PCNE Practice Test 5 — 10 Questions

Question 1

A company wants to connect an on-premises network to Google Cloud using Cloud VPN. The on-premises network has a single subnet and no dynamic routing capabilities. The company needs a simple, low-cost solution. Which VPN configuration should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Classic VPN with route-based configuration. Classic VPN with route-based configuration is the correct choice because the on-premises network lacks dynamic routing capabilities and requires a simple, low-cost solution. Route-based VPNs use static routes and do not require BGP, making them ideal for environments without dynamic routing support. Classic VPN is the legacy, lower-cost option compared to HA VPN, and route-based configuration allows traffic to be forwarded based on routing table entries rather than policy-based selectors.

Answer

HA VPN with dynamic routing (BGP)

Answer

HA VPN with static routing

Answer

Classic VPN with policy-based configuration

Question 2

A company uses Shared VPC. They want to restrict which service project's VMs can use a specific subnet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Use IAM roles on the subnet resource to grant 'compute.subnetUser' to specific service projects.. IAM roles on a subnet resource allow you to grant the `compute.subnetUser` role to specific service projects, which controls which projects can create VM instances in that subnet. This is a direct method to restrict subnet usage within a Shared VPC environment, as the role grants permission to use the subnet without granting broader network access.

Answer

Use VPC network peering.

Answer

Use firewall rules to deny traffic from other service projects.

Answer

Use network tags on VMs and associate the subnet with those tags.

Question 3

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Accepted Answer

Create a Cloud Router in the region, then create a Cloud NAT gateway using that router, then assign static IP addresses to the NAT, then apply the NAT to the desired subnets, then test connectivity from a private instance.. Cloud NAT requires a Cloud Router first. Then create NAT, assign IPs, and apply to subnets. Testing confirms internet access.

Answer

Create a Cloud NAT gateway first, then create a Cloud Router, then assign IP addresses, then apply to subnets, then test connectivity.

Answer

Create a Cloud Router, then assign IP addresses to the NAT, then create the Cloud NAT, then apply to subnets, then test.

Answer

Create a Cloud Router, then create a Cloud NAT and apply it to subnets, then assign IP addresses, then test connectivity.

Question 4

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Accepted Answer

Mismatched BGP hold timer values. BGP session flapping can be caused by mismatched parameters, MTU issues, or authentication problems.

Answer

Incorrect VLAN ID on the VLAN attachment

Answer

Duplicate AS number on the on-premises router

Question 5

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. NCC supports both VPC spokes and hybrid spokes (VPN/Interconnect). It does not support direct VPC-to-VPC peering; that's VPC peering. Route propagation is automatic within NCC.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.

Question 6

A company has deployed an HTTP load balancer with a backend service configured to use an unmanaged instance group. Users report that traffic is not reaching the backend instances. The backend instances are healthy and have proper firewall rules allowing traffic from the load balancer. What step should the network engineer take to resolve the issue?

Accepted Answer

Add a route for the load balancer's IP range.. The load balancer sends traffic to backend instances using their internal IP addresses. If there is no route from the load balancer's frontend IP range to the subnet containing the backend instances, traffic will be dropped. Adding a route for the load balancer's IP range ensures that packets can reach the instances. Since the problem states firewall rules are already proper, Option A (health check firewall rules) is unnecessary. Health checks are already configured (Option B is not needed). Instances do not require external IPs (Option C). Therefore, the correct step is to add the missing route.

Answer

Configure a firewall rule to allow health check probes from the load balancer's health check ranges.

Answer

Enable HTTP health check on the backend service.

Answer

Assign an external IP address to each backend instance.

Question 7

Drag and drop the steps to set up a Cloud Interconnect connection for dedicated on-premises connectivity into the correct order.

Accepted Answer

1. Order Cloud Interconnect, 2. Create VLAN attachment, 3. Complete cross-connect, 4. Configure BGP session, 5. Verify connectivity. Cloud Interconnect requires ordering, VLAN attachment, cross-connect, BGP, and verification.

Answer

1. Create VLAN attachment, 2. Order Cloud Interconnect, 3. Complete cross-connect, 4. Configure BGP session, 5. Verify connectivity

Answer

1. Order Cloud Interconnect, 2. Complete cross-connect, 3. Create VLAN attachment, 4. Configure BGP session, 5. Verify connectivity

Answer

1. Order Cloud Interconnect, 2. Configure BGP session, 3. Create VLAN attachment, 4. Complete cross-connect, 5. Verify connectivity

Question 8

A company has deployed an external HTTPS load balancer with a Cloud CDN backend. The load balancer uses a managed SSL certificate. Recently, the company updated their DNS record to point to a different IP address of a new load balancer. After the change, some users are still being served from the old load balancer's cache. The network engineer has confirmed that the DNS TTL has expired. What is the most likely cause of this issue?

Accepted Answer

Cloud CDN cached responses from the old load balancer may still be served until their cache TTL expires.. Cloud CDN caches content at Google's edge caches based on the cache-control headers or default cache TTL. When the DNS record is updated to point to a new load balancer, the old load balancer's cached responses may still be served from edge caches until their cache TTL expires, even after the DNS TTL has expired. This is because Cloud CDN caches are independent of DNS resolution and are governed by HTTP caching rules.

Answer

The old load balancer's SSL certificate is still cached by clients.

Answer

The DNS change has not propagated globally despite the TTL expiring.

Answer

The old load balancer's IP address is still being served by Google's edge network due to anycast.

Question 9

A company has a VPC with subnets in us-east1 and europe-west1. They have deployed a global external HTTP(S) load balancer with backend services in both regions. Users in Europe report high latency. What is the most likely cause?

Accepted Answer

Session affinity set to CLIENT_IP, causing sticky sessions to a distant backend. CLIENT_IP session affinity causes the load balancer to hash the client's IP address to a specific backend instance. If a user in Europe is hashed to a backend in us-east1, all their requests will be forwarded to that distant region, resulting in high latency. This occurs even though a healthy backend exists in europe-west1, because the affinity overrides the load balancer's normal least-latency or proximity-based routing.

Answer

Incorrect health check configuration causing backends to be marked unhealthy

Answer

Firewall rules blocking traffic from the load balancer's health check probes

Answer

The load balancer is not enabled for global access

Question 10

A security engineer wants to allow SSH access to a VM that has no external IP. The VM is in a VPC with IAP configured. What is the simplest way to enable secure SSH without a bastion host?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding with the gcloud compute start-iap-tunnel command.. Identity-Aware Proxy (IAP) TCP forwarding allows secure SSH access to a VM without an external IP by tunneling traffic through the IAP service. The `gcloud compute start-iap-tunnel` command establishes an encrypted tunnel from your local machine to the VM via the IAP proxy, using the VM's internal IP and port 22. This eliminates the need for a bastion host or public IP while leveraging IAP's identity-based access controls.

Answer

Create a VPN tunnel to the VPC and SSH over the VPN.

Answer

Configure a SOCKS proxy on a bastion host.

Answer

Assign an external IP to the VM and use a firewall rule to restrict access.