PCNE Practice Exam 52 — 20 Questions

Question 1

An organization wants to distribute incoming HTTPS traffic across a set of Compute Engine instances in multiple regions, with SSL termination at the Google Cloud edge. They also need to protect against DDoS attacks at the edge. Which load balancing solution should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Global External HTTP(S) Load Balancer. Global HTTPS Load Balancer is an external, global, proxy-based load balancer that terminates SSL at the edge and integrates with Cloud Armor for DDoS protection. It distributes traffic across regions.

Answer

SSL Proxy Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 2

Which TWO of the following are valid use cases for Cloud IDS? (Choose TWO)

Accepted Answer

Inspecting traffic between an on-premises network and Google Cloud via Cloud VPN.. Cloud IDS (Intrusion Detection System) inspects traffic for threats like malware and policy violations. Option B is correct because Cloud IDS can inspect traffic traversing Cloud VPN, enabling east-west and hybrid traffic inspection between on-premises and Google Cloud networks, which is a key use case for detecting threats in encrypted VPN tunnels.

Answer

Blocking malicious traffic at the network perimeter.

Answer

Replacing VPC firewall rules for access control.

Answer

Only inspecting traffic that is destined for the internet.

Question 3

Which TWO are valid methods to allow on-premises traffic to reach Google Cloud resources that only have internal (private) IP addresses? (Choose two.)

Accepted Answer

Set up Cloud VPN or Interconnect and configure proper routing and firewall rules.. Cloud VPN or Interconnect creates a secure, private connection between on-premises and Google Cloud VPCs. By configuring proper routing (e.g., custom static routes or BGP) and firewall rules, on-premises traffic can reach internal-only IP addresses without needing public IPs, as the traffic traverses the private network path.

Answer

Assign public IP addresses to the resources and use firewall rules to allow on-premises traffic.

Answer

Use Cloud NAT to allow inbound connections from on-premises.

Answer

Use the default internet gateway route for the VPC.

Question 4

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Accepted Answer

Create a new VPC in Google Cloud, then establish a VPN connection between on-premises and the new VPC, then configure BGP for dynamic routing, then set up VPC peering (if needed), and finally migrate workloads to the new VPC.. In a typical migration using VPN and VPC peering, you first create a VPC in Google Cloud as the target environment. Then, you set up a VPN connection between the on-premises network and this new VPC. After establishing VPN connectivity, configure BGP for dynamic routing to exchange routes. If needed, set up VPC peering to connect the new VPC to other VPCs in Google Cloud. Finally, migrate workloads from on-premises to the new VPC. The given common mistake sequence (VPN, BGP, new VPC) is incorrect because a VPC must exist before VPN can be created.

Answer

Establish a VPN connection first, then configure BGP, then create a new VPC, then set up VPC peering, then migrate workloads.

Answer

Configure BGP first, then create a new VPC, then establish VPN, then set up VPC peering, then migrate workloads.

Answer

Create a new VPC, then set up VPC peering, then establish VPN, then configure BGP, then migrate workloads.

Question 5

A company wants to establish a VPC peering connection between two VPCs in different projects. Which two steps are mandatory to create the peering connection?

Accepted Answer

Ensure the VPCs have non-overlapping subnet IP address ranges.. VPC peering relies on private IP routing between the two VPCs. If the IP address ranges overlap, the VPC route tables cannot distinguish which VPC a packet belongs to, causing routing conflicts and preventing the peering connection from being established. Google Cloud requires that the VPCs have non-overlapping subnet CIDR blocks for successful peering.

Answer

Assign a public IP to the VMs in both VPCs.

Answer

Create a firewall rule allowing all traffic between the VPCs.

Answer

Configure a Cloud Router with BGP sessions.

Question 6

An organization uses Partner Interconnect to connect their on-premises network to Google Cloud. They are experiencing intermittent connectivity issues and suspect the partner service provider is causing the problem. Which Google Cloud tool or feature can help verify the connection status and performance from the Google Cloud side?

Accepted Answer

Cloud Interconnect monitoring. Cloud Interconnect monitoring provides detailed metrics and status information for Partner Interconnect connections, including VLAN attachment health, throughput, and packet loss. This tool allows you to verify connectivity and performance from the Google Cloud side, helping isolate issues that may originate from the partner service provider.

Answer

Cloud Router logs

Answer

Network Service Tiers

Answer

VPC flow logs

Question 7

Refer to the exhibit. What is the purpose of the IP address 169.254.0.1 assigned to the Cloud Router interface?

Accepted Answer

It is a link-local IP address used for BGP sessions between the Cloud Router and the VPN gateway.. The IP address 169.254.0.1 falls within the 169.254.0.0/16 range, which is reserved for link-local addressing (RFC 3927). In Google Cloud, Cloud Routers use link-local addresses for BGP sessions with VPN gateways (both HA VPN and Classic VPN). This address is not routable and is used exclusively for BGP peering between the Cloud Router and the VPN gateway, ensuring that the BGP session operates over the VPN tunnel without conflicting with other IP assignments.

