PCNE Designing, planning, and prototyping a GCP network Practice Test 5 — 15 Questions

Question 1

A company has a complex on-premises network with multiple BGP AS numbers. They are connecting to GCP using Cloud VPN and wish to advertise specific prefixes. They want to ensure that only selected on-prem prefixes are advertised to GCP and no other prefixes leak. What is the best approach?

Accepted Answer

Configure Cloud Router with custom advertised route maps to filter prefixes. Cloud Router with custom advertised route maps allows you to explicitly define which on-premises prefixes are advertised to GCP via Cloud VPN. This ensures only the selected prefixes are propagated, preventing route leaks. Unlike relying on GCP's import policy, this approach gives you direct control over outbound advertisements from your on-premises network.

Answer

Use route advertisements from on-prem routers and rely on GCP's route import policy

Answer

Use VPC firewall rules to restrict incoming traffic

Answer

Set up a separate Cloud Router for each prefix

Question 2

A startup wants to minimize costs for their development VPC. They have a few VMs that need occasional internet access for updates. What is the most cost-effective approach?

Accepted Answer

Use Cloud NAT with a static IP. Cloud NAT with a static IP is the most cost-effective approach because it allows multiple VMs to share a single static IP address for outbound internet access, eliminating the need for individual external IPs. This reduces costs since external IP addresses incur charges, and Cloud NAT provides managed, scalable outbound connectivity without requiring a VPN or dedicated gateway.

Answer

Use Private Google Access

Answer

Use a VPN to an on-prem network for internet

Answer

Assign external IPs to each VM

Question 3

A company needs to ensure that all traffic between GCP VMs in different regions is encrypted in transit. What is the recommended approach?

Accepted Answer

By default, traffic between GCP VMs is encrypted. Google Cloud encrypts all traffic between VMs at the hypervisor level, regardless of region, using application-layer encryption (e.g., TLS) and network-layer encryption (e.g., IPSec) by default. This encryption is transparent, always-on, and does not require any configuration, making option B the correct answer. The encryption covers all VM-to-VM traffic within the same VPC or across VPCs, including inter-region communication.

Answer

Use VPC peering with encryption enabled

Answer

Use Cloud VPN between the two regions

Answer

Enable IPsec on the VPC

Question 4

An organization is using Shared VPC with 100 service projects. They want to allow each service project to manage its own Cloud NAT, but the network administration team wants to control the outbound IP addresses used. What is the best design?

Accepted Answer

Use a NAT instance with an external IP in the host project and route traffic from service projects. Option B is correct because a NAT instance in the host project allows the network administration team to control the outbound IP addresses (by attaching a static external IP to the instance) while service projects can manage their own Cloud NAT configurations for outbound traffic. The NAT instance acts as a centralized egress point, and service project traffic is routed to it via custom routes or policy-based routing, meeting both requirements: service project autonomy for NAT management and centralized IP control.

Answer

Create a single Cloud NAT in the host project and share it

Answer

Create Cloud NAT in each service project with the same external IPs

Answer

Use Private Google Access with Cloud NAT in the host project

Question 5

Which TWO services can be used to provide outbound connectivity to the internet for private VMs in a VPC? (Assume VMs have no external IPs.)

Accepted Answer

Instance with external IP. Option A is correct because an instance with an external IP can provide outbound connectivity for private VMs if it is configured as a NAT gateway or proxy. However, the question specifies that VMs have no external IPs, so this option is technically incorrect in the context of the question's constraint. The intended correct answer for outbound connectivity without external IPs is Cloud NAT, which allows private VMs to access the internet using source network address translation (SNAT) without assigning external IPs to individual VMs.

Answer

Cloud Router

Answer

Private Google Access

Answer

Cloud VPN

Question 6

Which TWO statements about VPC Network Peering are correct?

Accepted Answer

VPC peering is supported within the same organization. Option B is correct because VPC Network Peering is designed to connect VPCs within the same organization (or across different organizations) without requiring a VPN or gateway. It allows private RFC 1918 IP communication between VPCs, and when both VPCs belong to the same organization, the peering setup is straightforward and does not involve cross-organization trust policies. This is a fundamental use case for peering in Google Cloud.

Answer

VPC peering supports global load balancing with internal IPs

Answer

VPC peering supports transitivity across multiple peerings

Answer

VPC peering allows overlapping CIDR ranges

Question 7

Which THREE components are part of a typical Cloud Hybrid Networking architecture?

Accepted Answer

Cloud Router. Cloud Router is a core component of Cloud Hybrid Networking because it enables dynamic route exchange between a GCP VPC and an on-premises network using BGP. It works with Cloud VPN or Cloud Interconnect to automatically learn and propagate routes, eliminating the need for static route management.

Answer

VPC

Answer

Cloud CDN

Question 8

Refer to the exhibit. A network engineer checks the BGP status of a Cloud Router. The on-prem router has two BGP peers configured. What is the most likely cause of the IDLE session for the second peer?

Accepted Answer

The peer router's firewall is blocking TCP port 179. The IDLE state in BGP indicates that the session has not been established or has been reset. Since the on-prem router has two BGP peers and only one is IDLE, a per-peer issue like a firewall blocking TCP port 179 on the second peer's router is the most likely cause. This prevents the TCP three-way handshake required for BGP session establishment, leaving the session stuck in IDLE.

Answer

The VLAN attachment is not configured

Answer

The BGP timers are misconfigured

Answer

The peer router is not configured with the correct BGP ASN

Question 9

Refer to the exhibit. A VM in the default VPC with IP 10.0.0.5 is unable to receive traffic from another VM in the same VPC with IP 10.0.1.5. The firewall rule shown is in place. What is the most likely reason?

