PCNE Practice Test 32 — 15 Questions

Question 1

A company is using Cloud NAT to allow private VMs to access the internet. They want to troubleshoot connectivity failures and analyze connection attempts that were dropped due to NAT resource exhaustion. What should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud NAT logging. Cloud NAT logging records NAT allocation events, including dropped connections due to port exhaustion, and provides detailed error reasons. Enabling it is the correct way to analyze connection attempts that failed because NAT resources were exhausted. Other log types do not capture NAT-level translation or exhaustion details.

Answer

VPC Flow Logs on the subnet

Answer

Firewall rule logging

Answer

Packet Mirroring

Question 2

A company is migrating an on-premises DNS service to Cloud DNS. They want to resolve on-premises hostnames from GCP VMs and resolve Google Cloud private zone names from on-premises. They have a Cloud VPN with BGP. Which architecture should they implement?

Accepted Answer

Configure a Cloud DNS forwarding zone for on-premises names and a private zone for GCP names. Then create an inbound server policy for on-premises to query Cloud DNS.. Cloud DNS supports inbound server policies that allow on-premises DNS resolvers to forward queries for private zone names (e.g., `gcp.internal`) to Cloud DNS via the Cloud VPN. A forwarding zone in the VPC directs queries for on-premises hostnames (e.g., `corp.example.com`) to the on-premises DNS servers. This bidirectional resolution is achieved without exposing DNS to the internet, leveraging BGP for routing.

Answer

Configure a split-horizon DNS with separate DNS servers for each environment.

Answer

Set up Cloud DNS peering zones between the VPC and on-premises.

Answer

Use DNS over HTTPS from on-premises to Google's public DNS.

Question 3

Which TWO considerations are important when designing a VPC peering strategy between multiple projects in Google Cloud?

Accepted Answer

Subnet IP ranges in peered VPCs must not overlap. Option B is correct because VPC peering in Google Cloud requires that the subnet IP ranges of the two peered VPC networks do not overlap; if any subnet CIDR ranges overlap, the peering cannot be established. Option E is correct because, although peering does not automatically exchange custom routes, you can configure the peering to import and export custom routes (via the importCustomRoutes and exportCustomRoutes settings), allowing dynamic route exchange between peered VPCs. Option A is incorrect because VPC peering is non-transitive: if VPC A peers with VPC B and VPC B peers with VPC C, A cannot reach C through B unless separate peering is established. Option C is incorrect because firewall rules are enforced at the VPC network level and do not automatically apply across peered VPCs; each VPC's firewall rules govern only its own resources. Option D is incorrect because VPC peering can be established between VPC networks in different projects, which is a common multi-project design pattern.

Answer

Peering is transitive by default

Answer

Firewall rules in one VPC automatically apply to peered VPCs

Answer

VPC peering can only be used within the same project

Question 4

A company wants to use Cloud DNS to distribute traffic across multiple regional endpoints with failover: primary in us-central1, secondary in us-west1. If the primary health check fails, traffic should go to secondary. Which routing policy should they use?

Accepted Answer

Failover routing policy. Failover routing policy allows specifying primary and secondary targets with health checks. Geolocation and weighted round robin do not provide failover behavior.

Answer

Geolocation routing policy

Answer

Weighted round robin routing policy

Answer

Simple routing policy (A record)

Question 5

An organization needs DNS resolution for on-premises hosts to resolve GCP private zone names (e.g., myinstance.gcp.internal). They have Cloud DNS private zones in GCP. Which Cloud DNS feature should they configure to forward queries from on-premises to GCP?

Accepted Answer

Inbound DNS forwarding. Cloud DNS inbound server policy enables on-premises DNS resolvers to forward queries to Cloud DNS for resolution of private zones. This is the appropriate feature for on-premises to GCP DNS resolution.

Answer

Split-horizon DNS

Answer

DNS peering

Answer

Outbound DNS forwarding

Question 6

A company wants to deploy an HTTP application on Compute Engine instances in us-east1 and europe-west1, and use a global external HTTP(S) load balancer. How should they configure the backend?

Accepted Answer

Create one backend service and add two instance groups, one from each region.. A global external HTTP(S) load balancer requires a single backend service that can span multiple regions. By adding one instance group from us-east1 and another from europe-west1 to the same backend service, the load balancer automatically routes traffic to the closest healthy backend based on the client's geographic location and the load balancer's anycast IP. This configuration leverages Google's global network infrastructure for optimal latency and failover.

Answer

Create a regional load balancer in each region and use DNS round-robin.

Answer

Create one backend service and add one instance group with instances in both regions.

Answer

Create two backend services, one per region, and attach to the same URL map.

Question 7

Which THREE of the following are benefits of using VPC Flow Logs?

Accepted Answer

Compliance and audit requirements.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packets, bytes, accept/reject) for ENIs, subnets, or VPCs, which directly supports compliance and audit requirements (A) by providing an immutable record of network activity for auditors and forensic review. They are also a primary troubleshooting tool (B) because the ACCEPT/REJECT action field lets you pinpoint security group, NACL, or routing problems causing connectivity failures. In addition, flow logs help detect DDoS attacks (C) by revealing abnormal traffic patterns such as massive volumes of REJECTed packets or traffic from unusual source IPs that indicate a flood. Option D is wrong because flow logs are passive metadata records and do not alter routing, bandwidth, or latency. Option E is wrong because flow logs are delivered to CloudWatch Logs or S3 with aggregation intervals of up to 10 minutes, so they are near-real-time at best, not real-time network monitoring.

