PCNE Practice Exam 60 — 20 Questions

Question 1

What is the internal DNS name format for a Compute Engine instance named 'web-server' in the 'us-central1-a' zone within the project 'my-project'?

Accepted Answer

web-server.us-central1-a.c.my-project.internal. Compute Engine instances get an internal DNS name in the format: [instance_name].[zone].c.[project_id].internal. For example, web-server.us-central1-a.c.my-project.internal.

Answer

web-server.c.my-project.internal

Answer

web-server.us-central1.internal

Answer

web-server.my-project.internal

Question 2

A company has deployed a Cloud Armor security policy with the following rules: Rule 1: allow from IP range 10.0.0.0/8 (priority 1000); Rule 2: deny from all (priority 2000). What will be the action for traffic from IP 10.1.1.1?

Accepted Answer

Allow. Cloud Armor evaluates rules in priority order (lower number = higher priority). Rule 1 matches and allows the traffic, so Rule 2 is not evaluated.

Answer

Deny

Answer

Error: conflicting rules

Answer

Depends on the default rule

Question 3

An engineer is deploying a network appliance (e.g., a firewall) in a VPC. The appliance needs to handle traffic between different subnets. How many network interfaces should the appliance VM have, and why?

Accepted Answer

Two NICs: one for management, one for data traffic. Network appliances often use multiple NICs for traffic segregation: one for management, others for data traffic. Each NIC can be in a different subnet. NIC0 is the primary and must be connected. Up to 8 NICs are supported.

Answer

Zero NICs: use an internal load balancer

Answer

One NIC, with IP forwarding enabled

Answer

Three NICs: one for each subnet it routes between

Question 4

A company is designing a hub-and-spoke VPC architecture in Google Cloud. The hub VPC hosts a set of shared services, including a third-party firewall appliance (NGFW) in a managed instance group behind a TCP load balancer. Spoke VPCs need to send traffic to the hub's internal TCP load balancer IP (10.0.0.10) for inspection. The firewall appliance inspects traffic and forwards it to the final destination. The network team notices that traffic from one spoke to the load balancer is being dropped. They have verified that VPC peering is established, routes are propagated, and firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Accepted Answer

The internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target.. The most likely cause is that the internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target (e.g., an incorrect backend instance group or port). Even though VPC peering, routes, and firewall rules are verified as correctly set up, if the load balancer does not forward traffic to the NGFW appliance, the traffic will be dropped. Misconfiguration of the forwarding rule is a common issue that can occur independently of network layer setup.

Answer

The spoke VPC's subnet routes are not advertised to the hub VPC via VPC peering.

Answer

The spoke VPC does not have a route to the hub's internal load balancer IP via the peering connection.

Answer

The hub VPC uses Cloud NAT, which is not compatible with VPC peering.

Question 5

A company wants to protect its HTTP(S) Load Balancer from layer 7 attacks, including SQL injection and cross-site scripting (XSS). Which TWO Google Cloud services or features should be used together? (Choose TWO.)

Accepted Answer

HTTPS Load Balancer. Cloud Armor security policies provide WAF capabilities with preconfigured rules to block SQLi and XSS. These policies are attached to the backend service of the HTTPS Load Balancer.

Answer

Cloud CDN

Answer

VPC Service Controls

Answer

Identity-Aware Proxy (IAP)

Question 6

A company has two VPC networks (VPC-A and VPC-B) in the same project. They are connected via VPC peering. VPC-A contains an internal TCP load balancer with IP 10.1.2.3 serving on port 80. VPC-B needs to access this load balancer. The network engineer has verified that the firewall rules allow traffic from VPC-B to the load balancer's IP and port. However, instances in VPC-B cannot connect to 10.1.2.3:80. What is the most likely reason for this failure?

Accepted Answer

Internal load balancers are regional; clients must be in the same region as the load balancer when using VPC peering.. Internal TCP/UDP load balancers are regional and only accept traffic from clients in the same region when using VPC peering. If VPC-B's instances are in a different region than the load balancer, they cannot reach it via peering unless the load balancer has global access enabled (which is only available for external LBs). Option B is incorrect: VPC peering does propagate subnets, but the issue is not routing; it's the regional constraint. Option C is incorrect: Health checks affect the load balancer's ability to send traffic to backends, not clients' ability to connect to the load balancer IP. Option D is incorrect: Firewall rules were already verified as allowing traffic.

