PCNE Practice Exam 61 — 20 Questions

Question 1

A company wants to establish a dedicated physical connection between their on-premises network and Google Cloud. They need a 10 Gbps connection and are willing to manage the circuit and colocation facility themselves. Which Google Cloud service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection between the on-premises network and Google's network via a colocation facility and Google Partner PoP. It is managed by the customer for circuit ordering and colocation.

Answer

Partner Interconnect

Answer

Cloud CDN

Answer

Cloud VPN

Question 2

A company uses Identity-Aware Proxy (IAP) to secure access to a group of Compute Engine instances running a web application. The instances have no external IP addresses and are accessed via IAP TCP forwarding. Recently, the security team discovered that some users can access the instances directly via SSH from other instances within the same VPC, bypassing IAP. What is the most effective way to ensure all SSH access goes through IAP?

Accepted Answer

Modify the VPC firewall rule to deny ingress traffic on TCP port 22 from all sources except the IAP IP range (35.235.240.0/20).. The IAP TCP forwarding source IP range (35.235.240.0/20) is the only range that should be allowed to initiate SSH connections to the instances. By modifying the VPC firewall rule to deny all other sources on TCP port 22, you ensure that any SSH traffic not originating from the IAP IP range is blocked, even from other instances within the same VPC. This directly addresses the bypass scenario where users SSH from other internal instances.

Answer

Assign a service account to each instance with the IAP-secured Tunnel User role.

Answer

Remove SSH keys from the instances and use OS Login.

Answer

Create a new firewall rule that allows SSH only from the IAP IP range and delete the existing SSH rule.

Question 3

A company has VPC peering between two VPC networks. They want to ensure that traffic from VPC A to VPC B can use a custom route in VPC A that points to a next-hop appliance in VPC A. Which TWO conditions must be met?

Accepted Answer

VPC peering must be set up with 'export custom routes' enabled from VPC A.. Required because custom routes must be exported from VPC A to VPC B via peering. This allows VPC B to learn the route and send return traffic back through the same appliance, ensuring bidirectional communication via the appliance. Without exporting custom routes, VPC B would send return traffic directly via the peering connection, bypassing the appliance. Option E is required because VPC A must have a route that specifies the destination inside VPC B and sets the next-hop to the appliance. This route is what directs the traffic from VPC A to VPC B through the appliance. Options A, C, and D are not necessary for the forward path: VPC B does not need a route back (the return path is handled via export), the appliance can be in any region (it just needs connectivity), and a firewall rule on the appliance is needed but is not a condition specific to using the custom route via peering.

Answer

VPC B must have a route back to VPC A.

Answer

The appliance must be in the same region as VPC A.

Answer

The appliance must have a firewall rule allowing traffic from VPC B.

Question 4

Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.. Since the VM can ping the on-premises gateway (192.168.1.1) but not the server (192.168.1.100), the VPN tunnel and BGP session are working, and GCP has the correct route. The issue is that the on-premises router is not advertising or does not have a route for the GCP subnet 10.0.1.0/24 pointing back to the VPN tunnel, so return traffic from the server to the VM is dropped. Without this route, the on-premises router cannot forward packets destined for 10.0.1.10 back through the VPN.

Answer

The on-premises server is not configured with a default gateway pointing to the on-premises gateway.

Answer

The Cloud VPN tunnel is not configured with an IKE version supported by the on-premises device.

Answer

A firewall rule on the GCP VPC is blocking ICMP traffic from 192.168.1.100.

Question 5

A company is using Traffic Director with Envoy sidecars to manage traffic between microservices. They want to inject faults to test service resilience. Which Traffic Director feature should they use?

Accepted Answer

Fault injection. Fault injection is a feature of Traffic Director that allows injecting delays or abort errors into requests for testing.

Answer

Traffic splitting

Answer

Circuit breakers

Answer

mTLS

Question 6

A company needs to connect multiple on-premises sites and multiple GCP VPCs in a hub-and-spoke topology using Google Cloud. Which service provides a centralized hub for managing such connectivity?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is the correct choice because it provides a centralized hub-and-spoke topology for connecting multiple on-premises sites (via VPN, Interconnect, or third-party SD-WAN appliances) and multiple GCP VPCs. It manages routing and policy distribution across spokes, eliminating the need for individual peering or complex route tables, and supports both intra- and cross-region connectivity.

