PCNE Practice Test 36 — 15 Questions

Question 1

A platform team runs an internal application on a managed instance group in us-east1 behind an internal TCP/UDP load balancer (ILB). The application must resolve a private Cloud DNS name that only exists in a separate VPC network, vpc-shared, which is connected to the application's VPC through VPC Network Peering. Name resolution currently fails. What should the team change to make the private zone visible to the application's VPC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable DNS peering on the application VPC's Cloud DNS configuration, pointing at vpc-shared for the target domain.. VPC Network Peering exchanges routes but deliberately does not share private Cloud DNS zones between the peered networks. To resolve a zone hosted in a peer, the consuming VPC needs a DNS peering zone configured to forward queries for that domain to the VPC that owns the managed zone. This keeps the zone private while making the records available to the application instances.

Answer

Configure an inbound server policy on the DNS server VPC and set the application VPC as a client.

Answer

Set the private managed zone's visibility to public so that the peered VPC can query it.

Answer

Add a custom recursive resolver entry to each instance's /etc/resolv.conf that targets the vpc-shared DNS address.

Question 2

A company runs a web application on a managed instance group in us-central1. They need to distribute incoming HTTP traffic to the instances and also ensure that requests from the same user session are consistently routed to the same instance. Which Google Cloud load balancing configuration should they use?

Accepted Answer

External HTTP(S) Load Balancer with session affinity set to Client IP. The external HTTP(S) load balancer is a Layer 7 load balancer that supports HTTP session affinity. By configuring session affinity to Client IP, requests from the same client IP are consistently routed to the same backend instance. This meets the requirement for session persistence. The other load balancer types either operate at a different layer or do not support the necessary session affinity for HTTP traffic.

Answer

External TCP Proxy Load Balancer with session affinity set to None

Answer

External SSL Proxy Load Balancer with session affinity set to Client IP

Answer

Internal TCP/UDP Load Balancer with session affinity set to Client IP

Question 3

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They need to expose the application to external clients with a static IP address and also route traffic to different services based on the URL path. Which two Google Cloud components should they use? (Choose two.)

Accepted Answer

GKE Ingress with an external HTTP(S) Load Balancer. To expose a GKE application externally with a static IP and path-based routing, you need a Layer 7 load balancer. GKE Ingress creates an external HTTP(S) load balancer that supports URL path routing and can be assigned a reserved global static IP. Using a Service of type LoadBalancer or NodePort does not provide Layer 7 routing, and an internal load balancer cannot serve external clients.

Answer

GKE Ingress with an internal HTTP(S) Load Balancer

Answer

GKE Service of type LoadBalancer with an external TCP/UDP Load Balancer

Answer

GKE Service of type NodePort with a global static IP

Question 4

A company has a Shared VPC host project with several service projects. An engineer in a service project needs to create a Cloud NAT gateway so that instances in that service project's subnet can reach the internet without external IPs. The host project administrator has already enabled the required APIs. Which action should the engineer take?

Accepted Answer

Ask a host project administrator to create the Cloud NAT gateway on the shared VPC in the host project, scoped to the subnet used by the service project's instances.. Cloud NAT is a resource of the VPC network owner, which in Shared VPC is the host project. The service project only consumes the shared subnet, so a host project administrator must create the NAT gateway there and scope it to that subnet. Creating NAT in the service project, attaching it to a different VPC, or relying on Private Google Access and routes cannot deliver general internet egress for the shared-subnet instances.

Answer

Enable Private Google Access on the shared subnet and configure a default route in the service project to route internet traffic through the host project.

Answer

Create a Cloud NAT gateway in the service project and attach it to the service project's own default VPC, then peer that VPC with the host project.

Answer

Create the Cloud NAT gateway in the service project, selecting the shared subnet from the host project as the NAT's subnet.

Question 5

A network engineer is configuring a Cloud VPN tunnel between an on-premises network and a Google Cloud VPC. The on-premises VPN gateway uses a dynamic routing protocol. The engineer wants to ensure that the tunnel can fail over to a second tunnel automatically if the primary tunnel goes down. What should be configured?

Accepted Answer

Configure an HA VPN gateway with two interfaces, create two tunnels to two distinct peer IPs, and enable BGP on both tunnels with the same Cloud Router.. HA VPN is the recommended solution for high availability. By creating an HA VPN gateway with two interfaces and two tunnels to two distinct peer IPs, and running BGP on both tunnels with the same Cloud Router, the network achieves automatic failover. If one tunnel fails, BGP withdraws its routes, and traffic uses the remaining tunnel, ensuring continuous connectivity.

Answer

Deploy two Classic VPN tunnels with dynamic routing using a single Cloud Router, and configure the on-premises gateway to use ECMP.

Answer

Create two Cloud VPN tunnels with the same peer IP but different IKE pre-shared keys, and enable global dynamic routing on the VPC.

