PCNE Practice Test 38 — 15 Questions

Question 1

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Private Google Access enabled on the subnet where the VPN gateway resides.. Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.

Answer

Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.

Answer

Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

Answer

Cloud NAT configured in the VPC.

Question 2

A customer has established a Dedicated Interconnect, but traffic from on-premises to Google Cloud is still using the internet path instead of the interconnect. What is the most likely cause?

Accepted Answer

The BGP routes from on-premises have a lower priority than the default route via internet.. Google Cloud uses route priority to determine which route is used when multiple routes match a destination. The default route (0.0.0.0/0) is a system route with priority 0 (highest priority). BGP routes learned via Dedicated Interconnect have a priority of 200 (lower priority). When both exist, the route with the lower priority number (higher priority) wins, so the default route via the internet takes precedence over the BGP routes from the interconnect. This causes traffic to use the internet path instead of the interconnect.

Answer

The on-premises firewall blocks BGP traffic.

Answer

The Google Cloud Router has not learned any routes.

Answer

The VLAN attachment is in a different region.

Question 3

An organization is using Cloud VPN with dynamic routing and wants to improve failover time between two VPN tunnels. Which THREE configuration changes can help reduce failover time?

Accepted Answer

Set a lower BGP MED value on the primary tunnel. Lowering the BGP Multi-Exit Discriminator (MED) value on the primary tunnel makes it more preferred by the BGP best-path selection process. When the primary tunnel fails, BGP withdraws the route, and the backup tunnel (with a higher MED) is immediately used without waiting for timers to expire. This reduces failover time by ensuring the backup path is already known and only needs to be selected upon withdrawal.

Answer

Increase the BGP keepalive interval to reduce overhead

Answer

Add static routes with a higher priority than BGP routes

Question 4

An organization has multiple projects and wants to apply a consistent set of firewall rules across all VPC networks in the organization. Which approach should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization level and are inherited by all folders and projects, ensuring consistent rules across the entire hierarchy.

Answer

Create a network firewall policy and attach it to each VPC

Answer

Use VPC peering to share rules

Answer

Apply firewall rules using tags in each project

Question 5

A network engineer is designing a VPC in Google Cloud with multiple subnets across different regions. The application requires low-latency communication between instances in the same region but not across regions. Which VPC network configuration should be used?

Accepted Answer

Custom mode VPC with regional subnets. Custom mode VPC with regional subnets (D) is correct because it allows you to explicitly define subnets in specific regions, ensuring that instances within the same region communicate over low-latency paths without cross-region traffic. This design avoids the automatic creation of subnets in every region (as in auto mode) and prevents the use of deprecated legacy networks, giving you full control over regional placement for latency-sensitive applications.

Answer

Auto mode VPC with global subnets

Answer

Legacy network

Answer

Auto mode VPC with regional subnets

Question 6

You are troubleshooting a failing HA VPN tunnel between GCP and on-premises. The tunnel status shows 'Tunnel is down' in Cloud Console. Which TWO steps should you take to diagnose the issue? (Choose two.)

Accepted Answer

Check the on-premises firewall rules to ensure UDP ports 500 and 4500 are allowed. Checking Cloud VPN gateway logs for IKE errors helps identify authentication or configuration mismatch. Verifying that the on-premises firewall allows UDP 500 and 4500 for IPsec is necessary because many failures are due to firewall blocking.

Answer

Confirm that the GCP VPC has a firewall rule allowing inbound IPsec traffic

Answer

Verify that the Cloud Router BGP session is established

Answer

Ensure that the on-premises VPN gateway has a static route to the GCP VPC

Question 7

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

Accepted Answer

Create host project and enable Shared VPC, attach service projects to host project, grant IAM permissions to service project admins, service project admins create resources using shared subnets.. Shared VPC requires a host project with VPC, then granting access to service projects. Service projects then use the shared subnets.

Answer

Grant IAM permissions to service project admins, create host project and enable Shared VPC, attach service projects to host project, service project admins create resources.

Answer

Attach service projects to host project, create host project and enable Shared VPC, grant IAM permissions, service project admins create resources.

Answer

Create service projects first, then create host project and enable Shared VPC, attach service projects, grant IAM permissions.

Question 8

An organization wants to connect their on-premises network to Google Cloud using a Dedicated Interconnect. They have ordered a circuit from a network service provider and need to determine the correct co-location facility to connect to. Which factor is most critical when selecting a co-location facility?

Accepted Answer

The facility must be a Google Cloud partner facility with access to a Google PoP in the same metro as the on-premises data center.. The co-location facility must be a Google Cloud partner facility that provides access to a Google Point of Presence (PoP) in the same metro area as the organization's on-premises data center to minimize latency and meet SLA requirements.

Answer

The facility must offer Layer 2 connectivity to the Google Cloud VPC.

Answer

The facility must support 100 Gbps ports to maximize throughput.

Answer

The facility must be in a different continent to ensure geographic redundancy.

Question 9

A company has an external HTTP(S) load balancer with a backend service pointing to an instance group in us-east1. They enable Cloud CDN to improve performance for global users. After enabling, they observe that users in Asia still experience high latency. They verify that the backend instances respond with Cache-Control headers that allow caching. What is the most likely reason for the high latency?

Accepted Answer

The load balancer is a regional load balancer, not a global one.. An external HTTP(S) load balancer that is regional (e.g., a regional external HTTP(S) load balancer) cannot serve traffic globally with low latency; it is confined to a single region. Cloud CDN caches content at edge locations, but if the load balancer itself is regional, the cache points are also regional, so users in Asia still route to us-east1 for cache misses or even for cache hits if the edge is not globally distributed. Only a global external HTTP(S) load balancer (with a global anycast IP) can leverage Cloud CDN's global edge cache locations to serve users from the nearest point of presence.

