PCNE Practice Test 43 — 15 Questions

Question 1

A company currently uses a site-to-site Cloud VPN (IPsec) to connect their on-premises network to a VPC. Due to growing bandwidth demands, they plan to migrate to Partner Interconnect using a supported service provider. They have ordered a 1 Gbps connection and the provider has indicated the VLAN attachment is ready. After creating the VLAN attachment and pairing it with a Cloud Router, the on-premises router sees the BGP session come up, but no traffic is forwarded over the interconnect. The Cloud VPN is still operational. What step is most likely missing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adjust the BGP metric (MED) on the Cloud Router for the Partner Interconnect VLAN attachment to be lower than the VPN route. When both a Cloud VPN and a Partner Interconnect are connected to the same VPC, the Cloud Router will have multiple BGP routes for the same destination prefixes. By default, the VPN BGP session may have a lower MED (Multi-Exit Discriminator) or a higher local preference, causing traffic to prefer the VPN path. Lowering the MED on the VLAN attachment's BGP session makes the interconnect route more preferred, allowing traffic to be forwarded over the interconnect without deleting the VPN.

Answer

Create a VPC firewall rule to allow traffic on the VLAN attachment

Answer

Add a firewall rule in the VPC allowing traffic from the on-premises IP ranges on the interconnect

Answer

Delete the Cloud VPN tunnel and gateway to force traffic over the interconnect

Question 2

A company has an HTTP Load Balancer that distributes traffic to a backend service consisting of Compute Engine instance groups. They need to block traffic from specific geographic regions and also rate-limit requests from any IP. Which THREE Cloud Armor features should they configure?

Accepted Answer

Rate limiting rules. Cloud Armor security policies allow you to create rules with conditions. To block regions, use geoblocking by specifying source regions. To rate-limit, use rate limiting rules. Custom rules can also be used to combine conditions. Pre-configured WAF rules (like XSS, SQLi) are for web application attacks, not region blocking or rate limiting.

Answer

Cloud Armor logging

Answer

Pre-configured WAF rules (e.g., OWASP Top 10)

Question 3

A media streaming company uses Cloud CDN with signed URLs to protect content. They want to invalidate cached content for a specific file after a security incident. The file is stored in a Cloud Storage bucket and the CDN cache key includes the URL. They run: gcloud compute url-maps invalidate-cdn-cache URL_MAP --path "/videos/incident.mp4". The invalidation succeeds but the old content is still served. What is the most likely reason?

Accepted Answer

The invalidation path does not match the cache key because signed URLs include query parameters.. Cloud CDN's cache key for signed URLs includes the query parameters (e.g., `?Expires=...&Signature=...`). The invalidation command specifies only the path `/videos/incident.mp4`, which does not match the full cache key that includes the query string. As a result, the invalidation does not purge the cached entry for the signed URL, and the old content continues to be served.

Answer

The Cloud CDN cache key does not include query parameters, so the invalidation should work.

Answer

The Cache-Control header on the object is set to public, max-age=31536000.

Answer

The Cloud Storage bucket requires object versioning to be enabled for invalidation.

Question 4

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

Accepted Answer

Specify a subnet in the same region as the backend instances.. An internal load balancer (ILB) in GCP requires a regional forwarding rule that routes traffic to backend instances within the same VPC. Specifying a subnet in the same region as the backend instances is mandatory because the ILB's internal IP address is allocated from that subnet, and the forwarding rule must reference a subnet to enable internal-only routing. Without a subnet, the ILB cannot be provisioned as an internal load balancer.

Answer

Assign a static external IP address to the forwarding rule.

Answer

Upload an SSL certificate to the load balancer.

Answer

Create a Cloud NAT gateway for the backend instances.

Question 5

A network engineer sees the above output from a Cloud Router. There are two BGP peers from the on-premises router (10.0.0.1 and 10.0.0.2). Both learned the same route 10.1.0.0/16 from their respective peers. However, traffic from Google Cloud to 10.1.0.0/16 is only going through the first peer (10.0.0.1) and not load-balanced. What could be the reason?

