PCNE Practice Test 50 — 15 Questions

Question 1

A company is using Cloud NAT to provide outbound internet access for instances without external IPs. They notice that the NAT gateway is running out of ports for connections to a single external IP address. To minimize port exhaustion, what should the engineer configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the number of NAT IP addresses assigned to the Cloud NAT gateway.. Cloud NAT uses NAT IP addresses and ports. To increase capacity for connections to a single destination IP, you can either allocate more NAT IP addresses (which increases the number of ports) or use dynamic port allocation. Static port allocation is used for endpoints that require predictable source ports. For minimizing exhaustion, adding more NAT IPs is the direct solution.

Answer

Change the NAT port allocation to static.

Answer

Reduce the endpoint-independent mapping timeout.

Answer

Enable Cloud NAT logging to diagnose the issue.

Question 2

A company wants to protect its HTTPS Load Balancer from DDoS attacks and common web application attacks like SQL injection and cross-site scripting (XSS). Which Google Cloud service should be used?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and WAF capabilities including preconfigured rules for OWASP, XSS, and SQLi. It attaches to HTTPS Load Balancers.

Answer

Cloud IDS

Answer

VPC Service Controls

Answer

Firewall Rules

Question 3

An engineer needs to configure DNS resolution for a Compute Engine instance named "web-1" in zone us-central1-a of project my-project. What is the internal DNS name for this instance?

Accepted Answer

web-1.us-central1-a.c.my-project.internal. GCP internal DNS uses the format: [instance name].[zone].c.[project id].internal

Answer

web-1.us-central1.c.my-project.internal

Answer

web-1.c.my-project.us-central1-a.internal

Answer

web-1.us-central1-a.my-project.internal

Question 4

An engineer needs to provide outbound internet access to a set of Compute Engine instances that do not have external IP addresses. The instances are in a VPC subnet with a Cloud NAT configured. However, the instances still cannot reach the internet. The engineer verified that Cloud NAT is configured on the same region and VPC as the instances. What is the most likely cause?

Accepted Answer

The instances are not tagged with the correct network tag used in the Cloud NAT configuration. Cloud NAT requires the instances to have the 'allow NAT' network tag or service account configured in the NAT gateway rules. If the instances are not tagged or the service account is not specified, traffic is not forwarded.

Answer

The firewall rules block all outbound traffic from the subnet

Answer

The instances are using a custom network that does not support Cloud NAT

Answer

The Cloud NAT gateway uses dynamic port allocation, which is disabled

Question 5

A company has an application running on Compute Engine that needs to send traffic to a third-party SaaS service on the internet. The VMs have no external IPs. Which solution provides outbound connectivity with minimal configuration and allows source IP preservation?

Accepted Answer

Use Cloud NAT with a static NAT IP. Cloud NAT allows VMs without external IPs to reach the internet. It preserves the source IP (the NAT IP) for outbound connections. It is regional and can be configured per subnet.

Answer

Configure a proxy instance with an external IP and route traffic through it

Answer

Assign external IPs to each VM

Answer

Use Private Google Access

Question 6

Match each Google Cloud Armor feature to its description.

Accepted Answer

Security Policies: A set of rules that filter traffic to backend services based on conditions.. Cloud Armor features include Security Policies (rule-based traffic filtering), WAF Rules (web vulnerability protection), and DDoS Protection (edge mitigation). Common confusions mix WAF with IP lists or rate limiting.

Answer

Security Policies: A feature that provides managed protection against OWASP Top 10 attacks.

Answer

WAF Rules: A list of allowed or blocked IP addresses for backend services.

Answer

DDoS Protection: Enables custom rate limiting for individual users.

Question 7

An organization needs to serve a TCP-based application globally with low latency but without SSL termination. Which load balancer should they use?

Accepted Answer

Global TCP Proxy Load Balancer. Global TCP Proxy Load Balancer is designed for non-SSL TCP traffic and provides global anycast IP.

Answer

Global HTTPS Load Balancer

Answer

Global SSL Proxy Load Balancer

Answer

Regional External TCP/UDP Network Load Balancer

Question 8

A company uses a Global HTTPS Load Balancer with Cloud CDN. They need to purge specific cached objects for all users immediately after a content update. Which method should they use?

Accepted Answer

Cache invalidation. Cache invalidation allows purging specific URLs or URL prefixes from Cloud CDN caches.

