PCNE Practice Test 35 — 15 Questions

Question 1

A company uses Shared VPC with multiple service projects. They want to ensure that only specific service projects can use the Cloud NAT configured in the host project. What should they do?

Accepted Answer

Configure Cloud NAT with a specific network tag and assign that tag only to VMs in authorized service projects.. Cloud NAT can be restricted to specific VMs using network tags. By configuring the Cloud NAT gateway in the host project with a specific network tag, and then assigning that tag only to the VM instances in authorized service projects, only those tagged VMs can use the NAT gateway. This ensures that only specific service projects (via their tagged VMs) can leverage the Cloud NAT, while all other VMs in the shared VPC are excluded.

Answer

Use firewall rules to restrict traffic from service projects.

Answer

Use VPC Service Controls to restrict access.

Answer

Configure IAM roles on the Cloud NAT resource to allow only specific projects.

Question 2

Which THREE factors should be considered when designing a Cloud VPN for high availability? (Choose 3.)

Accepted Answer

Enable BGP for dynamic routing. Enabling BGP (Border Gateway Protocol) for dynamic routing is correct because it allows the Cloud VPN to automatically detect and route around failures. BGP exchanges route information between the on-premises router and the Cloud Router, enabling dynamic failover and load balancing across multiple tunnels. Without BGP, you would rely on static routes, which cannot adapt to network changes and require manual intervention during a failure.

Answer

Use static routes for failover

Answer

Use a single Cloud Router for simplicity

Question 3

A company has multiple projects that each need their own administrative control but must share a common VPC network. Which networking solution should they use?

Accepted Answer

Use Shared VPC with the host project and attach service projects.. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling centralized control of the network while maintaining administrative isolation for each project. The host project owns the VPC and firewall rules, and service projects can use subnets within that VPC, meeting the requirement for separate administrative control with a shared network.

Answer

Create a single VPC in one project and grant all users access to that project.

Answer

Create separate VPCs for each project and connect via Cloud VPN.

Answer

Create a VPC in each project and peer them all together.

Question 4

A company needs to connect multiple on-premises sites to Google Cloud using a single Cloud VPN gateway. What is the recommended approach?

Accepted Answer

Create multiple VPN tunnels, each with its own BGP session to a Cloud Router.. When connecting multiple on-premises sites to Google Cloud using a single Cloud VPN gateway, the recommended approach is to create multiple VPN tunnels, each with its own BGP session to a Cloud Router. This allows the Cloud VPN gateway to terminate multiple tunnels, and each tunnel can have a unique BGP session for dynamic route exchange, enabling the gateway to learn and advertise routes for each site independently. Using a single tunnel with multiple BGP sessions or policy-based routing is not supported because a Cloud VPN tunnel is a point-to-point connection that can only have one BGP session per tunnel, and static routes would not provide the redundancy or dynamic failover needed for multiple sites.

Answer

Create a single VPN tunnel and use policy-based routing to direct traffic.

Answer

Use a single VPN tunnel with multiple BGP sessions.

Answer

Create a single VPN tunnel and use static routes for each site.

Question 5

A network engineer is troubleshooting connectivity between an on-premises network and Google Cloud. The on-premises router has two BGP sessions configured for redundancy with a Cloud Router. The engineer runs the command above. Which issue does the output indicate?

Accepted Answer

The on-premises router is not advertising any routes to the Cloud Router. The output shows that both BGP sessions are established (state = Established), so options A and B are incorrect. However, the 'Received routes' count is 0 for both peers, meaning the on-premises router is not sending any routes to the Cloud Router. This prevents the Cloud Router from learning the on-premises prefixes, breaking connectivity from Google Cloud to on-premises.

Answer

Both BGP sessions are down

Answer

The BGP session for peer-a is down

Answer

The Cloud Router is not advertising any routes to on-premises

Question 6

Which TWO of the following are benefits of using Cloud Interconnect over Cloud VPN for hybrid connectivity? (Choose two.)

Accepted Answer

Lower and more consistent latency.. Cloud Interconnect provides a dedicated, private connection between your on-premises network and Google Cloud, bypassing the public internet. This results in lower and more consistent latency compared to Cloud VPN, which relies on the public internet and is subject to variable network conditions and potential congestion.

Answer

Always provides encryption for data in transit.

Answer

Easier to set up as no physical connection is needed.

Answer

Lower cost for small bandwidth requirements.

Question 7

A company uses Cloud CDN with an external HTTP(S) load balancer. They have two origin server groups: a primary in us-central1 and a backup in europe-west1. They want traffic directed to the primary unless it is unhealthy, in which case traffic should fail over to the backup. Which configuration is required?

Accepted Answer

Create a backend service with two backends (primary and failover) and a failover policy that marks the primary as failover when unhealthy.. Cloud CDN with an external HTTP(S) load balancer uses a backend service that can contain multiple backends (e.g., instance groups or NEGs) with a failover policy. When the primary backend is marked as unhealthy by the health check, the load balancer automatically routes traffic to the failover backend. This configuration meets the requirement without manual intervention.

Answer

Create a Cloud CDN with two origins and enable failover in the CDN settings.

Answer

Use a TCP/UDP network load balancer with two target pools.

Answer

Configure a weighted round-robin with primary weight 100 and backup weight 0, and change weights manually.

Question 8

A company needs private connectivity between its on-premises data center and Google Cloud with consistent low latency and high throughput. The on-premises location is close to a Google Cloud point of presence that supports Dedicated Interconnect. The company expects to use more than 10 Gbps of bandwidth in the near future. Which connectivity solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, offering consistent low latency and high throughput. Since the on-premises location is near a Google Cloud point of presence that supports Dedicated Interconnect and the bandwidth requirement exceeds 10 Gbps (Dedicated Interconnect supports up to 10 Gbps per circuit, with multiple circuits for higher aggregate bandwidth), this is the optimal solution.

