PCNE Practice Test 39 — 15 Questions

Question 1

A healthcare company is designing a VPC network for a new application that will process sensitive patient data. They need to ensure that all outbound internet traffic from their Compute Engine instances goes through a centralized set of firewall appliances for inspection. The instances must not have external IP addresses. Which Google Cloud feature should they use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Custom static route with next hop as an instance in a centralized VPC. To route outbound internet traffic through centralized firewall appliances, you can use a custom static route with the next hop as an instance in a centralized VPC. This allows the traffic to be inspected before it goes to the internet. Instances without external IPs can still send traffic to the appliance, which then forwards it after inspection. This approach is commonly used with third-party firewall appliances.

Answer

Cloud NAT with a custom NAT IP address

Answer

VPC Network Peering with a shared VPC

Answer

Cloud VPN with a policy-based route

Question 2

A network engineer is configuring Cloud IDS to inspect traffic entering a VPC from an on-premises data center over a Cloud VPN tunnel. The VMs that must be protected are in subnet 10.0.1.0/24, and the tunnel terminates in the same region. Which deployment approach correctly places Cloud IDS in the traffic path?

Accepted Answer

Create a Cloud IDS endpoint, then create a packet mirroring policy whose mirrored source is the subnet or instances to protect and whose collector is the IDS endpoint.. Cloud IDS inspects copies of packets delivered by packet mirroring, so the correct design creates an IDS endpoint and then a mirroring policy that names the protected subnet or instances as the mirrored source and the endpoint as the collector. Routes and next hops do not deliver traffic to IDS, and Cloud IDS does not forward to third-party appliance addresses.

Answer

Deploy a third-party firewall appliance VM and configure Cloud IDS to mirror traffic to that appliance's internal IP address.

Answer

Create a Cloud IDS endpoint and attach it directly as a next hop in a custom static route for the on-premises destination range.

Answer

Create a Cloud IDS endpoint in the same zone as the protected VMs, and add a policy-based route that forwards all traffic to the endpoint.

Question 3

A multinational corporation is designing a Google Cloud network to support a multi-tier application across multiple projects. They need to ensure that the database tier can only be accessed by the application tier, and that the application tier can access the internet for updates but not be accessed from the internet. They also want to minimize administrative overhead. Which design should they implement?

Accepted Answer

Use a Shared VPC with separate projects for each tier, and define firewall rules and IAM policies to control access.. A Shared VPC centralizes network management in a host project while allowing service projects to use shared subnets. This reduces administrative overhead and enables consistent firewall rules and IAM policies across tiers. By placing each tier in its own service project, you achieve isolation. Firewall rules can restrict database access to only the application tier, and the application tier can access the internet via Cloud NAT while remaining inaccessible from the internet.

Answer

Use multiple VPC networks in a single project and use Cloud VPN to connect them.

Answer

Deploy all tiers in a single project with a single VPC and use firewall rules to restrict access.

Answer

Create separate VPC networks for each tier and use VPC Network Peering to connect them, with firewall rules to restrict access.

Question 4

A company has a VPC network with two subnets: 'app-subnet' (10.10.1.0/24) in us-central1 and 'data-subnet' (10.10.2.0/24) in us-east1. An instance 'app-1' in app-subnet needs to send traffic to an instance 'data-1' in data-subnet on TCP port 5432. The engineer has created an ingress firewall rule in the VPC that allows TCP 5432 from 10.10.1.0/24 to target tag 'data-server'. However, connectivity tests show that traffic is not reaching data-1. What is the most likely cause?

Accepted Answer

The instance data-1 does not have the network tag 'data-server' applied.. The ingress rule is scoped by the target tag 'data-server', so it only takes effect on instances that have that tag. If data-1 is missing the tag, the rule does not apply and the default deny blocks the connection. Cross-region subnet routing and egress permissions are not the issue here.

Answer

The source range 10.10.1.0/24 is not routable across regions in a VPC network.

Answer

A Cloud NAT configuration is required for cross-region traffic between subnets.

Answer

The firewall rule is ingress, but a corresponding egress rule is also required to allow the traffic from app-1.

Question 5

A company has a VPC network with a subnet in us-central1 (10.0.1.0/24) and another in europe-west1 (10.0.2.0/24). They need to ensure that a Compute Engine instance in us-central1 can reach an instance in europe-west1 on TCP port 3306, but only if the traffic originates from a specific service account. Which firewall rule configuration should they use?

Accepted Answer

Create an ingress rule with target service account of the destination instance, source service account of the source instance, and protocol tcp:3306.. To restrict ingress traffic based on the source service account, the firewall rule must specify the source service account in the source filter. The target service account identifies the destination instances. An ingress rule with both service accounts correctly allows only traffic from the specified source service account to the destination on the required port. Egress rules or source IP ranges do not enforce the service account restriction.

Answer

Create an egress rule with target service account of the source instance, destination service account of the destination instance, and protocol tcp:3306.

Answer

Create an ingress rule with target service account of the destination instance, source range 10.0.1.0/24, and protocol tcp:3306.

Answer

Create an ingress rule with target tag 'db' on the destination instance, source range 10.0.1.0/24, and protocol tcp:3306.

