PCNE Designing, planning, and prototyping a GCP network Practice Test 1 — 15 Questions

Question 1

Your company is deploying a multi-tier web application on Google Kubernetes Engine (GKE) with a regional cluster. You need to design network policies to allow traffic only from the frontend pods to the backend pods on port 8080. Which of the following is the most secure and recommended approach?

Accepted Answer

Define a Kubernetes NetworkPolicy that allows ingress to backend pods from frontend pods on port 8080.. A Kubernetes NetworkPolicy is the native and most secure way to control pod-to-pod traffic within a GKE cluster. By defining an ingress rule that allows traffic only from frontend pods (selected via pod labels) to backend pods on TCP port 8080, you enforce micro-segmentation at the pod level, which is the recommended practice for multi-tier applications. This approach works regardless of the underlying node or VPC configuration and is fully integrated with GKE's network policies engine (Calico or Cilium).

Answer

Configure Private Service Connect to restrict access to backend pods.

Answer

Create VPC firewall rules to allow ingress from frontend pods to backend pods on port 8080.

Answer

Use Cloud Armor security policies to restrict traffic to backend pods.

Question 2

A company is designing a hybrid connectivity solution between an on-premises data center and Google Cloud. They have a high bandwidth requirement of 20 Gbps and need a service level agreement (SLA) of 99.99% availability. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect with two 10 Gbps connections. Dedicated Interconnect provides direct, private connections between your on-premises network and Google Cloud, supporting up to 10 Gbps per circuit. By using two 10 Gbps connections in an active-active or active-passive configuration, you can achieve the required 20 Gbps aggregate bandwidth and meet the 99.99% SLA, as Google guarantees this SLA when you have at least two redundant connections.

Answer

Cloud VPN with two tunnels each using 1 Gbps

Answer

Direct Peering

Answer

Partner Interconnect with two 10 Gbps connections

Question 3

A network engineer needs to design a VPC network for a global application that will have Compute Engine instances in multiple regions. The instances need to communicate with each other using internal IP addresses. What is the simplest way to enable this communication?

Accepted Answer

Create a single VPC network with subnets in each region.. A single VPC network is global and can contain subnets in any region. By placing subnets in each required region within the same VPC, instances can communicate using internal IP addresses (RFC 1918) without any additional connectivity services. This is the simplest and most scalable approach because VPCs inherently provide global routing between subnets.

Answer

Use Dedicated Interconnect to connect regions.

Answer

Use Cloud VPN to connect the instances.

Answer

Create separate VPC networks per region and peer them.

Question 4

Which TWO of the following are valid methods to reduce latency between users in Europe and a GCP-hosted application?

Accepted Answer

Use Cloud CDN to cache content at edge locations.. Cloud CDN uses Google's globally distributed edge caches to serve content from locations closer to users, reducing round-trip time and latency. For users in Europe, cached static or dynamic content is delivered from a nearby edge PoP, bypassing the need to fetch from the origin server in a potentially distant region.

Answer

Establish a Cloud VPN tunnel to the user's ISP.

Answer

Use Premium Tier networking instead of Standard Tier.

Answer

Use Cloud NAT for outbound traffic.

Question 5

Which THREE of the following are requirements for implementing a Global External HTTP(S) Load Balancer with an external backend?

Accepted Answer

The backend must support health checks from the load balancer's health check IP ranges.. Option B is correct because Global External HTTP(S) Load Balancers use Google's frontend (proxying) IP ranges to send health checks to backends. The backend must allow inbound traffic from these specific health check IP ranges (e.g., 35.191.0.0/16 and 130.211.0.0/22) to receive health probes; otherwise, the load balancer will mark the backend as unhealthy and stop forwarding traffic.

Answer

The backend must be configured with Private Google Access.

Answer

The backend must have an SSL certificate installed.

