PCNE Practice Exam 51 — 20 Questions

Question 1

A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable MACsec on the Dedicated Interconnect. MACsec (IEEE 802.1AE) provides Layer 2 encryption on the Dedicated Interconnect link itself, encrypting all traffic between the on-premises router and the Google Cloud edge router without requiring any changes to applications or additional VPN gateways. This meets the encryption requirement with minimal overhead and complexity because MACsec operates transparently at the data link layer, adding negligible latency and no per-packet processing overhead compared to IPsec or TLS.

Answer

Enable TLS encryption on all applications

Answer

Use Cloud VPN over the internet instead of Dedicated Interconnect

Answer

Establish an IPsec VPN tunnel over the Dedicated Interconnect

Question 2

A network engineer is troubleshooting a Cloud VPN gateway that is not establishing a VPN tunnel with an on-premises device. The engineer checks the Cloud VPN gateway logs and sees the error 'IKE SA negotiation failed due to mismatched authentication method'. What is the most likely cause?

Accepted Answer

The authentication method is set to 'pre-shared key' on one side and 'certificate' on the other.. The error indicates a mismatch between the authentication methods configured on both ends, such as pre-shared key vs certificate, or different authentication types.

Answer

The pre-shared keys on both ends do not match.

Answer

The VPN gateway is using the wrong external IP address.

Answer

The IKE version configured on the on-premises device is IKEv1 while Cloud VPN only supports IKEv2.

Question 3

A company needs to resolve DNS queries from their Google Cloud VPC for on-premises hostnames (e.g., internal.mycompany.com). They have a Cloud VPN tunnel between GCP and on-premises. Which approach should they use?

Accepted Answer

Create a DNS forwarding zone in Cloud DNS that points to the on-premises DNS server IPs via the Cloud Router.. Cloud DNS forwarding zones allow you to forward queries for a specific domain (e.g., internal.mycompany.com) to on-premises DNS servers via the VPN tunnel.

Answer

Configure an outbound DNS forwarding policy with Cloud Router to forward queries to on-premises DNS servers.

Answer

Create a Cloud DNS private zone and add A records for each on-premises host.

Answer

Set up a BIND server on a Compute Engine instance and configure it as a forwarder.

Question 4

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

Accepted Answer

The passive VLAN attachment does not have BGP session configured with Cloud Router.. For failover to work with active-passive, the passive connection must have its own VLAN attachment and Cloud Router BGP session with the same routes, but with a higher MED value to be less preferred. If the VLAN attachment is not created, there is no path.

Answer

The SLA requires two circuits in different metro areas for failover.

Answer

The on-premises router is not configured to use the passive connection.

Answer

The passive connection is in a different metro area, causing higher latency.

Question 5

A network engineer is troubleshooting a VPN tunnel that is up but not passing traffic. The Cloud Router shows that BGP sessions are established, but routes are not being exchanged. Which two should the engineer check? (Choose two.)

Accepted Answer

Ensure that the firewall rules in the VPC allow traffic from the on-premises IP ranges.. Common issues: incorrect firewall rules blocking the traffic, or the route advertisements are not configured correctly (e.g., not advertising the correct prefixes).

Answer

Verify that the Cloud Router is using the correct ASN.

Answer

Check that the Cloud VPN gateway has the correct pre-shared key configured.

Answer

Confirm that the VLAN attachment is of type PARTNER_PROVIDER.

Question 6

A company wants to reduce egress costs for traffic going to Google APIs (e.g., Cloud Storage, BigQuery) from Compute Engine instances. Which configuration should they use?

Accepted Answer

Enable Private Google Access on the subnet. Private Google Access allows instances without external IPs to reach Google APIs over the internal network, avoiding internet egress charges.

Answer

Use VPC Flow Logs to monitor traffic

Answer

Assign external IPs to the instances

Answer

Set up Cloud NAT for the instances

Question 7

A company has two VPCs connected via VPC Network Peering. Traffic from an instance in VPC A to an instance in VPC B is failing. Connectivity Tests show that the expected route exists and firewall rules allow the traffic. What is a possible cause?

Accepted Answer

Asymmetric routing due to conflicting routes. Asymmetric routing can occur when a packet goes from A to B via peering, but the return packet takes a different path (e.g., through a VPN) due to route priorities. This can result in dropped packets.

