PCNE Configuring network services Practice Test 4 — 15 Questions

Question 1

A company is migrating an on-premises DNS service to Cloud DNS. They want to resolve on-premises hostnames from GCP VMs and resolve Google Cloud private zone names from on-premises. They have a Cloud VPN with BGP. Which architecture should they implement?

Accepted Answer

Configure a Cloud DNS forwarding zone for on-premises names and a private zone for GCP names. Then create an inbound server policy for on-premises to query Cloud DNS.. Option A is correct because Cloud DNS supports inbound server policies that allow on-premises DNS resolvers to forward queries for private zone names (e.g., `gcp.internal`) to Cloud DNS via the Cloud VPN. A forwarding zone in the VPC directs queries for on-premises hostnames (e.g., `corp.example.com`) to the on-premises DNS servers. This bidirectional resolution is achieved without exposing DNS to the internet, leveraging BGP for routing.

Answer

Configure a split-horizon DNS with separate DNS servers for each environment.

Answer

Set up Cloud DNS peering zones between the VPC and on-premises.

Answer

Use DNS over HTTPS from on-premises to Google's public DNS.

Question 2

A network engineer notices unusual traffic patterns from a VM. They want to capture detailed information about each packet sent and received by the VM, including source and destination IPs, protocols, and ports. Which feature should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IPs, protocols, and ports. This feature is designed specifically for analyzing traffic patterns and troubleshooting connectivity issues at the network layer, making it the correct choice for the described requirement.

Answer

Packet Mirroring

Answer

Cloud Audit Logs

Answer

Firewall Rules Logging

Question 3

A company uses Cloud CDN with an external HTTP(S) load balancer. They have two origin server groups: a primary in us-central1 and a backup in europe-west1. They want traffic directed to the primary unless it is unhealthy, in which case traffic should fail over to the backup. Which configuration is required?

Accepted Answer

Create a backend service with two backends (primary and failover) and a failover policy that marks the primary as failover when unhealthy.. Option D is correct because Cloud CDN with an external HTTP(S) load balancer uses a backend service that can contain multiple backends (e.g., instance groups or NEGs) with a failover policy. When the primary backend is marked as unhealthy by the health check, the load balancer automatically routes traffic to the failover backend. This configuration meets the requirement without manual intervention.

Answer

Create a Cloud CDN with two origins and enable failover in the CDN settings.

Answer

Use a TCP/UDP network load balancer with two target pools.

Answer

Configure a weighted round-robin with primary weight 100 and backup weight 0, and change weights manually.

Question 4

Which TWO are best practices for securing a VPC network? (Choose 2.)

Accepted Answer

Use firewall rules to restrict ingress traffic to only necessary ports and IPs.. Option D is correct because firewall rules are the primary mechanism for controlling ingress traffic in a VPC. By restricting traffic to only necessary ports and source IPs, you minimize the attack surface and enforce the principle of least privilege. This is a fundamental security best practice for network segmentation and access control.

Answer

Use VPC Network Peering to connect to other projects.

Answer

Create a VPC with default firewall rules.

Answer

Enable Private Google Access on all subnets.

Question 5

Which THREE factors should be considered when choosing between a global external HTTP(S) load balancer and a regional external HTTP(S) load balancer? (Choose 3.)

Accepted Answer

SSL termination at the edge (global) vs. at the backend (regional).. Regional external HTTP(S) load balancers terminate SSL at the backend (the backend service or instance), meaning the encrypted traffic must travel to the backend before decryption. Global external HTTP(S) load balancers terminate SSL at the edge (Google Front End), decrypting traffic at the closest point of presence and forwarding plaintext HTTP to the backend. This architectural difference impacts security, latency, and backend processing requirements, making it a key factor in choosing between the two.

Answer

Support for multiple backend types (Compute Engine, GKE, serverless).

Answer

Ability to use health checks.

Question 6

Which TWO steps are required to set up a Cloud VPN with dynamic routing (BGP)? (Choose 2.)

Accepted Answer

Create a VPN gateway and a VPN tunnel.. Option C is correct because a Cloud VPN requires both a VPN gateway (the GCP-side endpoint for encrypted traffic) and a VPN tunnel (the actual IPSec tunnel configuration that defines the remote peer IP, shared secret, and IKE parameters). Option E is correct because dynamic routing with BGP mandates a Cloud Router in the same region as the VPN gateway to exchange BGP routes with the on-premises router; the Cloud Router advertises the VPC subnets and learns remote prefixes via BGP sessions over the tunnel.

Answer

Configure a static route for the remote network.

Answer

Create a Cloud NAT for outbound access.

Answer

Create firewall rules to allow traffic from the remote network.

