PCNE Practice Test 45 — 15 Questions

Question 1

A company uses Cloud DNS with a managed zone for example.com. They want to override DNS responses for a specific subdomain, mail.example.com, to point to an internal IP address when queried from within the VPC, but external queries should resolve normally. Which feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Response Policy Zone (RPZ). Response Policy Zones (RPZ) allow you to override DNS responses for specific domains based on the source network. This is used for DNS filtering or overriding.

Answer

DNS Security Extensions (DNSSEC)

Answer

Private DNS zone

Answer

Routing policy (weighted or geo)

Question 2

A network engineer notices unusual traffic patterns from a VM. They want to capture detailed information about each packet sent and received by the VM, including source and destination IPs, protocols, and ports. Which feature should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IPs, protocols, and ports. This feature is designed specifically for analyzing traffic patterns and troubleshooting connectivity issues at the network layer, making it the correct choice for the described requirement.

Answer

Packet Mirroring

Answer

Cloud Audit Logs

Answer

Firewall Rules Logging

Question 3

A company uses Cloud Armor with an external HTTPS load balancer to protect their web application. They have a security policy 'my-policy' attached to the backend service. The policy includes an allow rule (priority 1000) for their corporate IP range (203.0.113.0/24) and a deny rule (priority 2000) for all other IPs. The company has an office at a remote location that uses a different IP range (198.51.100.0/24). Employees from the remote office report they cannot access the application. Meanwhile, employees from the corporate office (203.0.113.0/24) can access. The engineer checks the Cloud Armor policy and sees the rule configuration as shown. What is the most likely cause?

Accepted Answer

The remote office IP range is not included in an allow rule in the security policy.. The remote office IP range (198.51.100.0/24) is not explicitly allowed by any rule in the security policy. The only allow rule (priority 1000) permits traffic from the corporate IP range (203.0.113.0/24), and the deny rule (priority 2000) blocks all other IPs. Since the remote office IPs are not covered by the allow rule, they are denied by default, which explains their inability to access the application.

Answer

The rule evaluation order is wrong; the deny rule should have higher priority (lower number).

Answer

The deny rule uses 'SRC_IPS_V2' which is an invalid expression.

Answer

The load balancer's frontend IP blocks traffic from certain geographic regions.

Question 4

A company is planning to connect multiple VPCs in different regions to their on-premises network using a single Dedicated Interconnect. Which TWO configurations are required to achieve this?

Accepted Answer

Create a Cloud Router in each VPC. Each VPC requires its own Cloud Router to establish dynamic routing (BGP) over the Dedicated Interconnect. A Cloud Router is a per-VPC resource that manages BGP sessions and routes for that specific VPC, and since the interconnect is shared, each VPC must have its own router to participate in routing independently.

Answer

Create a single Cloud Router for all VPCs

Answer

Set up Cloud VPN tunnels for regional connectivity

Answer

Use a global VLAN attachment

Question 5

A network engineer is troubleshooting a Cloud VPN tunnel that is not passing traffic. The tunnel status shows as established, and BGP sessions are up. However, traffic from an on-premises subnet (10.0.1.0/24) to a GCP subnet (192.168.1.0/24) is not working. What should the engineer check first?

Accepted Answer

Verify that the on-premises router is advertising the 10.0.1.0/24 prefix via BGP. Even though the VPN tunnel and BGP session are established, traffic may still fail if the on-premises router is not advertising the on-premises subnet (10.0.1.0/24) to GCP via BGP. Without this advertisement, GCP's Cloud Router has no route to reach that subnet, so return traffic from GCP to on-premises is dropped. The first step in troubleshooting is to verify that the on-premises BGP speaker is sending the correct prefix in its UPDATE messages.

Answer

Ensure that the Cloud Router is configured with the correct BGP ASN

Answer

Check that GCP has a static route for 10.0.1.0/24 pointing to the VPN tunnel

Answer

Check GCP firewall rules to allow ingress from 10.0.1.0/24

Question 6

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

Accepted Answer

Ingress rule: source 203.0.113.5/32, destination 10.0.1.2/32, tcp:22. Firewall rules in GCP are stateful and applied at the instance level, not the VPN tunnel. The rule must allow ingress traffic from the on-premises source IP (203.0.113.5/32) to the Compute Engine instance's internal IP (10.0.1.2/32) on TCP port 22. The Cloud VPN and Cloud Router handle routing, but the firewall rule explicitly defines the allowed traffic flow.

Answer

Ingress rule: source 203.0.113.5/32, destination 169.254.0.1/32, tcp:22

Answer

Ingress rule: source 10.0.1.2/32, destination 203.0.113.5/32, tcp:22

Answer

Ingress rule: source 0.0.0.0/0, destination 203.0.113.5/32, tcp:22

Question 7

A developer wants to allow HTTP (port 80) traffic from the internet to a set of Compute Engine instances that have a tag "web-server". Which firewall rule should they create?

Accepted Answer

Ingress rule: source 0.0.0.0/0, target tag "web-server", tcp:80. An ingress firewall rule with source range 0.0.0.0/0, target tag "web-server", and protocol/port tcp:80 allows HTTP traffic from the internet to the tagged instances.

