PCNE Practice Questions 1 — 50 Questions

Question 1

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

Accepted Answer

Cloud Router. Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Answer

Cloud NAT

Answer

VPC peering

Answer

VPC Flow Logs

Question 2

A company is migrating on-premises DNS to Google Cloud. They have a hybrid network using Cloud VPN and want to resolve on-premises hostnames from Compute Engine instances without custom scripts. Which service should they use?

Accepted Answer

Use Cloud DNS inbound server policy to forward queries to on-premises DNS.. Cloud DNS inbound server policy allows on-premises DNS servers to receive DNS queries from Compute Engine instances by creating a VPC-scoped policy that forwards queries to the IP addresses of on-premises DNS resolvers over Cloud VPN. This enables hybrid name resolution without custom scripts, as the policy automatically handles the forwarding of DNS requests from Google Cloud resources to the on-premises DNS infrastructure.

Answer

Create a forwarding zone in Cloud DNS and associate it with the VPC.

Answer

Enable Private Google Access on the VPC subnet.

Answer

Configure Cloud NAT to forward DNS queries to on-premises DNS servers.

Question 3

A network engineer is configuring a Cloud Router for BGP peering with an on-premises router over a VPN tunnel. The on-premises router uses 169.254.x.x link-local addresses. Which BGP peer IP should the engineer use in the Cloud Router configuration?

Accepted Answer

169.254.0.1. The correct BGP peer IP is 169.254.0.1 because Cloud Router uses the first IP in the 169.254.0.0/16 link-local range for BGP peering over a VPN tunnel. This is required by Google Cloud's implementation, where the on-premises router must use a link-local address from the 169.254.0.0/16 range, and Cloud Router automatically assigns 169.254.0.1 as its own BGP peer IP. The on-premises router typically uses 169.254.0.2 as its BGP peer IP, ensuring a point-to-point link-local BGP session.

Answer

10.0.0.1

Answer

The tunnel's external IP address

Answer

The on-premises router's external IP address

Question 4

A company uses Cloud NAT to allow private instances to reach the internet. They notice that egress traffic from Compute Engine VMs is intermittently failing. The VMs are in us-central1-a and use the default VPC network. Cloud NAT is configured with a single NAT IP address. What is the most likely cause?

Accepted Answer

Port exhaustion due to insufficient NAT IP addresses. Cloud NAT uses source network address translation (SNAT) to map private VM IPs to a public NAT IP. With only a single NAT IP address, the available port range (typically 64,512 ephemeral ports per NAT IP per VM) can be exhausted under high egress traffic, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures and the single IP configuration.

Answer

Missing default route to Internet gateway

Answer

Cloud NAT not configured in the correct region

Answer

Firewall rule blocking egress traffic from VM

Question 5

Match each VPC networking concept to its definition.

Question 6

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

Question 7

A company has a VPC with subnets in us-east1 and europe-west1. They have deployed a global external HTTP(S) load balancer with backend services in both regions. Users in Europe report high latency. What is the most likely cause?

Accepted Answer

Session affinity set to CLIENT_IP, causing sticky sessions to a distant backend. Option D is correct because CLIENT_IP session affinity causes the load balancer to hash the client's IP address to a specific backend instance. If a user in Europe is hashed to a backend in us-east1, all their requests will be forwarded to that distant region, resulting in high latency. This occurs even though a healthy backend exists in europe-west1, because the affinity overrides the load balancer's normal least-latency or proximity-based routing.

Answer

Incorrect health check configuration causing backends to be marked unhealthy

Answer

Firewall rules blocking traffic from the load balancer's health check probes

Answer

The load balancer is not enabled for global access

Question 8

A company uses an internal TCP/UDP load balancer to distribute traffic to a backend service. The backend instances are in an unmanaged instance group. Some instances fail health checks and are removed. What happens to existing connections to failed instances?

Accepted Answer

Existing connections are terminated immediately.. When an instance in an unmanaged instance group fails a health check, the internal TCP/UDP load balancer immediately terminates all existing connections to that instance. This is because the load balancer does not support connection draining for unmanaged instance groups; it simply stops forwarding new traffic and drops existing flows to the failed instance. The abrupt termination occurs because the load balancer operates at Layer 4 and has no mechanism to gracefully close TCP connections or wait for application-level cleanup.

