PCNE Practice Test 42 — 15 Questions

Question 1

Which THREE components are required when configuring an internal TCP/UDP load balancer? (Choose THREE.)

Accepted Answer

Health check. The three required components for an internal TCP/UDP load balancer in Google Cloud are: a health check to determine backend instance health, a backend service to define the instance group and port mapping, and a forwarding rule to assign the internal VIP address. Option C (External IP address) is not used because internal load balancers use internal IP addresses. Option D (SSL certificate) is not required for internal load balancing, as SSL termination is handled by external load balancers or proxies.

Answer

External IP address

Answer

SSL certificate

Question 2

A company uses Cloud NAT to enable outbound connectivity for private VMs. They notice that some VMs are not able to reach a specific external IP range. The VMs have no tags or service accounts. What is the most likely cause?

Accepted Answer

The VMs might be in a different subnet than the one where Cloud NAT is configured.. The most likely cause is that the VMs are in a subnet that does not have Cloud NAT configured. Cloud NAT is configured on a per-subnet basis, and only VMs in subnets with Cloud NAT enabled can use it for outbound traffic. Option A is incorrect because Cloud NAT does not require each VM to have a unique external IP; it uses a pool of NAT IPs. Option B is incorrect because VMs already have a default route (0.0.0.0/0) via the default internet gateway, and Cloud NAT works with that route; there is no need for a route pointing to the NAT gateway. Option C is incorrect because no static route is needed for specific external IP ranges; Cloud NAT uses the default route and performs source NAT for all outbound traffic.

Answer

Cloud NAT requires each VM to have a unique external IP address.

Answer

The VMs need a default route pointing to the NAT gateway.

Answer

A static route must be created for the external IP range via the NAT gateway.

Question 3

Your company uses Network Connectivity Center (NCC) to manage multiple on-premises sites connected via Cloud VPN and Partner Interconnect. You create a NCC hub and attach spokes (VPN tunnels and VLAN attachments). Traffic between two on-premises sites (Site A and Site B) should flow through Google Cloud. However, traffic is not passing between the sites. What is the most likely cause?

Accepted Answer

The VPN spokes do not have custom dynamic route exchange enabled, so routes from Site A are not advertised to Site B.. The most likely cause is that custom dynamic route exchange is not enabled on the VPN spokes. By default, NCC does not advertise routes between VPN spokes unless you explicitly enable custom dynamic route exchange. Without this, routes from Site A are not propagated to Site B, preventing inter-site traffic through Google Cloud. Option A is incorrect because NCC uses dynamic routing, so static routes to the VPC are unnecessary. Option B is correct because it correctly identifies the need for custom dynamic route exchange to advertise routes between spokes. Option C is incorrect because NCC fully supports Cloud VPN as a spoke type. Option D is incorrect because the NCC hub is a global resource and does not need to reside in the same VPC as the sites' VPCs.

Answer

The on-premises routers need static routes pointing to the Google Cloud VPC for inter-site traffic.

Answer

Network Connectivity Center does not support Cloud VPN as a spoke type.

Answer

The NCC hub must be in the same VPC network as the sites' VPCs.

Question 4

A company is using VPC Network Peering between two VPCs. They want to ensure that routes for a specific subnet in VPC A are exported to VPC B. However, VPC B should not export its routes to VPC A. What peering configuration should they set?

Accepted Answer

On VPC B's peering, enable 'Import custom routes'; on VPC A's peering, disable 'Export custom routes'. VPC Network Peering consists of two separate peering connections: one from VPC A to VPC B and another from VPC B to VPC A. To ensure VPC B receives the specific subnet from VPC A, the import setting on VPC B's peering must be enabled to accept routes. Option B enables 'Import custom routes' on VPC B's peering, allowing B to import routes if they are exported by A. However, it disables 'Export custom routes' on VPC A's peering, which means A will not export its routes. Among the options, only B ensures import is enabled on B, which is necessary for receiving routes. The other options either disable import on B or do not allow selective export. While B does not fully meet the requirement, it is the closest correct configuration based on the available choices.

Answer

On VPC A's peering, enable 'Export selected custom routes' and specify the subnet; on VPC B's peering, disable all route export/import

Answer

Enable VPC Network Peering with default settings

Answer

On VPC A's peering, enable 'Export custom routes'; on VPC B's peering, disable 'Import custom routes'

Question 5

A company requires a dedicated connection from their on-premises data center to Google Cloud with a guaranteed SLA of 99.99% and bandwidth starting at 10 Gbps. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google Cloud, supporting bandwidths of 10 Gbps or 100 Gbps per circuit. It offers a 99.99% or 99.999% SLA depending on the configuration (e.g., dual connections with diverse paths), meeting the guaranteed SLA and bandwidth requirements specified in the question.

Answer

Direct Peering

Answer

Cloud VPN

Answer

Partner Interconnect

Question 6

A company wants to connect two VPC networks using VPC Network Peering. What is required for this setup?

