PCNE Practice Exam 62 — 20 Questions

Question 1

A company has a single VPC with subnets in us-central1 and europe-west1. They have Compute Engine instances in both subnets that need to communicate with each other. The security team wants to ensure that only specific instances in us-central1 can connect to a database instance in europe-west1 on port 3306. Currently, the default firewall rules allow all internal traffic (priority 65535). The network engineer first creates a new ingress firewall rule to allow TCP traffic on port 3306 from instances with the network tag 'app' to instances with the tag 'db', with priority 1000. Then, to enforce the restriction, they delete the default allow internal rule (priority 65535). However, after applying the changes, the app instances (tagged 'app') in us-central1 cannot connect to the database instance (tagged 'db') in europe-west1. The engineer verifies that the tags are correctly applied to the instances. What is the most likely cause of the connectivity failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The app instances need a firewall rule to allow egress traffic to the database on port 3306.. B is correct because in Google Cloud VPC, firewall rules are stateful for ingress but not for egress. The ingress rule allowing traffic from 'app' to 'db' on port 3306 only controls incoming packets to the database instance. The app instance still needs an egress firewall rule to allow outbound traffic on port 3306, otherwise the outbound SYN packet is dropped before it reaches the database. Deleting the default allow internal rule (priority 65535) removed the implicit egress permission, so a specific egress rule is required.

Answer

The firewall rule only allows ingress from instances with tag 'app' but the egress traffic from app instances is blocked.

Answer

The firewall rule is applied to the wrong VPC network.

Answer

The database instance's network tag 'db' was not applied to the database instance.

Question 2

An organization has multiple VPCs in a Shared VPC setup. They want to allow only certain service projects to use a specific subnet in the host project. What should they configure?

Accepted Answer

Use shared subnet IAM to grant compute.subnetUser on the specific subnet. Shared VPC allows IAM permissions on individual subnets. You can grant the compute.subnetUser role on a specific subnet to a service project.

Answer

Use VPC peering between host and service projects

Answer

Grant the compute.networkUser role to the service project

Answer

Create a separate host project for each service project

Question 3

A company is deploying a Dedicated Interconnect with a 10 Gbps circuit to Google Cloud. They need to ensure high availability. Which configuration is required by Google Cloud to meet the high availability SLA?

Accepted Answer

Provision two VLAN attachments on two separate Cloud Routers in different zones. To meet the high availability SLA for Dedicated Interconnect, Google Cloud requires at least two VLAN attachments, each on a separate Cloud Router in different zones. This ensures that if one zone or Cloud Router fails, traffic can still flow through the other attachment, providing redundancy. A single VLAN attachment or a single Cloud Router does not meet the 99.99% availability SLA because it creates a single point of failure.

Answer

Combine Dedicated Interconnect with a Cloud VPN tunnel for failover

Answer

Use Partner Interconnect instead of Dedicated Interconnect

Answer

Provision a single VLAN attachment on one Cloud Router

Question 4

A company is using Partner Interconnect with a service provider that offers Layer 3 connectivity. The service provider manages the BGP sessions. The engineer needs to create a VLAN attachment on the Google side. Which attachment type should they choose?

Accepted Answer

PARTNER_PROVIDER. For Partner Interconnect, when the service provider manages Layer 3 (BGP), the VLAN attachment type must be PARTNER_PROVIDER. The PARTNER type is for Layer 2 connectivity where the customer manages BGP.

Answer

PARTNER

Answer

MANAGED

Answer

DEDICATED

Question 5

Which TWO considerations are important when designing a VPC peering strategy between multiple projects in Google Cloud?

Accepted Answer

Subnet IP ranges in peered VPCs must not overlap. VPC peering requires that subnet IP ranges in peered VPCs do not overlap. This is a fundamental constraint of VPC peering in Google Cloud: if two VPCs have overlapping CIDR blocks, routes cannot be exchanged unambiguously, and the peering connection will fail to establish or will cause routing conflicts. Overlapping ranges would break the ability to route traffic correctly between the VPCs, as there would be no way to determine which subnet a packet should be delivered to.

Answer

Peering is transitive by default

Answer

Firewall rules in one VPC automatically apply to peered VPCs

Answer

VPC peering can only be used within the same project

Question 6

A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)

Accepted Answer

Add the project containing the service account to the VPC Service Controls perimeter. VPC Service Controls use a perimeter to restrict access to managed services like BigQuery. Adding the project containing the service account to the perimeter allows that service account to access the protected BigQuery datasets, as the perimeter explicitly includes the project as an allowed member.