Question 6

A network engineer is troubleshooting connectivity from a Compute Engine instance in subnet-a to a Google Cloud Storage bucket. The instance has no external IP address. Based on the exhibit, what is the most likely cause of the connectivity issue?

Accepted Answer

Private Google Access is disabled on the subnet.. The instance has no external IP address, so it must use Private Google Access to reach Google APIs and services like Cloud Storage. Private Google Access is enabled at the subnet level; if it is disabled, the instance cannot route traffic to the Google API VIPs through the default route (0.0.0.0/0) without a NAT gateway or external IP. Option B correctly identifies this as the most likely cause.

Answer

The subnet purpose is PRIVATE, which blocks Google APIs.

Answer

The subnet CIDR range is too small.

Answer

Flow logs are disabled, so traffic is not logged.

Question 7

Based on the exhibit, what is the purpose of Cloud Router's BGP configuration?

Accepted Answer

To advertise the VPC's IP range to the on-premises network.. Cloud Router uses BGP to dynamically exchange routes between a VPC network and an on-premises network over a VPN tunnel or Dedicated Interconnect. In this configuration, the purpose is to advertise the VPC's IP range (the custom or auto-mode subnet CIDR) to the on-premises router, enabling on-premises hosts to route traffic back to the VPC. This is achieved by configuring the Cloud Router with a BGP session and setting the advertised route for the VPC's IP range.

Answer

To load balance traffic across multiple VPN tunnels.

Answer

To receive a default route from the on-premises network.

Answer

To advertise a default route to the on-premises network.

Question 8

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

Accepted Answer

Ingress rule: source 203.0.113.5/32, destination 10.0.1.2/32, tcp:22. Option D is correct because firewall rules in GCP are stateful and applied at the instance level, not the VPN tunnel. The rule must allow ingress traffic from the on-premises source IP (203.0.113.5/32) to the Compute Engine instance's internal IP (10.0.1.2/32) on TCP port 22. The Cloud VPN and Cloud Router handle routing, but the firewall rule explicitly defines the allowed traffic flow.

Answer

Ingress rule: source 203.0.113.5/32, destination 169.254.0.1/32, tcp:22

Answer

Ingress rule: source 10.0.1.2/32, destination 203.0.113.5/32, tcp:22

Answer

Ingress rule: source 0.0.0.0/0, destination 203.0.113.5/32, tcp:22

Question 9

A company is deploying an internal load balancer (ILB) in a VPC to distribute traffic among backend instances in a managed instance group. The ILB should only be accessible from within the VPC. Which of the following is a required step when configuring the ILB?

Accepted Answer

Specify a subnet in the same region as the backend instances.. An internal load balancer (ILB) in GCP requires a regional forwarding rule that routes traffic to backend instances within the same VPC. Specifying a subnet in the same region as the backend instances is mandatory because the ILB's internal IP address is allocated from that subnet, and the forwarding rule must reference a subnet to enable internal-only routing. Without a subnet, the ILB cannot be provisioned as an internal load balancer.

Answer

Assign a static external IP address to the forwarding rule.

Answer

Upload an SSL certificate to the load balancer.

Answer

Create a Cloud NAT gateway for the backend instances.

Question 10

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth up to 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Partner Interconnect with redundant connections. Option D is correct because the requirement for high availability (redundancy) and bandwidth up to 10 Gbps is best met by Partner Interconnect with redundant connections. Partner Interconnect supports bandwidths from 50 Mbps to 10 Gbps and allows you to connect through a supported service provider, while redundant connections ensure failover and meet the high-availability requirement. Dedicated Interconnect offers up to 10 Gbps per circuit but requires two separate connections for high availability, not a single connection.

Answer

VPN with Cloud Router

Answer

Direct Peering

Answer

Dedicated Interconnect with a single connection

Question 11

A network engineer is designing a VPC in Google Cloud with multiple subnets across different regions. The application requires low-latency communication between instances in the same region but not across regions. Which VPC network configuration should be used?

