PCNE Configuring network services Practice Test 2 — 15 Questions

Question 1

Your company runs a multi-tier web application on Google Cloud. The frontend is in us-central1 (3 instances behind an external HTTP(S) Load Balancer), the backend is in us-west1 (3 instances behind an internal TCP/UDP Load Balancer). The frontend instances are in a managed instance group (MIG) with autoscaling based on CPU utilization. Recently, you noticed that during traffic spikes, the frontend instances' CPU utilization remains low, but the backend instances' CPU utilization spikes to 90% and causes timeouts. The application uses a synchronous REST API; the frontend instances make requests to the internal load balancer's IP. What should you do to resolve the backend scaling issue?

Accepted Answer

Replace the internal TCP/UDP load balancer with an internal HTTP(S) load balancer and configure the backend MIG to autoscale based on the load balancing serving capacity or request count.. Option C is correct because the internal TCP/UDP load balancer cannot provide request-level metrics (like requests per second) for autoscaling, as it operates at layer 4. Replacing it with an internal HTTP(S) load balancer (layer 7) allows the backend MIG to autoscale based on the load balancing serving capacity or request count, which directly correlates with the frontend's synchronous REST API calls. This resolves the backend CPU spike issue by scaling the backend instances before they become overloaded, rather than relying on CPU utilization which lags behind traffic spikes.

Answer

Create a backend service with the backend MIG and attach it to the internal TCP/UDP load balancer, enabling connection draining.

Answer

Configure the internal TCP/UDP load balancer with a health check that monitors CPU utilization and adjust the autoscaling metric of the backend MIG accordingly.

Answer

Enable Cloud Armor on the external load balancer to rate-limit requests and prevent backend overload.

Question 2

Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.. The correct answer is A. Since the VM can ping the on-premises gateway (192.168.1.1) but not the server (192.168.1.100), the VPN tunnel and BGP session are working, and GCP has the correct route. The issue is that the on-premises router is not advertising or does not have a route for the GCP subnet 10.0.1.0/24 pointing back to the VPN tunnel, so return traffic from the server to the VM is dropped. Without this route, the on-premises router cannot forward packets destined for 10.0.1.10 back through the VPN.

Answer

The on-premises server is not configured with a default gateway pointing to the on-premises gateway.

Answer

The Cloud VPN tunnel is not configured with an IKE version supported by the on-premises device.

Answer

A firewall rule on the GCP VPC is blocking ICMP traffic from 192.168.1.100.

Question 3

A company is deploying a global application on Google Cloud using Cloud Load Balancing. They want to serve traffic from multiple regions and require the lowest possible latency for users worldwide. The application serves HTTP traffic and uses a static IP address. Which load balancing solution should they use?

Accepted Answer

External HTTP(S) Load Balancer with Premium Tier. The External HTTP(S) Load Balancer with Premium Tier is correct because it uses Google's global anycast IP address to route user traffic to the nearest frontend, minimizing latency worldwide. Premium Tier leverages Google's global network backbone, ensuring traffic enters and exits at the closest Google edge point of presence (PoP) for HTTP(S) traffic, which is essential for a global application requiring low latency and a static IP.

Answer

Network Load Balancer

Answer

Internal HTTP(S) Load Balancer

Answer

SSL Proxy Load Balancer

Question 4

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

Accepted Answer

Check Cloud NAT logs for port exhaustion. Option B is correct because Cloud NAT logs can reveal port exhaustion, which occurs when the NAT gateway runs out of available source ports for connections. Since all instances share the same NAT IP addresses, high connection counts from some instances can exhaust ports, preventing others from establishing new outbound connections. Checking these logs helps identify whether port exhaustion is the root cause of the connectivity issue.

Answer

Ensure Cloud NAT is enabled in each zone where instances are located

Answer

Verify that the instances have external IP addresses assigned

Answer

Review the health check configuration for the NAT gateway

Question 5

An engineer creates a Cloud NAT configuration as shown in the exhibit. The test-instance is created without an external IP address. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The subnet subnet-a is in a region different from us-central1. Option A is correct because Cloud NAT is a regional resource that applies to all instances within a given region. The exhibit shows subnet-a is in a different region than us-central1, so the NAT gateway cannot route traffic from instances in that subnet. Even though the instance is in us-central1, the subnet's region mismatch means the NAT configuration does not apply, leaving the instance without internet access.

Answer

The Cloud Router is not in the same zone as the instance

Answer

A firewall rule is blocking outbound traffic from the instance

Answer

Logging is enabled but not configured to send logs to Cloud Logging

Question 6

Drag and drop the steps to set up a Google Cloud Armor security policy for a backend service into the correct order.

Question 7

Drag and drop the steps to set up a Cloud Interconnect connection for dedicated on-premises connectivity into the correct order.

Question 8

Match each Cloud Load Balancing type to its description.

Question 9

Match each network pricing model to its description.

