PCNE Practice Exam 55 — 20 Questions

Question 1

Which TWO steps are required to set up a Cloud VPN with dynamic routing (BGP)? (Choose 2.)

Accepted Answer

Create a VPN gateway and a VPN tunnel.. A Cloud VPN requires both a VPN gateway (the GCP-side endpoint for encrypted traffic) and a VPN tunnel (the actual IPSec tunnel configuration that defines the remote peer IP, shared secret, and IKE parameters). Option E is correct because dynamic routing with BGP mandates a Cloud Router in the same region as the VPN gateway to exchange BGP routes with the on-premises router; the Cloud Router advertises the VPC subnets and learns remote prefixes via BGP sessions over the tunnel.

Answer

Configure a static route for the remote network.

Answer

Create a Cloud NAT for outbound access.

Answer

Create firewall rules to allow traffic from the remote network.

Question 2

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

Accepted Answer

The firewall rule allow-ssh is missing a source IP range or has a source IP range that does not include the user's IP. The most likely cause is that the firewall rule 'allow-ssh' is missing a source IP range or has a source IP range that does not include the user's public IP (203.0.113.5). In Google Cloud, firewall rules are stateful and by default deny all ingress traffic unless explicitly allowed; without a source IP range (or with an incorrect one), the SSH traffic from the user's workstation is dropped at the VPC firewall level, preventing access to the VM's external IP (34.67.89.10).

Answer

The firewall rule allow-ssh is for the wrong network

Answer

The firewall rule allow-ssh is disabled

Answer

The VM's external IP (34.67.89.10) is blocked by Cloud NAT

Question 3

A company wants to expose an on-premises HTTP server to internet clients through a Global HTTPS Load Balancer using a hybrid connectivity NEG. The on-prem server is reachable via a Cloud VPN tunnel. What must the engineer configure to ensure the load balancer can reach the on-prem endpoint?

Accepted Answer

Create a static route in VPC pointing to the VPN tunnel for the on-prem IP. Hybrid connectivity NEGs require a custom route that directs traffic to the on-prem network via the VPN tunnel. The load balancer's health check source ranges also need routes back. Firewall rules are necessary but not the primary routing requirement.

Answer

Use a global TCP proxy load balancer instead

Answer

Configure a firewall rule allowing health check ranges to the on-prem server

Answer

Deploy a proxy VM in the VPC to forward traffic to on-prem

Question 4

Which THREE components are required to set up a Cloud VPN with dynamic routing (BGP) between an on-premises network and Google Cloud?

Accepted Answer

Cloud VPN gateway. A Cloud VPN gateway is required because it acts as the Google Cloud-side endpoint for the VPN tunnel, handling the encryption and encapsulation of traffic. Without a VPN gateway, there is no secure tunnel termination point in GCP, making it impossible to establish the VPN connection.

Answer

Cloud NAT

Answer

Static routes for the remote network

Question 5

A network engineer needs to design a VPC network for a global application that will have Compute Engine instances in multiple regions. The instances need to communicate with each other using internal IP addresses. What is the simplest way to enable this communication?

Accepted Answer

Create a single VPC network with subnets in each region.. A single VPC network is global and can contain subnets in any region. By placing subnets in each required region within the same VPC, instances can communicate using internal IP addresses (RFC 1918) without any additional connectivity services. This is the simplest and most scalable approach because VPCs inherently provide global routing between subnets.

Answer

Use Dedicated Interconnect to connect regions.

Answer

Use Cloud VPN to connect the instances.

Answer

Create separate VPC networks per region and peer them.

Question 6

A company wants to prevent data exfiltration from a Google Cloud Storage bucket that contains sensitive data. They plan to use VPC Service Controls. Which two steps are necessary to implement this? (Choose two.)

Accepted Answer

Add the storage bucket to a VPC Service Controls perimeter and restrict access to only trusted VPC networks.. VPC Service Controls allows you to define a service perimeter that includes a Cloud Storage bucket, and within that perimeter you can restrict access to only trusted VPC networks. This prevents data exfiltration by ensuring that only resources within the specified VPC networks can access the bucket, blocking any access from outside the perimeter, including the public internet or other networks.

