PCNE Multiple Select — 60 Questions

Question 1

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Accepted Answer

Service projects. A is correct because service projects in a Shared VPC architecture allow each project to host its own resources (e.g., Compute Engine instances) while maintaining separate firewall rules and security policies. This enables centralized network administration via the host project while giving each project autonomy over its own firewall configurations, meeting the requirement for multiple projects with independent firewall rules.

Answer

Cloud VPN

Answer

VPC peering

Question 2

A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which THREE conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?

Accepted Answer

The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.. Option B is correct because VPC firewall rules in Google Cloud are stateful and defined as ingress or egress rules. To block traffic from Subnet-A to Subnet-B, you need an ingress rule on Subnet-B (the destination) with the source set to Subnet-A's IP range and the destination set to Subnet-B's IP range. This ensures the rule applies to incoming traffic from Subnet-A, and the action 'deny' will drop the packets.

Answer

The rule must be applied using network tags on instances in Subnet-A.

Answer

The rule must also allow return traffic from Subnet-B to Subnet-A.

Question 3

A company is designing a hybrid network using Dedicated Interconnect. They want to configure BGP for load balancing across multiple VLAN attachments. Which TWO statements are correct?

Accepted Answer

You can configure the Cloud Router to advertise the same IP prefixes over both VLAN attachments.. Option B is correct because a Cloud Router can advertise the same IP prefixes over multiple VLAN attachments to enable load balancing. This allows Google Cloud to use ECMP (Equal-Cost Multi-Path) routing to distribute outbound traffic across the two VLAN attachments, as long as the BGP attributes (e.g., AS path length, MED) are equal.

Answer

You must create a separate Cloud Router for each VLAN attachment.

Answer

You should use BGP MED to load balance outbound traffic from Google Cloud.

Answer

Load balancing across VLAN attachments requires a single BGP session.

Question 4

An organization is using Cloud VPN with dynamic routing and wants to improve failover time between two VPN tunnels. Which THREE configuration changes can help reduce failover time?

Accepted Answer

Set a lower BGP MED value on the primary tunnel. Option A is correct because lowering the BGP Multi-Exit Discriminator (MED) value on the primary tunnel makes it more preferred by the BGP best-path selection process. When the primary tunnel fails, BGP withdraws the route, and the backup tunnel (with a higher MED) is immediately used without waiting for timers to expire. This reduces failover time by ensuring the backup path is already known and only needs to be selected upon withdrawal.

Answer

Increase the BGP keepalive interval to reduce overhead

Answer

Add static routes with a higher priority than BGP routes

Question 5

Which TWO considerations are important when designing a VPC peering strategy between multiple projects in Google Cloud?

Accepted Answer

Subnet IP ranges in peered VPCs must not overlap. Option B is correct because VPC peering requires that subnet IP ranges in peered VPCs do not overlap. This is a fundamental constraint of VPC peering in Google Cloud: if two VPCs have overlapping CIDR blocks, routes cannot be exchanged unambiguously, and the peering connection will fail to establish or will cause routing conflicts. Overlapping ranges would break the ability to route traffic correctly between the VPCs, as there would be no way to determine which subnet a packet should be delivered to.

Answer

Peering is transitive by default

Answer

Firewall rules in one VPC automatically apply to peered VPCs

Answer

VPC peering can only be used within the same project

Question 6

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Accepted Answer

Private Google Access enabled on the subnet where the VPN gateway resides.. Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.

Answer

Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.

Answer

Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

Answer

Cloud NAT configured in the VPC.

Question 7

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Accepted Answer

Assign an external IP address to the VM.. Option B is correct because a VM must have an external (public) IP address assigned to be directly reachable from the internet. Without an external IP, the VM cannot receive inbound traffic initiated from outside the VPC, even with proper firewall rules. This is a fundamental requirement for internet-facing workloads in Google Cloud.

Answer

Configure Cloud NAT for the VPC.

Answer

Enable Private Google Access on the subnet.

