PCNE Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Answer

Change the stack type of subnet-b to IPV4_IPV6.

Answer

Configure Cloud NAT in the region of subnet-b.

Answer

Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.

Question 2

A company is running workloads on Compute Engine instances without public IP addresses. They need to allow these instances to securely access the internet for software updates. Which Google Cloud service should be configured?

Accepted Answer

Cloud NAT. Cloud NAT (Network Address Translation) allows Compute Engine instances without public IP addresses to initiate outbound connections to the internet for tasks like software updates. It translates the private IP addresses of the instances to a public IP address managed by Google Cloud, enabling secure outbound internet access without exposing the instances to inbound traffic.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering

Question 3

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

Accepted Answer

Pre-configured WAF rules. Pre-configured WAF rules in Cloud Armor include a SQL injection (SQLi) rule that inspects HTTP(S) request bodies, headers, and URIs for SQL injection patterns. This rule uses a set of signatures to detect and block malicious SQL queries, directly addressing the requirement to protect against SQL injection attacks on an external HTTP(S) load balancer.

Answer

IP allowlist/denylist

Answer

Named IP address lists

Answer

Rate limiting

Question 4

A company needs to connect their on-premises data center to Google Cloud with a consistent, high-availability connection that offers 99.99% availability SLA. The on-premises router supports VLAN tagging and BGP. They expect to burst up to 50 Gbps peak traffic. Which interconnect solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, supporting up to 80 Gbps per connection (via 10 or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant links and BGP sessions. The on-premises router's support for VLAN tagging and BGP aligns perfectly with Dedicated Interconnect's requirements for 802.1Q VLANs and eBGP peering, making it the only option that meets the 50 Gbps burst requirement and high-availability SLA.

Answer

Cloud VPN with dynamic routing

Answer

Partner Interconnect

Answer

HA VPN

Question 5

Which THREE of the following are requirements for VPC Network Peering?

Accepted Answer

The VPCs must have non-overlapping subnet IP ranges.. VPC Network Peering requires non-overlapping subnet IP ranges to prevent routing conflicts and ensure that traffic is correctly directed between the peered VPCs. Overlapping CIDR blocks would cause ambiguous routing, as the same IP address could exist in both VPCs, making it impossible for the VPC routers to determine the correct destination.

Answer

Peering supports transitive routing.

Answer

The VPCs must be in the same project.

Question 6

Which TWO of the following load balancer types can distribute traffic to backends in multiple regions?

Accepted Answer

External HTTP(S) Load Balancer. The External HTTP(S) Load Balancer is a global load balancer that can distribute traffic to backends in multiple regions using anycast IP addresses and Google's global network. It supports cross-regional backend services, making it suitable for global applications.

Answer

Internal HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP/UDP Load Balancer

Question 7

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address. When the BGP session state is stuck in 'CONNECT', it indicates that the router is actively trying to initiate a TCP connection to the peer but is not receiving a response. For BGP to establish a TCP session (port 179), the on-premises router must have a valid IP route to the Cloud Router's BGP peer IP address. Without this route, TCP SYN packets are dropped, preventing the session from transitioning to 'ESTABLISHED'.

Answer

Change the BGP ASN on the Cloud Router to a different number

Answer

Increase the BGP hold timer on the Cloud Router

Answer

Change the BGP keepalive interval to 10 seconds

Question 8

A financial services firm needs to connect their on-premises data center to Google Cloud VPC with 50 Gbps of bandwidth and latency under 5 ms. They are in a metropolitan area with a Google Cloud region. They require an SLA of 99.99% and need to support VLAN attachments to multiple VPCs. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides direct, private connections between the on-premises data center and Google Cloud VPC, supporting up to 80 Gbps per interconnect (via 8 x 10 Gbps links) and offering a 99.99% SLA when configured with redundant links. It supports VLAN attachments (VLANs) to multiple VPCs, enabling segmentation across different environments, and meets the sub-5 ms latency requirement within a metropolitan area with a Google Cloud region.

Answer

Direct Peering

Answer

Cloud VPN with multiple tunnels and ECMP

Answer

Partner Interconnect

Question 9

A company has a VPC with a firewall rule that allows SSH (tcp:22) from 0.0.0.0/0. They want to restrict SSH access to only the public IP address of their Cloud VPN gateway. How should they modify the firewall rule?

Accepted Answer

Change the source IP range to the VPN gateway's public IP address.. The firewall rule currently allows SSH from any source IP (0.0.0.0/0). To restrict access to only the Cloud VPN gateway, you must change the source IP range to the gateway's public IP address, because the SSH connection originates from the VPN gateway's public-facing interface over the internet. Internal IP addresses are not routable over the internet and would not match the source of the incoming SSH traffic.

Answer

Use Cloud Armor to block all SSH except from the VPN IP.

Answer

Change the source IP range to the VPN gateway's internal IP address.

Answer

Use IAP Tunneling instead of SSH firewall rules.

Question 10

A company is deploying a global HTTP load balancer with a backend service that spans multiple regions. The backend instances are in a managed instance group. They want to use Cloud CDN to cache content. What is the minimal set of configurations required on the backend bucket or instance group to enable Cloud CDN?

Accepted Answer

Enable Cloud CDN on the backend service and ensure that the load balancer's frontend uses HTTP or HTTPS protocol. Cloud CDN must be enabled on the backend service of the HTTP(S) load balancer, and the frontend must use HTTP or HTTPS because Cloud CDN only supports HTTP(S) protocols. This is the minimal configuration; no changes to the backend bucket or instance group are required beyond ensuring the backend service is correctly associated with the load balancer.

Answer

Configure Identity-Aware Proxy (IAP) on the backend service to allow cache

Answer

Use the gcloud compute backend-services update command with the --enable-cdn flag on the load balancer itself

Answer

Create a Cloud Storage bucket with public access and set it as the backend

PCNE Practice Test 9 — 10 Questions

Exhibit

PCNE Practice Test 9 — 10 Questions

Exhibit