PCNE Practice Test 39 — 15 Questions

Question 1

A company uses Identity-Aware Proxy (IAP) to secure access to Compute Engine VMs. Users report that they can SSH into some VMs but not others, even though they have the IAP-secured Tunnel User role. Both VMs are in the same project and have the same network tags. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Firewall rules allow ingress from IAP's IP ranges only for some VMs.. IAP TCP forwarding relies on firewall rules that allow ingress from the IAP proxy's IP ranges (35.235.240.0/20) to the VM. If these rules are applied inconsistently across VMs (e.g., missing on some subnets or instances), users will be unable to SSH into those VMs. The fact that both VMs share the same network tags does not guarantee identical firewall configurations if rules are applied based on other criteria like target tags or service accounts. Options B and D are incorrect as DNS resolution and OS Login are not prerequisites for IAP TCP forwarding. Option C is wrong because IAP TCP forwarding works with internal IPs; external IPs are not required.

Answer

The VMs are in different zones with different DNS resolution.

Answer

The VMs that can be accessed have external IP addresses; the others only have internal IP addresses.

Answer

The VMs do not have OS Login enabled.

Question 2

A company has multiple VPC networks in the same project, each with its own Cloud NAT configuration. They notice that traffic from a VM in VPC-A that has an external IP address is being NATed through the Cloud NAT gateway, but they only want Cloud NAT to be used for VMs without external IPs. What configuration ensures this?

Accepted Answer

Remove any NAT rules that match the source subnet and include external IP addresses; Cloud NAT automatically applies only to VMs without external IPs if not explicitly configured otherwise.. Cloud NAT only performs source network address translation for VMs that do not have external IP addresses, unless you explicitly configure NAT rules that match traffic from VMs with external IPs. By removing any such custom NAT rules, the default behavior ensures that only VMs without external IPs are NATed through the Cloud NAT gateway, leaving VMs with external IPs to use their own public addresses directly.

Answer

Disable the 'send-tosource-ip' flag on the Cloud NAT gateway.

Answer

Set the network tier of the VM to 'Standard' instead of 'Premium'.

Answer

Enable Cloud NAT logging to track which VMs are NATed.

Question 3

A financial services firm needs to connect their on-premises data center to Google Cloud VPC with 50 Gbps of bandwidth and latency under 5 ms. They are in a metropolitan area with a Google Cloud region. They require an SLA of 99.99% and need to support VLAN attachments to multiple VPCs. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides direct, private connections between the on-premises data center and Google Cloud VPC, supporting up to 80 Gbps per interconnect (via 8 x 10 Gbps links) and offering a 99.99% SLA when configured with redundant links. It supports VLAN attachments (VLANs) to multiple VPCs, enabling segmentation across different environments, and meets the sub-5 ms latency requirement within a metropolitan area with a Google Cloud region.

Answer

Direct Peering

Answer

Cloud VPN with multiple tunnels and ECMP

Answer

Partner Interconnect

Question 4

Refer to the exhibit. A user within the perimeter project '111111111111' tries to access BigQuery from a VM that has an external IP address. The request is denied. What is the most likely reason?

Accepted Answer

The VPC Accessible Services restriction requires that the request originate from an internal IP address or through VPC-controlled access.. The VPC Accessible Services restriction, when enabled, forces all traffic to Google APIs to use internal IP addresses or VPC-controlled access (such as Private Google Access or Private Service Connect). Since the VM has an external IP address and the request is denied, the most likely reason is that this restriction is in place, requiring the request to originate from an internal IP or through a VPC endpoint, not from a public external IP.

Answer

BigQuery is not listed in the restricted services, so it is blocked.

Answer

The user does not meet the access level conditions defined in 'trusted_ips'.

Answer

The VM's project is not in the resources list.

Question 5

A startup wants to minimize costs for their development VPC. They have a few VMs that need occasional internet access for updates. What is the most cost-effective approach?

