PCNE Practice Test 38 — 15 Questions

Question 1

A company is deploying a global e-commerce platform on Google Cloud. The network team must ensure that all outbound traffic from Compute Engine instances in the 'web' VPC (project 'prod-web') to the internet is routed through a single regional Cloud NAT gateway in us-central1 with a fixed set of external IP addresses for allowlisting by partners. However, they also need to allow incoming SSH connections from a bastion host in a different VPC. The instances have no external IP addresses. Which configuration should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud NAT gateway in us-central1 with a manual external IP allocation, and configure a firewall rule to allow SSH from the bastion host's internal IP range.. Cloud NAT with manual external IP allocation provides predictable outbound IPs for allowlisting, while keeping instances without external IPs. A firewall rule allowing SSH from the bastion host's internal IP range enables secure inbound management access. Together, these satisfy both the outbound fixed-IP requirement and the inbound SSH requirement, leveraging native Google Cloud networking features.

Answer

Assign ephemeral external IP addresses to all instances in the web VPC and use a firewall rule to restrict inbound SSH to the bastion host's external IP.

Answer

Configure a Cloud NAT gateway with auto-allocation of external IPs and use a firewall rule to allow SSH from the bastion host's internal IP range.

Answer

Deploy a third-party NAT instance on a Compute Engine VM with a static external IP, and route all outbound traffic through it using a custom route.

Question 2

A media company is prototyping a new VPC network in Google Cloud. They want to ensure that all outbound traffic from their Compute Engine instances to the internet uses a static external IP address that can be allowlisted by a partner's firewall. The instances must not have external IP addresses assigned. Which Google Cloud feature should they configure?

Accepted Answer

Cloud NAT with a manually allocated external IP address on the Cloud Router. Cloud NAT is the Google Cloud service that lets instances without external IP addresses reach the internet. When you reserve a static external IP address and assign it to the NAT gateway, outbound traffic from those instances is translated to that address, giving the partner a single, stable IP to allowlist. This is the standard design for predictable outbound internet access.

Answer

An external passthrough Network Load Balancer with a reserved static IP address

Answer

A Cloud VPN tunnel with a static external IP address on the Cloud VPN gateway

Answer

A VPC firewall rule that allows egress to the partner's IP range

Question 3

A company is designing a Google Cloud network for a multi-tier application. The web tier must be accessible from the internet on port 443, the application tier must only accept traffic from the web tier on port 8080, and the database tier must only accept traffic from the application tier on port 3306. All tiers are in the same VPC network and use network tags. Which firewall rule configuration should they use to meet these requirements?

Accepted Answer

Create three ingress firewall rules: allow 443 from 0.0.0.0/0 to target tag 'web'; allow 8080 from source tag 'web' to target tag 'app'; allow 3306 from source tag 'app' to target tag 'db'.. The correct configuration uses network tags to enforce tier isolation. The web tier is open to the internet on port 443, the application tier only accepts traffic from the web tier on port 8080, and the database tier only accepts traffic from the application tier on port 3306. This matches the requirements and leverages tags for precise control. Other options either omit tags, reverse source and target, or introduce unnecessary priority settings.

Answer

Create three ingress firewall rules: allow 443 from 0.0.0.0/0 to target tag 'web'; allow 8080 from source tag 'web' to target tag 'app'; allow 3306 from source tag 'app' to target tag 'db'; and set priority 1000 for all rules.

Answer

Create three ingress firewall rules: allow 443 from 0.0.0.0/0 to web tier; allow 8080 from web tier to app tier; allow 3306 from app tier to db tier.

Answer

Create three ingress firewall rules: allow 443 from 0.0.0.0/0 to target tag 'web'; allow 8080 from source tag 'app' to target tag 'web'; allow 3306 from source tag 'db' to target tag 'app'.

Question 4

A company is designing a hybrid network that connects their on-premises data center to Google Cloud using Cloud VPN. They need to ensure that the on-premises network can reach all subnets in the VPC, including those in different regions, and that the VPC can reach all on-premises subnets. They also want to minimize the number of VPN tunnels and BGP sessions. What should they configure?

Accepted Answer

A single Cloud VPN tunnel with dynamic routing (BGP) and global routing enabled on the VPC.. Dynamic routing with BGP allows automatic exchange of routes between on-premises and the VPC. Enabling global routing on the VPC ensures that routes learned via BGP are propagated to all regions, so on-premises can reach all subnets without additional tunnels. A single tunnel minimizes the number of tunnels and BGP sessions, though for production high availability, multiple tunnels are recommended. Static routing or regional routing would require more manual configuration or additional tunnels.

Answer

A single Cloud VPN tunnel with static routing and custom routes for each subnet.

Answer

A single Cloud VPN tunnel with dynamic routing (BGP) and regional routing enabled on the VPC.

Answer

Multiple Cloud VPN tunnels, one per region, with dynamic routing (BGP) and regional routing.

