Cloud VPN with dynamic routing

Answer

Shared VPC

Question 9

Based on the exhibit, what is the purpose of Cloud Router's BGP configuration?

Accepted Answer

To advertise the VPC's IP range to the on-premises network.. Cloud Router uses BGP to dynamically exchange routes between a VPC network and an on-premises network over a VPN tunnel or Dedicated Interconnect. In this configuration, the purpose is to advertise the VPC's IP range (the custom or auto-mode subnet CIDR) to the on-premises router, enabling on-premises hosts to route traffic back to the VPC. This is achieved by configuring the Cloud Router with a BGP session and setting the advertised route for the VPC's IP range.

Answer

To load balance traffic across multiple VPN tunnels.

Answer

To receive a default route from the on-premises network.

Answer

To advertise a default route to the on-premises network.

Question 10

Which TWO of the following are valid methods to reduce latency between users in Europe and a GCP-hosted application?

Accepted Answer

Use Cloud CDN to cache content at edge locations.. Option B is correct because Cloud CDN caches cacheable HTTP(S) content at Google's globally distributed edge points of presence, so European users are served from a nearby edge location instead of traversing the network to the origin, directly reducing round-trip latency. Option E is correct because deploying Compute Engine instances in a European region places the application's compute close to the European users, shortening the physical network path and thus the RTT compared to hosting the workload in, say, us-central1. Option A is not a valid latency-reduction method: Cloud VPN is an IPsec tunnel between a VPC network and a peer network (typically on-premises or another cloud), not something you establish to a user's ISP, and it does not optimize end-user paths. Option C is incorrect because Premium Tier versus Standard Tier affects the quality and routing of traffic entering and leaving Google's network (Premium keeps traffic on Google's backbone longer), but it does not by itself place content or compute closer to European users the way edge caching or regional deployment does. Option D is incorrect because Cloud NAT provides outbound internet access for private instances without external IPs; it is an egress address-translation service and has no bearing on reducing latency for inbound user traffic.

Answer

Establish a Cloud VPN tunnel to the user's ISP.

Answer

Use Premium Tier networking instead of Standard Tier.

Answer

Use Cloud NAT for outbound traffic.

Question 11

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

Accepted Answer

Deploy a global HTTP(S) Load Balancer with backend services in each region.. A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Answer

Use Cloud DNS with geo-routing to direct users to regional load balancers.

Answer

Set up Cloud NAT with multiple static IP addresses for each region.

Answer

Assign a global anycast IP address to all instances and use BGP to advertise it.

Question 12

You have a Cloud Router with the configuration shown. The on-premises network (ASN 65002) is not receiving any routes from Google Cloud. What is the most likely cause?

Accepted Answer

The router is in custom advertise mode but does not advertise the VPC subnets. When a Cloud Router is configured in custom advertise mode, it only advertises the routes explicitly specified in the custom advertisement list. If the VPC subnets are not included in that list, the on-premises network will not receive any routes from Google Cloud, even if the BGP session is established. This is the most likely cause because the question states the on-premises network is not receiving any routes, which aligns with a missing custom advertisement rather than a session or timer issue.

Answer

The BGP keepalive interval is set too low

Answer

The BGP session is not established

Answer

The on-premises subnet 10.0.1.0/24 is not advertised

Question 13

Which TWO factors should be considered when selecting a Google Cloud region for deploying a globally distributed application to minimize latency for users?

Accepted Answer

Availability of required Google Cloud services in the region. Option A is correct because not every Google Cloud service or machine type is available in every region, so you must verify that the services your globally distributed application depends on (for example, specific Compute Engine machine families, GKE features, or managed databases) are actually offered in the candidate region before selecting it. Option C is correct because latency is dominated by physical distance and network path; placing resources in regions geographically close to the majority of your users reduces round-trip time, which is the core goal of minimizing latency for a globally distributed application. Option B is not selected here because data residency is a legal/regulatory constraint rather than a latency-minimization factor, and the question specifically asks about minimizing latency. Option D is not selected because the number of zones affects availability and fault tolerance (redundancy across failure domains), not the latency users experience. Option E is not selected because resource cost is a budget consideration and does not directly reduce network latency for end users.

Answer

Compliance with data residency requirements

Answer

Number of zones in the region

Answer

Cost of resources in the region

Question 14

An engineer is configuring a Compute Engine instance with multiple network interfaces for use as a network appliance. Which interface is considered the primary interface for default routes and instance metadata?

Accepted Answer

NIC0. NIC0 is the primary interface; default routes and instance metadata are tied to it. Adding extra interfaces (NIC1, NIC2, etc.) is for specific networking scenarios like network appliances.

Answer

Any interface with an external IP

Answer

The interface with the lowest subnet CIDR

Answer

The interface attached to the default VPC

Question 15

A company uses Traffic Director with Envoy sidecars for service mesh. They want to gradually shift traffic from version 1 to version 2 of a service, starting with 10% traffic to version 2. Which Traffic Director feature should they use?

Accepted Answer

Traffic splitting. Traffic Director's traffic splitting feature allows you to distribute traffic across different service versions by configuring weighted backends in the URL map. By assigning a weight of 10 to version 2 and 90 to version 1, you achieve a gradual canary rollout. This is the canonical mechanism for progressive traffic shifting in Traffic Director service mesh deployments.

Answer

Circuit breakers

Answer

Fault injection

Answer

mTLS authentication