PCNE Practice Test 44 — 15 Questions

Question 1

A company is planning a hybrid cloud architecture with GCP. They need a dedicated, high-bandwidth connection from their on-premises data center to GCP with 99.99% SLA and the ability to scale beyond 10 Gbps. Which connection type should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between an on-premises data center and Google Cloud, supporting speeds of 10 Gbps or 100 Gbps per link. It offers a 99.99% SLA when configured with redundant links (two circuits) and can scale beyond 10 Gbps by adding additional 10 Gbps or 100 Gbps connections, meeting the requirement for high bandwidth and high availability.

Answer

Classic VPN

Answer

HA VPN

Answer

Partner Interconnect

Question 2

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

Accepted Answer

The subnet routes are exported from VPC-B to VPC-A.. VPC Network Peering requires that subnet routes be exported from the peered VPC. By default, subnet routes are automatically exported, but if the peering configuration was modified (e.g., exportSubnetRoutesWithPublicIp set to false), routes may not be exported. The engineer should verify that VPC-B exports its subnet routes to VPC-A. Option B is incorrect because BGP is not used in VPC peering; Cloud Router is used for Cloud VPN or Dedicated Interconnect, not peering. Option C is incorrect because MTU mismatch is unlikely to cause complete lack of connectivity. Option D is incorrect because the route tables themselves are not the issue; the missing routes are due to export settings, not the presence of route tables.

Answer

The BGP session status on the Cloud Router.

Answer

The MTU size of the instances.

Answer

The route tables for the peered network.

Question 3

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

Accepted Answer

Cloud NAT on the subnet or VPC. Cloud NAT (Network Address Translation) allows private Compute Engine instances to initiate outbound connections to the internet without assigning them public IP addresses. It translates the instance's private IP to a Cloud NAT external IP address for outbound traffic, while unsolicited inbound connections from the internet are blocked. This is the correct solution because the requirement explicitly states no public IP on the instance, yet outbound internet access is needed.

Answer

Configure a private Google access for the subnet

Answer

Assign a static external IP address to the instance

Answer

Set up an internal HTTP(S) load balancer

Question 4

A company has a VPC with a firewall rule that allows SSH (tcp:22) from 0.0.0.0/0. They want to restrict SSH access to only the public IP address of their Cloud VPN gateway. How should they modify the firewall rule?

Accepted Answer

Change the source IP range to the VPN gateway's public IP address.. The firewall rule currently allows SSH from any source IP (0.0.0.0/0). To restrict access to only the Cloud VPN gateway, you must change the source IP range to the gateway's public IP address, because the SSH connection originates from the VPN gateway's public-facing interface over the internet. Internal IP addresses are not routable over the internet and would not match the source of the incoming SSH traffic.

Answer

Use Cloud Armor to block all SSH except from the VPN IP.

Answer

Change the source IP range to the VPN gateway's internal IP address.

Answer

Use IAP Tunneling instead of SSH firewall rules.

Question 5

A company wants to connect two VPC networks (vpc-a and vpc-b) that both reside in the same Google Cloud project. They need to ensure that all IP ranges in both VPCs can communicate using internal private IP addresses. Which solution should they implement?

Accepted Answer

Enable VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering directly connects two VPCs within the same project using internal RFC 1918 IP addresses, with no bandwidth limitations and no single point of failure. It allows all subnets in both VPCs to communicate privately without requiring external connectivity, VPN tunnels, or NAT gateways.

Answer

Use Dedicated Interconnect to connect the VPCs.

Answer

Set up Cloud VPN tunnels between the two VPCs.

Answer

Configure Cloud NAT to allow the VPCs to communicate through NAT.

Question 6

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

Accepted Answer

Dedicated Interconnect with static routing. Dedicated Interconnect supports static routing, which is required because the on-premises router does not support BGP. This solution provides direct, private connectivity to a single Google Cloud VPC without relying on dynamic routing protocols, making it the correct choice for this scenario.