Question 6

A company runs a production VPC with a subnet in us-central1 named 'prod-subnet' (10.0.1.0/24). They want to add a second subnet in europe-west1 for disaster recovery, but the DR VMs must be able to communicate with the production VMs over internal IPs without traversing the public internet. The network team uses a single VPC and does not want to manage additional VPCs. What should they do?

Accepted Answer

Create a new subnet in europe-west1 within the same VPC, and rely on the default global routing behavior of VPC networks.. A VPC network in Google Cloud is a global resource, and subnets in different regions within the same VPC can communicate over internal IP addresses without additional configuration. Creating a new subnet in the same VPC satisfies the DR requirement while avoiding the complexity of peering or VPN. The other options introduce unnecessary components or misunderstand the purpose of Private Google Access.

Answer

Create a new subnet in europe-west1 and configure a Cloud VPN tunnel between the two regions.

Answer

Create a new subnet in europe-west1 and enable Private Google Access on both subnets.

Answer

Create a new VPC in europe-west1 and set up VPC Network Peering between the two VPCs.

Question 7

A company wants to migrate an on-premises application that uses IPsec VPN tunnels to Google Cloud. They need to ensure encrypted connectivity between the on-premises network and a VPC. Which GCP service should they use?

Accepted Answer

Cloud VPN. Cloud VPN (D) is the correct service because it securely extends an on-premises network to a Google Cloud VPC over the public internet using IPsec VPN tunnels. It provides encrypted connectivity that matches the existing IPsec-based architecture, ensuring data confidentiality and integrity between the two sites.

Answer

Cloud Router

Answer

Cloud Interconnect

Answer

VPC Network

Question 8

A network engineer is designing a VPC for a three-tier application. The web tier must be reachable from the internet, but the database tier must not be reachable from any external source, including other VPC networks. The engineer wants to minimize firewall rules and ensure that the database tier is isolated. What should the engineer do?

Accepted Answer

Create the database tier in a separate VPC with no external IP addresses and no routes to the internet, and use VPC peering to allow only required traffic from the web tier.. Isolating the database tier in its own VPC without internet access and using VPC peering for required traffic provides strong isolation with minimal firewall rules. The lack of external IPs and internet routes prevents external reachability, while peering enables controlled communication from the web tier. This aligns with the goals of security and simplicity.

Answer

Create a separate VPC for the database tier and peer it with the web tier VPC.

Answer

Place the database tier in a subnet with a firewall rule that denies all ingress traffic except from the web tier subnet.

Answer

Use a VPC network with two subnets and apply a hierarchical firewall policy that denies all ingress to the database subnet.

Question 9

A company is deploying a new VPC in Google Cloud. They need to ensure that all outbound traffic from their VM instances to the internet is allowed, but they want to restrict inbound traffic to only SSH (port 22) from a specific bastion host IP (203.0.113.5). Which firewall rule configuration should they implement?

Accepted Answer

Create an ingress allow rule for tcp:22 with source 203.0.113.5, and rely on the implied allow egress rule for outbound traffic.. The implied allow egress rule already permits all outbound traffic, so no egress rule is needed. For inbound, an ingress allow rule for tcp:22 with source 203.0.113.5 permits SSH from the bastion, while the implied deny ingress blocks all other inbound traffic. This is the simplest and most secure configuration that meets the requirements.

Answer

Create an ingress allow rule for all protocols from 203.0.113.5, and create an egress allow rule for all protocols to 0.0.0.0/0.

Answer

Create an ingress allow rule for tcp:22 with source 0.0.0.0/0, and create an egress deny rule for all protocols.

Answer

Create an egress allow rule for all protocols to 0.0.0.0/0, and create an ingress deny rule for all protocols except tcp:22 from 203.0.113.5.

Question 10

A company has a VPC with a subnet in us-central1. They want to allow SSH access to all VMs in that subnet from a specific on-premises CIDR range (203.0.113.0/24) using Identity-Aware Proxy (IAP) TCP forwarding. Which firewall rule and IAM configuration should the network engineer implement?

Accepted Answer

Create an ingress firewall rule allowing tcp:22 from 35.235.240.0/20 to all instances in the subnet. Grant the users the IAP-secured Tunnel User role and ensure they have the necessary IAM permissions on the instances.. IAP TCP forwarding establishes a tunnel from the user to the VM via Google's IAP infrastructure, so the VM sees the connection originating from the IAP source range 35.235.240.0/20. A firewall rule must allow ingress TCP 22 from that range. Users must also be granted the IAP-secured Tunnel User role and IAM permissions on the target instances. Allowing the on-premises range directly would bypass IAP and is not desired.

Answer

Create an egress firewall rule allowing tcp:22 from 35.235.240.0/20 to all instances in the subnet. Grant the users the IAP-secured Tunnel User role.

Answer

Create an ingress firewall rule allowing tcp:22 from 203.0.113.0/24 to all instances in the subnet. Grant the users the IAP-secured Tunnel User role.

Answer

Create an ingress firewall rule allowing tcp:22 from 203.0.113.0/24 and 35.235.240.0/20. Grant the users the IAP-secured Tunnel User role.

