PCNE Hard Questions — 25 Difficult Questions

Question 1

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

Accepted Answer

Cloud Router. Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Answer

Cloud NAT

Answer

VPC peering

Answer

VPC Flow Logs

Question 2

A company is migrating on-premises DNS to Google Cloud. They have a hybrid network using Cloud VPN and want to resolve on-premises hostnames from Compute Engine instances without custom scripts. Which service should they use?

Accepted Answer

Use Cloud DNS inbound server policy to forward queries to on-premises DNS.. Cloud DNS inbound server policy allows on-premises DNS servers to receive DNS queries from Compute Engine instances by creating a VPC-scoped policy that forwards queries to the IP addresses of on-premises DNS resolvers over Cloud VPN. This enables hybrid name resolution without custom scripts, as the policy automatically handles the forwarding of DNS requests from Google Cloud resources to the on-premises DNS infrastructure.

Answer

Create a forwarding zone in Cloud DNS and associate it with the VPC.

Answer

Enable Private Google Access on the VPC subnet.

Answer

Configure Cloud NAT to forward DNS queries to on-premises DNS servers.

Question 3

An organization has a VPC with custom mode subnets in us-central1 and europe-west1. They create a VM instance in us-central1 with an internal IP 10.0.1.2 and a VM in europe-west1 with internal IP 10.0.2.2. They want to enable communication between these instances using internal IPs. What must be configured?

Accepted Answer

Ensure the VPC firewall rules allow ingress from the source subnet or instance.. Option A is correct because VPC firewall rules are stateful and must allow ingress traffic from the source subnet (10.0.1.0/24) or the specific source instance (10.0.1.2) to the destination VM in europe-west1. By default, VPCs have an implied deny-all ingress rule, so explicit firewall rules are required to permit traffic between subnets in different regions within the same VPC. The rule should specify the source IP range or tag and the destination protocol/port (e.g., ICMP, TCP/22) to enable communication.

Answer

Set up VPC peering between the two regions.

Answer

No additional configuration is needed because internal IPs are routable within the VPC.

Answer

Enable Cloud NAT for the VPC.

Question 4

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

Accepted Answer

Deploy a global HTTP(S) Load Balancer with backend services in each region.. A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Answer

Use Cloud DNS with geo-routing to direct users to regional load balancers.

Answer

Set up Cloud NAT with multiple static IP addresses for each region.

Answer

Assign a global anycast IP address to all instances and use BGP to advertise it.

Question 5

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Accepted Answer

Service projects. A is correct because service projects in a Shared VPC architecture allow each project to host its own resources (e.g., Compute Engine instances) while maintaining separate firewall rules and security policies. This enables centralized network administration via the host project while giving each project autonomy over its own firewall configurations, meeting the requirement for multiple projects with independent firewall rules.

Answer

Cloud VPN

Answer

VPC peering

Question 6

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Accepted Answer

Place both instances in the same VPC, using internal IP addresses.. Option C is correct because placing both Compute Engine instances in the same VPC and using internal IP addresses ensures traffic stays within Google's private network backbone, bypassing any external gateways or internet hops. This configuration leverages Google's internal routing with sub-millisecond latency between zones in the same region, as traffic is forwarded at the hypervisor level without encapsulation or additional network hops.

Answer

Use VPC Network Peering between two different VPCs.

Answer

Place instances in different VPCs and use a VPN between them.

Answer

Assign external IP addresses to both instances and communicate over the internet.

Question 7

A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which THREE conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?

Accepted Answer

The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.. Option B is correct because VPC firewall rules in Google Cloud are stateful and defined as ingress or egress rules. To block traffic from Subnet-A to Subnet-B, you need an ingress rule on Subnet-B (the destination) with the source set to Subnet-A's IP range and the destination set to Subnet-B's IP range. This ensures the rule applies to incoming traffic from Subnet-A, and the action 'deny' will drop the packets.

Answer

The rule must be applied using network tags on instances in Subnet-A.

Answer

The rule must also allow return traffic from Subnet-B to Subnet-A.

Question 8

A network engineer configured a Cloud Router with the BGP configuration shown. The on-premises router (AS 64512) is peering with the Cloud Router (AS 65001) over a Dedicated Interconnect VLAN attachment. The engineer notices that traffic from on-premises to Google Cloud is not being routed via this interconnect as expected. What is the most likely cause?