Answer

Assign a static internal IP address to the VM.

Question 8

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

Accepted Answer

Use Cloud NAT to allow outbound internet access without public IPs. Cloud NAT enables outbound internet access for private VMs without assigning them public IP addresses, which reduces the attack surface. This is a secure alternative to direct internet access because it allows outbound connections initiated by the VMs while blocking unsolicited inbound traffic from the internet. It works by translating private IP addresses to a set of ephemeral public IPs managed by Google Cloud.

Answer

Assign public IP addresses to all VMs for direct internet access

Answer

Enable VPC Flow Logs to block malicious traffic

Question 9

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

Accepted Answer

Check if the external service is blocking the Cloud NAT IP addresses.. Option A is correct because Cloud NAT uses a set of public IP addresses for outbound traffic. If the external service has firewall rules or access control lists that block these specific IP addresses, the instances will be unable to reach it. Checking for IP-based blocking is a standard first step in troubleshooting connectivity issues through a NAT gateway.

Answer

Ensure that the VPC has a default route to the internet gateway.

Answer

Check the DNS resolution for the external service.

Question 10

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Accepted Answer

Set up VPC peering between the VPCs in each region.. Option A is correct because VPC peering allows direct, private IP connectivity between two VPCs using the AWS global network backbone, without traversing the public internet. This enables instances in different regions to communicate using internal IP addresses, provided the VPCs have non-overlapping CIDR blocks and appropriate route table entries are configured.

Answer

Create firewall rules allowing all traffic from the other region's subnet CIDR.

Answer

Configure instances to use external IP addresses for cross-region communication.

Answer

Use a shared VPC to connect both regions.

Question 11

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

Accepted Answer

Check Cloud NAT logs for port exhaustion. Option B is correct because Cloud NAT logs can reveal port exhaustion, which occurs when the NAT gateway runs out of available source ports for connections. Since all instances share the same NAT IP addresses, high connection counts from some instances can exhaust ports, preventing others from establishing new outbound connections. Checking these logs helps identify whether port exhaustion is the root cause of the connectivity issue.

Answer

Ensure Cloud NAT is enabled in each zone where instances are located

Answer

Verify that the instances have external IP addresses assigned

Answer

Review the health check configuration for the NAT gateway

Question 12

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Accepted Answer

Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet. Option A is correct because for Cloud NAT to function, the VM must have a default route (0.0.0.0/0) that points to the Cloud NAT gateway's subnet as the next hop. Without this route, the VM's outbound traffic will not be directed to the NAT gateway, and the NAT IPs will not be used. This ensures that traffic from the VM is routed through the NAT gateway, allowing the specific set of NAT IPs to be applied for auditing.

Answer

Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it

Answer

Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used

Question 13

Which TWO of the following are valid methods to reduce latency between users in Europe and a GCP-hosted application?

Accepted Answer

Use Cloud CDN to cache content at edge locations.. Cloud CDN uses Google's globally distributed edge caches to serve content from locations closer to users, reducing round-trip time and latency. For users in Europe, cached static or dynamic content is delivered from a nearby edge PoP, bypassing the need to fetch from the origin server in a potentially distant region.

Answer

Establish a Cloud VPN tunnel to the user's ISP.

Answer

Use Premium Tier networking instead of Standard Tier.

Answer

Use Cloud NAT for outbound traffic.

Question 14

Which THREE of the following are requirements for implementing a Global External HTTP(S) Load Balancer with an external backend?

Accepted Answer

The backend must support health checks from the load balancer's health check IP ranges.. Option B is correct because Global External HTTP(S) Load Balancers use Google's frontend (proxying) IP ranges to send health checks to backends. The backend must allow inbound traffic from these specific health check IP ranges (e.g., 35.191.0.0/16 and 130.211.0.0/22) to receive health probes; otherwise, the load balancer will mark the backend as unhealthy and stop forwarding traffic.

Answer

The backend must be configured with Private Google Access.

Answer

The backend must have an SSL certificate installed.