Answer

The cache TTL is too short.

Answer

Cloud CDN is not enabled on the correct backend.

Answer

The backend instances are in us-east1, too far from Asia.

Question 10

A company wants to set up a hybrid network with HA VPN between an on-premises network and GCP. They need a 99.99% SLA. Which THREE conditions must be met to achieve this SLA?

Accepted Answer

Two or more tunnels established with BGP sessions. To achieve a 99.99% SLA with HA VPN, you need at least two tunnels, each with a separate external IP on the GCP side, and the on-premises gateway must have two distinct public IP addresses. Unique pre-shared keys per tunnel are recommended for security but are not a requirement for the SLA.

Answer

Cloud Router configured with global dynamic routing mode

Answer

Two Cloud VPN gateways in GCP, each with one interface

Answer

Each tunnel uses a unique IKE pre-shared key

Question 11

Which TWO of the following are required when setting up an internal TCP/UDP load balancer (ILB) in a shared VPC environment?

Accepted Answer

A health check must be configured for the backend service.. Correct answers: A and D. A: A health check is mandatory for an internal TCP/UDP load balancer (ILB) backend service to determine instance health. D: The ILB forwarding rule must be in the same region as the backend instances because ILB is a regional load balancer. B: Incorrect. ILB does not use proxy-only subnets; firewall rules for proxy-only subnets are required only for load balancers that use Envoy proxies (e.g., HTTP(S) LB). C: Incorrect. While the forwarding rule's IP address is taken from a subnet in the shared VPC (owned by the host project), this is not a separate requirement; the critical requirement is that the forwarding rule and backends are in the same region. E: Incorrect. Global routing is not needed for ILB; it operates within a single region.

Answer

A firewall rule must allow traffic from the proxy-only subnet.

Answer

The forwarding rule's IP address must be from the host project's subnet.

Answer

Global routing must be enabled in the VPC.

Question 12

A company has a Hybrid Connectivity setup using Cloud VPN with dynamic routing (BGP). They notice that traffic from their on-premises network to Google Cloud is intermittently dropping. The on-premises BGP speaker is sending routes with a higher local preference (200) than the Google Cloud router (default 100). What is the most likely cause of the intermittent drops?

Accepted Answer

Asymmetric routing is causing traffic to be dropped by stateful firewalls. The on-premises BGP speaker is sending routes with a higher local preference (200) than the default on Cloud Router (100). This makes the on-premises route preferred for return traffic from Google Cloud, but the forward traffic from on-premises may still use the Cloud VPN tunnel. This asymmetry causes stateful firewalls (e.g., on-premises firewall or Google Cloud firewall) to drop packets that do not match an existing session, leading to intermittent drops.

Answer

AS path prepending is causing route flapping

Answer

Cloud Router is not configured for ECMP

Answer

The BGP MED attribute is misconfigured

Question 13

A multinational company has a Shared VPC environment with multiple service projects. They need to allow a specific service project to use its own Cloud DNS private zone that resolves to internal IPs in the Shared VPC. Which configuration ensures this without exposing the zone to other projects?

Accepted Answer

Create a DNS response policy in the Shared VPC host project and associate it with the service project's VPC.. DNS response policies allow you to control DNS resolution per VPC in a Shared VPC environment. By creating a response policy in the host project and associating it with the service project's VPC, you enable that service project to use its own private zone without exposing it to other projects. Option A is incorrect because an inbound server policy is used for on-premises DNS resolution, not for granting private zone access to a service project. Option B is incorrect because VPC peering would allow the service project to manage DNS records, but it does not restrict access to the zone; moreover, peering is not the correct approach for selective DNS resolution in a Shared VPC. Option C is incorrect because granting IAM roles alone does not associate the private zone with a specific VPC; it would allow the service project to view or manage the zone, but the zone would still be visible to other projects with access.

Answer

Create a private zone in the service project and use an inbound server policy.

Answer

Use VPC peering and allow the service project to manage DNS records.

Answer

Grant the service project access to the Shared VPC's private zone via IAM roles.

Question 14

A company has a Cloud VPN tunnel to on-premises. They want on-premises clients to resolve private DNS names in the VPC. Which service should they configure?

Accepted Answer

Inbound DNS policy. An inbound DNS policy forwards DNS queries from on-premises DNS servers to Cloud DNS, enabling resolution of private zone names. Option B (Outbound DNS policy) is for forwarding queries from VMs to on-premises DNS, the opposite direction. Option C (Cloud NAT) provides outbound internet access for VMs, not DNS resolution. Option D (Private Google Access) allows VMs with internal IPs to reach Google APIs, not on-premises DNS resolution.

Answer

Outbound DNS policy

Answer

Cloud NAT

Answer

Private Google Access

Question 15

Which THREE of the following are required to use Private Google Access for on-premises hosts through a Cloud VPN or Interconnect? (Choose THREE)

Accepted Answer

Firewall rules allowing traffic from on-premises to the restricted VIP IP range.. Private Google Access for on-premises hosts requires firewall rules that allow traffic from on-premises to the restricted VIP IP range (199.36.153.4/30). This is necessary because on-premises hosts must be able to reach the restricted Google APIs VIP over the VPN or Interconnect, and firewall rules control which source IPs can access that VIP. Without these rules, traffic from on-premises would be blocked at the Google Cloud perimeter.

Answer

VPC Flow Logs enabled on the VPC.

Answer

Cloud NAT configured for the on-premises subnet.