PCNE Practice Test 46 — 15 Questions

Question 1

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The BGP routes for that subnet are not advertised.. The Dedicated Interconnect is up and the organization can ping instances in one subnet, which confirms that Layer 2 and basic Layer 3 connectivity (via the VLAN attachment) are working. However, the inability to reach a service on a different subnet within the same VPC indicates that the on-premises router does not have a route to that specific subnet. This is most likely because the BGP session is not advertising the prefix for that subnet, or the on-premises router is not receiving the route via BGP. Without the route, traffic from on-premises to that subnet will be dropped.

Answer

The MTU is too small.

Answer

The firewall rules are blocking the traffic.

Answer

The VLAN attachment is down.

Question 2

An organization needs to connect three GCP VPCs (VPC-A, VPC-B, VPC-C) so that all VPCs can communicate with each other. They want a solution that is transitive and does not require full mesh peering. Which TWO approaches meet these requirements?

Accepted Answer

Use Network Connectivity Center with all VPCs as spokes. Network Connectivity Center hub-and-spoke and a VPN appliance in a shared VPC can provide transitive routing. VPC peering is non-transitive and would require full mesh.

Answer

Use Cloud VPN with HA VPN to connect all VPCs

Answer

Use a single shared VPC with subnets for all three networks

Answer

Establish VPC peering between each pair of VPCs (full mesh)

Question 3

A company is designing a hybrid network using Dedicated Interconnect. They want to achieve a 99.99% SLA for availability. Which THREE configurations are required to meet this SLA?

Accepted Answer

Two VLAN attachments (one per connection). Two physical connections, two VLAN attachments, and two BGP sessions (one per attachment) are needed for 99.99% SLA.

Answer

Cloud Router in global dynamic routing mode

Answer

A single 10 Gbps physical connection

Question 4

Refer to the exhibit. A company has enabled Private Google Access on the subnet. What effect does this have on VMs in the subnet?

Accepted Answer

VMs can access Google services using only internal IPs. Private Google Access enables VMs in a subnet that have only internal IP addresses (RFC 1918) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through Google's internal network. The traffic is routed via the default internet gateway (which does not require an external IP on the VM) and uses a special 0.0.0.0/0 route with next hop 'default internet gateway' to reach Google's external IPs, but the VM itself never needs a public IP. This is why D is correct: VMs can access Google services using only internal IPs.

Answer

VMs can use external IPs to access Google services

Answer

VMs can access the internet using Cloud NAT

Answer

VMs can communicate with each other without firewall rules

Question 5

A company has deployed a global HTTP Load Balancer with Cloud CDN to serve content to users worldwide. They notice high egress costs from the origin region. What is the most cost-effective solution to reduce egress from the origin?

Accepted Answer

Enable Cloud CDN with general-purpose cache mode. Using Cloud CDN with a general-purpose cache mode caches content at Google's edge locations, reducing requests to the origin and lowering egress costs for served content.

Answer

Use Private Google Access

Answer

Increase the number of backend instances

Answer

Switch to a regional load balancer

Question 6

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Answer

Cloud NAT logging

Question 7

An organization is connecting their on-premises data center to GCP using Dedicated Interconnect with multiple VLAN attachments. They have configured Cloud Router with BGP sessions for each VLAN attachment. They notice that traffic from GCP to on-premises is not load-balanced across the attachments; instead, all traffic uses a single link. What is the most likely cause?

Accepted Answer

Cloud Router's BGP is not configured for multipath; it selects only one best path per prefix.. Cloud Router uses BGP to exchange routes with the on-premises router. By default, BGP selects only a single best path per prefix based on the lowest MED, weight, local preference, AS-path length, or IGP metric. Without BGP multipath enabled (e.g., 'maximum-paths' or 'bgp multipath' configuration), Cloud Router will not load-balance traffic across multiple VLAN attachments even if multiple equal-cost paths are available. This causes all traffic to egress through a single link.

Answer

The on-premises router is not advertising the same routes over all BGP sessions.

Answer

The VLAN attachments have different bandwidths, causing BGP to prefer the higher bandwidth link.

Answer

The BGP keepalive timers are misconfigured, causing session flapping.

Question 8

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Answer

Change the stack type of subnet-b to IPV4_IPV6.

Answer

Configure Cloud NAT in the region of subnet-b.

Answer

Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.

