PCNE Practice Exam 56 — 20 Questions

Question 1

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces. They help diagnose packet drops and latency issues. Cloud NAT logging provides logs about NAT connections, not general traffic. Packet Mirroring is for capturing and inspecting traffic for analysis, not for logging. Traffic Director is a service mesh control plane, not a traffic logging tool.

Answer

Cloud NAT logging

Answer

Packet Mirroring

Answer

Traffic Director

Question 2

Match each Cloud Load Balancing type to its description.

Accepted Answer

External HTTP(S) Load Balancer: Distributes traffic from the internet to backend instances, supports HTTP/HTTPS protocols, can be global or regional.. The correct matches are: External HTTP(S) Load Balancer handles internet HTTP/HTTPS traffic; Internal TCP/UDP Load Balancer handles internal TCP/UDP traffic. Common confusions include mixing external/internal roles and protocol support.

Answer

External HTTP(S) Load Balancer: Distributes traffic from internal clients to backend instances, supports TCP/UDP protocols, regional.

Answer

Internal TCP/UDP Load Balancer: Distributes traffic from the internet to backend instances, supports HTTP/HTTPS protocols, global or regional.

Answer

External TCP/UDP Load Balancer: Terminates SSL and forwards to backend instances.

Question 3

An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?

Accepted Answer

The firewall rules in the VPC allowing incoming traffic from the on-premises CIDR.. The first thing to check is the VPC firewall rules because even if BGP routes are exchanged and the tunnel is up, traffic can be blocked by firewall rules if there is no ingress rule allowing traffic from the on-premises CIDR. The tunnel being established and BGP session up indicates Layer 3 connectivity, but Layer 4 filtering via firewall rules can still block traffic. Option A is incorrect: a default route advertised from on-premises is fine as long as the route is learned and points to the correct next hop. Option B is incorrect: MTU issues would typically cause fragmentation problems, not complete inability to reach instances. Option C is incorrect: the Cloud VPN gateway must have an external IP for the tunnel to be established; if it were missing, the tunnel wouldn't be up.

Answer

The advertised route from the on-premises router is a default route.

Answer

The MTU size of the VPN tunnel.

Answer

The Cloud VPN gateway is assigned an external IP address.

Question 4

A company has an on-premises data center connected to Google Cloud via Dedicated Interconnect. They have a VPC with subnets in us-central1 and us-west1. They want compute instances in us-central1 to access Google APIs (e.g., Cloud Storage) without traversing the internet, but the on-premises network must also be able to access those APIs via the interconnect. They have configured Private Google Access (PGA) on all subnets. However, on-premises users report that they cannot access Cloud Storage buckets using the private IP of a forward proxy in us-central1 (the proxy is configured to use the default internet gateway for egress). What is the most likely reason?

Accepted Answer

There is a custom static route for 199.36.153.4/30 (Google API VIP) that points to the interconnect, overriding the default route for the proxy's outbound traffic.. Private Google Access (PGA) allows instances with only internal IPs to reach Google APIs via the default internet gateway (0.0.0.0/0 route). However, if a more specific static route exists for the Google API IP range (199.36.153.4/30) that points to the interconnect, traffic from the forward proxy to Google APIs will be routed to the on-premises network instead of the internet. Since the proxy is in us-central1 and uses its VPC routing, the custom route overrides the default route, preventing the proxy from reaching Google APIs. Option C correctly identifies this misconfiguration.

Answer

Private Google Access is not supported on subnets in us-central1.

Answer

The forward proxy must use an external IP address to use Private Google Access.

Answer

The on-premises network must be configured with a default route pointing to the internet.

Question 5

A company has two VPC networks in the same project: 'vpc-a' (us-central1) and 'vpc-b' (us-east1). They are connected via VPC Network Peering. An instance in vpc-a can ping the internal IP of an instance in vpc-b, but cannot reach it on TCP port 8080. The firewall rule in vpc-b allows ingress from the peered network's subnets. What is the most likely cause?

Accepted Answer

The firewall rule for port 8080 is missing or uses an incorrect target tag or service account.. Since ICMP (ping) works, VPC Network Peering is functioning correctly, and the firewall rule in vpc-b allows ingress from the peered network's subnets. The failure on TCP 8080 indicates a missing or misconfigured firewall rule specific to that port, possibly due to incorrect target tags or service accounts. Option D is incorrect because the rule already permits ingress from the peered subnets; the issue is that no rule explicitly allows TCP 8080. Therefore, the most likely cause is that the firewall rule for port 8080 is missing or uses an incorrect target tag or service account, making option C correct.