Accepted Answer

The target service account does not match the VM's service account. The firewall rule shown uses a target service account, which means it applies only to VM instances that are associated with that specific service account. If the VM at 10.0.0.5 has a different service account (or no service account) than the one specified in the rule, the rule will not apply to it, and traffic will be blocked by the implicit deny-all egress/ingress firewall rules. This is the most likely reason the VM cannot receive traffic from 10.0.1.5.

Answer

The source range does not include 10.0.1.5

Answer

The rule only allows TCP but the traffic is UDP

Answer

The priority is too low

Question 10

Refer to the exhibit. A company has enabled Private Google Access on the subnet. What effect does this have on VMs in the subnet?

Accepted Answer

VMs can access Google services using only internal IPs. Private Google Access enables VMs in a subnet that have only internal IP addresses (RFC 1918) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through Google's internal network. The traffic is routed via the default internet gateway (which does not require an external IP on the VM) and uses a special 0.0.0.0/0 route with next hop 'default internet gateway' to reach Google's external IPs, but the VM itself never needs a public IP. This is why D is correct: VMs can access Google services using only internal IPs.

Answer

VMs can use external IPs to access Google services

Answer

VMs can access the internet using Cloud NAT

Answer

VMs can communicate with each other without firewall rules

Question 11

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth of at least 10 Gbps. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect with two circuits (each 10 Gbps) to different edge locations. Dedicated Interconnect with two 10 Gbps circuits to different edge locations meets the 10 Gbps bandwidth requirement and provides high availability through diverse physical paths. Cloud VPN maxes out at 3 Gbps per tunnel, Direct Peering does not offer SLA-backed bandwidth or support for 10 Gbps single connections, and Partner Interconnect typically caps at 1 Gbps per VLAN attachment.

Answer

Cloud VPN with two tunnels to different gateways

Answer

Direct Peering with multiple BGP sessions

Answer

Partner Interconnect with 1 Gbps VLAN attachments

Question 12

A startup is migrating a two-tier application to GCP. The web tier must be accessible from the internet, and the database tier must only be accessible from the web tier. Which network design should be used?

Accepted Answer

Place web servers in a public subnet with external IPs, database in a private subnet, and add a firewall rule allowing traffic from web subnet to database. Option A is correct because it places the web servers in a public subnet with external IPs, allowing direct internet access, while the database resides in a private subnet with no external IP, enforcing isolation. A firewall rule (ingress on the database subnet) explicitly permits traffic from the web subnet’s CIDR range, typically on the database port (e.g., TCP 3306 for MySQL), ensuring the database is reachable only from the web tier. This design follows GCP’s best practice of using VPC firewall rules to control east-west traffic between subnets.

Answer

Place both tiers in separate VPCs and use VPC peering with no firewall rules

Answer

Place both tiers in the same subnet and configure firewall rules to restrict database access

Answer

Place web servers in a private subnet with Cloud NAT for outbound, database in the same private subnet

Question 13

An enterprise uses Shared VPC with a host project and multiple service projects. A service project team wants to create a Cloud VPN tunnel to their on-premises network. What must the network team configure in the host project to allow this?

Accepted Answer

The VPN gateway and Cloud Router must be created in the host project's VPC, and the service project must be granted compute.networkUser role on the host project. In a Shared VPC setup, the VPN gateway and Cloud Router must reside in the host project's VPC because the host project owns the underlying network infrastructure. The service project can then use the VPN tunnel by being granted the `compute.networkUser` role on the host project, which allows it to create forwarding rules and use the VPN resources. This ensures that the VPN termination point is within the shared VPC network, enabling connectivity to on-premises networks.

Answer

The service project can create the VPN gateway directly in its own project as long as it uses a VPC that is peered with the host project

Answer

The service project cannot use Cloud VPN with Shared VPC; they must use Dedicated Interconnect instead

Answer

A Cloud Router must be created in the service project, and the VPN gateway in the host project

Question 14

A company is designing a global application that requires low-latency access to GCP services like Cloud Storage and BigQuery. They also need to minimize egress costs for traffic to the internet. Which network service tier should they choose for their GCP resources?

Accepted Answer

Premium Tier for all resources. The Premium Tier routes traffic over Google's global network backbone, providing lower latency and higher performance for accessing GCP services like Cloud Storage and BigQuery. It also minimizes egress costs to the internet by keeping traffic on Google's private network for as long as possible, reducing reliance on public transit.

Answer

Use a CDN to reduce latency and no specific tier

Answer

Premium Tier for Compute Engine instances and Standard Tier for Cloud Storage

Answer

Standard Tier for all resources

Question 15

An organization needs to allow on-premises servers to resolve DNS names of GCP VM instances using RFC 1918 addresses. They have a Cloud VPN connection. Which DNS resolution approach should they implement?

Accepted Answer

Configure Cloud DNS inbound server policy and set up forwarding from on-premises DNS to the Cloud DNS inbound endpoint. Option D is correct because the on-premises servers need to resolve DNS names of GCP VM instances using RFC 1918 addresses over a Cloud VPN connection. Configuring a Cloud DNS inbound server policy creates a VPC-wide inbound DNS endpoint (using an internal IP address) that on-premises DNS servers can forward queries to. This allows the on-premises DNS to send DNS requests for GCP private zone records (e.g., `vm-instance.c.example.internal`) directly to the Cloud DNS inbound endpoint, which then resolves the private RFC 1918 addresses of the VM instances.

Answer

Set up a public zone and use the instance's external IP for DNS

Answer

Configure Cloud DNS outbound server policy and forward from Cloud DNS to on-premises DNS

Answer

Use DNS peering with a private zone in the on-premises DNS