Answer

VPC Flow Logs are disabled

Answer

The MTU of the instances is set to 1500

Answer

The VPC peering is not in active state

Question 8

A company is experiencing packet loss between two Compute Engine instances in different zones within the same region. They suspect MTU issues. Which three actions should they take to diagnose and resolve? (Choose three.)

Accepted Answer

Verify that the network path between instances does not have a smaller MTU (e.g., VPN or load balancer). Check the MTU settings on the instances (default 1460 for GCP). Use packet capture to see if fragmentation is occurring. Ensure that the path MTU is consistent (e.g., between VMs and any load balancers). VPC Flow Logs do not show MTU. Cloud NAT is not relevant. Connectivity Tests do not test MTU.

Answer

Enable Cloud NAT to reduce packet size

Answer

Use VPC Flow Logs to check for packet drops

Question 9

A security engineer wants to monitor and analyze traffic to a load-balanced web application. Which TWO services can provide detailed logs of HTTP requests and responses?

Accepted Answer

HTTP Load Balancer access logs. HTTP Load Balancer access logs capture request details. Cloud Armor request logs provide additional security insights. VPC Flow Logs and Firewall logs do not provide HTTP-level details.

Answer

Cloud NAT logging

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Question 10

Which Network Intelligence Center tool provides a visual representation of your VPC network, including instances, subnets, firewall rules, and routes?

Accepted Answer

Network Topology

Answer

Connectivity Tests

Answer

Firewall Insights

Answer

Performance Dashboard

Question 11

A network engineer has set up a Cloud Router with BGP for an HA VPN. The BGP session is flapping. Which log should be examined to diagnose the issue?

Accepted Answer

Cloud Router logs

Answer

Firewall Rules logs

Answer

VPN tunnel logs

Answer

VPC Flow Logs

Question 12

A company is using Cloud NAT to allow private VMs to access the internet. They want to troubleshoot connectivity failures and analyze connection attempts that were dropped due to NAT resource exhaustion. What should they enable?

Accepted Answer

Cloud NAT logging. Cloud NAT logging captures connection and allocation failures, which helps troubleshoot NAT resource exhaustion and other issues.

Answer

VPC Flow Logs on the subnet

Answer

Firewall rule logging

Answer

Packet Mirroring

Question 13

A company wants to connect two VPCs in the same project using VPC Network Peering. Each VPC has non-overlapping subnets. What is the minimum number of peering connections required to enable full bidirectional communication?

Accepted Answer

Two peering connections: one from VPC1 to VPC2, and one from VPC2 to VPC1.. VPC Network Peering requires a peering connection to be established in each direction to enable full bidirectional communication. A single peering connection from VPC1 to VPC2 only allows VPC1 to initiate traffic to VPC2; for VPC2 to initiate traffic back to VPC1, a separate peering connection from VPC2 to VPC1 is needed. Therefore, two peering connections (one from each VPC to the other) are the minimum required.

Answer

One peering connection from VPC1 to VPC2.

Answer

Two peering connections from each VPC to the other (total four).

Answer

A Shared VPC with subnetworks from both VPCs.

Question 14

A company has deployed Dedicated Interconnect with a 10 Gbps connection. They are experiencing packet loss when transferring large files. The on-premises MTU is set to 1500. What is the maximum MTU that can be set on the Cloud Router interface to avoid fragmentation?

Accepted Answer

1500 bytes. Dedicated Interconnect uses VLAN attachments that encapsulate packets with an additional 4-byte 802.1Q VLAN tag and a 4-byte outer Ethernet header. With an on-premises MTU of 1500 bytes, the maximum payload that can traverse the interconnect without fragmentation is 1500 bytes, because the interconnect path supports jumbo frames up to 1440 bytes for the payload after overhead, but the Cloud Router interface MTU must match the on-premises MTU to avoid fragmentation. Setting the Cloud Router MTU to 1500 bytes ensures that packets are not fragmented at the router, as the interconnect handles the encapsulation overhead transparently.

Answer

1460 bytes

Answer

1400 bytes

Answer

8896 bytes

Question 15

Refer to the exhibit. A network engineer is unable to SSH to instance-1 using IAP TCP forwarding. What is the most likely reason?

