PCNE Practice Exam 63 — 20 Questions

Question 1

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The engineer forgot to add firewall rules to allow traffic from the peer range.. Default firewall rules deny all ingress, so even with peering, traffic is blocked unless allow rules are added.

Answer

The VPCs use different routing modes.

Answer

The IAM permissions for the peering are missing.

Answer

The VPCs have overlapping subnet CIDR ranges.

Question 2

A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud NAT. Cloud NAT allows instances without external IPs to access the internet. Other options are for different purposes.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering

Question 3

Refer to the exhibit. You are troubleshooting an on-premises to Cloud VPN connection with dynamic routing. The BGP session is CONNECTED, but no routes are received from the on-premises router. What is the most likely cause?

Accepted Answer

The on-premises router is not configured to advertise routes.. The BGP session is up, but routesReceived is 0, indicating the on-premises router is not advertising routes.

Answer

The firewall rules are blocking BGP traffic.

Answer

The VPN tunnel is down.

Answer

The cloud router is not advertising any routes.

Question 4

A company uses VPC Flow Logs for traffic analysis. They notice that logs are missing for a specific Compute Engine instance that handles high traffic. The subnet has Flow Logs enabled. What is the most likely reason?

Accepted Answer

Flow Logs are sampled and may drop high-throughput traffic.. VPC Flow Logs use sampling; high throughput can lead to sampling reduction or dropped logs.

Answer

The instance is using Private Google Access.

Answer

The instance's network interface has an external IP.

Answer

The instance is in a different region from the log sink.

Question 5

An engineer runs 'gcloud compute networks peerings list' and sees state 'INACTIVE' for a peering connection. Which is the most likely cause?

Accepted Answer

The subnet CIDR ranges overlap.. Overlapping subnet CIDRs cause the peering to be INACTIVE.

Answer

The IAM permissions for the peer are insufficient.

Answer

The dynamic routing mode differs.

Answer

The firewall rules are missing.

Question 6

A company is migrating from an on-premises data center to Google Cloud. They have a legacy TCP application that must preserve client IP addresses when load balanced. They also need SSL termination for a different web application. Which TWO load balancers should they consider? (Choose two.)

Accepted Answer

Global SSL Proxy Load Balancer. Regional External TCP/UDP Network Load Balancer preserves client IP (pass-through). Global SSL Proxy Load Balancer provides SSL termination for TCP applications (non-HTTP).

Answer

Global TCP Proxy Load Balancer

Answer

Regional Internal HTTP(S) Load Balancer

Answer

Global HTTPS Load Balancer

Question 7

A company has Compute Engine instances without external IPs that need to access the internet for updates. They do not want any inbound traffic. What is the best design?

Accepted Answer

Configure Cloud NAT and add firewall rules to allow only necessary egress and deny all ingress.. Cloud NAT provides outbound internet connectivity for instances without external IPs, and the explicit firewall rules ensure only necessary egress traffic is allowed while denying all ingress, meeting the requirement of no inbound traffic. Default firewall rules allow some ingress (e.g., ICMP), so they must be overridden with a deny-all-ingress rule to fully block inbound traffic.

Answer

Configure Cloud NAT and rely on default firewall rules.

Answer

Configure Cloud NAT and add a firewall rule to allow all egress traffic.

Answer

Configure Cloud NAT and add a firewall rule to deny all ingress and egress.

Question 8

A developer wants to create a VM that can communicate with all Google APIs without requiring an external IP address. Which configuration is necessary?

Accepted Answer

Enable Private Google Access on the subnet.. To enable a VM to communicate with Google APIs without an external IP, Private Google Access must be enabled on the subnet. This allows instances with only internal IPs to reach Google APIs and services through Google's internal network. Option A (Cloud NAT) provides internet access for non-Google destinations, not specifically for Google APIs. Option B (firewall rule to 0.0.0.0/0) would allow egress to the internet, but the VM still needs an external IP if Private Google Access is not enabled. Option C (VPC peering) is used to connect VPCs, not to access Google APIs. Therefore, Option D is correct.

Answer

Configure a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Set up VPC peering with the Google APIs service producer.

Question 9

Refer to the exhibit. A network engineer reviews the firewall rules in a VPC. What is the most significant security concern?

Accepted Answer

SSH is allowed from any source.. Allowing SSH (TCP/22) from any source (0.0.0.0/0) exposes the VPC instances to brute-force attacks, unauthorized access, and potential compromise. This violates the principle of least privilege and is a critical security misconfiguration in a VPC firewall rule.

Answer

There is no deny rule.

Answer

RDP is allowed from 10.0.0.0/8.

Answer

Firewall rules are not in order.