Answer

The instance in vpc-b has a firewall rule that denies TCP port 8080 explicitly.

Answer

The subnet in vpc-a is in a different region, so peering does not support cross-region communication.

Answer

The firewall rule in vpc-b must allow ingress from the entire CIDR of vpc-a's subnet, not just the peered network.

Question 6

A company is designing a Shared VPC architecture for multiple projects. The host project hosts three VPC networks: 'prod', 'staging', 'dev'. Each service project needs access to a specific network. Some service projects require access to multiple networks. The security team wants to minimize the number of firewall rules and use IAM for centralized control. Which approach meets these requirements?

Accepted Answer

Attach each service project to one host project network and use IAM roles to grant access to specific subnets in other networks with a cross-project service account.. In Shared VPC, a service project can only be attached to one VPC network per host project. To provide access to multiple VPC networks, you can use IAM roles such as compute.networkUser on specific subnets across different host projects or use a cross-project service account. Option A allows each service project to be attached to one network and then grants IAM permissions to access subnets in other networks, meeting the requirement to minimize firewall rules and use IAM for centralized control. Option B (VPC peering) does not provide centralized IAM control. Option C (separate host projects) increases management overhead. Option D (single VPC) defeats the purpose of isolation.

Answer

Use VPC Network Peering between each service project's VPC and the host project's networks.

Answer

Create a separate host project for each environment and attach service projects accordingly.

Answer

Create a single VPC network that encompasses all environments, and use subnet-level firewall rules to isolate environments.

Question 7

A company needs to connect three VPC networks in separate projects (two in the same organization, one in a different organization) to each other for private IP communication. Which TWO GCP solutions should they consider? (Choose 2.)

Accepted Answer

VPC Network Peering. Options D and E are correct for connecting three VPC networks in separate projects, including across organizations. VPC Network Peering (D) directly connects VPCs, allowing private IP communication, but it is non-transitive, so a full mesh of peerings is required for all three VPCs to communicate. Cloud VPN with dynamic routing (E) can also be used to create routed connections between VPCs via Cloud Routers, enabling private IP communication even across organizations, though it involves more overhead. Option B (hub-and-spoke topology) is incorrect because VPC peering is non-transitive; spokes cannot communicate through the hub without additional routing, so a hub-and-spoke design alone does not enable full connectivity among all three VPCs. Shared VPC (C) is limited to projects within the same organization, and Cloud Interconnect (A) is designed for on-premises to VPC connections, not VPC-to-VPC.

Answer

Cloud Interconnect

Answer

VPC Network Peering hub-and-spoke topology

Answer

Shared VPC

Question 8

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

Accepted Answer

Enable Private Google Access on subnets that host instances without external IP addresses.. Private Google Access allows VM instances that have only internal IP addresses (no external IPs) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through the Google Cloud network. This eliminates the need for an external IP address, reducing the attack surface and supporting a defense-in-depth strategy by keeping traffic within Google's internal infrastructure.

Answer

Configure firewall rules with stateful packet inspection disabled to maximize throughput.

Answer

Use VPC Network Peering to isolate the sensitive workloads from other projects.

Answer

Create a Cloud NAT gateway to filter inbound traffic from the internet.

Question 9

Refer to the exhibit. A network team has created this load balancer. Clients inside the VPC are unable to connect to the load balancer's IP address from a Compute Engine instance in the same VPC. What is the most likely cause?

Accepted Answer

The load balancer is configured with network tier STANDARD, which does not support internal traffic.. A load balancer configured with network tier STANDARD uses the Premium Tier's external IP addressing, which does not support internal traffic routing within the same VPC. Clients inside the VPC attempting to connect to the load balancer's IP address from a Compute Engine instance in the same VPC will fail because STANDARD tier IPs are designed for external internet-facing traffic and cannot be reached from within the VPC without a public IP and appropriate routing. The load balancer must use the Premium Tier (network tier PREMIUM) to support internal client traffic within the same VPC.

Answer

The target HTTPS proxy is not properly configured to use a backend service.

