PCNE Practice Test 47 — 15 Questions

Question 1

A company is designing a VPC for a multi-tier application. The web tier must be accessible from the internet, the app tier only from the web tier, and the db tier only from the app tier. Which combination of firewall rules is appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ingress allow from 0.0.0.0/0 to web, ingress allow from web subnets to app, ingress allow from app subnets to db. It follows the principle of least privilege for a multi-tier VPC. The web tier must be accessible from the internet (0.0.0.0/0) on ingress, the app tier must only accept ingress from the web tier subnets, and the db tier must only accept ingress from the app tier subnets. This ensures that each tier is isolated and only reachable from the immediate upstream tier, which is a fundamental security best practice for multi-tier architectures in Google Cloud.

Answer

Ingress allow from web to app, ingress allow from app to db, no rule for web

Answer

Ingress allow from 0.0.0.0/0 to web, ingress allow from all subnets to app, ingress allow from app to db

Answer

Ingress allow from web to app, ingress allow from web to db, ingress allow from app to db

Question 2

Which TWO statements are true about VPC Network Peering?

Accepted Answer

Each VPC can have up to 25 peerings by default. The default limit for VPC Network Peering per VPC is 25, as documented in Google Cloud's quotas and limits. This is a soft limit that can be increased by requesting a quota adjustment, but by default, each VPC can have up to 25 peerings. Option B is correct because VPC Network Peering allows direct communication between VPCs using RFC 1918 private IP addresses without requiring VPN tunnels or Cloud Interconnect, as the peering connection uses Google's internal network infrastructure.

Answer

Firewall rules in one VPC are automatically applied to the peered VPC

Answer

VPC peering incurs additional cost beyond standard egress charges

Answer

Custom static routes are automatically exchanged between peered VPCs

Question 3

A company is setting up a Dedicated Interconnect connection between their on-premises network and Google Cloud. They have configured a VLAN attachment and assigned a Cloud Router with BGP sessions. They notice that traffic is being dropped intermittently. The BGP session status shows 'Established' but routes are not being exchanged consistently. What is the most likely cause?

Accepted Answer

Bidirectional Forwarding Detection (BFD) is not enabled on the BGP session. When BFD is not enabled on a BGP session, the BGP keepalive timers (typically 60 seconds) are used to detect failures, which can cause intermittent traffic drops because BGP does not detect link failures quickly enough. With BFD enabled (default interval of 300ms), failures are detected in sub-seconds, preventing route flapping and ensuring consistent route exchange. The 'Established' BGP state with inconsistent route exchange is a classic symptom of BFD being absent, as routes may be withdrawn and re-advertised due to transient link issues that BGP alone cannot react to fast enough.

Answer

The on-premises firewall is blocking BGP port 179

Answer

The Cloud Router has reached the maximum number of routes

Answer

The MTU on the VLAN attachment is set too low

Question 4

Which THREE are true regarding Cloud HA VPN when used with dynamic routing (BGP)? (Choose three.)

Accepted Answer

Cloud HA VPN requires two interfaces per VPN gateway.. Cloud HA VPN requires two interfaces per VPN gateway to provide high availability and redundancy. Each gateway interface connects to a separate Cloud Router, enabling active-active failover and ensuring continuous connectivity if one interface or tunnel fails.

Answer

Cloud HA VPN requires two Cloud Routers in the same region for redundancy.

Answer

Cloud HA VPN allows custom BGP timers.

Question 5

Refer to the exhibit. A VM in the default VPC with IP 10.0.0.5 is unable to receive traffic from another VM in the same VPC with IP 10.0.1.5. The firewall rule shown is in place. What is the most likely reason?

Accepted Answer

The target service account does not match the VM's service account. The firewall rule shown uses a target service account, which means it applies only to VM instances that are associated with that specific service account. If the VM at 10.0.0.5 has a different service account (or no service account) than the one specified in the rule, the rule will not apply to it, and traffic will be blocked by the implicit deny-all egress/ingress firewall rules. This is the most likely reason the VM cannot receive traffic from 10.0.1.5.

