PCNE Practice Test 9 — 10 Questions

Question 1

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between services. Which configuration must be enabled?

Accepted Answer

Enable mTLS in the Traffic Director mesh configuration. To enforce mTLS between services in Traffic Director, you must enable mTLS in the Traffic Director mesh configuration. This setting automatically configures Envoy sidecars to use mutual TLS for service-to-service communication.

Answer

Configure SSL certificates on each Envoy sidecar manually

Answer

Use Cloud NAT to hide internal IPs

Answer

Enable Cloud Armor on the service

Question 2

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

Accepted Answer

The VM has a custom route that does not use the default route through Cloud NAT. Cloud NAT relies on the default route (0.0.0.0/0) pointing to the Cloud Router to direct traffic through the NAT gateway. If a VM has a custom route that overrides the default route (e.g., a more specific route to an external IP or a route to a different next hop), the VM's outbound traffic will bypass Cloud NAT entirely, resulting in the source IP being the VM's private IP instead of the Cloud NAT IP. This causes external firewalls to block the traffic as the source IP is not the expected NAT IP.

Answer

The VM is in a different zone than the Cloud NAT gateway

Answer

The VPC firewall rules are blocking outbound traffic from the VM to the Cloud NAT IP

Answer

Cloud Router is misconfigured and not advertising the Cloud NAT IP

Question 3

You are configuring a health check for a backend service that expects gRPC health probing. Which protocol should the health check use to verify gRPC service health?

Accepted Answer

gRPC. gRPC health checking uses the gRPC Health Checking Protocol (defined in the grpc.health.v1 package) over HTTP/2, so the health check must use the gRPC protocol to invoke the Check method and receive SERVING/NOT_SERVING status. Using gRPC ensures the probe speaks the same protocol and can query the service's health endpoint correctly. This is the standard approach for Kubernetes gRPC liveness/readiness probes via tools like grpc-health-probe.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 4

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides a direct, private connection between your on-premises network and Google Cloud, supporting bandwidth up to 100 Gbps (via multiple 10 Gbps or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant attachments. This solution requires you to manage your own physical infrastructure in a Google colocation facility, meeting the organization's requirement for self-managed hardware.

Answer

Cloud VPN with multiple tunnels

Answer

Partner Interconnect

Answer

HA VPN

Question 5

A company has two VPCs in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). They want to allow SSH from VPC-A to instances in VPC-B. The network admin creates a firewall rule with source range 10.0.0.0/16 and protocol tcp:22, but connectivity fails. What is the most likely cause?

Accepted Answer

The rule is created in VPC-A instead of VPC-B.. Firewall rules in Google Cloud are applied at the network level, not the instance level. To allow inbound SSH traffic from VPC-A to instances in VPC-B, the firewall rule must be created in VPC-B (the destination network) with the source range set to 10.0.0.0/16. Creating the rule in VPC-A would only affect traffic destined for instances in VPC-A, not VPC-B.

Answer

The source range should be 10.0.0.0/8.

Answer

The target tag is not specified.

Answer

The source tag is missing.

Question 6

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

Accepted Answer

The passive VLAN attachment does not have BGP session configured with Cloud Router.. For a Dedicated Interconnect failover to occur, the passive connection must have a VLAN attachment with a configured BGP session peering with Cloud Router. Without BGP, the passive connection cannot advertise routes or receive routes, so traffic will not fail over even if the physical link is up. The most likely reason is that the passive VLAN attachment lacks a BGP session.

Answer

The SLA requires two circuits in different metro areas for failover.

Answer

The on-premises router is not configured to use the passive connection.

Answer

The passive connection is in a different metro area, causing higher latency.

Question 7

An organization has two VPC networks in different Google Cloud organizations. They need to allow private IP communication between instances in these VPCs without using public IPs or VPNs. Which solution should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering allows private IP connectivity between two VPC networks across different organizations without requiring public IPs, VPNs, or gateways. It uses the Google Cloud internal infrastructure to route traffic directly between instances, leveraging RFC 1918 addresses and supporting global peering.

Answer

Cloud NAT

Answer

Shared VPC

Answer

Cloud VPN

Question 8

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

Accepted Answer

Ingress rule: source 203.0.113.5/32, destination 10.0.1.2/32, tcp:22. Firewall rules in GCP are stateful and applied at the instance level, not the VPN tunnel. The rule must allow ingress traffic from the on-premises source IP (203.0.113.5/32) to the Compute Engine instance's internal IP (10.0.1.2/32) on TCP port 22. The Cloud VPN and Cloud Router handle routing, but the firewall rule explicitly defines the allowed traffic flow.

Answer

Ingress rule: source 203.0.113.5/32, destination 169.254.0.1/32, tcp:22

Answer

Ingress rule: source 10.0.1.2/32, destination 203.0.113.5/32, tcp:22

Answer

Ingress rule: source 0.0.0.0/0, destination 203.0.113.5/32, tcp:22

Question 9

A network engineer is troubleshooting a Cloud VPN gateway that is not establishing a VPN tunnel with an on-premises device. The engineer checks the Cloud VPN gateway logs and sees the error 'IKE SA negotiation failed due to mismatched authentication method'. What is the most likely cause?

Accepted Answer

The authentication method is set to 'pre-shared key' on one side and 'certificate' on the other.. The error 'IKE SA negotiation failed due to mismatched authentication method' indicates that the two VPN peers are configured with different authentication methods. One side is using pre-shared key (PSK) and the other is using certificates, so they cannot agree on how to authenticate. This is a common misconfiguration in Cloud VPN setups.

Answer

The pre-shared keys on both ends do not match.

Answer

The VPN gateway is using the wrong external IP address.

Answer

The IKE version configured on the on-premises device is IKEv1 while Cloud VPN only supports IKEv2.

Question 10

A security team wants to block traffic from specific geographic regions (e.g., Country A) to their HTTP(S) load balancer. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS protection service that integrates with HTTP(S) load balancers. It allows you to create security policies with rules that can block or allow traffic based on various criteria, including geographic location (country/region). Therefore, Cloud Armor is the correct service to block traffic from specific geographic regions.

Answer

Firewall rules

Answer

VPC Service Controls

Answer

Cloud CDN