PCNE Hard Questions — 25 Difficult Questions

Question 1

Your company uses Network Connectivity Center (NCC) to manage multiple on-premises sites connected via Cloud VPN and Partner Interconnect. You create a NCC hub and attach spokes (VPN tunnels and VLAN attachments). Traffic between two on-premises sites (Site A and Site B) should flow through Google Cloud. However, traffic is not passing between the sites. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPN spokes do not have custom dynamic route exchange enabled, so routes from Site A are not advertised to Site B.. Network Connectivity Center (NCC) hub-and-spoke architecture requires custom dynamic route exchange to be enabled on VPN spokes for routes to be propagated between on-premises sites. By default, NCC does not automatically exchange routes between spokes; you must enable custom dynamic route exchange on the VPN spokes so that Site A's routes are advertised to Site B via the hub. Without this, traffic cannot flow between the sites even though both are connected to the hub.

Answer

The on-premises routers need static routes pointing to the Google Cloud VPC for inter-site traffic.

Answer

Network Connectivity Center does not support Cloud VPN as a spoke type.

Answer

The NCC hub must be in the same VPC network as the sites' VPCs.

Question 2

An engineer is troubleshooting a VPC Network Peering connection between VPC-A and VPC-B. They have verified that the peering is active. However, an instance in VPC-A cannot reach an instance in VPC-B using its internal IP. Both VPCs have firewall rules allowing the traffic. What is the most likely cause?

Accepted Answer

Custom routes are not being exchanged between the VPCs. When VPC Network Peering is active but traffic fails, the most common cause is that custom routes are not being exchanged. By default, only subnet routes are exchanged; custom routes (e.g., static routes or routes from VPNs) are not shared unless explicitly configured using the 'export custom routes' option in the peering settings. Without this, the instance in VPC-A has no route to the internal IP of the instance in VPC-B, even if firewall rules allow the traffic.

Answer

The firewall rules are not applied to the correct tags

Answer

The subnet IP ranges overlap

Answer

The instance in VPC-A does not have a default route

Question 3

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

Accepted Answer

It depends on the redundancy requirements; typically two per attachment for active-active.. With a Dedicated Interconnect using two VLAN attachments in different edge availability domains (EADs), the recommended best practice for high availability is to establish two BGP sessions per VLAN attachment (one active and one redundant) on the same Cloud Router, resulting in four sessions total. However, the question asks 'how many BGP sessions should be established' and the correct answer acknowledges that it depends on the redundancy requirements; typically two per attachment for active-active, but if active-passive is acceptable, fewer sessions may suffice. This flexibility makes 'It depends' the most accurate choice.

Answer

Four: two per VLAN attachment.

Answer

Two: one per VLAN attachment.

Answer

One: one session per Cloud Router.

Question 4

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking health check probes from Google Cloud. Hybrid connectivity NEGs rely on health checks from Google Cloud to determine endpoint health. If the on-premises firewall blocks these health check probes (which originate from Google's health check IP ranges), the NEG marks the endpoint as unhealthy, and Traffic Director stops routing traffic, causing connection timeouts. The most likely cause is the firewall blocking these probes.

Answer

The hybrid connectivity NEG is not supported with Traffic Director

Answer

The Cloud VPN tunnel is not established

Answer

Traffic Director requires mTLS for all hybrid endpoints

Question 5

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Accepted Answer

Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used. To ensure specific VMs use a designated set of NAT IPs for auditing, you must first create a separate Cloud NAT gateway with the desired IPs and associate it with the VMs via subnet or tags (option D). This isolates traffic from those VMs. Next, configure VPC firewall rules to allow egress from the VMs to the internet (option E); otherwise, outbound traffic may be blocked. Finally, enable VPC Flow Logs on the subnet (option C) to capture which NAT IPs are used, providing auditability. Option A is not necessary because the default route's next hop is the internet gateway, not the NAT gateway's subnet, and Cloud NAT does not require a route pointing to its subnet. Option B is misleading: Cloud NAT uses subnet or tag associations, not IAM conditions, to control which VMs use it.

Answer

Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet

Answer

Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it

Question 6

A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?

Accepted Answer

Enable MACsec on the Dedicated Interconnect. MACsec (IEEE 802.1AE) provides Layer 2 encryption on the Dedicated Interconnect link itself, encrypting all traffic between the on-premises router and the Google Cloud edge router without requiring any changes to applications or additional VPN gateways. This meets the encryption requirement with minimal overhead and complexity because MACsec operates transparently at the data link layer, adding negligible latency and no per-packet processing overhead compared to IPsec or TLS.

Answer

Enable TLS encryption on all applications

Answer

Use Cloud VPN over the internet instead of Dedicated Interconnect

Answer

Establish an IPsec VPN tunnel over the Dedicated Interconnect

Question 7

A company uses Shared VPC with a host project and several service projects. They want to allow only a specific team to create subnets in the host project, and another team to use those subnets in their service projects. Which IAM roles should be assigned?