Answer

The source range does not include 10.0.1.5

Answer

The rule only allows TCP but the traffic is UDP

Answer

The priority is too low

Question 6

A company is migrating from an on-premises data center to Google Cloud. They have set up a High-Availability VPN (with two tunnels) between their on-premises router and a Cloud VPN gateway in a VPC. They use static routing. The on-premises network uses RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the VPC uses 10.1.0.0/16. They have configured static routes in the VPC for the on-premises ranges pointing to the VPN gateway. However, they notice that traffic from on-premises to the VPC is intermittent: sometimes packets go through tunnel 1, sometimes through tunnel 2, and sometimes they drop. The on-premises router is configured to use both tunnels in an active-active mode with equal-cost multipath (ECMP). What is the most likely cause of the intermittent drops?

Accepted Answer

Change from static routing to dynamic routing (BGP) to allow the Cloud VPN gateway to advertise routes and avoid ECMP issues.. The most likely cause of intermittent drops is that the on-premises router is using ECMP to distribute traffic across both VPN tunnels, but Cloud VPN with static routing does not support ECMP for incoming traffic. This can lead to out-of-order packets or drops for the same flow if packets arrive on different tunnels. Switching to dynamic routing with BGP allows the Cloud VPN gateway to establish BGP sessions over each tunnel, which enables proper route advertisement and ECMP support by creating a single logical interface. BGP routing also allows the gateway to better handle path selection and failover, thus resolving the intermittent drops. Therefore, option B is correct.

Answer

Increase the number of tunnels to four to distribute traffic better.

Answer

Set the on-premises router to active-passive mode using only one tunnel at a time.

Answer

Configure traffic selector policies on the VPN tunnels to ensure each tunnel only handles specific subnets.

Question 7

A company wants to audit firewall rules for security best practices. They need to identify overly permissive rules (e.g., allowing all traffic from 0.0.0.0/0) and rules that are never used. Which two Google Cloud tools can help? (Choose two.)

Accepted Answer

Firewall Insights. Firewall Insights provides analytics on rule usage (including shadowed and overly permissive rules) and suggests improvements. VPC Flow Logs can be analyzed to see which firewall rules are matched by actual traffic, identifying unused rules. Connectivity Tests is for reachability testing, not auditing. Packet Mirroring is for traffic capture. Cloud Armor is for WAF.

Answer

Packet Mirroring

Answer

Cloud Armor

Answer

Connectivity Tests

Question 8

A company is deploying a global web application on Google Cloud. They need to serve traffic from the closest region to users, support both HTTP and HTTPS, and offload SSL/TLS termination at the load balancer. Which load balancing solution should they use?

Accepted Answer

Global HTTPS Load Balancer. The Global HTTPS Load Balancer is a layer 7 proxy that can terminate SSL/TLS, route traffic based on URL maps, and serve users from the closest region via anycast IP. It supports both HTTP and HTTPS.

Answer

Global SSL Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global TCP Proxy Load Balancer

Question 9

A company wants to connect their on-premises data center to Google Cloud using a site-to-site VPN with dynamic routing. Which protocol should they use for route exchange?

Accepted Answer

BGP. C is correct because Cloud VPN with dynamic routing requires BGP (Border Gateway Protocol) to exchange routes between the on-premises router and the Cloud Router. BGP is the only dynamic routing protocol supported by Google Cloud for site-to-site VPN tunnels, as it allows route advertisement, failover, and policy-based control over multiple tunnels.

Answer

OSPF

Answer

Static routing

Answer

RIP

Question 10

A company uses Packet Mirroring to monitor traffic from a set of VMs. They want to ensure that mirrored traffic does not interfere with the production traffic. Which statement is correct?

