PCNE Practice Test 9 — 10 Questions

Question 1

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Cloud NAT with a static NAT IP address and ensure all traffic uses that IP.. Cloud NAT with a static NAT IP address ensures that all outbound traffic from private instances uses a consistent, predictable source IP. This satisfies the external API's requirement for a static source IP without needing to assign public IPs directly to instances. Option C correctly configures Cloud NAT to use a static IP, which is the intended solution for this scenario.

Answer

Use Private Google Access instead of Cloud NAT.

Answer

Assign a static external IP to the instances and use Cloud NAT with static IPs.

Answer

Use a VPN tunnel to the API provider's network.

Question 2

A company is deploying a GKE cluster with Dataplane V2 and wants to enforce micro-segmentation using network policies. They also need to monitor policy violations. What should they do?

Accepted Answer

Enable GKE Dataplane V2 and use Kubernetes Network Policies with audit logging.. Dataplane V2 uses eBPF to implement Kubernetes Network Policies directly in the kernel, providing native support for micro-segmentation. Enabling audit logging on the cluster captures denied or allowed policy actions, allowing the company to monitor policy violations without additional infrastructure.

Answer

Enable Packet Mirroring.

Answer

Use Cloud IDS to monitor traffic.

Answer

Use VPC firewall rules with pod IP ranges.

Question 3

A company is using Partner Interconnect to connect their data center to Google Cloud. They notice that traffic from their on-premises network to a specific subnet in VPC is taking a suboptimal path. Which action should they take to influence the routing preference?

Accepted Answer

Configure BGP MED values on the on-premises router for the prefixes advertised to the Cloud Router.. BGP MED (Multi-Exit Discriminator) is the standard mechanism for influencing inbound traffic path selection when multiple connections exist between two autonomous systems. By setting a lower MED value on the on-premises router for prefixes advertised to the Cloud Router, the on-premises network can signal Google Cloud to prefer that specific VLAN attachment for traffic destined to the subnet, thereby correcting the suboptimal path.

Answer

Use route priorities on the Cloud Router for the learned routes.

Answer

Change the VLAN attachment's mode to active-active.

Answer

Set a lower cost on the Cloud Router interface for the preferred VLAN attachment.

Question 4

A Dedicated Interconnect VLAN attachment is in ACTIVE state. The Cloud Router has learned routes from on-premises, and the on-premises router has learned routes from GCP. However, traffic from on-premises to a GCP VM fails. What should the engineer check first?

Accepted Answer

Both A and C.. Both firewall rules and VPC subnet routes must be in place for traffic to reach a GCP VM. Even if the VLAN attachment is ACTIVE and routes are exchanged, the VPC firewall must permit ingress from the on-premises range, and the VPC subnet routes must exist in the routing table for the VM's subnet. Without both, traffic will be dropped or not forwarded.

Answer

Check firewall rules on the GCP VPC for ingress from the on-premises range.

Answer

Confirm that the Cloud Router is advertising the on-premises subnets back to the VPC.

Answer

Verify that the VPC subnet routes exist in the routing table.

Question 5

A company has a VPC with multiple subnets and uses Cloud VPN tunnels to connect to on-premises. They want to ensure that only traffic destined for on-premises is sent through the VPN tunnels; all other traffic should use the internet. Which route configuration should they implement?

Accepted Answer

Use Cloud Router with BGP to exchange specific routes with on-premises, and keep the default internet route for other traffic.. Using Cloud Router with BGP allows the VPC to dynamically learn specific routes from the on-premises network via the VPN tunnels. The default route (0.0.0.0/0) remains pointing to the internet gateway, so only traffic destined for the learned on-premises prefixes is sent through the VPN, while all other traffic uses the internet. This provides precise control without overriding the default route.

Answer

Add a static route for 0.0.0.0/0 with next hop VPN gateway, and set a lower priority than the internet default route.

Answer

Configure the Cloud VPN to advertise a default route to on-premises, and rely on local preference.

Answer

Use VPC Network Peering with the on-premises network and configure custom route exchange.

