PCNE Practice Test 5 — 10 Questions

Question 1

A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?

Accepted Answer

Export logs to BigQuery. For long-term analysis and ad-hoc querying of HTTP load balancer access logs, exporting them to BigQuery is the recommended approach because BigQuery is a fully managed, petabyte-scale analytics data warehouse that supports fast SQL queries over massive datasets. Cloud Logging is designed for real-time monitoring and short-term retention (default 30 days), not for the complex, historical, large-scale analytical queries that user-behavior and traffic-pattern analysis requires.

Answer

Use VPC Flow Logs instead

Answer

View logs in the Cloud Logging dashboard

Answer

Store logs in Cloud Storage and use grep

Question 2

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

Accepted Answer

Specify a subnet in the same region as the backend instances.. An internal load balancer (ILB) in GCP requires a regional forwarding rule that routes traffic to backend instances within the same VPC. Specifying a subnet in the same region as the backend instances is mandatory because the ILB's internal IP address is allocated from that subnet, and the forwarding rule must reference a subnet to enable internal-only routing. Without a subnet, the ILB cannot be provisioned as an internal load balancer.

Answer

Assign a static external IP address to the forwarding rule.

Answer

Upload an SSL certificate to the load balancer.

Answer

Create a Cloud NAT gateway for the backend instances.

Question 3

An organization has multiple VPCs in different projects that need to consume a common internal service hosted in a central project. The service runs on a set of Compute Engine instances with internal IPs. Which architecture allows the consumers to access the service using private IPs without VPC peering?

Accepted Answer

Create a Private Service Connect endpoint in each consumer VPC and publish the service as a Private Service Connect service from the central project.. Private Service Connect allows you to publish internal services via Private Service Connect endpoints in consumer VPCs. Consumers access the service using internal IPs without needing VPC peering or VPNs. This is the recommended architecture for publishing and consuming internal services across projects.

Answer

Use Cloud VPN to connect each consumer VPC to the central VPC.

Answer

Expose the service through an external IP and use IAM to restrict access.

Answer

Set up VPC peering between each consumer VPC and the central VPC.

Question 4

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

Accepted Answer

gRPC. For gRPC backends, the health check should use the gRPC protocol because gRPC health checking is defined by the standard grpc.health.v1.Health service, which returns a structured status that load balancers can interpret. HTTP or TCP checks cannot properly validate gRPC service health since gRPC uses HTTP/2 with binary framing and its own status semantics.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 5

A company wants to resolve DNS queries from their on-premises network for Google Cloud private zones (e.g., example.internal) without duplicating DNS data. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS forwarding. Inbound DNS forwarding allows on-premises DNS resolvers to send queries to Cloud DNS for private zones (e.g., example.internal) without duplicating records. The on-premises resolver forwards queries to a Cloud DNS inbound forwarder IP, which resolves the private zone and returns the answer. This is the correct feature for on-prem to cloud private zone resolution.

Answer

DNS peering

Answer

Private DNS zones

Answer

Outbound DNS forwarding

Question 6

A network engineer needs to test connectivity after setting up a Dedicated Interconnect VLAN attachment and BGP session. Which tool should they use to verify that Google Cloud can reach an on-premises IP address?

Accepted Answer

ping and traceroute from a Google Cloud VM to the on-premises IP.. After configuring a Dedicated Interconnect VLAN attachment and BGP session, the most direct way to verify connectivity from Google Cloud to an on-premises IP is to use ping and traceroute from a Google Cloud VM. These tools test actual data-plane reachability and path, confirming that routes are exchanged and traffic flows.

Answer

gcloud compute interconnect list command.

Answer

Cloud Monitoring dashboard for interconnect metrics.

Answer

tcpdump on the on-premises router.

Question 7

A media streaming company uses Cloud CDN with signed URLs to protect content. They want to invalidate cached content for a specific file after a security incident. The file is stored in a Cloud Storage bucket and the CDN cache key includes the URL. They run: gcloud compute url-maps invalidate-cdn-cache URL_MAP --path "/videos/incident.mp4". The invalidation succeeds but the old content is still served. What is the most likely reason?

Accepted Answer

The invalidation path does not match the cache key because signed URLs include query parameters.. Cloud CDN's cache key for signed URLs includes the query parameters (e.g., `?Expires=...&Signature=...`). The invalidation command specifies only the path `/videos/incident.mp4`, which does not match the full cache key that includes the query string. As a result, the invalidation does not purge the cached entry for the signed URL, and the old content continues to be served.

Answer

The Cloud CDN cache key does not include query parameters, so the invalidation should work.

Answer

The Cache-Control header on the object is set to public, max-age=31536000.

Answer

The Cloud Storage bucket requires object versioning to be enabled for invalidation.

Question 8

An organization has multiple VPCs in different regions that need to connect to a single on-premises data center via Dedicated Interconnect. They want to minimize cost and complexity. What is the recommended architecture?

Accepted Answer

Create a single interconnect connection and use multiple VLAN attachments, one per VPC.. A single Dedicated Interconnect connection can support multiple VLAN attachments (each with a unique VLAN ID) to connect multiple VPCs in different regions to the same on-premises data center. This minimizes cost by using one physical connection and reduces complexity by avoiding separate interconnects or VPNs for each VPC.

Answer

Use a single VPC and then use VPC Peering to connect to the other VPCs.

Answer

Use Cloud VPN for the additional VPCs to avoid additional interconnect costs.

Answer

Create a separate interconnect connection for each VPC.

Question 9

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The metric 'interconnect/link/operational_status' provides the operational status of each interconnect link (e.g., operational, degraded).

Answer

interconnect/vlan_attachment/outbound_bytes

Answer

interconnect/network/packet_drop_count

Answer

interconnect/network/received_bytes_count

Question 10

A company wants to use Cloud DNS to resolve DNS queries from their on-premises network for a private zone that contains internal GCP resource names. They do not want to manage DNS servers on-premises. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS server policy. Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS private zones, enabling resolution without managing on-premises DNS servers.

Answer

Private DNS zone

Answer

Outbound DNS server policy

Answer

DNS peering