PCNE Practice Exam 58 — 20 Questions

Question 1

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Accepted Answer

Assign an external IP address to the VM.. A VM must have an external (public) IP address assigned to be directly reachable from the internet. Without an external IP, the VM cannot receive inbound traffic initiated from outside the VPC, even with proper firewall rules. This is a fundamental requirement for internet-facing workloads in Google Cloud.

Answer

Configure Cloud NAT for the VPC.

Answer

Enable Private Google Access on the subnet.

Answer

Assign a static internal IP address to the VM.

Question 2

A company wants to use Cloud DNS response policy zones (RPZ) to override DNS responses for a set of internal domains. They need to ensure that only specific VPC networks can use these overrides. Which three steps are required? (Choose three.)

Accepted Answer

Bind the response policy zone to the desired VPC networks. To use RPZ, you must create the response policy zone, bind it to the target VPC network(s), and ensure that the DNS queries from those VPCs use Cloud DNS. Additionally, you may need to configure the resolver. The correct steps: create the RPZ, bind it to VPC networks, and specify the DNS overrides (rules).

Answer

Create a forwarding zone for the overridden domains

Answer

Enable DNSSEC on the response policy zone

Question 3

A company uses Shared VPC with multiple service projects. The security team wants to ensure that only specific service projects can create firewall rules that allow ingress traffic to the Shared VPC network. What is the best practice?

Accepted Answer

Grant the compute.securityAdmin role to a group with a condition that limits access to only the service projects that need it, using the resource.name condition.. The compute.securityAdmin role allows users to create firewall rules, and by applying a condition on the resource.name, you can restrict this permission to only specific service projects. This ensures that only authorized service projects can create ingress firewall rules in the Shared VPC network, aligning with the security team's requirement.

Answer

Disable firewall rule creation by setting an organization policy constraint.

Answer

Grant the compute.securityAdmin role to a group at the organization level.

Answer

Grant the compute.securityAdmin role to the service project owners at the host project level.

Question 4

Refer to the exhibit. An engineer has configured HA VPN with two tunnels (tunnel-a and tunnel-b) to an on-premises network. The BGP session for peer-b is in IDLE state. What is the most likely cause?

Accepted Answer

The on-premises router's BGP configuration for peer-b has a wrong IP address.. The BGP session for peer-b is in IDLE state, which typically indicates a TCP connection failure. Since tunnel-a is working, the Cloud Router and VPN gateway are correctly configured, and the issue is specific to peer-b. The most likely cause is that the on-premises router's BGP configuration for peer-b has the wrong IP address (e.g., the wrong BGP peer IP or the wrong Cloud Router interface IP), preventing the TCP handshake from completing.

Answer

The Cloud Router is not in the same region as the VPN gateway.

Answer

The on-premises router is not advertising any routes.

Answer

The pre-shared key for tunnel-b is incorrect.

Question 5

An engineer is configuring a Global HTTPS Load Balancer with a serverless NEG pointing to Cloud Run. The deployment fails with a health check error. What is the most likely cause?

Accepted Answer

The serverless NEG does not support health checks. Serverless NEGs do not require health checks; the health check configuration is ignored. The error may be due to incorrect IAM permissions or service account.

Answer

The Cloud Run service is not deployed

Answer

The health check interval is too short

Answer

The SSL certificate is misconfigured

Question 6

A multinational company is migrating workloads to Google Cloud and requires a hybrid connectivity solution between their on-premises data centers in New York and London and Google Cloud regions us-central1 and europe-west1. Each data center has a pair of redundant border routers. The network team has set up a Dedicated Interconnect connection in each Google Cloud region, with two VLAN attachments per region (total 4 attachments). Each VLAN attachment is associated with a separate Cloud Router. The Cloud Routers in us-central1 are configured with BGP sessions to the on-premises routers in New York, and the Cloud Routers in europe-west1 peer with the London routers. The VPC is in 'global' dynamic routing mode. After deployment, traffic from on-premises London to Google Cloud in us-central1 takes a suboptimal path: it goes from London to us-central1 via the internet instead of using the Dedicated Interconnect in europe-west1 and then internal Google Cloud backbone. All BGP sessions are up, and routes are being exchanged. The on-premises routers are advertising all their subnets. The Cloud Routers are learning the on-premises prefixes. What is the most likely cause of this suboptimal routing?

Accepted Answer

The on-premises London routers are not receiving routes for the VPC subnets in us-central1, so they send traffic via the internet.. The on-premises London routers are not receiving routes for the VPC subnets in us-central1. Since the Cloud Routers in europe-west1 only peer with London, they must advertise the us-central1 VPC subnets to London via BGP. If those routes are missing, London has no path via the Dedicated Interconnect and falls back to the internet. The VPC is in global dynamic routing mode, so Cloud Routers in both regions learn all VPC subnets, but the europe-west1 Cloud Router must explicitly advertise them to London.

