PCNE Practice Exam 59 — 20 Questions

Question 1

A company deploys a web application behind a global external HTTP(S) load balancer and wants to protect against SQL injection attacks. Which Google Cloud security product should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities, including pre-configured rules to filter SQL injection (SQLi) attacks at the edge of Google's network, before traffic reaches the backend. It integrates directly with the global external HTTP(S) load balancer to inspect HTTP/HTTPS requests and block malicious payloads based on OWASP Top 10 signatures.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Answer

Cloud IDS

Question 2

An engineer creates a Cloud NAT configuration as shown in the exhibit. The test-instance is created without an external IP address. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The subnet subnet-a is in a region different from us-central1. Cloud NAT is a regional resource that applies to all instances within a given region. The exhibit shows subnet-a is in a different region than us-central1, so the NAT gateway cannot route traffic from instances in that subnet. Even though the instance is in us-central1, the subnet's region mismatch means the NAT configuration does not apply, leaving the instance without internet access.

Answer

The Cloud Router is not in the same zone as the instance

Answer

A firewall rule is blocking outbound traffic from the instance

Answer

Logging is enabled but not configured to send logs to Cloud Logging

Question 3

A company has a GKE cluster with pods and services that need to communicate with on-premises resources over a VPN. The on-premises firewall requires the source IP of the pods to be from a specific range. Which secondary IP ranges should be configured on the VPC subnet?

Accepted Answer

Secondary pod range and secondary service range. In GKE, pods are assigned IP addresses from the secondary pod range, and services (of type ClusterIP) are assigned IPs from the secondary service range. For on-premises resources to allow traffic from pods via a VPN, the firewall must see the pod IPs (not node IPs), so the secondary pod range must be configured on the VPC subnet. The secondary service range is also required for service discovery and proper routing, but the source IP seen by on-premises will be the pod IP from the secondary pod range.

Answer

Primary IP range and secondary pod range

Answer

Only the secondary service range

Answer

Primary IP range and secondary service range

Question 4

Refer to the exhibit. A project has the IAM policy shown. Alice is trying to delete a VPC firewall rule but receives a permission error. What is the most likely reason?

Accepted Answer

Alice has the role roles/compute.securityAdmin, which should allow deletion; perhaps the rule is managed by another service. Alice has the role roles/compute.securityAdmin, which includes the compute.firewalls.delete permission. However, if the VPC firewall rule is managed by another service (e.g., Firewall Rules Manager, Google Cloud Armor, or a managed service like GKE), the rule may have a 'managed' label or be part of a service-managed resource hierarchy that prevents direct deletion via the compute.firewalls.delete API. In such cases, the rule must be deleted through the managing service, not directly via the firewall rules API, leading to a permission error despite having the correct role.

Answer

The IAM policy has a condition that denies deletion after business hours

Answer

An organization policy prevents deletion of firewall rules in this project

Answer

Bob has the role roles/compute.networkAdmin, which does not include permissions to delete firewall rules

Question 5

A company wants to allow HTTP traffic from the internet to a web server running on a Compute Engine VM in a VPC. The web server should only be accessible on port 80. Which firewall rule should be created?

Accepted Answer

Ingress rule: allow tcp:80 from 0.0.0.0/0 (target tags: web-server). HTTP traffic from the internet (source 0.0.0.0/0) must be allowed by an ingress firewall rule targeting the web server VM. The rule specifies TCP port 80, which is the standard HTTP port, and uses target tags 'web-server' to apply the rule only to VMs with that tag, ensuring the web server is accessible on port 80 from any source.

Answer

Egress rule: allow tcp:80 from 0.0.0.0/0 (target tags: web-server)

Answer

Ingress rule: allow tcp:443 from 0.0.0.0/0 (target tags: web-server)

Answer

Ingress rule: allow tcp:80 from 0.0.0.0/0 (target tags: default)

Question 6

A company uses an internal TCP/UDP load balancer to distribute traffic to a backend service. The backend instances are in an unmanaged instance group. Some instances fail health checks and are removed. What happens to existing connections to failed instances?

Accepted Answer

Existing connections are terminated immediately.. When an instance in an unmanaged instance group fails a health check, the internal TCP/UDP load balancer immediately terminates all existing connections to that instance. This is because the load balancer does not support connection draining for unmanaged instance groups; it simply stops forwarding new traffic and drops existing flows to the failed instance. The abrupt termination occurs because the load balancer operates at Layer 4 and has no mechanism to gracefully close TCP connections or wait for application-level cleanup.

