PCNE Practice Test 48 — 15 Questions

Question 1

A network engineer needs to ensure that Compute Engine instances without external IP addresses can access Google APIs such as BigQuery and Cloud Storage. Which feature should be enabled on the subnet where the instances reside?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Private Google Access. Private Google Access allows instances without external IPs to reach Google APIs using private IP addresses. It is enabled per subnet.

Answer

Private Service Connect

Answer

VPC Service Controls

Answer

Cloud NAT

Question 2

A gaming company uses Cloud Armor with an external HTTP(S) load balancer to protect against DDoS attacks. They need to restrict access to the load balancer based on geographic region. What should they configure?

Accepted Answer

Geo-match custom rule in Cloud Armor. Cloud Armor supports geo-match custom rules that allow you to allow or deny traffic based on the geographic region of the client IP address. When attached to an external HTTP(S) load balancer, these rules are evaluated at the edge before traffic reaches the backend, providing effective geo-based access control against DDoS attacks.

Answer

Geo-based routing policy on the backend service

Answer

A firewall rule that blocks IPs from certain countries

Answer

Use Cloud CDN with geo filtering

Question 3

An organization needs to allow on-premises servers to resolve DNS names of GCP VM instances using RFC 1918 addresses. They have a Cloud VPN connection. Which DNS resolution approach should they implement?

Accepted Answer

Configure Cloud DNS inbound server policy and set up forwarding from on-premises DNS to the Cloud DNS inbound endpoint. The on-premises servers need to resolve DNS names of GCP VM instances using RFC 1918 addresses over a Cloud VPN connection. Configuring a Cloud DNS inbound server policy creates a VPC-wide inbound DNS endpoint (using an internal IP address) that on-premises DNS servers can forward queries to. This allows the on-premises DNS to send DNS requests for GCP private zone records (e.g., `vm-instance.c.example.internal`) directly to the Cloud DNS inbound endpoint, which then resolves the private RFC 1918 addresses of the VM instances.

Answer

Set up a public zone and use the instance's external IP for DNS

Answer

Configure Cloud DNS outbound server policy and forward from Cloud DNS to on-premises DNS

Answer

Use DNS peering with a private zone in the on-premises DNS

Question 4

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

Accepted Answer

Add a new allow rule for that region with a lower priority number than the deny rule. Cloud Armor security rules are evaluated in order of priority, where a lower priority number means higher precedence. To allow traffic from a specific region that is currently blocked by a deny rule, you must add an allow rule with a lower priority number (e.g., 100) than the deny rule (e.g., 1000). This ensures the allow rule is evaluated first, permitting the legitimate traffic before the deny rule can block it, while the deny rule still protects against attacks from other regions.

Answer

Remove the deny rule for that region and rely on other security measures

Answer

Remove all rules and add a single allow rule for the legitimate region

Answer

Reorder the rules so that the deny rule is at the bottom of the list

Question 5

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) uses a hub-and-spoke model to connect on-premises networks and VPCs.

Answer

Cloud VPN

Answer

VPC peering

Answer

Cloud Router

Question 6

A small company has a single VPC with one subnet in us-central1 (10.0.1.0/24). They have a Compute Engine instance that needs to be reachable from the internet via HTTP (port 80) and HTTPS (port 443). The instance has an external IP address (ephemeral). They have created firewall rules allowing ingress on TCP 80 and 443 from 0.0.0.0/0, with target tags 'web-server'. The instance has been assigned the tag 'web-server'. However, external users report that they cannot access the instance's public IP on either port. The instance's OS firewall (iptables) is default allow. What is the most likely cause?

Accepted Answer

The instance's external IP is ephemeral and may have changed, so users should use the new IP or reserve a static IP.. The VPC automatically has a default route to the internet gateway, so no custom route is needed. Firewall rules with target tags 'web-server' are correctly applied to the instance with that tag. The instance's OS firewall (iptables) is default allow, so it is not blocking traffic. The most likely cause is that the instance's external IP is ephemeral and may have changed after a stop/start operation. Users may be attempting to connect to the old IP address. To resolve this, the company should assign a static external IP to the instance.

Answer

The instance's OS firewall is blocking the traffic; check iptables.

Answer

The VPC needs a custom route for the internet gateway.

Answer

The firewall rules must be applied to the subnet, not the instance tag.

Question 7

A company wants to use Cloud DNS to resolve DNS queries from their on-premises network for a private zone that contains internal GCP resource names. They do not want to manage DNS servers on-premises. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS server policy. Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS private zones, enabling resolution without managing on-premises DNS servers.

Answer

Private DNS zone

Answer

Outbound DNS server policy

Answer

DNS peering

Question 8

A company has a VPC with a subnet in us-central1. They have several private Compute Engine instances (no external IP) that need to download updates from a public repository on the internet. The network engineer has created a Cloud NAT gateway in the same region and attached it to the subnet. However, the instances still cannot reach the internet. The engineer has confirmed that the Cloud NAT gateway is correctly configured and that the subnet's Private Google Access is not relevant for this traffic. What should the engineer check first to resolve the issue?

Accepted Answer

Verify that the default route (0.0.0.0/0) is present in the VPC route table pointing to the internet gateway.. Even with a properly configured Cloud NAT, instances require a default route (0.0.0.0/0) in the VPC route table that points to the internet gateway (IGW) to direct outbound traffic to the internet. Cloud NAT translates private IPs to public IPs, but it does not create the route; the route must exist for packets to leave the VPC. Without this route, traffic from the instances to 0.0.0.0/0 will be dropped, as there is no next-hop to forward packets to the internet.