Answer

The VPC subnets in us-central1 are using smaller prefixes that are not being summarized by the Cloud Router.

Answer

The Cloud Router in europe-west1 is prepending AS path for routes coming from us-central1, making them less preferred.

Answer

The on-premises New York routers are setting a lower MED for routes to us-central1, causing London to deprefer them.

Question 7

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have ordered a circuit from a telecom provider and need to complete the setup. Which of the following steps is required during the provisioning process?

Accepted Answer

Create a VLAN attachment in the Google Cloud Console.. When provisioning a Dedicated Interconnect, after the telecom provider has delivered the circuit to the meet-me room, you must create a VLAN attachment (formerly called a VLAN attachment or interconnect attachment) in the Google Cloud Console. This attachment defines the VLAN and the Cloud Router that will establish BGP peering with your on-premises router, making it the essential step to complete the Layer 2 and Layer 3 connectivity.

Answer

Set up a VPN tunnel for redundancy.

Answer

Configure on-premises DNS forwarding to Cloud DNS.

Answer

Configure the Cloud Router BGP session before ordering the circuit.

Question 8

A company is using Cloud VPN with BGP to connect their on-premises network to Google Cloud. They have two VPN tunnels from two different on-premises VPN gateways to a single Cloud VPN gateway. They notice that during maintenance on one on-premises gateway, traffic fails over to the other tunnel, but after the maintenance, traffic does not fail back. What is the most likely cause?

Accepted Answer

The BGP local preference on the primary tunnel is not higher than the backup tunnel. B is correct because BGP local preference is used to influence outbound traffic path selection. If the primary tunnel's local preference is not higher than the backup tunnel, BGP will not prefer the primary route after the backup session recovers, causing traffic to remain on the backup tunnel. This is a classic BGP route selection behavior where the highest local preference wins.

Answer

Only one VPN tunnel can be active at a time

Answer

Cloud VPN gateway does not support BGP

Answer

The backup tunnel does not have a valid BGP session

Question 9

A company has a VPC with three subnets and multiple firewall rules. They want to ensure that the most specific firewall rule takes precedence when there is a conflict. What is the default evaluation order of firewall rules?

Accepted Answer

The rule with the highest priority (lowest priority number) is evaluated first.. In Google Cloud Platform (GCP) VPC firewall rules, the default evaluation order is based on priority. Each rule is assigned a priority number from 0 to 65535 (lower number = higher priority), and rules are evaluated from highest priority (lowest number) to lowest priority. When multiple rules match traffic, the rule with the highest priority (lowest priority number) is applied first, and its action (allow/deny) is definitive; lower-priority rules are not evaluated for that traffic.

Answer

Egress rules are evaluated before ingress rules.

Answer

The more restrictive rule (with smaller IP range) is applied first.

Answer

Rules are evaluated in the order they were created.

Question 10

Match each Cloud Router BGP attribute to its function.

Accepted Answer

ASN: The autonomous system number for the Cloud Router. The correct matches: ASN → local autonomous system number, BGP peer IP → on-premises router IP, Advertised route priority → MED value. Common confusions include swapping ASN with peer IP, and route priority with advertised IP ranges.

Answer

ASN: The IP address of the BGP peer on the on-premises side

Answer

BGP peer IP: The autonomous system number for the Cloud Router

Answer

Advertised route priority: The IP range advertised to the peer

Question 11

A large enterprise has multiple on-premises data centers connected to Google Cloud via a combination of Dedicated Interconnect and Cloud VPN. They have a VPC with subnets in us-east1 and us-west1. The on-premises network advertises a prefix 10.0.0.0/8 to both Cloud Routers (each in different regions) via BGP. The Cloud Routers are configured with 'global' dynamic routing mode. The network team notices that traffic from Google Cloud instances in us-west1 to on-premises destinations in 10.0.0.0/8 is always taking the path to the closest on-premises data center (west coast) even though the west coast data center is currently under high load, causing performance degradation. The east coast data center is underutilized. They want to influence the path selection so that the west coast instances prefer the east coast data center during peak times. They are using BGP. What is the most effective method to achieve this?

Accepted Answer

Use BGP communities to tag routes from the west coast data center under load, and configure Cloud Router to match these communities and adjust the route priority (MED) accordingly.. BGP communities allow the west coast data center to tag its routes with a community value indicating high load. The Cloud Router can then be configured to match this community and adjust the route priority by lowering the MED (or local preference) for those routes, making the east coast data center's routes more preferred. This dynamic, policy-based approach directly addresses the need to shift traffic away from the overloaded west coast data center without manual reconfiguration.

