PCNE Practice Test 41 — 15 Questions

Question 1

A network engineer is responsible for a VPC network that uses Cloud NAT to provide outbound internet access for instances without external IPs. The engineer needs to troubleshoot why some instances are unable to reach certain external destinations. The engineer wants to see detailed logs of NAT translations, including the source IP and port, destination IP and port, and whether the connection was allowed or denied. Which logging feature should the engineer enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud NAT logging with the 'translations' filter and 'errors' filter enabled.. Cloud NAT logging provides two log types: translations and errors. Translations logs capture each NAT translation, including source and destination IP/port and whether the connection was allowed or denied. Errors logs capture failures like port exhaustion. Enabling both gives the engineer the detailed information needed to troubleshoot why some instances cannot reach specific external destinations. VPC Flow Logs and Firewall Rules Logging do not provide NAT translation details, so they are not suitable for this task.

Answer

Cloud NAT logging with the 'errors' filter only.

Answer

VPC Flow Logs on the subnet containing the instances.

Answer

Firewall Rules Logging on the egress firewall rules.

Question 2

A Cloud Network Engineer manages a VM in `us-central1-a` that has an ephemeral external IP. The VM must be reachable from the internet on a stable address that does not change when the instance is stopped and restarted, and the address must survive instance deletion so it can be reassigned to a replacement VM. Which approach should the engineer take?

Accepted Answer

Reserve a static regional external IP address and attach it to the VM's network interface.. Reserving a static regional external IP address creates a project-held resource that can be attached to a VM's interface and later moved to another VM. It survives stop, start, and instance deletion, unlike an ephemeral external IP, which is released and may change. This is the direct, supported way to meet all three requirements.

Answer

Create a forwarding rule for the VM and use its external IP.

Answer

Assign an alias IP range and advertise it via Cloud Router to the internet.

Answer

Use a Cloud NAT gateway so the VM appears with a stable public address.

Question 3

Your organization has a Dedicated Interconnect connection in the us-central1 region with a single VLAN attachment and a Cloud Router. You need to add a second VLAN attachment on the same Dedicated Interconnect to provide redundancy, but you want to avoid a single point of failure in the Cloud Router. What should you do?

Accepted Answer

Create a second VLAN attachment on the same Dedicated Interconnect and associate it with a new Cloud Router.. To avoid a single point of failure in the Cloud Router when using Dedicated Interconnect, you must use two Cloud Routers, each associated with a separate VLAN attachment on the same interconnect. This way, if one Cloud Router fails, the other maintains BGP sessions and route advertisement. Associating both attachments with one router leaves that router as a single point of failure.

Answer

Create a second VLAN attachment on the same Dedicated Interconnect and associate it with the existing Cloud Router.

Answer

Create a new Dedicated Interconnect connection in a different region and attach it to the existing Cloud Router.

Answer

Convert the existing VLAN attachment to a Partner Interconnect attachment and add a second attachment.

Question 4

A startup is deploying a new application on Google Cloud and wants to ensure that its VPC network can resolve internal DNS names for its Compute Engine instances and also resolve public DNS names for external services. The company wants to minimize management overhead and use Google Cloud's default DNS resolution. Which DNS configuration should they use?

Accepted Answer

Use the default VPC network's built-in DNS resolution, which provides internal DNS for instances and forwards external queries to public DNS.. The default VPC network includes internal DNS resolution for instances and forwards external queries to public DNS. This requires no setup and meets both internal and external resolution needs. Custom DNS servers, private zones, and DNSSEC are either unnecessary or address different requirements.

Answer

Create a Cloud DNS private zone for the internal domain and a public zone for external resolution.

Answer

Enable DNSSEC on the VPC network to secure all DNS queries.

Answer

Deploy a custom DNS server on a Compute Engine instance and configure all instances to use it as their resolver.

Question 5

You have a VPC with a Cloud NAT gateway. You need to log NAT translations to troubleshoot connectivity issues for a specific VM. You want to capture both successful and failed translations. Which logging configuration should you enable on the Cloud NAT gateway?

Accepted Answer

Set the NAT logging filter to 'ALL' and log destination to Cloud Logging. Cloud NAT logging supports filters: 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', and 'ALL'. To capture both successful and failed translations, you must set the filter to 'ALL'. The logs should be sent to Cloud Logging, which provides a centralized interface for querying and analyzing logs. Other filters or destinations would not provide the complete picture needed for troubleshooting connectivity issues.

Answer

Set the NAT logging filter to 'TRANSLATIONS_ONLY' and log destination to Cloud Logging

Answer

Set the NAT logging filter to 'ERRORS_ONLY' and log destination to Cloud Logging

Answer

Set the NAT logging filter to 'ALL' and log destination to Cloud Storage

Question 6

A network engineer is configuring Cloud IDS to inspect traffic between an on-premises network and a VPC. The engineer creates a Cloud IDS endpoint in the VPC and configures a policy to mirror traffic from a subnet. However, no alerts are generated. What is the most likely cause?