Question 6

A customer reports that after setting up HA VPN, some on-premises subnets are not reachable from Google Cloud. The Cloud Router shows the missing routes. What is the most likely cause?

Accepted Answer

BGP route filters are blocking the advertisement of those subnets.. The Cloud Router shows the missing routes, indicating that the VPN tunnel and BGP session are up, but the routes are not being installed. BGP route filters on the Cloud Router or on-premises router can explicitly block the advertisement of specific subnets, preventing them from being learned and installed in the routing table even though the BGP session is established.

Answer

The VPN tunnel is down.

Answer

The on-premises router is not configured to advertise those subnets.

Answer

The shared secret is incorrect.

Question 7

An organization is designing IP address planning for hybrid connectivity. They have three VPCs (Prod, Dev, Test) that will be peered with each other and also connected to an on-premises network via Cloud VPN. Which practice should they follow to avoid IP address overlap?

Accepted Answer

Allocate unique, non-overlapping IP ranges for each VPC and on-premises network. To avoid routing conflicts, each VPC and the on-premises network should use unique, non-overlapping RFC 1918 CIDR blocks. Overlap would cause routing issues and potential traffic blackholing.

Answer

Use overlapping IP ranges but rely on NAT to resolve conflicts

Answer

Use carrier-grade NAT (CGNAT) ranges for all VPCs to avoid private IP conflicts

Answer

Use the same /16 range for all VPCs to simplify route summarization

Question 8

A company with multiple VPCs in a Shared VPC environment wants to connect their on-premises network to all VPCs with high availability and minimal cost. They already have a Dedicated Interconnect. What is the most efficient solution?

Accepted Answer

Use the existing Dedicated Interconnect to create multiple VLAN attachments, one per VPC.. A Dedicated Interconnect can support multiple VLAN attachments (each with a separate VLAN ID and BGP session) to connect to different VPCs in a Shared VPC environment. This approach leverages the existing physical connection, provides high availability through redundant attachments, and minimizes cost by avoiding additional circuits or VPN tunnels.

Answer

Set up Cloud VPN with dynamic routing to each VPC.

Answer

Create an HA VPN gateway for each VPC and peer with on-prem.

Answer

Provision a new Partner Interconnect for each VPC.

Question 9

A company uses a VPC with two subnets: subnet-a (10.0.1.0/24) with VMs tagged 'web', and subnet-b (10.0.2.0/24) with VMs tagged 'db'. They have a Cloud VPN tunnel to an on-premises network (172.16.0.0/16). The VPN tunnel is up and BGP is exchanging routes. A custom route for 172.16.0.0/16 with next hop VPN gateway exists, but it has a tag 'web', meaning it applies only to VMs with the 'web' tag. VMs in subnet-a can reach on-premises, but VMs in subnet-b cannot. Which step should be taken to allow subnet-b VMs to reach on-premises?

Accepted Answer

Add the 'db' tag to the custom route.. The custom route for 172.16.0.0/16 is tagged with 'web', so it only applies to VMs that have the 'web' tag. Subnet-b VMs are tagged 'db', so they do not match the route and cannot reach on-premises. Adding the 'db' tag to the route makes it apply to both tagged groups, enabling connectivity for subnet-b VMs without affecting existing traffic.

Answer

Create a new route for 172.16.0.0/16 with priority 1000 and no tag.

Answer

Remove the tag from the existing route.

Answer

Add a firewall rule to allow egress traffic from subnet-b.

Question 10

Refer to the exhibit. A request arrives with User-Agent 'GoodBot' and path '/admin'. What action does Cloud Armor take?

Accepted Answer

Allow the request because the rule with priority 200 matches and allows it.. Cloud Armor evaluates rules in order of priority (lowest number = highest priority). The rule with priority 200 matches the request (User-Agent 'GoodBot' and path '/admin') and explicitly allows it. Once a matching allow rule is found, evaluation stops, and the request is allowed, overriding any lower-priority rules.

Answer

Deny the request because the rule with priority 300 has a higher priority number but matches path.

Answer

Allow the request because of the default rule at priority 1000.

Answer

Deny the request because both rules match and deny takes precedence.