PCNE Practice Questions 1 — 50 Questions

Question 1

A company is designing IP address plans for multiple VPCs that will be connected via VPC Network Peering and to an on-premises network via HA VPN with dynamic routing. Which three practices should be followed to avoid IP address conflicts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reserve IP ranges for future VPCs and on-premises expansion. To avoid overlap, use unique private IP ranges per VPC, plan for future growth, and document all ranges. Using RFC 1918 addresses and avoiding overlapping CIDRs ensures successful peering and VPN connectivity.

Answer

Use only public IP addresses for all GCP resources

Answer

Use the same IP range for all VPCs to simplify management

Question 2

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

Accepted Answer

USE_ORIGIN_HEADERS. USE_ORIGIN_HEADERS respects the origin's Cache-Control headers, so only objects with headers indicating public cacheability (e.g., Cache-Control: public) will be cached. This mode ensures that the CDN does not cache content that the origin marks as private or no-store. It is the most conservative caching mode and is suitable when the origin's caching directives are authoritative.

Answer

CACHE_ALL_STATIC

Answer

None of the above

Answer

FORCE_CACHE_ALL

Question 3

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking health check probes from Google Cloud. Hybrid connectivity NEGs rely on health checks from Google Cloud to determine endpoint health. If the on-premises firewall blocks these health check probes (which originate from Google's health check IP ranges), the NEG marks the endpoint as unhealthy, and Traffic Director stops routing traffic, causing connection timeouts. The most likely cause is the firewall blocking these probes.

Answer

The hybrid connectivity NEG is not supported with Traffic Director

Answer

The Cloud VPN tunnel is not established

Answer

Traffic Director requires mTLS for all hybrid endpoints

Question 4

An engineer is configuring a Global HTTPS Load Balancer with a serverless NEG pointing to Cloud Run. The deployment fails with a health check error. What is the most likely cause?

Accepted Answer

The serverless NEG does not support health checks. Serverless NEGs (Network Endpoint Groups) for Cloud Run do not support health checks because Cloud Run services are fully managed and inherently highly available. The load balancer cannot perform health checks on serverless backends; instead, it relies on the serverless platform's own health management. Therefore, attempting to configure a health check for a serverless NEG will cause a deployment failure. The most likely cause is that the serverless NEG does not support health checks.

Answer

The Cloud Run service is not deployed

Answer

The health check interval is too short

Answer

The SSL certificate is misconfigured

Question 5

A company wants to resolve DNS queries from their on-premises DNS servers for a private zone hosted in Cloud DNS. They also need GCP resources to resolve on-premises hostnames. Which combination of Cloud DNS features should they configure?

Accepted Answer

Both inbound and outbound DNS server policies. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS private zones. Outbound DNS server policy allows GCP to forward queries to on-premises DNS servers.

Answer

Outbound DNS server policy only

Answer

DNS peering with the on-premises network

Answer

Inbound DNS server policy only

Question 6

A company uses Shared VPC with a host project and several service projects. They want to allow only a specific team to create subnets in the host project, and another team to use those subnets in their service projects. Which IAM roles should be assigned?

Accepted Answer

Compute Network Admin on host project for subnet creators; Compute Network User on host project for subnet users.. To create subnets, a user needs the Compute Network Admin role on the host project. To use subnets, a user needs the Compute Network User role on the host project or specific subnets.

Answer

Compute Network Admin on host project for both teams.

Answer

Compute Shared VPC Admin on host project for subnet creators; Compute Network User on host project for subnet users.

Answer

Compute Network User on host project for subnet creators; Compute Network Admin on service projects for subnet users.

Question 7

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

Accepted Answer

Use a Cloud Router with BGP and establish multiple BGP sessions over each Interconnect. Cloud Router with BGP enables dynamic routing, allowing multiple BGP sessions over each Cloud Interconnect. When one interconnect fails, BGP withdraws the affected routes, and traffic is automatically redistributed across the remaining BGP sessions without manual intervention. This meets the requirement for automatic failover and load balancing across the five 10 Gbps connections.

Answer

Configure multiple VLAN attachments on a single Cloud Router and rely on link aggregation

Answer

Deploy Cloud VPN tunnels as backup and configure static routes with lower priority

Answer

Configure VPC Network Peering between all data centers and Google Cloud

Question 8

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

Accepted Answer

Reserve a static internal IP address in the same region and subnetwork.. A static internal IP address is reserved within a specific region and subnetwork, ensuring the IP persists even after the VM is stopped or deleted. This meets the requirement for a fixed internal address that remains available for reassignment to the same or a different VM in the same subnet. Ephemeral IPs are released on VM stop/delete, and external IPs are not relevant for internal-only communication.