Answer

The load balancer drains existing connections before removing the instance.

Answer

Existing connections are seamlessly redirected to healthy instances.

Answer

The load balancer waits for all existing connections to close before removing the instance.

Question 7

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

Accepted Answer

Use Private Service Connect to publish the database as a managed service and create a Private Service Connect endpoint in the spoke VPC with IAM permissions for the specific VM service accounts. Private Service Connect (PSC) allows you to publish a managed service (like Cloud SQL) and create a PSC endpoint in the spoke VPC. By combining the PSC endpoint with IAM permissions on the VM service accounts, you ensure that only specific VMs can connect to the database, providing fine-grained, identity-aware access control without exposing the database to the entire network.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and configure IAM permissions for each VM's service account

Answer

Use Shared VPC and assign the specific VMs to a subnet with a dedicated secondary IP range, then restrict database access to that range

Answer

Configure firewall rules in the hub project to allow traffic only from the specific VM internal IPs

Question 8

A company is migrating on-premises DNS to Google Cloud. They have a hybrid network using Cloud VPN and want to resolve on-premises hostnames from Compute Engine instances without custom scripts. Which service should they use?

Accepted Answer

Use Cloud DNS inbound server policy to forward queries to on-premises DNS.. Cloud DNS inbound server policy allows on-premises DNS servers to receive DNS queries from Compute Engine instances by creating a VPC-scoped policy that forwards queries to the IP addresses of on-premises DNS resolvers over Cloud VPN. This enables hybrid name resolution without custom scripts, as the policy automatically handles the forwarding of DNS requests from Google Cloud resources to the on-premises DNS infrastructure.

Answer

Create a forwarding zone in Cloud DNS and associate it with the VPC.

Answer

Enable Private Google Access on the VPC subnet.

Answer

Configure Cloud NAT to forward DNS queries to on-premises DNS servers.

Question 9

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

Accepted Answer

Configure active-active BGP with multiple sessions using the same ASN.. The best practice for HA VPN is to use active-active BGP with multiple sessions, using the same ASN on all on-premises routers. This enables ECMP and ensures symmetric routing. Option B correctly describes this configuration.

Answer

Configure active-passive BGP with a single session.

Answer

Use policy-based routing to fail between tunnels.

Answer

Use static routes with a primary and backup route.

Question 10

A team has deployed Compute Engine instances with internal IPs only. They need to allow these instances to download updates from specific external IP ranges. Which action should they take?

Accepted Answer

Create egress firewall rules with target tags and allowed IP ranges.. Egress firewall rules with target tags allow you to control outbound traffic from Compute Engine instances based on destination IP ranges. By specifying the allowed external IP ranges for updates and applying the rule to instances with a specific tag, you enable secure outbound access without exposing the instances to inbound traffic or requiring public IPs.

Answer

Configure Cloud NAT and allow all traffic.

Answer

Attach a public IP to each instance.

Answer

Use Private Google Access.

Question 11

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They require high availability for the connection. Which TWO of the following are recommended by Google for achieving high availability? (Choose two.)

Accepted Answer

Order two Dedicated Interconnect connections in the same metro. Google recommends ordering two Dedicated Interconnect connections in the same metro to provide link-level redundancy. Option E is correct because connecting to two different Interconnect locations (POPs) provides site-level redundancy, protecting against a single POP failure. Together, these two approaches ensure high availability for the hybrid connection.

Answer

Use a single Dedicated Interconnect with double the bandwidth

Answer

Connect to two different edge availability domains in the same POP

Answer

Order connections from two different service providers

Question 12

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

Accepted Answer

Check the MTU size on the VPN tunnel or interconnect.. An MTU mismatch on the VPN tunnel or interconnect can cause packet fragmentation or drops, leading to BGP session flapping. Cloud Router uses Google's internal infrastructure, and if the MTU is set too low, large BGP update packets may be silently discarded, triggering hold timer expiry and session resets. Checking and adjusting the MTU ensures that BGP packets can traverse the path without fragmentation.

Answer

Delete and recreate the VLAN attachment.

Answer

Revert all BGP routes to static routes.

Answer

Increase the bandwidth of the interconnect.

Question 13

A network engineer needs to configure firewall rules to allow health checks from Google Cloud's health check systems to a backend service. Which two source IP ranges should they allow? (Choose two.)

Accepted Answer

130.211.0.0/22. Google Cloud health check probes originate from the specific IP ranges 130.211.0.0/22 and 35.191.0.0/16. Allowing these source ranges in firewall rules is necessary to permit health check traffic to reach backend instances, ensuring load balancers can determine instance health.

