PCNE Practice Exam 53 — 20 Questions

Question 1

A company runs a private GKE cluster in us-central1. Pods need to access the internet for updates. Which configuration is required?

Accepted Answer

Enable Cloud NAT on the cluster's subnet.. In a private GKE cluster, nodes do not have external IPs, so pods cannot reach the internet directly. Cloud NAT provides outbound connectivity by translating private IPs to a public IP, allowing pods to fetch updates while keeping the cluster private. This is the standard solution for outbound-only internet access from private GKE clusters.

Answer

Add network tags to allow egress traffic.

Answer

Create a Cloud Router with BGP peering.

Answer

Assign external IPs to the nodes.

Question 2

A company wants to expose an internal HTTP service running on Compute Engine instances to other VPCs in the same project using a load balancer. The load balancer must support HTTP path-based routing and preserve the client source IP. Which load balancer types meet these requirements? (Choose two.)

Accepted Answer

External HTTP(S) Load Balancer (regional) [CORRECT]. Both the External HTTP(S) Load Balancer (regional) and the Internal HTTP(S) Load Balancer support HTTP path-based routing and preserve the client source IP via the X-Forwarded-For header. The External regional LB can be configured with a public IP, while the Internal LB uses a private IP within the VPC. Both are suitable for exposing an internal HTTP service to other VPCs in the same project, depending on whether internet access is needed.

Answer

Internal TCP/UDP Load Balancer [wrong]

Answer

Global external HTTP(S) Load Balancer [wrong]

Answer

External TCP/UDP Network Load Balancer [wrong]

Question 3

A company needs to resolve DNS queries for a private zone (e.g., corp.example.com) from multiple GCP projects that are not in the same organization. Which Cloud DNS feature should they use?

Accepted Answer

DNS peering. DNS peering allows you to resolve DNS queries across different GCP projects, even if they are not in the same organization, by establishing a peering relationship between two VPC networks. This enables the private zone (corp.example.com) in one project to be queried from instances in another project without exposing the zone to the internet or requiring shared VPC.

Answer

Private DNS zones

Answer

DNS forwarding

Answer

Shared VPC

Question 4

A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC flow logs show traffic being dropped. Firewall rules are correctly configured. Which TWO actions should the engineer take to identify the cause?

Accepted Answer

Use Packet Mirroring to capture traffic on both sides and compare.. Packet Mirroring allows you to capture and inspect actual traffic at the packet level on both sides of the VPC peering connection. Since firewall rules are correctly configured but flow logs still show drops, the issue is likely at a lower layer (e.g., routing, MTU, or asymmetric traffic). By comparing mirrored packets, you can see if traffic is actually reaching the destination interface and whether responses are being sent back, which flow logs alone cannot reveal.

Answer

Ensure that the subnets in both VPCs don't overlap.

Answer

Disable the firewall rules to see if traffic flows.

Answer

Verify that the VPCs are in the same project.

Question 5

A company has Compute Engine instances without external IP addresses that need to access external APIs. The instances are in multiple zones within a region, and each zone has a subnet. The company wants a cost-effective and highly available solution that does not require manual failover. What should they do?

Accepted Answer

Create a Cloud NAT gateway in each zone and configure region-specific NAT rules.. A Cloud NAT gateway per zone provides highly available outbound connectivity for instances without external IPs. By placing a gateway in each zone, traffic from instances in that zone uses the local gateway, avoiding cross-zone hops and ensuring automatic failover if a zone fails. This meets the cost-effective and no-manual-failover requirements without needing instance-level external IPs.

Answer

Create a Cloud NAT gateway in one zone and configure an instance tag-based route to the gateway.

Answer

Enable Private Google Access on the subnets and configure a Cloud NAT gateway in one zone.

Answer

Assign external IP addresses to each instance and create appropriate firewall rules.

Question 6

An engineer is configuring a Cloud Router for HA VPN. They need to enable BGP on the VPN tunnels. Which BGP configuration is required for the Cloud Router to advertise the VPC subnets to the on-premises network?

