PCNE Hard Questions — 25 Difficult Questions

Question 1

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service perimeter. VPC Service Controls perimeters require: 1) A service perimeter that includes the project and services, 2) Access levels that define allowed client attributes (e.g., IP addresses, device policy), and 3) VPC accessible services configuration to restrict access to only requests originating from specified VPC networks. Ingress rules are optional for allowing access from outside the perimeter.

Answer

Cloud NAT gateway

Answer

Private Google Access

Question 2

An organization needs to design a hybrid connectivity solution with 99.99% availability for a mission-critical application. They have a co-location facility near a GCP region. Which THREE components are required to meet this SLA?

Accepted Answer

Two VLAN attachments. For 99.99% SLA with Dedicated Interconnect, you need two links in different edge availability domains, two VLAN attachments, and BGP sessions with Cloud Router.

Answer

One Dedicated Interconnect link with multiple VLAN attachments

Answer

Classic VPN as a backup

Question 3

A network engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but different subnets (us-east1 and europe-west1). The engineer suspects an MTU issue. What is the default MTU for traffic within Google Cloud, and what MTU should the engineer expect when packets traverse the internet?

Accepted Answer

1460 bytes internally, 1500 bytes internet. Google Cloud uses an MTU of 1460 bytes (64 bytes less than the standard 1500) to accommodate encapsulation headers. Internet traffic typically uses 1500 bytes. Fragmentation can occur if a packet larger than 1460 bytes is sent over a path that expects 1500 but the internal path is 1460.

Answer

1400 bytes internally, 1500 bytes internet

Answer

1500 bytes both internally and internet

Answer

1500 bytes internally, 1460 bytes internet

Question 4

A network engineer configured a Cloud Router with the BGP configuration shown. The on-premises router (AS 64512) is peering with the Cloud Router (AS 65001) over a Dedicated Interconnect VLAN attachment. The engineer notices that traffic from on-premises to Google Cloud is not being routed via this interconnect as expected. What is the most likely cause?

Accepted Answer

The update-source loopback0 command is invalid for Cloud Router BGP sessions. Cloud Router does not support the `update-source loopback0` command. BGP sessions on Cloud Router must use the primary IP address of the interface that is directly connected to the VLAN attachment; loopback interfaces are not supported for BGP peering. This command would cause the Cloud Router to attempt to source BGP packets from a loopback address that is not reachable by the on-premises router, breaking the BGP session.

Answer

The route-map SET-MED sets the MED attribute incorrectly

Answer

The ebgp-multihop 2 command is not supported on Cloud Router

Answer

The local-preference is set in the outbound direction, which is not allowed

Question 5

You are using Serverless VPC Access to connect Cloud Run services to a VPC network. The connector is in us-central1 with a /28 subnet. You have a Cloud SQL instance (private IP) in the same region but in a different VPC network (peered). The Cloud Run service cannot reach the Cloud SQL instance. What is the most likely cause?

Accepted Answer

The VPC connector's subnet does not have a route to the peered VPC where Cloud SQL resides.. Serverless VPC Access routes traffic from Cloud Run through the connector's VPC. If the Cloud SQL instance is in a different VPC (even if peered), the connector's VPC must have a route to the peered VPC's subnet for the Cloud SQL private IP range. Since the connector's subnet is in us-central1 with a /28, it may not have such a route automatically. Option A is incorrect because Cloud SQL Proxy is not required for private IP access; it is needed for public IP or IAM-based access. Option B is incorrect because Private Google Access is used for accessing Google APIs, not for connectivity to a peered VPC. Option C is incorrect because Cloud SQL with private IP does not require an external IP; it is accessible within the VPC or through peering.

Answer

The Cloud SQL instance must have the Cloud SQL Proxy configured.

Answer

Serverless VPC Access requires Private Google Access to be enabled on the connector's subnet.

Answer

Cloud SQL requires an external IP for Serverless VPC Access connectivity.

Question 6

You are using Cloud CDN with a backend bucket and want to cache all responses regardless of Cache-Control headers. Which cache mode should you set?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL overrides origin Cache-Control headers and caches all responses. CACHE_ALL_STATIC attempts to cache static content but respects Cache-Control. USE_ORIGIN_HEADERS respects origin headers.

Answer

CACHE_ALL_STATIC

Answer

USE_ORIGIN_HEADERS

Answer

DISABLED

Question 7

You are configuring an HA VPN tunnel between GCP and on-premises. The on-premises VPN device only supports IKEv1 and static routing. Which of the following is true regarding this setup?

