PCNE Practice Test 37 — 15 Questions

Question 1

Company A and Company B both have networks in Google Cloud. They want to connect their VPCs using VPC peering, but they have overlapping IP addresses. How can they resolve this?

Accepted Answer

Use Cloud VPN to establish connectivity between the VPCs, as VPC peering cannot handle overlapping IPs.. VPC peering does not support overlapping IP ranges. The only option from the list that can handle overlapping IPs is Cloud VPN with network address translation or filtering.

Answer

Configure Private Service Connect to connect the VPCs.

Answer

Configure VPC peering with custom route exchange to exclude the overlapping subnets.

Answer

Use Dedicated Interconnect to connect the VPCs through a central router.

Question 2

An organization has two VPCs in the same project: VPC-A and VPC-B. They want instances in VPC-A to reach Cloud Storage buckets without external IPs. What is the simplest solution?

Accepted Answer

Enable Private Google Access on the subnets in VPC-A.. Private Google Access enables instances without external IPs to reach Google API endpoints (including Cloud Storage) via the private IP range. The feature is enabled per subnet, so enabling it on subnets in VPC-A allows those instances to access Cloud Storage.

Answer

Create a Cloud NAT gateway in VPC-A and configure firewall rules to allow traffic to Cloud Storage.

Answer

Peer VPC-A with VPC-B and enable Private Google Access on VPC-B.

Answer

Assign external IPs to the instances in VPC-A.

Question 3

An organization wants to prevent data exfiltration from a project that uses Google Cloud Storage and BigQuery. They need to restrict access to these services from only the authorized VPC networks. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow creating a service perimeter around GCP services (like Cloud Storage and BigQuery) to restrict data access to only authorized VPCs and projects. This prevents data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

Cloud Armor

Question 4

Your VPC has instances with internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. You need to ensure that DNS resolution works for instances in the same zone using short names (e.g., 'instance1'). Which condition must be met?

Accepted Answer

The instances must be in the same zone and VPC network.. Google Cloud internal DNS automatically resolves short names for instances within the same zone and network. The instance must be in the same zone and VPC network. No additional configuration is needed as long as instances are in the same zone.

Answer

Custom DNS must be configured via Cloud DNS.

Answer

The VPC must have Private Google Access enabled.

Answer

The instance must have a network tag 'dns-enabled'.

Question 5

Which statement about Cloud Armor security policies is true?

Accepted Answer

They support both allow and deny actions for incoming requests.. Cloud Armor security policies can be attached to HTTPS Load Balancers. They support rules with conditions like IP addresses, geographic regions, and preconfigured WAF rules. They also support rate limiting.

Answer

They can be attached to any GCP resource, including Compute Engine instances.

Answer

They are evaluated after the firewall rules.

Answer

They cannot be used with internal load balancers.

Question 6

Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?

Accepted Answer

Enable Private Google Access on the subnet.. The subnet has privateIpGoogleAccess set to false, which must be enabled for VMs without external IPs to access Google APIs via Private Google Access. Option C (Enable Private Google Access on the subnet) is the correct configuration. Option A (Cloud NAT) is for outbound internet to non-Google destinations, not for Google APIs. Option B is not needed because egress to 0.0.0.0/0 is allowed by default. Option D is not missing; a default route exists as indicated by gatewayAddress.

Answer

Create a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Add a default route to the internet gateway.

Question 7

Refer to the exhibit. You have two VPCs, vpc-a and vpc-b, with VPC peering configured and custom route import/export enabled. An instance in subnet-a (10.0.1.2) cannot ping an instance in subnet-b (10.0.2.2) using internal IP. Firewall rules are default (deny all ingress). What is the required action?

Accepted Answer

Add a firewall rule allowing ICMP from 10.0.1.0/24 to 10.0.2.0/24.. Even with peering, firewall rules are needed to allow traffic. Default deny all ingress blocks the ping.

Answer

Add a static route for the peer range.

Answer

Enable Private Google Access.

Answer

Create a Cloud VPN tunnel.