Answer

It is the public IP address of the VPN gateway.

Answer

It is a private IP address for BGP peering with the on-premises router.

Answer

It is the management IP address of the Cloud Router.

Question 8

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The metric 'interconnect/link/operational_status' provides the operational status of each interconnect link (e.g., operational, degraded).

Answer

interconnect/vlan_attachment/outbound_bytes

Answer

interconnect/network/packet_drop_count

Answer

interconnect/network/received_bytes_count

Question 9

A network engineer is designing a VPC with custom subnet mode. They need to allocate IP addresses for three tiers: web (100 instances), app (200 instances), and db (50 instances). The VPC will be in the us-central1 region. Which subnet plan is most cost-effective and scalable?

Accepted Answer

Create three subnets: 10.0.1.0/24 (web), 10.0.2.0/23 (app), 10.0.4.0/26 (db). It allocates IP addresses efficiently for each tier: a /24 (256 IPs) for web (100 instances), a /23 (512 IPs) for app (200 instances), and a /26 (64 IPs) for db (50 instances). This minimizes wasted IP space while providing room for growth, and using separate subnets per tier allows granular firewall rules and routing. In a custom VPC, this design is both cost-effective (no over-provisioning) and scalable (each tier can expand within its subnet).

Answer

Use one subnet per zone: us-central1-a: 10.0.0.0/22, us-central1-b: 10.0.4.0/22, us-central1-c: 10.0.8.0/22

Answer

Create two subnets: 10.0.1.0/24 (web+app) and 10.0.3.0/24 (db)

Answer

Create one subnet 10.0.0.0/20 and use network tags to isolate tiers via firewall rules

Question 10

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

Accepted Answer

Use a Cloud Router with BGP and establish multiple BGP sessions over each Interconnect. Cloud Router with BGP enables dynamic routing, allowing multiple BGP sessions over each Cloud Interconnect. When one interconnect fails, BGP withdraws the affected routes, and traffic is automatically redistributed across the remaining BGP sessions without manual intervention. This meets the requirement for automatic failover and load balancing across the five 10 Gbps connections.

Answer

Configure multiple VLAN attachments on a single Cloud Router and rely on link aggregation

Answer

Deploy Cloud VPN tunnels as backup and configure static routes with lower priority

Answer

Configure VPC Network Peering between all data centers and Google Cloud

Question 11

Which TWO of the following are valid methods to restrict access to a Compute Engine VM that has no external IP?

Accepted Answer

A Cloud VPN tunnel from an on-premises network.. A Cloud VPN tunnel creates an encrypted, RFC-compliant IPsec tunnel between an on-premises network and a VPC, allowing on-premises hosts to reach the VM over its internal IP without requiring an external IP on the VM. Option E is correct because Identity-Aware Proxy (IAP) TCP forwarding uses the IAP service as a proxy to establish an SSH or RDP connection to a VM that has no external IP, by tunneling traffic through the IAP service using the `gcloud compute start-iap-tunnel` command.

Answer

Using a NAT gateway to allow SSH from the internet.

Answer

Configuring a SOCKS proxy on a bastion host.

Answer

Assigning an external IP and using firewall rules.

Question 12

Which TWO network services are required to enable private Google access for on-premises hosts using a Dedicated Interconnect connection? (Choose two.)

Accepted Answer

Cloud Router with BGP. Cloud Router with BGP is required because Dedicated Interconnect uses BGP sessions between the on-premises router and Google's edge router to exchange routes. Without BGP, the on-premises network cannot advertise or receive the routes necessary for private Google access, such as the 199.36.153.4/30 or 199.36.153.8/30 ranges used for Private Google Access for on-premises.

Answer

Cloud NAT

Answer

VPC Flow Logs

Answer

Cloud VPN

Question 13

An organization runs a stateful TCP application on a group of Compute Engine instances in us-central1. Clients must connect to the service using a single anycast IP address, and the load balancer must preserve the client source IP address. Which load balancing option meets these requirements?

Accepted Answer

Global external TCP Proxy Load Balancer. The Global external TCP Proxy Load Balancer provides a single anycast IP address that clients can connect to from anywhere. While it terminates the TCP connection, it can be configured to forward the client's IP address to the backend using Proxy Protocol (e.g., HAProxy protocol). This allows the backend to see the original client source IP, meeting the requirement for a stateful TCP application. The other options either do not provide anycast IP or cannot preserve the source IP.

Answer

External TCP/UDP Network Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

Global external HTTP(S) Load Balancer

Question 14

A company has set up a Cloud VPN with dynamic routing (BGP) between their on-premises network (AS 65001) and Google Cloud (AS 64514). They are using Cloud Router with a regional dynamic routing mode. The on-premises router is advertising a subnet 10.1.0.0/16. The Google Cloud VPC has subnet 10.2.0.0/16 in the same region as the Cloud Router. Both subnets are unique. The connection has been working for months. However, after a recent maintenance window, the on-premises router started experiencing BGP flapping with the Cloud Router. The Cloud Router logs show 'BGP notification sent: Hold timer expired'. The on-premises router logs show similar errors. The network team has verified that the VPN tunnel is established and stable. What is the most likely cause of the BGP flapping?

