PCNE Practice Test 4 — 10 Questions

Question 1

A financial services company has a Shared VPC setup where the host project contains a central VPC, and multiple service projects attach to it. The network team wants to monitor all VPC Flow Logs from the host project's subnets and analyze traffic patterns across all service projects. They need to aggregate logs in a central location for long-term analysis and querying with SQL. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable VPC Flow Logs on each subnet in the host project, then create a log sink in the host project that exports to a BigQuery dataset in a centralized logging project.. In a Shared VPC, the host project owns the subnets, so VPC Flow Logs are generated there. To centralize these logs for SQL analysis, a log sink in the host project should export to a BigQuery dataset, which can reside in a separate logging project. This pattern aggregates all flow logs from the host project's subnets into one location, enabling cross-project traffic analysis and long-term retention with BigQuery's querying capabilities.

Answer

Enable VPC Flow Logs on each service project's subnets, then create a log sink in each service project that exports to a BigQuery dataset in the host project.

Answer

Enable VPC Flow Logs on the host project's subnets, then use Cloud Logging's log viewer to filter and analyze the logs, and schedule regular exports to Cloud Storage for long-term retention.

Answer

Use Cloud Monitoring's VPC Flow Logs dashboard to view traffic across all projects, and export the dashboard data to BigQuery using the Monitoring API.

Question 2

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

Accepted Answer

Configure Cloud Router in the host project to advertise all subnets via BGP.. In a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Answer

Configure Cloud NAT in each service project for on-prem access.

Answer

Use VPC peering between the host project and each service project.

Answer

Create separate Interconnect VLAN attachments for each service project.

Question 3

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to create service perimeters that restrict access to Google Cloud APIs and prevent data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

IAM Conditions

Question 4

A company wants to publish a custom internal service running in their VPC so that consumers in other VPCs can access it using private IP addresses. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows publishing internal services via private endpoints in your VPC and enabling consumption from other VPCs using private IPs.

Answer

Cloud Load Balancing

Answer

VPC Peering

Answer

Cloud VPN

Question 5

A startup is creating a new VPC for their production environment. They want to minimize management overhead and plan to use multiple regions. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region and manage IP ranges, reducing management overhead. Custom mode requires manual subnet creation.

Answer

Custom mode VPC

Answer

Shared VPC

Answer

VPC Network Peering

Question 6

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 7

An engineer needs to verify that a Compute Engine instance can reach a specific IP address on the internet, considering firewall rules and routes. Which Network Intelligence Center tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests allow you to test reachability between a source and a destination, checking firewall rules, routes, and VPC peering configurations.

Answer

Performance Dashboard

Answer

Firewall Insights

Answer

Network Topology

Question 8

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Answer

Cloud NAT logging

Question 9

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

Accepted Answer

Configure active-active BGP with multiple sessions using the same ASN.. The best practice for HA VPN is to use active-active BGP with multiple sessions, using the same ASN on all on-premises routers. This enables ECMP and ensures symmetric routing. Option B correctly describes this configuration.

Answer

Configure active-passive BGP with a single session.

Answer

Use policy-based routing to fail between tunnels.

Answer

Use static routes with a primary and backup route.

Question 10

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

Accepted Answer

Cloud NAT on the subnet or VPC. Cloud NAT (Network Address Translation) allows private Compute Engine instances to initiate outbound connections to the internet without assigning them public IP addresses. It translates the instance's private IP to a Cloud NAT external IP address for outbound traffic, while unsolicited inbound connections from the internet are blocked. This is the correct solution because the requirement explicitly states no public IP on the instance, yet outbound internet access is needed.

Answer

Configure a private Google access for the subnet

Answer

Assign a static external IP address to the instance

Answer

Set up an internal HTTP(S) load balancer