Accepted Answer

The mirrored traffic is not being routed through the Cloud IDS endpoint's internal IP address.. Cloud IDS inspects traffic by using packet mirroring to copy traffic from a source subnet and send it to a Cloud IDS endpoint. The packet mirroring policy must specify the endpoint's internal IP as the destination. If the policy is missing or misconfigured, the endpoint receives no traffic and generates no alerts. Firewall rules, public IPs, and zone alignment do not affect this inspection path.

Answer

The Cloud IDS endpoint does not have a public IP address assigned.

Answer

The firewall rules do not allow traffic from the on-premises network to the Cloud IDS endpoint.

Answer

The Cloud IDS endpoint is not in the same zone as the mirrored subnet.

Question 7

A network engineer is configuring a Partner Interconnect connection with a service provider. The provider offers a Layer 2 connection and requires the engineer to provide a VLAN ID for the attachment. The engineer creates a VLAN attachment in Google Cloud and provides the VLAN ID to the provider. However, the attachment remains in a 'Pending' state. What is the most likely reason?

Accepted Answer

The service provider has not yet configured the VLAN on their end.. A VLAN attachment for Partner Interconnect remains in 'Pending' state until the service provider completes their configuration. The engineer must provide the VLAN ID and other details to the provider, and the provider must activate the connection on their end. Once the provider finishes, the attachment becomes 'Active'. Therefore, the most likely reason is that the provider has not yet configured the VLAN.

Answer

The engineer did not configure the Cloud Router for the VLAN attachment.

Answer

The VLAN attachment was created in a region that is not supported by the service provider.

Answer

The VLAN ID provided is not unique within the VPC network.

Question 8

A network engineer manages a Shared VPC host project with 40 service projects. The security team reports that a newly created firewall rule in the host project is not taking effect on VM instances in one service project. The engineer confirms the rule targets the correct network tags and IP ranges. Which action should the engineer take to diagnose the issue?

Accepted Answer

Run gcloud compute firewall-rules list --project=<host-project> and verify the rule's priority relative to existing rules that match the same traffic.. Shared VPC firewall rules are authored and enforced in the host project, and evaluation follows priority order. When a new rule appears ineffective, the most likely cause is a pre-existing higher-priority rule matching the same traffic. Listing rules in the host project and inspecting priorities confirms the shadowing, whereas looking in the service project, examining flow logs, or auditing IAM cannot reveal firewall rule precedence.

Answer

Verify that the service project's IAM policy grants compute.securityAdmin to the network service account.

Answer

Run gcloud compute firewall-rules list --project=<service-project> and confirm the rule was replicated to the service project.

Answer

Check the VPC Flow Logs on the service project subnet to confirm whether the rule is being evaluated.

Question 9

A retail company is deploying a new multi-tier application in Google Cloud. The web tier must be reachable from the internet on TCP port 443, the application tier must only accept traffic from the web tier, and the database tier must only accept traffic from the application tier. The security team requires that all rules be enforced at the VPC level and that no external IP addresses be assigned to the application or database instances. Which Google Cloud feature should the network engineer use to meet these requirements?

Accepted Answer

VPC firewall rules with target tags and source service accounts. The requirement is to enforce network segmentation at the VPC level without external IPs. VPC firewall rules with target tags and source service accounts allow precise control over which instances can communicate on which ports. This approach uses identity-based rules, ensuring that only the web tier can reach the application tier, and only the application tier can reach the database tier, all within the VPC.

Answer

Cloud Armor security policies applied to a global external HTTP(S) load balancer

Answer

VPC Service Controls perimeter around the project

Answer

Identity-Aware Proxy (IAP) TCP forwarding for all tiers

Question 10

A healthcare company has a VPC network with several subnets. They need to log all network traffic to and from their Compute Engine instances for compliance. They want to capture both allowed and denied traffic, including metadata such as source and destination IPs, ports, and protocols. They also want to minimize the performance impact on their instances. What should they do?

Accepted Answer

Enable VPC Flow Logs on all subnets and configure log aggregation to export to Cloud Logging.. VPC Flow Logs are the correct choice because they provide detailed logs of all IP traffic to and from instances in a subnet, including allowed and denied traffic. They capture metadata such as source and destination IPs, ports, protocol, and bytes. Flow Logs are collected at the hypervisor level, so they have minimal performance impact. Exporting to Cloud Logging allows for long-term retention and analysis, meeting compliance requirements.

Answer

Use Cloud IDS to monitor all traffic and generate alerts for suspicious activity.

Answer

Configure Firewall Rules Logging for all firewall rules in the VPC.

Answer

Install a third-party network monitoring agent on each instance to capture packet-level data.

Question 11

A company has a VPC network with a subnet in us-central1. They need to add a secondary IP range to the subnet to support alias IPs for a GKE cluster. Which command should they use?

Accepted Answer

gcloud compute networks subnets update SUBNET_NAME --region=us-central1 --add-secondary-ranges=SECONDARY_RANGE_NAME=CIDR. The correct command uses gcloud compute networks subnets update with the --add-secondary-ranges flag to add a secondary IP range to an existing subnet. This is the documented method to extend a subnet's IP space for alias IPs, which are required for GKE clusters and other advanced networking features.