Answer

Cloud VPN with dynamic routing (BGP)

Answer

Ha VPN with policy-based routing

Answer

Partner Interconnect with BGP

Question 7

A company has a GKE cluster with pods and services that need IP addresses. They want to plan IP address space to avoid overlapping with on-premises networks. Which GCP feature allows reserving separate IP ranges for GKE pods and services?

Accepted Answer

Secondary IP ranges. Secondary IP ranges on a subnet can be designated for GKE pods and services. These ranges are separate from the primary subnet range.

Answer

VPC peering

Answer

Alias IP ranges

Answer

Shared VPC

Question 8

An organization uses Shared VPC with multiple service projects. They want to allow a service project to create a VM in a subnet that belongs to the host project. The subnet has an IAM policy that grants the compute.instanceAdmin role to the service project's service account. However, the service project is unable to create VMs in that subnet. What is the most likely reason?

Accepted Answer

The service project is missing the compute.networkUser role on the host project.. In Shared VPC, a service project must have the compute.networkUser role on the host project to use its networks. Without this role, subnet-level IAM permissions (like compute.instanceAdmin) are ineffective because the service project cannot even access the network. Therefore, even though the subnet IAM may be correctly configured, the missing networkUser role prevents VM creation. Option D is correct. Option A is incorrect because the subnet IAM policy is not the issue; the problem is at the host project level. Option B is incorrect because IP exhaustion would give a different error (e.g., IP space full), not a permission error. Option C is incorrect because the service project's own IAM roles are irrelevant for accessing host project resources.

Answer

The subnet IAM policy does not include the service project's service account.

Answer

The subnet is out of IP addresses.

Answer

The service project does not have the compute.instanceAdmin role on itself.

Question 9

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have already ordered a cross-connect from their co-location facility to a Google Point of Presence (PoP). What is the NEXT step to establish the connection?

Accepted Answer

Create a VLAN attachment in Google Cloud. After the physical cross-connect is in place, the next step is to create a VLAN attachment in the Cloud Console or via gcloud. The VLAN attachment is the logical construct that represents the connection between the on-premises router and the Cloud Router.

Answer

Create a Cloud Router and BGP session

Answer

Run a ping test to verify connectivity

Answer

Configure BGP on the on-premises router

Question 10

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides a direct, private connection between your on-premises network and Google Cloud, supporting bandwidth up to 100 Gbps (via multiple 10 Gbps or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant attachments. This solution requires you to manage your own physical infrastructure in a Google colocation facility, meeting the organization's requirement for self-managed hardware.

Answer

Cloud VPN with multiple tunnels

Answer

Partner Interconnect

Answer

HA VPN

Question 11

A company has an on-premises data center connected to GCP via Cloud VPN with dynamic routing (BGP). Recently, connectivity to a specific subnet (10.1.0.0/16) in GCP became intermittent. The VPN tunnel is up, and BGP sessions are established. What is the most likely cause?

Accepted Answer

The Cloud Router is not advertising the correct subnet range to the on-premises router.. Since the VPN tunnel is up and BGP sessions are established, the issue is not with the tunnel or BGP peering itself. Intermittent connectivity to a specific subnet (10.1.0.0/16) while other subnets remain reachable strongly indicates a route advertisement problem. The Cloud Router must be configured to advertise the correct subnet range to the on-premises router via BGP; if it is not, the on-premises router will lack a route for that subnet, causing intermittent or no connectivity.

Answer

The shared secret is misconfigured.

Answer

The VPN tunnel is flapping due to packet loss.

Answer

A firewall rule is blocking traffic from on-premises.

Question 12

A company has a VPC with the above firewall rule applied. They have a VM instance with network tag 'web-server' that hosts a web server. Users report they cannot access the web server from the internet. What is the most likely cause?

Accepted Answer

The VM instance does not have a public IP address.. The most likely cause because a VM instance without a public IP address cannot receive traffic from the internet, regardless of firewall rules. Even with a firewall rule allowing ingress from 0.0.0.0/0, the traffic has no public IP to reach the VM. Option A is incorrect because sourceRanges 0.0.0.0/0 allows all sources. Option B is incorrect because the firewall rule being disabled would prevent access, but there is no indication it is disabled. Option D is incorrect because priority 1000 is default, and a deny rule with lower priority (higher number) would not override it. Option E is incorrect because the targetTags filter 'web-server' matches the VM's tag.