Accepted Answer

Compute Network Admin on host project for subnet creators; Compute Network User on host project for subnet users.. To create subnets, a user needs the Compute Network Admin role on the host project. To use subnets, a user needs the Compute Network User role on the host project or specific subnets.

Answer

Compute Network Admin on host project for both teams.

Answer

Compute Shared VPC Admin on host project for subnet creators; Compute Network User on host project for subnet users.

Answer

Compute Network User on host project for subnet creators; Compute Network Admin on service projects for subnet users.

Question 8

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

Accepted Answer

Use a Cloud Router with BGP and establish multiple BGP sessions over each Interconnect. Cloud Router with BGP enables dynamic routing, allowing multiple BGP sessions over each Cloud Interconnect. When one interconnect fails, BGP withdraws the affected routes, and traffic is automatically redistributed across the remaining BGP sessions without manual intervention. This meets the requirement for automatic failover and load balancing across the five 10 Gbps connections.

Answer

Configure multiple VLAN attachments on a single Cloud Router and rely on link aggregation

Answer

Deploy Cloud VPN tunnels as backup and configure static routes with lower priority

Answer

Configure VPC Network Peering between all data centers and Google Cloud

Question 9

A security team needs to capture all traffic to and from a specific Compute Engine instance for forensic analysis. They want to send the mirrored traffic to a third-party IDS appliance running on a separate VM in the same VPC. Which GCP feature should they use, and what is a key consideration?

Accepted Answer

Packet Mirroring, and the collector must be in the same VPC network as the mirrored instance. Packet Mirroring in GCP captures traffic to and from a specific Compute Engine instance and forwards it to a collector instance for analysis. A key requirement is that the collector must be in the same VPC network as the mirrored instance, ensuring the mirrored traffic can be delivered without crossing network boundaries. This makes it suitable for sending traffic to a third-party IDS appliance on a separate VM.

Answer

Firewall Rules Logging, which logs allow/deny events

Answer

VPC Flow Logs, since logs are stored in Stackdriver and can be exported

Answer

Cloud NAT logging, which logs all outbound connections

Question 10

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Accepted Answer

Use a global external HTTP(S) load balancer with an anycast IP and enable Cloud CDN.. A global external HTTP(S) load balancer uses a single anycast IP address, which directs each user to the closest healthy backend based on the user's geographic location and backend health. Enabling Cloud CDN further reduces latency by caching content at Google's global edge locations, ensuring that static and dynamic content is served from the nearest point of presence.

Answer

Deploy a regional external HTTP(S) load balancer in each region and use Cloud CDN to cache content.

Answer

Configure an internal TCP/UDP load balancer in each region with DNS-based geolocation routing.

Answer

Set up a global external TCP proxy load balancer with SSL termination at each backend.

Question 11

A company is planning to migrate to Google Cloud and needs to design a VPC network for a multi-tier application (web, app, database). Which THREE best practices should they follow? (Choose THREE.)

Accepted Answer

Create separate subnets for each tier and use firewall rules to control traffic between them.. Option C is correct because segmenting the web, app, and database tiers into separate subnets lets you apply VPC firewall rules scoped by subnet/tag/service account, enforcing least-privilege east-west traffic control between tiers. Option D is correct because Cloud Armor attaches to an external HTTP(S) load balancer in front of the web tier, providing WAF rules and DDoS/edge protection for internet-facing traffic. Option E is correct because Private Google Access lets instances with only internal IPs reach Google APIs and services (e.g., via private.googleapis.com) without external IPs or NAT. Option A is wrong because a single flat subnet for all tiers removes network segmentation and weakens least-privilege firewall enforcement. Option B is wrong because Google Cloud firewall rules are VPC-level constructs applied to instances by tags or service accounts; there is no separate 'instance-level firewall' model replacing VPC firewall rules.

Answer

Use one subnet for all tiers to simplify routing.

Answer

Use instance-level firewalls instead of VPC firewall rules.

Question 12

A financial company requires encrypted traffic between on-premise and GCP. They have strict compliance requiring that encryption keys are managed on-premise and rotated every 30 days. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect with MACsec. B is correct because MACsec (IEEE 802.1AE) provides encryption at Layer 2, which is required for Cloud Interconnect to secure traffic between on-premise and GCP. Unlike VPN solutions, MACsec allows the customer to manage encryption keys on-premise and rotate them every 30 days, meeting strict compliance requirements. Cloud Interconnect with MACsec ensures low-latency, high-bandwidth connectivity while keeping key management under the customer's control.

Answer

Cloud VPN with certificate-based authentication using on-prem CA

Answer

Cloud VPN with IKEv2 and pre-shared keys

Answer

Cloud Interconnect with VLAN attachments

Answer

Partner Interconnect with a service provider that supports MACsec

Question 13

A company is deploying a GKE cluster with Dataplane V2 and wants to enforce micro-segmentation using network policies. They also need to monitor policy violations. What should they do?

Accepted Answer

Enable GKE Dataplane V2 and use Kubernetes Network Policies with audit logging.. Dataplane V2 uses eBPF to implement Kubernetes Network Policies directly in the kernel, providing native support for micro-segmentation. Enabling audit logging on the cluster captures denied or allowed policy actions, allowing the company to monitor policy violations without additional infrastructure.