Answer

The load balancer drains existing connections before removing the instance.

Answer

Existing connections are seamlessly redirected to healthy instances.

Answer

The load balancer waits for all existing connections to close before removing the instance.

Question 9

An organization has multiple VPCs in Google Cloud that need to communicate with an on-premises network through a single Dedicated Interconnect. All VPCs are in the same project. What is the most efficient way to enable connectivity from all VPCs to on-premises?

Accepted Answer

Create a Cloud Router per VPC, each with its own VLAN attachment on the same Interconnect. Option C is correct because each VPC requires its own Cloud Router and VLAN attachment to establish a dedicated BGP session over the same Dedicated Interconnect. This allows multiple VPCs in the same project to share a single physical interconnect while maintaining separate Layer 3 routing domains. A single VLAN attachment cannot be shared across VPCs, as each attachment is associated with exactly one Cloud Router and one VPC.

Answer

Create a separate Interconnect for each VPC

Answer

Create a single VLAN attachment and use it for all VPCs

Answer

Use VPC Network Peering to connect VPCs and attach one VPC to Interconnect

Question 10

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

Accepted Answer

Auto mode subnet. An auto mode subnet automatically creates subnets in each region and assigns IP address ranges from a predefined pool that can expand as you add more VM instances. This allows the subnet to grow without manual intervention, making it ideal for startups that need dynamic scaling.

Answer

Custom mode subnet

Answer

Dynamic subnet

Answer

Legacy network

Question 11

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

Accepted Answer

Use three separate VPCs for each tier and connect them using VPC peering.. Option B is correct because using three separate VPCs with VPC peering enforces strict network segmentation: the web tier VPC has a public subnet with an internet gateway, the application tier VPC is peered only to the web tier VPC (no internet gateway), and the database tier VPC is peered only to the application tier VPC (no public IPs). This design ensures that the database tier has no public IP addresses and is only reachable through the application tier, meeting all security requirements.

Answer

Use a Shared VPC with separate subnets in different projects for each tier.

Answer

Use a single VPC and connect the database tier via Cloud VPN to on-premises.

Answer

Use a single VPC with separate subnets for each tier and configure firewall rules to restrict traffic.

Question 12

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

Accepted Answer

The firewall rules in the VPC are blocking ingress traffic from the on-premises network.. Option D is correct because, by default, the default VPC includes firewall rules that allow outbound traffic but restrict inbound traffic. Even though the Cloud VPN tunnel is established, the VPC firewall rules block ingress traffic from the on-premises network (e.g., ICMP for ping). To allow communication, a firewall rule must explicitly permit ingress traffic from the on-premises IP range or the remote tunnel IP.

Answer

The subnet IP range overlaps with the on-premises network.

Answer

The instance has IP forwarding disabled.

Answer

The default VPC does not have a default route to the internet.

Question 13

An organization has a VPC with custom mode subnets in us-central1 and europe-west1. They create a VM instance in us-central1 with an internal IP 10.0.1.2 and a VM in europe-west1 with internal IP 10.0.2.2. They want to enable communication between these instances using internal IPs. What must be configured?

Accepted Answer

Ensure the VPC firewall rules allow ingress from the source subnet or instance.. Option A is correct because VPC firewall rules are stateful and must allow ingress traffic from the source subnet (10.0.1.0/24) or the specific source instance (10.0.1.2) to the destination VM in europe-west1. By default, VPCs have an implied deny-all ingress rule, so explicit firewall rules are required to permit traffic between subnets in different regions within the same VPC. The rule should specify the source IP range or tag and the destination protocol/port (e.g., ICMP, TCP/22) to enable communication.

Answer

Set up VPC peering between the two regions.

Answer

No additional configuration is needed because internal IPs are routable within the VPC.

Answer

Enable Cloud NAT for the VPC.

Question 14

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

Accepted Answer

Deploy a global HTTP(S) Load Balancer with backend services in each region.. A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Answer

Use Cloud DNS with geo-routing to direct users to regional load balancers.

Answer

Set up Cloud NAT with multiple static IP addresses for each region.