Accepted Answer

The on-premises router is advertising the route with different MED values. BGP uses the MED (Multi-Exit Discriminator) attribute to influence inbound traffic from a neighboring AS. When the on-premises router advertises the same route (10.1.0.0/16) to the Cloud Router via two peers (10.0.0.1 and 10.0.0.2) with different MED values, the Cloud Router will prefer the route with the lower MED value. This causes all traffic to be sent through the peer with the lower MED, preventing load balancing. By default, Cloud Router does not perform ECMP (Equal-Cost Multi-Path) for BGP routes unless the paths are identical in all BGP path selection criteria, including MED.

Answer

The on-premises router is advertising the route with different AS_PATH lengths

Answer

The VPC routing mode is set to 'global'

Answer

Cloud Router has a limit of one route per prefix

Question 6

You are designing DNS resolution for a hybrid cloud. On-premises DNS servers must resolve GCP private VM hostnames, and GCP VMs must resolve on-premises hostnames. Which Cloud DNS feature should you use?

Accepted Answer

DNS forwarding (inbound and outbound). DNS forwarding with inbound and outbound policies is the correct choice because it enables bidirectional resolution between on-premises and GCP VMs. Outbound forwarding sends queries from GCP to on-premises DNS servers, while inbound forwarding allows on-premises clients to resolve GCP private VM hostnames by forwarding queries to Cloud DNS. This creates a seamless hybrid DNS namespace without exposing private zones to the internet.

Answer

DNS peering

Answer

Cloud DNS public zones

Answer

Split-horizon DNS

Question 7

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

Accepted Answer

Check VPN tunnel status, then Verify BGP session status, then Check firewall rules, then Verify routing tables, then Perform connectivity tests. Troubleshooting starts with tunnel status, then BGP, firewall, routing, and finally connectivity tests.

Answer

Verify routing tables, then Check firewall rules, then Check VPN tunnel status, then Verify BGP session status, then Perform connectivity tests

Answer

Verify BGP session status, then Check VPN tunnel status, then Check firewall rules, then Verify routing tables, then Perform connectivity tests

Answer

Perform connectivity tests, then Check VPN tunnel status, then Verify BGP session status, then Check firewall rules, then Verify routing tables

Question 8

A company wants to expose a set of internal services running on Compute Engine instances in a private VPC to other internal services using HTTP load balancing. They require L7 features like URL-based routing and SSL termination. Which load balancer should they use?

Accepted Answer

Regional Internal HTTP(S) Load Balancer. Regional Internal HTTP(S) Load Balancer is an Envoy-based L7 load balancer for internal traffic, supporting URL maps and SSL termination.

Answer

Global HTTPS Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 9

A company is designing a secure multi-VPC architecture in Google Cloud. They have three VPCs: Production, Staging, and Shared Services. The Shared Services VPC hosts a Cloud NAT for outbound internet access and a set of managed instance groups. The Production and Staging VPCs are peered to the Shared Services VPC. The company wants to ensure that: (1) instances in Staging cannot initiate connections to instances in Production, (2) instances in Production cannot initiate connections to instances in Staging, (3) all VPCs can communicate with Shared Services, and (4) traffic between VPCs must be inspected by a firewall appliance in Shared Services. Which TWO actions should the company take?

Accepted Answer

Set up a Cloud VPN between each spoke VPC and the Shared Services VPC to enable transitive routing.. To achieve transitive routing between the spoke VPCs through the hub Shared Services VPC, Cloud VPN is required because VPC peering is non-transitive. Option B correctly establishes VPN connections between each spoke and the hub to enable transit. Option C is incorrect because a static route in a spoke VPC cannot use the firewall appliance's internal IP (which is in the hub VPC) as a next hop; the next hop must be a resource in the same VPC, such as a VPN tunnel. Therefore, the only correct action from the given options is B. (Note: The question asks for two actions, but only one option is technically valid; this may indicate an issue with the question design.)

Answer

Delete the VPC peering connection between the Staging and Production VPCs.