Accepted Answer

Classic VPN must be used. HA VPN requires IKEv2 and dynamic routing (BGP). Classic VPN supports IKEv1 and static routing.

Answer

Partner Interconnect can be used instead

Answer

HA VPN can be used with static routing if you disable BGP

Answer

HA VPN can be configured with IKEv1 and static routes

Question 8

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Accepted Answer

Cloud NAT logging with filter for errors

Answer

Firewall Rules logging

Answer

VPC Flow Logs on the subnet

Answer

Cloud Armor request logs

Question 9

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

Accepted Answer

It depends on the redundancy requirements; typically two per attachment for active-active.. With a Dedicated Interconnect using two VLAN attachments in different edge availability domains (EADs), the recommended best practice for high availability is to establish two BGP sessions per VLAN attachment (one active and one redundant) on the same Cloud Router, resulting in four sessions total. However, the question asks 'how many BGP sessions should be established' and the correct answer acknowledges that it depends on the redundancy requirements; typically two per attachment for active-active, but if active-passive is acceptable, fewer sessions may suffice. This flexibility makes 'It depends' the most accurate choice.

Answer

Four: two per VLAN attachment.

Answer

Two: one per VLAN attachment.

Answer

One: one session per Cloud Router.

Question 10

An engineer is troubleshooting a VPC Network Peering connection between two VPCs. The peering is established, but traffic from VPC A to VPC B is not reaching a specific subnet. Both VPCs have custom routes. What is the most likely cause?

Accepted Answer

Export custom routes is not enabled on the VPC B side. A common issue is that the subnet's custom routes are not exported. VPC peering allows exporting custom routes, but this must be explicitly enabled. If not, only system-generated routes (subnet routes) are exchanged.

Answer

The subnet has overlapping IP with VPC A

Answer

The subnet in VPC B is in a different region

Answer

Export custom routes is not enabled on the VPC A side

Question 11

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address. When the BGP session state is stuck in 'CONNECT', it indicates that the router is actively trying to initiate a TCP connection to the peer but is not receiving a response. For BGP to establish a TCP session (port 179), the on-premises router must have a valid IP route to the Cloud Router's BGP peer IP address. Without this route, TCP SYN packets are dropped, preventing the session from transitioning to 'ESTABLISHED'.

Answer

Change the BGP ASN on the Cloud Router to a different number

Answer

Increase the BGP hold timer on the Cloud Router

Answer

Change the BGP keepalive interval to 10 seconds

Question 12

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Accepted Answer

Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used. To ensure specific VMs use a designated set of NAT IPs for auditing, you must first create a separate Cloud NAT gateway with the desired IPs and associate it with the VMs via subnet or tags (option D). This isolates traffic from those VMs. Next, configure VPC firewall rules to allow egress from the VMs to the internet (option E); otherwise, outbound traffic may be blocked. Finally, enable VPC Flow Logs on the subnet (option C) to capture which NAT IPs are used, providing auditability. Option A is not necessary because the default route's next hop is the internet gateway, not the NAT gateway's subnet, and Cloud NAT does not require a route pointing to its subnet. Option B is misleading: Cloud NAT uses subnet or tag associations, not IAM conditions, to control which VMs use it.

Answer

Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet

Answer

Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it

Question 13

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

Accepted Answer

Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.. Traffic Director uses Envoy's fault injection filter, configured via the Envoy xDS API or through GKE configuration. The correct approach is to apply a traffic policy with fault injection percentage. The other options are not valid Traffic Director features or do not achieve fault injection.

Answer

Use the gcloud compute backend-services update command with the --fault-injection flag.

Answer

Set a circuit breaker with a max pending requests threshold.

Answer

Create a backend service with connection draining and set the drain timeout.

Question 14

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Accepted Answer

Mismatched BGP hold timer values. BGP session flapping can be caused by mismatched parameters, MTU issues, or authentication problems.

Answer

Incorrect VLAN ID on the VLAN attachment

Answer

Duplicate AS number on the on-premises router

Question 15

A company has deployed an external HTTPS load balancer with a Cloud CDN backend. The load balancer uses a managed SSL certificate. Recently, the company updated their DNS record to point to a different IP address of a new load balancer. After the change, some users are still being served from the old load balancer's cache. The network engineer has confirmed that the DNS TTL has expired. What is the most likely cause of this issue?

