PCNE Practice Test 8 — 10 Questions

Question 1

A large multinational corporation uses a Shared VPC in Google Cloud with multiple service projects. They have a central Cloud NAT configured in the host project in the us-central1 region to provide internet egress for all VMs. Recently, the IT team added a new subnet (10.0.10.0/24) in a service project and deployed VMs there. All other VMs in the same project but in different subnets (e.g., 10.0.1.0/24) can reach the internet, but the new VMs in 10.0.10.0/24 cannot. The Cloud NAT gateway is configured in us-central1 with all IP ranges allowed. The VPC firewall rules allow egress traffic to the internet. The team verified that the VMs have a default route (0.0.0.0/0) with next-hop 'default-internet-gateway' and that the Cloud NAT router's NAT IPs are properly assigned. However, the new subnet's VMs are unable to connect to any external IP. The network engineer suspects that the Cloud NAT's NAT reservations might be the issue, but all NAT IPs are ephemeral. Further investigation shows that the Cloud Router used by Cloud NAT is advertising custom IP ranges via BGP to an on-premises router for a different use case. What is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the new subnet range (10.0.10.0/24) from the custom advertised routes on the Cloud Router associated with the Cloud NAT.. The Cloud Router associated with Cloud NAT is advertising custom IP ranges via BGP to an on-premises router. If the new subnet range (10.0.10.0/24) is included in those custom advertised routes, the on-premises router may advertise a more specific route back to the VPC, causing the VMs in that subnet to prefer the on-premises route over the default route (0.0.0.0/0) for internet-bound traffic. Since the on-premises router does not have internet access, the traffic is blackholed. Removing the subnet range from the custom advertised routes on the Cloud Router resolves the issue by ensuring the default route remains the preferred path for internet egress.

Answer

Add a static route for 0.0.0.0/0 with next-hop set to the Cloud NAT gateway's IP address in the VPC.

Answer

Update the VPC firewall rules to explicitly allow egress traffic from the new subnet's IP range to 0.0.0.0/0.

Answer

Reserve static NAT IPs for the new subnet in the Cloud NAT configuration to ensure that the VMs have a consistent egress IP.

Question 2

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Accepted Answer

Geo routing policy. Geo routing policy (B) is correct because it lets Cloud DNS return answers based on the geographic location of the querying client, which directly satisfies the requirement to direct users by region. Failover policy (C) is correct because it enables health-checked primary/backup routing, so traffic automatically shifts to a healthy backup region when the primary endpoint is unhealthy. Together, these two policies match the stated need for location-based steering plus regional failover. Weighted round-robin (A) only distributes traffic by configured weights and does not provide geographic targeting or health-based failover. DNSSEC (D) is a security extension for authenticating DNS responses, not a routing policy. Response policy zone (E) is used to override or rewrite DNS answers for policy/filtering purposes, not for geo-based routing or failover.

Answer

Weighted round-robin

Answer

DNSSEC

Answer

Response policy zone

Question 3

A company has a global e-commerce platform using a Global HTTPS Load Balancer with Cloud CDN. They want to serve private content, such as user-specific PDFs, with CDN caching while ensuring only authorized users can access it. Which method should they use?

Accepted Answer

Use Cloud CDN signed URLs or signed cookies. Cloud CDN signed URLs or signed cookies are the correct mechanism to serve private content through the CDN while enforcing per-user authorization. They embed a cryptographic signature and expiration that the CDN edge validates before serving cached content, so only users with a valid signed URL/cookie can access the private PDFs. This preserves CDN caching benefits while restricting access.

Answer

Use Cloud Armor to restrict access by IP address

Answer

Enable IAM permissions on the backend bucket and restrict access to only authenticated users

Answer

Set the cache mode to FORCE_CACHE_ALL and use a token in the URL

Question 4

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is GCP's managed hub-and-spoke service that connects multiple on-premises data centers (via Cloud VPN or Interconnect) and multiple VPCs (as spokes) through a central hub. It simplifies topology management, routing, and monitoring for large-scale hybrid and multi-VPC connectivity, which is exactly the requirement.

Answer

Cloud VPN

Answer

VPC peering

Answer

Cloud Router

Question 5

An organization wants to allow only certain users to access a service published via Private Service Connect. They need to restrict access based on the source VPC network. What should they use?

Accepted Answer

Consumer allow lists in the service attachment. Private Service Connect allows publishing services with access control using service attachment with consumer allow lists that specify which projects or VPCs can connect.

Answer

Firewall rules in the consumer VPC

Answer

IAM permissions on the service attachment

Answer

VPC Service Controls

Question 6

A company wants to connect two VPC networks (vpc-a and vpc-b) that both reside in the same Google Cloud project. They need to ensure that all IP ranges in both VPCs can communicate using internal private IP addresses. Which solution should they implement?

Accepted Answer

Enable VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering directly connects two VPCs within the same project using internal RFC 1918 IP addresses, with no bandwidth limitations and no single point of failure. It allows all subnets in both VPCs to communicate privately without requiring external connectivity, VPN tunnels, or NAT gateways.

Answer

Use Dedicated Interconnect to connect the VPCs.

Answer

Set up Cloud VPN tunnels between the two VPCs.

Answer

Configure Cloud NAT to allow the VPCs to communicate through NAT.

Question 7

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

Accepted Answer

Private Service Connect endpoint. When a consumer wants to connect to a managed SaaS application published via Private Service Connect (PSC), they must create a Private Service Connect endpoint in their own VPC. This endpoint is a regional resource that uses an internal IP address from the consumer's VPC and establishes a connection to the service attachment published by the provider. The endpoint effectively makes the SaaS service accessible as if it were a resource inside the consumer's VPC, without requiring public IPs or VPNs.

Answer

Service attachment

Answer

Internal forwarding rule

Answer

Cloud VPN tunnel

Question 8

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

Accepted Answer

Check VPC firewall rules to ensure ingress traffic from the on-premises subnet is allowed to the VM. VPC firewall rules are the first line of defense for controlling traffic to GCE VMs. Even though the VPN tunnel is established, the default-deny ingress posture of GCP means that traffic from the on-premises subnet must be explicitly allowed by a VPC firewall rule. Without this rule, packets arriving via the tunnel are dropped before they ever reach the VM's network interface.

Answer

Check the VM's OS firewall to see if it is blocking incoming traffic

Answer

Verify that the VPN tunnel is using the correct pre-shared key

Answer

Review Cloud Armor security policies that may be blocking the traffic

Question 9

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Answer

Change the stack type of subnet-b to IPV4_IPV6.

Answer

Configure Cloud NAT in the region of subnet-b.

Answer

Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.

Question 10

A company wants to connect two VPCs in different GCP projects so that they can exchange traffic using internal IP addresses. They do not need centralized management or transitive routing between the VPCs. Which GCP networking feature should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering in Google Cloud allows two VPC networks in different projects (or organizations) to connect privately using internal IP addresses. It provides full mesh connectivity without a gateway or VPN, and it does not require centralized management or transitive routing. This exactly matches the requirement to connect two VPCs in different GCP projects for internal IP traffic.

Answer

Network Connectivity Center

Answer

Cloud VPN

Answer

Shared VPC