Accepted Answer

The VPCs must have non-overlapping IP ranges.. VPC Network Peering requires that the IP ranges of the peered networks do not overlap. Option C is correct. Option A is wrong because a Cloud VPN tunnel is not required for peering; peering is a direct connection. Option B is wrong because VPCs can be in different organizations and still be peered. Option D is wrong because VPCs can be in different regions.

Answer

A Cloud VPN tunnel must be established.

Answer

Both VPCs must belong to the same organization.

Answer

Both VPCs must be in the same region.

Question 7

A company wants to enable VPC Flow Logs for a subnet to troubleshoot connectivity issues. They have enabled flow logs with a sample rate of 1.0 and metadata annotation enabled. After a few hours, they notice that logs are being generated but they are missing flows from a specific application server to a database server in the same subnet. Both servers are Compute Engine instances with internal IPs only. What could be the cause?

Accepted Answer

VPC Flow Logs do not capture traffic between instances in the same subnet because it does not traverse the VPC router.. VPC Flow Logs capture IP traffic that traverses the VPC router. Traffic between two instances within the same subnet is forwarded at layer 2, without going through the router, so it is not captured by flow logs. This is why the flows from the application server to the database server are missing. Option D correctly identifies this behavior.

Answer

The instances are using internal DNS names, and flow logs only capture traffic by IP address.

Answer

The sample rate of 1.0 means all flows are sampled, but metadata annotation may be causing some flows to be dropped.

Answer

Flow logs must be enabled on the VPC network, not just the subnet.

Question 8

A company has a VPC that is connected to an on-premises network via a Cloud VPN tunnel using dynamic routing (BGP). They have set up a Cloud Router with an advertised IP range of 10.0.0.0/8. The on-premises network advertises 172.16.0.0/12. They also have a custom static route in the VPC for 10.0.0.0/8 that points to a next-hop VPN tunnel (the same tunnel) with priority 100. Recently, they added a new subnet 10.1.0.0/24 in the VPC. Traffic from on-premises to 10.1.0.0/24 is not working. Which THREE steps should they take to troubleshoot and resolve the issue? (Choose 3.)

Accepted Answer

Verify that the Cloud Router is advertising the 10.1.0.0/24 subnet to on-premises.. The issue is that traffic from on-premises to the new subnet 10.1.0.0/24 is not working. Since the VPC already has a Cloud VPN tunnel with dynamic routing (BGP) and a Cloud Router advertising 10.0.0.0/8, the new subnet 10.1.0.0/24 is more specific. Static routes with priority 100 for 10.0.0.0/8 do not override more specific dynamically learned routes; the most specific prefix wins. Therefore, the most likely causes are: the Cloud Router is not advertising the new subnet to on-premises (B), the on-premises firewall or route tables do not allow 10.1.0.0/24 (C), or the BGP session between Cloud Router and on-premises router is down (E). Checking BGP session status (E) is a fundamental step. Deleting the static route (D) is unnecessary, and changing priority (A) is not relevant because dynamic routes already have higher priority and more specific routes are preferred regardless. Thus, the correct steps are B, C, and E.

Answer

Change the static route priority to 1000 to match dynamic routes.

Answer

Delete the static route for 10.0.0.0/8 and rely solely on dynamic routing.

Question 9

Refer to the exhibit. A VM in the default VPC with an internal IP 10.0.1.2 tries to SSH (tcp:22) from a host at 10.0.2.5. What is the result?

Accepted Answer

The traffic is allowed because it matches the allow-internal rule.. In Google Cloud VPC, firewall rules are stateful and evaluated based on priority (lower priority number = higher priority). The default VPC includes an 'allow-internal' rule (priority 65534) that allows all TCP traffic from any source in the 10.0.0.0/8 range. Since the source IP (10.0.2.5) is within 10.0.0.0/8 and the destination VM (10.0.1.2) is also in that range, the SSH traffic matches this allow rule. If a deny-ssh rule were present with a lower priority number (e.g., 1000), it would take precedence over the allow-internal rule. However, no such deny rule is specified in the question, so the traffic is allowed because it matches the allow-internal rule.

Answer

The traffic is denied because the source IP is not in the same subnet as the VM.

Answer

The traffic is denied because the deny-ssh rule has a lower priority number and blocks all SSH traffic.

Answer

The traffic is denied due to the implicit deny rule at the end.

Question 10

An organization has multiple VPCs in different regions that need to connect to a single on-premises data center via Dedicated Interconnect. They want to minimize cost and complexity. What is the recommended architecture?

Accepted Answer

Create a single interconnect connection and use multiple VLAN attachments, one per VPC.. A single Dedicated Interconnect connection can support multiple VLAN attachments (each with a unique VLAN ID) to connect multiple VPCs in different regions to the same on-premises data center. This minimizes cost by using one physical connection and reduces complexity by avoiding separate interconnects or VPNs for each VPC.

Answer

Use a single VPC and then use VPC Peering to connect to the other VPCs.