Accepted Answer

Use Cloud NAT with a static IP. Cloud NAT with a static IP is the most cost-effective approach because it allows multiple VMs to share a single static IP address for outbound internet access, eliminating the need for individual external IPs. This reduces costs since external IP addresses incur charges, and Cloud NAT provides managed, scalable outbound connectivity without requiring a VPN or dedicated gateway.

Answer

Use Private Google Access

Answer

Use a VPN to an on-prem network for internet

Answer

Assign external IPs to each VM

Question 6

An enterprise uses HA VPN to connect their on-premises network to Google Cloud. The on-premises side has a single VPN device that supports BGP. They want to maximize availability. What is the recommended Google Cloud configuration?

Accepted Answer

Deploy a single Cloud VPN gateway with two interfaces, each with its own external IP, and configure two BGP sessions to the single on-premises device.. It provides high availability by using a single Cloud VPN gateway with two interfaces, each with its own external IP, and two BGP sessions to the on-premises device. This configuration allows active/active failover: if one interface or BGP session fails, traffic automatically switches to the other, maximizing availability without requiring multiple regions.

Answer

Deploy two Cloud VPN gateways in different regions to provide regional failover.

Answer

Deploy a single Cloud VPN gateway with one interface and one BGP session.

Answer

Deploy a single Cloud VPN gateway with two interfaces, but only use one BGP session for simplicity.

Question 7

A company wants to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have ordered a 10 Gbps connection and plan to use a single VLAN attachment. How many Cloud Router interfaces are required for a single VLAN attachment with active/active BGP?

Accepted Answer

1 interface. For a single VLAN attachment using Dedicated Interconnect with active/active BGP, only one Cloud Router interface is required. The Cloud Router interface represents the VLAN attachment itself, and BGP sessions are configured as sub-interfaces under that single interface. Active/active BGP does not require multiple interfaces; it uses two BGP sessions (one for each router in the pair) but both sessions share the same VLAN attachment and Cloud Router interface.

Answer

4 interfaces (two for each BGP session)

Answer

2 interfaces (one for each VLAN)

Answer

2 interfaces (one for each BGP session)

Question 8

Which THREE components are required to set up a Partner Interconnect connection?

Accepted Answer

A VLAN attachment. A VLAN attachment (option B) is required because it defines the connection between your VPC and the partner's network over a Partner Interconnect, specifying the VLAN ID and IP addressing for the BGP session. Without a VLAN attachment, the Layer 2 and Layer 3 parameters for the interconnect cannot be established.

Answer

A Dedicated Interconnect connection

Answer

A Cloud VPN gateway

Question 9

Which THREE factors can affect the throughput of a Cloud VPN tunnel? (Choose three.)

Accepted Answer

Tunnel type (route-based vs policy-based). Tunnel type (route-based vs policy-based) affects throughput because route-based tunnels (e.g., using BGP or static routes) can leverage ECMP and do not require per-flow policy lookups, reducing CPU overhead. Policy-based tunnels require the VPN gateway to evaluate each packet against a security policy, which adds latency and can limit throughput, especially under high traffic loads.

Answer

VM instance types

Answer

Number of tunnels

Question 10

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

Accepted Answer

Private Service Connect endpoint. When a consumer wants to connect to a managed SaaS application published via Private Service Connect (PSC), they must create a Private Service Connect endpoint in their own VPC. This endpoint is a regional resource that uses an internal IP address from the consumer's VPC and establishes a connection to the service attachment published by the provider. The endpoint effectively makes the SaaS service accessible as if it were a resource inside the consumer's VPC, without requiring public IPs or VPNs.

Answer

Service attachment

Answer

Internal forwarding rule

Answer

Cloud VPN tunnel

Question 11

A company uses a shared VPC with multiple service projects. They want to connect their on-premises data center to the shared VPC through a Dedicated Interconnect. Where should they configure the Cloud Router and VLAN attachment?

