PCNE Designing, planning, and prototyping a GCP network Practice Test 4 — 15 Questions

Question 1

A company runs a Kubernetes cluster on GKE with a VPC-native cluster (alias IP ranges). They have pods that need to communicate with on-premises services via a Cloud VPN tunnel. Which networking configuration is required to enable pod-to-on-premises communication?

Accepted Answer

Advertise the pod IP ranges over the Cloud Router BGP session to the on-premises router.. Option B is correct because VPC-native clusters assign alias IP ranges to pods directly from the VPC subnet's secondary CIDR ranges. To enable on-premises routing to these pods, the pod IP ranges must be advertised over the Cloud Router BGP session to the on-premises router. This ensures the on-premises network learns the routes to the pod CIDRs and can forward traffic back through the Cloud VPN tunnel.

Answer

Enable VPC Flow Logs for the subnets to allow traffic to be routed.

Answer

Configure a firewall rule allowing traffic from pod CIDR to on-premises subnets.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Question 2

A company has a VPC with three subnets and multiple firewall rules. They want to ensure that the most specific firewall rule takes precedence when there is a conflict. What is the default evaluation order of firewall rules?

Accepted Answer

The rule with the highest priority (lowest priority number) is evaluated first.. In Google Cloud Platform (GCP) VPC firewall rules, the default evaluation order is based on priority. Each rule is assigned a priority number from 0 to 65535 (lower number = higher priority), and rules are evaluated from highest priority (lowest number) to lowest priority. When multiple rules match traffic, the rule with the highest priority (lowest priority number) is applied first, and its action (allow/deny) is definitive; lower-priority rules are not evaluated for that traffic.

Answer

Egress rules are evaluated before ingress rules.

Answer

The more restrictive rule (with smaller IP range) is applied first.

Answer

Rules are evaluated in the order they were created.

Question 3

A company needs a dedicated, low-latency connection from their on-premises data center to GCP with a 10 Gbps capacity. They require the highest availability and service level agreement (SLA). Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect with two connections to different meet-me rooms.. Dedicated Interconnect provides a direct, private connection between the on-premises data center and GCP with 10 Gbps capacity. By using two connections to different meet-me rooms, the company achieves the highest availability and meets the 99.99% SLA, as this eliminates single points of failure at the physical layer and within a single facility.

Answer

Carrier Peering using Equinix or other carrier.

Answer

Partner Interconnect with two VLAN attachments from different providers.

Answer

Cloud VPN with two tunnels from different VPN gateways.

Question 4

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

Accepted Answer

Traffic is taking one tunnel for outbound and the other for return, causing stateful firewall to drop packets.. The most likely cause is asymmetric routing, where outbound traffic from GCP to on-premises takes one VPN tunnel while return traffic takes the other. Stateful firewalls track connection state based on the first packet seen; if return packets arrive via a different tunnel (and thus a different source IP or interface), the firewall does not recognize them as part of an existing session and drops them. This is a classic symptom of asymmetric routing with multiple BGP sessions over separate tunnels.

Answer

BGP keepalive timers are set too low, causing session flapping.

Answer

The MTU is mismatched between the tunnels.

Answer

The on-premises router is not receiving the VPC routes via BGP.

Question 5

Which TWO of the following are true regarding VPC Network Peering? (Choose TWO.)

Accepted Answer

The VPCs' subnet IP ranges must not overlap.. Option A is correct because VPC Network Peering requires that the subnet IP ranges of the peered VPCs do not overlap. Overlapping ranges would cause routing conflicts and ambiguous destination addresses, as GCP uses the subnet CIDR blocks to determine the next hop for traffic. If two VPCs have overlapping ranges, packets cannot be reliably forwarded to the correct destination, breaking the peering connection.

Answer

It supports transitive routing across multiple peering connections.

Answer

It supports exchange of routes with custom dynamic routing.

Answer

Custom dynamic routes are automatically exchanged.

Question 6

Which THREE of the following are required to set up a highly available Cloud VPN with dynamic routing? (Choose THREE.)

Accepted Answer

A Cloud Router with BGP configured for each tunnel.. A is correct because Cloud VPN with dynamic routing requires a Cloud Router with BGP configured for each tunnel. BGP enables the exchange of routes between the on-premises network and Google Cloud, allowing automatic failover and route propagation. Without BGP, dynamic routing cannot function, and the VPN would rely on static routes, which do not support high availability.

Answer

Redundant on-premises VPN gateways.

Answer

Two VPN tunnels from each gateway to the on-premises router.

Question 7

Which TWO of the following are advantages of using the Premium Tier of Google Cloud's Network Service Tiers? (Choose TWO.)

Accepted Answer

Global load balancing with a single anycast IP address.. Options B and D are correct. Premium Tier offers lower latency by leveraging Google's global network. Option A is wrong because Premium Tier costs more. Option C is wrong because Premium Tier allows global load balancing with anycast IP. Option E is wrong because Premium Tier supports both global and regional load balancers, but the advantage is global.

Answer

Reduced cost compared to Standard Tier.

Answer

Supports regional load balancers only.

Answer

Public IP addresses are assigned from a regional pool.

Question 8

A network engineer runs the gcloud command above for a Cloud NAT configured in us-central1. The VPC has 20 instances without external IPs in us-central1. They notice that only three instances have NAT mappings displayed. What could explain this?

Accepted Answer

Only instances with active outbound connections are shown.. The `gcloud compute nat-gateways list-mappings` command only displays NAT mappings for instances that currently have active outbound connections traversing the Cloud NAT gateway. Cloud NAT uses dynamic port address translation (PAT) and only creates a mapping entry when an instance sends traffic that requires source NAT. Instances without active sessions will not appear in the listing, even though they are configured to use the NAT gateway.

