PCNE Practice Exam 54 — 20 Questions

Question 1

An organization wants to connect two VPCs in different projects so that they can communicate using private IPs. The connection must not be transitive. Which solution meets these requirements?

Accepted Answer

VPC Network Peering. VPC Network Peering directly connects two VPCs and is non-transitive by default.

Answer

Cloud Interconnect

Answer

Shared VPC

Answer

Cloud VPN

Question 2

A network engineer has configured a Dedicated Interconnect with a VLAN attachment and Cloud Router. BGP sessions are up and routes are exchanged. However, traffic from a specific on-premises subnet is not reaching a VPC instance. The route table shows a custom static route with priority 1000 for that subnet pointing to a VPN tunnel, and a BGP learned route with priority 100 for the same subnet via Interconnect. What is the most likely reason for the traffic not using the Interconnect route?

Accepted Answer

The BGP route's next hop is not reachable due to a missing firewall rule on the on-premises side. The BGP route with priority 100 is preferred over the static route with priority 1000. However, if the BGP route's next hop is not reachable (e.g., due to a missing firewall rule on the on-premises side blocking the necessary ICMP or BGP session traffic), the route will be considered invalid and not installed in the routing table. This causes traffic to fall back to the less preferred static route via the VPN tunnel, explaining why the Interconnect path is not used.

Answer

Route propagation is disabled on the Cloud Router

Answer

VPC firewall rules are blocking traffic on the Interconnect VLAN attachment

Answer

The BGP route has a lower MED than the static route

Question 3

A company uses an HTTPS load balancer with SSL certificates. They want to ensure only strong cipher suites are accepted. Which Google Cloud service should they use to enforce this?

Accepted Answer

SSL policies on the target HTTPS proxy.. SSL policies on the target HTTPS proxy allow you to define a set of allowed SSL/TLS cipher suites and protocols for the load balancer. By configuring an SSL policy with a 'RESTRICTED' profile or a custom list of strong ciphers, you can enforce that only secure cipher suites (e.g., TLS 1.2+ with ECDHE and AES-GCM) are accepted, rejecting weak or deprecated ciphers like RC4 or 3DES.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud Armor security policy.

Answer

Firewall rules on the backend instances.

Question 4

Your company runs a multi-tier web application on Google Cloud. The frontend is in us-central1 (3 instances behind an external HTTP(S) Load Balancer), the backend is in us-west1 (3 instances behind an internal TCP/UDP Load Balancer). The frontend instances are in a managed instance group (MIG) with autoscaling based on CPU utilization. Recently, you noticed that during traffic spikes, the frontend instances' CPU utilization remains low, but the backend instances' CPU utilization spikes to 90% and causes timeouts. The application uses a synchronous REST API; the frontend instances make requests to the internal load balancer's IP. What should you do to resolve the backend scaling issue?

Accepted Answer

Replace the internal TCP/UDP load balancer with an internal HTTP(S) load balancer and configure the backend MIG to autoscale based on the load balancing serving capacity or request count.. The internal TCP/UDP load balancer cannot provide request-level metrics (like requests per second) for autoscaling, as it operates at layer 4. Replacing it with an internal HTTP(S) load balancer (layer 7) allows the backend MIG to autoscale based on the load balancing serving capacity or request count, which directly correlates with the frontend's synchronous REST API calls. This resolves the backend CPU spike issue by scaling the backend instances before they become overloaded, rather than relying on CPU utilization which lags behind traffic spikes.

Answer

Create a backend service with the backend MIG and attach it to the internal TCP/UDP load balancer, enabling connection draining.

Answer

Configure the internal TCP/UDP load balancer with a health check that monitors CPU utilization and adjust the autoscaling metric of the backend MIG accordingly.

Answer

Enable Cloud Armor on the external load balancer to rate-limit requests and prevent backend overload.

Question 5

Which THREE statements about VPC Flow Logs are correct?

Accepted Answer

Flow logs support sampling with a configurable interval.. Flow logs are subnet-level, can be sent to BigQuery, and support configurable sampling.

Answer

Flow logs record traffic to and from external IP addresses only.

Answer

Flow logs are enabled by default for all subnets.

Question 6

A network engineer notices that VPC Flow Logs show connections from a Compute Engine instance to an IP address that should have been blocked by firewall rules. What is the most likely cause?

Accepted Answer

The firewall rule is not applied to the instance's network tag.. If a firewall rule is not applied to the instance's network tag, the rule will not affect that instance. In Google Cloud, firewall rules can target instances by specifying target tags; if the rule's target tag does not match the instance's tag, the rule is not enforced on that instance, allowing traffic that should have been blocked.

Answer

The firewall rule has a lower priority than a deny rule.

Answer

The instance is using an external IP.

Answer

VPC Flow Logs are inaccurate.

Question 7

Which TWO configurations provide high availability for Dedicated Interconnect? (Choose two.)