Answer

Configure an alias IP range on the VM's network interface.

Answer

Assign an ephemeral external IP and configure a firewall rule.

Answer

Use a regional internal IP address with auto-delete set to false.

Question 9

An engineer manages a global application using Global external HTTP(S) Load Balancer with URL map routing to multiple backend services. They want to enable Cloud CDN for the /images/* path. What is the correct way to enable CDN for that specific path?

Accepted Answer

Enable CDN on the backend service that serves /images/*. Cloud CDN is enabled at the backend service level, not at the load balancer or URL map level. Because the URL map routes /images/* to a specific backend service, enabling CDN on that backend service scopes caching precisely to that path. This is the supported and documented configuration model.

Answer

Use the gcloud compute url-maps add-path-matcher command with --cache-mode

Answer

Set a cache key header for /images/* in the URL map

Answer

Enable Cloud CDN at the load balancer level

Question 10

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

Accepted Answer

No additional configuration is needed.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs. Once enabled on the subnet, Google automatically adds a private route for the Google API IP ranges, so no further configuration is required. Therefore, option C is correct. Option A is incorrect because a default route to the internet would send traffic to the internet, not to Google APIs via private access. Option B is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.

Answer

A default route to the internet must be created.

Answer

A Cloud NAT must be configured.

Answer

The instances must have external IPs.

Question 11

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

Accepted Answer

Inbound DNS policy. Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Answer

DNS peering

Answer

Outbound DNS forwarding zone

Answer

Private zone with DNS forwarding

Question 12

An organization wants to reduce egress costs for data sent from Compute Engine instances to users worldwide. Which TWO approaches should they consider? (Choose TWO.)

Accepted Answer

Deploy instances in multiple regions closer to users.. Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network routes traffic over Google's network, which may not reduce egress cost but improves performance; however, Standard Tier egress is cheaper than Premium Tier for internet egress. For reducing costs, Cloud CDN and using Standard Tier (if acceptable) can help. But among the options, Cloud CDN and placing instances in multiple regions (to serve users locally) reduce egress.

Answer

Enable Private Google Access to avoid internet egress for Google APIs.

Answer

Use global load balancers instead of regional load balancers.

Answer

Use Premium Tier networking to route traffic over Google's network.

Question 13

A security team needs to capture all traffic to and from a specific Compute Engine instance for forensic analysis. They want to send the mirrored traffic to a third-party IDS appliance running on a separate VM in the same VPC. Which GCP feature should they use, and what is a key consideration?

Accepted Answer

Packet Mirroring, and the collector must be in the same VPC network as the mirrored instance. Packet Mirroring in GCP captures traffic to and from a specific Compute Engine instance and forwards it to a collector instance for analysis. A key requirement is that the collector must be in the same VPC network as the mirrored instance, ensuring the mirrored traffic can be delivered without crossing network boundaries. This makes it suitable for sending traffic to a third-party IDS appliance on a separate VM.

Answer

Firewall Rules Logging, which logs allow/deny events

Answer

VPC Flow Logs, since logs are stored in Stackdriver and can be exported

Answer

Cloud NAT logging, which logs all outbound connections

Question 14

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify the BGP session status on the Cloud Router.. BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Answer

Check the MTU configuration on the on-premises router.

Answer

Verify the physical interconnect location and cable connections.

Answer

Review the Cloud NAT configuration for the VPC network.

Question 15

A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?

Accepted Answer

Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.. Firewall rules are evaluated in order of priority (lower number = higher priority). The deny rule at priority 1000 will deny all IPs. To allow the VPN IP, a higher priority (lower number) allow rule must be created for that specific IP, before the deny rule is evaluated. The correct approach is to create an allow rule with priority 100 (or any lower number) for source IP 203.0.0.0/8 (or the specific IP) targeting web-server.

Answer

Modify the existing deny rule to include an exception for the VPN IP in the source IP field.

Answer

Delete the deny rule and create a single rule that denies all IPs except the VPN IP using the 'except' option.

Answer

Change the priority of the existing deny rule to 1 and create an allow rule with priority 2 for the VPN IP.