Answer

The NAT gateway is configured only for a specific subnet.

Answer

Only instances with external IPs are mapped.

Answer

The other instances are using a different NAT gateway.

Question 9

A team is deploying a new service in a Compute Engine instance without an external IP in subnet-b. The service needs to access Google Cloud Storage using internal IPs. What must the team do to enable this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a Compute Engine instance without an external IP address to reach Google APIs and services (including Cloud Storage) over the internal VPC network using RFC 1918 addresses. By enabling this feature on subnet-b, the instance can access Cloud Storage via internal IPs without needing an external IP or NAT gateway. This is the correct and minimal configuration for the requirement.

Answer

Assign an external IP address to the instance.

Answer

Move the instance to subnet-a where Private Google Access is already enabled.

Answer

Set up Cloud NAT on the VPC to allow outbound access to Google APIs.

Question 10

A request comes from IP 192.0.2.5, with origin region code 'US', and path '/admin/dashboard'. What will be the final action?

Accepted Answer

Deny by rule priority 2000.. The request matches a rule with priority 2000 that denies traffic from IP 192.0.2.5 to path '/admin/dashboard' with origin region 'US'. Since Cloud Armor security policies evaluate rules in ascending priority order, rule 2000 is evaluated before rule 3000 and after rule 1000. Rule 1000 does not match (likely a different condition), so rule 2000 applies and denies the request.

Answer

Deny by rule priority 1000.

Answer

Deny by rule priority 3000.

Answer

Allow (default rule).

Question 11

A company wants to connect on-premise to GCP via Cloud VPN with dynamic routing. They have two on-prem routers for redundancy. Which configuration ensures automatic failover?

Accepted Answer

Create two VPN tunnels using Cloud Router with BGP and the same ASN. Option C is correct because creating two VPN tunnels with Cloud Router using BGP and the same ASN on both on-prem routers enables dynamic routing and automatic failover. Cloud Router establishes BGP sessions with each on-prem router, and when both tunnels advertise the same routes with the same ASN, Cloud Router can detect a BGP session failure and automatically route traffic through the remaining healthy tunnel. This setup ensures seamless failover without manual intervention.

Answer

Create two VPN tunnels each with static routes pointing to the other router

Answer

Create one VPN tunnel with BGP and two interfaces

Answer

Create two VPN tunnels with BGP but different ASNs on each tunnel

Question 12

A company uses Shared VPC with multiple service projects. They need to allow certain service projects to create internal load balancers (ILBs) that are accessible from all projects in the organization. What is the best practice?

Accepted Answer

Create the ILB in the host project and share the backend. In a Shared VPC architecture, the host project owns the VPC network and its resources, including internal load balancers (ILBs). By creating the ILB in the host project and sharing its backend (e.g., instance groups from service projects), the ILB becomes accessible from all projects in the organization without additional connectivity. This approach centralizes network control and ensures the ILB's IP address is routable within the shared VPC, meeting the requirement for cross-project access.

Answer

Deploy ILB in each service project and use global access

Answer

Use Cloud NAT for outbound connectivity

Answer

Use VPC peering between each service project and the host project

Answer

Enable Private Service Connect

Question 13

A financial company requires encrypted traffic between on-premise and GCP. They have strict compliance requiring that encryption keys are managed on-premise and rotated every 30 days. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect with MACsec. B is correct because MACsec (IEEE 802.1AE) provides encryption at Layer 2, which is required for Cloud Interconnect to secure traffic between on-premise and GCP. Unlike VPN solutions, MACsec allows the customer to manage encryption keys on-premise and rotate them every 30 days, meeting strict compliance requirements. Cloud Interconnect with MACsec ensures low-latency, high-bandwidth connectivity while keeping key management under the customer's control.

Answer

Cloud VPN with certificate-based authentication using on-prem CA

Answer

Cloud VPN with IKEv2 and pre-shared keys

Answer

Cloud Interconnect with VLAN attachments

Answer

Partner Interconnect with a service provider that supports MACsec

Question 14

A company is designing a VPC for a multi-tier application. The web tier must be accessible from the internet, the app tier only from the web tier, and the db tier only from the app tier. Which combination of firewall rules is appropriate?

Accepted Answer

Ingress allow from 0.0.0.0/0 to web, ingress allow from web subnets to app, ingress allow from app subnets to db. Option B is correct because it follows the principle of least privilege for a multi-tier VPC. The web tier must be accessible from the internet (0.0.0.0/0) on ingress, the app tier must only accept ingress from the web tier subnets, and the db tier must only accept ingress from the app tier subnets. This ensures that each tier is isolated and only reachable from the immediate upstream tier, which is a fundamental security best practice for multi-tier architectures in Google Cloud.

Answer

Ingress allow from web to app, ingress allow from app to db, no rule for web

Answer

Ingress allow from 0.0.0.0/0 to web, ingress allow from all subnets to app, ingress allow from app to db

Answer

Ingress allow from web to app, ingress allow from web to db, ingress allow from app to db

Question 15

An organization is deploying a global application and wants to use an Internal Load Balancer (ILB) across multiple regions. What is the correct configuration?

Accepted Answer

Deploy ELB in each region and use DNS to route traffic. Option C is correct because Google Cloud does not support a native cross-region Internal Load Balancer (ILB). To distribute traffic across multiple regions, you must deploy a separate Internal TCP/UDP Load Balancer in each region and use DNS-based routing (e.g., Cloud DNS with geo-routing or weighted record sets) to direct clients to the appropriate regional ILB. This approach provides regional high availability and global reach without exposing internal IPs externally.

Answer

Use a cross-region ILB by enabling global access

Answer

Use an Internal TCP/UDP Load Balancer in one region and route traffic via Cloud VPN

Answer

Use a global External Load Balancer with internal backend