PCNE Practice Test 33 — 15 Questions

Question 1

A company uses Cloud Armor to protect its HTTP(S) load balancer. They need to block requests from a specific geographic region and also apply a rate limiting rule. What is the correct order of evaluation for Cloud Armor security policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Evaluate rules in priority order; the first matching rule determines the action.. Cloud Armor security policies evaluate rules in priority order, and the first rule that matches the request determines the action (allow or deny). This means that if a rate limiting rule matches first, it will be applied, and subsequent rules are not evaluated. Option C correctly describes this behavior.

Answer

Rate limiting rules are evaluated separately from other rules.

Answer

Evaluate rules in priority order and apply all matching rules.

Answer

Evaluate all rules and apply the most restrictive action.

Question 2

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

Accepted Answer

Enable IP forwarding on the VPN appliance VM instance.. A third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.

Answer

Create a custom route in the VPC pointing to the VPN appliance's internal IP.

Answer

Enable Private Google Access on the subnet hosting the VPN appliance.

Answer

Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.

Question 3

A company uses a shared VPC with multiple service projects. They want to connect their on-premises data center to the shared VPC through a Dedicated Interconnect. Where should they configure the Cloud Router and VLAN attachment?

Accepted Answer

In the host project of the shared VPC. In a shared VPC architecture, the Cloud Router and VLAN attachment for Dedicated Interconnect must be configured in the host project because the host project owns the VPC network and manages all network resources, including interconnect attachments. Service projects consume subnets from the host project but cannot create or manage interconnect resources. This ensures that the on-premises connectivity is centrally managed and that all service projects can use the interconnect through the shared VPC's routing.

Answer

In the same region as the majority of service project instances

Answer

In a global resource policy, cross-project

Answer

In the service project that will use the connectivity

Question 4

A company wants to ensure that only traffic from specific source IP ranges can reach a Cloud Load Balancer. How should they enforce this?

Accepted Answer

Configure Cloud Armor with IP allowlist.. Cloud Armor is a web application firewall (WAF) that can be attached to a Cloud Load Balancer to filter incoming traffic based on IP addresses, including allowlisting specific source IP ranges. This directly meets the requirement to restrict access to the load balancer by source IP without affecting backend instance configurations.

Answer

Use IAP.

Answer

Set up Cloud NAT.

Answer

Use VPC firewall rules on the load balancer's backend.

Question 5

Refer to the exhibit. Users report that HTTP (port 80) traffic is still reaching instances in my-vpc despite the deny-all rule. What is the most likely reason?

Accepted Answer

A default firewall rule allowing HTTP exists with a higher priority.. In Google Cloud Platform (GCP), firewall rules are evaluated in order of priority, with lower numbers having higher priority. The default-allow-http rule has a priority of 1000, which is higher (lower number) than the deny-all rule's priority of 2000. Therefore, HTTP traffic is allowed by the default rule before the deny rule is evaluated, causing HTTP traffic to still reach instances.

Answer

The allow-ssh rule has priority 1000 and is evaluated before the deny rule.

Answer

The deny-all rule does not specify target tags.

Answer

The deny-all rule has priority 2000, which is higher than the allow rule.

Question 6

A company uses Shared VPC with multiple service projects. The network admin wants to restrict access to certain Compute Engine instances so that only specific service accounts can SSH into them. What is the best practice to achieve this?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding with IAM conditions restricting which service accounts can use IAP.. Identity-Aware Proxy (IAP) TCP forwarding allows SSH access to Compute Engine instances without exposing them to the public internet. By combining IAP with IAM conditions, the network admin can restrict which service accounts are permitted to use IAP, thereby controlling SSH access at the identity level rather than relying on source IP addresses. This approach aligns with Google Cloud's best practice for zero-trust network security.

Answer

Configure firewall rules that allow SSH only from source IP ranges of the allowed service accounts.

Answer

Use Organization Policies to restrict SSH access.

Answer

Use VPC Service Controls with a service perimeter.

Question 7

An organization uses Partner Interconnect to connect their on-premises network to Google Cloud. They are experiencing intermittent connectivity issues and suspect the partner service provider is causing the problem. Which Google Cloud tool or feature can help verify the connection status and performance from the Google Cloud side?

Accepted Answer

Cloud Interconnect monitoring. Cloud Interconnect monitoring provides detailed metrics and status information for Partner Interconnect connections, including VLAN attachment health, throughput, and packet loss. This tool allows you to verify connectivity and performance from the Google Cloud side, helping isolate issues that may originate from the partner service provider.

Answer

Cloud Router logs

Answer

Network Service Tiers

Answer

VPC flow logs

Question 8

A company wants to use Cloud CDN to serve content from a custom origin that is not hosted on Google Cloud. They have enabled Cloud CDN with a backend bucket pointing to an external origin URL. However, content is not being cached. What is a likely reason?

Accepted Answer

The origin does not return Cache-Control or Expires headers.. Cloud CDN only caches responses that include explicit caching directives. If the external origin returns content without Cache-Control or Expires headers, Cloud CDN treats the response as non-cacheable and passes it through to the client without storing it. Enabling Cloud CDN on a backend bucket alone does not force caching — the origin must signal cacheability.

Answer

The custom origin does not support HTTPS.

Answer

The origin is not configured in the backend bucket as an internet NEG.

Answer

The load balancer is a Global TCP Proxy, not HTTP.

Question 9

A network engineer is troubleshooting connectivity from a Compute Engine instance in subnet-a to a Google Cloud Storage bucket. The instance has no external IP address. Based on the exhibit, what is the most likely cause of the connectivity issue?

