PCNE Multiple Select — 40 Questions

Question 1

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service perimeter. VPC Service Controls perimeters require: 1) A service perimeter that includes the project and services, 2) Access levels that define allowed client attributes (e.g., IP addresses, device policy), and 3) VPC accessible services configuration to restrict access to only requests originating from specified VPC networks. Ingress rules are optional for allowing access from outside the perimeter.

Answer

Cloud NAT gateway

Answer

Private Google Access

Question 2

An organization needs to design a hybrid connectivity solution with 99.99% availability for a mission-critical application. They have a co-location facility near a GCP region. Which THREE components are required to meet this SLA?

Accepted Answer

Two VLAN attachments. For 99.99% SLA with Dedicated Interconnect, you need two links in different edge availability domains, two VLAN attachments, and BGP sessions with Cloud Router.

Answer

One Dedicated Interconnect link with multiple VLAN attachments

Answer

Classic VPN as a backup

Question 3

A company is designing a hybrid network with Cloud VPN. Which TWO best practices should they follow? (Choose TWO.)

Accepted Answer

Use pre-shared keys for authentication.. Pre-shared keys (PSKs) are a valid and commonly used authentication method for IPsec VPN tunnels in Google Cloud. They provide a simple, symmetric key-based mechanism to authenticate the VPN peers without requiring a PKI infrastructure, making them a best practice for straightforward deployments.

Answer

Use a VPN tunnel per subnet.

Answer

Use static routes for simplicity.

Answer

Use a single VPN tunnel for all traffic.

Question 4

A network engineer is designing a hybrid cloud architecture connecting an on-premises data center to Google Cloud via Dedicated Interconnect. The on-premises network uses BGP for dynamic routing. The engineer needs to configure Cloud Router to exchange routes with the on-premises router. Which two configuration steps are required? (Choose two.)

Accepted Answer

Enable the BGP session on the Cloud Router and configure the peer IP address and ASN.. Cloud Router uses BGP to dynamically exchange routes with the on-premises router over Dedicated Interconnect. Enabling the BGP session requires configuring the peer IP address (the on-premises router's interface IP) and the on-premises ASN, which allows the two routers to establish a BGP peering and exchange prefixes.

Answer

Configure a static route in Google Cloud VPC with the on-premises prefix.

Answer

Assign a primary and secondary IP range to the Cloud Router interface.

Answer

Configure the Cloud Router with the same ASN as the on-premises router.

Question 5

A company uses Traffic Director with Envoy sidecars to manage traffic in their service mesh. They want to perform canary deployments where 10% of traffic goes to the new version and 90% to the stable version. Which TWO Traffic Director resources should they configure? (Choose two.)

Accepted Answer

A TrafficDirectorService with a traffic splitting policy (weighted clusters). Traffic splitting is achieved through TrafficDirectorService with a weighted traffic policy. BackendService defines the service backends. Envoy Route Configuration is used for routing, but Traffic Director configures it automatically. HTTPRoute and gRPC filters are not used for traffic splitting.

Answer

A gRPC filter in the Envoy configuration

Answer

An HTTPRoute resource

Answer

An Envoy Route Configuration with weighted clusters

Question 6

An organization wants to enforce that only instances with specific service accounts can be accessed via SSH (TCP 22) from the internet. Which two attributes should be used in the firewall rule to achieve this? (Choose two.)

Accepted Answer

--source-ranges 0.0.0.0/0. To target instances based on service account, use --target-service-accounts. To specify the source from internet, use --source-ranges with 0.0.0.0/0.

Answer

--source-service-accounts

Answer

--target-tags

Answer

--destination-ranges

Question 7

A company wants to set up a Regional Internal HTTP(S) Load Balancer to serve an internal web application. Which two components are required? (Choose two.)

Accepted Answer

An Envoy-based proxy. Regional Internal HTTP(S) LB requires an Envoy-based proxy and a backend service with a NEG of type GCE_VM_IP_PORT or GCE_VM_IP.

Answer

Cloud CDN

Answer

An SSL certificate

Answer

A global forwarding rule

Question 8

A company needs to load balance TCP traffic without SSL termination for a gaming application where client IP preservation is critical. The backend is a group of Compute Engine instances. Which load balancer types meet these requirements? (Choose TWO.)

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Global TCP Proxy Load Balancer terminates SSL? Actually, TCP Proxy LB does not terminate SSL; it forwards TCP traffic but does not preserve client IP by default (uses Proxy Protocol). Regional External TCP/UDP Network Load Balancer is pass-through and preserves client IP. The Internal TCP/UDP LB is pass-through but internal. For external TCP without SSL termination and client IP preservation, the best options are the Regional External TCP/UDP NLB (pass-through) and a Global TCP Proxy with Proxy Protocol enabled (which can preserve IP via Proxy Protocol).

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global SSL Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Question 9

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address. When the BGP session state is stuck in 'CONNECT', it indicates that the router is actively trying to initiate a TCP connection to the peer but is not receiving a response. For BGP to establish a TCP session (port 179), the on-premises router must have a valid IP route to the Cloud Router's BGP peer IP address. Without this route, TCP SYN packets are dropped, preventing the session from transitioning to 'ESTABLISHED'.