Accepted Answer

The update-source loopback0 command is invalid for Cloud Router BGP sessions. Option C is correct because Cloud Router does not support the `update-source loopback0` command. BGP sessions on Cloud Router must use the primary IP address of the interface that is directly connected to the VLAN attachment; loopback interfaces are not supported for BGP peering. This command would cause the Cloud Router to attempt to source BGP packets from a loopback address that is not reachable by the on-premises router, breaking the BGP session.

Answer

The route-map SET-MED sets the MED attribute incorrectly

Answer

The ebgp-multihop 2 command is not supported on Cloud Router

Answer

The local-preference is set in the outbound direction, which is not allowed

Question 9

A company has a VPC with multiple subnets. They want to restrict traffic between two specific subnets (10.0.1.0/24 and 10.0.2.0/24) while allowing all other traffic. They create a firewall rule with priority 1000 denying ingress from 10.0.1.0/24 to 10.0.2.0/24. However, traffic is still allowed. What is the most likely reason?

Accepted Answer

There is a higher priority allow rule that matches the traffic. Option C is correct because in Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence. A rule with priority 1000 is evaluated after any rule with a priority lower than 1000 (e.g., priority 65535 is the default allow rule). If a higher priority (lower number) allow rule exists that matches the same traffic, it will override the deny rule. The default VPC firewall rules include an implicit allow rule for egress and an ingress allow rule for traffic within the same VPC, which may have a higher priority than 1000, thus permitting the traffic despite the deny rule.

Answer

The rule is incorrectly applied to the wrong network tag

Answer

The traffic is going through the metadata server

Answer

Firewall rules are stateless, so return traffic is blocked

Question 10

You have a Cloud Router with the configuration shown. The on-premises network (ASN 65002) is not receiving any routes from Google Cloud. What is the most likely cause?

Accepted Answer

The router is in custom advertise mode but does not advertise the VPC subnets. When a Cloud Router is configured in custom advertise mode, it only advertises the routes explicitly specified in the custom advertisement list. If the VPC subnets are not included in that list, the on-premises network will not receive any routes from Google Cloud, even if the BGP session is established. This is the most likely cause because the question states the on-premises network is not receiving any routes, which aligns with a missing custom advertisement rather than a session or timer issue.

Answer

The BGP keepalive interval is set too low

Answer

The BGP session is not established

Answer

The on-premises subnet 10.0.1.0/24 is not advertised

Question 11

A large enterprise is migrating to Google Cloud and needs to establish connectivity between on-premises and VPCs in two different regions (us-east1 and europe-west1). They have a single Partner Interconnect connection at a co-location facility in New York. They want to use the same interconnect for both regions. Which configuration should they use?

Accepted Answer

Create two VLAN attachments, one for each region, over the same interconnect. A is correct because a single Partner Interconnect connection can support multiple VLAN attachments, each associated with a different region. By creating two VLAN attachments over the same interconnect—one for us-east1 and one for europe-west1—the enterprise can route traffic from the on-premises network to both VPCs using the same physical link, leveraging Google Cloud's support for multiple VLAN attachments per interconnect.

Answer

Create one VLAN attachment and attach it to both VPCs

Answer

Use HA VPN over the interconnect to connect both regions

Answer

Create two Cloud VPN tunnels from on-prem to each VPC

Question 12

A company has a VPC with subnets in us-central1 and europe-west1. They create a Private Service Connect endpoint for a managed service in us-central1. Can Compute Engine instances in europe-west1 access the endpoint?

Accepted Answer

No, because the endpoint is only accessible from the same region.. Private Service Connect (PSC) endpoints are regional resources. An endpoint created in us-central1 is only accessible from Compute Engine instances within the same region (us-central1) of the VPC. Instances in europe-west1 cannot directly reach the endpoint because traffic would need to cross regional boundaries, which PSC does not support for producer endpoints. Option D correctly identifies this regional restriction.

Answer

Yes, if they use a global load balancer in front of the endpoint.

Answer

No, unless the VPC is peered with another VPC that contains the endpoint.

Answer

Yes, because the endpoint is accessible from any region in the VPC.

Question 13

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

Accepted Answer

Use Cloud NAT to allow outbound internet access without public IPs. Cloud NAT enables outbound internet access for private VMs without assigning them public IP addresses, which reduces the attack surface. This is a secure alternative to direct internet access because it allows outbound connections initiated by the VMs while blocking unsolicited inbound traffic from the internet. It works by translating private IP addresses to a set of ephemeral public IPs managed by Google Cloud.