Answer

The targetTags filter is incorrectly spelled; it should be 'webserver' instead of 'web-server'.

Answer

The firewall rule is disabled.

Answer

The firewall rule priority is too high (1000), causing it to be overridden by a deny rule with lower priority.

Answer

The firewall rule does not allow traffic from the internet because sourceRanges is set to 0.0.0.0/0.

Question 13

A company uses Cloud VPN with dynamic routing (BGP). The on-premises network advertises a prefix that overlaps with a subnet in the VPC. Which TWO actions can resolve this conflict? (Choose TWO.)

Accepted Answer

Modify the on-premises BGP advertisement to use a more specific prefix (longer subnet mask) that does not overlap.. By advertising a more specific prefix (longer subnet mask) from on-premises, that route will be preferred over the less specific VPC subnet route due to longest prefix match. Option E is correct: Cloud Router custom route advertisements allow you to filter or modify which routes are learned or advertised, which can be used to prevent the overlapping route from being installed. Options A, C, and D are incorrect: deleting the subnet is unnecessary; route propagation filters are not a native feature; and a static route with the same prefix length would not override a dynamic BGP route.

Answer

Delete the conflicting subnet in the VPC.

Answer

Use route propagation with a filter in the VPC route table.

Answer

Create a static route in the VPC with the same prefix as the overlapping route.

Question 14

A company has a multi-region VPC with subnets in us-central1 (10.0.0.0/24) and europe-west1 (10.0.1.0/24). They have deployed a global Application Load Balancer (ALB) with backend services in both regions. The backends are instance groups with instances in each subnet. The ALB uses internal IP addresses from a subnet in each region for the backend services. The company wants to restrict access to the ALB so that only traffic from a specific list of external IP addresses (e.g., corporate VPN) can reach the load balancer. They have created a firewall rule allowing ingress from those IP addresses to the ALB's forwarding rule IP (which is a global IP). However, external traffic from allowed IPs is still being blocked. What is the most likely reason?

Accepted Answer

VPC firewall rules do not apply to global load balancer's frontend; use Cloud Armor with IP whitelist.. The Global Application Load Balancer (external) uses a global anycast IP that is part of Google's frontend infrastructure, not a VPC resource. VPC firewall rules apply only to traffic entering or leaving VPC network interfaces, such as VM instances or internal load balancers. Traffic to the global ALB's frontend IP is handled before it reaches the VPC, so VPC firewall rules cannot filter it. To restrict access based on source IP addresses, you must use Cloud Armor security policies attached to the load balancer. Therefore, option B is correct. Option A is incorrect because priority is not the issue; firewall rules simply do not apply to the global frontend. Option C and D are incorrect because they refer to backend instances, but the problem is at the frontend. Option B is the correct solution: use Cloud Armor with an IP whitelist.

Answer

The firewall rule should be created with priority lower than 1000 to override default deny.

Answer

The firewall rule must allow ingress from the allowed IPs to the backend instance's internal IPs.

Answer

The firewall rule must be applied to the backend instances' tags, not the forwarding rule IP.

Question 15

A company has deployed a Dedicated Interconnect with multiple VLAN attachments connected to a single Cloud Router. They want to influence inbound traffic from on-premises to Google Cloud to use a specific attachment for certain prefixes. Which BGP attribute can they manipulate on the on-premises router to achieve this?

Accepted Answer

MED. The Multi-Exit Discriminator (MED) attribute is used to influence inbound traffic from on-premises to Google Cloud when multiple paths exist via a Dedicated Interconnect. By setting a lower MED value on the on-premises router for specific prefixes, the Cloud Router will prefer that attachment for those prefixes, as MED is compared first among paths from the same neighboring AS.

Answer

AS_PATH

Answer

LOCAL_PREF

Answer

Community tags