Accepted Answer

The on-premises router's BGP hold timer is set to 30 seconds, but the Cloud Router's hold timer is set to 180 seconds.. The BGP hold timer defines the maximum time a router waits to receive a keepalive or update message from a peer before declaring the session dead. When the on-premises router uses a hold timer of 30 seconds and the Cloud Router uses 180 seconds, the on-premises router expects keepalives every 10 seconds (one-third of hold time). If the Cloud Router sends keepalives at its own negotiated interval (e.g., 60 seconds based on its hold timer), the on-premises router will not receive them within its 30-second window, causing it to send a 'Hold timer expired' notification and flap the BGP session. The VPN tunnel remains stable because the issue is at the BGP session layer, not the underlying tunnel.

Answer

The VPN tunnel's MTU is set to 1500 bytes, but BGP packets are larger and are being fragmented.

Answer

The Cloud Router's BGP keepalive interval is set to 30 seconds, while the on-premises router is using 10 seconds.

Answer

The on-premises router is advertising too many routes, causing the Cloud Router to run out of memory.

Question 15

An engineer needs to set up a VPN between an on-premises network and GCP. The on-premises VPN device does not support BGP and can only support static routing. Which VPN solution should the engineer choose?

Accepted Answer

Classic VPN. Classic VPN supports static routing (policy-based or route-based). HA VPN requires dynamic routing (BGP), and Partner Interconnect is a dedicated connection not a VPN.

Answer

Partner Interconnect

Answer

HA VPN

Answer

Dedicated Interconnect

Question 16

A request comes from IP 192.0.2.5, with origin region code 'US', and path '/admin/dashboard'. What will be the final action?

Accepted Answer

Deny by rule priority 2000.. The request matches a rule with priority 2000 that denies traffic from IP 192.0.2.5 to path '/admin/dashboard' with origin region 'US'. Since Cloud Armor security policies evaluate rules in ascending priority order, rule 2000 is evaluated before rule 3000 and after rule 1000. Rule 1000 does not match (likely a different condition), so rule 2000 applies and denies the request.

Answer

Deny by rule priority 1000.

Answer

Deny by rule priority 3000.

Answer

Allow (default rule).

Question 17

Refer to the exhibit. A VM in the my-vpc network is unable to reach an external HTTPS server. What is the most likely cause?

Accepted Answer

The deny-all-egress firewall rule blocks all outbound traffic.. The default VPC configuration includes a deny-all-egress firewall rule with the lowest priority (65535) that blocks all outbound traffic not explicitly allowed. Since no higher-priority rule permits outbound traffic to the external HTTPS server (port 443), the VM's HTTPS requests are dropped by this implicit deny rule, preventing connectivity.

Answer

The allow-custom-internal rule only allows inbound traffic.

Answer

No rule allows outbound traffic to port 443.

Answer

The default-allow-ssh rule has a low priority.

Question 18

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

Accepted Answer

Enable IP forwarding on the VPN appliance VM instance.. A third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.

Answer

Create a custom route in the VPC pointing to the VPN appliance's internal IP.

Answer

Enable Private Google Access on the subnet hosting the VPN appliance.

Answer

Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.

Question 19

Refer to the exhibit. The Cloud Router is configured with custom BGP advertisements. The on-premises router receives only the two advertised ranges (10.1.0.0/24 and 10.2.0.0/24) but not the VPC subnets (e.g., 10.3.0.0/24). What is the most likely reason?

Accepted Answer

The on-premises router is filtering routes based on the BGP community or AS path.. Cloud Router custom advertisements can include BGP communities or AS-path attributes that the on-premises router may be filtering. If the on-premises router is configured to reject routes based on these attributes (e.g., only accepting routes with a specific community or AS-path length), it would drop the VPC subnet routes even if they are advertised. The scenario states that only the two explicitly advertised ranges are received, indicating a filtering mechanism on the on-premises side rather than a Cloud Router misconfiguration.

Answer

The on-premises router is configured to accept only prefixes longer than /24.

Answer

The advertised route priority of 100 is too high, causing the routes to be ignored.

Answer

The Cloud Router's custom advertisement includes both the ALL_SUBNETS group and the explicit ranges, so all subnets should be advertised.

Question 20

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the return route via BGP, causing asymmetric routing.. For asymmetric routing, GCP may drop return traffic if it does not match the forwarding route. Cloud VPN supports dynamic routing (BGP) which advertises the on-premises prefix. However, if the on-premises router forwards return traffic through a different path (e.g., internet), GCP's firewall drops it because the return packet does not come via the VPN tunnel (asymmetric).

Answer

The Cloud VPN tunnel is down.

Answer

The MTU is set to 1500 on the VPN tunnel.

Answer

The instance's firewall is blocking ICMP.