PCNE Practice Test 37 — 15 Questions

Question 1

A company has a Partner Interconnect connection with a service provider. The VLAN attachment is up, and BGP sessions are established. However, the on-premises network cannot reach certain VM instances in the VPC. The engineer suspects that the issue is with the MTU. What is the maximum MTU supported for Partner Interconnect?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

8896 bytes. Partner Interconnect supports a maximum MTU of 8896 bytes, which is higher than the standard 1500 bytes. This allows for jumbo frames and improved efficiency. The engineer should ensure that the on-premises network and service provider also support this MTU to avoid fragmentation or packet drops.

Answer

1460 bytes

Answer

9000 bytes

Answer

1500 bytes

Question 2

A financial services company is designing a Google Cloud network for a new application that must be isolated from the corporate network and the internet. The application runs on Compute Engine instances and requires access to Cloud Storage and BigQuery. The security team mandates that no external IP addresses be assigned and that all traffic to Google APIs stay within Google's network. Which configuration should the network engineer implement?

Accepted Answer

Private Google Access enabled on the subnet, with firewall rules allowing egress to Google APIs. Private Google Access allows VM instances without external IP addresses to reach Google APIs and services using internal IP addresses, keeping traffic within Google's network. This meets the isolation and access requirements. Cloud NAT would route traffic externally, VPC peering does not provide API access, and assigning external IPs violates the mandate.

Answer

A VPC peering connection to a shared services VPC that has a Cloud VPN to on-premises

Answer

Assign ephemeral external IP addresses and use firewall rules to restrict access to Google APIs

Answer

Cloud NAT with a custom min-ports-per-VM setting to allow outbound connections

Question 3

A retail company is designing a Google Cloud network to host a three-tier web application. The presentation tier must be accessible from the internet, the application tier must only accept traffic from the presentation tier, and the database tier must only accept traffic from the application tier. The company wants to use VPC firewall rules and network tags to enforce this. Which two configurations should the network engineer implement? (Choose two.)

Accepted Answer

Create an ingress firewall rule allowing tcp:8080 from instances with the tag 'web' to instances with the tag 'app'.. The correct rules allow internet access to the web tier and restrict app-tier access to the web tier. Using target tags and source tags enforces the required isolation. The other options either expose the database, block necessary traffic, or add unnecessary management access.

Answer

Create an egress firewall rule denying all traffic from instances with the tag 'app' to any destination.

Answer

Create an ingress firewall rule allowing tcp:22 from 0.0.0.0/0 to all instances for management.

Answer

Create an ingress firewall rule allowing tcp:3306 from 0.0.0.0/0 to instances with the tag 'db'.

Question 4

A network engineer has configured a Cloud Router with a BGP session to an on-premises router over a Dedicated Interconnect. The engineer wants to ensure that the on-premises router prefers routes learned from the Cloud Router over its default route to the internet. Which BGP attribute should the engineer configure on the on-premises router?

Accepted Answer

Set a higher local preference for routes learned from the Cloud Router.. Local preference is a well-known BGP attribute used to select the preferred outbound path. A higher local preference is preferred. By configuring a higher local preference for routes learned from the Cloud Router, the on-premises router will prefer those routes over its default route to the internet. This ensures that traffic destined for Google Cloud uses the Dedicated Interconnect connection, while other traffic continues to use the default route. This is a standard BGP traffic engineering technique.

Answer

Set a higher AS path length for routes learned from the Cloud Router.

Answer

Set a lower MED (Multi-Exit Discriminator) for routes learned from the Cloud Router.

Answer

Set a higher weight for routes learned from the Cloud Router.

Question 5

A company runs a multi-tier application on Compute Engine in a single VPC. The web tier instances have an external IP and are tagged 'web'. The database tier instances have no external IP and are tagged 'db'. The database must accept connections only from the web tier on port 3306. The security team wants to ensure that even if other instances in the VPC are compromised, they cannot reach the database. Which firewall rule configuration should the engineer implement?

Accepted Answer

Create an ingress rule with target tags 'db', source tags 'web', protocol tcp, port 3306, and action allow.. The correct rule uses target tags to apply only to database instances and source tags to restrict traffic to web tier instances. This enforces the principle of least privilege and meets the requirement that only the web tier can connect on port 3306. Other options either open the database to all sources, reverse the direction, or use a different targeting method not specified in the scenario.

Answer

Create an ingress rule with target tags 'db', source ranges '0.0.0.0/0', protocol tcp, port 3306, and action allow.

Answer

Create an ingress rule with target tags 'web', source tags 'db', protocol tcp, port 3306, and action allow.

Answer

Create an ingress rule with target service accounts 'db-sa', source service accounts 'web-sa', protocol tcp, port 3306, and action allow.

Question 6

A media company streams live video to a global audience through a global external Application Load Balancer. Users in several regions report intermittent buffering and higher-than-expected latency. The network team wants to determine whether backend health, latency distribution, and error rates are contributing. Which two actions should the team take? (Choose two.)