Answer

Set up a single Cloud VPN tunnel with a static route and enable route priority to prefer a backup path via a second VPC.

Question 6

A network engineer is troubleshooting intermittent connectivity issues between two VPC networks connected via VPC Network Peering. The engineer suspects that some traffic is being dropped due to firewall rules. They need to determine which firewall rules are being applied to a specific VM's traffic and whether any rules are blocking it. Which tool should they use?

Accepted Answer

Connectivity Tests in Network Intelligence Center to simulate the traffic and identify firewall rules. Connectivity Tests is designed to simulate and analyze the path of a packet through Google Cloud's network, including VPC peering, firewall rules, and routes. It provides a detailed report of which firewall rules allow or deny the traffic, making it the ideal tool for troubleshooting intermittent connectivity and identifying blocking rules. Other options are either after-the-fact logging or not applicable.

Answer

VPC Flow Logs with metadata annotations to identify firewall rule names

Answer

Firewall Rules Logging with a log-based metric to count denied connections

Answer

Cloud NAT logging to see which connections are translated and dropped

Question 7

A company needs to allow its Compute Engine instances in a private subnet to access Google Cloud APIs without using external IP addresses. The instances must not traverse the public internet. What should the network engineer configure?

Accepted Answer

Enable Private Google Access on the subnet and ensure that the instances have no external IP addresses.. Private Google Access enables instances with only internal IP addresses to reach Google APIs and services. By enabling it on the subnet, traffic to Google APIs stays within the Google network and does not traverse the public internet. This is the simplest and most secure method to meet the requirement.

Answer

Create a Cloud NAT gateway and configure the instances to use it for all outbound traffic.

Answer

Set up a VPN tunnel to a VPC that has Private Google Access enabled, and route API traffic through that tunnel.

Answer

Assign external IP addresses to the instances and create a firewall rule to allow traffic only to Google API endpoints.

Question 8

A company has deployed a global external HTTP(S) load balancer with Cloud CDN enabled. They want to monitor the performance and health of the load balancer and its backends. They need to set up alerts for when the load balancer's 5xx error rate exceeds a threshold and when backend latency increases. Which two Cloud Monitoring metrics should they use to create alerting policies? (Choose two.)

Accepted Answer

loadbalancing.googleapis.com/https/backend_latencies. To alert on 5xx error rate, the request_count metric with response_code_class label is appropriate because it allows filtering and ratio calculation. For backend latency, the backend_latencies metric directly measures the time backends take to respond, enabling precise alerts. These two metrics together provide the necessary monitoring for the stated requirements.

Answer

loadbalancing.googleapis.com/https/total_latencies

Answer

compute.googleapis.com/instance/cpu/utilization

Answer

loadbalancing.googleapis.com/https/response_bytes_count

Question 9

A small startup is deploying a web application on a single Compute Engine instance in us-central1. They want to assign a static external IP address to the instance so that it remains the same even if the instance is stopped and started. What should they do?

Accepted Answer

Reserve a static external IP address and assign it to the instance's network interface.. To assign a static external IP address to a Compute Engine instance, you must reserve a static external IP address in the project and then attach it to the instance's network interface. This ensures the IP remains the same even if the instance is stopped and started. Ephemeral IPs are not persistent, and other methods like Cloud NAT or load balancers do not assign a static IP directly to the instance.

Answer

Use a global external HTTP(S) load balancer with the instance as a backend and use the load balancer's IP.

Answer

Create a Cloud NAT gateway and route the instance's traffic through it.

Answer

Configure the instance to use an ephemeral external IP address and set a long lease time.

Question 10

You need to connect your on-premises network to Google Cloud using a Partner Interconnect connection. Your service provider offers Layer 2 connectivity and requires you to provide a VLAN ID. Which Google Cloud resource must you create to establish the connection?

Accepted Answer

A VLAN attachment. For Partner Interconnect, you create a VLAN attachment to connect your VPC to the service provider's network. The VLAN attachment is associated with a Cloud Router and uses the VLAN ID provided by the service provider. This is the fundamental step to establish connectivity.

Answer

A Cloud VPN tunnel

Answer

A Dedicated Interconnect connection

Answer

A Cloud Router

Question 11

A retail company runs a global e-commerce platform on Compute Engine VMs behind a global external HTTP(S) load balancer. The operations team needs to receive an alert whenever the load balancer's 5xx error rate exceeds 1% for a sustained period of 5 minutes, so they can investigate backend failures. They want to use Cloud Monitoring and avoid custom scripts. What should they do?