Answer

The VPC peering connection does not propagate routes for the load balancer IP.

Answer

The backend instances are unhealthy and the load balancer is not serving traffic.

Answer

Firewall rules in VPC-B are not allowing egress to the load balancer IP.

Question 7

Your organization has a site-to-site Cloud VPN connection between an on-premises network with CIDR 10.0.0.0/8 and a VPC in us-central1 with subnet 192.168.1.0/24. The VPN tunnel is established, but you cannot reach a Compute Engine instance with internal IP 192.168.1.10 from a server on-premises with IP 10.0.0.50. Cloud VPN logs show no errors. On-premises firewall rules allow all outbound traffic. What is the most likely cause of the problem?

Accepted Answer

Missing a static route on the on-premises router for 192.168.1.0/24 pointing to the VPN gateway. The VPN tunnel is established and Cloud VPN logs show no errors, indicating the cloud side is configured correctly. However, the on-premises server at 10.0.0.50 cannot reach 192.168.1.10 because the on-premises router lacks a static route for the VPC subnet 192.168.1.0/24 pointing to the VPN gateway. Without this route, the on-premises router does not know to send traffic destined for 192.168.1.0/24 through the VPN tunnel, so packets are dropped or sent to the default gateway instead.

Answer

A firewall rule on the VPC blocking inbound traffic from 10.0.0.0/8

Answer

The Compute Engine instance's OS firewall blocking ICMP

Answer

Incorrect IAM permissions on the Cloud VPN gateway

Question 8

A network engineer configured a hierarchical firewall policy at the organization level with a priority 100 rule that denies all ingress traffic. At the folder level, a policy with priority 110 allows ingress from a specific IP range. At the VPC level, a network firewall policy with priority 90 allows ingress from a different IP range. Which traffic will be allowed?

Accepted Answer

Only traffic matching the VPC-level allow rule. Hierarchical firewall policies are evaluated in order of priority (lower number = higher priority) and then network firewall policies. The org-level rule with priority 100 denies all ingress. The folder-level rule with priority 110 allows specific IPs, but since the org rule has higher priority, it overrides the folder rule. The VPC-level network firewall policy is evaluated after hierarchical policies and has priority 90, which is lower than 100, so it would override the org rule. However, hierarchical policies are evaluated before network firewall policies only if they have higher priority. Here, the VPC policy has priority 90, which is lower than 100, so it takes precedence over the org-level deny. Thus, traffic matching the VPC policy's allowed IP range is allowed.

Answer

Traffic matching either the folder-level or VPC-level allow rules

Answer

Only traffic matching the folder-level allow rule

Answer

No traffic is allowed because the org-level deny is evaluated last

Question 9

A company needs to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have a service level agreement that requires 99.99% availability for the connection. What is the minimum number of VLAN attachments they must provision, and how should they be configured to meet this SLA?

Accepted Answer

Two VLAN attachments, each on a different Interconnect. To achieve 99.99% availability for Dedicated Interconnect, you must eliminate single points of failure. A single VLAN attachment on one Interconnect (Option A) provides no redundancy. Google Cloud requires at least two VLAN attachments, each on a different Interconnect (and ideally different edge availability domains), to meet this SLA. This ensures that if one Interconnect or VLAN attachment fails, traffic can fail over to the other, maintaining connectivity.

Answer

One VLAN attachment with a single Interconnect

Answer

Four VLAN attachments on two Interconnects

Answer

Two VLAN attachments on the same Interconnect

Question 10

A startup is deploying its first application on Google Cloud and needs to create a VPC network. They want to avoid manual subnet planning and prefer that Google automatically creates subnets in each region as they expand. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region with predetermined IP ranges, simplifying initial setup. Custom mode VPCs require manual subnet creation.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 11

Your organization uses Cloud DNS for private DNS resolution within GCP. You need to enable on-premises DNS servers to resolve GCP private zone names (e.g., myinstance.internal.example.com). Which TWO resources must you configure? (Choose two.)