Answer

VPC Peering

Answer

Shared VPC

Answer

Cloud Router

Question 7

A company has a Cloud VPN between their on-premises network and Google Cloud. They want to ensure that traffic flows symmetrically, meaning that traffic from Google Cloud to on-premises uses the same VPN tunnel as traffic from on-premises to Google Cloud. Which best practice should they implement?

Accepted Answer

Implement policy-based routing that forces traffic to and from specific subnets to use the same tunnel.. Policy-based routing (PBR) allows you to explicitly define forwarding rules based on source/destination IP addresses, ensuring that traffic from Google Cloud to on-premises uses the same VPN tunnel as the reverse direction. This enforces symmetric flow, which is critical for stateful firewalls and NAT devices that expect packets to arrive on the same interface they left. Dynamic routing (BGP) or static routes alone do not guarantee symmetry unless combined with PBR or tunnel interface configurations.

Answer

Use dynamic routing with BGP and ensure that the AS path length is the same on both sides.

Answer

Deploy multiple VPN tunnels and use different priorities for each.

Answer

Use static routes pointing to the VPN tunnel on both sides.

Question 8

A Cloud VPN with dynamic routing (BGP) is established between an on-premises network and Google Cloud. The on-premises BGP router is advertising a default route (0.0.0.0/0). The Cloud Router in Google Cloud is receiving this route, but network traffic from Google Cloud VMs to the internet is not being routed through the VPN. Which THREE troubleshooting steps should you take? (Choose three.)

Accepted Answer

Verify that the VPC's dynamic routing mode is set to 'global' if using regional routing.. The VPC's dynamic routing mode determines the scope of route propagation. If the VPC uses regional dynamic routing, Cloud Router only propagates routes within the region where the VPN tunnel is attached. A global dynamic routing mode is required for the BGP-learned default route to be available across all regions, ensuring VMs in any region can use the VPN for internet egress.

Answer

Check VPC firewall rules to ensure they allow egress traffic from VMs.

Answer

Ensure that the on-premises router is sending the default route with a higher local preference.

Question 9

Which TWO are best practices for securing a VPC network? (Choose 2.)

Accepted Answer

Use firewall rules to restrict ingress traffic to only necessary ports and IPs.. Firewall rules are the primary mechanism for controlling ingress traffic in a VPC. By restricting traffic to only necessary ports and source IPs, you minimize the attack surface and enforce the principle of least privilege. This is a fundamental security best practice for network segmentation and access control.

Answer

Use VPC Network Peering to connect to other projects.

Answer

Create a VPC with default firewall rules.

Answer

Enable Private Google Access on all subnets.

Question 10

A company uses Network Connectivity Center (NCC) to connect multiple on-premises sites and VPCs. They have a hub in us-central1 and spokes including two on-premises networks and three VPCs. Which two statements about NCC are accurate? (Choose TWO.)

Accepted Answer

Traffic between spokes must traverse the hub.. Network Connectivity Center (NCC) operates on a hub-and-spoke model. Traffic between spokes must traverse the hub (C). NCC supports both VPC and on-premises spokes (D). Other options are incorrect: on-premises spokes can use Partner Interconnect or VPN, not just Dedicated Interconnect; each spoke attaches to only one hub; transitive routing is not automatic and requires configuration.

Answer

NCC requires a Dedicated Interconnect for on-premises spokes.

Answer

Each spoke can be connected to multiple hubs.

Answer

NCC provides transitive routing across all spokes automatically.

Question 11

Which THREE of the following are requirements for VPC Network Peering?

Accepted Answer

The VPCs must have non-overlapping subnet IP ranges.. VPC Network Peering requires non-overlapping subnet IP ranges to prevent routing conflicts and ensure that traffic is correctly directed between the peered VPCs. Overlapping CIDR blocks would cause ambiguous routing, as the same IP address could exist in both VPCs, making it impossible for the VPC routers to determine the correct destination.

