PCNE Practice Test 35 — 15 Questions

Question 1

A startup is deploying its first application on Google Cloud and needs to create a VPC network. They want to avoid manual subnet planning and prefer that Google automatically creates subnets in each region as they expand. Which VPC type should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region with predetermined IP ranges, simplifying initial setup. Custom mode VPCs require manual subnet creation.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 2

You have set up a Dedicated Interconnect with two VLAN attachments (each 10 Gbps) and configured ECMP on the Cloud Router. You observe that traffic from on-premises to a specific VM is only using one attachment. What is the most likely cause?

Accepted Answer

The traffic consists of a single flow that is hashed to one attachment. D is correct because ECMP (Equal-Cost Multi-Path) relies on hashing of packet headers (e.g., 5-tuple: source/destination IP, protocol, source/destination port) to select a path. A single flow (e.g., a TCP connection between two specific IPs and ports) will always hash to the same attachment, so it cannot use both VLAN attachments simultaneously. This is expected behavior, not a fault.

Answer

Route propagation is disabled on one Cloud Router interface

Answer

One of the VLAN attachments has a higher route priority

Answer

BGP ASN mismatch between the two attachments

Question 3

Refer to the exhibit. A VM with the 'ssh-allowed' tag is unreachable via SSH from the internet, while other VMs with the same tag work. What is the most likely cause?

Accepted Answer

A firewall rule with priority 500 denies ingress traffic to the VM's tag or IP range.. The most likely cause is that a firewall rule with priority 500 explicitly denies ingress traffic to the specific VM's tag or IP range, overriding the allow-ssh rule (which has a lower priority, i.e., a higher numerical value). In Google Cloud Platform (GCP), firewall rules are evaluated from lowest to highest priority number, and a deny rule with a lower priority number (e.g., 500) takes precedence over an allow rule with a higher priority number (e.g., 1000). This explains why other VMs with the same 'ssh-allowed' tag remain reachable, as they are not affected by the specific deny rule.

Answer

The rule source range is set to 0.0.0.0/0, which includes all internet IPs, so it should allow SSH.

Answer

The VM is in a different VPC that does not have the allow-ssh rule.

Answer

The firewall rule 'allow-ssh' has a higher priority (1000) than the implicit deny (65535), so it should work.

Question 4

A company wants to analyze firewall rule effectiveness by identifying rules that are never hit or are shadowed. Which Network Intelligence Center tool should be used?

Accepted Answer

Firewall Insights

Answer

Network Topology

Answer

Performance Dashboard

Answer

Connectivity Tests

Question 5

Which TWO network services can be used to provide secure connectivity between a VPC and an on-premises data center without traversing the public internet? (Choose two.)

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (C) provides a direct, private physical connection between your on-premises network and Google's VPC, bypassing the public internet entirely. This ensures low latency, high bandwidth, and consistent network performance for secure hybrid cloud connectivity.

Answer

Cloud VPN with IPsec

Answer

Cloud NAT

Answer

VPC Network Peering

Question 6

A company wants to restrict access to Google Cloud APIs from a specific VPC network so that only the Google APIs listed in the VPC Service Controls perimeter can be accessed. Which configuration should be used?

Accepted Answer

VPC Service Controls with VPC accessible services. VPC Service Controls with VPC accessible services allows you to restrict access to Google APIs from a specific VPC network by defining which services are accessible within the perimeter. This configuration ensures that only the APIs listed in the perimeter can be accessed from the VPC, effectively creating a secure boundary. It is the correct way to limit API access based on the VPC network.

Answer

Private Service Connect

Answer

Private Google Access

Answer

Cloud NAT with a firewall rule

Question 7

A company wants to enable mTLS between microservices in a service mesh managed by Traffic Director. They have deployed Envoy sidecars. What must be configured to enforce mTLS?

Accepted Answer

The mTLS mode in Traffic Director's mesh configuration. Traffic Director, Google Cloud's managed control plane for service mesh, enforces mTLS through its mesh configuration where you explicitly set the mTLS mode (e.g., STRICT or PERMISSIVE). This configuration is pushed to Envoy sidecars, which then handle certificate provisioning and mutual authentication automatically. Without setting the mTLS mode in Traffic Director, the sidecars will not enforce mTLS even if certificates are available.

Answer

An SSL policy on the load balancer

Answer

A VPC Service Controls perimeter

Answer

A Cloud Armor security policy

Question 8

A company wants to connect their on-premises data center to Google Cloud using a site-to-site VPN with dynamic routing. Which protocol should they use for route exchange?

Accepted Answer

BGP. C is correct because Cloud VPN with dynamic routing requires BGP (Border Gateway Protocol) to exchange routes between the on-premises router and the Cloud Router. BGP is the only dynamic routing protocol supported by Google Cloud for site-to-site VPN tunnels, as it allows route advertisement, failover, and policy-based control over multiple tunnels.

Answer

OSPF

Answer

Static routing

Answer

RIP

Question 9

Which load balancer type preserves the client source IP address and can be used for TCP/UDP traffic on a specific port, passing traffic through to backend instances without proxy overhead?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. The Regional External TCP/UDP Network Load Balancer is a Layer 4 (transport layer) load balancer that operates as a pass-through device. Because it does not terminate the connection or act as a proxy, the original client source IP address is preserved and visible to backend instances. It handles TCP and UDP traffic on specific ports and is designed for regional external traffic, making it the correct choice for this scenario.