Answer

gcloud compute networks update VPC_NAME --add-secondary-ranges=SECONDARY_RANGE_NAME=CIDR

Answer

gcloud compute addresses create SECONDARY_RANGE_NAME --region=us-central1 --subnet=SUBNET_NAME --purpose=SECONDARY

Answer

gcloud compute networks subnets create SUBNET_NAME --region=us-central1 --secondary-range=SECONDARY_RANGE_NAME=CIDR

Question 12

A network engineer needs to allow SSH access from a specific on-premises CIDR block (203.0.113.0/24) to all instances in a VPC. The VPC has a firewall rule that denies all ingress by default. Which firewall rule should be created?

Accepted Answer

Create an ingress rule with action allow, protocol tcp, port 22, source range 203.0.113.0/24, and target all instances in the VPC.. To allow SSH from a specific on-premises CIDR to all instances, an ingress allow rule for TCP port 22 with source range 203.0.113.0/24 and target all instances is required. This overrides the default deny ingress and restricts access to the specified source. Other options either allow too much traffic, control the wrong direction, or deny the traffic.

Answer

Create an egress rule with action allow, protocol tcp, port 22, destination range 203.0.113.0/24, and target all instances.

Answer

Create an ingress rule with action allow, protocol tcp, port 22, source range 0.0.0.0/0, and target all instances.

Answer

Create an ingress rule with action deny, protocol tcp, port 22, source range 203.0.113.0/24, and target all instances.

Question 13

A company is deploying a multi-tier application in Google Cloud. The web tier runs in a managed instance group across three zones, and the database tier runs on Compute Engine instances in a single zone. The network engineer must design the VPC firewall rules to allow only the web tier to access the database tier on port 3306, and to allow health checks from Google's load balancer to the web tier. The web tier instances have the network tag 'web', and the database instances have the tag 'db'. Which firewall rule configuration should the engineer implement?

Accepted Answer

Create an ingress rule with target tag 'db', source tag 'web', protocol tcp, port 3306. Create another ingress rule with target tag 'web', source IP ranges 130.211.0.0/22 and 35.191.0.0/16, protocol tcp, ports 80 and 443.. The correct firewall rules use network tags to enforce least privilege: the database only accepts traffic from instances with the 'web' tag, and the web tier accepts health checks from Google's published IP ranges. This design ensures that only the intended traffic is allowed and that health checks succeed, maintaining application availability and security.

Answer

Create an ingress rule with target tag 'db', source IP range 10.0.0.0/8, protocol tcp, port 3306. Create another ingress rule with target tag 'web', source IP range 0.0.0.0/0, protocol tcp, ports 80 and 443.

Answer

Create an ingress rule with target tag 'db', source service account 'web-sa', protocol tcp, port 3306. Create another ingress rule with target tag 'web', source service account 'lb-sa', protocol tcp, ports 80 and 443.

Answer

Create an ingress rule with target tag 'web', source tag 'db', protocol tcp, port 3306. Create another ingress rule with target tag 'db', source IP ranges 130.211.0.0/22 and 35.191.0.0/16, protocol tcp, ports 80 and 443.

Question 14

A retail company runs an internal web application on Compute Engine instances in two subnets of the same VPC network, subnet-a (us-central1) and subnet-b (europe-west1). Clients in both regions must reach the application through a single internal IP address, and the backend instances must receive traffic from a source IP that belongs to the load balancer's proxy-only subnet. Which configuration should the engineer implement?

Accepted Answer

Create a cross-region internal Application Load Balancer with a proxy-only subnet in each region and a global backend service spanning both instance groups.. A cross-region internal Application Load Balancer is the only option that delivers a single internal IP address, spans backends across regions, and sources backend traffic from proxy-only subnets. It requires a proxy-only subnet in each region, and the global backend service can include instance groups from both us-central1 and europe-west1, satisfying the design constraints exactly.

Answer

Create a regional internal Application Load Balancer in us-central1 with backend instances in both subnets.

Answer

Create two regional internal Application Load Balancers, one per region, and publish both IP addresses to clients through Cloud DNS.

Answer

Create an external global Application Load Balancer and restrict access with Cloud Armor so only internal clients can connect.

Question 15

A company is deploying a set of Compute Engine instances that must be reachable from the internet on TCP port 443. The instances are in a subnet with a regional external Application Load Balancer. The security team requires that the instances themselves have no external IP addresses. Which TWO actions must the engineer take to allow the load balancer to reach the instances while keeping the instances private? (Choose two.)

Accepted Answer

Create an ingress firewall rule that allows traffic from the load balancer's health check and proxy ranges to the instance target tag on TCP port 443.. To serve internet traffic through an external Application Load Balancer while keeping instances private, the backend service must target the instance group on the correct port, and an ingress firewall rule must permit the load balancer's proxy and health check traffic to the instances. External IPs, Cloud NAT, and Private Google Access are not part of this inbound path.

Answer

Create a Cloud NAT configuration so the instances can respond to the load balancer.

Answer

Assign an external IP address to each instance so the load balancer can forward traffic to them.

Answer

Enable Private Google Access on the subnet so the load balancer can reach the instances.