Answer

Peering supports transitive routing.

Answer

The VPCs must be in the same project.

Question 12

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Accepted Answer

Service projects. A is correct because service projects in a Shared VPC architecture allow each project to host its own resources (e.g., Compute Engine instances) while maintaining separate firewall rules and security policies. This enables centralized network administration via the host project while giving each project autonomy over its own firewall configurations, meeting the requirement for multiple projects with independent firewall rules.

Answer

Cloud VPN

Answer

VPC peering

Question 13

An organization uses HA VPN with dynamic routing and active-active BGP sessions. One tunnel fails, but traffic continues to flow through the other tunnel. However, they notice increased latency. What is the most likely explanation?

Accepted Answer

BGP multipath is enabled, causing all traffic to be sent through the remaining tunnel.. When BGP multipath is enabled on an HA VPN with active-active BGP sessions, the router can load-balance traffic across multiple tunnels. If one tunnel fails, all traffic is redirected through the remaining tunnel, which can cause increased latency due to congestion or suboptimal path selection. The correct answer is A because this behavior directly explains the latency increase after a tunnel failure.

Answer

The remaining tunnel is using a different encryption algorithm.

Answer

The BGP timers are misconfigured.

Answer

The failed tunnel's routes are still in the routing table.

Question 14

A company has a hybrid network with on-premises data center connected to Google Cloud via Dedicated Interconnect. They use Private Google Access for on-premises (on-premises hosts use the external IP addresses of Google APIs via the interconnect). However, they notice that traffic to certain Google APIs is being routed via the internet instead of the interconnect. What is a likely cause?

Accepted Answer

On-premises DNS is not configured to resolve Google API hostnames to the Private Google Access IP address range (199.36.153.4/30).. Private Google Access for on-premises requires on-premises DNS to resolve Google API hostnames to the specific IP range 199.36.153.4/30. If DNS resolution returns the public IP addresses instead, traffic will be routed over the internet rather than through the Dedicated Interconnect, even though the interconnect is available. This is because the on-premises hosts will use the public IPs and follow their default route to the internet.

Answer

Firewall rules in the VPC are blocking the private API traffic.

Answer

Cloud NAT is not configured for the on-premises subnet.

Answer

VPC Flow Logs are not enabled, causing routing misconfiguration.

Question 15

An organization is deploying a global application and wants to use an Internal Load Balancer (ILB) across multiple regions. What is the correct configuration?

Accepted Answer

Deploy Internal Load Balancer (ILB) in each region and use DNS to route traffic. Google Cloud does not support a native cross-region Internal Load Balancer (ILB). To distribute traffic across multiple regions, you must deploy a separate Internal TCP/UDP Load Balancer in each region and use DNS-based routing (e.g., Cloud DNS with geo-routing or weighted record sets) to direct clients to the appropriate regional ILB. This approach provides regional high availability and global reach without exposing internal IPs externally.

Answer

Use a cross-region ILB by enabling global access

Answer

Use an Internal TCP/UDP Load Balancer in one region and route traffic via Cloud VPN

Answer

Use a global External Load Balancer with internal backend

Question 16

A network engineer runs the gcloud command above for a Cloud NAT configured in us-central1. The VPC has 20 instances without external IPs in us-central1. They notice that only three instances have NAT mappings displayed. What could explain this?

Accepted Answer

Only instances with active outbound connections are shown.. The `gcloud compute nat-gateways list-mappings` command only displays NAT mappings for instances that currently have active outbound connections traversing the Cloud NAT gateway. Cloud NAT uses dynamic port address translation (PAT) and only creates a mapping entry when an instance sends traffic that requires source NAT. Instances without active sessions will not appear in the listing, even though they are configured to use the NAT gateway.

Answer

The NAT gateway is configured only for a specific subnet.

Answer

Only instances with external IPs are mapped.

Answer

The other instances are using a different NAT gateway.