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global External TCP Proxy Load Balancer

Answer

Global External HTTPS Load Balancer

Question 10

A company with multiple VPCs in a Shared VPC environment wants to connect their on-premises network to all VPCs with high availability and minimal cost. They already have a Dedicated Interconnect. What is the most efficient solution?

Accepted Answer

Use the existing Dedicated Interconnect to create multiple VLAN attachments, one per VPC.. A Dedicated Interconnect can support multiple VLAN attachments (each with a separate VLAN ID and BGP session) to connect to different VPCs in a Shared VPC environment. This approach leverages the existing physical connection, provides high availability through redundant attachments, and minimizes cost by avoiding additional circuits or VPN tunnels.

Answer

Set up Cloud VPN with dynamic routing to each VPC.

Answer

Create an HA VPN gateway for each VPC and peer with on-prem.

Answer

Provision a new Partner Interconnect for each VPC.

Question 11

A company is using Cloud VPN to connect to Google Cloud. They notice that traffic from their on-premises network to Google Cloud is not being routed correctly after a recent change. On the on-premises router, they verify that the BGP session is established and routes are received. Which step should they take next to troubleshoot?

Accepted Answer

Verify that the routes learned via BGP are being propagated to the VPC network by examining Cloud Router details. Since the BGP session is established and routes are received on the on-premises router, the issue is likely that those routes are not being propagated into the VPC network. Cloud Router acts as the BGP speaker for the VPC; even if the VPN tunnel is up and BGP peering is successful, the learned routes must be advertised into the VPC’s routing tables. Verifying Cloud Router details (e.g., using `gcloud compute routers get-status` or checking the Cloud Console) confirms whether the routes are being accepted and propagated, which directly addresses the routing failure.

Answer

Check the on-premises firewall logs

Answer

Disable and re-enable the VPN tunnel

Answer

Check the tunnel status in Cloud Console

Question 12

Refer to the exhibit. What is the purpose of the IP address 169.254.0.1 assigned to the Cloud Router interface?

Accepted Answer

It is a link-local IP address used for BGP sessions between the Cloud Router and the VPN gateway.. The IP address 169.254.0.1 falls within the 169.254.0.0/16 range, which is reserved for link-local addressing (RFC 3927). In Google Cloud, Cloud Routers use link-local addresses for BGP sessions with VPN gateways (both HA VPN and Classic VPN). This address is not routable and is used exclusively for BGP peering between the Cloud Router and the VPN gateway, ensuring that the BGP session operates over the VPN tunnel without conflicting with other IP assignments.

Answer

It is the public IP address of the VPN gateway.

Answer

It is a private IP address for BGP peering with the on-premises router.

Answer

It is the management IP address of the Cloud Router.

Question 13

An organization needs to serve a TCP-based application globally with low latency but without SSL termination. Which load balancer should they use?

Accepted Answer

Global TCP Proxy Load Balancer. Global TCP Proxy Load Balancer is designed for non-SSL TCP traffic and provides global anycast IP.

Answer

Global HTTPS Load Balancer

Answer

Global SSL Proxy Load Balancer

Answer

Regional External TCP/UDP Network Load Balancer

Question 14

Which TWO of the following are valid reasons to use a Shared VPC architecture?

Accepted Answer

To prevent individual projects from creating their own VPCs and force them to use a common VPC. Option C is correct because Shared VPC lets an organization designate a host project whose VPC network is shared with attached service projects, and IAM policies on the host project can restrict service projects from creating or using their own VPC networks, effectively centralizing network control. Option D is correct because Shared VPC is designed exactly for this split of duties: the central network team owns and manages subnets, firewall rules, and routes in the host project, while application teams deploy resources such as Compute Engine instances into those shared subnets from their own service projects. The unmarked options do not belong: A is wrong because Shared VPC does not inherently reduce latency—regional placement and network topology determine latency, not the sharing model. B is wrong because Shared VPC is an intra-organization GCP construct and does not replace VPN or VPC peering for connecting separate networks or organizational units. E is wrong because egress charges depend on traffic destination and SKUs, not on whether resources live in a shared VPC.

Answer

To reduce latency by placing resources in the same region within a single VPC

Answer

To improve network connectivity between different organizational units without using VPN or peering

Answer

To reduce egress costs by having all resources in one VPC

Question 15

A company hosts a web application on Cloud Run and wants to serve content from a Cloud Storage bucket for static assets. They plan to use a global HTTPS load balancer with a URL map to route requests. Which backend type should they configure for the static content?

Accepted Answer

Backend bucket (Cloud Storage bucket). A backend bucket is a Google Cloud load balancing backend that points directly to a Cloud Storage bucket, allowing the global HTTPS load balancer to serve static content from that bucket. This is the correct backend type for serving static assets from Cloud Storage via a URL map.

Answer

Serverless NEG (Cloud Run)

Answer

Zonal NEG (Compute Engine)

Answer

Internet NEG (external endpoint)