PCNE Practice Test 33 — 15 Questions

Question 1

A company has a VPC with multiple subnets. They want to restrict traffic between two specific subnets (10.0.1.0/24 and 10.0.2.0/24) while allowing all other traffic. They create a firewall rule with priority 1000 denying ingress from 10.0.1.0/24 to 10.0.2.0/24. However, traffic is still allowed. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

There is a higher priority allow rule that matches the traffic. In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence. A rule with priority 1000 is evaluated after any rule with a priority lower than 1000 (e.g., priority 65535 is the default allow rule). If a higher priority (lower number) allow rule exists that matches the same traffic, it will override the deny rule. The default VPC firewall rules include an implicit allow rule for egress and an ingress allow rule for traffic within the same VPC, which may have a higher priority than 1000, thus permitting the traffic despite the deny rule.

Answer

The rule is incorrectly applied to the wrong network tag

Answer

The traffic is going through the metadata server

Answer

Firewall rules are stateless, so return traffic is blocked

Question 2

A company uses VPC Service Controls with a service perimeter that includes Project A. They want to allow an external identity from Project B (outside the perimeter) to access a Cloud Storage bucket in Project A, but only during business hours. Which VPC Service Controls feature should they use?

Accepted Answer

Access levels with time constraint and an ingress rule. VPC Service Controls use access levels (e.g., based on IP, time) and ingress rules to allow traffic from outside the perimeter. Ingress rules define which identities and resources can access perimeters.

Answer

Egress rules with IP whitelisting

Answer

Cloud Armor geoblocking

Answer

Private Google Access

Question 3

Which TWO of the following are benefits of using Cloud NAT?

Accepted Answer

Enables outbound traffic from instances without public IPs. Cloud NAT enables outbound connectivity from private instances that lack public IP addresses. It translates private source IPs to a single or a pool of external IPs, allowing instances to reach the internet while remaining unreachable from outside. This is essential for security and compliance in VPC networks.

Answer

Supports static IP addresses for all instances

Answer

Provides inbound port forwarding

Answer

Automatically scales with the number of instances

Question 4

You are configuring Cloud Router for BGP sessions with an on-premises router. You need to ensure that the on-premises network can reach Google Cloud services using the advertiser’s IP addresses. Which option should you configure on the Cloud Router?

Accepted Answer

Advertise all subnets visible by the Cloud Router. Cloud Router must advertise all subnets visible to it to ensure that the on-premises router learns the IP prefixes for Google Cloud services (e.g., Google APIs, GKE control planes) that are reachable via Private Google Access or Private Service Connect. By default, Cloud Router only advertises VPC subnet routes; enabling 'Advertise all subnets visible by the Cloud Router' includes custom IP ranges and service producer ranges, allowing the on-premises network to route traffic to those services using the advertiser's IP addresses.

Answer

Set the global routing mode

Answer

Configure custom route exchange in VPC Peering

Answer

Enable VPC Flow Logs

Question 5

A company is designing a highly available hybrid network using HA VPN. They need to ensure that if one VPN tunnel fails, traffic automatically fails over to the other tunnel. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable BGP on both tunnels. HA VPN requires two tunnels from two interfaces, each with its own external IP, and BGP sessions on both tunnels. The on-premises side must also have two separate peer IPs.

Answer

Configure static routes for failover

Answer

Configure both tunnels with the same peer IP address on the on-premises side

Answer

Use the same pre-shared key for both tunnels

Question 6

An enterprise is evaluating connectivity options to Google Cloud. They have moderate bandwidth requirements (up to 1 Gbps) and need high availability. Which two of the following are appropriate solutions? (Choose two.)

Accepted Answer

HA VPN over the internet.. HA VPN (High-Availability VPN) uses two tunnels to two separate Cloud VPN gateways, providing automatic failover and meeting the 99.99% SLA when configured with dynamic routing (BGP). This solution supports up to 3 Gbps per tunnel pair, easily covering the 1 Gbps requirement, and uses the public internet without needing physical cross-connects.

Answer

VPC peering with a third-party network.

Answer

Classic VPN with a single tunnel.

Answer

Dedicated Interconnect with 10 Gbps connections.