Answer

Partner Interconnect

Answer

HA VPN with dynamic routing

Answer

Cloud VPN with static routing

Question 9

Which TWO of the following are required steps to set up a Dedicated Interconnect?

Accepted Answer

Create an interconnect (physical connection) in the colocation facility. Creating an interconnect (physical connection) in the colocation facility is a required step because Dedicated Interconnect requires a direct, physical cross-connect between your on-premises router and a Google Cloud edge router at a colocation facility. This physical link is the foundation of the dedicated, high-bandwidth connection, and without it, no Layer 2 or Layer 3 connectivity can be established.

Answer

Establish a VPN tunnel as a backup

Answer

Deploy a Google-provided router in the colocation facility

Answer

Configure MD5 authentication on the BGP session

Question 10

Which TWO network services can be used to provide secure connectivity between a VPC and an on-premises data center without traversing the public internet? (Choose two.)

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (C) provides a direct, private physical connection between your on-premises network and Google's VPC, bypassing the public internet entirely. This ensures low latency, high bandwidth, and consistent network performance for secure hybrid cloud connectivity.

Answer

Cloud VPN with IPsec

Answer

Cloud NAT

Answer

VPC Network Peering

Question 11

A small company is moving their on-premises application to Google Cloud. They have a single on-premises office with a small router that supports IPsec VPN. They need a simple and low-cost connectivity solution that provides encryption and a consistent experience. They anticipate low bandwidth needs (under 100 Mbps). They also want the ability to use BGP for dynamic routing to avoid manual route updates. Which Google Cloud service should they use?

Accepted Answer

Cloud HA VPN with dynamic routing (BGP). Cloud HA VPN with dynamic routing (BGP) is the correct choice because it provides an encrypted IPsec tunnel, supports BGP for automatic route exchange, and is a low-cost, simple solution for sub-100 Mbps bandwidth needs. It meets the requirement for a consistent experience without the complexity or cost of dedicated interconnect services.

Answer

Partner Interconnect

Answer

Cloud Classic VPN with static routes

Answer

Direct Peering

Question 12

An organization has two VPC networks in different Google Cloud organizations. They need to allow private IP communication between instances in these VPCs without using public IPs or VPNs. Which solution should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering allows private IP connectivity between two VPC networks across different organizations without requiring public IPs, VPNs, or gateways. It uses the Google Cloud internal infrastructure to route traffic directly between instances, leveraging RFC 1918 addresses and supporting global peering.

Answer

Cloud NAT

Answer

Shared VPC

Answer

Cloud VPN

Question 13

An enterprise is using a 10 Gbps Dedicated Interconnect between their on-premises data center and Google Cloud. They measure throughput and find it is only 5 Gbps even though there is no congestion. The on-premises router is configured with a single VLAN attachment. What is the most likely cause?

Accepted Answer

The on-premises router does not support full line rate. A single VLAN attachment on a 10 Gbps Dedicated Interconnect means the on-premises router must handle all traffic through one physical interface. If the router lacks the forwarding capacity to process packets at 10 Gbps line rate, throughput will be capped at its maximum switching or routing performance, which in this case is 5 Gbps. This is a common hardware limitation, not a configuration or congestion issue.

Answer

BGP is not configured, causing routing loop

Answer

MTU mismatch between on-premises and Google Cloud

Answer

QoS policy is limiting throughput on Google Cloud side

Question 14

A company has two VPC networks in the same project: Network A (hosting a private zone for 'example.internal.') and Network B. They are connected via VPC peering. The network engineer created a DNS peering zone in Network B for 'example.internal.' pointing to Network A. However, instances in Network B cannot resolve 'host.example.internal.' which is defined in Network A's private zone. The engineer verified that the peering zone is active and the networks are properly peered. What is the most likely reason for the resolution failure?

Accepted Answer

The private zone in Network A is not configured to allow resolution from peered networks.. Cloud DNS private zones do not automatically allow resolution from peered VPC networks unless explicitly configured. Even though VPC peering and DNS peering are active, the private zone in Network A must have its 'Allow resolution from peered networks' setting enabled. Without this, queries from Network B via the DNS peering zone are rejected, causing resolution failures for records like 'host.example.internal.'.

Answer

An inbound server policy must be created in Network A.

Answer

The peering zone should be a forwarding zone instead.

Answer

An outbound server policy must be created in Network B.

Question 15

An enterprise uses Shared VPC with a host project and multiple service projects. A service project team wants to create a Cloud VPN tunnel to their on-premises network. What must the network team configure in the host project to allow this?

Accepted Answer

The VPN gateway and Cloud Router must be created in the host project's VPC, and the service project must be granted compute.networkUser role on the host project. In a Shared VPC setup, the VPN gateway and Cloud Router must reside in the host project's VPC because the host project owns the underlying network infrastructure. The service project can then use the VPN tunnel by being granted the `compute.networkUser` role on the host project, which allows it to create forwarding rules and use the VPN resources. This ensures that the VPN termination point is within the shared VPC network, enabling connectivity to on-premises networks.

Answer

The service project can create the VPN gateway directly in its own project as long as it uses a VPC that is peered with the host project

Answer

The service project cannot use Cloud VPN with Shared VPC; they must use Dedicated Interconnect instead

Answer

A Cloud Router must be created in the service project, and the VPN gateway in the host project