PCNE Practice Test 41 — 15 Questions

Question 1

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

Accepted Answer

Pre-configured WAF rules. Pre-configured WAF rules in Cloud Armor include a SQL injection (SQLi) rule that inspects HTTP(S) request bodies, headers, and URIs for SQL injection patterns. This rule uses a set of signatures to detect and block malicious SQL queries, directly addressing the requirement to protect against SQL injection attacks on an external HTTP(S) load balancer.

Answer

IP allowlist/denylist

Answer

Named IP address lists

Answer

Rate limiting

Question 2

A company wants to serve private content over Cloud CDN with access control. They need to generate time-limited URLs that allow users to download files from Cloud Storage. Which TWO methods can they use? (Choose two.)

Accepted Answer

Use Cloud CDN signed cookies with a key defined in the backend bucket. Cloud CDN supports signed URLs and signed cookies to control access to private content. IAM conditions are not supported directly with Cloud CDN. CNAME records are DNS configuration, not access control. Cloud Armor is for security policies but not for generating signed URLs.

Answer

Create a CNAME record pointing to the Cloud CDN IP

Answer

Use IAM conditions on Cloud Storage to restrict access

Answer

Use Cloud Armor with IP allowlists

Question 3

A company has set up an HA VPN tunnel between their on-premises router and a Cloud Router in Google Cloud. The on-premises router establishes BGP sessions to both Cloud Router instances, but the routes learned from one Cloud Router instance are not being received. The other instance works fine. What is the most likely cause?

Accepted Answer

The on-premises router has a firewall blocking BGP updates only on one IP address. The most likely cause is a firewall blocking BGP updates only on one IP address. In Google Cloud HA VPN, each Cloud Router instance uses a separate BGP IP address for the two tunnels. If a firewall on the on-premises router is blocking BGP traffic (TCP port 179) to one of these IP addresses but not the other, BGP sessions can establish (since session establishment uses a different mechanism or the firewall rule is applied incorrectly to the data plane), but BGP updates carrying routes may be dropped. This explains why one session receives routes while the other does not. An incorrect ASN would prevent BGP session establishment entirely, which contradicts the stem that states BGP sessions are established. Similarly, a failed tunnel would prevent session establishment, and advertisement mode 'Custom' would affect both sessions equally.

Answer

The tunnel is in a failed state

Answer

The on-premises router has incorrect ASN configured for that BGP session

Answer

The Cloud Router is set to advertisement mode 'Custom' and does not advertise all subnets

Question 4

A company has deployed a network appliance (e.g., firewall) as a Compute Engine instance with two NICs: NIC0 for management and NIC1 for data traffic. The appliance must forward traffic from instances in subnet A to subnet B. The engineer has enabled IP forwarding on the appliance. What additional configuration is required on the VPC for the appliance to route traffic between subnets?

Accepted Answer

Create a route in the VPC with destination subnet B and next hop set to the appliance's internal IP address.. For a Compute Engine instance to forward traffic between subnets, it must act as a router. The VPC needs a custom route that sends traffic destined for subnet B to the appliance's IP (or NIC) as the next hop. Without this route, the VPC's default routing will deliver traffic directly between subnets, bypassing the appliance. Also, the appliance's NIC1 must be in the same VPC and the firewall rules must allow the traffic.

Answer

Configure the appliance's guest OS to enable packet forwarding by setting net.ipv4.ip_forward=1.

Answer

Create a firewall rule allowing egress from the appliance to both subnets.

Answer

Attach the appliance to a Cloud Router and configure BGP sessions.

Question 5

A security team wants to capture and analyze all DNS queries from their Compute Engine instances to detect potential data exfiltration. They have enabled VPC Flow Logs. Which TWO additional steps should they take to capture DNS query details?

Accepted Answer

Enable Packet Mirroring on the instances. VPC Flow Logs do not include DNS query names. To capture DNS queries, they need to enable DNS logging (which logs queries sent to Cloud DNS) or use Packet Mirroring to capture the full DNS packets for analysis.

