PCNE Practice Test 43 — 15 Questions

Question 1

A company is planning to deploy a global load balancer for their web application. They need to ensure that the load balancer can route traffic to backend instances in multiple regions and provide automatic failover. They also want to minimize latency for users worldwide. Which two components are required to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A global forwarding rule with a global IP address.. A global load balancer requires a global forwarding rule to accept traffic on a global IP and a backend service with backends in multiple regions. The global forwarding rule enables anycast, directing users to the nearest Google edge location. The multi-region backend service allows the load balancer to distribute traffic and failover automatically if a region becomes unhealthy. Other components like URL maps are optional for advanced routing.

Answer

A URL map that routes based on the host and path.

Answer

A target pool with instances in multiple regions.

Answer

A regional forwarding rule for each region.

Question 2

You have a VPC with two subnets: `subnet-a` (10.0.1.0/24) in `us-central1` and `subnet-b` (10.0.2.0/24) in `europe-west1`. You need to allow SSH access to all instances in both subnets from a specific IP range `203.0.113.0/24`. You want to apply a single firewall rule to both subnets. What should you do?

Accepted Answer

Create a firewall rule with no target specified, source range `203.0.113.0/24`, allowing tcp:22. This rule applies to all instances in the VPC.. A firewall rule with no target applies to all instances in the VPC, so it covers both subnets. Specifying the source range and allowing tcp:22 grants SSH access from the given IP range to all instances. This is the most efficient solution, avoiding the need for tags or service accounts.

Answer

Create two firewall rules, one for each subnet, with source range `203.0.113.0/24` and allowing tcp:22.

Answer

Create a firewall rule with target tags `ssh` and source range `203.0.113.0/24`, allowing tcp:22. Then apply the tag `ssh` to all instances in both subnets.

Answer

Create a firewall rule with target service account `ssh-sa` and source range `203.0.113.0/24`, allowing tcp:22. Then assign the service account `ssh-sa` to all instances in both subnets.

Question 3

You are setting up a Cloud VPN HA configuration between your on-premises network and Google Cloud. You have created two VPN tunnels on the HA VPN gateway. What is the next step to enable dynamic routing?

Accepted Answer

Create a Cloud Router and add BGP sessions for each tunnel.. After creating HA VPN tunnels, you must create a Cloud Router in the same region as the VPN gateway and then add BGP sessions for each tunnel. Cloud Router is the Google Cloud service that provides dynamic routing via BGP. This allows the on-premises router and Cloud Router to exchange routes automatically, which is essential for high availability and failover.

Answer

Enable global dynamic routing on the VPC network.

Answer

Configure static routes in the VPC for each tunnel.

Answer

Create a VPN gateway with two interfaces and assign external IP addresses.

Question 4

A company is using Cloud VPN to connect their on-premises network to a Google Cloud VPC. They want to ensure that traffic between on-premises and Google Cloud is encrypted and authenticated. They are considering using Cloud VPN with dynamic routing (BGP). Which two statements are correct regarding the security features of Cloud VPN? (Choose two.)

Accepted Answer

Cloud VPN uses IKEv2 with pre-shared keys or certificates for authentication.. Cloud VPN uses IKEv2 for key exchange and supports authentication via pre-shared keys or certificates. It also provides anti-replay protection and perfect forward secrecy when configured with appropriate Diffie-Hellman groups. These are core security features that ensure encrypted and authenticated tunnels. Options about default encryption algorithm, Cloud KMS integration, and automatic threat detection are not correct for Cloud VPN.

Answer

Cloud VPN requires the use of Cloud KMS to manage encryption keys.

Answer

Cloud VPN encrypts traffic using AES-256-GCM by default.

Answer

Cloud VPN traffic is automatically inspected by Cloud IDS for threat detection.

Question 5

A company has a requirement to route traffic from their VPC to specific on-premises destinations through a third-party network appliance. The appliance is deployed as a VM in the VPC. They want to ensure that traffic from all subnets in the VPC is directed to the appliance for inspection before reaching on-premises. What should they configure?

Accepted Answer

Create a custom static route with the appliance VM as the next hop for the on-premises destination ranges.. To route traffic through a network virtual appliance, you create a custom static route for the on-premises destination ranges with the appliance VM instance as the next hop. The appliance must have IP forwarding enabled. This ensures that traffic from all subnets is sent to the appliance for inspection. Firewall rules and load balancers do not provide this routing functionality.

Answer

Enable IP forwarding on the appliance VM and create a route with the default internet gateway as the next hop.

Answer

Configure a VPC firewall rule to redirect traffic to the appliance.

Answer

Use a global external HTTP(S) load balancer to route traffic to the appliance.