Question 9

An organization wants to connect their on-premises network to Google Cloud using Partner Interconnect. Which of the following is a requirement that must be met before the partner can provision the connection?

Accepted Answer

The organization must have a VLAN attachment created and share the pairing key.. Partner Interconnect requires the customer to create a VLAN attachment in their Google Cloud project and share the generated pairing key with the service provider. The partner uses this key to provision the connection on their side, ensuring the correct mapping to the customer's VPC. Without the VLAN attachment and pairing key, the partner cannot establish the Layer 2 circuit.

Answer

The organization must purchase a cross-connect at a colocation facility.

Answer

The organization must have a Dedicated Interconnect connection already set up.

Answer

The organization must have a Cloud Router configured with BGP sessions.

Question 10

A company is planning to connect their on-premises data center to Google Cloud. They require high bandwidth (10 Gbps) and low latency for real-time data replication. They also want a cost-effective solution that supports burstable traffic. Which TWO connectivity options should they consider? (Choose TWO.)

Accepted Answer

Partner Interconnect. Partner Interconnect (Option C) is correct because it provides dedicated, high-bandwidth connections (up to 10 Gbps per circuit) with low latency, suitable for real-time data replication, and supports burstable traffic through a service provider's network, offering a cost-effective alternative to Dedicated Interconnect for enterprises that need flexibility without full physical infrastructure ownership.

Answer

Classic VPN (route-based VPN)

Answer

Cloud VPN (IPsec VPN)

Answer

Direct Peering

Question 11

An organization is deploying a Shared VPC with one host project and three service projects. Each service project has multiple VPC networks. They want to ensure that only the host project's network admin can create firewall rules affecting the shared VPC network. Which architecture satisfies this requirement?

Accepted Answer

Create the shared VPC network in the host project and grant the network admin IAM role only to host project users.. In a Shared VPC architecture, the host project owns the shared VPC network, and only IAM roles granted in the host project can manage that network's resources. By creating the shared VPC network in the host project and granting the network admin IAM role exclusively to host project users, you ensure that only those users can create firewall rules for the shared VPC. Service project users cannot modify the shared network's firewall rules because they lack the necessary IAM permissions on the host project.

Answer

Use VPC Network Peering between each service project and the host project, and allow each service project admin to manage their own firewall rules.

Answer

Assign the network admin role to users in each service project for the shared VPC network.

Answer

Create separate VPC networks in each service project and use VPC Network Peering to interconnect them.

Question 12

A company needs to connect their on-premises network to Google Cloud with high availability and load balancing across multiple tunnels. They plan to use HA VPN. Which TWO of the following are required to achieve active-active load balancing across multiple tunnels?

Accepted Answer

Configure the on-premises router to enable ECMP. For active-active load balancing, Cloud Router BGP must advertise the same routes with identical attributes, and the on-premises router must support ECMP. Often, two tunnels are configured as a pair. The on-premises router must be configured to accept equal-cost routes.

Answer

Use AS path prepending on one tunnel

Answer

Use different MED values for each tunnel

Answer

Configure static routes instead of BGP

Question 13

An engineer notices that some packets sent from a Compute Engine VM in GCP to an on-premises server via a VPN tunnel are being fragmented. The on-premises server is not receiving the fragmented packets. What is the most likely cause?

Accepted Answer

The VM's MTU is set to 1500. GCP uses an MTU of 1460 bytes on VMs, while the internet standard is 1500. If the VPN encapsulates packets, the additional overhead reduces effective MTU. Fragmentation may occur but is often problematic. The issue is typically due to an MTU mismatch, and setting the VM's MTU to 1460 or lower (e.g., 1400) ensures no fragmentation.

Answer

Cloud NAT is not configured

Answer

The VPN tunnel is using UDP encapsulation

Answer

The on-premises firewall is dropping ICMP

Question 14

An organization needs to distribute incoming traffic across multiple GCE instances in the same region while preserving the client IP address. Which load balancer should they use?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves the client IP.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 15

A company uses an external HTTP Load Balancer with Cloud Armor. They want to log all requests that are blocked by Cloud Armor security policies for compliance auditing. What should they enable?

Accepted Answer

Cloud Armor request logs. Cloud Armor request logs capture details about requests that are allowed or blocked by security policies. Enabling these logs provides the required auditing.

Answer

VPC Flow Logs

Answer

Load balancer access logs

Answer

Firewall rule logging