PCNE Practice Test 49 — 15 Questions

Question 1

Refer to the exhibit. A Compute Engine instance has the network tags 'http-server' and 'ssh-server'. It also has a public IP address. Which of the following statements about traffic to this instance is true?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HTTP traffic from the internet is allowed.. The instance has the network tag 'http-server', which is used by the default VPC firewall rule 'default-allow-http' to permit inbound TCP traffic on port 80 from any source (0.0.0.0/0). Since the instance also has a public IP address, HTTP traffic from the internet can reach it. The other tags and the public IP do not override this allow rule.

Answer

All traffic from the internet is denied because of the deny-all rule.

Answer

SSH traffic from the internet is allowed.

Answer

HTTPS traffic from the internet is allowed.

Question 2

You are using Traffic Director with Envoy sidecars for a microservices application. You want to inject artificial delays into requests from service A to service B for testing purposes. Which Traffic Director feature should you use?

Accepted Answer

Fault injection. Traffic Director supports fault injection, which allows you to inject delays and abort requests into the traffic between services.

Answer

Traffic splitting

Answer

Circuit breakers

Answer

Outlier detection

Question 3

You need to create a DNS routing policy that routes users in Europe to one IP and users in Asia to a different IP, with a fallback to a default IP if no match. Which THREE elements are required? (Choose 3)

Accepted Answer

A geo location (e.g., europe-west1). A geo routing policy requires a geo location, an IP address (rrdata) for each geo, and a default target for unmatched locations.

Answer

A health check

Answer

A response policy

Question 4

A company wants to use Cloud CDN to accelerate content delivery globally. Which TWO of the following are valid cache key components that can be configured in Cloud CDN? (Choose 2)

Accepted Answer

Query string parameters. Cloud CDN allows you to configure cache keys based on protocol, host, query string parameters, and headers. IP address and client port are not configurable cache key components.

Answer

Client IP address

Answer

Request headers (e.g., Accept-Language)

Answer

Client port

Question 5

A large enterprise is migrating to Google Cloud and needs to establish connectivity between on-premises and VPCs in two different regions (us-east1 and europe-west1). They have a single Partner Interconnect connection at a co-location facility in New York. They want to use the same interconnect for both regions. Which configuration should they use?

Accepted Answer

Create two VLAN attachments, one for each region, over the same interconnect. A is correct because a single Partner Interconnect connection can support multiple VLAN attachments, each associated with a different region. By creating two VLAN attachments over the same interconnect—one for us-east1 and one for europe-west1—the enterprise can route traffic from the on-premises network to both VPCs using the same physical link, leveraging Google Cloud's support for multiple VLAN attachments per interconnect.

Answer

Create one VLAN attachment and attach it to both VPCs

Answer

Use HA VPN over the interconnect to connect both regions

Answer

Create two Cloud VPN tunnels from on-prem to each VPC

Question 6

A financial services company requires a dedicated, low-latency connection between their on-premises data center and Google Cloud. They need a 99.99% SLA and bandwidth of 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides 10 Gbps or 100 Gbps links with a 99.99% SLA when configured with two connections.

Answer

HA VPN

Answer

Partner Interconnect

Answer

Classic VPN

Question 7

A company is planning a hybrid connectivity setup using HA VPN. They want to ensure high availability by using two Cloud VPN gateways. How many tunnels and external IP addresses are required for the HA VPN to achieve 99.99% SLA?

Accepted Answer

2 external IPs, 4 tunnels. HA VPN uses two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP to provide a 99.99% SLA.

Answer

4 external IPs, 4 tunnels

Answer

2 external IPs, 2 tunnels

Answer

1 external IP, 2 tunnels

Question 8

A company wants to connect two VPCs in the same region so that they can communicate using internal IP addresses without transiting the internet. They have no overlapping IP ranges. Which GCP networking feature should they use?

