PCNE Practice Test 44 — 15 Questions

Question 1

A startup runs a three-tier application in a single VPC with separate subnets for web, application, and database tiers. The operations team wants to receive an alert whenever outbound traffic from the database subnet to the internet exceeds a defined threshold, so they can detect misconfigured instances. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud Monitoring alerting policy based on a log-based metric derived from VPC Flow Logs that filters for the database subnet and counts egress bytes.. Detecting unexpected egress from a specific subnet is best done at the network layer. VPC Flow Logs record per-flow byte counts for the subnet, and a log-based metric filtered to that subnet feeds a Cloud Monitoring alerting policy. This avoids per-instance agents and does not depend on load balancer or packet inspection features that operate at different layers.

Answer

Deploy the Ops Agent on each database instance and alert on the agent's network transmit metric in Cloud Monitoring.

Answer

Enable Packet Mirroring on the database subnet and set a Cloud Monitoring alert on the mirrored packet count metric.

Answer

Configure a Cloud Armor security policy on the database subnet with a rate-limiting rule and an alert on the policy's denied request count.

Question 2

A startup is designing its first Google Cloud network. They need to create a VPC that allows instances to communicate with each other and with the internet, but they want to minimize management overhead. They do not have any on-premises connectivity requirements. Which VPC network type should they choose?

Accepted Answer

Auto mode VPC network. Auto mode VPC networks automatically create subnets in each region, reducing the need for manual configuration. They provide default routes for internet access and allow instances to communicate internally. This aligns with the startup's goal of minimal management overhead and no hybrid connectivity.

Answer

Shared VPC network

Answer

Custom mode VPC network

Answer

Legacy network

Question 3

A company has a Shared VPC host project with a subnet in us-central1. A service project administrator needs to create a Compute Engine VM in the service project that uses an internal IP address from the host project's subnet. What should you do to enable this?

Accepted Answer

Grant the service project administrator the compute.networkUser role on the host subnet.. To create a VM in a service project that uses a Shared VPC subnet from the host project, the user needs the compute.networkUser role on that subnet. This role grants the necessary permission to consume the subnet. Other roles either provide too much privilege or are unrelated to subnet usage. The correct approach is to grant the minimal required role on the specific subnet or at the host project level.

Answer

Enable the Compute Engine API in the host project and grant the service project administrator the compute.instanceAdmin.v1 role.

Answer

Grant the service project administrator the compute.networkAdmin role on the host project.

Answer

Create a new subnet in the service project and attach it to the host VPC.

Question 4

An engineer is creating a Compute Engine instance that will act as a network virtual appliance for inspection of traffic between two subnets in the same VPC. The instance must have two network interfaces, each in a different subnet, and the engineer wants to ensure that the interfaces can send and receive traffic that is not destined for the instance's own IP address. What should the engineer do when creating the instance?

Accepted Answer

Enable IP forwarding on the instance.. For an instance to forward traffic that is not addressed to its own IP, IP forwarding must be enabled. This is a property of the instance's network interfaces and is required for virtual appliances, routers, and similar functions. Firewall rules, external IPs, and tags influence reachability and policy but do not enable transit forwarding.

Answer

Configure the instance to use a custom network tag and apply a route to the tag.

Answer

Assign a static external IP address to each network interface.

Answer

Create a firewall rule allowing all ingress and egress traffic to the instance.

Question 5

A media company streams video from Cloud Storage buckets to viewers worldwide, and the buckets are fronted by an external Application Load Balancer with Cloud CDN enabled. Viewers report that live-updated playlist files are stale for several minutes after the origin changes. The engineer must reduce the staleness of these small, frequently updated files while keeping large video segments cached for long periods. What should the engineer do?

Accepted Answer

Apply a Cache-Control response header with a short max-age to the playlist objects in Cloud Storage, and a long max-age to the video segment objects.. Cloud CDN respects origin Cache-Control metadata, so the cleanest solution is to tag playlist objects with a short max-age and video segments with a long max-age in Cloud Storage. This keeps segments cached at the edge while allowing playlists to refresh within the desired interval, meeting both freshness and performance goals without splitting backends.

Answer

Set a short cache TTL on the CDN by configuring the Cloud CDN cache mode to CACHE_ALL_STATIC and lowering the default TTL for the load balancer.

Answer

Disable Cloud CDN for the load balancer and serve all objects directly from the Cloud Storage origin to guarantee freshness.