Answer

Assign a global anycast IP address to all instances and use BGP to advertise it.

Question 15

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Accepted Answer

Service projects. A is correct because service projects in a Shared VPC architecture allow each project to host its own resources (e.g., Compute Engine instances) while maintaining separate firewall rules and security policies. This enables centralized network administration via the host project while giving each project autonomy over its own firewall configurations, meeting the requirement for multiple projects with independent firewall rules.

Answer

Cloud VPN

Answer

VPC peering

Question 16

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Accepted Answer

Place both instances in the same VPC, using internal IP addresses.. Option C is correct because placing both Compute Engine instances in the same VPC and using internal IP addresses ensures traffic stays within Google's private network backbone, bypassing any external gateways or internet hops. This configuration leverages Google's internal routing with sub-millisecond latency between zones in the same region, as traffic is forwarded at the hypervisor level without encapsulation or additional network hops.

Answer

Use VPC Network Peering between two different VPCs.

Answer

Place instances in different VPCs and use a VPN between them.

Answer

Assign external IP addresses to both instances and communicate over the internet.

Question 17

A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which THREE conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?

Accepted Answer

The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.. Option B is correct because VPC firewall rules in Google Cloud are stateful and defined as ingress or egress rules. To block traffic from Subnet-A to Subnet-B, you need an ingress rule on Subnet-B (the destination) with the source set to Subnet-A's IP range and the destination set to Subnet-B's IP range. This ensures the rule applies to incoming traffic from Subnet-A, and the action 'deny' will drop the packets.

Answer

The rule must be applied using network tags on instances in Subnet-A.

Answer

The rule must also allow return traffic from Subnet-B to Subnet-A.

Question 18

Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.. The correct answer is A. Since the VM can ping the on-premises gateway (192.168.1.1) but not the server (192.168.1.100), the VPN tunnel and BGP session are working, and GCP has the correct route. The issue is that the on-premises router is not advertising or does not have a route for the GCP subnet 10.0.1.0/24 pointing back to the VPN tunnel, so return traffic from the server to the VM is dropped. Without this route, the on-premises router cannot forward packets destined for 10.0.1.10 back through the VPN.

Answer

The on-premises server is not configured with a default gateway pointing to the on-premises gateway.

Answer

The Cloud VPN tunnel is not configured with an IKE version supported by the on-premises device.

Answer

A firewall rule on the GCP VPC is blocking ICMP traffic from 192.168.1.100.

Question 19

A company is designing a hybrid network using Dedicated Interconnect. They want to configure BGP for load balancing across multiple VLAN attachments. Which TWO statements are correct?

Accepted Answer

You can configure the Cloud Router to advertise the same IP prefixes over both VLAN attachments.. Option B is correct because a Cloud Router can advertise the same IP prefixes over multiple VLAN attachments to enable load balancing. This allows Google Cloud to use ECMP (Equal-Cost Multi-Path) routing to distribute outbound traffic across the two VLAN attachments, as long as the BGP attributes (e.g., AS path length, MED) are equal.

Answer

You must create a separate Cloud Router for each VLAN attachment.

Answer

You should use BGP MED to load balance outbound traffic from Google Cloud.

Answer

Load balancing across VLAN attachments requires a single BGP session.

Question 20

A network engineer configured a Cloud Router with the BGP configuration shown. The on-premises router (AS 64512) is peering with the Cloud Router (AS 65001) over a Dedicated Interconnect VLAN attachment. The engineer notices that traffic from on-premises to Google Cloud is not being routed via this interconnect as expected. What is the most likely cause?

Accepted Answer

The update-source loopback0 command is invalid for Cloud Router BGP sessions. Option C is correct because Cloud Router does not support the `update-source loopback0` command. BGP sessions on Cloud Router must use the primary IP address of the interface that is directly connected to the VLAN attachment; loopback interfaces are not supported for BGP peering. This command would cause the Cloud Router to attempt to source BGP packets from a loopback address that is not reachable by the on-premises router, breaking the BGP session.

Answer

The route-map SET-MED sets the MED attribute incorrectly

Answer

The ebgp-multihop 2 command is not supported on Cloud Router

Answer

The local-preference is set in the outbound direction, which is not allowed