Accepted Answer

Create a custom route advertisement for each subnet. Cloud Router uses Border Gateway Protocol (BGP) to dynamically exchange routes with the on-premises network over HA VPN tunnels. By default, Cloud Router advertises only the VPC subnet ranges that are directly connected to the VPC network. To ensure all VPC subnets are advertised, you must create custom route advertisements for each subnet that needs to be reachable from on-premises. This is done by configuring the Cloud Router with a custom advertisement mode and specifying the subnet CIDR ranges as custom advertised IP ranges.

Answer

Set up a VPC peering connection

Answer

Use static routes on the VPN tunnel

Answer

Configure the VPN gateway to advertise the subnets

Question 7

A company has two Dedicated Interconnect connections to two separate Google Cloud regions for redundancy. They use Cloud Router with BGP to exchange routes. They want to ensure that traffic from on-premises to a specific VPC in us-central1 uses only the interconnect to us-central1, and the other interconnect is used only as a backup. How can they achieve this?

Accepted Answer

Configure MED values on the on-premises router to prefer the us-central1 interconnect.. Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to a specific entry point. By setting a lower MED value on the on-premises router for the routes advertised via the us-central1 interconnect, the on-premises network will prefer that path for traffic destined to the VPC in us-central1. The other interconnect will only be used if the preferred path fails, providing the desired active/backup behavior.

Answer

Configure BGP communities on Google Cloud to prefer the us-central1 interconnect.

Answer

Configure AS path prepending on the on-premises router to make the us-central1 path longer.

Answer

Use Cloud Router's custom route advertisements to influence path selection.

Question 8

An engineer is troubleshooting a VPC Network Peering connection between VPC-A and VPC-B. They have verified that the peering is active. However, an instance in VPC-A cannot reach an instance in VPC-B using its internal IP. Both VPCs have firewall rules allowing the traffic. What is the most likely cause?

Accepted Answer

Custom routes are not being exchanged between the VPCs. When VPC Network Peering is active but traffic fails, the most common cause is that custom routes are not being exchanged. By default, only subnet routes are exchanged; custom routes (e.g., static routes or routes from VPNs) are not shared unless explicitly configured using the 'export custom routes' option in the peering settings. Without this, the instance in VPC-A has no route to the internal IP of the instance in VPC-B, even if firewall rules allow the traffic.

Answer

The firewall rules are not applied to the correct tags

Answer

The subnet IP ranges overlap

Answer

The instance in VPC-A does not have a default route

Question 9

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

Accepted Answer

Auto mode subnet. An auto mode subnet automatically creates subnets in each region and assigns IP address ranges from a predefined pool that can expand as you add more VM instances. This allows the subnet to grow without manual intervention, making it ideal for startups that need dynamic scaling.

Answer

Custom mode subnet

Answer

Dynamic subnet

Answer

Legacy network

Question 10

A company with limited public IP addresses on-premises needs to connect to Google Cloud using Cloud VPN. They require high availability. Which solution should they implement?

Accepted Answer

Use HA VPN with two on-premises public IPs and two tunnels.. HA VPN provides high availability by using two tunnels, each terminating on a separate on-premises VPN gateway with a unique public IP address. This ensures that if one on-premises public IP or tunnel fails, traffic can still flow through the other tunnel, meeting the high-availability requirement. Classic VPN (option B) does not support active-active failover, and using the same public IP for both tunnels (option D) creates a single point of failure at the on-premises side.

Answer

Use NAT to map multiple private IPs to one public IP.

Answer

Use Classic VPN with a single tunnel.

Answer

Use HA VPN with the same public IP for both tunnels.

Question 11

A company has two VPCs in the same project, VPC-A and VPC-B. They have set up VPC peering between them. In VPC-A, there is a subnet 10.0.1.0/24. In VPC-B, there are subnets 10.0.2.0/24 and 10.0.3.0/24. A compute instance in VPC-A can ping an instance in VPC-B with IP 10.0.2.10, but fails to ping an instance in VPC-B with IP 10.0.3.10. All subnets are in the same region. Firewall rules allow all traffic between VPC-A and VPC-B. What is the most likely cause?

