PCNE Practice Test 42 — 15 Questions

Question 1

A retail company wants to distribute incoming HTTP requests across two regional managed instance groups in us-east1 and us-west1, and it wants automatic failover if one region becomes unhealthy. The application uses a single anycast IP and terminates HTTP at the load balancer. Which Google Cloud load balancer should the engineer choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

External HTTP(S) Load Balancer with a global anycast IP and backend services in both regions.. A global HTTP(S) application with a single anycast IP and automatic regional failover maps to the external HTTP(S) Load Balancer. It operates at Layer 7, terminates HTTP, and uses global backend services with health checks to shift traffic away from unhealthy regions. TCP Proxy, SSL Proxy, and internal Layer 4 load balancers do not provide HTTP-aware global failover for public clients.

Answer

External TCP Proxy Load Balancer with a global anycast IP and backend services in both regions.

Answer

Internal TCP/UDP Load Balancer with a global backend service and health checks.

Answer

External SSL Proxy Load Balancer with a global anycast IP and backend services in both regions.

Question 2

A Cloud Network Engineer needs a Compute Engine instance to use multiple MAC-level addresses for containers on a single network interface in `vpc-prod`. The container addresses must be routable within the VPC and must not consume additional VM instances. Which Compute Engine feature should the engineer use?

Accepted Answer

Alias IP ranges assigned to the VM's network interface.. Alias IP ranges attach additional CIDR blocks from the subnet to a VM's network interface, and Compute Engine routes those addresses to the VM inside the VPC. Containers can then use addresses from the alias range without requiring separate VM instances, which matches the requirement of many addresses on one interface.

Answer

A Cloud Router with a custom BGP advertisement of the container CIDR.

Answer

Reserved static internal IP addresses created in the subnet.

Answer

Secondary network interfaces attached to the same subnet.

Question 3

A media company hosts a public API behind an external HTTPS load balancer whose backend service points to a global managed instance group. The API must be reachable at api.example.com, and the company wants TLS certificates to renew without manual intervention while keeping the private key inside Google's infrastructure. The DNS zone for example.com is managed by Cloud DNS in the same project. Which combination of steps should you perform?

Accepted Answer

Create a Google-managed certificate, attach it to the load balancer's target HTTPS proxy, and create an A record for api.example.com pointing to the load balancer's global IP address.. The goal is automated certificate lifecycle management with keys held by Google, plus correct hostname resolution to the load balancer. A Google-managed certificate attached to the target HTTPS proxy provides automatic provisioning and renewal with keys stored inside Google, and an A record pointing api.example.com to the load balancer's global IP completes the path. Self-managed certificates, backend attachment, and wildcard managed certificates all fail at least one stated requirement.

Answer

Create a Google-managed certificate, attach it to the backend service instead of the target proxy, and create an A record for api.example.com.

Answer

Create a self-managed certificate, upload the certificate chain and private key to the load balancer, and create a CNAME record for api.example.com.

Answer

Create a Google-managed certificate that uses a wildcard for *.example.com, attach it to the target HTTPS proxy, and create a TXT record for api.example.com.

Question 4

A startup runs a web application on a managed instance group behind an external Application Load Balancer. The application must be reachable only over HTTPS, and any HTTP request from users must be permanently redirected to HTTPS without reaching the backend instances. What should the engineer configure?

Accepted Answer

Configure the load balancer's HTTP frontend to use a redirect, and attach an HTTPS frontend with a Google-managed certificate to the same URL map.. An external Application Load Balancer can attach an HTTP frontend configured to redirect to HTTPS, returning a 301 permanent redirect before any backend is contacted, while an HTTPS frontend with a Google-managed certificate serves the application. This satisfies both the HTTPS-only requirement and the permanent redirect of HTTP traffic.

Answer

Remove the HTTP frontend entirely so only the HTTPS frontend remains, forcing clients to use the secure URL.

Answer

Enable Cloud CDN on the load balancer and enable the HTTPS-only cache mode so HTTP requests are upgraded at the edge.

Answer

Create an HTTP load balancer with a URL map that returns a 302 redirect to the HTTPS URL for all requests.

Question 5

A network engineer is designing a hybrid network for a financial institution. They need to connect their on-premises data center to Google Cloud with a 99.99% availability SLA and support for multiple VLAN attachments. They also require deterministic routing and the ability to use their own BGP ASN. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect with two 10-Gbps circuits in different metro locations. Dedicated Interconnect with two 10-Gbps circuits in different metro locations provides the required 99.99% availability SLA, supports multiple VLAN attachments for flexible routing, and allows the use of a custom BGP ASN on the Cloud Router. This combination delivers deterministic routing and high bandwidth, making it the best fit for the financial institution's hybrid network design.