Question 10

A network engineer is troubleshooting connectivity from a Compute Engine instance in subnet-a to a Google Cloud Storage bucket. The instance has no external IP address. Based on the exhibit, what is the most likely cause of the connectivity issue?

Accepted Answer

Private Google Access is disabled on the subnet.. The instance has no external IP address, so it must use Private Google Access to reach Google APIs and services like Cloud Storage. Private Google Access is enabled at the subnet level; if it is disabled, the instance cannot route traffic to the Google API VIPs through the default route (0.0.0.0/0) without a NAT gateway or external IP. Option B correctly identifies this as the most likely cause.

Answer

The subnet purpose is PRIVATE, which blocks Google APIs.

Answer

The subnet CIDR range is too small.

Answer

Flow logs are disabled, so traffic is not logged.

Question 11

A startup is migrating a two-tier application to GCP. The web tier must be accessible from the internet, and the database tier must only be accessible from the web tier. Which network design should be used?

Accepted Answer

Place web servers in a public subnet with external IPs, database in a private subnet, and add a firewall rule allowing traffic from web subnet to database. It places the web servers in a public subnet with external IPs, allowing direct internet access, while the database resides in a private subnet with no external IP, enforcing isolation. A firewall rule (ingress on the database subnet) explicitly permits traffic from the web subnet’s CIDR range, typically on the database port (e.g., TCP 3306 for MySQL), ensuring the database is reachable only from the web tier. This design follows GCP’s best practice of using VPC firewall rules to control east-west traffic between subnets.

Answer

Place both tiers in separate VPCs and use VPC peering with no firewall rules

Answer

Place both tiers in the same subnet and configure firewall rules to restrict database access

Answer

Place web servers in a private subnet with Cloud NAT for outbound, database in the same private subnet

Question 12

A network engineer is setting up Dedicated Interconnect and sees the output above. What does the 'encryption: IPSEC' field indicate about this VLAN attachment?

Accepted Answer

Traffic over this VLAN attachment is encrypted using IPsec. The 'encryption: IPSEC' field in the VLAN attachment output for Dedicated Interconnect indicates that traffic traversing this attachment is encrypted using IPsec. This is a feature of Google Cloud's Dedicated Interconnect that allows you to enable IPsec encryption on the VLAN attachment itself, providing confidentiality and integrity for data in transit without requiring a separate Cloud VPN tunnel.

Answer

The attachment is using Cloud VPN as the underlying transport

Answer

The attachment requires a Cloud VPN tunnel in addition to the Interconnect

Answer

The attachment is using MACsec encryption at layer 2

Question 13

Your company has a Dedicated Interconnect with two VLAN attachments (vlan-attachment-a and vlan-attachment-b) connected to two different Edge Availability Domains (EADs) in the us-central1 region. Both attachments are associated with a single Cloud Router named 'cr-us-central1'. On-premises, you have two routers (rtr-a and rtr-b) each connected to one VLAN attachment via BGP. The Cloud Router has four BGP sessions: rtr-a (vlan-a), rtr-a (vlan-b), rtr-b (vlan-a), rtr-b (vlan-b) — a full mesh for redundancy. All sessions are established and routes are exchanged. Recently, you added a new on-premises subnet 192.168.100.0/24 and advertised it via BGP from both on-premises routers. However, Google Cloud instances in the VPC cannot reach this subnet. Other on-premises subnets (e.g., 10.0.0.0/8) are reachable. The Cloud Router route table for 'cr-us-central1' shows multiple entries for 192.168.100.0/24, each with different next hops but all with status 'stacked'. There are no BGP route filters configured. What is the most likely cause of the issue?

Accepted Answer

The new subnet 192.168.100.0/24 overlaps with an existing VPC subnet.. When a BGP-learned route overlaps with an existing VPC subnet, Google Cloud treats it as a conflict and marks the route as 'stacked' (i.e., not active). The Cloud Router can learn the route, but it will not be installed in the VPC's effective routes because the VPC subnet prefix takes precedence. Since 192.168.100.0/24 is a private IP range that could easily overlap with a subnet in the VPC, this is the most likely cause.

Answer

The Cloud Router has reached its maximum route limit.

Answer

The BGP routes have incorrect MED values causing a conflict.

Answer

The on-premises routers are not advertising the subnet with a required community tag.

Question 14

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

Accepted Answer

Reserve a static internal IP address in the same region and subnetwork.. A static internal IP address is reserved within a specific region and subnetwork, ensuring the IP persists even after the VM is stopped or deleted. This meets the requirement for a fixed internal address that remains available for reassignment to the same or a different VM in the same subnet. Ephemeral IPs are released on VM stop/delete, and external IPs are not relevant for internal-only communication.