Accepted Answer

Review the load balancer's request and latency metrics in Cloud Monitoring, including backend latency and request count by response code.. Diagnosing regional buffering on a global Application Load Balancer requires combining application-layer metrics with network-path measurements. Load balancer metrics in Cloud Monitoring expose latency and error-rate trends by response code, while Performance Dashboard shows latency and packet loss between Google's network and client regions. Together they separate backend slowness from last-mile issues, which is exactly what the team needs.

Answer

Enable and analyze Cloud CDN logs and cache hit ratio metrics to determine whether origin shielding is misconfigured.

Answer

Run gcloud compute backend-services get-health on each backend service to confirm instance-level connectivity.

Answer

Export VPC Flow Logs from all backend subnets to BigQuery and query for TCP retransmissions to each client region.

Question 7

A network engineer is prototyping a new VPC network in Google Cloud. The engineer wants to validate that the design meets the following requirements: (1) instances in subnet A can communicate with instances in subnet B using internal IP addresses, (2) instances can reach Google APIs such as Cloud Storage without traversing the public internet, and (3) the network must support future expansion to on-premises connectivity via Cloud VPN. Which two actions should the engineer take to validate these requirements? (Choose two.)

Accepted Answer

Create a VPC network with two subnets in different regions, and verify connectivity between instances using internal IP addresses with ping or netcat.. To validate internal connectivity, the engineer should create a multi-subnet VPC and test instance-to-instance communication using internal IPs. To validate private access to Google APIs, the engineer should enable Private Google Access and test access to a service like Cloud Storage. These actions directly confirm the design meets the first two requirements and lays groundwork for future VPN connectivity.

Answer

Enable VPC Flow Logs on all subnets and analyze logs for any dropped packets between instances.

Answer

Set up a Cloud VPN tunnel to an on-premises network and verify BGP session establishment.

Answer

Create a Cloud NAT gateway and verify that instances can access the internet.

Question 8

A company has a Cloud Router in us-central1 managing a Dedicated Interconnect VLAN attachment. They want to advertise a custom IP range (192.168.100.0/24) to their on-premises network, but they do not want to advertise any VPC subnets. How should they configure the Cloud Router?

Accepted Answer

Enable custom advertisement and add 192.168.100.0/24 as an advertised range.. The Cloud Router's advertisement mode determines what routes it advertises to BGP peers. By default, it advertises all subnets in the VPC network. To advertise only a specific custom range and suppress VPC subnets, you must enable custom advertisement and add the desired range. This ensures that only 192.168.100.0/24 is advertised, and no VPC subnets are advertised.

Answer

Keep default advertisement and add 192.168.100.0/24 as a custom range.

Answer

Use a route policy to filter out VPC subnets and allow only 192.168.100.0/24.

Answer

Create a static route for 192.168.100.0/24 and enable route advertisement.

Question 9

A network engineer is designing a VPC network for a new application that will run on Compute Engine instances. The application must be able to communicate with each other on a custom port range, and the instances must have outbound internet access for software updates without exposing them to inbound internet traffic. The company wants to minimize cost and management overhead. Which approach should the engineer recommend?

Accepted Answer

Place instances in a private subnet with no external IP addresses and configure Cloud NAT to allow outbound internet access.. Cloud NAT enables instances without external IP addresses to initiate outbound connections to the internet while preventing unsolicited inbound connections. This directly satisfies the need for outbound access without inbound exposure. It is a managed service that reduces cost and operational overhead compared to assigning external IPs or routing through third-party VPNs. The other options either expose instances, add unnecessary complexity, or use services designed for different purposes.

Answer

Configure a proxy-only subnet and deploy an internal HTTP(S) load balancer to handle outbound traffic.

Answer

Use a VPN tunnel to a third-party provider to route all outbound traffic through the provider's network.

Answer

Assign external IP addresses to all instances and use firewall rules to block all inbound traffic except from specific sources.

Question 10

A retail company uses Cloud NAT to provide outbound internet access for private GKE nodes. Customers occasionally report failed API calls to a third-party payment provider, and the network team suspects port exhaustion on the NAT gateway. The team wants to confirm the cause and reduce recurrence. Which combination should the team implement?

Accepted Answer

Enable Cloud NAT logging with error filtering, review the allocation and connection logs for dropped connections and port allocation failures, and increase the minimum ports per VM or add more NAT IP addresses.. Cloud NAT port exhaustion manifests as dropped connections and allocation failures, which the NAT logging feature records when error and allocation logging are enabled. Confirming those entries validates the hypothesis, and expanding capacity by increasing minimum ports per VM or adding NAT IP addresses resolves the underlying limit. Flow logs, byte-decline alerts, and BGP checks operate at other layers and cannot confirm or fix the problem.

Answer

Inspect Cloud NAT metrics in Cloud Monitoring for allocated ports and set an alert when the sent bytes metric declines.

Answer

Enable VPC Flow Logs on the GKE node subnet and analyze dropped TCP SYN packets to the payment provider's IP range.

Answer

Configure a Cloud Router custom route advertisement for the NAT IPs and verify BGP session health to the payment provider.