Answer

Enable firewall rule logging

Answer

Increase VPC Flow Logs sampling rate to 100%

Answer

Export VPC Flow Logs to BigQuery

Question 6

An organization has a VPC with multiple subnets and Cloud NAT configured for outbound internet access. They need to analyze which instances are using the most egress bandwidth to optimize costs. Which approach is most effective?

Accepted Answer

Export VPC Flow Logs to BigQuery and query by source instance. VPC Flow Logs exported to BigQuery allow detailed analysis of traffic patterns, including source IP, destination, and bytes transferred, enabling cost attribution.

Answer

Enable Cloud NAT logging and analyze logs in Cloud Logging

Answer

Use Firewall Insights to identify high-traffic instances

Answer

Use the Performance Dashboard to see bandwidth usage per region

Question 7

A network engineer is configuring a Cloud VPN tunnel with route-based VPN and BGP. The tunnel is established, but the Cloud Router does not learn any routes from the on-premises peer. What is the most likely cause?

Accepted Answer

The BGP session is not configured on the VPN tunnel.. The most likely cause because the BGP session must be explicitly configured on the VPN tunnel interface for route exchange. Option A is incorrect because BGP uses TCP port 179, not UDP. Option D is incorrect because a Cloud Router without an ASN would not establish a BGP session, but this is not a given in the scenario; however, the question asks for the most likely cause, and the tunnel being established suggests the VPN is up, but BGP configuration is missing. Option C is incorrect because not all options are possible causes (A and D are not valid).

Answer

Firewall rules on the on-prem router block UDP port 179.

Answer

All of the above are possible causes.

Answer

The Cloud Router does not have an ASN configured.

Question 8

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

Accepted Answer

Move all resources to a single region, such as us-central1, and use a single VPC.. The latency issue stems from inter-region communication between the backend and Cloud SQL database. By moving all resources to a single region (us-central1), you eliminate cross-region traffic entirely, reducing latency to the minimum possible within that region. This is the most cost-effective solution as it avoids any additional networking costs and simplifies the architecture. While it may require a redesign of the MIGs, it directly addresses the root cause of high latency. Option B (Cloud VPN) adds a VPN tunnel over the Google backbone, which would introduce extra latency and cost without solving the underlying routing issue within the same VPC. Option C (VPC peering) is irrelevant since the resources are already in the same VPC. Option D (Cloud CDN) is designed for caching static content, not database queries, and would not reduce latency for dynamic database traffic.

Answer

Set up a Cloud VPN tunnel with Cloud Router and use BGP to advertise routes between the two regions.

Answer

Create a VPC peering connection between the frontend and backend VPCs.

Answer

Enable Cloud CDN on the backend load balancer to cache database responses.

Question 9

Your company has a hybrid cloud architecture with two on-premises data centers: DC1 and DC2. Each DC is connected to Google Cloud via separate Cloud VPN tunnels (tunnel1 from DC1, tunnel2 from DC2) to a VPC in us-west1. The VPC has two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). DC1 has a subnet 192.168.1.0/24 and DC2 has 192.168.2.0/24. You configure BGP on both tunnels with the VPC dynamic routing, and each on-premises router advertises its local subnet. The VPC automatically imports the learned routes. You notice that traffic from DC1 to an instance in subnet-a (10.0.1.5) works, but traffic from DC2 to the same instance fails intermittently. Additionally, traffic from DC2 to DC1 (192.168.1.0/24) fails completely. You check the route tables and see that both tunnels have learned the routes for the remote subnets. What is the most likely cause and solution?

Accepted Answer

Configure each Cloud VPN tunnel with a separate Cloud Router and assign different BGP priorities to influence route selection, or use distinct regions for the VPN gateways.. The issue is that both Cloud VPN tunnels are using the same Cloud Router, causing BGP to learn identical routes for the on-premises subnets from both tunnels. This leads to asymmetric routing and potential black-holing, especially when traffic from DC2 to DC1 or to subnet-a is routed via DC1's tunnel due to equal-cost multi-path (ECMP) or default BGP tie-breaking. By configuring separate Cloud Routers with different BGP priorities (MED or local preference), you can force traffic from each DC to use its own tunnel, ensuring symmetric routing and consistent connectivity.