Question 10

A company wants to securely connect an on-premises data center to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) that overlap with the VPC subnet (10.0.1.0/24). They need connectivity to specific workloads in the VPC without changing IP addresses on premises. What should they do?

Accepted Answer

Deploy Private Service Connect to expose the VPC workloads as endpoints accessible from on-premises.. Private Service Connect (PSC) allows on-premises clients to access specific VPC workloads via internal IP addresses (RFC 1918) without requiring VPC peering or VPN. PSC publishes the workloads as endpoints reachable through a Private Service Connect endpoint in the on-premises network, avoiding IP overlap by using a separate IP address range for the endpoint. This solution meets the requirement of not changing on-premises IPs while providing secure, targeted connectivity.

Answer

Use VPC Network Peering with a custom route exchange to filter the overlapping range.

Answer

Set up Dedicated Interconnect and configure BGP with the on-premises router, advertising a more specific prefix.

Answer

Use Cloud NAT and configure a firewall rule to allow traffic from the on-premises network.

Question 11

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Accepted Answer

Use a global external HTTP(S) load balancer with an anycast IP and enable Cloud CDN.. A global external HTTP(S) load balancer uses a single anycast IP address, which directs each user to the closest healthy backend based on the user's geographic location and backend health. Enabling Cloud CDN further reduces latency by caching content at Google's global edge locations, ensuring that static and dynamic content is served from the nearest point of presence.

Answer

Deploy a regional external HTTP(S) load balancer in each region and use Cloud CDN to cache content.

Answer

Configure an internal TCP/UDP load balancer in each region with DNS-based geolocation routing.

Answer

Set up a global external TCP proxy load balancer with SSL termination at each backend.

Question 12

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

Accepted Answer

Reserve a static internal IP address in the same region and subnetwork.. A static internal IP address is reserved within a specific region and subnetwork, ensuring the IP persists even after the VM is stopped or deleted. This meets the requirement for a fixed internal address that remains available for reassignment to the same or a different VM in the same subnet. Ephemeral IPs are released on VM stop/delete, and external IPs are not relevant for internal-only communication.

Answer

Configure an alias IP range on the VM's network interface.

Answer

Assign an ephemeral external IP and configure a firewall rule.

Answer

Use a regional internal IP address with auto-delete set to false.

Question 13

A financial services company needs to audit all VPC firewall rule changes in real time. They want to receive notifications whenever a rule is created, modified, or deleted. What is the most efficient way to achieve this?

Accepted Answer

Use Cloud Logging with a filter on firewall rule updates and create a logs-based metric with an alert.. Option D is correct because VPC Firewall Rules Logging with a sink to Pub/Sub can filter change events. Option A is wrong because export to BigQuery is for batch analysis. Option B is wrong because Stackdriver (Cloud Logging) by itself doesn't create alerts easily; Option C is wrong because Cloud Audit Logs track changes but require additional setup to send alerts.

Answer

Enable VPC Flow Logs and export them to BigQuery for analysis.

Answer

Enable VPC Firewall Rules Logging and send logs to Pub/Sub with a Cloud Function trigger.

Answer

Store Cloud Audit Logs in a Cloud Storage bucket and periodically check for changes.

Question 14

A company uses Cloud NAT to allow private VMs to access the internet. They notice that some VMs are unable to reach a specific set of external IP addresses, but other VMs can. The firewall rules are correctly configured. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway uses a static IP address that is not allowed by the external service's firewall.. Cloud NAT uses a source IP address (either a static IP you assign or an ephemeral IP from the NAT gateway's IP range) when translating outbound traffic from private VMs. If the external service's firewall only allows traffic from specific IP addresses, and the Cloud NAT gateway is using a static IP that is not on that allowlist, the affected VMs' traffic will be blocked. Other VMs might reach the service if they use a different NAT gateway or if the service's firewall permits their translated IP.

Answer

The default route (0.0.0.0/0) is missing for the VPC.

Answer

The VPC firewall rules have a deny rule for the source IP range of the affected VMs.

Answer

The VMs have a tag that overrides the Cloud NAT routing.

Question 15

A company wants to connect two VPCs in the same project using VPC Network Peering. Each VPC has non-overlapping subnets. What is the minimum number of peering connections required to enable full bidirectional communication?

Accepted Answer

Two peering connections: one from VPC1 to VPC2, and one from VPC2 to VPC1.. VPC Network Peering requires a peering connection to be established in each direction to enable full bidirectional communication. A single peering connection from VPC1 to VPC2 only allows VPC1 to initiate traffic to VPC2; for VPC2 to initiate traffic back to VPC1, a separate peering connection from VPC2 to VPC1 is needed. Therefore, two peering connections (one from each VPC to the other) are the minimum required.

Answer

One peering connection from VPC1 to VPC2.

Answer

Two peering connections from each VPC to the other (total four).

Answer

A Shared VPC with subnetworks from both VPCs.