Accepted Answer

In the host project of the shared VPC. In a shared VPC architecture, the Cloud Router and VLAN attachment for Dedicated Interconnect must be configured in the host project because the host project owns the VPC network and manages all network resources, including interconnect attachments. Service projects consume subnets from the host project but cannot create or manage interconnect resources. This ensures that the on-premises connectivity is centrally managed and that all service projects can use the interconnect through the shared VPC's routing.

Answer

In the same region as the majority of service project instances

Answer

In a global resource policy, cross-project

Answer

In the service project that will use the connectivity

Question 12

A company has a VPC with subnet 10.1.0.0/24 in us-central1. They created a Cloud NAT gateway named 'nat-us-central1' attached to that subnet. During peak hours, many VM instances in the subnet cannot connect to the internet. The NAT configuration shows only one NAT IP. Firewall rules allow egress traffic, and health checks confirm the NAT gateway is functioning. What is the most likely cause of the failure?

Accepted Answer

Port exhaustion due to insufficient NAT IP addresses.. With only one NAT IP address and many VM instances sharing it, the available source ports (65,535 per IP) are quickly exhausted during peak hours. Each concurrent outbound connection consumes a unique source port; once all ports are in use, new connections fail. This is a classic port exhaustion scenario, not a configuration or firewall issue.

Answer

The Cloud Router is missing or misconfigured.

Answer

The NAT gateway is not attached to the correct subnet.

Answer

An egress firewall rule blocks ICMP packets.

Question 13

Your company has a VPC with a single subnet in us-central1 (10.0.1.0/24). You have a managed instance group (MIG) of web servers (10.0.1.2-10.0.1.10) and a standalone database instance (10.0.1.100). The web servers need to communicate with the database on TCP port 3306. You have configured a firewall rule allowing ingress from 10.0.1.0/24 to 10.0.1.100 on tcp:3306. However, the web servers cannot connect to the database. You verified that the database is running and listening on port 3306, and that the web servers can ping the database. What should you do to resolve the issue?

Accepted Answer

Check the database instance's OS-level firewall (e.g., iptables) and ensure it allows traffic on port 3306 from the web servers.. The firewall rule is correctly configured at the VPC level to allow ingress from the web servers' subnet to the database on TCP port 3306. Since the web servers can ping the database, network connectivity exists, but the application-layer connection fails. This indicates the database instance's OS-level firewall (e.g., iptables on Linux) is blocking the port, as cloud VPC firewall rules and guest OS firewalls operate independently.

Answer

Create a custom route from the web servers to the database.

Answer

Add a network tag 'db' to the database instance and update the firewall rule to target 'db'.

Answer

Configure the firewall rule to use the database's service account as the target.

Question 14

An engineer needs to monitor Cloud NAT gateway usage for cost allocation and troubleshooting. Which TWO types of logs should they enable? (Choose TWO.)

Accepted Answer

Translation logs (failures). Cloud NAT provides two types of logs: NAT logs (connection information) and translation logs (allocation failures). Both are useful for monitoring and troubleshooting.

Answer

VPC Flow Logs

Answer

Load balancer access logs

Answer

Firewall rules logs

Question 15

A network engineer notices unexpected traffic being allowed through a VPC firewall rule. They want to analyze the logs to identify the source and destination. What is the best way to enable detailed logging for firewall rules?

Accepted Answer

Enable firewall rule logging on the specific rule and view logs in Cloud Logging.. Firewall rule logging in VPC is designed specifically to log metadata (source IP, destination IP, action, etc.) for each packet matched by a firewall rule. Enabling it on the specific rule and viewing logs in Cloud Logging provides the granular, per-rule detail needed to identify the source and destination of unexpected traffic. This is the direct and intended method for firewall rule analysis.

Answer

Enable VPC Flow Logs for the subnet.

Answer

Create a custom router with a log export.

Answer

Use Packet Mirroring to capture all traffic.