Answer

Configure an alias IP range on the VM's network interface.

Answer

Assign an ephemeral external IP and configure a firewall rule.

Answer

Use a regional internal IP address with auto-delete set to false.

Question 15

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect using VLAN attachments. They have set up a Cloud Router with BGP to exchange routes. The on-premises network advertises a prefix 10.0.0.0/8, and Google Cloud advertises the VPC's subnet ranges (10.0.0.0/24 and 10.0.1.0/24). After configuration, on-premises hosts cannot reach the Google Cloud instances in those subnets. The engineer checks the BGP session status and it is established. The Cloud Router shows that the on-premises prefix is learned, and the on-premises router shows that the specific /24 prefixes are received. However, traffic from on-premises to the Google Cloud subnets is not working. What is the most likely cause?

Accepted Answer

The on-premises router has a local route for 10.0.0.0/8 that overrides the BGP-learned /24 routes.. The most likely cause is that the on-premises router has a local route for the larger prefix 10.0.0.0/8, which is more specific than the BGP-learned /24 routes. Since the local route has a lower administrative distance (typically 0 for directly connected or 1 for static) compared to BGP's administrative distance of 20 for eBGP, the on-premises router prefers the local route and forwards traffic locally instead of sending it over the Dedicated Interconnect to Google Cloud. This results in traffic not reaching the VPC subnets.

Answer

The VPN connection needs to be configured for the Interconnect.

Answer

The Google Cloud VPC has a custom static route that overrides the dynamically learned route.

Answer

The on-premises firewall is blocking the traffic.

Question 16

Which THREE components are required to set up Identity-Aware Proxy (IAP) for TCP forwarding to a VM?

Accepted Answer

A firewall rule that allows ingress from 35.235.240.0/20 to the VM on the desired port.. IAP TCP forwarding requires that the VM allows ingress traffic from the IAP health-check and forwarding source IP range (35.235.240.0/20) on the desired TCP port. Without this firewall rule, the IAP proxy cannot establish a connection to the VM, even if the user is authenticated and authorized.

Answer

The VM must have an external IP address.

Answer

A NAT gateway configured for the VPC.

Question 17

An engineer needs to configure a Cloud Router for a VPN tunnel to an on-premises network. The on-premises BGP ASN is 64512. Which ASN should the engineer assign to the Cloud Router?

Accepted Answer

64513. Cloud Router requires a unique ASN (typically a private ASN from 64512-65534) that does not conflict with the on-premises ASN. The default ASN for Cloud Router is 64512, but it must be changed if the on-premises ASN is the same. The engineer should use a different private ASN, such as 64513.

Answer

64512

Answer

Any public ASN

Answer

0

Question 18

Which TWO statements about HA VPN are correct?

Accepted Answer

It supports both active-active and active-passive modes.. HA VPN supports both active-active and active-passive modes. In active-active mode, both tunnels forward traffic simultaneously, while in active-passive mode, one tunnel is used as a standby. This flexibility allows HA VPN to meet different high-availability and load-balancing requirements.

Answer

Both VPN gateways must be in the same region.

Answer

It uses IKEv1 by default.

Answer

It supports static routing as well as dynamic routing.

Question 19

A company uses Shared VPC with multiple service projects. The network admin wants to restrict access to certain Compute Engine instances so that only specific service accounts can SSH into them. What is the best practice to achieve this?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding with IAM conditions restricting which service accounts can use IAP.. Identity-Aware Proxy (IAP) TCP forwarding allows SSH access to Compute Engine instances without exposing them to the public internet. By combining IAP with IAM conditions, the network admin can restrict which service accounts are permitted to use IAP, thereby controlling SSH access at the identity level rather than relying on source IP addresses. This approach aligns with Google Cloud's best practice for zero-trust network security.

Answer

Configure firewall rules that allow SSH only from source IP ranges of the allowed service accounts.

Answer

Use Organization Policies to restrict SSH access.

Answer

Use VPC Service Controls with a service perimeter.

Question 20

A company wants to resolve DNS queries for a private zone (e.g., example.internal) from multiple service projects using the same host project's Cloud DNS private zone. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows Cloud DNS private zones from one project (the host project) to be resolved by VPCs in other projects (service projects) without requiring Shared VPC or network connectivity. By setting up a DNS peering zone in each service project that targets the host project's private zone, DNS queries for example.internal are forwarded to the host project's authoritative DNS servers. This is the correct approach because it directly enables cross-project DNS resolution for private zones while keeping the zones managed centrally.

Answer

Shared VPC

Answer

DNS forwarding

Answer

Create a public zone