Question 5

A healthcare company is designing a VPC network for a new application that must be isolated from the internet. The application instances need to access a Cloud Storage bucket in the same project without traversing the public internet. The security team requires that the traffic never leave Google's network. Which Google Cloud feature should they use?

Accepted Answer

Private Google Access on the subnet where the instances reside. Private Google Access enables instances that only have internal IP addresses to reach Google APIs and services such as Cloud Storage. The traffic is routed within Google's network and never uses the public internet, which meets the strict isolation requirement. It is configured on the subnet, so all instances in that subnet benefit.

Answer

A firewall rule allowing egress to the Cloud Storage IP ranges

Answer

A Cloud NAT gateway configured on the VPC network

Answer

VPC Network Peering between the application VPC and a dedicated VPC for Google services

Question 6

An engineer is creating a Compute Engine instance in a subnet that has no external IP address assigned. The instance must download OS package updates from an external public repository over HTTPS. The subnet already has Cloud NAT configured. What should the engineer verify to ensure the instance can reach the public internet?

Accepted Answer

That Cloud NAT is configured for the region and subnet where the instance resides.. Cloud NAT provides outbound internet access for instances without external IPs, but it is scoped to a region and a set of subnets. For the instance to reach a public package repository, a NAT gateway must exist for that region and cover the instance's subnet. Verifying that coverage confirms the outbound path works as intended.

Answer

That firewall rules allow ingress from the repository's IP ranges.

Answer

That the instance has the appropriate access scopes for the repository.

Answer

That the instance has a public PTR record in Cloud DNS.

Question 7

A company has a VPC network with a subnet in us-central1. They need to allow SSH access from the internet to a group of Compute Engine instances that have the network tag 'ssh-enabled'. The instances have external IP addresses. Which firewall rule configuration should the engineer create?

Accepted Answer

Create an ingress firewall rule with action allow, protocol tcp, port 22, source range 0.0.0.0/0, and target tags 'ssh-enabled'.. To allow SSH from the internet, an ingress firewall rule must permit TCP port 22 from a source range that includes public IPs, typically 0.0.0.0/0. The rule should target only the intended instances, which are identified by the network tag 'ssh-enabled'. Egress rules control outbound traffic and are not relevant for inbound SSH. Using a restrictive source range like 10.0.0.0/8 would block internet traffic, and targeting by service account would not specifically select the tagged instances.

Answer

Create an ingress firewall rule with action allow, protocol tcp, port 22, source range 0.0.0.0/0, and target service accounts 'default'.

Answer

Create an ingress firewall rule with action allow, protocol tcp, port 22, source range 10.0.0.0/8, and target tags 'ssh-enabled'.

Answer

Create an egress firewall rule with action allow, protocol tcp, port 22, destination range 0.0.0.0/0, and target tags 'ssh-enabled'.

Question 8

A company is planning to migrate a legacy on-premises application to Google Cloud. The application requires a fixed private IP address that must remain the same even if the VM is recreated. The network team wants to ensure that the IP is not accidentally assigned to another resource. What should they do?

Accepted Answer

Create a static internal IP address reservation in the subnet and assign it to the VM's network interface.. Reserving a static internal IP address in the subnet prevents other resources from using it and allows you to assign it to a VM's network interface. This ensures the private IP remains constant across VM lifecycle events and meets the legacy application's need for a fixed address without accidental reassignment.

Answer

Assign an ephemeral internal IP address to the VM and configure a long DHCP lease time.

Answer

Use a reserved external IP address and map it to the VM's internal IP via NAT.

Answer

Configure the VM to use a custom static route with the desired IP address.

Question 9

A company is deploying a Compute Engine instance that will serve as a VPN gateway. The instance needs to forward encrypted traffic between an on-premises network and a VPC network. The engineer must ensure the instance can forward packets and that the VPC routes traffic appropriately. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Enable IP forwarding on the VPN gateway instance.. For a Compute Engine instance to act as a VPN gateway, it must be able to forward packets not addressed to itself, which requires enabling IP forwarding. Additionally, the VPC must have a custom static route that directs traffic destined for the on-premises network to the VPN gateway instance, so that other instances can reach the on-premises network. Assigning external IPs to all interfaces is not possible, allowing all traffic is insecure, and network tier does not enable forwarding.

Answer

Set the instance's network tier to Premium to ensure global routing.

Answer

Assign an external IP address to each network interface of the VPN gateway instance.

Answer

Configure a firewall rule to allow all traffic on the VPN gateway instance.

Question 10

A network engineer must create a Compute Engine VM whose primary internal IP address is fixed and does not change even if the VM is stopped and restarted. The VM runs in subnet `subnet-a` in `us-central1`. Which configuration achieves this with the least operational overhead?

Accepted Answer

Reserve a static internal IP address in subnet-a and assign it to the VM's primary network interface.. A reserved static internal IP address assigned as the VM's primary internal IP remains bound to the VM across stop and start operations, and can be retained even if the instance is deleted. This is the standard, low-overhead way to give an instance a stable internal address without DNS workarounds or alias ranges.

