PCNE Practice Test 36 — 15 Questions

Question 1

A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IAM conditions on the bucket. VPC Service Controls can restrict access to Google APIs to only specified VPCs and projects, creating a service perimeter. IAM conditions can further restrict access based on the caller's service account. This combination ensures that only instances with the correct service account in the correct VPC can access the bucket.

Answer

Hierarchical firewall policy

Answer

Cloud Armor

Answer

Cloud NAT

Question 2

You need to configure firewall rules to allow HTTP (TCP 80) traffic from the internet to instances in a VPC. The instances are in different subnets and have a network tag 'web-server'. You want to minimize the number of rules. Which rule configuration is correct?

Accepted Answer

Create an ingress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.. Firewall rules are global, so one ingress rule can apply to all instances with the tag 'web-server' regardless of subnet. The direction must be ingress, source 0.0.0.0/0, protocol tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule with source 0.0.0.0/0, protocol tcp:0-65535, and target tags 'web-server'.

Answer

Create an egress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule for each subnet with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Question 3

An organization needs to restrict access to Google Cloud APIs such that only traffic from a specific set of VMs inside a VPC can reach the APIs, and all other traffic (including from other VPCs) must be denied. The VMs do not have external IPs. Which combination of services should they use?

Accepted Answer

Private Google Access and VPC Service Controls. Private Google Access allows VMs without external IPs to reach Google APIs. VPC Service Controls can create a service perimeter that restricts access to APIs from only authorized VPCs.

Answer

Private Service Connect and VPC Service Controls

Answer

Cloud NAT and VPC Service Controls

Answer

Cloud NAT and Private Google Access

Question 4

Refer to the exhibit. A Cloud Router has two BGP sessions. The first session is UP, the second is DOWN. What is the most likely cause for the second session being down?

Accepted Answer

The session initialization mode is set to PASSIVE.. The second session has sessionInitializationMode set to PASSIVE. If the peer router is also configured as PASSIVE, the BGP session will never establish. The first session is ACTIVE, so it came up. This is a common misconfiguration.

Answer

The advertised route priority is too low.

Answer

The peer IP address 169.254.1.2 is not routable.

Answer

The BFD multiplier is too low (3).

Question 5

A company wants to restrict access to Google Cloud APIs from a specific set of VMs based on the VM's service account. Which type of firewall rule target should be used?

Accepted Answer

Target service accounts. Firewall rules can target instances by service account, allowing fine-grained control based on identity rather than network tags.

Answer

Target tags

Answer

All instances

Answer

Source service accounts

Question 6

A company wants to use Cloud Armor to block traffic from a specific IP range (198.51.100.0/24) and also apply rate limiting. Which TWO components are needed? (Select 2)

Accepted Answer

A Cloud Armor security policy with two rules: one for IP deny and one for rate limiting. Cloud Armor security policies contain rules with conditions like IP ranges and rate limiting. The policy is attached to a backend service of an HTTPS load balancer.

Answer

A Cloud CDN cache rule

Answer

A Cloud Armor security policy with one rule that combines IP deny and rate limiting

Answer

A network firewall rule to block the IP range

Question 7

Refer to the exhibit. A Cloud VPN tunnel is configured with the above Cloud Router configuration. The on-premises BGP peer is at 169.254.0.2 with ASN 65001. The on-premises router is receiving the route 10.0.0.0/8 from the Cloud Router, but it is not receiving any of the specific subnets (e.g., 10.1.0.0/16) that exist in the VPC. What is the most likely cause?

Accepted Answer

The Cloud Router is configured with custom advertise mode and is only advertising the manually specified ranges.. The Cloud Router is configured with custom advertise mode, which means it only advertises the manually specified CIDR ranges to the on-premises BGP peer. Since the specific subnets (e.g., 10.1.0.0/16) are not included in the custom advertised ranges, the on-premises router receives only the explicitly listed 10.0.0.0/8 route, not the more specific subnets.

Answer

The advertised_route_priority is set too low, causing the routes to be suppressed.

Answer

The BGP session is not established due to ASN mismatch.

Answer

The on-premises peer ASN is incorrect.

Question 8

A company runs a global e-commerce platform with a monolithic application deployed on Compute Engine. They want to modernize by splitting the monolith into microservices running on Cloud Run and Cloud Functions, and expose them externally via a single anycast IP with Google-managed SSL certificates. Which load balancer should they use?

Accepted Answer

Global External HTTPS Load Balancer. The Global External HTTPS Load Balancer supports serverless NEGs for Cloud Run and Cloud Functions, provides an anycast IP, and offers Google-managed SSL certificates. The Regional External HTTPS LB is regional and does not provide global anycast. The Global SSL Proxy LB does not support serverless NEGs. The Global TCP Proxy LB also does not support serverless NEGs.

