PCNE Practice Test 6 — 10 Questions

Question 1

A company wants to enforce that all HTTPS load balancer traffic uses TLS 1.2 or higher. Which Google Cloud resource should they configure?

Accepted Answer

SSL policy attached to the target HTTPS proxy. An SSL policy in Google Cloud can be attached to a target HTTPS proxy to enforce minimum TLS version requirements, such as TLS 1.2 or higher. This policy directly controls the TLS handshake parameters at the load balancer level, ensuring that only clients supporting TLS 1.2 or above can establish HTTPS connections.

Answer

SSL certificate resource

Answer

VPC firewall rule to block TLS 1.0/1.1

Answer

Identity-Aware Proxy (IAP)

Question 2

A company has a VPC with subnets in us-east1 and us-west1. They have established a Cloud VPN tunnel to their on-premises network through a Cloud Router in us-east1. They want to ensure that traffic from on-premises to resources in us-west1 uses the VPN tunnel and not the public internet. What must be configured?

Accepted Answer

Add a route on the on-premises router for us-west1 subnets with next hop pointing to the VPN tunnel. The on-premises router must have a route for the us-west1 subnets with the VPN tunnel as the next hop. Without this, the on-premises router will use its default route (typically the public internet) to reach us-west1, bypassing the VPN tunnel. The Cloud Router in us-east1 advertises the us-west1 subnets via BGP over the VPN tunnel, but the on-premises router must be explicitly configured to forward traffic for those subnets into the tunnel.

Answer

Configure a custom dynamic route on the Cloud Router for us-west1 subnets

Answer

Create a separate VPN tunnel from on-premises to a Cloud Router in us-west1

Answer

Configure VPC firewall rules to allow traffic from on-premises to us-west1

Question 3

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

Accepted Answer

Inbound DNS policy. Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Answer

DNS peering

Answer

Outbound DNS forwarding zone

Answer

Private zone with DNS forwarding

Question 4

An organization wants to reduce egress costs for data sent from Compute Engine instances to users worldwide. Which TWO approaches should they consider? (Choose TWO.)

Accepted Answer

Deploy instances in multiple regions closer to users.. Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network routes traffic over Google's network, which may not reduce egress cost but improves performance; however, Standard Tier egress is cheaper than Premium Tier for internet egress. For reducing costs, Cloud CDN and using Standard Tier (if acceptable) can help. But among the options, Cloud CDN and placing instances in multiple regions (to serve users locally) reduce egress.

Answer

Enable Private Google Access to avoid internet egress for Google APIs.

Answer

Use global load balancers instead of regional load balancers.

Answer

Use Premium Tier networking to route traffic over Google's network.

Question 5

Which THREE of the following are valid use cases for VPC Service Controls?

Accepted Answer

Controlling access to a Cloud SQL database from a specific VPC.. VPC Service Controls allow you to define a service perimeter that restricts access to a Cloud SQL database (or other Google Cloud services) to requests originating from a specific VPC network. This is achieved by configuring an access level that references the VPC network, ensuring that only traffic from that VPC can reach the database, even if the database is exposed via private IP.

Answer

Allowing access to a managed instance group from the internet.

Answer

Enabling private access to Cloud APIs from on-premises.

Question 6

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

Accepted Answer

Traffic is taking one tunnel for outbound and the other for return, causing stateful firewall to drop packets.. The most likely cause is asymmetric routing, where outbound traffic from GCP to on-premises takes one VPN tunnel while return traffic takes the other. Stateful firewalls track connection state based on the first packet seen; if return packets arrive via a different tunnel (and thus a different source IP or interface), the firewall does not recognize them as part of an existing session and drops them. This is a classic symptom of asymmetric routing with multiple BGP sessions over separate tunnels.

Answer

BGP keepalive timers are set too low, causing session flapping.

Answer

The MTU is mismatched between the tunnels.

Answer

The on-premises router is not receiving the VPC routes via BGP.

Question 7

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify the BGP session status on the Cloud Router.. BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Answer

Check the MTU configuration on the on-premises router.

Answer

Verify the physical interconnect location and cable connections.

Answer

Review the Cloud NAT configuration for the VPC network.

Question 8

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

Accepted Answer

Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.. Deploying two Cloud VPN tunnels from two Cloud Routers with BGP sessions provides high availability and automatic failover. The two Cloud Routers in different zones ensure redundancy, and BGP (Border Gateway Protocol) dynamically advertises routes and detects tunnel failures, allowing traffic to automatically switch to the healthy tunnel without manual intervention. This meets the requirement for an IPsec VPN connection to a third-party SaaS provider that only supports IPsec VPN.

Answer

Use Dedicated Interconnect with VLAN attachments to the SaaS provider.

Answer

Deploy a Classic VPN tunnel with policy-based routing.

Answer

Deploy a single Cloud VPN tunnel and use static routing.

Question 9

A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?

Accepted Answer

Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.. Firewall rules are evaluated in order of priority (lower number = higher priority). The deny rule at priority 1000 will deny all IPs. To allow the VPN IP, a higher priority (lower number) allow rule must be created for that specific IP, before the deny rule is evaluated. The correct approach is to create an allow rule with priority 100 (or any lower number) for source IP 203.0.0.0/8 (or the specific IP) targeting web-server.

Answer

Modify the existing deny rule to include an exception for the VPN IP in the source IP field.

Answer

Delete the deny rule and create a single rule that denies all IPs except the VPN IP using the 'except' option.

Answer

Change the priority of the existing deny rule to 1 and create an allow rule with priority 2 for the VPN IP.

Question 10

A company uses Cloud VPN tunnels to connect multiple sites to Google Cloud. They have a primary and a backup tunnel for redundancy, each with a different Cloud Router (both in the same region). BGP sessions are established on both routers. The network team notices that during a failover test, traffic fails over to the backup tunnel but then after 30 seconds, the backup tunnel traffic stops and does not recover until the primary tunnel comes back. The engineer finds that the backup Cloud Router is advertising the same routes as the primary, but the backup tunnel's BGP session shows that the routes are being withdrawn after 30 seconds. Additionally, the BGP session remains established. What is the most likely cause?

Accepted Answer

The backup Cloud Router's BGP session is experiencing a keepalive timeout due to incorrect timers.. The backup Cloud Router's BGP session remains established, but routes are withdrawn after 30 seconds. This is classic behavior of a BGP keepalive or hold timer mismatch: if the backup router expects a keepalive within a shorter interval than the peer sends, the hold timer expires, causing the router to withdraw all routes learned from that peer while keeping the TCP session alive (or re-establishing it). The 30-second interval matches the default BGP hold timer (90 seconds) divided by three, suggesting a timer misconfiguration on the backup router.

Answer

The backup Cloud Router is configured with a lower MED value, causing the routes to be withdrawn.

Answer

The backup tunnel is using a static routing method instead of dynamic BGP.

Answer

The backup tunnel's Cloud Router is in a different region, and the routes are not propagated globally.