Answer

Set a higher local preference on the west coast Cloud Router for routes received from the east coast data center.

Answer

Set a higher MED on the west coast data center's BGP advertisements to increase its desirability.

Answer

Configure the east coast data center to prepend one additional AS path hop to its advertised routes.

Question 12

A financial services company is deploying a multi-tier application in a custom VPC with three subnets: web (10.0.1.0/24), app (10.0.2.0/24), and db (10.0.3.0/24). They use a Cloud VPN with dynamic routing (BGP) to connect to their on-premises data center (10.1.0.0/16). The on-premises network administrator reports that traffic from the web tier (10.0.1.0/24) to on-premises is working, but traffic from the app tier (10.0.2.0/24) to on-premises is failing. The company uses an Identity-Aware Proxy (IAP) for SSH access. The following configurations are in place:
- Cloud Router advertises all VPC subnets via BGP.
- On-premises router advertises 10.1.0.0/16.
- Firewall rules allow all traffic from 10.0.0.0/16 to 10.1.0.0/16.
- The app tier instances have a network tag 'app-tier' and a service account 'app-sa@project.iam.gserviceaccount.com'.
- There is a firewall rule with priority 1000 that denies egress from tags 'app-tier' to 10.1.0.0/16.
What is the most likely cause of the failure?

Accepted Answer

A firewall egress rule with priority 1000 denies traffic from instances with tag 'app-tier' to 10.1.0.0/16.. The firewall egress rule with priority 1000 explicitly denies traffic from instances tagged 'app-tier' to the on-premises network (10.1.0.0/16). Since firewall rules are evaluated in order of priority (lower numbers are higher priority), and this rule has a relatively low priority number, it will override any higher-numbered (lower priority) allow rules. The fact that web tier traffic works confirms that routing and VPN are functional, isolating the issue to the egress deny rule targeting the app tier.

Answer

The service account 'app-sa' does not have permissions to send traffic through the VPN.

Answer

IAP is blocking traffic from the app tier because it is not configured for that subnet.

Answer

The Cloud Router is not advertising the 10.0.2.0/24 subnet to on-premises.

Question 13

A large enterprise has a multi-site on-premises network with two data centers (DC1 and DC2) connected via a private WAN. They are migrating critical applications to Google Cloud and have established a Dedicated Interconnect at each data center, each with a single VLAN attachment (vlan-attachment-1 from DC1, vlan-attachment-2 from DC2) connected to a single VPC network in us-central1. Each VLAN attachment uses a separate Cloud Router (router-us-central1-dc1 and router-us-central1-dc2) with BGP sessions advertising the same on-premises prefixes. The VPC has auto-mode subnet ranges. They notice that traffic from Google Cloud to on-premises is flowing only through DC1, and when DC1's interconnect fails, traffic fails over to DC2, but after DC1 recovers, traffic does not return to DC1. The on-premises routers are advertising the same prefixes with equal MED values. What is the most likely cause and the best corrective action?

Accepted Answer

Configure the on-premises router at DC1 to set a lower MED value for its advertised routes to make DC1 preferred. With equal MED values from both on-premises routers, Google Cloud's Cloud Routers will prefer the first learned route and stick to it due to the default BGP best-path selection behavior (no tie-breaking based on router ID or other attributes when routes are identical). When DC1's interconnect fails, the route is withdrawn, and traffic fails over to DC2. After DC1 recovers, the route is re-advertised, but Cloud Router does not automatically preempt the existing DC2 route because the BGP best-path selection is stable and does not re-evaluate unless the current best path is withdrawn. Setting a lower MED on DC1's advertised routes makes DC1's route more preferred, ensuring traffic returns to DC1 after recovery.

Answer

Change the VPC routing mode from auto to custom to force route re-evaluation

Answer

Disable the BGP session on DC2's Cloud Router during normal operation and re-enable it only when DC1 fails

Answer

On the Google Cloud Router for DC1, apply a route policy to set a higher local preference for routes learned from DC1

Question 14

A company uses Shared VPC with a host project and multiple service projects. A service project administrator wants to create a VM with an internal IP from a specific subnet in the host project. The operation fails with a permission error. What is the most likely missing permission?

Accepted Answer

compute.subnetworks.use on the host project subnet.. To create a VM in a service project using a subnet from the host project, the service project administrator needs the compute.subnetworks.use permission on that specific subnet. This permission is granted through the roles/compute.networkUser role. Option A is incorrect because resourcemanager.projects.get is not related to subnet usage. Option C is incorrect because compute.instances.create is for creating instances globally, but the missing permission is for using the subnet. Option D is incorrect because compute.networks.use is for using the VPC network, but the error is more specific to subnet use.