Answer

Cloud Router with global dynamic routing and multiple VPN tunnels

Answer

Cloud VPN with HA VPN tunnels

Answer

Partner Interconnect with a single 10-Gbps connection

Question 6

A financial services firm is prototyping a global network in Google Cloud. They need to ensure that their Compute Engine instances in us-central1 and europe-west1 can communicate with each other using internal IP addresses, and they want to minimize latency by keeping traffic on Google's private backbone. They also want to avoid managing separate VPC networks per region. Which Google Cloud network design should they implement?

Accepted Answer

A single global VPC network with subnets in us-central1 and europe-west1, and instances in each region using their regional subnets. Google Cloud VPC networks are global resources. A single VPC network can have subnets in multiple regions, and instances in different regions can communicate using internal IP addresses. Traffic between regions stays on Google's private backbone, which minimizes latency and avoids public internet paths. This design also eliminates the need to manage multiple VPC networks per region.

Answer

A single VPC network with a single subnet in us-central1 that spans both regions using a global subnet range

Answer

Two regional VPC networks, one in us-central1 and one in europe-west1, connected by VPC Network Peering

Answer

A Shared VPC host project with service projects in each region, and Cloud VPN tunnels between the regions

Question 7

A company is planning to deploy a new application in Google Cloud. The network engineer must design a VPC network that provides isolation between the frontend and backend tiers, but still allows the frontend to communicate with the backend on specific ports. The company also wants to minimize costs and management overhead. Which VPC design should the engineer choose?

Accepted Answer

Create a single VPC network with separate subnets for frontend and backend, and use firewall rules to control traffic between them.. A single VPC with separate subnets for each tier is the simplest and most cost-effective design. It allows isolation through subnet boundaries and firewall rules, without the complexity of multiple VPCs or Shared VPC. This approach meets the requirements while minimizing management overhead and cost.

Answer

Create a Shared VPC host project and service projects for each tier, and use firewall rules to control traffic.

Answer

Create a single VPC network with a single subnet, and use tags and firewall rules to isolate frontend and backend instances.

Answer

Create two separate VPC networks, one for frontend and one for backend, and connect them using VPC peering.

Question 8

A startup runs a two-tier application in a single VPC. The web tier is in subnet web-subnet (10.0.1.0/24) and the database tier is in subnet db-subnet (10.0.2.0/24). The security team wants to allow database connections only from the web tier, regardless of which instances are added later, and wants the rule to remain valid when instances are recreated with new IP addresses. Which firewall configuration should you create in the VPC?

Accepted Answer

An ingress rule with priority 1000, action allow, protocol tcp and port 5432, source service account web-tier@project.iam.gserviceaccount.com, target service account db-tier@project.iam.gserviceaccount.com.. Tying the rule to service accounts on both sides makes the allowed path identity-based rather than address-based, so it survives instance recreation and prevents unrelated workloads from reaching the database. The rule targets the database tier's service account and accepts only the web tier's service account on the database port, which matches the requirement precisely and avoids broad source ranges.

Answer

An ingress rule with priority 1000, action allow, protocol tcp and port 5432, source service account web-tier@project.iam.gserviceaccount.com, target tag db-server.

Answer

An ingress rule with priority 1000, action allow, protocol tcp and port 5432, source range 10.0.1.0/24, target tag db-server.

Answer

An ingress rule with priority 1000, action allow, protocol tcp and port 5432, source range 0.0.0.0/0, target tag db-server.

Question 9

A company wants to allow only specific IP addresses to access a Compute Engine VM's SSH port (22). They have created a VPC firewall rule with a source IP range of 203.0.113.0/24 and target tags set to 'ssh-server'. However, users from that IP range still cannot connect. What is the most likely reason?

Accepted Answer

The VM does not have the 'ssh-server' network tag applied.. Firewall rules with target tags apply only to VMs that have those tags. If the VM does not have the 'ssh-server' tag, the rule does not apply, and SSH traffic is not allowed. Ensuring the VM has the correct network tag is essential for the rule to take effect. Other options are either alternative valid configurations or misconceptions.

Answer

The firewall rule must have a priority lower than 65535 to be effective.

Answer

The source IP range must be specified as a single IP address, not a CIDR block.

Answer

The firewall rule needs to be applied to the VM's service account instead of a network tag.

Question 10

A network engineer must allow an on-premises security scanner at 198.51.100.25 to reach a specific VM's TCP port 8443, while all other inbound traffic to the VPC must remain blocked. The VM has no external IP address and sits behind a Cloud VPN tunnel. Which firewall rule configuration achieves this?