Accepted Answer

Custom mode VPC with regional subnets. Custom mode VPC with regional subnets (D) is correct because it allows you to explicitly define subnets in specific regions, ensuring that instances within the same region communicate over low-latency paths without cross-region traffic. This design avoids the automatic creation of subnets in every region (as in auto mode) and prevents the use of deprecated legacy networks, giving you full control over regional placement for latency-sensitive applications.

Answer

Auto mode VPC with global subnets

Answer

Legacy network

Answer

Auto mode VPC with regional subnets

Question 12

An organization wants to implement a hub-and-spoke network topology in Google Cloud using VPC Network Peering. The hub VPC hosts shared services and the spoke VPCs host application workloads. They need to ensure that spokes can communicate with each other through the hub. Which additional configuration is required?

Accepted Answer

Configure a managed VPN between the hub and each spoke, and enable dynamic routing. VPC Network Peering does not support transitive routing by default. To enable spoke-to-spoke communication through the hub, you must configure a managed VPN (Cloud VPN) between the hub and each spoke with dynamic routing (BGP). This creates a routed overlay that allows the hub to forward traffic between spokes, effectively achieving transitive routing.

Answer

Enable 'Export custom routes' on the hub VPC and 'Import custom routes' on the spoke VPCs

Answer

Use a shared VPC instead of VPC Network Peering

Answer

Create a peering connection between each pair of spokes

Question 13

A company is planning to migrate their on-premises application to Google Cloud. The application requires consistent high bandwidth and low latency to on-premises databases. They have a Dedicated Interconnect connection with a 10 Gbps link. To improve availability, they decide to add a second Interconnect connection. Which of the following is a best practice for configuring BGP sessions?

Accepted Answer

Configure two BGP sessions, each on a separate connection, with different ASNs and MED values to influence path selection. Option B is correct because using different ASNs on each BGP session allows the on-premises router to treat the two Dedicated Interconnect connections as separate routing peers, enabling path selection control via MED values. This ensures that if one connection fails, traffic can be rerouted through the other, improving availability without relying on ECMP or a single session, which would not provide the desired redundancy and traffic engineering.

Answer

Configure two BGP sessions with the same ASN and MED values

Answer

Enable ECMP across the two connections with a single BGP session

Answer

Use a single BGP session across both connections

Question 14

A network engineer is designing a Google Cloud network for a financial services company that requires strict compliance with PCI DSS. They need to isolate development, staging, and production environments. Which approach should they use to meet these requirements?

Accepted Answer

Use separate VPCs for each environment, connected via VPC Network Peering. Option D is correct because PCI DSS requires strict network segmentation between environments handling cardholder data. Separate VPCs provide complete isolation at the network layer, preventing any accidental cross-environment traffic. VPC Network Peering allows controlled, encrypted communication between these isolated VPCs without reducing the security boundary, as peering does not merge routing domains or security policies.

Answer

Use a single VPC with separate subnets for each environment and firewall rules to restrict traffic

Answer

Use a single VPC with separate firewall rules for each environment

Answer

Use a Shared VPC with separate service projects for each environment

Question 15

Which TWO factors should be considered when selecting a Google Cloud region for deploying a globally distributed application to minimize latency for users?

Accepted Answer

Availability of required Google Cloud services in the region. Option A is correct because the availability of required Google Cloud services in a region is a fundamental constraint: if a service (e.g., Cloud Spanner, BigQuery, or a specific machine series) is not offered in a region, you cannot deploy that component there, regardless of latency benefits. Option C is correct because minimizing latency for a globally distributed application requires placing compute and data resources as close as possible to the majority of users, reducing round-trip time (RTT) and improving user experience. Google Cloud's global network and edge caching locations (e.g., Cloud CDN) further amplify the benefit of proximity.

Answer

Compliance with data residency requirements

Answer

Number of zones in the region

Answer

Cost of resources in the region