Question 6

A company wants to distribute incoming traffic across multiple backend instances in different regions using a single global anycast IP address. The application uses HTTP and requires session affinity based on client IP. Which Google Cloud load balancer should the network engineer choose?

Accepted Answer

External HTTP(S) Load Balancer with client IP affinity configured on the backend service.. The external HTTP(S) Load Balancer is designed for HTTP and HTTPS traffic, provides a global anycast IP, and supports session affinity including client IP affinity. It can distribute traffic across multiple regions and is the correct choice for this scenario. Other load balancers either do not support HTTP or do not provide a global anycast IP.

Answer

External SSL Proxy Network Load Balancer with session affinity configured.

Answer

Internal HTTP(S) Load Balancer with a global anycast IP and client IP affinity.

Answer

External TCP Proxy Network Load Balancer with session affinity set to client IP.

Question 7

A company is designing a Shared VPC architecture where the host project contains a subnet in us-central1 with secondary IP ranges for GKE pods and services. A service project needs to deploy a GKE cluster that uses these secondary ranges. What must the network engineer do to ensure the service project can use the host project's secondary ranges?

Accepted Answer

In the host project, grant the service project's GKE service account the Compute Network User role, and in the service project, create a GKE cluster that references the host project's subnet and secondary ranges by name.. In Shared VPC, the host project owns the subnets, including secondary ranges. Service projects can use these subnets if their service accounts have the Compute Network User role on the host project. For GKE, the cluster configuration must explicitly reference the host project's subnet and its secondary ranges. This enables the cluster to allocate pod and service IPs from the host's ranges without creating new subnets or peering.

Answer

In the host project, assign the service project's GKE service account the Compute Network User role and ensure the subnet's secondary ranges are shared by enabling 'Shared VPC' on the subnet.

Answer

Grant the service project's GKE service account the Compute Network User role on the host project.

Answer

Create a new subnet in the service project with identical secondary ranges and peer it with the host project's subnet.

Question 8

A platform team is deploying a Shared VPC where a host project owns the network and several service projects run workloads. The security team requires that service project administrators cannot modify shared subnet firewall rules, and that some subnets be usable only by one specific service project. Which two configurations should the engineer apply? (Choose two.)

Accepted Answer

Assign the service project administrators the compute.networkUser role on the host project's subnets that their project needs.. Shared VPC requires the host project to own and share subnets, and service project users need the compute.networkUser role on those specific subnets to deploy into them. Scoping networkUser per subnet lets the team restrict each subnet to a designated service project while keeping firewall administration in the host project, meeting both security constraints.

Answer

Create the subnets in each service project and peer them to the host project VPC using VPC Network Peering.

Answer

Grant the service project administrators the compute.networkAdmin role on the host project so they can manage shared resources.

Answer

Grant service project administrators the compute.securityAdmin role at the organization level to let them audit shared firewall rules.

Question 9

A company is using Cloud VPN to connect their on-premises network to a VPC in Google Cloud. They want to ensure that traffic from on-premises to Google Cloud is encrypted and authenticated. They have configured a HA VPN gateway with two interfaces and two tunnels. Which TWO statements are true about HA VPN? (Choose two.)

Accepted Answer

HA VPN provides a 99.99% availability SLA when configured with two or more tunnels from different interfaces.. HA VPN is Google Cloud's high-availability VPN solution. It provides a 99.99% SLA when configured with two or more tunnels from different interfaces. It supports both static and dynamic routing, but BGP is recommended for automatic failover. Cloud Router is required for dynamic routing but not for static. HA VPN supports both IKEv1 and IKEv2. A single tunnel does not qualify for the 99.99% SLA.

Answer

HA VPN tunnels can only be configured with IKEv2, not IKEv1.

Answer

HA VPN gateway can be used with only one tunnel to achieve the 99.99% SLA.

Answer

HA VPN requires the use of Cloud Router for all configurations, even when using static routing.

Question 10

A company has a VPC network with a Cloud Router in us-central1. They need to advertise a custom IPv4 prefix 192.168.100.0/24 to their on-premises router over a Cloud VPN tunnel. The on-premises router is already configured to accept this prefix. Which Cloud Router configuration should they use?

Accepted Answer

Create a custom route advertisement with the prefix 192.168.100.0/24 and enable advertisement of that custom route.. Cloud Router custom route advertisement allows you to specify exactly which prefixes are advertised to on-premises peers. By creating a custom advertisement for 192.168.100.0/24 and enabling it, the router includes that prefix in BGP updates. Other options either affect internal routing, do not advertise to on-premises, or control preference rather than advertisement.

Answer

Enable global routing mode on the Cloud Router so that the prefix is propagated to all regions.

Answer

Configure a BGP session with a higher priority for the prefix by setting a MED value.