Accepted Answer

An ingress rule with source range 198.51.100.25/32, target tag applied to the VM, protocol tcp and port 8443, with priority 1000, plus the implied deny-all ingress rule.. Only the rule that combines the precise /32 source, a target that identifies the single VM, the exact protocol and port, and reliance on the implied deny-all for everything else satisfies the stated requirement. Broader source ranges, egress-direction rules, and untargeted rules each fail to keep the allow narrow to the one scanner and one VM.

Answer

An egress rule on the VM with destination range 198.51.100.25/32 and protocol tcp port 8443, priority 1000.

Answer

A firewall rule with direction INGRESS, source range 198.51.100.25/32, protocol tcp port 8443, and no target specified, priority 1000.

Answer

An ingress rule with source range 198.51.100.0/24, target service account applied to the VM, protocol tcp and port 8443, priority 1000.

Question 11

You manage a VPC with several subnets and want to ensure that all outbound internet traffic from your Compute Engine instances goes through a centralized NAT solution. You have configured Cloud NAT on a Cloud Router in the us-central1 region. However, you notice that instances in europe-west1 are not using Cloud NAT. What is the most likely cause?

Accepted Answer

Cloud NAT is regional and only applies to instances in the same region as the Cloud Router.. Cloud NAT is a regional service. A Cloud NAT configured on a Cloud Router in us-central1 only provides NAT for instances in us-central1. Instances in other regions, such as europe-west1, require their own Cloud NAT configuration in their respective region. The other options are incorrect because Cloud NAT is regional, does not require global Cloud Router, is for instances without external IPs, and does not use tags for selection.

Answer

The instances in europe-west1 do not have an external IP address, so they cannot use Cloud NAT.

Answer

Cloud NAT only works with instances that have the same network tag as the NAT gateway.

Answer

Cloud NAT requires a global Cloud Router to work across regions.

Question 12

A network engineer is configuring a Shared VPC in Google Cloud. The organization wants to centralize network management while allowing service projects to use the shared network. Which two configurations are required to enable a service project to use a shared VPC subnet? (Choose two.)

Accepted Answer

The service project must have the Compute Network User role on the host project's subnets.. To enable a service project to use a shared VPC subnet, you must first designate the host project as a Shared VPC host and attach the service project to it. Then, you must grant the necessary IAM permissions, such as the Compute Network User role, on the specific subnets to the users or service accounts in the service project. These two steps are essential for the service project to deploy resources in the shared subnets.

Answer

The organization must enable the compute.sharedVpc API in both the host and service projects.

Answer

The service project must create its own VPC and then peer it with the host project's VPC.

Answer

The host project must have a VPC network peering connection to each service project's VPC.

Question 13

Your organization operates a Dedicated Interconnect connection in the metro of Amsterdam. The on-premises router advertises a default route (0.0.0.0/0) to the Cloud Router, and you want the VPC to use this route for all destinations not covered by more specific routes. After you configure the Cloud Router BGP session, you notice that the default route is not installed in the VPC routing table. What should you do?

Accepted Answer

Configure a custom import policy on the Cloud Router to accept the default route.. Cloud Router does not accept a default route (0.0.0.0/0) from a BGP peer unless you explicitly configure a custom import policy to allow it. Without that policy, the route is rejected and never installed in the VPC. Enabling global routing or manipulating BGP attributes does not override this default behavior.

Answer

Advertise the default route from the VPC to on-premises using a custom export policy.

Answer

Set the advertised route priority to a lower value than other routes.

Answer

Enable global routing on the Cloud Router.

Question 14

A startup is designing its first Google Cloud network and wants to minimize administrative overhead while still isolating development, staging, and production environments. Each environment will have its own set of resources but should share a common set of subnets and firewall policies managed by a central team. Which Google Cloud network design should they choose?

Accepted Answer

A Shared VPC host project containing the shared subnets and firewall rules, with one service project per environment. Shared VPC is designed for exactly this scenario: a central host project owns and manages the VPC network, including subnets and firewall rules, while service projects contain the resources for each environment. This centralizes network administration, enforces consistent policies, and still provides project-level isolation for development, staging, and production workloads.

Answer

Three separate VPC networks, one per environment, connected by VPC Network Peering

Answer

Three VPC networks in three projects linked by Cloud VPN tunnels with dynamic routing

Answer

A single VPC network with all resources from all environments placed in the same project and separated by firewall tags

Question 15

A company wants to create a VPC network that has subnets in multiple regions. They also want to ensure that the VPC has no automatically created subnets. Which VPC mode should they use?

Accepted Answer

Custom mode VPC. A custom mode VPC does not automatically create subnets, allowing you to define subnets in specific regions with custom IP ranges. This provides the control needed to have subnets in multiple regions without any automatic creation. Auto mode would create subnets automatically, legacy networks lack subnet support, and Shared VPC is a sharing mechanism, not a mode.

Answer

Shared VPC

Answer

Auto mode VPC

Answer

Legacy network