Accepted Answer

Two connections to different PoPs.. Connecting to two different Points of Presence (PoPs) provides geographic redundancy; if one PoP fails, traffic can be rerouted through the other. Option E is correct because two connections to the same PoP provide link-level redundancy; if one circuit fails, the other can continue carrying traffic, and BGP can be used to load-balance or failover between them.

Answer

A single circuit with L2 redundancy.

Answer

Using Cloud NAT for failover.

Answer

A single connection from one provider.

Question 8

An organization has multiple VPCs in different projects that need to resolve DNS names across projects. They want to use Cloud DNS without creating a separate managed zone for each VPC. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows DNS resolution between projects without creating separate managed zones. DNS forwarding is for forwarding queries to an external DNS server.

Answer

Private managed zones

Answer

Shared VPC

Answer

DNS forwarding

Question 9

An organization has multiple VPCs in the same project. They want to apply consistent firewall rules to all VPCs at the project level. What is the most efficient way to achieve this?

Accepted Answer

Use hierarchical firewall policies at the project level. Hierarchical firewall policies can be applied at the organization, folder, or project level and apply to all VPCs in the resource hierarchy. VPC-level firewall rules are per VPC and require duplication.

Answer

Create a network firewall policy and attach it to each VPC

Answer

Create a firewall rules template using Deployment Manager

Answer

Use VPC Service Controls to enforce rules

Question 10

A company has a VPC with a single subnet in us-central1 (10.0.0.0/24). They have a Compute Engine instance running a database that uses an internal IP address 10.0.0.10. They need to ensure that this database instance can be accessed by a legacy on-premises application via a Cloud VPN tunnel. The on-premises network uses 192.168.0.0/16. They have set up a HA VPN gateway with two tunnels and BGP routing. The Cloud Router is configured to advertise the subnet 10.0.0.0/24. On the on-premises side, the router receives the route for 10.0.0.0/24 and has a static route for 10.0.0.0/24 pointing to the VPN tunnel. However, the on-premises application cannot reach the database. The application's server can ping the on-premises gateway, but not the database IP. The database instance's OS firewall allows all traffic from 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The VPC firewall rules are blocking ingress from on-premises; add a rule allowing traffic from 192.168.0.0/16 to the database IP.. The issue is likely that the VPC firewall rules are blocking ingress traffic from the on-premises network. Even though the database OS firewall is permissive, the VPC firewall must allow ingress from the on-premises IP range (192.168.0.0/16) to the database's IP. Option B is correct: Create a firewall rule allowing ingress from 192.168.0.0/16 to 10.0.0.10 on the required port.

Answer

The database instance's OS firewall is blocking the traffic despite the setting.

Answer

The Cloud Router is not advertising the specific database IP 10.0.0.10, only the subnet 10.0.0.0/24.

Answer

The BGP session is not establishing properly; check the shared secret and IP addresses.

Question 11

A company currently uses Cloud VPN with dynamic routing to connect to Google Cloud. They want to migrate to Dedicated Interconnect without downtime. Which THREE steps should they take to achieve a seamless migration? (Choose three.)

Accepted Answer

Order and provision the Dedicated Interconnect. Ordering and provisioning the Dedicated Interconnect is the foundational step to establish the physical connection between the on-premises network and Google Cloud. Without this, no migration can occur. This involves working with a Google Cloud partner to ensure the cross-connect is completed and the VLAN attachments are created.

Answer

Decrease the BGP route priority (MED) on the VPN advertisements to make VPN less preferred

Answer

Update on-premises firewall rules to allow traffic over the new Interconnect

Question 12

A company wants to migrate an on-premises application that uses IPsec VPN tunnels to Google Cloud. They need to ensure encrypted connectivity between the on-premises network and a VPC. Which GCP service should they use?

Accepted Answer

Cloud VPN. Cloud VPN (D) is the correct service because it securely extends an on-premises network to a Google Cloud VPC over the public internet using IPsec VPN tunnels. It provides encrypted connectivity that matches the existing IPsec-based architecture, ensuring data confidentiality and integrity between the two sites.

Answer

Cloud Router

Answer

Cloud Interconnect

Answer

VPC Network

Question 13

A company wants to allow traffic to a specific set of Compute Engine instances only from a single management instance that uses a service account. The management instance has the service account 'sa-mgmt@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations can achieve this? (Choose TWO.)

Accepted Answer

Set the source IP range to the internal IP of the management instance. Firewall rules can target instances by service account (using the 'target service accounts' field) and filter source traffic by service account (using the 'source service accounts' field). Both approaches can restrict traffic to only the management instance's service account.

Answer

Set the priority to 65535 to ensure it is evaluated last

Answer

Set the target tags to 'mgmt' and assign that tag to the management instance

Answer

Set the target of the rule to the service account 'sa-mgmt@project.iam.gserviceaccount.com'

Question 14

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

Accepted Answer

Cloud Router. Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Answer

Cloud NAT

Answer

VPC peering

Answer

VPC Flow Logs

Question 15

An engineer configured a Cloud Router with the above settings. The VPC network has subnets 10.1.0.0/16 and 10.2.0.0/16, as well as subnets 10.3.0.0/16 and 10.4.0.0/16. The on-premises router is only receiving routes for 10.1.0.0/16 and 10.2.0.0/16 but not for 10.3.0.0/16 and 10.4.0.0/16. What is the cause?