Accepted Answer

Configure an inbound DNS server policy in GCP. To allow on-premises DNS servers to resolve GCP private zone names, you only need to configure an inbound DNS server policy (option C). This creates a forwarding endpoint with a Google-managed IP address in a VPC network. On-premises DNS servers must then be configured to forward queries for the private zone to that IP address. A DNS peering zone (option B) is not required because the inbound endpoint can resolve records in any private zone that is in the same project and VPC network. The other options (A, D, E) are not relevant for this use case.

Answer

Configure an outbound DNS server policy in GCP

Answer

Create a DNS peering zone in Cloud DNS that points to the on-premises DNS servers

Answer

Set up a VPN tunnel between GCP and on-premises

Answer

Create a forwarding zone in Cloud DNS

Question 12

An engineer configures an HA VPN with two tunnels to an on-premises network using IKEv2 and pre-shared keys. After configuration, the tunnels show as established, but no traffic flows. The Cloud Router BGP sessions are not established. The on-premises firewall logs show IKE packets are being sent but no response. What is the most likely cause?

Accepted Answer

The pre-shared keys do not match. B is correct because the on-premises firewall logs show IKE packets being sent but no response, which indicates that the IKEv2 pre-shared key mismatch causes the IKE authentication phase to fail. Even though the tunnel status shows as established (likely due to a stale or misconfigured status check), the BGP sessions cannot form because the IKE security association (SA) is not fully authenticated, preventing the IPsec SA from being created and thus blocking all traffic, including BGP packets.

Answer

The Cloud Router BGP AS number is duplicated

Answer

The on-premises firewall is blocking UDP port 500

Answer

The VPN tunnel is configured as policy-based instead of route-based

Question 13

A company is setting up HA VPN between GCP and on-premises. They want 99.99% SLA. Which TWO configurations are required? (Choose 2)

Accepted Answer

Four IKEv2 tunnels with BGP. The 99.99% SLA for Cloud HA VPN requires two interfaces on the Cloud VPN gateway, each with a unique external IP address (two external IPs total — option D). Additionally, each interface must have two tunnels, resulting in four tunnels total, and these tunnels must use IKEv2 and BGP dynamic routing (option B). Cloud Router with BGP is required for dynamic routing, but the two specific configurations from the options are two external IP addresses and four IKEv2 tunnels with BGP. Therefore, options B and D are correct.

Answer

One external IP address on the Cloud VPN gateway

Answer

Cloud Router configured with BGP

Answer

Static routing

Question 14

You have set up a Dedicated Interconnect with two VLAN attachments (each 10 Gbps) and configured ECMP on the Cloud Router. You observe that traffic from on-premises to a specific VM is only using one attachment. What is the most likely cause?

Accepted Answer

The traffic consists of a single flow that is hashed to one attachment. D is correct because ECMP (Equal-Cost Multi-Path) relies on hashing of packet headers (e.g., 5-tuple: source/destination IP, protocol, source/destination port) to select a path. A single flow (e.g., a TCP connection between two specific IPs and ports) will always hash to the same attachment, so it cannot use both VLAN attachments simultaneously. This is expected behavior, not a fault.

Answer

Route propagation is disabled on one Cloud Router interface

Answer

One of the VLAN attachments has a higher route priority

Answer

BGP ASN mismatch between the two attachments

Question 15

An organization wants to restrict data exfiltration from a GCP project. They need to prevent users from copying data to external cloud storage services like AWS S3, but allow access to Google Cloud Storage. Which VPC Service Controls (VPC-SC) configuration should they use?

Accepted Answer

Combine VPC Service Controls with a Cloud Firewall that denies egress to non-Google IPs.. VPC Service Controls (VPC-SC) can create a perimeter that restricts data movement to only Google Cloud Storage, while Cloud Firewall egress rules can deny traffic to non-Google IP ranges (including AWS S3 endpoints). This combination ensures that even if a user attempts to copy data to an external cloud storage service, the firewall blocks the egress traffic, and VPC-SC prevents access to Google Cloud Storage from outside the perimeter.

Answer

Use Cloud Firewall rules to block egress to AWS IP ranges.

Answer

Enable Data Loss Prevention (DLP) API to inspect outgoing data.

Answer

Create a VPC Service Controls perimeter that includes the project and set access levels to allow only Google Cloud Storage.

