PCNE Practice Test 31 — 15 Questions

Question 1

A company has deployed an HA VPN gateway in Google Cloud to connect to their on-premises network. They have configured two tunnels with IKEv2 and BGP. One tunnel is established, but the second tunnel is not coming up. What could be a likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pre-shared keys are mismatched between the two tunnels. Common issues include mismatched pre-shared keys or IKE versions. Since the first tunnel works, the configuration is mostly correct, but the second tunnel may have a different pre-shared key or PSK mismatch. Incorrect IKE version is less likely because both tunnels use the same gateway. BGP timers are usually consistent. Cloud VPN logs would help identify the root cause.

Answer

IKE version is set to IKEv1 on one side

Answer

The second tunnel's peer IP is unreachable

Answer

BGP timers are inconsistent

Question 2

A company has deployed a web application on Compute Engine instances in a VPC with subnet 10.1.0.0/20. The instances need to access an external API that whitelists IP addresses. The company uses Cloud NAT to provide outbound connectivity. The API integration tests are failing, and the operations team suspects that the source IP addresses seen by the API are not consistent. What is the most likely cause and solution?

Accepted Answer

Cloud NAT is configured with a default rule that does not include the subnet; add a custom NAT rule that specifically includes subnet 10.1.0.0/20.. If Cloud NAT's default rule does not include the subnet 10.1.0.0/20, instances in that subnet will not have their outbound traffic translated through the NAT gateway, causing them to use their ephemeral public IPs (if any) or fail to reach the external API. Adding a custom NAT rule that explicitly includes the subnet ensures all outbound traffic from those instances uses the consistent NAT IP address that the API whitelist expects.

Answer

Cloud NAT is configured with endpoint-independent mapping; change to endpoint-dependent mapping to ensure consistent source IP.

Answer

Cloud NAT is configured with dynamic port allocation; use static port allocation instead.

Answer

Cloud NAT is using a manual NAT IP address that is not assigned to the instances; assign the NAT IP to the instances as an alias IP range.

Question 3

You run the command shown in the exhibit. Your on-premises network is connected to your VPC via a Cloud Router with two BGP sessions. You notice that your on-premises network receives routes for only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) but not for other subnets in the VPC. What is the most likely cause?

Accepted Answer

The Cloud Router is configured with custom route advertisement that only includes the two specified ranges.. The Cloud Router's custom route advertisement configuration explicitly controls which routes are advertised to on-premises via BGP. If only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) are included in the custom advertisement, other VPC subnets will not be advertised, even if they exist. The exhibit shows that the on-premises network receives only those two ranges, which directly matches a custom advertisement setup rather than the default ALL_SUBNETS behavior.

Answer

The BGP interface IP addresses 169.254.x.x are not reachable from the on-premises side.

Answer

The BGP peer ASN 65001 is not recognized by the on-premises router.

Answer

The advertisedGroups includes ALL_SUBNETS but the router is ignoring it because of a misconfiguration.

Question 4

Which TWO statements about VPC Network Peering are correct?

Accepted Answer

VPC peering is supported within the same organization. VPC Network Peering is designed to connect VPCs within the same organization (or across different organizations) without requiring a VPN or gateway. It allows private RFC 1918 IP communication between VPCs, and when both VPCs belong to the same organization, the peering setup is straightforward and does not involve cross-organization trust policies. This is a fundamental use case for peering in Google Cloud.

Answer

VPC peering supports global load balancing with internal IPs

Answer

VPC peering supports transitivity across multiple peerings

Answer

VPC peering allows overlapping CIDR ranges

Question 5

A company has Compute Engine instances in a VPC that only have internal IP addresses. They need to access Google Cloud services like Cloud Storage and BigQuery. They also have on-premises servers that need to access the same instances via a Cloud VPN tunnel. What must be enabled for the instances to access Google APIs without public IPs?

Accepted Answer

Private Google Access. Private Google Access enables Compute Engine instances that have only internal IP addresses (no external IPs) to reach Google APIs and services such as Cloud Storage and BigQuery. It works by routing traffic destined for Google API IP ranges through the default internet gateway, using the VPC's internal DNS resolution to map the API hostnames to Google's internal IP addresses, without requiring a public IP on the instance.

Answer

Cloud Router

Answer

VPC peering

Answer

Cloud NAT

Question 6

You have a Cloud Router with the configuration shown. The on-premises network (ASN 65002) is not receiving any routes from Google Cloud. What is the most likely cause?

Accepted Answer

The router is in custom advertise mode but does not advertise the VPC subnets. When a Cloud Router is configured in custom advertise mode, it only advertises the routes explicitly specified in the custom advertisement list. If the VPC subnets are not included in that list, the on-premises network will not receive any routes from Google Cloud, even if the BGP session is established. This is the most likely cause because the question states the on-premises network is not receiving any routes, which aligns with a missing custom advertisement rather than a session or timer issue.

Answer

The BGP keepalive interval is set too low

Answer

The BGP session is not established

Answer

The on-premises subnet 10.0.1.0/24 is not advertised

Question 7

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

Accepted Answer

Check VPC firewall rules to ensure ingress traffic from the on-premises subnet is allowed to the VM. VPC firewall rules are the first line of defense for controlling traffic to GCE VMs. Even though the VPN tunnel is established, the default-deny ingress posture of GCP means that traffic from the on-premises subnet must be explicitly allowed by a VPC firewall rule. Without this rule, packets arriving via the tunnel are dropped before they ever reach the VM's network interface.