Accepted Answer

Create a Cloud Monitoring alerting policy using the loadbalancing.googleapis.com/https/request_count metric filtered by response_code_class=500, with a condition that the ratio of 5xx to total requests exceeds 1% over a 5-minute window.. Cloud Monitoring provides native metrics for external HTTP(S) load balancers, including request counts broken down by response code class. By creating an alerting policy that compares the count of 5xx responses to total requests over a 5-minute window, the team can precisely detect when the error rate exceeds 1%. This avoids custom code and leverages the platform's built-in alerting capabilities, which is the recommended operational practice for monitoring load balancer health.

Answer

Enable VPC Flow Logs on the load balancer's backend subnets and create an alerting policy in Cloud Monitoring based on the number of TCP RST packets observed on backend instances.

Answer

Configure a Cloud Logging sink to export load balancer logs to BigQuery, then schedule a query every 5 minutes and use Cloud Scheduler to trigger a Cloud Function that sends an alert when the error rate is high.

Answer

Create a log-based alerting policy in Cloud Logging that triggers on the load balancer's 5xx log entries and sends a notification to a Pub/Sub topic.

Question 12

A network engineer needs to connect a VPC to an on-premises network using a Cloud VPN. The on-premises VPN device supports only IKEv1. Which Google Cloud VPN configuration should the engineer use?

Accepted Answer

Classic VPN with IKEv1 and a static route.. Classic VPN supports IKEv1, making it the only Google Cloud VPN option compatible with an on-premises device that only supports IKEv1. HA VPN requires IKEv2, so it cannot be used. The engineer should configure Classic VPN with appropriate routing and IKEv1 settings.

Answer

Partner Interconnect with a VLAN attachment and IKEv1.

Answer

HA VPN with two tunnels and IKEv2.

Answer

HA VPN with a single tunnel and IKEv1.

Question 13

A startup has a single VPC with two subnets in us-central1 and us-east1. They want to allow SSH from a specific on-premises jump host to all instances in both subnets using the fewest firewall rules. Which approach should they use?

Accepted Answer

Create one ingress firewall rule that allows TCP port 22 from the jump host IP and apply it to all instances using a network tag or service account.. VPC firewall rules are applied to instances through network tags or service accounts, not subnets, so a single ingress rule with a broad selector can cover instances in both regions. Using one rule with a tag or service account meets the fewest-rules requirement and keeps management simple. Per-subnet rules, egress rules, and default-service-account-only rules either add unnecessary rules or miss instances.

Answer

Create two ingress firewall rules, one per subnet, allowing TCP port 22 from the jump host IP.

Answer

Create one egress firewall rule that allows TCP port 22 from the jump host IP to all instances.

Answer

Create one ingress firewall rule that allows TCP port 22 from the jump host IP and apply it to the default service account only.

Question 14

A financial services company runs a hybrid environment with two Dedicated Interconnect attachments in different metros to a single Cloud Router. During a maintenance window, one attachment goes down unexpectedly. The on-premises team reports that some flows fail while others continue. The engineer needs to verify that the Cloud Router is properly re-advertising and learning routes after the failover. Which diagnostic approach should the engineer use?

Accepted Answer

Inspect Cloud Router BGP session status and advertised and received route counts using gcloud compute routers get-status, then review the router's logs in Cloud Logging.. Validating BGP behavior after an attachment failure requires inspecting the control plane, not the data plane. The Cloud Router status output exposes per-peer session state along with advertised and received route counts, and Cloud Router logs record session transitions and route updates. Link diagnostics, flow logs, and connectivity tests describe other layers and cannot confirm that prefixes are being exchanged correctly after failover.

Answer

Run gcloud compute interconnects get-diagnostics on the failed attachment and rely on the reported link-layer state to infer route convergence.

Answer

Check VPC Flow Logs on the subnet hosting the Cloud Router to confirm that BGP keepalives are being exchanged.

Answer

Use Network Intelligence Center Connectivity Tests to trace the data path and infer whether BGP prefixes are being exchanged.

Question 15

A multinational corporation has a Dedicated Interconnect connection between its on-premises network and Google Cloud. They use Cloud Router with BGP. The on-premises router is configured to advertise routes with a MED of 100. The company wants to ensure that traffic from the VPC to on-premises uses the Dedicated Interconnect link and not a backup Cloud VPN tunnel. However, they notice that some traffic is being sent over the VPN tunnel. What is the most likely cause?

Accepted Answer

The Cloud VPN tunnel is advertising more specific routes than the Dedicated Interconnect.. For outbound traffic from the VPC to on-premises, Cloud Router uses the longest prefix match first. If the Cloud VPN tunnel advertises more specific routes for certain prefixes, those routes will be installed and preferred over the less specific routes from the Dedicated Interconnect, causing traffic to use the VPN for those destinations.

Answer

The Cloud VPN tunnel has a lower priority than the Dedicated Interconnect.

Answer

The Cloud Router is not configured to use global routing.

Answer

The MED value on the Dedicated Interconnect is higher than on the Cloud VPN tunnel.