Question 16

A company is deploying a new application across three VPCs in the same project, using Shared VPC. The security team wants to restrict traffic such that only the frontend subnet (10.0.1.0/24) can send traffic to the backend subnet (10.0.2.0/24) on TCP port 8080. The backend instances have the service account 'backend-sa@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations achieve this goal?

Accepted Answer

Create an ingress firewall rule on the backend VPC with source service account 'frontend-sa@project.iam.gserviceaccount.com', protocol tcp:8080, and target service account 'backend-sa@project.iam.gserviceaccount.com'.. It uses service accounts as both source and target in an ingress rule on the backend VPC. This allows only instances with the frontend service account to send traffic to instances with the backend service account on TCP 8080, meeting the security requirement without relying on IP addresses or network tags.

Answer

Create an egress firewall rule on the frontend VPC with source CIDR 10.0.1.0/24, protocol tcp:8080, and target CIDR 10.0.2.0/24.

Answer

Create an ingress firewall rule on the backend VPC with source tag 'frontend-tag', protocol tcp:8080, and target tag 'backend-tag'.

Answer

Create a VPC firewall rule with priority 1000 that denies all traffic from 10.0.1.0/24 to 10.0.2.0/24, and then a higher priority rule allowing tcp:8080.

Question 17

Which TWO factors should be considered when selecting a Google Cloud region for deploying a globally distributed application to minimize latency for users?

Accepted Answer

Availability of required Google Cloud services in the region. The availability of required Google Cloud services in a region is a fundamental constraint: if a service (e.g., Cloud Spanner, BigQuery, or a specific machine series) is not offered in a region, you cannot deploy that component there, regardless of latency benefits. Option C is correct because minimizing latency for a globally distributed application requires placing compute and data resources as close as possible to the majority of users, reducing round-trip time (RTT) and improving user experience. Google Cloud's global network and edge caching locations (e.g., Cloud CDN) further amplify the benefit of proximity.

Answer

Compliance with data residency requirements

Answer

Number of zones in the region

Answer

Cost of resources in the region

Question 18

A company is designing a hybrid network using Dedicated Interconnect. They want to configure BGP for load balancing across multiple VLAN attachments. Which TWO statements are correct?

Accepted Answer

You can configure the Cloud Router to advertise the same IP prefixes over both VLAN attachments.. A Cloud Router can advertise the same IP prefixes over multiple VLAN attachments to enable load balancing. This allows Google Cloud to use ECMP (Equal-Cost Multi-Path) routing to distribute outbound traffic across the two VLAN attachments, as long as the BGP attributes (e.g., AS path length, MED) are equal.

Answer

You must create a separate Cloud Router for each VLAN attachment.

Answer

You should use BGP MED to load balance outbound traffic from Google Cloud.

Answer

Load balancing across VLAN attachments requires a single BGP session.

Question 19

A company has a Dedicated Interconnect with one 10 Gbps connection. They need high availability for critical workloads. Which design is the best practice according to Google Cloud recommendations?

Accepted Answer

Provision a second Dedicated Interconnect connection to a different PoP.. Google Cloud best practice for high availability with Dedicated Interconnect requires at least two physical connections, each to a different edge point of presence (PoP), to eliminate single points of failure at the network edge. A single 10 Gbps connection, even with a backup VPN, does not provide the same SLA or bandwidth guarantees for critical workloads. Option A ensures that if one PoP or provider fails, the other connection can maintain connectivity.

Answer

Add a second connection to the same PoP using the same provider.

Answer

Rely on the single connection and monitor for failures.

Answer

Use Cloud VPN as a backup to the Dedicated Interconnect.

Question 20

Which TWO of the following methods can be used to encrypt traffic between VPC networks?

Accepted Answer

Use of SSL/TLS at the application layer.. SSL/TLS operates at the application layer (Layer 7) of the OSI model, providing end-to-end encryption for traffic between VPC networks. When applications use HTTPS (HTTP over TLS), the payload is encrypted before leaving the source, ensuring confidentiality even if the underlying network path is untrusted. This method is independent of the underlying network connectivity, making it suitable for encrypting traffic across VPCs connected via any means, including the public internet.

Answer

VPC peering.

Answer

Cloud Interconnect with VLAN attachments.

Answer

Cloud NAT.