Question 16

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Accepted Answer

Use a global external HTTP(S) load balancer with an anycast IP and enable Cloud CDN.. A global external HTTP(S) load balancer uses a single anycast IP address, which directs each user to the closest healthy backend based on the user's geographic location and backend health. Enabling Cloud CDN further reduces latency by caching content at Google's global edge locations, ensuring that static and dynamic content is served from the nearest point of presence.

Answer

Deploy a regional external HTTP(S) load balancer in each region and use Cloud CDN to cache content.

Answer

Configure an internal TCP/UDP load balancer in each region with DNS-based geolocation routing.

Answer

Set up a global external TCP proxy load balancer with SSL termination at each backend.

Question 17

A company wants to apply consistent firewall rules across all projects in an organization. They need to block all traffic to ports 22 and 3389 from the internet to any VMs in any project. Which approach is most scalable and maintainable?

Accepted Answer

Use a hierarchical firewall policy at the organization level with deny rules for ports 22 and 3389 from 0.0.0.0/0.. Hierarchical firewall policies in Google Cloud are applied at the organization or folder level and are inherited by all projects and VPCs beneath them, so a single policy with deny rules for tcp:22 and tcp:3389 from 0.0.0.0/0 enforces the requirement everywhere without per-project configuration. This is the most scalable and maintainable approach because new projects automatically inherit the rules.

Answer

Configure OS-level firewall on each VM using startup scripts.

Answer

Use Cloud Armor security policies attached to load balancers.

Answer

Create a VPC firewall rule in each project's VPC.

Question 18

Drag and drop the steps to set up a Private Service Connect for accessing Google APIs privately into the correct order.

Accepted Answer

Reserve a static internal IP address, then create a Private Service Connect endpoint using that IP, then configure DNS to point to the endpoint IP, then test connectivity.. Private Service Connect involves creating an endpoint, assigning IP, setting DNS, and testing.

Answer

Create a Private Service Connect endpoint, then reserve a static internal IP address, then configure DNS, then test.

Answer

Reserve a static internal IP address, then configure DNS, then create a Private Service Connect endpoint, then test.

Answer

Create a Private Service Connect endpoint, then configure DNS, then reserve a static internal IP address, then test.

Question 19

A company is planning to migrate to Google Cloud and needs to design a VPC network for a multi-tier application (web, app, database). Which THREE best practices should they follow? (Choose THREE.)

Accepted Answer

Create separate subnets for each tier and use firewall rules to control traffic between them.. Option C is correct because segmenting the web, app, and database tiers into separate subnets lets you apply VPC firewall rules scoped by subnet/tag/service account, enforcing least-privilege east-west traffic control between tiers. Option D is correct because Cloud Armor attaches to an external HTTP(S) load balancer in front of the web tier, providing WAF rules and DDoS/edge protection for internet-facing traffic. Option E is correct because Private Google Access lets instances with only internal IPs reach Google APIs and services (e.g., via private.googleapis.com) without external IPs or NAT. Option A is wrong because a single flat subnet for all tiers removes network segmentation and weakens least-privilege firewall enforcement. Option B is wrong because Google Cloud firewall rules are VPC-level constructs applied to instances by tags or service accounts; there is no separate 'instance-level firewall' model replacing VPC firewall rules.

Answer

Use one subnet for all tiers to simplify routing.

Answer

Use instance-level firewalls instead of VPC firewall rules.

Question 20

A network engineer is troubleshooting a Cloud VPN tunnel that is not passing traffic. The tunnel status shows as established, and BGP sessions are up. However, traffic from an on-premises subnet (10.0.1.0/24) to a GCP subnet (192.168.1.0/24) is not working. What should the engineer check first?

Accepted Answer

Verify that the on-premises router is advertising the 10.0.1.0/24 prefix via BGP. Even though the VPN tunnel and BGP session are established, traffic may still fail if the on-premises router is not advertising the on-premises subnet (10.0.1.0/24) to GCP via BGP. Without this advertisement, GCP's Cloud Router has no route to reach that subnet, so return traffic from GCP to on-premises is dropped. The first step in troubleshooting is to verify that the on-premises BGP speaker is sending the correct prefix in its UPDATE messages.

Answer

Ensure that the Cloud Router is configured with the correct BGP ASN

Answer

Check that GCP has a static route for 10.0.1.0/24 pointing to the VPN tunnel

Answer

Check GCP firewall rules to allow ingress from 10.0.1.0/24