Answer

Confirm that the Cloud NAT router is configured with the correct network and subnet.

Answer

Ensure that the Cloud NAT gateway has a static external IP.

Answer

Check that the firewall rules allow egress traffic for the instances to the internet.

Question 9

An organization has a hybrid network with multiple VPN tunnels connecting their on-premises network to Google Cloud. They use Cloud Router with BGP to propagate routes. They recently added a new subnet 192.168.100.0/24 in Google Cloud. On-premises devices can reach resources in the new subnet, but Google Cloud resources cannot initiate traffic to certain on-premises hosts in the 10.0.0.0/8 subnet. BGP sessions are all established. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking traffic initiated from the 192.168.100.0/24 subnet because it is not in the permitted list.. The issue is that on-premises hosts in 10.0.0.0/8 can be reached from the new Google Cloud subnet (192.168.100.0/24) because BGP routes are propagated, but return traffic initiated from on-premises hosts is blocked by the on-premises firewall. Since BGP sessions are established and routes are exchanged, the problem is not routing but stateful firewall filtering: the on-premises firewall likely has a rule that permits traffic from known subnets but does not include 192.168.100.0/24, so return packets for connections initiated from Google Cloud are dropped.

Answer

The VPC firewall rules are blocking outbound traffic from the new subnet.

Answer

There is a route conflict between the 192.168.100.0/24 route and an existing route in the on-premises routing table.

Answer

The on-premises BGP router is not advertising the 10.0.0.0/8 network because a mask mismatch.

Question 10

A developer wants to use Cloud CDN to cache content from a backend bucket. They want to cache all objects regardless of cache-control headers, but need to exclude certain URL patterns (e.g., /private/*) from caching. Which cache mode should they choose?

Accepted Answer

FORCE_CACHE_ALL. Cloud CDN cache modes: FORCE_CACHE_ALL caches all content irrespective of origin headers; USE_ORIGIN_HEADERS respects cache-control; CACHE_ALL_STATIC is similar to FORCE_CACHE_ALL but for static content. To exclude certain paths, you need to set up cache key or use URL map routing to different backends. The question asks for cache mode; FORCE_CACHE_ALL will cache everything by default, but to exclude patterns, you need to configure cache key rules or separate backends. However, the best answer among the options is FORCE_CACHE_ALL because it caches all objects, but the exclusion would require additional configuration. There is no "CACHE_ALL_EXCEPT" mode. Actually, the correct approach is to use a URL map with two backend buckets: one for public content with FORCE_CACHE_ALL, and one for private content with no CDN. But among the cache modes, FORCE_CACHE_ALL is the one that ignores cache-control.

Answer

CACHE_ALL_STATIC

Answer

DISABLED

Answer

USE_ORIGIN_HEADERS

Question 11

A company wants to use Cloud DNS to distribute traffic across multiple regional endpoints with failover: primary in us-central1, secondary in us-west1. If the primary health check fails, traffic should go to secondary. Which routing policy should they use?

Accepted Answer

Failover routing policy. Failover routing policy allows specifying primary and secondary targets with health checks. Geolocation and weighted round robin do not provide failover behavior.

Answer

Geolocation routing policy

Answer

Weighted round robin routing policy

Answer

Simple routing policy (A record)

Question 12

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Accepted Answer

URL map. To achieve this, you need a backend service (or backend bucket) for the service, a URL map to route requests, and an SSL certificate for the custom domain. The load balancer itself is the target proxy.

Answer

Cloud NAT gateway

Answer

Target TCP proxy

Question 13

An engineer is configuring a Global HTTPS Load Balancer with a backend service that points to a serverless NEG for Cloud Functions. The health checks are failing. What is the most likely cause?

Accepted Answer

Serverless NEGs do not support health checks. Serverless NEGs do not support health checks. The load balancer relies on the underlying Cloud Functions being healthy. Health checks must be disabled for serverless backends.

Answer

The health check path is incorrect

Answer

The backend service is not associated with the correct URL map

Answer

The health check protocol is set to HTTP instead of HTTPS

Question 14

A company has a TCP-based application running on a group of Compute Engine VMs in us-central1. They need to provide a static internal IP address to clients within the VPC, while preserving the client source IP for logging. Which load balancer should they use?

Accepted Answer

Regional Internal TCP/UDP Load Balancer. The Regional Internal TCP/UDP Load Balancer is a pass-through load balancer that preserves client IP. It provides a static internal IP and operates at L4.

Answer

Regional Internal HTTP(S) Load Balancer

Answer

Regional External TCP/UDP Network Load Balancer

Answer

Global Internal HTTP(S) Load Balancer

Question 15

You are configuring a Regional Internal HTTP(S) Load Balancer for a service that must only be accessible from within a VPC. The backend is a zonal NEG of Compute Engine instances. The load balancer is not receiving traffic. What is a likely cause?

Accepted Answer

The backend service is in a different region than the forwarding rule. Internal HTTP(S) LB requires an internal forwarding rule in the same region as the backend. The forwarding rule must use an internal IP address, and the backend service must be in the same region.

Answer

The zonal NEG is in a different zone than the forwarding rule

Answer

The health check is using TCP but the instances expect HTTP

Answer

The forwarding rule uses an external IP address