PCNE Designing, planning, and prototyping a GCP network Practice Test 3 — 15 Questions

Question 1

An organization has two VPC networks in different Google Cloud organizations. They need to allow private IP communication between instances in these VPCs without using public IPs or VPNs. Which solution should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering allows private IP connectivity between two VPC networks across different organizations without requiring public IPs, VPNs, or gateways. It uses the Google Cloud internal infrastructure to route traffic directly between instances, leveraging RFC 1918 addresses and supporting global peering.

Answer

Cloud NAT

Answer

Shared VPC

Answer

Cloud VPN

Question 2

Which GCP service provides a dedicated, low-latency connection from an on-premises data center to Google Cloud?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, low-latency connection from an on-premises data center to Google Cloud, bypassing the public internet. It offers two options: Dedicated Interconnect (a direct physical connection via a colocation facility) and Partner Interconnect (via a supported service provider). This ensures consistent bandwidth and lower latency compared to VPN-based solutions.

Answer

Cloud Router

Answer

Cloud VPN

Answer

VPC Network

Question 3

A company has a VPC with a firewall rule that allows SSH (tcp:22) from 0.0.0.0/0. They want to restrict SSH access to only the public IP address of their Cloud VPN gateway. How should they modify the firewall rule?

Accepted Answer

Change the source IP range to the VPN gateway's public IP address.. The firewall rule currently allows SSH from any source IP (0.0.0.0/0). To restrict access to only the Cloud VPN gateway, you must change the source IP range to the gateway's public IP address, because the SSH connection originates from the VPN gateway's public-facing interface over the internet. Internal IP addresses are not routable over the internet and would not match the source of the incoming SSH traffic.

Answer

Use Cloud Armor to block all SSH except from the VPN IP.

Answer

Change the source IP range to the VPN gateway's internal IP address.

Answer

Use IAP Tunneling instead of SSH firewall rules.

Question 4

A global application uses a global external HTTPS load balancer with backend NEGs in multiple regions. The content is static and must be cached at edge locations to reduce latency. Which GCP service should be enabled?

Accepted Answer

Cloud CDN. Cloud CDN is the correct service because it leverages Google's global edge cache network to cache static content from an external HTTPS load balancer with backend NEGs. When enabled, Cloud CDN intercepts requests at edge locations and serves cached responses, reducing latency and offloading origin servers. This directly addresses the requirement to cache static content at edge locations for a global application.

Answer

Cloud Storage

Answer

Cloud NAT

Answer

Cloud Memorystore

Question 5

Which TWO of the following are benefits of using Shared VPC?

Accepted Answer

Automatic cross-project routing. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling automatic cross-project routing. This is because all subnets in the host project are directly reachable from any service project attached to that host, without needing additional VPC peering or VPN tunnels. Option B is correct because this inherent routing simplifies network connectivity and reduces administrative overhead.

Answer

Enhanced security through VPC Service Perimeters

Answer

Reduced IP address usage

Answer

Separation of network and application teams

Question 6

A company needs to connect three VPC networks in separate projects (two in the same organization, one in a different organization) to each other for private IP communication. Which TWO GCP solutions should they consider? (Choose 2.)

Accepted Answer

VPC Network Peering hub-and-spoke topology. Option B is correct because a VPC Network Peering hub-and-spoke topology allows a central hub VPC to peer with multiple spoke VPCs, enabling transitive routing between spokes via the hub. This is necessary when VPCs are in different organizations, as VPC peering does not support transitive peering directly, but a hub-and-spoke design with explicit peering between each spoke and the hub can achieve private IP communication across organizations.

Answer

Cloud Interconnect

Answer

Shared VPC

Answer

Cloud VPN with dynamic routing

Question 7

Which THREE factors should be considered when designing a Cloud VPN for high availability? (Choose 3.)

Accepted Answer

Enable BGP for dynamic routing. Enabling BGP (Border Gateway Protocol) for dynamic routing is correct because it allows the Cloud VPN to automatically detect and route around failures. BGP exchanges route information between the on-premises router and the Cloud Router, enabling dynamic failover and load balancing across multiple tunnels. Without BGP, you would rely on static routes, which cannot adapt to network changes and require manual intervention during a failure.

Answer

Use static routes for failover

Answer

Use a single Cloud Router for simplicity

Question 8

Refer to the exhibit. A network engineer reviews the firewall rules in a VPC. What is the most significant security concern?

Accepted Answer

SSH is allowed from any source.. Option C is correct because allowing SSH (TCP/22) from any source (0.0.0.0/0) exposes the VPC instances to brute-force attacks, unauthorized access, and potential compromise. This violates the principle of least privilege and is a critical security misconfiguration in a VPC firewall rule.

Answer

There is no deny rule.

Answer

RDP is allowed from 10.0.0.0/8.

Answer

Firewall rules are not in order.

Question 9

Refer to the exhibit. What is the purpose of the --enable-private-ip-google-access flag?

Accepted Answer

Allows VMs to access Google APIs without requiring an external IP.. The `--enable-private-ip-google-access` flag, when set to `true` on a subnet, allows VM instances in that subnet to reach Google APIs and services (e.g., Cloud Storage, BigQuery) using their private IP addresses, without requiring an external (public) IP. This works by routing traffic through Google's internal network to the Google API frontend, bypassing the public internet.

