PCNE Practice Test 32 — 15 Questions

Question 1

After configuring Cloud VPN with dynamic routing (BGP), you notice that on-premises routes are not appearing in Google Cloud. BGP sessions are established but no prefixes are exchanged. Cloud Router logs show: 'No route advertisement received'. On-premises BGP configuration shows 'network 10.0.0.0/8' and 'neighbor 10.1.1.1 remote-as 65000'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'network 10.0.0.0/8' command does not have a corresponding exact route in the on-premises routing table; also missing 'neighbor 10.1.1.1 activate' under BGP.. The on-premises BGP configuration uses the 'network 10.0.0.0/8' command, which requires an exact match in the local routing table to be advertised. Without a route for 10.0.0.0/8 (e.g., a connected or static route), BGP will not advertise it. Additionally, the 'neighbor 10.1.1.1 activate' command is missing under BGP, which is required to enable the exchange of prefixes with that neighbor. These two issues together prevent route advertisement to Google Cloud.

Answer

The on-premises router's BGP peer IP is not in the same subnet as the Cloud Router's interface.

Answer

The Cloud Router's BGP peer IP is not reachable from the on-premises router.

Answer

The BGP MD5 password is configured incorrectly on the on-premises router.

Question 2

Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?

Accepted Answer

Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.. The preconfigured WAF rule for SQL injection (sqli-stable) uses a default sensitivity level that may be too aggressive, causing false positives on legitimate traffic. By lowering the sensitivity level or excluding specific request attributes (e.g., headers, cookies, or URI paths), you can reduce false positives while still blocking actual SQL injection attempts. Cloud Armor allows fine-tuning of preconfigured rules via the `sensitivity` parameter and `exclude` lists, which is the correct approach here.

Answer

Add a rate-based rule to limit the number of requests per second.

Answer

Create a rule with higher priority to allow the legitimate traffic before the WAF rule.

Answer

Enable TLS inspection for the load balancer to fully inspect encrypted traffic.

Question 3

An engineer needs to configure Cloud Armor to block requests from a specific IP address (10.1.2.3) while allowing all other traffic. They create a security policy with a deny rule for that IP and an allow rule for all traffic. What priority should the deny rule have relative to the allow rule?

Accepted Answer

The deny rule must have a lower priority number than the allow rule. In Cloud Armor, rules are evaluated from lowest to highest priority (lower number = higher priority). The deny rule must have a lower priority number than the allow rule to be evaluated first and block the IP before the allow rule applies. Typically, the allow-all rule has highest priority (e.g., 2147483647).

Answer

Both rules must have the same priority

Answer

Priority does not matter for deny rules

Answer

The deny rule must have a higher priority number than the allow rule

Question 4

A company is migrating an on-premises DNS service to Cloud DNS. They want to resolve on-premises hostnames from GCP VMs and resolve Google Cloud private zone names from on-premises. They have a Cloud VPN with BGP. Which architecture should they implement?

Accepted Answer

Configure a Cloud DNS forwarding zone for on-premises names and a private zone for GCP names. Then create an inbound server policy for on-premises to query Cloud DNS.. Cloud DNS supports inbound server policies that allow on-premises DNS resolvers to forward queries for private zone names (e.g., `gcp.internal`) to Cloud DNS via the Cloud VPN. A forwarding zone in the VPC directs queries for on-premises hostnames (e.g., `corp.example.com`) to the on-premises DNS servers. This bidirectional resolution is achieved without exposing DNS to the internet, leveraging BGP for routing.

Answer

Configure a split-horizon DNS with separate DNS servers for each environment.

Answer

Set up Cloud DNS peering zones between the VPC and on-premises.

Answer

Use DNS over HTTPS from on-premises to Google's public DNS.

Question 5

A company has a VPC with subnets in us-central1 and europe-west1. They need to allow Compute Engine instances in us-central1 (without external IPs) to access Google Cloud Storage buckets in the US multi-region. They also need to ensure the traffic does not traverse the public internet. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Ensure the instances have a service account with permissions to access Cloud Storage. Private Google Access allows instances without external IPs to reach Google APIs. It must be enabled on the subnet. Additionally, the DNS name for Google APIs must resolve to the private IP ranges (199.36.153.4/30 for restricted.googleapis.com) or use the default private Google access IPs. For Cloud Storage, the restricted.googleapis.com VIP is used for Private Google Access if the project is in a VPC Service Controls perimeter; otherwise, the default private Google access IPs work. However, to ensure traffic does not go over the public internet, Private Google Access is sufficient as Google's internal network is used. The second required configuration is to enable Private Google Access on the subnet. No additional DNS changes are needed if using the default DNS (the private Google access IPs are returned automatically).

Answer

Use the private DNS zone for googleapis.com with the restricted.googleapis.com IP addresses

Answer

Configure a firewall rule allowing egress to 0.0.0.0/0

Answer

Create a Cloud NAT gateway in us-central1

Question 6

A company is running workloads on Compute Engine instances without public IP addresses. They need to allow these instances to securely access the internet for software updates. Which Google Cloud service should be configured?

Accepted Answer

Cloud NAT. Cloud NAT (Network Address Translation) allows Compute Engine instances without public IP addresses to initiate outbound connections to the internet for tasks like software updates. It translates the private IP addresses of the instances to a public IP address managed by Google Cloud, enabling secure outbound internet access without exposing the instances to inbound traffic.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering

Question 7

A company has multiple on-premises networks connected to a Cloud VPN hub in GCP. Each on-premises site uses BGP to advertise its prefixes. The security team wants to ensure that only specific prefixes from each site are accepted into the VPC routes. What should they configure?