Answer

Global TCP Proxy Load Balancer

Answer

Regional External HTTPS Load Balancer

Answer

Global SSL Proxy Load Balancer

Question 9

A company is designing an HA VPN to connect their on-premises data center to Google Cloud VPC. The on-premises router supports two independent interfaces with public IPs. They want to achieve 99.99% availability for the VPN connection, understanding that HA VPN uses two tunnels and two Cloud Router instances. Which configuration meets this goal?

Accepted Answer

Four tunnels: one tunnel from each on-premises interface to each Cloud Router instance, totaling four BGP sessions. HA VPN requires at least two Cloud Router instances and two tunnels from each on-premises interface to each Cloud Router instance to achieve 99.99% availability. This configuration creates four BGP sessions, ensuring that if one on-premises interface, one Cloud Router, or one tunnel fails, traffic can still flow through the remaining paths. The design leverages both redundancy of interfaces and redundancy of Cloud Routers to meet the high availability SLA.

Answer

Two tunnels: both tunnels from the same on-premises interface to two different Cloud Router instances

Answer

Two tunnels: each tunnel from a separate on-premises interface to the same Cloud Router instance

Answer

Four tunnels: two tunnels from each on-premises interface to the same Cloud Router instance

Question 10

What is the purpose of a Response Policy Zone (RPZ) in Cloud DNS?

Accepted Answer

To override DNS responses for specified domains (e.g., block or redirect). RPZ allows you to override DNS responses for specific domains, often used for security (malware filtering) or policy enforcement. It is not for routing traffic, private zones, or load balancing.

Answer

To route traffic based on geographic location of the requester

Answer

To enable weighted round-robin load balancing for multiple IPs

Answer

To create private DNS zones within a VPC

Question 11

An organization wants to connect multiple on-premises sites to multiple VPCs in GCP using a hub-and-spoke model. Which GCP service provides a centralized hub for managing such connectivity?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is designed for hub-and-spoke topologies, connecting on-premises networks and VPCs through a hub.

Answer

Cloud Router

Answer

VPC Peering

Answer

Cloud VPN

Question 12

An engineer configures a Cloud Router with BGP to advertise a custom learned route for 10.0.0.0/8 to an on-premises router. The on-premises router also receives the same prefix from another path with a lower MED. Which route will the on-premises router prefer?

Accepted Answer

The route from the other path with lower MED. BGP route selection prefers the lowest MED value among routes received from the same neighboring AS. Since the on-premises router receives 10.0.0.0/8 from two paths, and the other path has a lower MED, that route will be preferred. The Cloud Router's advertisement with a higher MED will be less preferred, making option D correct.

Answer

Both routes are used for load balancing

Answer

The on-premises router will ignore MED and prefer the route with higher local preference

Answer

The route advertised by Cloud Router

Question 13

A company is using Cloud Interconnect with multiple VLAN attachments. They want to implement traffic shaping to prioritize real-time traffic over bulk transfers. Which THREE actions should they take?

Accepted Answer

Set up Cloud Router with BGP QoS policies to match DSCP values. Cloud Router with BGP QoS policies can match DSCP values to prioritize traffic. By configuring BGP QoS policies, you can map specific DSCP values to different traffic classes, allowing Cloud Interconnect to apply traffic shaping that prioritizes real-time traffic (e.g., VoIP) over bulk transfers. This leverages BGP community attributes to signal QoS requirements across the hybrid connection.

Answer

Enable Cloud NAT to handle traffic shaping

Answer

Use VPC flow logs to identify heavy traffic flows

Question 14

An organization configures a Global external HTTP(S) Load Balancer with Cloud CDN. They notice that some users are getting stale content even after they have invalidated the cache for specific objects. What is the most likely reason?

Accepted Answer

Invalidation requests are queued and take time to propagate globally. Cache invalidation removes objects from cache but does not prevent new requests from being served stale content if the origin returns a 304 Not Modified or if there is a propagation delay. However, the most common cause is that the invalidation has not propagated to all edge caches yet.

Answer

The URL map is routing to the wrong backend

Answer

The objects were cached with a very long TTL

Answer

Cloud CDN does not support invalidation for backend buckets

Question 15

A GCP environment has a VPC with a subnet that enables Private Google Access. Instances in that subnet can access Google APIs without external IPs. However, an instance cannot reach storage.googleapis.com from a private IP. Cloud NAT is configured for the subnet. What is the most likely reason for the failure?

Accepted Answer

The subnet's Private Google Access is enabled, but Cloud NAT is also routing traffic to Google APIs via NAT, bypassing the internal access.. Private Google Access uses the default routes for Google APIs. If Cloud NAT is configured, it may override Private Google Access because traffic to Google APIs can be matched by a default route with a next hop of NAT. To fix, ensure the subnet has a Private Google Access route with a next hop 'default internet gateway' for the restricted VIPs. Option B correctly identifies that Cloud NAT is incorrectly routing traffic.

Answer

The instance does not have a DNS resolution for storage.googleapis.com.

Answer

The VPC does not have a default route to the internet.

Answer

The instance does not have a firewall rule allowing egress to 199.36.153.4/30.