PCNE Practice Test 8 — 10 Questions

Question 1

An enterprise uses HA VPN to connect their on-premises network to Google Cloud. The on-premises side has a single VPN device that supports BGP. They want to maximize availability. What is the recommended Google Cloud configuration?

Accepted Answer

Deploy a single Cloud VPN gateway with two interfaces, each with its own external IP, and configure two BGP sessions to the single on-premises device.. Option C is correct because it provides high availability by using a single Cloud VPN gateway with two interfaces, each with its own external IP, and two BGP sessions to the on-premises device. This configuration allows active/active failover: if one interface or BGP session fails, traffic automatically switches to the other, maximizing availability without requiring multiple regions.

Answer

Deploy two Cloud VPN gateways in different regions to provide regional failover.

Answer

Deploy a single Cloud VPN gateway with one interface and one BGP session.

Answer

Deploy a single Cloud VPN gateway with two interfaces, but only use one BGP session for simplicity.

Question 2

A company is using Cloud DNS for private zone resolution within their VPC. They have a private zone for 'example.internal' and have attached it to the VPC. When they create a new Compute Engine VM and try to resolve 'myapp.example.internal', it fails. What is the most likely cause?

Accepted Answer

The record 'myapp.example.internal' does not exist in the zone. Option D is correct because the most likely cause of a resolution failure for a specific record is that the record does not exist in the private zone. The question states the zone is attached to the VPC, so the zone itself is accessible; the failure is specific to the record name. Cloud DNS will return an NXDOMAIN response if the record is not defined, even if the zone is properly configured.

Answer

The private zone is not attached to the VPC

Answer

The VM's /etc/resolv.conf does not point to Cloud DNS

Answer

Firewall rule blocking DNS traffic (UDP 53) to the metadata server

Question 3

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

Accepted Answer

Check the MTU size on the VPN tunnel or interconnect.. Option A is correct because an MTU mismatch on the VPN tunnel or interconnect can cause packet fragmentation or drops, leading to BGP session flapping. Cloud Router uses Google's internal infrastructure, and if the MTU is set too low, large BGP update packets may be silently discarded, triggering hold timer expiry and session resets. Checking and adjusting the MTU ensures that BGP packets can traverse the path without fragmentation.

Answer

Delete and recreate the VLAN attachment.

Answer

Revert all BGP routes to static routes.

Answer

Increase the bandwidth of the interconnect.

Question 4

Which TWO of the following are benefits of using Cloud Interconnect over Cloud VPN for hybrid connectivity? (Choose two.)

Accepted Answer

Lower and more consistent latency.. Cloud Interconnect provides a dedicated, private connection between your on-premises network and Google Cloud, bypassing the public internet. This results in lower and more consistent latency compared to Cloud VPN, which relies on the public internet and is subject to variable network conditions and potential congestion.

Answer

Always provides encryption for data in transit.

Answer

Easier to set up as no physical connection is needed.

Answer

Lower cost for small bandwidth requirements.

Question 5

An engineer configured a Cloud Router with the above settings. The VPC network has subnets 10.1.0.0/16 and 10.2.0.0/16, as well as subnets 10.3.0.0/16 and 10.4.0.0/16. The on-premises router is only receiving routes for 10.1.0.0/16 and 10.2.0.0/16 but not for 10.3.0.0/16 and 10.4.0.0/16. What is the cause?

Accepted Answer

The Cloud Router is set to custom advertisement mode, and the missing subnets are not included in the advertised IP ranges. Option C is correct because when a Cloud Router is configured in custom advertisement mode, it only advertises the specific CIDR ranges explicitly listed in the 'Advertised IP ranges' field. Since the missing subnets (10.3.0.0/16 and 10.4.0.0/16) are not included in that list, they are not propagated via BGP to the on-premises router, even though they exist in the VPC.

Answer

The BGP session is not established

Answer

The Cloud Router is in global routing mode, which does not advertise all subnets

Answer

The on-premises router has a filter that blocks the other routes

Question 6

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

Accepted Answer

Enable IP forwarding on the VPN appliance VM instance.. Option C is correct because a third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.

Answer

Create a custom route in the VPC pointing to the VPN appliance's internal IP.

Answer

Enable Private Google Access on the subnet hosting the VPN appliance.

Answer

Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.

Question 7

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

Accepted Answer

The BGP routes for that subnet are not advertised.. The Dedicated Interconnect is up and the organization can ping instances in one subnet, which confirms that Layer 2 and basic Layer 3 connectivity (via the VLAN attachment) are working. However, the inability to reach a service on a different subnet within the same VPC indicates that the on-premises router does not have a route to that specific subnet. This is most likely because the BGP session is not advertising the prefix for that subnet, or the on-premises router is not receiving the route via BGP. Without the route, traffic from on-premises to that subnet will be dropped.

Answer

The MTU is too small.

Answer

The firewall rules are blocking the traffic.

Answer

The VLAN attachment is down.

Question 8

A company with limited public IP addresses on-premises needs to connect to Google Cloud using Cloud VPN. They require high availability. Which solution should they implement?

Accepted Answer

Use HA VPN with two on-premises public IPs and two tunnels.. HA VPN provides high availability by using two tunnels, each terminating on a separate on-premises VPN gateway with a unique public IP address. This ensures that if one on-premises public IP or tunnel fails, traffic can still flow through the other tunnel, meeting the high-availability requirement. Classic VPN (option B) does not support active-active failover, and using the same public IP for both tunnels (option D) creates a single point of failure at the on-premises side.

Answer

Use NAT to map multiple private IPs to one public IP.

Answer

Use Classic VPN with a single tunnel.

Answer

Use HA VPN with the same public IP for both tunnels.

Question 9

A company has set up an HA VPN tunnel between their on-premises router and a Cloud Router in Google Cloud. The on-premises router establishes BGP sessions to both Cloud Router instances, but the routes learned from one Cloud Router instance are not being received. The other instance works fine. What is the most likely cause?

Accepted Answer

The on-premises router has incorrect ASN configured for that BGP session. The most likely cause is that the on-premises router has an incorrect ASN configured for the BGP session with the failing Cloud Router instance. In Google Cloud HA VPN, each Cloud Router instance uses a unique BGP IP address but both must use the same peer ASN as configured on the on-premises side. If the ASN mismatch occurs, BGP will not establish or will reject routes, while the other session with the correct ASN works fine.

Answer

The tunnel is in a failed state

Answer

The on-premises router has a firewall blocking BGP updates only on one IP address

Answer

The Cloud Router is set to advertisement mode 'Custom' and does not advertise all subnets

Question 10

Which TWO network services can be used to provide secure connectivity between a VPC and an on-premises data center without traversing the public internet? (Choose two.)

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (C) provides a direct, private physical connection between your on-premises network and Google's VPC, bypassing the public internet entirely. This ensures low latency, high bandwidth, and consistent network performance for secure hybrid cloud connectivity.

Answer

Cloud VPN with IPsec

Answer

Cloud NAT

Answer

VPC Network Peering