Question 15

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

Accepted Answer

Confirm that the subnet routes for the instance IP ranges are present in the VPC. Option B is correct because for on-premises traffic to reach Compute Engine instances over Dedicated Interconnect, the VPC must have a subnet route (either automatically created or custom static/dynamic route) that matches the instance IP ranges. Without this route, packets from the on-premises network will be dropped by the VPC router, even if the VLAN attachment is reachable.

Answer

Verify that the on-premises network has IAM permissions to access instances

Answer

Ensure that the VLAN attachment IP is in the same subnet as the instances

Answer

Check that BGP sessions are established between Cloud Router and on-premises router

Question 16

A company is planning to connect multiple VPCs in different regions to their on-premises network using a single Dedicated Interconnect. Which TWO configurations are required to achieve this?

Accepted Answer

Create a Cloud Router in each VPC. Option C is correct because each VPC requires its own Cloud Router to establish dynamic routing (BGP) over the Dedicated Interconnect. A Cloud Router is a per-VPC resource that manages BGP sessions and routes for that specific VPC, and since the interconnect is shared, each VPC must have its own router to participate in routing independently.

Answer

Create a single Cloud Router for all VPCs

Answer

Set up Cloud VPN tunnels for regional connectivity

Answer

Use a global VLAN attachment

Question 17

A company has a Hybrid Connectivity setup using Cloud VPN with BGP. They want to migrate to Dedicated Interconnect for better performance. During the migration, they need to avoid downtime. Which THREE steps should they take?

Accepted Answer

Provision the Dedicated Interconnect and VLAN attachments. Option C is correct because provisioning the Dedicated Interconnect and VLAN attachments is the foundational step to establish the new high-performance connection. Without this, there is no physical or logical path to migrate traffic onto. This must be done before any BGP configuration or route manipulation can occur.

Answer

Set a lower local preference on the Interconnect BGP session

Answer

Remove the VPN tunnels immediately after Interconnect is up

Question 18

Which TWO of the following are valid reasons to use a Shared VPC architecture?

Accepted Answer

To prevent individual projects from creating their own VPCs and force them to use a common VPC. Option C is correct because a Shared VPC architecture allows an organization to enforce that individual projects cannot create their own VPCs; instead, they must use a common VPC that is centrally managed. This is achieved by designating a host project that contains the shared VPC network, and attaching service projects to it, which prevents the service projects from having their own independent VPC networks.

Answer

To reduce latency by placing resources in the same region within a single VPC

Answer

To improve network connectivity between different organizational units without using VPN or peering

Answer

To reduce egress costs by having all resources in one VPC

Question 19

Which THREE of the following are required to use Private Google Access for on-premises hosts through a Cloud VPN or Interconnect? (Choose THREE)

Accepted Answer

Firewall rules allowing traffic from on-premises to the restricted VIP IP range.. Private Google Access for on-premises hosts requires firewall rules that allow traffic from on-premises to the restricted VIP IP range (199.36.153.4/30). This is necessary because on-premises hosts must be able to reach the restricted Google APIs VIP over the VPN or Interconnect, and firewall rules control which source IPs can access that VIP. Without these rules, traffic from on-premises would be blocked at the Google Cloud perimeter.

Answer

VPC Flow Logs enabled on the VPC.

Answer

Cloud NAT configured for the on-premises subnet.

Question 20

Which TWO of the following are required steps to set up a Dedicated Interconnect?

Accepted Answer

Create an interconnect (physical connection) in the colocation facility. Creating an interconnect (physical connection) in the colocation facility is a required step because Dedicated Interconnect requires a direct, physical cross-connect between your on-premises router and a Google Cloud edge router at a colocation facility. This physical link is the foundation of the dedicated, high-bandwidth connection, and without it, no Layer 2 or Layer 3 connectivity can be established.

Answer

Establish a VPN tunnel as a backup

Answer

Deploy a Google-provided router in the colocation facility

Answer

Configure MD5 authentication on the BGP session