Accepted Answer

Private Google Access is disabled on the subnet.. The instance has no external IP address, so it must use Private Google Access to reach Google APIs and services like Cloud Storage. Private Google Access is enabled at the subnet level; if it is disabled, the instance cannot route traffic to the Google API VIPs through the default route (0.0.0.0/0) without a NAT gateway or external IP. Option B correctly identifies this as the most likely cause.

Answer

The subnet purpose is PRIVATE, which blocks Google APIs.

Answer

The subnet CIDR range is too small.

Answer

Flow logs are disabled, so traffic is not logged.

Question 10

A network engineer is setting up Dedicated Interconnect and sees the output above. What does the 'encryption: IPSEC' field indicate about this VLAN attachment?

Accepted Answer

Traffic over this VLAN attachment is encrypted using IPsec. The 'encryption: IPSEC' field in the VLAN attachment output for Dedicated Interconnect indicates that traffic traversing this attachment is encrypted using IPsec. This is a feature of Google Cloud's Dedicated Interconnect that allows you to enable IPsec encryption on the VLAN attachment itself, providing confidentiality and integrity for data in transit without requiring a separate Cloud VPN tunnel.

Answer

The attachment is using Cloud VPN as the underlying transport

Answer

The attachment requires a Cloud VPN tunnel in addition to the Interconnect

Answer

The attachment is using MACsec encryption at layer 2

Question 11

A large enterprise is migrating to Google Cloud and needs to establish connectivity between on-premises and VPCs in two different regions (us-east1 and europe-west1). They have a single Partner Interconnect connection at a co-location facility in New York. They want to use the same interconnect for both regions. Which configuration should they use?

Accepted Answer

Create two VLAN attachments, one for each region, over the same interconnect. A is correct because a single Partner Interconnect connection can support multiple VLAN attachments, each associated with a different region. By creating two VLAN attachments over the same interconnect—one for us-east1 and one for europe-west1—the enterprise can route traffic from the on-premises network to both VPCs using the same physical link, leveraging Google Cloud's support for multiple VLAN attachments per interconnect.

Answer

Create one VLAN attachment and attach it to both VPCs

Answer

Use HA VPN over the interconnect to connect both regions

Answer

Create two Cloud VPN tunnels from on-prem to each VPC

Question 12

A company has a GKE cluster that needs to be accessed by pods and services. The cluster is deployed in a VPC with a primary subnet 10.0.0.0/16. To avoid IP exhaustion, they want to use separate IP ranges for pods and services. Which approach should they take?

Accepted Answer

Create secondary IP ranges on the subnet for pods and services.. GKE supports secondary IP ranges for pods and services, which are defined on the subnet and allocated separately from the primary range.

Answer

Use a separate VPC for the GKE cluster with its own subnet.

Answer

Use the primary subnet range for pods and create a separate subnet for services.

Answer

Use alias IP ranges on the VM instances for pods and services.

Question 13

A security engineer wants to monitor and analyze traffic to a load-balanced web application. Which TWO services can provide detailed logs of HTTP requests and responses?

Accepted Answer

HTTP Load Balancer access logs. HTTP Load Balancer access logs (option A) are correct because they capture detailed per-request data for HTTP(S) traffic handled by the load balancer, including request URL, response status, latency, and client/server bytes. Cloud Armor request logs (option E) are correct because Cloud Armor is attached to the HTTP(S) load balancer and logs each request it evaluates, including matched security policies, rule outcomes, and request details. Cloud NAT logging (option B) only records NAT translations and connection metadata, not HTTP request/response content. VPC Flow Logs (option C) capture IP-level flow metadata (5-tuple, bytes, packets) but not HTTP-layer details. Firewall Rules logging (option D) records allow/deny decisions for firewall rules, not HTTP request and response payloads.

Answer

Cloud NAT logging

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Question 14

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Accepted Answer

Service perimeter. Option C, the service perimeter, is the core VPC Service Controls resource that defines the security boundary around the project's BigQuery datasets and enforces restrictions on data exfiltration. Option D, the VPC accessible services configuration, is required to specify which services (such as BigQuery) inside the perimeter are reachable from the designated VPC network, allowing that network's traffic to reach the protected resources. Option E, the access level, is needed to define the conditions (for example, based on user identity or context) that grant the specified users access to the perimeter's services. Options A and B are not required: a Cloud NAT gateway only provides outbound internet access for private instances and is unrelated to perimeter access control, while Private Google Access only lets VM instances without external IPs reach Google APIs and does not itself define perimeter membership or access conditions.

Answer

Cloud NAT gateway

Answer

Private Google Access

Question 15

A company is planning to migrate its on-premises workloads to Google Cloud. They have a few dedicated servers that need to be reachable from the internet via specific public IPs. Which TWO options should they consider to assign static public IP addresses to their Compute Engine instances? (Choose 2.)

Accepted Answer

Promote an existing ephemeral external IP address to static.. Option A is correct because Compute Engine allows you to promote an ephemeral external IP that is already attached to an instance to a static external IP address, preserving the same public IP for long-term use. Option B is correct because you can reserve a new static external (regional) IP address in the project and then assign it to the instance's network interface, which is the standard way to give an instance a fixed public IP. Option C is incorrect because a static internal IP is only routable inside the VPC and cannot serve as a public IP via DNS. Option D is incorrect because Cloud NAT provides outbound internet access with a static NAT IP for egress, not inbound reachability to instances. Option E is incorrect because internal IP addresses are private and cannot be made public by firewall rules; firewalls control traffic, not address translation.

Answer

Assign a static internal IP address and use it as the public IP via DNS.

Answer

Configure Cloud NAT to assign a static IP for inbound traffic.

Answer

Use the instance's internal IP address as the public IP by configuring the VPC firewall.