Answer

resourcemanager.projects.get on the host project.

Answer

compute.instances.create on the service project.

Answer

compute.networks.use on the host project VPC.

Question 15

An organization wants to design IP addresses for their GCP VPC that will be peered with an on-premises network using 10.0.0.0/8. Which subnet IP range should they avoid to prevent overlap?

Accepted Answer

10.1.0.0/16. Both option A (10.1.0.0/16) and option C (10.0.0.0/8) overlap with the on-premises network using 10.0.0.0/8. Option A is a subset, and option C is the exact same range. Peering requires non-overlapping CIDR blocks, so both must be avoided.

Answer

192.168.0.0/16

Answer

172.16.0.0/12

Question 16

A company wants to distribute traffic across multiple backend services based on the geographic location of the user. They are using an external HTTPS load balancer. Which routing configuration should they use?

Accepted Answer

Use a URL map with route rules that use a header matching condition based on Cloud Armor geo headers. The URL map of a load balancer supports route rules. To route based on geographic location, you can use advanced traffic management with weighted routing based on origin region. However, the simplest approach is to use a multicloud or global load balancer with policies, but for a single load balancer, you can use a URL map with route rules that match based on request headers (like Cloud Armor geo headers) or use a backend bucket with CDN. The most common method is to use a global load balancer with a URL map and route rules that include conditions based on geographic location using a pre-defined variable like {client_region}.

Answer

Use a URL map with route rules that match on the Host header

Answer

Configure the load balancer with a weighted round-robin routing policy

Answer

Use Cloud DNS with geolocation routing policy to direct users to different load balancers

Question 17

A company wants to deploy a web application with a public-facing load balancer and a private backend. The backend instances must not have external IPs. Which statement about the VPC configuration is correct?

Accepted Answer

No additional configuration is required beyond creating the subnet.. Instances without external IPs can still receive traffic from a public load balancer. No additional configuration such as NAT or Private Google Access is needed. Option A is incorrect because Cloud NAT provides outbound internet access, not required for load balancer traffic. Option B is incorrect because the backend subnet does not need a default route to the internet; the load balancer uses internal routing. Option C is incorrect because Private Google Access is for accessing Google APIs, not for load balancer traffic.

Answer

Cloud NAT must be configured for the backend subnet.

Answer

The backend subnet must have a default route to the internet.

Answer

Private Google Access must be enabled on the backend subnet.

Question 18

A company is designing a hybrid network between their on-premises data center and Google Cloud. They need high availability for traffic between the two environments and want to use Cloud VPN with dynamic routing. Which configuration ensures that if one VPN tunnel fails, traffic automatically fails over to the other tunnel without manual intervention?

Accepted Answer

Create two VPN tunnels to two separate peer VPN gateways on-premises, and use Cloud Router with BGP to advertise routes from both tunnels.. It uses two VPN tunnels to separate on-premises peer gateways with Cloud Router and BGP. BGP automatically handles failover by withdrawing routes from the failed tunnel and advertising routes via the healthy tunnel, ensuring traffic fails over without manual intervention. This meets the high availability and dynamic routing requirements specified in the question.

Answer

Create one VPN tunnel and a static route with next hop set to the VPN gateway.

Answer

Use Cloud Interconnect instead of VPN, and configure two VLAN attachments.

Answer

Create two VPN tunnels to the same peer VPN gateway, and configure equal-cost multi-path (ECMP) routing with static routes.

Question 19

Which THREE of the following are requirements for implementing a Global External HTTP(S) Load Balancer with an external backend?

Accepted Answer

The backend must support health checks from the load balancer's health check IP ranges.. Global External HTTP(S) Load Balancers use Google's frontend (proxying) IP ranges to send health checks to backends. The backend must allow inbound traffic from these specific health check IP ranges (e.g., 35.191.0.0/16 and 130.211.0.0/22) to receive health probes; otherwise, the load balancer will mark the backend as unhealthy and stop forwarding traffic.

Answer

The backend must be configured with Private Google Access.

Answer

The backend must have an SSL certificate installed.

Question 20

A network engineer needs to test connectivity after setting up a Dedicated Interconnect VLAN attachment and BGP session. Which tool should they use to verify that Google Cloud can reach an on-premises IP address?

Accepted Answer

ping and traceroute from a Google Cloud VM to the on-premises IP.. The standard tools to test connectivity are ping (ICMP echo) and traceroute (path discovery). They are used after BGP is established to verify end-to-end reachability.

Answer

gcloud compute interconnect list command.

Answer

Cloud Monitoring dashboard for interconnect metrics.

Answer

tcpdump on the on-premises router.