Answer

Create a firewall rule in the client VPC allowing egress to the BigQuery API

Answer

Configure an IAM condition on the service account's roles to restrict access to the perimeter

Answer

Enable Private Google Access on the subnet where the service account's VMs are located

Question 7

An engineer is configuring Dedicated Interconnect between an on-premises data center and Google Cloud. Cloud Router is set up with BGP sessions. The BGP session remains in Idle state. Which of the following is the most likely cause?

Accepted Answer

The Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface.. The BGP session remains in Idle state because the Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface. For BGP peering over Dedicated Interconnect, the two routers must be directly connected at Layer 3, meaning their BGP peer IP addresses must belong to the same /30 or /31 subnet. If they are in different subnets, the TCP connection for BGP cannot be established, keeping the session in Idle state.

Answer

The on-premises router is not advertising the Google Cloud VPC subnet routes.

Answer

The interconnect is not configured with redundant links.

Answer

The VLAN attachment is not in the same region as the Cloud Router.

Question 8

An organization has a VPC with multiple subnets. They want to log all outbound connections from instances to the internet for compliance. They also want to use a cost-effective solution that doesn't require a proxy. Which three components are needed? (Choose three.)

Accepted Answer

Cloud NAT. Cloud NAT with logging enabled provides logs of outbound connections. Cloud Router is required to set up Cloud NAT. Firewall rules allow the traffic but are not specifically needed for logging; the NAT logs capture the connections.

Answer

Cloud VPN

Answer

VPC Flow Logs

Question 9

A security team wants to capture all traffic from a Compute Engine instance for intrusion detection. Which service should be used to copy traffic to a third-party IDS appliance running on another instance?

Accepted Answer

Packet Mirroring

Answer

Firewall Rules logging

Answer

VPC Flow Logs

Answer

Cloud NAT logging

Question 10

A company has enabled VPC Flow Logs on a subnet with the default sample rate. They notice that only 50% of flows are being logged. What is the most likely reason?

Accepted Answer

The sample rate is set to 50% by default. The default sampling rate for VPC Flow Logs is 50%. This means only half of the network flows are captured to reduce cost and volume.

Answer

Flow logs only capture TCP traffic

Answer

Flow logs are disabled by default on all subnets

Answer

The subnet is using a custom sample rate of 50%

Question 11

A company is deploying a multi-tier application on Google Cloud. The frontend tier runs in a managed instance group behind a global external HTTP(S) load balancer. The backend tier runs on Compute Engine instances in a different VPC subnet. The frontend instances must communicate with the backend instances using internal IP addresses only. Which configuration should the network engineer use?

Accepted Answer

Set up VPC Network Peering between the frontend VPC and the backend VPC.. VPC Network Peering allows two separate VPC networks to communicate using internal IP addresses without traversing the internet or requiring a VPN. Since the frontend and backend are in different VPCs (implied by the need for peering), peering enables direct internal IP connectivity between the frontend instances and the backend instances, satisfying the requirement for internal-only communication.

Answer

Use Cloud NAT to allow the frontend to reach the backend via the internet.

Answer

Use an internal TCP/UDP load balancer in the backend VPC and configure the frontend to send traffic to the load balancer's internal IP.

Answer

Place both frontend and backend instances in the same VPC but different subnets, and use firewall rules to allow traffic.

Question 12

A company has a Hybrid Connectivity setup using Cloud VPN with BGP. They want to migrate to Dedicated Interconnect for better performance. During the migration, they need to avoid downtime. Which THREE steps should they take?

Accepted Answer

Provision the Dedicated Interconnect and VLAN attachments. Provisioning the Dedicated Interconnect and VLAN attachments is the foundational step to establish the new high-performance connection. Without this, there is no physical or logical path to migrate traffic onto. This must be done before any BGP configuration or route manipulation can occur.

Answer

Set a lower local preference on the Interconnect BGP session

Answer

Remove the VPN tunnels immediately after Interconnect is up

Question 13

A company uses Cloud Armor with WAF rules to protect an HTTPS load balancer. They notice that legitimate traffic from certain IPs is being blocked. How should they troubleshoot?

Accepted Answer

Review Cloud Armor security policy logs.. Cloud Armor security policy logs record the actions taken by WAF rules, including which requests were blocked and why. By reviewing these logs, you can identify the specific rule that is blocking legitimate traffic and adjust its configuration, such as modifying IP allowlists or threshold values.

Answer

Check firewall rule logs.

Answer

Enable Packet Mirroring.