Accepted Answer

The instance does not have the 'ssh-iap' tag that the firewall rule applies to.. The exhibit shows a firewall rule that allows IAP TCP forwarding traffic from the IAP source range (35.235.240.0/20) to instances with the network tag 'ssh-iap'. Since instance-1 lacks this tag, the firewall rule does not apply, and SSH traffic from IAP is blocked. Without the tag, the instance's firewall policy drops the forwarded TCP connections, preventing SSH access.

Answer

IAP TCP forwarding is not enabled for the project.

Answer

The instance's service account does not have the necessary IAP permissions.

Answer

SSH keys are not configured on the instance.

Question 16

A developer wants to SSH into a Compute Engine instance that has no public IP. Which service should they use?

Accepted Answer

Identity-Aware Proxy (IAP) TCP forwarding.. Identity-Aware Proxy (IAP) TCP forwarding allows secure, authenticated, and authorized SSH access to Compute Engine instances that have no public IP addresses. It works by establishing a tunnel through the IAP service, which proxies the SSH connection over HTTPS (port 443) to the instance's internal IP, eliminating the need for a public IP or bastion host.

Answer

Direct Peering.

Answer

Cloud NAT.

Answer

Cloud VPN.

Question 17

Refer to the exhibit. Users report that HTTP (port 80) traffic is still reaching instances in my-vpc despite the deny-all rule. What is the most likely reason?

Accepted Answer

A default firewall rule allowing HTTP exists with a higher priority.. In Google Cloud Platform (GCP), firewall rules are evaluated in order of priority, with lower numbers having higher priority. The default-allow-http rule has a priority of 1000, which is higher (lower number) than the deny-all rule's priority of 2000. Therefore, HTTP traffic is allowed by the default rule before the deny rule is evaluated, causing HTTP traffic to still reach instances.

Answer

The allow-ssh rule has priority 1000 and is evaluated before the deny rule.

Answer

The deny-all rule does not specify target tags.

Answer

The deny-all rule has priority 2000, which is higher than the allow rule.

Question 18

Refer to the exhibit. The Cloud Router shows one BGP peer as ESTABLISHED and one as IDLE. The best routes show two routes to the same destination with different priorities. What is the most likely reason the IDLE peer is not establishing?

Accepted Answer

BGP configuration mismatch between Cloud Router and on-premises router for the IDLE peer. The IDLE state in BGP indicates that the session has not been established, typically due to a configuration mismatch. Since the Cloud Router shows one peer as ESTABLISHED and another as IDLE, the most likely cause is a mismatch in BGP parameters (such as AS number, peer IP, or authentication) between the Cloud Router and the on-premises router for the IDLE peer. This prevents the BGP session from transitioning out of the IDLE state.

Answer

The on-premises router is not sending routes for the IDLE peer

Answer

The IDLE peer has a higher priority route, so it is not needed

Answer

The IDLE peer is not configured on the Cloud Router

Question 19

A company wants to serve global static content from a Cloud Storage bucket. They need low latency worldwide and SSL termination at the edge. Which solution should they choose?

Accepted Answer

Configure a global external HTTP(S) load balancer with a backend bucket.. A global external HTTP(S) load balancer with a backend bucket is the correct choice because it provides SSL termination at the edge (using Google Front Ends) and routes traffic over Google's global network to the nearest Cloud Storage bucket, ensuring low latency worldwide. The HTTP(S) load balancer supports global anycast IP addresses and integrates natively with Cloud Storage backends, making it ideal for serving static content globally.

Answer

Use a TCP/UDP network load balancer with the bucket as backend.

Answer

Deploy an internal TCP/UDP load balancer with the bucket as backend.

Answer

Set up Cloud CDN directly on the bucket without a load balancer.

Question 20

A company is using Partner Interconnect to connect to Google Cloud. They notice that traffic from on-premises to GCP takes one path, but return traffic takes a different path, causing asymmetric routing. How can they resolve this?

Accepted Answer

Apply BGP MED values to influence path selection.. B is correct because applying BGP MED (Multi-Exit Discriminator) values allows you to influence the path selection for return traffic from Google Cloud to your on-premises network. By setting a lower MED value on one of the Partner Interconnect connections, you can make Google Cloud prefer that path for return traffic, thereby matching the forward path and resolving asymmetric routing. This is a standard BGP technique for controlling inbound traffic to an AS.

Answer

Configure the same BGP ASN on both sides.

Answer

Enable asymmetric routing mode on the Cloud Router.

Answer

Use different link-local addresses for each session.