Answer

Egress rule: source 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Egress rule: destination 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Ingress rule: source 0.0.0.0/0, target service account "web-server", tcp:80

Question 8

A company uses Cloud NAT with a static NAT IP address. They notice that connections from their instances are failing after a few minutes. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway is using dynamic port allocation and running out of ports. Cloud NAT by default uses dynamic port allocation and releases ports after a timeout. With static NAT IP, if port exhaustion occurs or if the connection idle timeout is too low, connections may drop.

Answer

The instance's external IP is conflicting with the NAT IP

Answer

The NAT IP address is not whitelisted on the target

Answer

The VPC network has a firewall rule blocking egress

Question 9

A security team wants to block traffic from specific geographic regions (e.g., Country A) to their HTTP(S) load balancer. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor security policies can be attached to HTTP(S) load balancers. They support geo-based access control (allow/deny by country) using preconfigured or custom rules.

Answer

Firewall rules

Answer

VPC Service Controls

Answer

Cloud CDN

Question 10

A company needs to advertise a specific prefix from their on-premises network to GCP via Cloud Router. They do not want to advertise all connected networks. What should they configure on the Cloud Router's BGP peer?

Accepted Answer

Route advertisements with custom learned routes. Custom learned routes allow you to specify which prefixes are advertised to GCP via BGP.

Answer

Use a static route instead

Answer

Export custom routes

Answer

Global routing mode

Question 11

A network engineer is setting up HA VPN between an on-premises network and a GCP VPC. They have configured two Cloud VPN gateways in GCP, each with two interfaces, and four tunnels. They are using BGP with Cloud Router. However, only one of the four tunnels is established. What is the most likely cause?

Accepted Answer

The on-premises VPN gateway is using the same peer IP for multiple tunnels. For HA VPN, each VPN gateway has two external IP addresses. Tunnels should be configured between each GCP IP and the corresponding on-premises peer IP. If the on-premises peer IPs are not unique per tunnel (e.g., both tunnels on-prem use the same IP), BGP sessions may not form correctly. The issue is often due to duplicate peer IPs or misconfiguration of BGP ASNs.

Answer

The Cloud Router ASN is not unique to the project

Answer

The Cloud Router is not advertising the default route

Answer

The VPC firewall rules are blocking UDP port 500

Question 12

A company wants to use Cloud DNS to resolve queries for a private zone (e.g., example.internal) from multiple VPCs in the same project. They need to ensure that instances in all VPCs can resolve the zone. What is the simplest approach?

Accepted Answer

Create a private zone and associate it with all relevant VPCs. A private managed zone can be associated with one or more VPCs in the same project. By associating the zone with all VPCs that need resolution, instances in those VPCs can resolve the zone without additional peering.

Answer

Configure each VM to use a custom DNS resolver

Answer

Use Cloud DNS peering to forward queries between VPCs

Answer

Create a public zone and set visibility to private

Question 13

A company wants to securely connect an on-premises data center to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) that overlap with the VPC subnet (10.0.1.0/24). They need connectivity to specific workloads in the VPC without changing IP addresses on premises. What should they do?

Accepted Answer

Deploy Private Service Connect to expose the VPC workloads as endpoints accessible from on-premises.. Private Service Connect (PSC) allows on-premises clients to access specific VPC workloads via internal IP addresses (RFC 1918) without requiring VPC peering or VPN. PSC publishes the workloads as endpoints reachable through a Private Service Connect endpoint in the on-premises network, avoiding IP overlap by using a separate IP address range for the endpoint. This solution meets the requirement of not changing on-premises IPs while providing secure, targeted connectivity.

Answer

Use VPC Network Peering with a custom route exchange to filter the overlapping range.

Answer

Set up Dedicated Interconnect and configure BGP with the on-premises router, advertising a more specific prefix.

Answer

Use Cloud NAT and configure a firewall rule to allow traffic from the on-premises network.

Question 14

An enterprise is planning a Dedicated Interconnect connection to GCP. They require 99.99% availability and expect to use multiple VLAN attachments. What is the minimum number of 10 Gbps links and VLAN attachments needed to meet the availability goal?

Accepted Answer

Two 10 Gbps links and two VLAN attachments. To achieve 99.99% availability, Dedicated Interconnect requires at least two links (each 10 Gbps or 100 Gbps) in different edge availability domains, and at least two VLAN attachments.

Answer

Two 10 Gbps links and one VLAN attachment

Answer

One 100 Gbps link and one VLAN attachment

Answer

One 10 Gbps link and one VLAN attachment

Question 15

An organization is planning a hybrid network between an on-premises data center and Google Cloud. They require a dedicated, high-bandwidth connection with 99.99% availability SLA and the ability to scale up to 100 Gbps. They have a co-location facility that is connected to a Google Cloud region. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct physical connections between on-premises and GCP, offering 10 Gbps or 100 Gbps per link, with a 99.99% SLA when configured with redundant links. It is the best fit for high-bandwidth, high-availability requirements when co-location is available.

Answer

HA VPN

Answer

Partner Interconnect

Answer

Classic VPN