Accepted Answer

VPC-A has a static route to 10.0.3.0/24 that preempts the peering route.. VPC peering routes are automatically added to the route tables of both VPCs when the peering is established. However, if a more specific static route (e.g., to 10.0.3.0/24) exists in VPC-A, it will take precedence over the peering route due to longest prefix match routing. Since the instance in VPC-A can reach 10.0.2.10 but not 10.0.3.10, the most likely cause is that VPC-A has a static route that preempts the peering route for the 10.0.3.0/24 subnet.

Answer

The peering is not bidirectional; VPC-B is not exporting routes.

Answer

The firewall rules in VPC-B block ICMP from VPC-A to 10.0.3.0/24.

Answer

The subnet 10.0.3.0/24 was added after the peering, and the peering routes were not updated. Recreate the peering.

Question 12

Refer to the exhibit. The Cloud Router is connected to two on-premises routers via dedicated interconnect. The on-premises routers advertise the same prefix 10.1.0.0/16. Which on-premises router's route will be preferred by Google Cloud for traffic destined to 10.1.0.0/24? (Assume equal AS path length and MED from on-premises.)

Accepted Answer

The route from peer with IP 169.254.1.1. Google Cloud Router uses the customLearnedRoutePriority attribute as a tiebreaker when two on-premises routers advertise the same prefix via separate VLAN attachments on Dedicated Interconnect, assuming equal AS path length and MED. The router with the lower customLearnedRoutePriority value is preferred. In this scenario, the peer 169.254.1.1 has a lower priority (e.g., 100) compared to 169.254.0.1's higher priority (e.g., 200). Therefore, the route from peer 169.254.1.1 is selected.

Answer

The route with lower peer IP address

Answer

Both routes will be used equally (ECMP)

Answer

The route from peer with IP 169.254.0.1

Question 13

An organization wants to consume a third-party SaaS service via a private endpoint in their VPC, using Private Service Connect. Which type of Private Service Connect endpoint should they create?

Accepted Answer

PSC consumer endpoint (forwarding rule). Private Service Connect allows consumers to create endpoints in their VPC to access managed services. For accessing a third-party service published via PSC, the consumer creates a PSC endpoint (also known as a PSC forwarding rule) that targets the service attachment of the publisher.

Answer

PSC producer endpoint

Answer

Cloud VPN tunnel

Answer

VPC peering connection

Question 14

A network engineer needs to design a DNS architecture for a hybrid cloud environment. The requirements: on-premises hosts must resolve GCP private zone names, and GCP instances must resolve on-premises DNS names. Which TWO Cloud DNS features should they use?

Accepted Answer

Outbound DNS server policy. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS. Outbound DNS server policy allows GCP to forward queries to on-premises DNS.

Answer

Split-horizon DNS

Answer

DNS managed zone with forwarding

Answer

DNS peering

Question 15

An organization needs low-latency connectivity between their on-premises data center and Google Cloud, supporting up to 20 Gbps throughput. They already have a Partner Interconnect connection but need to increase capacity. Which two actions should they take? (Choose two.)

Accepted Answer

Work with the service provider to upgrade the existing interconnect to a higher capacity. Partner Interconnect connections can be upgraded to higher capacity by working with the service provider, as the provider manages the underlying physical circuit. This allows increasing throughput up to 20 Gbps without replacing the existing connection, leveraging the existing Layer 2 or Layer 3 handoff.

Answer

Create additional Cloud VPN tunnels to the same region

Answer

Provision a new Dedicated Interconnect to bypass the partner

Question 16

A company wants to expose a global web application with HTTP/HTTPS load balancing, SSL termination, and Cloud CDN. They need to route requests to different backend services based on the URL path (e.g., /api/* to a Cloud Run service, /static/* to a Cloud Storage bucket, and /* to a managed instance group). Which GCP load balancing product should they use?