Answer

Set up an Organization Policy to deny all public access to storage buckets.

Answer

Configure the service perimeter to allow access only from authorized IP ranges.

Answer

Create a service perimeter that includes the storage bucket and the VPC network.

Question 7

Which GCP service provides a dedicated, low-latency connection from an on-premises data center to Google Cloud?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, low-latency connection from an on-premises data center to Google Cloud, bypassing the public internet. It offers two options: Dedicated Interconnect (a direct physical connection via a colocation facility) and Partner Interconnect (via a supported service provider). This ensures consistent bandwidth and lower latency compared to VPN-based solutions.

Answer

Cloud Router

Answer

Cloud VPN

Answer

VPC Network

Question 8

Match each Cloud DNS record type to its use.

Accepted Answer

A: Maps a domain name to an IPv4 address.. Common DNS record types in Cloud DNS include A, AAAA, CNAME, and MX for IP mapping, aliasing, and email routing. Distractors swap definitions between record types.

Answer

A: Maps a domain name to an IPv6 address.

Answer

CNAME: Specifies mail exchange servers for a domain.

Question 9

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Accepted Answer

Create firewall rules allowing all traffic from the other region's subnet CIDR.. In Google Cloud, a VPC is a global resource. Subnets are regional, but they all belong to the same VPC. Instances in different regions within the same VPC can communicate using internal IP addresses automatically over Google's global network, without needing VPC peering, VPN, or Dedicated Interconnect. The only requirement is that firewall rules permit the traffic. Therefore, the necessary action is to create firewall rules (Option C). Options A and B are for connecting separate VPCs, which is not the scenario here. Options D and E are incorrect because using external IPs would traverse the internet, and Shared VPC is for sharing subnets across projects, not for connecting regions.

Answer

Set up VPC peering between the VPCs in each region.

Answer

Set up Cloud VPN or Dedicated Interconnect between the two VPCs.

Answer

Configure instances to use external IP addresses for cross-region communication.

Answer

Use a shared VPC to connect both regions.

Question 10

A network engineer is configuring Cloud Router for Dedicated Interconnect. The on-premises router is advertising a route to 10.1.0.0/16. The engineer wants to ensure that Google Cloud always prefers this route over other routes learned from different on-premises routers. Which BGP attribute should be set on the on-premises router?

Accepted Answer

MED. MED (Multi-Exit Discriminator) is the correct BGP attribute to influence inbound traffic from Google Cloud to prefer a specific on-premises router when multiple paths exist. By setting a lower MED value on the on-premises router, the Cloud Router will select that route over others with higher MED values, ensuring Google Cloud always prefers this path for traffic destined to 10.1.0.0/16.

Answer

NEXT_HOP

Answer

AS_PATH

Answer

LOCAL_PREF

Question 11

A company has a Global SSL Proxy Load Balancer handling HTTPS traffic. They want to offload SSL decryption to the load balancer and forward encrypted traffic to backends. Which backend protocol should they use?

Accepted Answer

SSL. Global SSL Proxy LB terminates SSL and forwards traffic using SSL (TCP with SSL) to backends, allowing end-to-end encryption.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 12

A company is using a Classic VPN with static routing to connect to GCP. They need to add a new subnet in GCP and make it reachable from on-premises without manual configuration changes on-premises. What is the limitation of Classic VPN in this scenario?

Accepted Answer

Classic VPN requires manual route updates on-premises. Classic VPN with static routing requires manual route updates; dynamic routing (BGP) is needed for automatic route advertisement.

Answer

Classic VPN does not support IKEv2

Answer

Classic VPN supports BGP, so routes are automatically advertised

Answer

Classic VPN cannot be used with multiple subnets

Question 13

Your company has two on-premises data centers, DC1 and DC2, each connected to a separate Google Cloud VPC via Dedicated Interconnect. Both VPCs are connected via VPC Network Peering. A new application deployed in VPC1 needs to communicate with a database in DC2. The database IP range is 10.0.0.0/16. You have configured firewall rules to allow the traffic. However, the application cannot reach the database. You have verified that routes for 10.0.0.0/16 exist in VPC1's route table with next hop to VPC Peering, and in VPC2's route table with next hop to the interconnect attachment. The BGP sessions on both interconnects are up. What is the most likely reason for the connectivity failure?

