PCNE Practice Test 6 — 10 Questions

Question 1

A company has a Dedicated Interconnect connection with a VLAN attachment in their GCP VPC. They want to use BGP to exchange routes with their on-premises router. Which GCP resource must be configured to establish the BGP session?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Router. A Cloud Router is required to establish BGP sessions over VLAN attachments. The Cloud Router manages BGP peers and route advertisements.

Answer

VPC peering

Answer

Network Connectivity Center

Answer

Cloud VPN gateway

Question 2

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

Accepted Answer

The engineer forgot to add firewall rules to allow traffic from the peer range.. The most likely cause is that the engineer forgot to add firewall rules to allow traffic from the peer range. Even though VPC peering is ACTIVE, the default ingress deny all firewall rule blocks incoming traffic. To allow communication between instances in peered VPCs, you must create ingress firewall rules in each VPC that permit traffic from the other VPC's subnet CIDR ranges.

Answer

The VPCs use different routing modes.

Answer

The IAM permissions for the peering are missing.

Answer

The VPCs have overlapping subnet CIDR ranges.

Question 3

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Accepted Answer

Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.. Cloud NAT in Google Cloud can be scoped to specific instances using network tags. By applying a network tag to the instances that should use NAT and then creating a Cloud NAT gateway with that tag, only those tagged instances will have their traffic NATed. This allows granular control without affecting other instances in the same subnet.

Answer

Assign external IPs to non-NAT instances.

Answer

Use firewall rules to allow NAT for tagged instances.

Answer

Create separate subnets for NAT instances.

Question 4

A company wants to resolve DNS queries from their on-premises network for a privately hosted zone in Google Cloud (e.g., example.internal). They also want on-premises DNS servers to resolve GCP internal VM hostnames. Which two Cloud DNS features should they implement? (Choose TWO.)

Accepted Answer

DNS peering. DNS peering allows on-premises to query GCP private zones, and DNS forwarding (inbound) allows GCP to forward queries to on-premises DNS servers.

Answer

Public zone delegation

Answer

DNS forwarding (outbound)

Answer

Split-horizon DNS

Question 5

A company is using a Classic VPN with static routing to connect to GCP. They need to add a new subnet in GCP and make it reachable from on-premises without manual configuration changes on-premises. What is the limitation of Classic VPN in this scenario?

Accepted Answer

Classic VPN requires manual route updates on-premises. Classic VPN with static routing requires manual configuration of routes on both the GCP side and the on-premises side. When adding a new subnet in GCP, the on-premises router must be manually updated to include the new subnet in its routing table, otherwise traffic to that subnet will not be routed through the VPN. This is a limitation because it does not support dynamic route advertisement.

Answer

Classic VPN does not support IKEv2

Answer

Classic VPN supports BGP, so routes are automatically advertised

Answer

Classic VPN cannot be used with multiple subnets

Question 6

An organization has multiple VPCs in different projects that need to share subnets to create a common network segment. They want central control over network administration while allowing individual project teams to deploy resources. Which approach should they use?

Accepted Answer

Shared VPC with a host project and service projects. Shared VPC allows a host project to share subnets with service projects, providing central network administration while allowing teams to deploy resources independently.

Answer

VPN tunnels connecting all VPCs

Answer

VPC Network Peering between all VPCs

Answer

Creating a single VPC in one project and granting IAM permissions to other projects

Question 7

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

Accepted Answer

Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.. A Google Cloud HA VPN gateway has two interfaces, each with its own external IP, and requires two VPN tunnels — one per interface — to achieve 99.99% availability. Each tunnel must have its own BGP session with the on-premises VPN device, and the on-premises device must be configured to peer with both. This creates the redundant tunnel pair that HA VPN is designed for.

Answer

Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.

Answer

Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.

Answer

Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.

Question 8

A company has two HA VPN tunnels between GCP and on-premises. They want to use both tunnels simultaneously for load balancing traffic. Which BGP feature should they configure on the Cloud Router to achieve equal-cost multipath (ECMP)?

Accepted Answer

Advertise identical routes with equal BGP metrics (AS path length, MED, etc.) from both tunnels.. ECMP is achieved by having multiple BGP paths with equal MED and AS path length. The Cloud Router automatically load balances if routes have equal metrics.

Answer

Use AS path prepending on one tunnel.

Answer

Set different MED values on each tunnel to prefer one.

Answer

Enable policy-based VPN instead of route-based.

Question 9

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's edge security service that attaches to HTTP(S) Load Balancers and provides WAF capabilities via preconfigured rules such as the OWASP ModSecurity Core Rule Set, which specifically detects and blocks SQL injection (SQLi) and cross-site scripting (XSS). Because it operates at the load balancer layer (Layer 7), it can inspect HTTP request headers, URLs, and bodies where these web exploits live. Firewall rules and Cloud IDS operate at different layers and cannot perform application-layer payload inspection for these attack types.

Answer

Firewall Rules

Answer

Cloud IDS

Answer

VPC Service Controls

Question 10

Which Google Cloud hybrid connectivity option can be configured without using BGP?

Accepted Answer

Classic VPN with static routes. Classic VPN can be configured with static routes and does not require BGP. Partner Interconnect and Dedicated Interconnect require BGP for routing. HA VPN also typically uses BGP for dynamic routing, making D the only option that can operate without BGP.

Answer

Partner Interconnect

Answer

Dedicated Interconnect

Answer

HA VPN