Answer

Add a static route for 192.168.100.0/24 in the VPC network with next hop set to the VPN tunnel.

Question 11

A network engineer is configuring a Partner Interconnect connection using a Layer 2 service provider. The engineer has created a VLAN attachment in the Google Cloud Console and provided the pairing key to the service provider. The service provider reports that the connection is up, but the VLAN attachment in Google Cloud shows 'Down'. The engineer verifies that the Cloud Router is up and the BGP session is not established. What is the most likely cause?

Accepted Answer

The service provider has not configured the correct VLAN ID on their side to match the VLAN attachment.. A VLAN attachment showing 'Down' despite the service provider reporting the connection is up usually indicates a Layer 2 mismatch. The most common cause is a VLAN ID mismatch between the Google Cloud VLAN attachment and the service provider's configuration. The engineer should verify that the VLAN ID configured on the service provider side matches the one in the VLAN attachment. Once corrected, the attachment should come up and BGP can establish.

Answer

The VLAN attachment's MTU is set to 1500, but the service provider requires 1440.

Answer

The VLAN attachment was created in a region that does not support Partner Interconnect.

Answer

The Cloud Router's BGP ASN is set to 16550, which is reserved for Google.

Question 12

A company has a VPC network with two subnets in the same region: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They need to ensure that a Compute Engine instance in subnet-a can resolve internal DNS names of instances in subnet-b, but they do not want to use any external DNS servers. What should they do?

Accepted Answer

Ensure that both subnets are in the same VPC network, because Google Cloud automatically provides internal DNS resolution for all instances in a VPC network regardless of subnet.. Internal DNS in Google Cloud automatically resolves instance names within the same VPC network, across subnets and regions. The default DNS name is based on the instance name and the project ID, with the zone .internal. No extra configuration is required. This built-in feature simplifies service discovery and communication between instances.

Answer

Assign external IP addresses to both instances so that they can use public DNS to resolve each other's names.

Answer

Create a Cloud DNS forwarding zone that points to the metadata server 169.254.169.254 for name resolution.

Answer

Configure the VPC network's DNS policy to enable inbound forwarding and set up a Cloud DNS private zone for the internal names.

Question 13

A network engineer needs to design a VPC network that allows instances in different regions to communicate with each other using internal IP addresses. The instances must also be able to reach Google APIs without traversing the public internet. Which VPC feature should be used to meet these requirements?

Accepted Answer

Global VPC with Private Google Access enabled on subnets. A VPC network in Google Cloud is global, so subnets in different regions can communicate using internal IP addresses by default. To allow instances without external IPs to reach Google APIs without using the public internet, Private Google Access must be enabled on the subnets. This combination satisfies both requirements without needing peering, VPNs, or Shared VPC.

Answer

Shared VPC with multiple host projects

Answer

VPC peering between regions

Answer

Cloud VPN between regions

Question 14

A network engineer needs to create a VPC network that allows instances in different regions to communicate using internal IP addresses. The company requires that the VPC automatically creates subnets in each region when a new region is used. Which VPC network type should they choose?

Accepted Answer

Auto mode VPC network. Auto mode VPC networks automatically create a subnet in each Google Cloud region using predefined IP ranges. This satisfies the need for automatic subnet creation and allows instances across regions to communicate internally. Custom mode requires manual subnet creation, legacy networks do not support subnets, and Shared VPC is a sharing mechanism rather than a network type. Therefore, auto mode is the correct choice.

Answer

Legacy network

Answer

Shared VPC network

Answer

Custom mode VPC network

Question 15

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) in us-central1 and subnet-b (10.0.2.0/24) in europe-west1. They need to create a new subnet in asia-east1 with a secondary IP range for a GKE cluster. Which command should they use?

Accepted Answer

gcloud compute networks subnets create subnet-c --network=my-vpc --region=asia-east1 --range=10.0.3.0/24 --secondary-range=services=10.0.4.0/24. The correct command includes the required --secondary-range flag with a name and CIDR separated by an equals sign. This allows the subnet to host a GKE cluster that needs distinct IP ranges for pods and services. The other options either misuse the flag syntax or add an inappropriate purpose.

Answer

gcloud compute networks subnets create subnet-c --network=my-vpc --region=asia-east1 --range=10.0.3.0/24 --secondary-range=10.0.4.0/24

Answer

gcloud compute networks subnets create subnet-c --network=my-vpc --region=asia-east1 --range=10.0.3.0/24 --secondary-range=services:10.0.4.0/24

Answer

gcloud compute networks subnets create subnet-c --network=my-vpc --region=asia-east1 --range=10.0.3.0/24 --secondary-range=services=10.0.4.0/24 --purpose=PRIVATE