Answer

Assign public IP addresses to all VMs for direct internet access

Answer

Enable VPC Flow Logs to block malicious traffic

Question 14

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

Accepted Answer

Check if the external service is blocking the Cloud NAT IP addresses.. Option A is correct because Cloud NAT uses a set of public IP addresses for outbound traffic. If the external service has firewall rules or access control lists that block these specific IP addresses, the instances will be unable to reach it. Checking for IP-based blocking is a standard first step in troubleshooting connectivity issues through a NAT gateway.

Answer

Ensure that the VPC has a default route to the internet gateway.

Answer

Check the DNS resolution for the external service.

Question 15

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

Accepted Answer

Check Cloud NAT logs for port exhaustion. Option B is correct because Cloud NAT logs can reveal port exhaustion, which occurs when the NAT gateway runs out of available source ports for connections. Since all instances share the same NAT IP addresses, high connection counts from some instances can exhaust ports, preventing others from establishing new outbound connections. Checking these logs helps identify whether port exhaustion is the root cause of the connectivity issue.

Answer

Ensure Cloud NAT is enabled in each zone where instances are located

Answer

Verify that the instances have external IP addresses assigned

Answer

Review the health check configuration for the NAT gateway

Question 16

An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?

Accepted Answer

Enable Private Google Access on the subnet and create a VPC Service Controls perimeter that includes the bucket project. D is correct because VPC Service Controls create a security perimeter around the Cloud Storage bucket's project, preventing data exfiltration even if the bucket is publicly accessible. Private Google Access on the subnet allows VMs to reach Google APIs (including storage.googleapis.com) via internal IPs, avoiding the public internet. Together, they ensure only VMs within the specified VPC network can download objects, as the perimeter restricts access to authorized networks and Private Google Access provides the private connectivity path.

Answer

Enable Cloud NAT and configure a firewall rule to allow egress to 0.0.0.0/0

Answer

Configure a Service Directory endpoint and attach an IAM policy to the bucket allowing access only from that endpoint

Answer

Create a firewall rule allowing egress to the storage.googleapis.com service IP range and enable VPC flow logs

Question 17

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

Accepted Answer

Use Private Service Connect to publish the database as a managed service and create a Private Service Connect endpoint in the spoke VPC with IAM permissions for the specific VM service accounts. Option C is correct because Private Service Connect (PSC) allows you to publish a managed service (like Cloud SQL) and create a PSC endpoint in the spoke VPC. By combining the PSC endpoint with IAM permissions on the VM service accounts, you ensure that only specific VMs can connect to the database, providing fine-grained, identity-aware access control without exposing the database to the entire network.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and configure IAM permissions for each VM's service account

Answer

Use Shared VPC and assign the specific VMs to a subnet with a dedicated secondary IP range, then restrict database access to that range

Answer

Configure firewall rules in the hub project to allow traffic only from the specific VM internal IPs

Question 18

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Accepted Answer

Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet. Option A is correct because for Cloud NAT to function, the VM must have a default route (0.0.0.0/0) that points to the Cloud NAT gateway's subnet as the next hop. Without this route, the VM's outbound traffic will not be directed to the NAT gateway, and the NAT IPs will not be used. This ensures that traffic from the VM is routed through the NAT gateway, allowing the specific set of NAT IPs to be applied for auditing.

Answer

Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it

Answer

Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used

Question 19

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

Accepted Answer

The firewall rule allow-ssh is missing a source IP range or has a source IP range that does not include the user's IP. The most likely cause is that the firewall rule 'allow-ssh' is missing a source IP range or has a source IP range that does not include the user's public IP (203.0.113.5). In Google Cloud, firewall rules are stateful and by default deny all ingress traffic unless explicitly allowed; without a source IP range (or with an incorrect one), the SSH traffic from the user's workstation is dropped at the VPC firewall level, preventing access to the VM's external IP (34.67.89.10).

Answer

The firewall rule allow-ssh is for the wrong network

Answer

The firewall rule allow-ssh is disabled

Answer

The VM's external IP (34.67.89.10) is blocked by Cloud NAT

Question 20

Which THREE of the following are requirements for implementing a Global External HTTP(S) Load Balancer with an external backend?

Accepted Answer

The backend must support health checks from the load balancer's health check IP ranges.. Option B is correct because Global External HTTP(S) Load Balancers use Google's frontend (proxying) IP ranges to send health checks to backends. The backend must allow inbound traffic from these specific health check IP ranges (e.g., 35.191.0.0/16 and 130.211.0.0/22) to receive health probes; otherwise, the load balancer will mark the backend as unhealthy and stop forwarding traffic.

Answer

The backend must be configured with Private Google Access.

Answer

The backend must have an SSL certificate installed.