Answer

Enable Packet Mirroring.

Answer

Use Cloud IDS to monitor traffic.

Answer

Use VPC firewall rules with pod IP ranges.

Question 14

A company has a VPC with multiple subnets and uses Cloud VPN tunnels to connect to on-premises. They want to ensure that only traffic destined for on-premises is sent through the VPN tunnels; all other traffic should use the internet. Which route configuration should they implement?

Accepted Answer

Use Cloud Router with BGP to exchange specific routes with on-premises, and keep the default internet route for other traffic.. Using Cloud Router with BGP allows the VPC to dynamically learn specific routes from the on-premises network via the VPN tunnels. The default route (0.0.0.0/0) remains pointing to the internet gateway, so only traffic destined for the learned on-premises prefixes is sent through the VPN, while all other traffic uses the internet. This provides precise control without overriding the default route.

Answer

Add a static route for 0.0.0.0/0 with next hop VPN gateway, and set a lower priority than the internet default route.

Answer

Configure the Cloud VPN to advertise a default route to on-premises, and rely on local preference.

Answer

Use VPC Network Peering with the on-premises network and configure custom route exchange.

Question 15

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the return route via BGP, causing asymmetric routing.. The symptom — traffic reaches on-premises but return traffic is dropped — is the classic signature of asymmetric routing. If the on-premises router doesn't advertise the 10.0.0.0/… prefix back through BGP over the Cloud VPN, it has no route for the return path and either drops the packet or sends it out a different interface. The Cloud VPN tunnel itself is up (traffic is flowing one way), so the issue is route propagation, not tunnel state.

Answer

The Cloud VPN tunnel is down.

Answer

The MTU is set to 1500 on the VPN tunnel.

Answer

The instance's firewall is blocking ICMP.

Question 16

An engineer configures a Global HTTPS Load Balancer with a backend service pointing to an instance group. The health check is set to HTTP on port 80, check interval 5s, timeout 5s, healthy threshold 1, unhealthy threshold 1. After deployment, instances are marked unhealthy despite the application responding correctly on port 80. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the check interval. With timeout equal to check interval, the health check may not have enough time to complete before the next check starts, causing failures. The timeout should be less than the interval.

Answer

The health check is using HTTPS but the instance expects HTTP

Answer

The unhealthy threshold is set too high

Answer

The health check is not configured with a host header

Question 17

A financial services company has a Shared VPC setup where the host project contains a central VPC, and multiple service projects attach to it. The network team wants to monitor all VPC Flow Logs from the host project's subnets and analyze traffic patterns across all service projects. They need to aggregate logs in a central location for long-term analysis and querying with SQL. What should they do?

Accepted Answer

Enable VPC Flow Logs on each subnet in the host project, then create a log sink in the host project that exports to a BigQuery dataset in a centralized logging project.. In a Shared VPC, the host project owns the subnets, so VPC Flow Logs are generated there. To centralize these logs for SQL analysis, a log sink in the host project should export to a BigQuery dataset, which can reside in a separate logging project. This pattern aggregates all flow logs from the host project's subnets into one location, enabling cross-project traffic analysis and long-term retention with BigQuery's querying capabilities.

Answer

Enable VPC Flow Logs on each service project's subnets, then create a log sink in each service project that exports to a BigQuery dataset in the host project.

Answer

Enable VPC Flow Logs on the host project's subnets, then use Cloud Logging's log viewer to filter and analyze the logs, and schedule regular exports to Cloud Storage for long-term retention.

Answer

Use Cloud Monitoring's VPC Flow Logs dashboard to view traffic across all projects, and export the dashboard data to BigQuery using the Monitoring API.

Question 18

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

Accepted Answer

Configure Cloud Router in the host project to advertise all subnets via BGP.. In a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Answer

Configure Cloud NAT in each service project for on-prem access.

Answer

Use VPC peering between the host project and each service project.

Answer

Create separate Interconnect VLAN attachments for each service project.

Question 19

A company has two Dedicated Interconnect connections in different metro areas to meet the 99.99% SLA. They want to ensure that traffic uses both connections in an active-active manner. Which three configurations are required? (Choose three.)

Accepted Answer

Configure BGP on both VLAN attachments with equal MED values.. For active-active, you need two VLAN attachments (one per connection), both attached to the same Cloud Router, and you must configure BGP on both attachments with the same route preferences (e.g., equal MED) to enable ECMP.

Answer

Create a single VLAN attachment shared across both connections.

Answer

Set the VLAN attachments to use static routing instead of BGP.

Question 20

A company is connecting their on-premises network to GCP via Cloud Interconnect with VLAN attachments and BGP sessions. They want to prefer one attachment over the other for traffic to a specific prefix. Which BGP attribute should they use?

Accepted Answer

MED. Multi-Exit Discriminator (MED) is used to influence inbound traffic from a peer AS. Lower MED values are preferred.

Answer

AS path prepend

Answer

Weight

Answer

Local preference