Answer

The load balancer is using INTERNAL_MANAGED scheme, which requires the clients to be in a different region.

Answer

The load balancer does not have a backend service configured.

Question 10

A company needs to cache API responses that are dynamic but cacheable for short periods. They want to use Cloud CDN with a Global HTTPS Load Balancer. Which three settings should they configure?

Accepted Answer

Set a short TTL (e.g., 60 seconds). To cache dynamic but cacheable API responses with Cloud CDN and a Global HTTPS Load Balancer, three settings are required: Set a short TTL (e.g., 60 seconds) to control how long responses are cached. Set cache mode to FORCE_CACHE_ALL to override origin cache headers and allow caching of all responses. Configure cache keys to include query parameters to distinguish different API calls. These three settings ensure dynamic content is cached appropriately.

Answer

Disable Cloud CDN for the backend service

Answer

Set cache mode to USE_ORIGIN_HEADERS

Question 11

An organization is using Shared VPC with 100 service projects. They want to allow each service project to manage its own Cloud NAT, but the network administration team wants to control the outbound IP addresses used. What is the best design?

Accepted Answer

Create Cloud NAT in each service project with the same external IPs. In Shared VPC, Cloud NAT can be created in each service project, using the same set of external IP addresses. This allows service projects to manage their own NAT gateways (e.g., configure NAT rules and logging) while the network administration team controls the outbound IPs by reserving the IP addresses in the host project. The IPs can be shared across multiple NAT gateways across different service projects, as long as they are in the same region and the IPs are allocated from a common pool in the host project. Option A is wrong because a single Cloud NAT in the host project cannot be managed by service projects. Option B is wrong because a NAT instance does not allow service projects to manage their own Cloud NAT; it is a single instance managed centrally. Option D is wrong because Private Google Access is for accessing Google APIs privately, not for general outbound NAT.

Answer

Create a single Cloud NAT in the host project and share it

Answer

Use a NAT instance with an external IP in the host project and route traffic from service projects

Answer

Use Private Google Access with Cloud NAT in the host project

Question 12

Which TWO of the following could cause a Dedicated Interconnect BGP session to go to the 'IDLE' state?

Accepted Answer

BGP is not enabled on the Cloud Router. BGP uses TCP port 179, not UDP. Blocking UDP port 179 has no effect on BGP session establishment. Options B and E are correct: BGP must be enabled on the Cloud Router, and the Cloud Router must be configured with the on-premises peer IP and ASN; otherwise, the session remains in IDLE state. Options C and D are incorrect: keepalive timer mismatch can cause hold timer expiry but does not prevent session establishment, and MED mismatch affects path selection, not session state.

Answer

Firewall rules blocking UDP port 179

Answer

BGP keepalive timer mismatch

Answer

Multi-Exit Discriminator (MED) mismatch

Question 13

A company uses Traffic Director with Envoy proxies to manage east-west traffic. They want to implement fault injection to test the resilience of their service mesh. Which TWO types of faults can they inject? (Choose two.)

Accepted Answer

Delay (add a fixed latency to matching requests). Traffic Director supports fault injection for abort (return an HTTP error) and delay (add latency). Throttle is not a supported fault injection type in Traffic Director; it is a rate-limiting feature that is not part of fault injection. Retry and Timeout are routing or circuit breaker features, not fault injection. Therefore, the two correct answers are abort (C) and delay (A).

Answer

Throttle (limit the rate of requests)

Answer

Retry (automatically retry failed requests)

Answer

Timeout (set a maximum time for a request to complete)

Question 14

A company is using Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer has created a VLAN attachment of type PARTNER_PROVIDER in Google Cloud. What must the service provider do to complete the connection?

Accepted Answer

Provide the engineer with a pairing key to attach the VLAN attachment to the interconnect.. For Partner Interconnect, the customer creates a VLAN attachment of type PARTNER (not PARTNER_PROVIDER) and gets a pairing key. The service provider uses this pairing key to connect their network to the customer's VLAN attachment. Therefore, the provider must provide the pairing key, not create a separate VLAN attachment. Option B correctly states this.

Answer

Create a VLAN attachment of type PARTNER on their end and associate it with the customer's VLAN attachment.

Answer

Assign a public IP address to the VLAN attachment.