Accepted Answer

VPC Network Peering does not support transitive routing through a peered VPC. VPC Network Peering does not support transitive routing. In this topology, VPC1 is peered with VPC2, but traffic from VPC1 to DC2 must pass through VPC2 and then over the interconnect. Since VPC1's route for 10.0.0.0/16 points to the VPC peering as next hop, VPC1 expects the traffic to be forwarded directly to VPC2. However, VPC2 cannot forward that traffic to DC2 because Google Cloud VPC peering does not allow a peered VPC to act as a transit hub; each VPC can only communicate directly with its peer, not with resources reachable through that peer. This is a fundamental limitation of VPC Network Peering, which is non-transitive.

Answer

The route for 10.0.0.0/16 in VPC1 is not imported correctly from VPC Peering

Answer

BGP session on the interconnect between VPC2 and DC2 is down

Answer

Firewall rules in VPC2 are blocking traffic

Question 14

A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises network does not have a route back to the VPC subnet.. The most likely cause is that the on-premises network lacks a route back to the VPC subnet. For Cloud VPN, return traffic from the on-premises server must have a route pointing to the on-premises VPN gateway to reach the VM. Without this route, packets are dropped, causing asymmetric routing. Option B is incorrect because firewall rules affect all traffic, not just the return path. Option C is incorrect because if the BGP session were down, no connectivity would exist at all. Option D is incorrect because Cloud Router is used for dynamic routing, but a missing return route would still cause the issue even with static routes.

Answer

A firewall rule is blocking ingress traffic from the on-premises network.

Answer

The BGP session is down.

Answer

The Cloud Router is not configured.

Question 15

A company has a VPC with three tiers: web, app, and db. They want to enforce that only the web tier can communicate with the app tier on TCP port 8080, and only the app tier can communicate with the db tier on TCP port 3306. All instances are in the same region but different subnets. Which TWO firewall rules should be created? (Choose 2.)

Accepted Answer

An ingress rule on the db tier instances with tag 'db' allowing TCP 3306 from instances with tag 'app'.. To control traffic between tiers, ingress firewall rules should be applied to the destination instances using target tags. For web-to-app (TCP 8080), place an ingress rule on app instances (tag 'app') allowing TCP 8080 from source tag 'web' (Option D). For app-to-db (TCP 3306), place an ingress rule on db instances (tag 'db') allowing TCP 3306 from source tag 'app' (Option A).

Option B is an egress rule on web, which controls outbound traffic but does not prevent other sources from reaching app. Option C allows traffic to any destination, violating the principle of least privilege. Option E incorrectly places an ingress rule on the web subnet, but the web tier should be the source, not the destination. Therefore, the correct answers are A and D.

Answer

An egress rule on the web instances with tag 'web' allowing TCP 8080 to the app subnet.

Answer

An egress rule on the web subnet allowing TCP 8080 to any destination.

Answer

An ingress rule on the web subnet allowing TCP 8080 from the app subnet.

Question 16

A customer is configuring a route-based IPsec VPN tunnel to Google Cloud. On their on-premises router, they must specify traffic selectors (proxy IDs). What should they set the local and remote traffic selectors to?

Accepted Answer

Set both local and remote traffic selectors to 0.0.0.0/0.. For route-based VPN, traffic selectors (proxy IDs) should be set to 0.0.0.0/0 (any) because route-based tunnels use routing tables to determine which traffic is sent through the tunnel, rather than policy-based selectors. Option A is incorrect because IKE version does not affect traffic selectors. Option B is incorrect because specifying local and remote subnets is used for policy-based VPN, not route-based. Option C is incorrect because the question specifies route-based VPN; using policy-based VPN is unnecessary and not the correct action.

Answer

Configure IKE version to match.