Answer

Reducing network latency.

Answer

Real-time network monitoring.

Question 8

A network engineer needs to ensure that Compute Engine instances without external IP addresses can access Google APIs such as BigQuery and Cloud Storage. Which feature should be enabled on the subnet where the instances reside?

Accepted Answer

Private Google Access. Private Google Access allows Compute Engine instances without external IP addresses to reach Google APIs and services (BigQuery, Cloud Storage, etc.) using internal IP addresses. It is enabled at the subnet level and routes traffic to Google's private API endpoints without requiring a NAT or external IP.

Answer

Private Service Connect

Answer

VPC Service Controls

Answer

Cloud NAT

Question 9

A developer wants to SSH into a Compute Engine instance that has no public IP. Which service should they use?

Accepted Answer

Identity-Aware Proxy (IAP) TCP forwarding.. Identity-Aware Proxy (IAP) TCP forwarding allows secure, authenticated, and authorized SSH access to Compute Engine instances that have no public IP addresses. It works by establishing a tunnel through the IAP service, which proxies the SSH connection over HTTPS (port 443) to the instance's internal IP, eliminating the need for a public IP or bastion host.

Answer

Direct Peering.

Answer

Cloud NAT.

Answer

Cloud VPN.

Question 10

A company is setting up HA VPN between GCP and an on-premises network. They need to configure two VPN tunnels for high availability. Which of the following is required for the HA VPN gateway?

Accepted Answer

Two external IP addresses, one for each interface.. An HA VPN gateway has two interfaces, each with its own external IP address. This allows two tunnels to be established for redundancy.

Answer

A single external IP address shared by both interfaces.

Answer

A Cloud Router with BGP enabled on both tunnels.

Answer

A dedicated interconnect circuit.

Question 11

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

Accepted Answer

Traffic is taking one tunnel for outbound and the other for return, causing stateful firewall to drop packets.. The most likely cause is asymmetric routing, where outbound traffic from GCP to on-premises takes one VPN tunnel while return traffic takes the other. Stateful firewalls track connection state based on the first packet seen; if return packets arrive via a different tunnel (and thus a different source IP or interface), the firewall does not recognize them as part of an existing session and drops them. This is a classic symptom of asymmetric routing with multiple BGP sessions over separate tunnels.

Answer

BGP keepalive timers are set too low, causing session flapping.

Answer

The MTU is mismatched between the tunnels.

Answer

The on-premises router is not receiving the VPC routes via BGP.

Question 12

A company has multiple projects that each need their own administrative control but must share a common VPC network. Which networking solution should they use?

Accepted Answer

Use Shared VPC with the host project and attach service projects.. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling centralized control of the network while maintaining administrative isolation for each project. The host project owns the VPC and firewall rules, and service projects can use subnets within that VPC, meeting the requirement for separate administrative control with a shared network.

Answer

Create a single VPC in one project and grant all users access to that project.

Answer

Create separate VPCs for each project and connect via Cloud VPN.

Answer

Create a VPC in each project and peer them all together.

Question 13

A company is designing a VPC network to support multiple projects that require isolation but also need to communicate with a shared services project. Which approach should the company use to minimize administrative overhead while ensuring isolation?

Accepted Answer

Implement a Shared VPC in the host project and attach all service projects to it.. A Shared VPC (XPN) allows an organization to connect resources from multiple service projects to a common host project's VPC network, enabling isolated projects to communicate with shared services while centralizing network administration. This minimizes administrative overhead because network policies, firewall rules, and routing are managed in one place, and service projects do not need to manage their own VPC infrastructure.

Answer

Assign all projects to a single VPC with separate subnets for each project.

Answer

Use dedicated VPCs for each project and connect via Cloud VPN tunnels.

Answer

Create a separate VPC for each project and peer them with the shared services VPC.

Question 14

A security engineer wants to allow SSH access to a VM that has no external IP. The VM is in a VPC with IAP configured. What is the simplest way to enable secure SSH without a bastion host?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding with the gcloud compute start-iap-tunnel command.. Identity-Aware Proxy (IAP) TCP forwarding allows secure SSH access to a VM without an external IP by tunneling traffic through the IAP service. The `gcloud compute start-iap-tunnel` command establishes an encrypted tunnel from your local machine to the VM via the IAP proxy, using the VM's internal IP and port 22. This eliminates the need for a bastion host or public IP while leveraging IAP's identity-based access controls.

Answer

Create a VPN tunnel to the VPC and SSH over the VPN.

Answer

Configure a SOCKS proxy on a bastion host.

Answer

Assign an external IP to the VM and use a firewall rule to restrict access.

Question 15

Refer to the exhibit. A company has enabled Private Google Access on the subnet. What effect does this have on VMs in the subnet?

Accepted Answer

VMs can access Google services using only internal IPs. Private Google Access enables VMs in a subnet that have only internal IP addresses (RFC 1918) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through Google's internal network. The traffic is routed via the default internet gateway (which does not require an external IP on the VM) and uses a special 0.0.0.0/0 route with next hop 'default internet gateway' to reach Google's external IPs, but the VM itself never needs a public IP. This is why D is correct: VMs can access Google services using only internal IPs.

Answer

VMs can use external IPs to access Google services

Answer

VMs can access the internet using Cloud NAT

Answer

VMs can communicate with each other without firewall rules