Answer

Create a URL map that routes playlist requests to a backend bucket with Cloud CDN disabled and segment requests to a backend bucket with CDN enabled.

Question 6

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They need to determine the required steps to establish the connection. Which of the following is the first step they must take?

Accepted Answer

Order a Dedicated Interconnect connection through the Google Cloud Console.. To establish a Dedicated Interconnect connection, the first action is to order the connection through the Google Cloud Console. After ordering, Google provides the necessary details to provision a cross-connect in a colocation facility. Once the physical connection is active, you can create VLAN attachments and configure Cloud Router.

Answer

Create a VLAN attachment in the Google Cloud Console.

Answer

Configure a Cloud Router in the same region as the Dedicated Interconnect.

Answer

Provision a cross-connect in a Google colocation facility.

Question 7

A company is migrating a legacy application to Google Cloud. The application uses a fixed IP address for its license server, which is hardcoded in the application. The company wants to ensure that the license server can be reached at the same IP address even if the underlying VM is recreated or moved to a different zone. Which Google Cloud feature should the network engineer use to provide a static internal IP address for the license server?

Accepted Answer

Reserve a static internal IP address and assign it to the VM's network interface. Reserving a static internal IP address and assigning it to the VM's network interface ensures that the license server always has the same internal IP, even if the VM is recreated. This is the simplest and most direct solution for a single VM that requires a fixed internal IP.

Answer

Configure a Cloud NAT gateway with a static IP address

Answer

Set up a forwarding rule with an internal TCP/UDP load balancer

Answer

Create an alias IP range on the VM's network interface

Question 8

A network engineer is deploying a Compute Engine instance in a VPC network that has no external IP address. The instance must reach an on-premises database server at 192.168.100.10. The VPC is connected to the on-premises network via Cloud VPN. Which configuration allows the instance to reach the on-premises server?

Accepted Answer

Create a route in the VPC with destination 192.168.100.0/24 and next hop set to the Cloud VPN tunnel.. To reach an on-premises server from a VPC instance, a route that directs traffic for the on-premises subnet to the Cloud VPN tunnel is required. Firewall rules and external IPs do not provide the necessary routing. Private Google Access is only for Google APIs. The correct configuration is a route with the appropriate destination and next hop.

Answer

Add a firewall rule allowing egress to 192.168.100.10.

Answer

Assign a static external IP address to the instance.

Answer

Enable Private Google Access on the subnet.

Question 9

A network engineer needs to analyze historical network traffic patterns in a VPC to identify peak usage times and potential bottlenecks. The VPC has VPC Flow Logs enabled and exported to Cloud Logging. The engineer wants to query and visualize the data over the past 30 days. Which approach should they use?

Accepted Answer

Export VPC Flow Logs to BigQuery and use Looker Studio or BigQuery BI Engine for analysis and visualization. BigQuery is the recommended service for storing and analyzing large volumes of log data over extended periods. By exporting VPC Flow Logs to BigQuery, the engineer can run complex SQL queries to identify peak usage and bottlenecks, and then visualize results using Looker Studio. This approach provides scalability, cost-effectiveness, and advanced analytics capabilities.

Answer

Enable VPC Flow Logs with metadata and use Network Intelligence Center's Performance Dashboard

Answer

Use Cloud Monitoring's log-based metrics to create custom metrics from flow logs and then build dashboards

Answer

Use Cloud Logging's Logs Explorer to run queries and create charts from the flow logs

Question 10

A company wants to provide a single global anycast IP address for a TCP-based application running on instances in multiple regions. The application requires SSL offloading and must preserve the client's original IP address for logging. Which load balancer should be used?

Accepted Answer

External SSL Proxy Load Balancer. The external SSL Proxy Load Balancer is designed for global TCP traffic that requires SSL offloading. It provides a single anycast IP, terminates SSL, and can preserve the client IP using the PROXY protocol. The HTTP(S) load balancer is only for HTTP, the TCP proxy does not offload SSL, and the internal load balancer is regional and lacks SSL offloading.

Answer

External TCP Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External HTTP(S) Load Balancer

Question 11

A network engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. The on-premises ASN is 65001 and the engineer sets the Cloud Router ASN to 65001. BGP fails to establish. What is the most likely cause?