Answer

Use VPC Flow Logs.

Question 14

A company uses Cloud Armor to protect its HTTP(S) load balancer. They need to block requests from a specific geographic region and also apply a rate limiting rule. What is the correct order of evaluation for Cloud Armor security policies?

Accepted Answer

Evaluate rules in priority order; the first matching rule determines the action.. Cloud Armor security policies evaluate rules in priority order, and the first rule that matches the request determines the action (allow or deny). This means that if a rate limiting rule matches first, it will be applied, and subsequent rules are not evaluated. Option C correctly describes this behavior.

Answer

Rate limiting rules are evaluated separately from other rules.

Answer

Evaluate rules in priority order and apply all matching rules.

Answer

Evaluate all rules and apply the most restrictive action.

Question 15

A company has two HA VPN tunnels from on-premises to Google Cloud using two separate Cloud Routers for redundancy. The on-premises network uses BGP and advertises a default route to Google Cloud. The company wants to ensure that traffic from Google Cloud to on-premises prefers the primary Cloud Router over the secondary. Which configuration should be applied?

Accepted Answer

Set a higher LOCAL_PREF on the primary Cloud Router for the default route.. LOCAL_PREF is a well-known mandatory BGP attribute that is used to influence outbound traffic from an AS. By setting a higher LOCAL_PREF on the primary Cloud Router for the default route, Google Cloud will prefer that path for traffic destined to on-premises, as LOCAL_PREF is evaluated before other attributes like AS_PATH and MED.

Answer

Set the primary Cloud Router's BGP IP as the next-hop for all routes on the secondary.

Answer

Set a lower MED on the primary Cloud Router's BGP session for the default route advertisement.

Answer

Set a shorter AS_PATH on the primary Cloud Router's BGP session.

Question 16

Refer to the exhibit. An engineer is troubleshooting a dual-tunnel HA VPN. The BGP session on one interface is established (State/PfxRcd 1) but the other is stuck in Active state. What can cause this?

Accepted Answer

The on-premises router does not have a BGP configuration for the second peer IP address (169.254.x.x).. In a dual-tunnel HA VPN, each tunnel uses a separate BGP session with its own peer IP address (typically from the 169.254.x.x link-local range). If the on-premises router only has a BGP neighbor statement for the first peer IP, it will ignore incoming BGP packets from the second peer. The Cloud Router sees the session stuck in Active state because it is sending BGP OPEN messages but never receiving a response, as the on-premises router is not listening on that IP.

Answer

The Cloud Router is using the same BGP identifier for both sessions, causing a conflict.

Answer

The on-premises router is configured with BGP MD5 authentication that only matches the first peer.

Answer

The MTU on the second tunnel is not matching between the two ends.

Question 17

An engineer needs to provide outbound internet access to a set of Compute Engine instances that have only internal IP addresses. The instances must use a static IP address for outbound traffic. Which solution should they implement?

Accepted Answer

Create a Cloud NAT gateway with static IP address and configure it on the VPC network.. Cloud NAT with manual port allocation allows a static IP to be assigned to the NAT gateway, providing outbound internet access to instances without external IPs.

Answer

Assign a static external IP to each instance and configure a firewall rule to allow egress.

Answer

Configure Private Google Access on the subnet to route traffic to Google APIs.

Answer

Deploy a Compute Engine instance as a NAT instance with IP forwarding enabled.

Question 18

Refer to the exhibit. Instances in subnet-b cannot access the internet through Cloud NAT. What is the most likely reason?

Accepted Answer

Subnet-b is not included in the Cloud NAT configuration.. The Cloud NAT configuration only includes subnet-a, so subnet-b is not NATed.

Answer

The firewall rules in subnet-b block egress.

Answer

The NAT IP address pool is exhausted.

Answer

Subnet-b has overlapping subnets.

Question 19

An organization needs to connect two VPCs in different regions using Google's backbone. What is the recommended solution?

Accepted Answer

VPC Peering. VPC Peering uses Google's backbone to connect VPCs across regions without public internet.

Answer

Cloud VPN

Answer

Dedicated Interconnect

Answer

Cloud NAT

Question 20

Which TWO statements about VPC peering are correct?

Accepted Answer

VPC peering requires that all subnet CIDR ranges be unique across both VPCs.. Peering can be across organizations and requires non-overlapping subnets.

Answer

VPC peering allows traffic without firewall rules if both VPCs are in the same project.

Answer

VPC peering automatically exports custom routes.

Answer

VPC peering can only be established for VPCs in the same region.