Answer

Set local to on-prem subnet and remote to VPC subnet.

Answer

Use policy-based VPN instead.

Question 17

A company wants to connect its on-premises data center to Google Cloud. They have a single VPN appliance on-premises and need high availability for the connection. Which architecture provides the most cost-effective high availability solution?

Accepted Answer

Deploy Cloud HA VPN with two interfaces, each with its own external IP address, and configure two tunnels to the on-premises VPN appliance.. Cloud HA VPN provides high availability by using two interfaces with two external IP addresses, and you can configure two tunnels to a single on-premises VPN appliance. This architecture is cost-effective because it uses a single Cloud VPN gateway (HA VPN) and does not require additional infrastructure. Option B is incorrect because a single Classic VPN tunnel does not provide high availability. Option C is incorrect because deploying two Classic VPN gateways is more expensive and still requires multiple tunnels to the same on-premises appliance, but it does not leverage the built-in HA capabilities of HA VPN. Option D is incorrect because Cloud HA VPN requires at least two interfaces (with separate IPs) to provide high availability; a single interface would be a single point of failure.

Answer

Use a single Cloud Classic VPN tunnel with a static route.

Answer

Deploy two Cloud Classic VPN gateways in the same region, each with one tunnel to the on-premises VPN appliance.

Answer

Deploy Cloud HA VPN with one interface and one external IP address, and configure a single tunnel to the on-premises appliance.

Question 18

Which TWO configurations can enable VM instances without external IPs to access the internet? (Choose TWO.)

Accepted Answer

VPC peering with a network that has Cloud NAT. Cloud NAT (Option E) provides source network address translation for VMs in a subnet, enabling outbound internet access without external IPs. VPC peering with a network that has Cloud NAT (Option B) allows VMs to use the NAT of the peered network for internet access. Option A (Direct peering with Google) only provides connectivity to Google services, not the full internet. Option C (Private Google Access) only grants access to Google APIs. Option D (Using a proxy instance with an external IP) is possible but not a native Google Cloud service and requires manual configuration.

Answer

Direct peering with Google

Answer

Private Google Access

Answer

Using a proxy instance with an external IP

Question 19

Your organization has an internal HTTP load balancer (ILB) in us-central1. The backend service is a managed instance group with a health check on port 8080. Recently, some instances are reported as unhealthy despite the application running fine. What is the most likely cause?

Accepted Answer

The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).. The most likely cause is that the firewall rule allowing health check probes does not include the required Google Cloud health check source IP ranges (35.191.0.0/16 and 130.211.0.0/22). For internal HTTP load balancers, the health check probes originate from these specific ranges, not from within the VPC. If the firewall rule only permits traffic from the VPC internal ranges, health checks will fail even if the application is running. Option A is wrong because the health check source range is not the same as VPC internal traffic; it must be the GCP health check ranges. Option B is wrong because proxy protocol does not affect health check source IPs for internal load balancers. Option D is wrong because preemptible instances do not become unhealthy after 24 hours due to preemption; they are terminated, not marked unhealthy.

Answer

The health check firewall rule is configured for the same source range as the VPC internal traffic.

Answer

The internal load balancer is using a proxy protocol which changes the health check source IP.

Answer

The instances are preemptible and become unhealthy after 24 hours.

Question 20

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

Accepted Answer

Ingress rule with source IP range of the company's public IPs and allow tcp:443. Options A and C are correct. Ingress firewall rules with source IP ranges limited to the company's known public IPs on ports 443 (HTTPS) and 80 (HTTP) ensure that only traffic from those IPs can access the web server instances. Option B is incorrect because source range 0.0.0.0/0 allows all IPs, which does not restrict to known IPs. Option D is incorrect because source tags identify target instances, not source IPs. Option E is incorrect because ingress rules use source IP ranges, not destination IP ranges, to restrict incoming traffic.

Answer

Ingress rule with source IP range 0.0.0.0/0 and allow tcp:80

Answer

Ingress rule with source tag 'web' and allow tcp:80

Answer

Ingress rule with destination IP range 0.0.0.0/0 and allow tcp:80