Question 7

An organization has multiple VPCs in Google Cloud that need to communicate with an on-premises network through a single Dedicated Interconnect. All VPCs are in the same project. What is the most efficient way to enable connectivity from all VPCs to on-premises?

Accepted Answer

Create a Cloud Router per VPC, each with its own VLAN attachment on the same Interconnect. Each VPC requires its own Cloud Router and VLAN attachment to establish a dedicated BGP session over the same Dedicated Interconnect. This allows multiple VPCs in the same project to share a single physical interconnect while maintaining separate Layer 3 routing domains. A single VLAN attachment cannot be shared across VPCs, as each attachment is associated with exactly one Cloud Router and one VPC.

Answer

Create a separate Interconnect for each VPC

Answer

Create a single VLAN attachment and use it for all VPCs

Answer

Use VPC Network Peering to connect VPCs and attach one VPC to Interconnect

Question 8

A global company has multiple on-premises data centers connected to Google Cloud via separate Dedicated Interconnects. Each on-premises site advertises the same IP prefix for a critical application. They want to ensure that traffic from Google Cloud to that prefix is load-balanced across the two interconnects and also provide automatic failover. Which configuration on Cloud Router meets this requirement?

Accepted Answer

Ensure on-premises routers advertise the prefix with the same AS_PATH length and MED. To load-balance and provide failover, you need equal-cost multi-path (ECMP) routing. Cloud Router supports ECMP only when the routes have the same MED and AS_PATH length. Setting both on-premises routers to advertise with the same attributes allows ECMP.

Answer

Configure Cloud Router with the same MED value for both paths

Answer

Use BGP multipath on Cloud Router with 'maximum-paths' set to 2

Answer

Enable 'set-community' on the on-premises routers to mark routes equally

Question 9

An organization wants to use Shared VPC but restrict access to certain subnets for specific service projects. Which GCP feature should they use?

Accepted Answer

Subnet-level IAM bindings. Subnet-level IAM bindings allow you to grant roles (e.g., compute.networkUser) on specific subnets within a Shared VPC to service project principals. This restricts access to only those subnets, while the service project can still use the shared network. It is the native GCP mechanism for fine-grained subnet access control in a Shared VPC environment.

Answer

VPC Network Peering

Answer

VPC Service Perimeters

Answer

Firewall rules

Question 10

Which TWO are necessary components for setting up Dedicated Interconnect? (Choose two.)

Accepted Answer

A Cloud Router in the same region as the VLAN attachment. A Cloud Router is required in the same region as the VLAN attachment to enable dynamic routing (BGP) between your on-premises network and Google Cloud VPC. The VLAN attachment must be mapped to a VPC to define which VPC network the interconnect circuit connects to, allowing traffic to flow between your on-premises network and Google Cloud resources.

Answer

A Cloud VPN tunnel for management traffic

Answer

A QoS policy to ensure bandwidth guarantee

Answer

Two physical interconnect connections for redundancy

Question 11

A large multinational corporation uses a Shared VPC in Google Cloud with multiple service projects. They have a central Cloud NAT configured in the host project in the us-central1 region to provide internet egress for all VMs. Recently, the IT team added a new subnet (10.0.10.0/24) in a service project and deployed VMs there. All other VMs in the same project but in different subnets (e.g., 10.0.1.0/24) can reach the internet, but the new VMs in 10.0.10.0/24 cannot. The Cloud NAT gateway is configured in us-central1 with all IP ranges allowed. The VPC firewall rules allow egress traffic to the internet. The team verified that the VMs have a default route (0.0.0.0/0) with next-hop 'default-internet-gateway' and that the Cloud NAT router's NAT IPs are properly assigned. However, the new subnet's VMs are unable to connect to any external IP. The network engineer suspects that the Cloud NAT's NAT reservations might be the issue, but all NAT IPs are ephemeral. Further investigation shows that the Cloud Router used by Cloud NAT is advertising custom IP ranges via BGP to an on-premises router for a different use case. What is the most likely cause and solution?