Answer

169.254.0.0/16

Answer

10.0.0.0/8

Answer

0.0.0.0/0

Question 14

A large enterprise uses hierarchical firewall policies across multiple VPCs. They have an organization policy that requires all VPCs to block SSH from the internet. However, a development team needs SSH from a specific external IP range for a building. How can they create a firewall rule that allows that range without violating the organization policy?

Accepted Answer

Create a project-level firewall policy with a priority higher than the organization policy's deny rule, allowing the specific source range.. In Google Cloud, hierarchical firewall policies are evaluated before VPC firewall rules, and the effective rule is the one with the highest priority (lowest numeric value). By creating a project-level firewall policy rule with a higher priority (e.g., priority 100) than the organization policy's deny rule (e.g., priority 1000), the allow rule for the specific external IP range will take precedence, effectively overriding the deny for that traffic while keeping the organization policy intact.

Answer

Remove the organization policy and implement firewall rules at the project level only.

Answer

Use VPC firewall rules instead of hierarchical policies to allow the range, as they are evaluated after hierarchical policies.

Answer

Add the external IP range to an exception list in the organization policy.

Question 15

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth of at least 10 Gbps. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect with two circuits (each 10 Gbps) to different edge locations. Dedicated Interconnect with two 10 Gbps circuits to different edge locations meets the 10 Gbps bandwidth requirement and provides high availability through diverse physical paths. Cloud VPN maxes out at 3 Gbps per tunnel, Direct Peering does not offer SLA-backed bandwidth or support for 10 Gbps single connections, and Partner Interconnect typically caps at 1 Gbps per VLAN attachment.

Answer

Cloud VPN with two tunnels to different gateways

Answer

Direct Peering with multiple BGP sessions

Answer

Partner Interconnect with 1 Gbps VLAN attachments

Question 16

A company is designing a network architecture with multiple VPCs and on-premises connectivity via Cloud VPN. They want to avoid IP address conflicts and ensure secure communication. Which three best practices should they follow? (Choose three.)

Accepted Answer

Use unique RFC 1918 IP address ranges for each VPC.. Using unique RFC 1918 IP address ranges for each VPC prevents overlapping IP spaces, which is critical when connecting multiple VPCs and on-premises networks via Cloud VPN. Overlapping ranges would cause routing conflicts and make it impossible for Cloud Router and BGP to establish proper path selection, leading to dropped or misrouted traffic.

Answer

Use Cloud NAT for all outbound internet traffic from private VMs.

Answer

Enable VPC Network Peering between all VPCs to enable direct communication.

Question 17

A company wants to allow instances in a VPC without external IPs to access Google APIs like BigQuery and Cloud Storage. Which configuration is required?

Accepted Answer

Enable Private Google Access on the subnet. Private Google Access enables instances without external IPs to reach Google APIs via internal IP addresses using the private.googleapis.com (199.36.153.8/30) or restricted.googleapis.com (199.36.153.4/30) VIPs. It must be enabled per subnet.

Answer

Create a VPC peering with the Google APIs VPC

Answer

Assign external IPs to all instances

Answer

Configure a Cloud NAT gateway in the region

Question 18

A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?

Accepted Answer

The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.. A custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface is required to force traffic to go through that specific tunnel. Option B is incorrect because Cloud NAT is for outbound internet access, not routing to on-premises. Option C is incorrect because firewall rules control access but not routing. Option D is incorrect because on-premises BGP advertisement is for routes from on-premises to Google Cloud, not for directing traffic within Google Cloud.

Answer

Cloud NAT is enabled.

Answer

Firewall rules allow ingress from on-premises IPs.

Answer

The on-premises router is advertising the route via BGP.

Question 19

A security team wants to restrict which Google services can be accessed from their VPC without external IPs. They use Private Google Access. What should they use to block access to specific services?

Accepted Answer

VPC Service Controls. VPC Service Controls allows creating security perimeters that restrict access to services.

Answer

Firewall rules blocking destination IPs

Answer

Cloud NAT with a specific IP range

Answer

Private Google Access with restricted VIPs

Question 20

A company wants to route traffic to different backend services based on the geographic location of the client. Which Cloud DNS routing policy should they use?

Accepted Answer

Geolocation. Geolocation routing policy directs traffic to different backends based on the geographic location of the DNS resolver.

Answer

Weighted round robin

Answer

Failover

Answer

Cloud CDN