Answer

Delete the objects from the backend bucket

Answer

Use signed URLs

Answer

Reduce TTL on the origin

Question 9

An engineer wants to use Cloud DNS to override DNS responses for a specific domain within their VPC. Which feature should they use?

Accepted Answer

Response policy zone (RPZ). Response policy zones (RPZ) allow overriding DNS responses for specified domains within a VPC.

Answer

Private zone

Answer

DNSSEC

Answer

Routing policy

Question 10

A media company uses Cloud CDN with signed URLs to distribute premium video content. They need to revoke access for a specific user immediately. Which approach should they take?

Accepted Answer

Delete the signed URL key that was used to sign the user's URL. Signed URLs are based on keys; to revoke access, you can either remove the key (invalidates all URLs signed with that key) or wait for expiration. There is no per-user revocation. The correct approach is to delete or disable the signing key, which invalidates all URLs signed with that key.

Answer

Use Cloud CDN cache invalidation to remove the user's content

Answer

Add the user's IP address to a deny list in the load balancer

Answer

Change the signing algorithm to SHA512

Question 11

You need to allow on-premises servers to access a Google Cloud VM's internal IP without using a public IP. The on-premises network is connected via Cloud VPN. What configuration is required on the Google Cloud side?

Accepted Answer

Enable Private Google Access on the VPC subnet where the VM resides. [wrong]. None of the provided options are correct. To allow on-premises servers to access a Google Cloud VM's internal IP over Cloud VPN, no special Google Cloud-side configuration is required beyond ensuring that the VPC subnet route is advertised to the on-premises network via Cloud Router and that firewall rules allow the traffic. Private Google Access is for accessing Google APIs, not VM internal IPs. Cloud NAT is for outbound traffic. A global static external IP exposes the VM externally. Cloud DNS forwarding is for DNS resolution, not IP reachability.

Answer

Configure Cloud NAT for the on-premises network.

Answer

Assign a global static external IP to the VM.

Answer

Configure Cloud DNS forwarding to the on-premises DNS servers.

Question 12

Which THREE components are part of a typical Cloud Hybrid Networking architecture?

Accepted Answer

Cloud Router. Cloud Router is a core component of Cloud Hybrid Networking because it enables dynamic route exchange between a GCP VPC and an on-premises network using BGP. It works with Cloud VPN or Cloud Interconnect to automatically learn and propagate routes, eliminating the need for static route management.

Answer

VPC

Answer

Cloud CDN

Question 13

Match each Google Cloud interconnect or peering type to its description.

Accepted Answer

Dedicated Interconnect: Direct physical connection between your on-premises network and Google's network, providing high bandwidth and a SLA.. Dedicated Interconnect offers a direct physical link with SLA. Partner Interconnect uses a service provider. Direct Peering is a direct BGP session, while Carrier Peering uses a carrier partner. Common confusion occurs between Dedicated and Partner Interconnect.

Answer

Dedicated Interconnect: Connectivity through a service provider with flexible bandwidth and no SLA.

Answer

Partner Interconnect: Direct physical connection between on-premises and Google with high bandwidth and SLA.

Question 14

A company is deploying Cloud DNS to enable on-premises resources to resolve Google Cloud private zone names. Which TWO resources are required for this setup?

Accepted Answer

Inbound DNS policy. To allow on-premises DNS queries to reach Google Cloud private zones, you need an inbound DNS policy that creates a forwarding IP address in a VPC, and you need to configure on-premises DNS servers to forward those queries to that IP. A forwarding zone is used for the opposite direction (GCP to on-premises).

Answer

VPC peering

Answer

Cloud Router

Answer

Outbound DNS forwarding zone

Question 15

A network engineer is configuring HA VPN between GCP and an on-premises network. They need to ensure that the VPN tunnels are established and BGP sessions are up. Which THREE steps are required? (Choose 3.)

Accepted Answer

Create an HA VPN gateway with two interfaces and two external IPs.. To establish HA VPN, you must create the VPN gateway with two interfaces and two external IPs, configure a Cloud Router to handle BGP, and create two VPN tunnels (one for each interface) with IKEv2 configuration. Pre-shared keys or certificates are part of tunnel configuration, but the key step is creating the tunnels.

Answer

Configure firewall rules to allow IKE traffic.

Answer

Set up Cloud NAT for internet access.