Accepted Answer

Cloud CDN cached responses from the old load balancer may still be served until their cache TTL expires.. Cloud CDN caches content at Google's edge caches based on the cache-control headers or default cache TTL. When the DNS record is updated to point to a new load balancer, the old load balancer's cached responses may still be served from edge caches until their cache TTL expires, even after the DNS TTL has expired. This is because Cloud CDN caches are independent of DNS resolution and are governed by HTTP caching rules.

Answer

The old load balancer's SSL certificate is still cached by clients.

Answer

The DNS change has not propagated globally despite the TTL expiring.

Answer

The old load balancer's IP address is still being served by Google's edge network due to anycast.

Question 16

Which THREE of the following are valid use cases for VPC Service Controls?

Accepted Answer

Controlling access to a Cloud SQL database from a specific VPC.. VPC Service Controls allow you to define a service perimeter that restricts access to a Cloud SQL database (or other Google Cloud services) to requests originating from a specific VPC network. This is achieved by configuring an access level that references the VPC network, ensuring that only traffic from that VPC can reach the database, even if the database is exposed via private IP.

Answer

Allowing access to a managed instance group from the internet.

Answer

Enabling private access to Cloud APIs from on-premises.

Question 17

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

Accepted Answer

Traffic is taking one tunnel for outbound and the other for return, causing stateful firewall to drop packets.. The most likely cause is asymmetric routing, where outbound traffic from GCP to on-premises takes one VPN tunnel while return traffic takes the other. Stateful firewalls track connection state based on the first packet seen; if return packets arrive via a different tunnel (and thus a different source IP or interface), the firewall does not recognize them as part of an existing session and drops them. This is a classic symptom of asymmetric routing with multiple BGP sessions over separate tunnels.

Answer

BGP keepalive timers are set too low, causing session flapping.

Answer

The MTU is mismatched between the tunnels.

Answer

The on-premises router is not receiving the VPC routes via BGP.

Question 18

A company uses Cloud VPN tunnels to connect multiple sites to Google Cloud. They have a primary and a backup tunnel for redundancy, each with a different Cloud Router (both in the same region). BGP sessions are established on both routers. The network team notices that during a failover test, traffic fails over to the backup tunnel but then after 30 seconds, the backup tunnel traffic stops and does not recover until the primary tunnel comes back. The engineer finds that the backup Cloud Router is advertising the same routes as the primary, but the backup tunnel's BGP session shows that the routes are being withdrawn after 30 seconds. Additionally, the BGP session remains established. What is the most likely cause?

Accepted Answer

The backup Cloud Router's BGP session is experiencing a keepalive timeout due to incorrect timers.. The backup Cloud Router's BGP session remains established, but routes are withdrawn after 30 seconds. This is classic behavior of a BGP keepalive or hold timer mismatch: if the backup router expects a keepalive within a shorter interval than the peer sends, the hold timer expires, causing the router to withdraw all routes learned from that peer while keeping the TCP session alive (or re-establishing it). The 30-second interval matches the default BGP hold timer (90 seconds) divided by three, suggesting a timer misconfiguration on the backup router.

Answer

The backup Cloud Router is configured with a lower MED value, causing the routes to be withdrawn.

Answer

The backup tunnel is using a static routing method instead of dynamic BGP.

Answer

The backup tunnel's Cloud Router is in a different region, and the routes are not propagated globally.

Question 19

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Accepted Answer

Use a global external HTTP(S) load balancer with an anycast IP and enable Cloud CDN.. A global external HTTP(S) load balancer uses a single anycast IP address, which directs each user to the closest healthy backend based on the user's geographic location and backend health. Enabling Cloud CDN further reduces latency by caching content at Google's global edge locations, ensuring that static and dynamic content is served from the nearest point of presence.

Answer

Deploy a regional external HTTP(S) load balancer in each region and use Cloud CDN to cache content.

Answer

Configure an internal TCP/UDP load balancer in each region with DNS-based geolocation routing.

Answer

Set up a global external TCP proxy load balancer with SSL termination at each backend.

Question 20

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

Accepted Answer

MED (Multi-Exit Discriminator). MED (Multi-Exit Discriminator) is used to influence inbound route preference. A lower MED value is preferred. Setting a lower MED for the specific subnet will make it preferred over the less specific route.

Answer

Local preference

Answer

AS path prepend

Answer

Weight