Accepted Answer

Remove the new subnet range (10.0.10.0/24) from the custom advertised routes on the Cloud Router associated with the Cloud NAT.. The Cloud Router associated with Cloud NAT is advertising custom IP ranges via BGP to an on-premises router. If the new subnet range (10.0.10.0/24) is included in those custom advertised routes, the on-premises router may advertise a more specific route back to the VPC, causing the VMs in that subnet to prefer the on-premises route over the default route (0.0.0.0/0) for internet-bound traffic. Since the on-premises router does not have internet access, the traffic is blackholed. Removing the subnet range from the custom advertised routes on the Cloud Router resolves the issue by ensuring the default route remains the preferred path for internet egress.

Answer

Add a static route for 0.0.0.0/0 with next-hop set to the Cloud NAT gateway's IP address in the VPC.

Answer

Update the VPC firewall rules to explicitly allow egress traffic from the new subnet's IP range to 0.0.0.0/0.

Answer

Reserve static NAT IPs for the new subnet in the Cloud NAT configuration to ensure that the VMs have a consistent egress IP.

Question 12

A global application uses a global external HTTPS load balancer with backend NEGs in multiple regions. The content is static and must be cached at edge locations to reduce latency. Which GCP service should be enabled?

Accepted Answer

Cloud CDN. Cloud CDN is the correct service because it leverages Google's global edge cache network to cache static content from an external HTTPS load balancer with backend NEGs. When enabled, Cloud CDN intercepts requests at edge locations and serves cached responses, reducing latency and offloading origin servers. This directly addresses the requirement to cache static content at edge locations for a global application.

Answer

Cloud Storage

Answer

Cloud NAT

Answer

Cloud Memorystore

Question 13

A network engineer is troubleshooting an HA VPN setup between Google Cloud and an on-premises data center. The two tunnels are established, and BGP sessions are up on both tunnels. However, traffic from Google Cloud to the on-premises network is only using one tunnel, even though both BGP sessions are advertising the same routes. What is the most likely cause?

Accepted Answer

The on-premises router is sending different BGP metrics (MED) for the same route on the two BGP sessions.. When both BGP sessions are up and advertising the same routes, but traffic only uses one tunnel, the most likely cause is that the on-premises router is sending different Multi-Exit Discriminator (MED) values for the same route on the two BGP sessions. MED is a metric that influences inbound traffic to an AS; a lower MED value is preferred. If one tunnel's BGP update carries a lower MED, Google Cloud's Cloud Router will select that path for all traffic, even though both tunnels are functional.

Answer

The Cloud Router is not configured for dynamic routing.

Answer

One of the IPsec tunnels is in a dead state.

Answer

The on-premises router is setting a higher local preference on one route.

Question 14

Your company is deploying a multi-tier web application on Google Kubernetes Engine (GKE) with a regional cluster. You need to design network policies to allow traffic only from the frontend pods to the backend pods on port 8080. Which of the following is the most secure and recommended approach?

Accepted Answer

Define a Kubernetes NetworkPolicy that allows ingress to backend pods from frontend pods on port 8080.. A Kubernetes NetworkPolicy is the native and most secure way to control pod-to-pod traffic within a GKE cluster. By defining an ingress rule that allows traffic only from frontend pods (selected via pod labels) to backend pods on TCP port 8080, you enforce micro-segmentation at the pod level, which is the recommended practice for multi-tier applications. This approach works regardless of the underlying node or VPC configuration and is fully integrated with GKE's network policies engine (Calico or Cilium).

Answer

Configure Private Service Connect to restrict access to backend pods.

Answer

Create VPC firewall rules to allow ingress from frontend pods to backend pods on port 8080.

Answer

Use Cloud Armor security policies to restrict traffic to backend pods.

Question 15

A company has two Dedicated Interconnects in different metro regions connecting to Google Cloud. They want to use BGP communities to influence Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises. Which community action can they apply on the on-premises routers?

Accepted Answer

Set BGP community 79ba:100 on routes from the preferred interconnect. Google Cloud uses 16-bit ASN format for BGP communities, and the well-known community 79ba:100 (equivalent to 31210:256 in decimal) is a Google-defined community that sets a higher local preference on routes received from the preferred interconnect. This influences Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises, as higher local preference is evaluated before MED or AS-path length.

Answer

Set BGP community 2:100 on routes to indicate MED change

Answer

Set BGP community 0:100 on routes to mark them as high preference

Answer

Set BGP community 79ba:101 on routes from the preferred interconnect