Accepted Answer

VPC peering. VPC peering allows two VPCs to communicate using internal IPs without a VPN or internet gateway, as long as there is no IP overlap.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Cloud Interconnect

Question 9

A developer wants to configure Cloud DNS for split-horizon DNS where internal queries resolve to private IPs and external queries resolve to public IPs. Which TWO steps should they take?

Accepted Answer

Create a public managed zone for the domain.. Split-horizon DNS is achieved by having a private zone for internal resolution and a public zone for external resolution, both authoritative for the same domain.

Answer

Set up DNS peering between the zones.

Answer

Configure the private zone with a VPC network binding.

Answer

Use DNS forwarding to on-premises servers.

Question 10

A company uses Shared VPC with a host project and multiple service projects. They want to grant a team in a service project the ability to create and manage firewall rules that apply to the shared VPC's subnets. Which THREE IAM roles or permissions are needed? (Choose three.)

Accepted Answer

compute.firewalls.create permission on the host project. To manage firewall rules on a shared VPC, the user needs compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete permissions, which are included in the Compute Security Admin role (roles/compute.securityAdmin) at the host project level. Additional roles may be needed depending on organization policies.

Answer

compute.firewalls.delete permission on the service project

Answer

Compute Network Admin (roles/compute.networkAdmin) on the service project

Question 11

A company has a Shared VPC with a host project and several service projects. They want to allow a service project's Network Engineer to create and manage Cloud Load Balancers, but not modify other networking resources in the shared VPC. Which IAM role should be granted at the service project level?

Accepted Answer

Compute Load Balancer Admin (roles/compute.loadBalancerAdmin). The Compute Load Balancer Admin role (roles/compute.loadBalancerAdmin) grants permissions to create, update, and delete load balancers. The Network Admin role (roles/compute.networkAdmin) would allow modifying other network resources, which is not desired.

Answer

Project Editor (roles/editor)

Answer

Compute Network Admin (roles/compute.networkAdmin)

Answer

Compute Security Admin (roles/compute.securityAdmin)

Question 12

A company has a Dedicated Interconnect connection with a VLAN attachment in their GCP VPC. They want to use BGP to exchange routes with their on-premises router. Which GCP resource must be configured to establish the BGP session?

Accepted Answer

Cloud Router. A Cloud Router is required to establish BGP sessions over VLAN attachments. The Cloud Router manages BGP peers and route advertisements.

Answer

VPC peering

Answer

Network Connectivity Center

Answer

Cloud VPN gateway

Question 13

An engineer is designing a hybrid network with a 10 Gbps Dedicated Interconnect. They require 99.99% availability for the connection. What is the minimum number of VLAN attachments and BGP sessions recommended?

Accepted Answer

2 VLAN attachments, 2 BGP sessions (one per attachment). To achieve 99.99% availability, you need at least 2 VLAN attachments (each on different physical links) and 2 BGP sessions. For higher SLAs, use 2 attachments and 4 BGP sessions.

Answer

2 VLAN attachments, 4 BGP sessions

Answer

2 VLAN attachments, 1 BGP session

Answer

1 VLAN attachment, 1 BGP session

Question 14

Which VPC type allows you to specify custom IP ranges and regions for subnets during creation, and does not automatically create subnets in every region?

Accepted Answer

Custom mode VPC. Custom mode VPCs let you define subnets manually. Auto mode creates a subnet per region automatically.

Answer

Auto mode VPC

Answer

Legacy Network

Answer

Shared VPC

Question 15

A company is setting up HA VPN to connect an on-premises network to a single GCP region. They want to achieve 99.99% SLA. Which three steps are required? (Choose THREE.)

Accepted Answer

Create two Cloud VPN gateways, each with one external IP address.. HA VPN requires two VPN gateways (each with one external IP), two tunnels per gateway (total four tunnels), and BGP sessions on each tunnel for dynamic routing.

Answer

Ensure that the VPN gateways are in different regions.

Answer

Configure static routes on the on-premises VPN device.