Accepted Answer

The Cloud Router ASN must differ from the on-premises ASN because eBGP requires different autonomous system numbers on each side of the session.. An external BGP session requires the two peers to be in different autonomous systems. When Cloud Router and the on-premises router both use ASN 65001, the session cannot form. Assigning Cloud Router a distinct private ASN, for example 65002, resolves the collision and lets the eBGP session establish over the VLAN attachment.

Answer

Cloud Router only supports ASN 16550, so any custom ASN prevents the session from establishing.

Answer

The VLAN attachment must be deleted and recreated with a different ASN, because the ASN is immutable after creation.

Answer

The on-premises router must be configured as an iBGP peer because Cloud Router emulates an internal BGP speaker.

Question 12

A company wants its Compute Engine VMs to access Cloud Storage and BigQuery APIs without using external IP addresses or sending traffic over the public internet. The VMs are in a subnet that has no Cloud NAT configured. What should the network engineer enable?

Accepted Answer

Private Google Access on the subnet.. Private Google Access is the subnet-level setting that lets instances lacking external IP addresses reach Google APIs and services over internal paths. It requires no NAT, no peering to service producer networks, and no load balancer. The other choices either route the traffic over the public internet or solve an unrelated inbound-traffic problem.

Answer

A VPC peering connection to the Google API service producer network.

Answer

Cloud NAT on the subnet's region so the VMs can reach the Google APIs.

Answer

An external HTTP(S) load balancer with a backend service pointing to the VMs.

Question 13

A company has a VPC with a subnet in us-central1. They need to ensure that all outbound traffic from their VMs to the internet goes through a specific set of IP addresses for auditing. They have configured Cloud NAT with a reserved static external IP address. However, they notice that some VMs are still using their ephemeral external IPs for outbound traffic. What is the most likely reason?

Accepted Answer

The VMs have external IP addresses assigned, so they bypass Cloud NAT for outbound traffic.. Cloud NAT is designed to provide outbound internet access for VMs without external IP addresses. If a VM has an external IP, its outbound traffic will use that IP and bypass Cloud NAT. To ensure all outbound traffic uses the NAT IP, you must remove external IPs from the VMs. This is a common configuration mistake when trying to centralize egress through Cloud NAT.

Answer

Cloud NAT is not configured to use the reserved static IP because the IP is not attached to the NAT gateway.

Answer

The VMs are in a subnet that is not associated with the Cloud NAT gateway.

Answer

The firewall rules are blocking traffic from the Cloud NAT IP address.

Question 14

A network engineer is configuring a VPC firewall rule to allow HTTP traffic from the internet to a group of web server instances. The instances are in subnet 'web-subnet' (10.0.1.0/24) and are tagged 'http-server'. The engineer wants to ensure that only HTTP (port 80) traffic from any source is allowed, and that all other ingress traffic is denied. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Ensure the default ingress deny rule is in place with priority 65535.. To allow HTTP from any source, you need an ingress allow rule targeting the appropriate instances with source 0.0.0.0/0 and tcp:80. The default implied deny ingress rule ensures all other traffic is blocked. Together, these two configurations meet the requirement: the allow rule permits HTTP, and the implied deny rule enforces the default deny for everything else.

Answer

Create an ingress firewall rule with action 'allow', target tags 'http-server', source IP range '10.0.0.0/8', and protocol/port 'tcp:80'.

Answer

Create an ingress firewall rule with action 'deny', target tags 'http-server', source IP range '0.0.0.0/0', and protocol/port 'all'.

Answer

Create an egress firewall rule with action 'allow', target tags 'http-server', destination IP range '0.0.0.0/0', and protocol/port 'tcp:80'.

Question 15

A company has a VM in a subnet with an external IP address. Security policy now requires that the VM no longer use that external address for outbound internet access, but it must still be reachable from the internet for inbound connections. The engineer removes the external IP and configures Cloud NAT. Which statement describes the resulting behavior?

Accepted Answer

The VM loses all inbound reachability because Cloud NAT provides only outbound translation.. Cloud NAT is an outbound-only construct: it enables VMs without external IPs to initiate connections to the internet but does not accept inbound sessions. Removing the external IP therefore removes direct inbound reachability. To keep the VM reachable from the internet while avoiding an outbound external IP, the engineer must front it with a load balancer or other ingress mechanism.

Answer

Inbound reachability is unaffected because firewall rules still permit the traffic.

Answer

The VM remains reachable inbound through the NAT gateway's external address.

Answer

Cloud NAT automatically preserves inbound connections on the same address.