Question 11

A company is deploying a global external HTTP(S) load balancer to serve a web application. The security team wants to protect the application from common web attacks such as SQL injection and cross-site scripting, and also wants to rate-limit requests from specific IP addresses to mitigate bot attacks. Which Google Cloud service should the network engineer configure to meet these requirements?

Accepted Answer

Cloud Armor security policy attached to the backend service of the load balancer.. Cloud Armor security policies are the appropriate solution for protecting a global external HTTP(S) load balancer against Layer 7 attacks such as SQL injection and cross-site scripting. Cloud Armor provides preconfigured WAF rules and supports rate-based ban rules to limit requests from specific IPs, mitigating bot attacks. Attaching the security policy to the backend service ensures that all incoming requests are inspected and filtered according to the defined rules.

Answer

Identity-Aware Proxy (IAP) configured on the backend service.

Answer

VPC firewall rules applied to the load balancer's backend instances.

Answer

Cloud CDN with signed URLs configured for the backend service.

Question 12

A company is using a Shared VPC with a host project and two service projects. They want to allow a service project administrator to create VMs that use a shared subnet, but they must not be able to modify the subnet or create new subnets in the host project. Which two IAM roles should be granted to the service project administrator to achieve this? (Choose two.)

Accepted Answer

roles/compute.networkUser on the host subnet. To allow a service project administrator to create VMs using a shared subnet while preventing subnet modifications, grant compute.networkUser on the host subnet and compute.instanceAdmin.v1 on the service project. The networkUser role permits subnet usage without modification rights, and the instanceAdmin role allows VM creation within the service project. Other roles either provide excessive permissions or do not grant the necessary capabilities.

Answer

roles/editor on the host project

Answer

roles/compute.securityAdmin on the host project

Answer

roles/compute.networkAdmin on the host project

Question 13

A company is deploying a new application that uses Cloud SQL for MySQL. The security team requires that all connections to the Cloud SQL instance are encrypted and that the database is not accessible from the public internet. The application runs on Compute Engine instances in a VPC. Which TWO configurations should the network engineer implement to meet these requirements? (Choose two.)

Accepted Answer

Enable SSL/TLS for the Cloud SQL instance and require all clients to connect using SSL certificates.. Assigning a private IP to the Cloud SQL instance and enabling SSL/TLS encryption ensures that the database is not publicly accessible and that all connections are encrypted. These two measures together meet the security team's requirements without exposing the database to the internet.

Answer

Configure the Cloud SQL instance to use a public IP but restrict access to only the application's external IP addresses via authorized networks.

Answer

Create a firewall rule to allow traffic from the application's subnet to the Cloud SQL instance's public IP on port 3306.

Answer

Use Cloud VPN to connect the application VPC to the Cloud SQL instance's VPC, and route traffic through the VPN.

Question 14

A financial company needs to inspect all egress traffic from a VPC to the internet for data exfiltration using a third-party next-generation firewall (NGFW) appliance deployed on Compute Engine instances. They want to avoid changing the application subnets and want automatic scaling and health checking of the appliance fleet. Which approach should the network engineer choose?

Accepted Answer

Configure an internal TCP/UDP load balancer with the NGFW instances as backends, and create a custom route with the internal load balancer's forwarding rule IP as the next hop for 0.0.0.0/0.. An internal TCP/UDP load balancer is a regional passthrough load balancer whose forwarding rule IP can serve as a custom route next hop. Pointing the default route at that IP sends all internet-bound traffic through the NGFW fleet, which is health-checked and horizontally scalable, and the passthrough design preserves the original packet headers for inspection.

Answer

Create an external passthrough Network Load Balancer with the NGFW instances as backends, and point the default route to the load balancer's external IP address.

Answer

Deploy the NGFW instances behind a global external HTTP(S) load balancer and use URL maps to direct egress traffic through the appliance backend service.

Answer

Attach the NGFW instances to a separate VPC and use VPC Network Peering with custom route import/export so that the default route in the application VPC points to the peered NGFW subnet.

Question 15

A network engineer is configuring Cloud NAT for a private GKE cluster that needs to reach the internet for package downloads, but the security team wants to ensure outbound traffic uses a stable, predictable set of addresses and that logging is available for audit. Which TWO configuration choices should the engineer make? (Choose two.)

Accepted Answer

Reserve static external IP addresses and assign them to the Cloud NAT gateway so that egress uses a predictable set of addresses.. Reserving static external IPs and assigning them to the Cloud NAT gateway makes egress addresses predictable and allowlistable, while enabling Cloud NAT logging provides translation and error events for audits and troubleshooting. Together these choices satisfy both the stability and audit requirements for the private GKE cluster's outbound traffic.

Answer

Configure the Cloud NAT gateway in manual allocation mode with a single external IP for the entire cluster to minimize the address footprint.

Answer

Enable Private Google Access on the subnet so that GKE nodes reach Google APIs without using Cloud NAT or external IP addresses.

Answer

Assign a public external IP address directly to each GKE node so that traffic leaves through the node's address without translation.