Question 7

A company is running workloads on Compute Engine instances without public IP addresses. They need to allow these instances to securely access the internet for software updates. Which Google Cloud service should be configured?

Accepted Answer

Cloud NAT. Cloud NAT (Network Address Translation) allows Compute Engine instances without public IP addresses to initiate outbound connections to the internet for tasks like software updates. It translates the private IP addresses of the instances to a public IP address managed by Google Cloud, enabling secure outbound internet access without exposing the instances to inbound traffic.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering

Question 8

A company is deploying an internal HTTP application on Compute Engine instances. The application must be load-balanced across multiple instances in different regions, but only accessible from within the same VPC. Which load balancer type meets these requirements?

Accepted Answer

Internal HTTP(S) Load Balancer. An Internal HTTP(S) Load Balancer is a regional, internal-only load balancer that distributes HTTP/HTTPS traffic among Compute Engine instances within the same VPC network. It uses an internal IP address and is not accessible from outside the VPC, meeting the requirement for internal-only access while providing cross-region load balancing via a multi-region backend service.

Answer

External TCP/UDP Load Balancer

Answer

External HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 9

An organization has a Dedicated Interconnect with Cloud Router configured for BGP. The on-premises network advertises a prefix that overlaps with an existing VPC subnet. How does Google Cloud handle the overlapping prefix?

Accepted Answer

It rejects the prefix and does not install a dynamic route for it.. When a Dedicated Interconnect with Cloud Router receives a BGP advertisement for a prefix that overlaps with an existing VPC subnet, Google Cloud rejects the prefix and does not install a dynamic route for it. This is because VPC subnet routes always take precedence over dynamically learned routes, and accepting an overlapping prefix would create ambiguity in forwarding decisions. The Cloud Router enforces this behavior to maintain the integrity of the VPC's internal addressing.

Answer

It accepts the prefix but static routes have higher priority.

Answer

It accepts the prefix and gives it higher priority than the VPC subnet.

Answer

It accepts the prefix and load balances traffic between the two locations.

Question 10

A company wants to forward DNS queries from their on-premises network to Google Cloud for resolution of private zone names. Which configuration is required?

Accepted Answer

DNS inbound server policy. Option B is correct because a DNS inbound server policy allows an on-premises DNS resolver to forward queries to Google Cloud, enabling resolution of private zone names. This policy creates a forwarding path from on-premises to Cloud DNS using a specific inbound endpoint, which is required for hybrid cloud DNS resolution.

Answer

DNS peering

Answer

DNS forwarding zone

Answer

Managed private zone

Question 11

A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?

Accepted Answer

Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'. Option D is correct because it defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.

Answer

Ingress rule: allow tcp:3306, source IP range 10.0.0.0/8, target tags 'db'

Answer

Ingress rule: allow tcp:3306, source tags 'web', target service account 'db-sa'

Answer

Egress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'

Question 12

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

Accepted Answer

Configure Cloud Router in the host project to advertise all subnets via BGP.. Option C is correct because in a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Answer

Configure Cloud NAT in each service project for on-prem access.

Answer

Use VPC peering between the host project and each service project.

Answer

Create separate Interconnect VLAN attachments for each service project.

Question 13

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

Accepted Answer

It reduces latency by serving content from edge locations.. Cloud CDN caches content at Google's global edge locations, which are geographically closer to end users. By serving static content from these edge caches instead of the origin HTTP load balancer, the request latency is significantly reduced because the data travels a shorter distance over the network.

Answer

It eliminates the need for SSL certificates.

Answer

It provides DDoS protection only.

Answer

It increases compute instance capacity.

Question 14

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

Accepted Answer

Pre-configured WAF rules. Pre-configured WAF rules in Cloud Armor include a SQL injection (SQLi) rule that inspects HTTP(S) request bodies, headers, and URIs for SQL injection patterns. This rule uses a set of signatures to detect and block malicious SQL queries, directly addressing the requirement to protect against SQL injection attacks on an external HTTP(S) load balancer.

Answer

IP allowlist/denylist

Answer

Named IP address lists

Answer

Rate limiting

Question 15

A company has Compute Engine instances in a VPC that only have internal IP addresses. They need to access Google Cloud services like Cloud Storage and BigQuery. They also have on-premises servers that need to access the same instances via a Cloud VPN tunnel. What must be enabled for the instances to access Google APIs without public IPs?

Accepted Answer

Private Google Access. Private Google Access enables Compute Engine instances that have only internal IP addresses (no external IPs) to reach Google APIs and services such as Cloud Storage and BigQuery. It works by routing traffic destined for Google API IP ranges through the default internet gateway, using the VPC's internal DNS resolution to map the API hostnames to Google's internal IP addresses, without requiring a public IP on the instance.

Answer

Cloud Router

Answer

VPC peering

Answer

Cloud NAT