Accepted Answer

The Cloud Router is set to custom advertisement mode, and the missing subnets are not included in the advertised IP ranges. When a Cloud Router is configured in custom advertisement mode, it only advertises the specific CIDR ranges explicitly listed in the 'Advertised IP ranges' field. Since the missing subnets (10.3.0.0/16 and 10.4.0.0/16) are not included in that list, they are not propagated via BGP to the on-premises router, even though they exist in the VPC.

Answer

The BGP session is not established

Answer

The Cloud Router is in global routing mode, which does not advertise all subnets

Answer

The on-premises router has a filter that blocks the other routes

Question 16

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

Accepted Answer

Check Cloud NAT logs for port exhaustion. Cloud NAT logs can reveal port exhaustion, which occurs when the NAT gateway runs out of available source ports for connections. Since all instances share the same NAT IP addresses, high connection counts from some instances can exhaust ports, preventing others from establishing new outbound connections. Checking these logs helps identify whether port exhaustion is the root cause of the connectivity issue.

Answer

Ensure Cloud NAT is enabled in each zone where instances are located

Answer

Verify that the instances have external IP addresses assigned

Answer

Review the health check configuration for the NAT gateway

Question 17

Match each Google Cloud networking service to its primary function.

Accepted Answer

Cloud Load Balancing: Distributes incoming traffic across multiple instances. Correct matches: Cloud Load Balancing distributes traffic, Cloud CDN caches content, Cloud DNS resolves domain names. Common confusions: Cloud NAT is for internet access without external IPs, Virtual Private Cloud provides isolated networks, and Cloud Interconnect connects on-premises to Google Cloud.

Answer

Cloud NAT: Caches content at edge locations

Answer

Virtual Private Cloud: Provides dedicated connection between on-premises and VPC

Answer

Cloud Interconnect: Translates domain names to IP addresses

Question 18

A company uses VPC Service Controls to protect a managed service (e.g., BigQuery) within a service perimeter. Developers need to access the service from an on-premises network via a Cloud VPN tunnel with a specific IP address. However, access is being denied. What is the most likely cause?

Accepted Answer

The on-premises source IP is not included in the allowed external IP addresses list in the perimeter.. VPC Service Controls enforce access to managed services like BigQuery by restricting which source IPs can reach the service. When accessing from on-premises via Cloud VPN, the source IP seen by the service is the on-premises client's IP, not the VPN gateway's IP. If that on-premises source IP is not explicitly added to the allowed external IP addresses list in the service perimeter, access is denied, even though the VPN tunnel is established.

Answer

The project containing the VPN tunnel is not in the same perimeter.

Answer

The VM instances in the perimeter do not have public IP addresses.

Answer

The Cloud VPN tunnel is not using IKEv2.

Question 19

A network engineer is troubleshooting BGP route propagation between an on-premises network and a GCP VPC via Cloud Router. The on-premises router is advertising a specific subnet (10.1.0.0/16), but GCP is not receiving the route. Cloud Router BGP sessions are established. Which configuration could be the issue?

Accepted Answer

The Cloud Router is configured to only accept routes from a specific set of prefixes. Cloud Router has an option to set custom route advertisements. If the on-premises route is not being accepted, it could be because the Cloud Router is configured with 'advertised route priority' or 'advertised IP ranges' that exclude the on-premises prefixes. More likely, the BGP peer is configured to accept only specific prefixes via 'advertised route priority' or 'advertised groups'. Another common issue: the on-premises router needs to advertise the route; Cloud Router must have 'advertise custom routes' enabled or the route must be within the allowed prefixes.

Answer

The VPC firewall rules are blocking BGP traffic (TCP port 179)

Answer

The Cloud Router is configured with a higher MED value for the route

Answer

The on-premises router is not sending the AS_PATH attribute

Question 20

A company wants to connect their on-premises network to Google Cloud using a VPN with high availability and 99.99% SLA. They have two Cloud VPN gateways, each with two external IP addresses. Which configuration best meets the high availability requirement?

Accepted Answer

Deploy two Cloud VPN gateways, each with two tunnels to two separate on-premises VPN devices. It meets the 99.99% SLA requirement by deploying two Cloud VPN gateways, each with two tunnels to two separate on-premises VPN devices. This configuration provides both gateway-level redundancy and tunnel-level redundancy, ensuring that if one gateway, tunnel, or on-premises device fails, traffic can failover to another tunnel. Google Cloud's HA VPN requires at least two tunnels per gateway to achieve the 99.99% SLA, and using two separate on-premises devices eliminates the single point of failure on the customer side.

Answer

Deploy two Cloud VPN gateways, each with one tunnel to one on-premises VPN device

Answer

Deploy one Cloud VPN gateway with two tunnels to two separate on-premises VPN devices

Answer

Deploy one Cloud VPN gateway with one tunnel to one on-premises VPN device