Accepted Answer

Configure BGP route filtering on the Cloud Router to accept only specific prefixes from each on-premises site.. Cloud Router supports BGP route filtering, allowing you to define inbound route policies that accept only specific prefixes from each on-premises BGP peer. This ensures that only the desired prefixes are installed into the VPC route table, providing granular control over route advertisement acceptance without affecting the VPN tunnel or firewall state.

Answer

Create firewall rules to block traffic from unwanted prefixes.

Answer

Set up a separate VPN tunnel for each prefix.

Answer

Use VPC Service Controls to restrict the prefixes.

Question 8

A company needs to connect multiple branch offices to GCP using Partner Interconnect. They need at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps. Which type of Partner Interconnect should they choose?

Accepted Answer

Single connection with 99.9% SLA. Partner Interconnect offers two SLA tiers: 99.9% for a single connection and 99.99% for dual connections. Since the requirement is at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps, a single connection with 99.9% SLA meets both criteria without the cost and complexity of dual connections.

Answer

Single connection with 99.99% SLA

Answer

Classic VPN

Answer

Dual connection with 99.99% SLA

Question 9

A company has a Dedicated Interconnect connection from their on-premises data center to GCP. They have set up BGP sessions over VLAN attachments to peer with their VPC. Traffic from on-premises to GCP works, but return traffic from GCP to on-premises is dropped at the on-premises firewall. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the on-premises prefix to GCP via BGP.. The most likely cause is that the on-premises router is not advertising the on-premises prefix to GCP via BGP. For return traffic from GCP to be routed correctly, GCP must learn the on-premises network prefix through a BGP advertisement from the on-premises router. Without this advertisement, GCP has no route to send traffic back, causing the firewall to drop the packets as they have no valid path.

Answer

The VLAN attachment is in a different region than the GCP resources.

Answer

A GCP firewall rule is blocking the return traffic.

Answer

The MTU size is inconsistent between the on-premises router and GCP.

Question 10

A Compute Engine instance has multiple network interfaces. Which interface is considered the primary (NIC0)?

Accepted Answer

The interface with the lowest index number (nic0).. By default, the first interface attached (nic0) is the primary interface and used for default routes and internal DNS.

Answer

The interface configured first in the instance creation.

Answer

The interface with the highest index number.

Answer

All interfaces are primary.

Question 11

Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?

Accepted Answer

Create a Private Service Connect service attachment and publish the service.. The producer (VPC-A) must create a Private Service Connect service attachment that publishes the service. This attachment is associated with a load balancer or a service. Option A is incorrect because the endpoint is created in the consumer VPC (VPC-B). Option B is incorrect because VPC peering is not used with Private Service Connect (the services can be across organizations without peering). Option D is incorrect because Private Google Access is unrelated to publishing services.

Answer

Create a Private Service Connect endpoint in VPC-A.

Answer

Enable Private Google Access on the subnet where the service resides.

Answer

Create a VPC peering connection with VPC-B.

Question 12

Which THREE statements about Shared VPC are correct?

Accepted Answer

The Shared VPC admin role can be assigned to manage the host VPC network.. Shared VPC allows service projects to use host VPC subnets, requires same organization, and can be managed via Shared VPC admin role.

Answer

Service projects can delete subnets in the host VPC.

Answer

Service projects can create their own VPCs that peer with the host VPC.

Question 13

A company uses Shared VPC with a host project and several service projects. They want to allow only a specific team to create subnets in the host project, and another team to use those subnets in their service projects. Which IAM roles should be assigned?

Accepted Answer

Compute Network Admin on host project for subnet creators; Compute Network User on host project for subnet users.. To create subnets, a user needs the Compute Network Admin role on the host project. To use subnets, a user needs the Compute Network User role on the host project or specific subnets.

Answer

Compute Network Admin on host project for both teams.

Answer

Compute Shared VPC Admin on host project for subnet creators; Compute Network User on host project for subnet users.

Answer

Compute Network User on host project for subnet creators; Compute Network Admin on service projects for subnet users.

Question 14

Match each network troubleshooting command/tool to its function.

Accepted Answer

ping: Tests reachability of a host and measures round-trip time. Common network troubleshooting tools: ping tests connectivity, traceroute maps the route, nslookup resolves DNS, netstat shows connections. The distractors swap ping and traceroute functions.

Answer

ping: Displays network connections and routing tables

Answer

traceroute: Tests reachability and measures round-trip time

Question 15

A company is deploying a global application on Google Cloud using Cloud Load Balancing. They want to serve traffic from multiple regions and require the lowest possible latency for users worldwide. The application serves HTTP traffic and uses a static IP address. Which load balancing solution should they use?

Accepted Answer

External HTTP(S) Load Balancer with Premium Tier. The External HTTP(S) Load Balancer with Premium Tier is correct because it uses Google's global anycast IP address to route user traffic to the nearest frontend, minimizing latency worldwide. Premium Tier leverages Google's global network backbone, ensuring traffic enters and exits at the closest Google edge point of presence (PoP) for HTTP(S) traffic, which is essential for a global application requiring low latency and a static IP.

Answer

Network Load Balancer

Answer

Internal HTTP(S) Load Balancer

Answer

SSL Proxy Load Balancer