Question 17

A company needs to ensure that all traffic between GCP VMs in different regions is encrypted in transit. What is the recommended approach?

Accepted Answer

By default, traffic between GCP VMs is encrypted. Google Cloud encrypts all traffic between VMs at the hypervisor level, regardless of region, using application-layer encryption (e.g., TLS) and network-layer encryption (e.g., IPSec) by default. This encryption is transparent, always-on, and does not require any configuration, making option B the correct answer. The encryption covers all VM-to-VM traffic within the same VPC or across VPCs, including inter-region communication.

Answer

Use VPC peering with encryption enabled

Answer

Use Cloud VPN between the two regions

Answer

Enable IPsec on the VPC

Question 18

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They have two VLAN attachments (vlan-100 and vlan-200) connected to two separate Cloud Routers in the same region. Each Cloud Router has a BGP session with the on-premises router. The on-premises router advertises the same prefixes (10.0.0.0/8) over both sessions. In Google Cloud, they have workloads in two different VPCs: VPC-A and VPC-B. They want traffic to VPC-A to use vlan-100, and traffic to VPC-B to use vlan-200. Cloud Router 1 is attached to VPC-A, Cloud Router 2 is attached to VPC-B. Currently, traffic from on-premises to VPC-A sometimes goes through vlan-200, causing asymmetric routing. What configuration change should they make to ensure traffic is symmetric?

Accepted Answer

Use BGP community tags on the on-premises router to label routes for VPC-A and VPC-B, and configure route priority on Cloud Router to match these communities.. BGP community tags allow the on-premises router to tag routes for VPC-A and VPC-B differently. Cloud Router can then use these community tags to influence route priority (e.g., via local preference or MED matching), ensuring that traffic to VPC-A is always routed through vlan-100 and traffic to VPC-B through vlan-200, solving the asymmetric routing issue without relying on static routes or MED manipulation that would affect all traffic.

Answer

Set a higher MED on the on-premises router for routes advertised to vlan-200, making vlan-100 preferred for all traffic.

Answer

Configure static routes on the on-premises router to force traffic to VPC-A via vlan-100 and to VPC-B via vlan-200.

Answer

Create two separate VPCs and assign each VLAN attachment to a different VPC.

Question 19

A company is using Traffic Director with Envoy sidecars. They want to enable mutual TLS (mTLS) between services. Which two steps are required? (Choose two.)

Accepted Answer

Enable mTLS in Traffic Director configuration. To enable mTLS, you need to enable mTLS in Traffic Director and configure Envoy sidecars with certificates.

Answer

Deploy a service mesh with Istio

Answer

Use a Global HTTPS Load Balancer

Answer

Set up Cloud DNS

Question 20

A large enterprise has two on-premises data centers (DC1 and DC2) connected to Google Cloud via two separate VPN tunnels to the same VPC. Each tunnel terminates on a different Cloud VPN gateway (gateway1 in us-east1, gateway2 in us-west1). The on-premises routers advertise the same CIDR 172.16.0.0/12 from both DCs. Cloud Router is configured with BGP and uses default route priority. You notice that after a failover event where one tunnel goes down, traffic continues to flow, but there is a significant increase in latency for traffic coming from GCP to on-premises. You verify that both tunnels have re-established. What is the most likely cause of the increased latency?

Accepted Answer

The on-premises routers do not use AS path prepending to prefer the local DC's path for the prefix. When both on-premises routers advertise the same CIDR (172.16.0.0/12) to Google Cloud via BGP, Cloud Router selects the path with the shorter AS path length by default. Without AS path prepending on the backup DC's router, both routes have equal AS path length, causing Cloud Router to load-balance or pick a suboptimal path after failover. After the tunnel re-establishes, traffic from GCP may still be routed to the remote DC (e.g., DC2) instead of the local DC (DC1), resulting in higher latency due to cross-country or inter-DC transit.

Answer

The on-premises routers are using site-to-site VPN between themselves causing a routing loop

Answer

The Cloud VPN tunnels are using different preshared keys

Answer

Bidirectional Forwarding Detection (BFD) is not enabled on the Cloud VPN tunnels