Answer

Configure BGP routing with the customer's on-premises router.

Question 15

An organization has a global web application deployed behind an External HTTPS Load Balancer. They want to reduce egress costs for users in Europe who are served from the same region. The application is already using Cloud CDN. Which additional action will MOST effectively reduce egress costs for these users?

Accepted Answer

Nothing; Cloud CDN already minimizes egress costs. Cloud CDN caches content at edge locations closer to users, reducing egress costs by serving cached responses from the edge. For users in Europe, if the origin is in the US, Cloud CDN will serve from European caches after the first request, minimizing cross-region egress.

Answer

Use Cloud Armor to block non-European traffic

Answer

Deploy a regional load balancer in Europe

Answer

Enable Private Google Access

Question 16

A network engineer wants to monitor the operational status of a Dedicated Interconnect link using Cloud Monitoring. Which metric should they use to check if the physical link is up or down?

Accepted Answer

interconnect/link/operational_status. The metric `interconnect/link/operational_status` directly indicates whether the physical link is up (1) or down (0).

Answer

interconnect/network/received_bytes_count

Answer

vpn/tunnel/status

Answer

interconnect/network/packets_dropped_percent

Question 17

Which TWO of the following are benefits of using Shared VPC?

Accepted Answer

Automatic cross-project routing. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling automatic cross-project routing. This is because all subnets in the host project are directly reachable from any service project attached to that host, without needing additional VPC peering or VPN tunnels. Option B is correct because this inherent routing simplifies network connectivity and reduces administrative overhead.

Answer

Enhanced security through VPC Service Perimeters

Answer

Reduced IP address usage

Answer

Separation of network and application teams

Question 18

A network engineer is troubleshooting connectivity issues with VPC Flow Logs. Which TWO statements about VPC Flow Logs are correct? (Choose TWO)

Accepted Answer

VPC Flow Logs can be used to diagnose overly permissive firewall rules.. VPC Flow Logs capture metadata about accepted and rejected traffic, including traffic that is allowed by overly permissive firewall rules. By analyzing the logs, you can identify flows that should have been blocked, revealing rules that are too broad in scope (e.g., allowing all traffic from 0.0.0.0/0). This diagnostic capability directly helps tighten security posture.

Answer

VPC Flow Logs capture only egress traffic.

Answer

VPC Flow Logs only capture traffic that is allowed by firewall rules.

Answer

VPC Flow Logs capture all packets for every flow in the VPC.

Question 19

A company uses Shared VPC with multiple service projects. They need to allow certain service projects to create internal load balancers (ILBs) that are accessible from all projects in the organization. What is the best practice?

Accepted Answer

Create the ILB in the host project and share the backend. In a Shared VPC architecture, the host project owns the VPC network and its resources, including internal load balancers (ILBs). By creating the ILB in the host project and sharing its backend (e.g., instance groups from service projects), the ILB becomes accessible from all projects in the organization without additional connectivity. This approach centralizes network control and ensures the ILB's IP address is routable within the shared VPC, meeting the requirement for cross-project access.

Answer

Deploy ILB in each service project and use global access

Answer

Use Cloud NAT for outbound connectivity

Answer

Use VPC peering between each service project and the host project

Answer

Enable Private Service Connect

Question 20

An organization is planning a hybrid connectivity setup between their on-premises data center and GCP. They require a 99.99% SLA and want to use a single physical connection at 10 Gbps. Which connectivity option should they choose?

Accepted Answer

HA VPN with two external IP addresses and four tunnels. The customer requires a 99.99% SLA and wants to use a single physical connection at 10 Gbps. However, no physical connection option (Dedicated Interconnect or Partner Interconnect) can provide a 99.99% SLA with just one physical link—they require multiple links for redundancy. Therefore, the best option that meets the 99.99% SLA requirement without requiring multiple physical connections is HA VPN, which uses a logical VPN connection over the internet, not a physical one. When configured with two external IP addresses and four tunnels, HA VPN achieves the 99.99% SLA. Thus, HA VPN is the only viable choice given the constraints.

Answer

Dedicated Interconnect with a single 10 Gbps link and single VLAN attachment

Answer

Partner Interconnect with 10 Gbps link

Answer

Dedicated Interconnect with two 10 Gbps links (one active, one standby) and two VLAN attachments