Answer

Check the VM's OS firewall to see if it is blocking incoming traffic

Answer

Verify that the VPN tunnel is using the correct pre-shared key

Answer

Review Cloud Armor security policies that may be blocking the traffic

Question 8

An engineer needs to set up a firewall rule that allows health check probes from Google Cloud's health check ranges (130.211.0.0/22 and 35.191.0.0/16) to a backend instance group. The rule should apply only to instances with the 'backend' network tag. What is the correct configuration?

Accepted Answer

Create an ingress rule with source IP ranges 130.211.0.0/22 and 35.191.0.0/16, and target tags 'backend'. Ingress firewall rules control incoming traffic. The rule must allow traffic from the health check source ranges to all instances (targets) with the tag 'backend'. Priority lower number means higher priority.

Answer

Create an ingress rule with destination IP ranges 130.211.0.0/22 and 35.191.0.0/16, and target tags 'backend'

Answer

Create a route with next hop as the backend instance group

Answer

Create an egress rule with source IP ranges 130.211.0.0/22 and 35.191.0.0/16, and target tags 'backend'

Question 9

What is the default MTU for Compute Engine virtual machines?

Accepted Answer

1460. Compute Engine instances use an MTU of 1460 bytes by default (the Ethernet maximum 1500 minus the IP/GRE overhead for tunneling). Some instance types support jumbo frames (MTU 8896).

Answer

1400

Answer

1500

Answer

8896

Question 10

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

Accepted Answer

Create the subnet with primary range 10.0.2.0/24 and specify the secondary range at creation time.. In Google Cloud VPC, a subnet can have both a primary IP range and one or more secondary IP ranges, and these secondary ranges must be specified at subnet creation time. For a Kubernetes cluster, the secondary range for pods is required, and it cannot be added after the subnet is created; it must be defined during the initial subnet creation.

Answer

Create the subnet with primary range 10.0.2.0/24 and then update it to add the secondary range.

Answer

Create two subnets: one with 10.0.2.0/24 for primary and another for the secondary range.

Answer

Create an auto mode subnet and let Google Cloud assign the secondary range automatically.

Question 11

A company needs to connect their on-premises data center to Google Cloud with a consistent, high-availability connection that offers 99.99% availability SLA. The on-premises router supports VLAN tagging and BGP. They expect to burst up to 50 Gbps peak traffic. Which interconnect solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, supporting up to 80 Gbps per connection (via 10 or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant links and BGP sessions. The on-premises router's support for VLAN tagging and BGP aligns perfectly with Dedicated Interconnect's requirements for 802.1Q VLANs and eBGP peering, making it the only option that meets the 50 Gbps burst requirement and high-availability SLA.

Answer

Cloud VPN with dynamic routing

Answer

Partner Interconnect

Answer

HA VPN

Question 12

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

Accepted Answer

The VM has a custom route that does not use the default route through Cloud NAT. Cloud NAT relies on the default route (0.0.0.0/0) pointing to the Cloud Router to direct traffic through the NAT gateway. If a VM has a custom route that overrides the default route (e.g., a more specific route to an external IP or a route to a different next hop), the VM's outbound traffic will bypass Cloud NAT entirely, resulting in the source IP being the VM's private IP instead of the Cloud NAT IP. This causes external firewalls to block the traffic as the source IP is not the expected NAT IP.

Answer

The VM is in a different zone than the Cloud NAT gateway

Answer

The VPC firewall rules are blocking outbound traffic from the VM to the Cloud NAT IP

Answer

Cloud Router is misconfigured and not advertising the Cloud NAT IP

Question 13

You are configuring a health check for a backend service that expects gRPC health probing. Which protocol should the health check use to verify gRPC service health?

Accepted Answer

gRPC. gRPC health checks use the gRPC protocol to query the standard gRPC health check endpoint.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 14

A company is deploying a hybrid cloud solution using Partner Interconnect. They have ordered a 1 Gbps connection from a partner at a colocation facility. The on-premises network uses a 10 Gbps link to the colo, and the partner provides a single 1 Gbps connection to Google Cloud. The company wants to connect two separate VPC networks in Google Cloud (production and development) to their on-premises network. Each VPC requires 500 Mbps of dedicated bandwidth. The company also needs high availability for the connection. What should they do?

Accepted Answer

Create two VLAN attachments on the same interconnect, each with 500 Mbps capacity. Configure a separate Cloud Router for each VPC, each with a BGP session on its respective VLAN attachment. Use BGP metrics for active/passive failover.. Partner Interconnect supports multiple VLAN attachments on a single connection, each with its own capacity allocation. By creating two VLAN attachments with 500 Mbps each, you can dedicate bandwidth to each VPC while meeting the 500 Mbps requirement. Using separate Cloud Routers with BGP sessions on each VLAN attachment and adjusting BGP metrics (e.g., local preference) allows active/passive failover for high availability, satisfying both the bandwidth and HA needs without requiring additional physical connections.

Answer

Create a single VLAN attachment, then use a shared VPC with two subnets. Configure one Cloud Router with two BGP sessions, one for each subnet.

Answer

Create one VLAN attachment with 1 Gbps capacity, attach it to both VPCs using a single Cloud Router with two BGP sessions.

Answer

Order two separate 1 Gbps Partner Interconnect connections, one for each VPC, and configure each with a single VLAN attachment.

Question 15

Which of the following is a benefit of using Shared VPC?

Accepted Answer

Centralized network administration and separation from application projects.. Shared VPC allows centralized network administration with separation of application projects.

Answer

Lower cost compared to VPC peering.

Answer

Automatic failover for applications.

Answer

Reduced latency between instances.