Accepted Answer

Global external HTTP(S) Load Balancer. Global external HTTPS Load Balancer supports URL-based routing via URL maps, can terminate SSL, integrate with Cloud CDN, and route to different backends (including serverless NEG for Cloud Run and backend buckets for Cloud Storage).

Answer

SSL Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP/UDP Network Load Balancer

Question 17

A company is using Dedicated Interconnect to connect their on-premises network to Google Cloud. They have two VLAN attachments configured, each with a separate Cloud Router with active/active BGP. They want to ensure that traffic from their on-premises network to Google Cloud uses both attachments equally. Which configuration should they implement?

Accepted Answer

Set the same MED value on both on-premises BGP peers, and ensure the AS path length is identical.. Setting the same MED (Multi-Exit Discriminator) value on both on-premises BGP peers ensures that Google Cloud's Cloud Routers, which are configured with active/active BGP, will see both paths as equally preferred. When the AS path length is also identical, the BGP best-path selection algorithm on the Cloud Routers will load-balance traffic across both VLAN attachments, achieving equal utilization. This is the standard method for enabling equal-cost multipath (ECMP) over Dedicated Interconnect with multiple attachments.

Answer

Configure local preference on the Cloud Router to prefer one attachment, and rely on the other for backup.

Answer

Configure a single BGP session on one Cloud Router and use static routing for the other attachment.

Answer

Set a higher MED value on one on-premises peer to deprefer that attachment.

Question 18

A company uses a Shared VPC with a host project and multiple service projects. They have deployed Cloud NAT in the host project's network to provide internet access for service project instances. The Cloud NAT is configured to use a network tag 'nat'. Instances in service projects that have the tag 'nat' can reach the internet. A new service project is added and its instances are created with the same tag 'nat' in a subnet in europe-west1. However, these instances cannot reach the internet. Other service project instances with the tag 'nat' in us-central1 work fine. The Cloud NAT is deployed in us-central1. What is the most likely cause?

Accepted Answer

The Cloud NAT is not in the same region as the new service project's instances.. Cloud NAT is a regional resource; it only provides outbound internet access to instances within the same region. Since the Cloud NAT is deployed in us-central1, instances in europe-west1 cannot use it, regardless of their network tag. The instances in the new service project must have a Cloud NAT deployed in europe-west1 to reach the internet.

Answer

The Cloud NAT's UDP timeout is too short.

Answer

The firewall rules in the host project block traffic from the new service project's subnets.

Answer

The new service project's instances are not tagged with 'nat'.

Question 19

A startup is setting up their first GCP VPC. They want minimal manual configuration and need subnets in multiple regions. Which VPC creation mode should they use, and why?

Accepted Answer

Auto mode, because it automatically creates subnets in all regions with predefined IP ranges.. Auto mode VPCs automatically create a subnet in each region with predefined IP ranges, reducing manual effort. Custom mode requires manual subnet creation.

Answer

Auto mode, because it allows overlapping IP ranges with on-premises networks.

Answer

Custom mode, because it is the only mode that supports Shared VPC.

Answer

Custom mode, because it provides full control over IP ranges.

Question 20

Refer to the exhibit. A company uses a Cloud Router with two BGP sessions for an HA VPN to on-premises. Traffic is not flowing correctly to the on-premises network. What is the most likely issue?

Accepted Answer

The BGP session with vpn-tunnel-2 is down, causing asymmetric routing.. The exhibit shows that vpn-tunnel-2's BGP session is in a state other than 'established' (likely down), while vpn-tunnel-1 is established. A down BGP session on one tunnel can cause asymmetric routing or loss of connectivity, especially if traffic is sent over the down tunnel. Option B correctly identifies this. Option A is incorrect because the advertised route priority (MED) of 100 is not the issue; the problem is the session state. Option C is incorrect because keepalive interval 20 seconds is standard. Option D is incorrect because private ASN 65000 is allowed in Cloud Router BGP configurations.

Answer

The advertised route priority is too low.

Answer

The keepalive interval is too high.

Answer

The ASN 65000 is private and not allowed.