PCNE Multiple Select — 10 Questions

Question 1

A company is designing IP address plans for multiple VPCs that will be connected via VPC Network Peering and to an on-premises network via HA VPN with dynamic routing. Which three practices should be followed to avoid IP address conflicts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reserve IP ranges for future VPCs and on-premises expansion. To avoid overlap, use unique private IP ranges per VPC, plan for future growth, and document all ranges. Using RFC 1918 addresses and avoiding overlapping CIDRs ensures successful peering and VPN connectivity.

Answer

Use only public IP addresses for all GCP resources

Answer

Use the same IP range for all VPCs to simplify management

Question 2

An organization wants to reduce egress costs for data sent from Compute Engine instances to users worldwide. Which TWO approaches should they consider? (Choose TWO.)

Accepted Answer

Deploy instances in multiple regions closer to users.. Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network routes traffic over Google's network, which may not reduce egress cost but improves performance; however, Standard Tier egress is cheaper than Premium Tier for internet egress. For reducing costs, Cloud CDN and using Standard Tier (if acceptable) can help. But among the options, Cloud CDN and placing instances in multiple regions (to serve users locally) reduce egress.

Answer

Enable Private Google Access to avoid internet egress for Google APIs.

Answer

Use global load balancers instead of regional load balancers.

Answer

Use Premium Tier networking to route traffic over Google's network.

Question 3

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify the BGP session status on the Cloud Router.. BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Answer

Check the MTU configuration on the on-premises router.

Answer

Verify the physical interconnect location and cable connections.

Answer

Review the Cloud NAT configuration for the VPC network.

Question 4

A company is planning to migrate to Google Cloud and needs to design a VPC network for a multi-tier application (web, app, database). Which THREE best practices should they follow? (Choose THREE.)

Accepted Answer

Create separate subnets for each tier and use firewall rules to control traffic between them.. Option C is correct because segmenting the web, app, and database tiers into separate subnets lets you apply VPC firewall rules scoped by subnet/tag/service account, enforcing least-privilege east-west traffic control between tiers. Option D is correct because Cloud Armor attaches to an external HTTP(S) load balancer in front of the web tier, providing WAF rules and DDoS/edge protection for internet-facing traffic. Option E is correct because Private Google Access lets instances with only internal IPs reach Google APIs and services (e.g., via private.googleapis.com) without external IPs or NAT. Option A is wrong because a single flat subnet for all tiers removes network segmentation and weakens least-privilege firewall enforcement. Option B is wrong because Google Cloud firewall rules are VPC-level constructs applied to instances by tags or service accounts; there is no separate 'instance-level firewall' model replacing VPC firewall rules.

Answer

Use one subnet for all tiers to simplify routing.

Answer

Use instance-level firewalls instead of VPC firewall rules.

Question 5

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. Option A is correct because Network Connectivity Center uses a hub-and-spoke model in which the hub dynamically exchanges and propagates routes between all attached spokes, so VPC spokes and hybrid spokes learn each other's reachable prefixes without manual route configuration. Option E is correct because NCC spokes can be VPC networks from different Google Cloud projects, allowing cross-project connectivity through a single hub as long as the appropriate IAM permissions and spoke attachments are configured. Option B is incorrect because NCC is a hub-and-spoke transit solution, not a direct VPC-to-VPC peering mechanism; VPC peering is a separate feature that does not involve an NCC hub. Option C is incorrect because NCC hybrid spokes can use HA VPN, Cloud Interconnect (Dedicated or Partner), and other supported connectivity methods, not only Dedicated Interconnect. Option D is incorrect because NCC spokes can be in different regions; the hub-and-spoke topology is global and does not require all spokes to share a region.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.

Question 6

A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?

Accepted Answer

IAM conditions on the bucket. VPC Service Controls can restrict access to Google APIs to only specified VPCs and projects, creating a service perimeter. IAM conditions can further restrict access based on the caller's service account. This combination ensures that only instances with the correct service account in the correct VPC can access the bucket.

Answer

Hierarchical firewall policy

Answer

Cloud Armor

Answer

Cloud NAT

Question 7

A company wants to resolve DNS queries from their on-premises network for a privately hosted zone in Google Cloud (e.g., example.internal). They also want on-premises DNS servers to resolve GCP internal VM hostnames. Which two Cloud DNS features should they implement? (Choose TWO.)

Accepted Answer

DNS peering. DNS peering allows on-premises to query GCP private zones, and DNS forwarding (inbound) allows GCP to forward queries to on-premises DNS servers.

Answer

Public zone delegation

Answer

DNS forwarding (outbound)

Answer

Split-horizon DNS

Question 8

An organization has an internal application that runs on Compute Engine and needs to be load balanced within the same region using a Layer 7 load balancer. They want the load balancer to be accessible only from within their VPC. Which THREE components are needed? (Choose three.)

Accepted Answer

A Regional Internal HTTP(S) Load Balancer forwarding rule. The three required components for a Regional Internal HTTP(S) Load Balancer are the forwarding rule, backend service, and URL map. While a health check is necessary to define in the backend service, it is not a separate component of the load balancer itself. The SSL certificate is optional and only needed if HTTPS is used, not for basic internal load balancing.

Answer

A health check

Answer

An SSL certificate

Question 9

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Accepted Answer

Geo routing policy. Geo routing policy (B) is correct because it lets Cloud DNS return answers based on the geographic location of the querying client, which directly satisfies the requirement to direct users by region. Failover policy (C) is correct because it enables health-checked primary/backup routing, so traffic automatically shifts to a healthy backup region when the primary endpoint is unhealthy. Together, these two policies match the stated need for location-based steering plus regional failover. Weighted round-robin (A) only distributes traffic by configured weights and does not provide geographic targeting or health-based failover. DNSSEC (D) is a security extension for authenticating DNS responses, not a routing policy. Response policy zone (E) is used to override or rewrite DNS answers for policy/filtering purposes, not for geo-based routing or failover.

Answer

Weighted round-robin

Answer

DNSSEC

Answer

Response policy zone

Question 10

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Accepted Answer

URL map. The scenario requires an external Application Load Balancer (HTTP(S)) in front of GKE, and that architecture is built from a specific set of resources. Option B, a URL map, is required because it defines the routing rules that map incoming request paths/hosts to backend services and is a mandatory component of the HTTP(S) load balancer. Option D, a backend service pointing to the GKE NEG, is required because the backend service is what binds the load balancer to the GKE workloads via a Network Endpoint Group and is where Cloud CDN is enabled for static content. Option E, a Google-managed SSL certificate, is required because the custom domain must be served over HTTPS and a Google-managed certificate provides automatic provisioning and renewal for that domain. Option A, a Cloud NAT gateway, is not part of exposing an inbound HTTP service; Cloud NAT provides outbound internet access for private instances and is unrelated to this load balancing path. Option C, a target TCP proxy, belongs to a TCP/SSL proxy load balancer (Layer 4), not to the global HTTP(S) load balancer that this scenario requires.

Answer

Cloud NAT gateway

Answer

Target TCP proxy