Answer

Configure static routes in each spoke VPC with a next hop to the firewall appliance's internal IP for the destination VPC's subnet ranges.

Answer

Remove the default route (0.0.0.0/0) from the spoke VPCs to prevent direct internet access.

Answer

Enable the export of custom routes from the Shared Services VPC to the peered VPCs.

Question 10

An organization has multiple VPC networks and wants to allow traffic between them with fine-grained control over which VMs can communicate. Which solution should they implement?

Accepted Answer

VPC peering with firewall rules.. VPC peering with firewall rules is the correct solution because it allows direct, private connectivity between two VPC networks while enabling fine-grained control over which specific VMs can communicate via firewall rules (ingress/egress). Unlike Shared VPC, which centralizes management but does not inherently provide per-VM granularity across separate VPCs, VPC peering combined with firewall rules allows you to restrict traffic based on source and destination tags, service accounts, or CIDR ranges. This meets the requirement for both inter-VPC traffic and granular VM-level control.

Answer

Cloud Interconnect.

Answer

Shared VPC.

Answer

Cloud VPN between VPCs.

Question 11

A company wants to use BGP traffic engineering to control how traffic flows between GCP and their on-premises network over two Dedicated Interconnect connections. Which TWO BGP attributes can they use on Cloud Router? (Choose 2.)

Accepted Answer

BGP communities. On Cloud Router, you can set MED (metric) to influence inbound traffic and use AS path prepending (though not directly on Cloud Router; you can influence outbound via MED). Actually, Cloud Router supports setting MED on advertised routes. BGP communities can also be used for tagging routes. Weight is a Cisco-specific attribute, not available on Cloud Router.

Answer

Weight

Answer

Local preference

Answer

AS path prepending

Question 12

A company needs to resolve on-premises DNS names from Google Cloud VMs. They want to forward DNS queries for a specific domain (example.corp) to an on-premises DNS server. Which Cloud DNS feature should they use?

Accepted Answer

Outbound DNS forwarding (conditional forwarding). Outbound DNS forwarding with conditional forwarding allows Cloud DNS to forward queries for a specific domain (example.corp) to an on-premises DNS server. This is the correct feature because it selectively routes DNS traffic based on the domain name, enabling resolution of private on-premises names from Google Cloud VMs without exposing the entire VPC network.

Answer

Private DNS zones

Answer

DNS peering

Answer

Inbound DNS policy

Question 13

A company wants to expose a web application running on Cloud Run globally with the lowest latency and automatic SSL termination. Which load balancer should they use?

Accepted Answer

Global HTTPS Load Balancer. Global HTTPS Load Balancer supports serverless NEGs for Cloud Run and provides global anycast IP, automatic SSL, and integration with Cloud CDN.

Answer

Regional Internal HTTP(S) Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global SSL Proxy Load Balancer

Question 14

A company needs to connect their on-premises data center to Google Cloud using a VPN with high availability. They have two VPN appliances on-premises in different locations. What is the best design on the GCP side?

Accepted Answer

Deploy two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.. It provides true high availability by using two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance. This design ensures that if one region or gateway fails, traffic can still flow through the other region, meeting the requirement for high availability. Using separate Cloud Routers allows for dynamic routing with BGP, enabling automatic failover and load balancing across the two tunnels.

Answer

Deploy one Cloud VPN gateway with two tunnels to both on-premises appliances, using one Cloud Router.

Answer

Deploy two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.

Answer

Deploy one Cloud VPN gateway with a single tunnel to one on-premises appliance.

Question 15

A company wants to use Traffic Director to implement fault injection for testing service resilience. They want to inject delays and errors into a percentage of requests. Which two configurations are required? (Choose two.)

Accepted Answer

Configure a fault injection policy in Traffic Director. Traffic Director supports fault injection policies, which require a traffic splitting rule to apply the policy to a portion of traffic, and the fault injection filter config in Envoy.

Answer

Enable Cloud Armor on the load balancer

Answer

Create a new backend service with different instance group

Answer

Configure a health check for the fault injection service