Answer

Enables the subnet to be used for Cloud VPN tunnels.

Answer

Allows external traffic to reach VMs using private IPs.

Answer

Enables Cloud NAT on this subnet.

Question 10

Refer to the exhibit. What is the purpose of the IP address 169.254.0.1 assigned to the Cloud Router interface?

Accepted Answer

It is a link-local IP address used for BGP sessions between the Cloud Router and the VPN gateway.. The IP address 169.254.0.1 falls within the 169.254.0.0/16 range, which is reserved for link-local addressing (RFC 3927). In Google Cloud, Cloud Routers use link-local addresses for BGP sessions with VPN gateways (both HA VPN and Classic VPN). This address is not routable and is used exclusively for BGP peering between the Cloud Router and the VPN gateway, ensuring that the BGP session operates over the VPN tunnel without conflicting with other IP assignments.

Answer

It is the public IP address of the VPN gateway.

Answer

It is a private IP address for BGP peering with the on-premises router.

Answer

It is the management IP address of the Cloud Router.

Question 11

A company is designing a VPC network to support multiple projects that require isolation but also need to communicate with a shared services project. Which approach should the company use to minimize administrative overhead while ensuring isolation?

Accepted Answer

Implement a Shared VPC in the host project and attach all service projects to it.. A Shared VPC (XPN) allows an organization to connect resources from multiple service projects to a common host project's VPC network, enabling isolated projects to communicate with shared services while centralizing network administration. This minimizes administrative overhead because network policies, firewall rules, and routing are managed in one place, and service projects do not need to manage their own VPC infrastructure.

Answer

Assign all projects to a single VPC with separate subnets for each project.

Answer

Use dedicated VPCs for each project and connect via Cloud VPN tunnels.

Answer

Create a separate VPC for each project and peer them with the shared services VPC.

Question 12

A company has Compute Engine instances without external IP addresses that need to access external APIs. The instances are in multiple zones within a region, and each zone has a subnet. The company wants a cost-effective and highly available solution that does not require manual failover. What should they do?

Accepted Answer

Create a Cloud NAT gateway in each zone and configure region-specific NAT rules.. A Cloud NAT gateway per zone provides highly available outbound connectivity for instances without external IPs. By placing a gateway in each zone, traffic from instances in that zone uses the local gateway, avoiding cross-zone hops and ensuring automatic failover if a zone fails. This meets the cost-effective and no-manual-failover requirements without needing instance-level external IPs.

Answer

Create a Cloud NAT gateway in one zone and configure an instance tag-based route to the gateway.

Answer

Enable Private Google Access on the subnets and configure a Cloud NAT gateway in one zone.

Answer

Assign external IP addresses to each instance and create appropriate firewall rules.

Question 13

An organization is connecting their on-premises data center to GCP using Dedicated Interconnect with multiple VLAN attachments. They have configured Cloud Router with BGP sessions for each VLAN attachment. They notice that traffic from GCP to on-premises is not load-balanced across the attachments; instead, all traffic uses a single link. What is the most likely cause?

Accepted Answer

Cloud Router's BGP is not configured for multipath; it selects only one best path per prefix.. Cloud Router uses BGP to exchange routes with the on-premises router. By default, BGP selects only a single best path per prefix based on the lowest MED, weight, local preference, AS-path length, or IGP metric. Without BGP multipath enabled (e.g., 'maximum-paths' or 'bgp multipath' configuration), Cloud Router will not load-balance traffic across multiple VLAN attachments even if multiple equal-cost paths are available. This causes all traffic to egress through a single link.

Answer

The on-premises router is not advertising the same routes over all BGP sessions.

Answer

The VLAN attachments have different bandwidths, causing BGP to prefer the higher bandwidth link.

Answer

The BGP keepalive timers are misconfigured, causing session flapping.

Question 14

A company has multiple projects that each need their own administrative control but must share a common VPC network. Which networking solution should they use?

Accepted Answer

Use Shared VPC with the host project and attach service projects.. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling centralized control of the network while maintaining administrative isolation for each project. The host project owns the VPC and firewall rules, and service projects can use subnets within that VPC, meeting the requirement for separate administrative control with a shared network.

Answer

Create a single VPC in one project and grant all users access to that project.

Answer

Create separate VPCs for each project and connect via Cloud VPN.

Answer

Create a VPC in each project and peer them all together.

Question 15

An organization has Compute Engine instances in a VPC without external IP addresses. They need to allow these instances to access Google Cloud Storage buckets but not the internet. What should they configure?

Accepted Answer

Enable Private Google Access on the subnets where the instances reside.. Private Google Access allows Compute Engine instances without external IP addresses to reach Google APIs and services, including Cloud Storage, through the VPC network's default route to the internet gateway, but only to Google's published IP ranges. This is the correct solution because it provides the required access without exposing the instances to the general internet.

Answer

Set up Cloud NAT and configure a firewall rule to allow egress to Google Cloud Storage IP ranges.

Answer

Peer the VPC with the Google Cloud Storage service VPC.

Answer

Create an egress firewall rule allowing traffic to 0.0.0.0/0 and a route to the default internet gateway.