Accepted Answer

Packet Mirroring uses a separate forwarding path and does not impact the performance of the monitored VMs.. Packet Mirroring in Google Cloud (and similar platforms) operates by creating a separate, independent copy of the traffic at the virtual switch level, which is then forwarded to a collector destination without traversing the same network path as the original production traffic. This ensures that the mirrored traffic does not consume bandwidth or processing resources on the monitored VMs, and any issues with the mirroring pipeline (e.g., packet drops) have zero impact on the original traffic flow. The correct answer is A because the separate forwarding path guarantees no interference with production traffic.

Answer

If firewall rules block the mirrored traffic, the original traffic will also be blocked.

Answer

Packet Mirroring cannot capture traffic that is encrypted in transit.

Answer

Mirrored traffic is always sent over the same network path as the original traffic.

Question 11

Match each VPC firewall rule component to its description.

Accepted Answer

Source: The IP address or range from which traffic originates.. Correct matches: Source refers to originating IPs, Destination to target IPs, Action to allow/deny, Direction to ingress/egress. Priority and Protocol are other components with distinct meanings.

Answer

Priority: The IP address range from which traffic originates.

Answer

Protocol: Whether the rule allows or denies traffic.

Question 12

A network engineer needs to create a firewall rule that denies all inbound traffic to instances with the tag 'web-server' from source IP range 10.0.0.0/8. They also have an existing allow rule with priority 1000 that permits traffic from 10.0.0.0/8 to those instances. To ensure the deny rule takes precedence, what priority should the new rule have?

Accepted Answer

500. In GCP firewall rules, lower priority numbers have higher precedence. To override an allow rule with priority 1000, the deny rule must have a priority lower than 1000.

Answer

1000

Answer

0

Answer

2000

Question 13

A company needs to connect on-premises to GCP using Dedicated Interconnect with a 10 Gbps link, and they require high availability. They plan to use a single VLAN attachment. What is the best design?

Accepted Answer

Deploy two interconnects with one VLAN attachment each.. For high availability with Dedicated Interconnect, you need two separate physical connections (interconnects) to avoid a single point of failure. Each interconnect must have its own VLAN attachment and BGP session to ensure that if one link fails, traffic can still flow over the other. A single VLAN attachment cannot provide redundancy because it is tied to one physical interconnect.

Answer

Deploy one interconnect with one VLAN attachment and a VPN as backup.

Answer

Deploy one interconnect with one VLAN attachment and use static routing.

Answer

Deploy two VLAN attachments on the same interconnect with separate BGP sessions.

Question 14

A company is designing a VPC routing strategy. Which three are valid route types in Google Cloud VPC? (Choose three.)

Accepted Answer

System-generated routes. Options A, B, and D are correct. System-generated routes are created automatically for subnet ranges and default internet gateway. Custom static routes are manually defined by administrators. Dynamic routes are learned through BGP from on-premises or other networks. Option C is incorrect because 'VPN tunnel routes' is not a distinct route type; VPN tunnels utilize either static routes or BGP for route advertisement. Option E is incorrect because 'Peering routes' are not a separate type; they are system-generated routes imported from peered VPCs.

Answer

VPN tunnel routes

Answer

Peering routes

Question 15

Refer to the exhibit. A network engineer configured a Cloud Router to advertise the on-premises subnet 10.0.0.0/8 to the VPC. However, traffic from VPC instances to 10.0.0.0/8 is being dropped. What is the most likely issue?

Accepted Answer

The subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range.. Cloud Router uses custom route advertisements, and if the on-premises subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range (e.g., the default or custom subnet ranges within the VPC), Google Cloud will not install or will drop traffic for that route due to a conflict. Overlapping routes cause the VPC to prefer its own local routes, resulting in dropped traffic to the on-premises subnet.

Answer

The advertised route has a priority that is too low.

Answer

The Cloud Router's ASN is private, causing routes to be rejected.

Answer

The on-premises router is not configured to accept the advertised route.