Question 8

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Accepted Answer

Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.. Options B, D, and E are correct. Option B: Cloud NAT requires a default route (0.0.0.0/0) pointing to the internet gateway to forward traffic. Option D: You can specify a manual list of NAT IP addresses (static external IPs) for Cloud NAT to use. Option E: Cloud NAT supports both TCP and UDP protocols for outbound connections. Option A is incorrect because Cloud NAT is configured per region, not per subnet; it applies to all subnets in the region that are enabled for NAT. Option C is incorrect because Cloud NAT does not assign external IPs to instances; it provides NAT for instances without external IPs.

Answer

Cloud NAT can be configured per subnet or per region.

Answer

Cloud NAT automatically assigns external IP addresses to instances.

Question 9

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Accepted Answer

Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.. Cloud NAT uses network tags to filter which instances use it.

Answer

Assign external IPs to non-NAT instances.

Answer

Use firewall rules to allow NAT for tagged instances.

Answer

Create separate subnets for NAT instances.

Question 10

A company needs to connect on-premises to Google Cloud with overlapping IP ranges. The on-premises network uses 10.0.0.0/16 and the VPC uses 10.0.0.0/16. What is the best approach?

Accepted Answer

Use Cloud VPN with source NAT on the on-premises side.. Cloud VPN with source NAT on the on-premises side translates overlapping addresses.

Answer

Use Cloud NAT.

Answer

Use VPC peering.

Answer

Use Private Google Access.

Question 11

Which THREE of the following are benefits of using VPC Flow Logs?

Accepted Answer

Compliance and audit requirements.. VPC Flow Logs capture network traffic metadata, which can be used for compliance auditing (A), troubleshooting connectivity issues (B), and analyzing traffic patterns to detect DDoS attacks (C). Option D is incorrect because flow logs do not reduce latency; they only log data. Option E is incorrect because flow logs are not real-time; there is a delay in log delivery.

Answer

Reducing network latency.

Answer

Real-time network monitoring.

Question 12

You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?

Accepted Answer

The domain is not verified for the Google-managed certificate on the frontend.. When a Google-managed certificate is used on the frontend of an SSL proxy load balancer, the domain must be verified via DNS or a challenge file. If the domain is not verified, the certificate cannot be provisioned or validated, causing a mismatch between the certificate's Subject Alternative Names (SANs) and the domain clients are connecting to, resulting in SSL errors.

Answer

The SSL policy is configured to require TLS 1.3 only.

Answer

The backend self-managed certificate is not signed by a public CA.

Answer

The backend service must use a Google-managed certificate as well.

Question 13

A company uses Cloud NAT for outbound internet access. Engineering notices that some VM instances fail to connect to external services during peak hours. The network engineer suspects port exhaustion. Which action would best mitigate this issue?

Accepted Answer

Increase the number of NAT IP addresses assigned to the NAT gateway.. Port exhaustion occurs when the NAT gateway runs out of available source ports to map outbound connections. Increasing the number of NAT IP addresses assigned to the gateway multiplies the available port range (each IP provides 64,512 ports), directly alleviating port exhaustion during peak traffic. This is the standard mitigation for port exhaustion in Cloud NAT.

Answer

Change the NAT type from standard to public.

Answer

Enable TCP keepalive on the NAT gateway.

Answer

Reduce the number of NAT gateways in the region.

Question 14

An organization wants to allow on-premises hosts to connect to a Cloud SQL instance privately without traversing the public internet. They have a Cloud VPN tunnel set up. What additional step is required?

Accepted Answer

Enable Private Service Connect on the Cloud SQL instance. Private Service Connect enables private connectivity to Google-managed services from on-premises via VPC and VPN.

Answer

Create a VPC peering connection

Answer

Add a route with next hop set to the VPN gateway

Answer

Configure Cloud NAT

Question 15

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

Accepted Answer

Deploy a global HTTP(S) Load Balancer with backend services in each region.. A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Answer

Use Cloud DNS with geo-routing to direct users to regional load balancers.

Answer

Set up Cloud NAT with multiple static IP addresses for each region.

Answer

Assign a global anycast IP address to all instances and use BGP to advertise it.