Question 11

A media company is designing a VPC network for a new video streaming service. They need to ensure that the network can handle high volumes of outbound traffic to the internet, and they want to implement network security controls to protect their backend instances. The backend instances should not have external IP addresses. They also want to log all network traffic for auditing. Which two Google Cloud features should the network engineer implement? (Choose two.)

Accepted Answer

Cloud NAT to provide outbound internet access for instances without external IP addresses.. Cloud NAT provides outbound internet access for instances without external IP addresses, meeting the requirement for private backend instances to reach the internet. VPC Flow Logs captures network traffic data for auditing and security analysis. Together, they enable secure outbound connectivity and comprehensive logging. The other options are either not relevant to outbound access, limited to specific traffic types, or do not provide logging.

Answer

Cloud Armor to protect the backend instances from DDoS attacks and provide web application firewall capabilities.

Answer

Private Google Access to allow instances without external IP addresses to reach Google APIs and services.

Answer

Cloud CDN to cache content and reduce latency for outbound traffic.

Question 12

A retail company is designing a Google Cloud network for a new application that will be deployed across multiple regions. The application requires a single global anycast IP address that directs users to the closest healthy backend. The backends will be managed instance groups in us-central1 and europe-west1. Which Google Cloud load balancing solution should they use?

Accepted Answer

Global external HTTP(S) load balancer. A global external HTTP(S) load balancer is the correct choice because it provides a single global anycast IP and automatically routes users to the closest healthy backend across multiple regions. It supports HTTP(S) traffic, integrates with managed instance groups, and includes health checking and failover, making it ideal for a globally distributed web application.

Answer

Global external TCP proxy load balancer

Answer

Regional external HTTP(S) load balancer

Answer

Internal TCP/UDP load balancer

Question 13

A company is deploying a new application on Compute Engine instances in a single VPC network. The instances must be able to communicate with each other using internal IP addresses, and they must also access Google Cloud APIs without traversing the public internet. The company wants to minimize latency and cost. What should they configure?

Accepted Answer

Private Google Access on the subnet. Private Google Access is the correct choice because it enables instances without external IPs to reach Google APIs using internal IP addresses, keeping traffic on Google's private network. This reduces latency, avoids public internet egress costs, and is simple to configure on a subnet. Other options do not provide private API access or add unnecessary complexity.

Answer

Cloud VPN to a Google API endpoint

Answer

Cloud NAT on the VPC

Answer

VPC peering with a shared VPC

Question 14

A retail company is designing a Shared VPC topology in Google Cloud. The host project will contain shared subnets in us-central1 and europe-west1. Two service projects will each deploy regional Managed Instance Groups, and a third service project will run a global external Application Load Balancer. The security team requires that service project administrators cannot create subnets in the host project and that firewall rules are centrally managed. Which two Google Cloud IAM and Shared VPC configuration elements must be implemented to meet these requirements? (Choose two.)

Accepted Answer

Create the firewall rules in the host project and associate them with the shared subnets so that they apply to all service project instances using those subnets.. In a Shared VPC, the host project owns the network, subnets, and firewall rules, while service projects consume specific shared subnets. Scoping Compute Network User to individual subnets enforces least privilege and prevents service project administrators from creating subnets. Central firewall rules in the host project apply to all service project instances using those subnets, satisfying the security team's requirement for centralized control.

Answer

Grant the service project administrators the Compute Network Admin role (roles/compute.networkAdmin) on the host project so they can manage firewall rules for their own workloads.

Answer

Enable VPC peering between the host project and each service project so that the service projects can use the shared subnets.

Answer

Assign the service project administrators the Shared VPC Admin role (roles/compute.xpnAdmin) on the host project so they can attach additional service projects.

Question 15

A retail company is prototyping a new multi-tier application in Google Cloud. The web tier must be reachable from the internet on TCP ports 80 and 443, while the database tier must accept connections only from the web tier's internal IP addresses. The security team requires that firewall rules be centrally managed and automatically applied to all current and future instances in the VPC, regardless of which project they belong to. Which approach should the network engineer use?

Accepted Answer

Configure a hierarchical firewall policy at the organization or folder level with rules that allow tcp:80,443 from 0.0.0.0/0 for the web tier and tcp:3306 from the web tier's subnet for the database tier, using secure tags to identify the tiers.. Hierarchical firewall policies are the correct choice because they are applied at the organization or folder level and automatically affect all VPC networks and instances underneath, including future ones. Secure tags allow dynamic targeting of instances based on identity attributes, eliminating the need to manage network tags manually. This provides the centralized, automatic enforcement required by the security team.

Answer

Create two VPC firewall rules: one allowing tcp:80,443 from 0.0.0.0/0 with target tags 'web', and another allowing tcp:3306 from the web tier's subnet range with target tags 'db'. Apply these rules in the host project.

Answer

Deploy a third-party next-generation firewall appliance in the VPC and route all traffic through it using policy-based routes. Configure the appliance to allow the required ports and block all other traffic.

Answer

Use VPC Service Controls to create a service perimeter around the project, and define ingress and egress rules to allow only the required ports between the web and database tiers.