Answer

Change the BGP ASN on the Cloud Router to a different number

Answer

Increase the BGP hold timer on the Cloud Router

Answer

Change the BGP keepalive interval to 10 seconds

Question 10

A company uses Shared VPC. They want to restrict which service project's VMs can use a specific subnet. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Use IAM roles on the subnet resource to grant 'compute.subnetUser' to specific service projects.. IAM roles on a subnet resource allow you to grant the `compute.subnetUser` role to specific service projects, which controls which projects can create VM instances in that subnet. This is a direct method to restrict subnet usage within a Shared VPC environment, as the role grants permission to use the subnet without granting broader network access.

Answer

Use VPC network peering.

Answer

Use firewall rules to deny traffic from other service projects.

Answer

Use network tags on VMs and associate the subnet with those tags.

Question 11

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Accepted Answer

Mismatched BGP hold timer values. BGP session flapping can be caused by mismatched parameters, MTU issues, or authentication problems.

Answer

Incorrect VLAN ID on the VLAN attachment

Answer

Duplicate AS number on the on-premises router

Question 12

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. NCC supports both VPC spokes and hybrid spokes (VPN/Interconnect). It does not support direct VPC-to-VPC peering; that's VPC peering. Route propagation is automatic within NCC.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.

Question 13

An organization wants to reduce egress costs for data sent from Compute Engine instances to users worldwide. Which TWO approaches should they consider? (Choose TWO.)

Accepted Answer

Deploy instances in multiple regions closer to users.. Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network routes traffic over Google's network, which may not reduce egress cost but improves performance; however, Standard Tier egress is cheaper than Premium Tier for internet egress. For reducing costs, Cloud CDN and using Standard Tier (if acceptable) can help. But among the options, Cloud CDN and placing instances in multiple regions (to serve users locally) reduce egress.

Answer

Enable Private Google Access to avoid internet egress for Google APIs.

Answer

Use global load balancers instead of regional load balancers.

Answer

Use Premium Tier networking to route traffic over Google's network.

Question 14

Which THREE of the following are valid use cases for VPC Service Controls?

Accepted Answer

Controlling access to a Cloud SQL database from a specific VPC.. VPC Service Controls allow you to define a service perimeter that restricts access to a Cloud SQL database (or other Google Cloud services) to requests originating from a specific VPC network. This is achieved by configuring an access level that references the VPC network, ensuring that only traffic from that VPC can reach the database, even if the database is exposed via private IP.

Answer

Allowing access to a managed instance group from the internet.

Answer

Enabling private access to Cloud APIs from on-premises.

Question 15

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify the BGP session status on the Cloud Router.. BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Answer

Check the MTU configuration on the on-premises router.

Answer

Verify the physical interconnect location and cable connections.

Answer

Review the Cloud NAT configuration for the VPC network.

Question 16

An organization is experiencing high latency on their Partner Interconnect connection. Which TWO tools or features can they use to diagnose the issue from within Google Cloud? (Choose two.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic flowing to and from VPC instances, including latency-related metrics such as packet loss and retransmissions. By analyzing these logs, you can identify if high latency is caused by dropped packets or congestion on the Partner Interconnect link. This makes VPC Flow Logs a direct diagnostic tool for latency issues from within Google Cloud.

Answer

Network Intelligence Center performance dashboard

Answer

Cloud Router logs

Answer

Cloud Load Balancing logs

Question 17

A company is designing a global web application that must serve users worldwide with low latency. They plan to use a Global HTTPS Load Balancer with Cloud CDN. Which TWO features should they enable to further reduce latency for users connecting from various regions? (Choose two.)

Accepted Answer

Anycast IP address. CDN Interconnect provides dedicated connectivity to CDN caches, reducing latency. Anycast IP ensures users connect to the nearest edge location. Cloud Armor is security, not performance.

Answer

Reserve a static IP address

Answer

Enable IAP for backend services

Answer

Cloud Armor with rate limiting

Question 18

You need to configure a health check for a backend service that uses HTTP2. Which THREE settings must be configured correctly for the health check to work? (Select three.)

Accepted Answer

Request path. For an HTTP2 health check, you need to specify the protocol (HTTP2), a port, and a request path.

Answer

Proxy protocol

Answer

SSL certificate

Question 19

An engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They want to control which on-premises subnets are advertised to GCP. Which TWO methods can they use?

Accepted Answer

Apply BGP filters on the on-premises router to limit advertised prefixes. Custom learned routes can be configured to filter prefixes, and BGP filters can be applied on the on-premises side.

Answer

Change the Cloud Router ASN

Answer

Use route priority in the VPC

Answer

Set MED on the on-premises router

Question 20

A network engineer is troubleshooting a global HTTPS load balancer that is not serving traffic to some users. The load balancer has a backend service with a zonal NEG in us-central1-a. Users report intermittent 502 errors. Which two checks should the engineer perform? (Choose two.)

Accepted Answer

Verify that the health check for the backend service is passing. Common causes for 502 errors include health check failures and mismatched SSL certificates. Check that the health check passes and that the SSL certificate covers the domain.

Answer

Increase the size of the instance group

Answer

Disable HTTP/2 on the backend

Answer

Ensure Cloud CDN is enabled