Answer

Use Cloud VPN for the additional VPCs to avoid additional interconnect costs.

Answer

Create a separate interconnect connection for each VPC.

Question 11

A service provider uses a Shared VPC with multiple service projects. The host project has a Cloud NAT configured for subnet 10.1.0.0/24 to provide outbound internet access to all service projects using that subnet. A new service project needs to use its own Cloud NAT for its VM instances in subnet 10.1.0.0/24 to meet compliance requirements. The network engineer attempts to create a Cloud NAT in the service project for that subnet but receives an error that the subnet already has a NAT gateway. What action should the engineer take to meet the compliance requirement?

Accepted Answer

Remove the host project's NAT from the subnet and create a Cloud NAT in the service project for that subnet.. A subnet can have only one NAT gateway associated. To allow the service project to use its own Cloud NAT for subnet 10.1.0.0/24, the host project's Cloud NAT must first be removed from that subnet. Then the service project can create its own Cloud NAT for the same subnet. Option A is not possible due to the conflict. Option B (VPC peering) would not allow the service project to have its own NAT on the same subnet. Option C (proxy instance) introduces management overhead and is not a native solution.

Answer

Create a new Cloud NAT in the service project for the same subnet, overwriting the existing one.

Answer

Use VPC peering to connect the service project to a different network that has a Cloud NAT.

Answer

Implement a proxy instance with an external IP in the service project.

Question 12

You need to allow instances with network tag 'db' in subnet-a to only accept connections on TCP port 3306 from instances with network tag 'app' in subnet-b. Which TWO firewall rules should you create? (Choose 2)

Accepted Answer

Ingress rule: target tag 'db', source tag 'app', allow tcp:3306, priority 1000.. To allow only instances with tag 'app' in subnet-b to connect to instances with tag 'db' in subnet-a on TCP port 3306, you need two ingress firewall rules on the db instances: one to allow traffic from the app source tag, and one to deny traffic from all other sources. The allow rule must have a higher priority (lower number) than the deny rule to take effect. Thus, option A (allow from app, priority 1000) and option C (deny from all, priority 2000) together achieve the goal.

Answer

Egress rule: target tag 'app', destination tag 'db', allow tcp:3306, priority 1000.

Answer

Ingress rule: target tag 'db', source tag 'app', deny tcp:3306, priority 1000.

Answer

Ingress rule: target tag 'db', source 0.0.0.0/0, deny all ports, priority 500.

Question 13

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They want to prioritize traffic from on-premises to GCP over one VPN tunnel when multiple tunnels are available. Which BGP attribute should they configure on their on-premises router?

Accepted Answer

Local Preference (LP). Local Preference (LP) is a BGP attribute that influences outbound traffic from an AS. When configuring multiple VPN tunnels, setting a higher Local Preference on the preferred tunnel will cause the on-premises router to choose that tunnel for traffic destined to GCP. AS path prepending, on the other hand, is used to influence inbound traffic by making a route less preferred; it does not affect outbound path selection from the on-premises network.

Answer

MED (Multi-Exit Discriminator)

Answer

AS path prepending

Answer

Origin attribute

Question 14

A company has deployed Cloud HA VPN between their on-premises network and Google Cloud. They have two tunnels from the on-premises VPN appliance to the HA VPN gateway. The on-premises appliance uses a single public IP address for both tunnels, while the Cloud VPN gateway uses two different public IPs. BGP sessions are established over both tunnels, and the Cloud Router is configured with 'active/active' mode. The network team notices that all outbound traffic from Google Cloud to on-premises is using only one of the two tunnels, even though both tunnels are up. BGP metrics are identical for routes received over both sessions. What is the most likely cause?

Accepted Answer

The Cloud Router does not support ECMP when both BGP sessions have the same peer IP address.. Cloud Router uses the BGP peer IP address as part of the ECMP hash key. When both BGP sessions originate from the same on-premises public IP (the single IP used for both tunnels), Cloud Router sees them as the same peer and does not load-balance across them. Even though the tunnels use different Cloud VPN gateway IPs, the BGP sessions share a common peer IP, which prevents ECMP from being enabled.

Answer

The BGP sessions have different hold timers causing one to be preferred.

Answer

The on-premises appliance must use two different public IPs for ECMP to work.

Answer

The Cloud Router must be configured with 'active/standby' mode instead of 'active/active'.

Question 15

When setting up a Partner Interconnect, which Google Cloud resource is used to connect to the partner's network?

Accepted Answer

VLAN attachment. When setting up a Partner Interconnect, the correct Google Cloud resource is a VLAN attachment. This attachment is provisioned on a Cloud Interconnect connection that is managed by a supported service provider, and it defines the VLAN and the Cloud Router configuration used to exchange routes via BGP. The VLAN attachment is the logical construct that connects your VPC network to the partner's network through the partner's physical infrastructure.

Answer

Cloud VPN gateway

Answer

Cloud Interconnect attachment

Answer

Cloud Router