Answer

Attach an alias IP range to the VM's network interface and use the first address in the range.

Answer

Assign an ephemeral internal IP and create a Cloud DNS A record that maps a hostname to that address.

Answer

Reserve a static external IP address and use its DNS name for internal access.

Question 11

A company is designing a network for a new application that will be deployed on Google Kubernetes Engine (GKE). They need to ensure that pods can communicate with each other across nodes and that services are accessible within the VPC. They also want to minimize IP address consumption. Which GKE network configuration should they choose?

Accepted Answer

Use a VPC-native cluster with secondary IP ranges for pods and services, and size the secondary ranges appropriately to avoid waste.. VPC-native clusters use alias IP ranges for pods and services, which are natively routable within the VPC. This allows pods on different nodes to communicate directly without static routes. By carefully sizing the secondary ranges—allocating enough IPs for expected pods and services but not excessively—you minimize IP consumption. Separate ranges for pods and services are required to avoid conflicts.

Answer

Use a VPC-native cluster with a single secondary range for both pods and services to simplify management.

Answer

Use a VPC-native cluster with secondary IP ranges for pods and services, and enable IP masquerading for pod egress.

Answer

Use a routes-based cluster with a large pod CIDR, and configure a custom static route for each node.

Question 12

A company is designing a VPC network in Google Cloud to host a three-tier web application. They need to ensure that the database tier is isolated from the internet while allowing the web tier to receive traffic from the internet. They also need to allow the application tier to communicate with the database tier on specific ports. Which two configurations should they implement? (Choose two.)

Accepted Answer

Create a firewall rule that allows ingress traffic from the application tier's service account to the database tier on the database's listening port.. To meet the requirements, the web tier must be accessible from the internet, so a firewall rule allowing ingress from 0.0.0.0/0 on ports 80 and 443 is needed. The database must be isolated from the internet but accept traffic from the application tier, so a rule allowing ingress from the application tier's service account on the database port is required. Together, these rules enable the three-tier architecture securely.

Answer

Create a firewall rule that allows ingress traffic from the web tier's network tag to the application tier on the application's listening port.

Answer

Create a firewall rule that denies all ingress traffic to the database tier from any source.

Answer

Create a firewall rule that allows ingress traffic from 0.0.0.0/0 to the database tier on the database's listening port.

Question 13

An engineer needs to create a Compute Engine instance that has a persistent static external IP address. Which method should be used?

Accepted Answer

Reserve a static external IP address and assign it to the instance during creation.. A persistent static external IP address must be reserved and then assigned to the instance. Ephemeral IPs are temporary and cannot be made static. DNS records and IP forwarding do not provide a static external IP. The correct approach is to reserve the IP and attach it during or after instance creation.

Answer

Use a DNS A record pointing to the instance's internal IP.

Answer

Create the instance with an ephemeral external IP, then promote it to static.

Answer

Enable IP forwarding on the instance.

Question 14

A Cloud Network Engineer is configuring a Compute Engine VM with two network interfaces: `nic0` in `vpc-a` and `nic1` in `vpc-b`. The engineer needs the VM to use `nic1` for all traffic destined to the internet and to on-premises networks reachable through `vpc-b`. The VM runs a Linux guest OS. Which TWO actions must the engineer take to achieve this? (Choose two.)

Accepted Answer

Ensure that the VPC firewall rules in vpc-b allow the required egress traffic to the internet and on-premises destinations.. With multiple interfaces, the guest OS decides the egress interface, so the routing table must be configured to send internet and on-premises traffic out of nic1's gateway. Additionally, the VPC network associated with the egress interface must have firewall rules permitting that egress traffic. Both conditions are necessary; neither alone is sufficient.

Answer

Enable IP forwarding on the VM so that it can route between the two VPCs.

Answer

Attach an external IP address to nic1 and remove any external IP from nic0.

Answer

Create a static route in vpc-a that points to the VM's nic0 address as the next hop for all destinations.

Question 15

A company has a VPC network with two subnets: subnet-a (10.0.1.0/24) in us-central1 and subnet-b (10.0.2.0/24) in europe-west1. They deploy a Compute Engine instance in subnet-a without an external IP address. The instance needs to access a Cloud Storage bucket. The engineer wants to avoid assigning an external IP to the instance. What should the engineer do to allow the instance to access Cloud Storage?

Accepted Answer

Configure Private Google Access on subnet-a.. Private Google Access enables instances without external IP addresses to reach Google APIs and services, such as Cloud Storage, using internal IP addresses. Enabling it on the subnet where the instance is located allows the instance to access Cloud Storage without an external IP. Firewall rules alone do not enable this access, assigning an external IP violates the constraint, and Cloud NAT is a broader solution for internet access that is not necessary when only Google APIs are needed.

Answer

Set up a Cloud NAT gateway on subnet-a.

Answer

Create a firewall rule allowing egress traffic to the Cloud Storage IP ranges.

Answer

Assign a static external IP address to the instance.