Answer

Create a new VPN tunnel from DC2 to a different VPC and use VPC peering.

Answer

Increase the MTU on the VPN tunnels to avoid fragmentation.

Answer

Disable dynamic routing on both tunnels and use static routes instead.

Question 10

Which TWO of the following are true regarding VPC Network Peering? (Choose TWO.)

Accepted Answer

The VPCs' subnet IP ranges must not overlap.. VPC Network Peering requires that the subnet IP ranges of the peered VPCs do not overlap. Overlapping ranges would cause routing conflicts and ambiguous destination addresses, as GCP uses the subnet CIDR blocks to determine the next hop for traffic. If two VPCs have overlapping ranges, packets cannot be reliably forwarded to the correct destination, breaking the peering connection.

Answer

It supports transitive routing across multiple peering connections.

Answer

It supports exchange of routes with custom dynamic routing.

Answer

Custom dynamic routes are automatically exchanged.

Question 11

Drag and drop the steps to create a VPC with custom subnet mode in Google Cloud into the correct order.

Accepted Answer

Name the VPC, Select custom subnet mode, Define subnets, Create VPC. Custom subnet mode requires manual subnet creation. The steps include naming the VPC, selecting custom mode, and defining subnets.

Answer

Name the VPC, Define subnets, Select custom subnet mode, Create VPC

Answer

Select custom subnet mode, Name the VPC, Define subnets, Create VPC

Answer

Define subnets, Name the VPC, Select custom subnet mode, Create VPC

Question 12

A company is designing a hybrid network using HA VPN with two external IP VPN gateways and four IKEv2 tunnels with BGP dynamic routing. They want to maintain connectivity during a zonal failure. What is the minimum number of Cloud VPN gateways needed in GCP?

Accepted Answer

1 Cloud VPN gateway. HA VPN uses two external IP addresses on a single gateway, one in each zone. One gateway supports two IPs and four tunnels, meeting the requirement with 99.99% SLA.

Answer

8 Cloud VPN gateways

Answer

4 Cloud VPN gateways

Answer

2 Cloud VPN gateways

Question 13

A company is setting up HA VPN between GCP and an on-premises network. They need to configure two VPN tunnels for high availability. Which of the following is required for the HA VPN gateway?

Accepted Answer

Two external IP addresses, one for each interface.. An HA VPN gateway has two interfaces, each with its own external IP address. This allows two tunnels to be established for redundancy.

Answer

A single external IP address shared by both interfaces.

Answer

A Cloud Router with BGP enabled on both tunnels.

Answer

A dedicated interconnect circuit.

Question 14

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth up to 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Partner Interconnect with redundant connections. The requirement for high availability (redundancy) and bandwidth up to 10 Gbps is best met by Partner Interconnect with redundant connections. Partner Interconnect supports bandwidths from 50 Mbps to 10 Gbps and allows you to connect through a supported service provider, while redundant connections ensure failover and meet the high-availability requirement. Dedicated Interconnect offers up to 10 Gbps per circuit but requires two separate connections for high availability, not a single connection.

Answer

VPN with Cloud Router

Answer

Direct Peering

Answer

Dedicated Interconnect with a single connection

Question 15

Which THREE actions are required to configure a High-Availability Cloud VPN (HA VPN) with dynamic routing to an on-premises peer?

Accepted Answer

Create two VPN tunnels, each associated with a different Cloud VPN gateway interface. HA VPN requires two tunnels, each attached to a different interface of the Cloud VPN gateway, to provide redundancy and failover. This ensures that if one tunnel or interface fails, traffic can continue through the other tunnel. Option C is correct because each tunnel must have its own external IP address, so you need to allocate two external IP addresses for the HA VPN gateway interfaces. Option D is correct because a Cloud Router must be created in the same region as the VPN gateway to manage BGP sessions for dynamic routing. Option B is incorrect because HA VPN uses a single Cloud Router to manage BGP sessions for both tunnels; separate Cloud Routers are not required. Option E is incorrect because with dynamic routing, static routes are not needed; the BGP sessions advertise routes automatically.

Answer

Create two separate Cloud Routers, one for each tunnel

Answer

Configure static routes for the remote network in the VPC