PCNE Configuring Network Services Practice Test 2 — 15 Questions

Question 1

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if the external service is blocking the Cloud NAT IP addresses.. Cloud NAT uses a set of public IP addresses for outbound traffic. If the external service has firewall rules or access control lists that block these specific IP addresses, the instances will be unable to reach it. Checking for IP-based blocking is a standard first step in troubleshooting connectivity issues through a NAT gateway.

Answer

Ensure that the VPC has a default route to the internet gateway.

Answer

Check the DNS resolution for the external service.

Question 2

A company uses Cloud NAT to allow private instances to reach the internet. They notice that egress traffic from Compute Engine VMs is intermittently failing. The VMs are in us-central1-a and use the default VPC network. Cloud NAT is configured with a single NAT IP address. What is the most likely cause?

Accepted Answer

Port exhaustion due to insufficient NAT IP addresses. Cloud NAT uses source network address translation (SNAT) to map private VM IPs to a public NAT IP. With only a single NAT IP address, the available port range (typically 64,512 ephemeral ports per NAT IP per VM) can be exhausted under high egress traffic, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures and the single IP configuration.

Answer

Missing default route to Internet gateway

Answer

Cloud NAT not configured in the correct region

Answer

Firewall rule blocking egress traffic from VM

Question 3

A large enterprise is migrating to Google Cloud and needs to establish connectivity between on-premises and VPCs in two different regions (us-east1 and europe-west1). They have a single Partner Interconnect connection at a co-location facility in New York. They want to use the same interconnect for both regions. Which configuration should they use?

Accepted Answer

Create two VLAN attachments, one for each region, over the same interconnect. A is correct because a single Partner Interconnect connection can support multiple VLAN attachments, each associated with a different region. By creating two VLAN attachments over the same interconnect—one for us-east1 and one for europe-west1—the enterprise can route traffic from the on-premises network to both VPCs using the same physical link, leveraging Google Cloud's support for multiple VLAN attachments per interconnect.

Answer

Create one VLAN attachment and attach it to both VPCs

Answer

Use HA VPN over the interconnect to connect both regions

Answer

Create two Cloud VPN tunnels from on-prem to each VPC

Question 4

A company is using Cloud DNS for private zone resolution within their VPC. They have a private zone for 'example.internal' and have attached it to the VPC. When they create a new Compute Engine VM and try to resolve 'myapp.example.internal', it fails. What is the most likely cause?

Accepted Answer

The record 'myapp.example.internal' does not exist in the zone. The most likely cause of a resolution failure for a specific record is that the record does not exist in the private zone. The question states the zone is attached to the VPC, so the zone itself is accessible; the failure is specific to the record name. Cloud DNS will return an NXDOMAIN response if the record is not defined, even if the zone is properly configured.

Answer

The private zone is not attached to the VPC

Answer

The VM's /etc/resolv.conf does not point to Cloud DNS

Answer

Firewall rule blocking DNS traffic (UDP 53) to the metadata server

Question 5

You have a Cloud Router with the configuration shown. The on-premises network (ASN 65002) is not receiving any routes from Google Cloud. What is the most likely cause?

Accepted Answer

The router is in custom advertise mode but does not advertise the VPC subnets. When a Cloud Router is configured in custom advertise mode, it only advertises the routes explicitly specified in the custom advertisement list. If the VPC subnets are not included in that list, the on-premises network will not receive any routes from Google Cloud, even if the BGP session is established. This is the most likely cause because the question states the on-premises network is not receiving any routes, which aligns with a missing custom advertisement rather than a session or timer issue.

Answer

The BGP keepalive interval is set too low

Answer

The BGP session is not established

Answer

The on-premises subnet 10.0.1.0/24 is not advertised

Question 6

A company has a VPC with subnets in us-east1 and europe-west1. They have deployed a global external HTTP(S) load balancer with backend services in both regions. Users in Europe report high latency. What is the most likely cause?

Accepted Answer

Session affinity set to CLIENT_IP, causing sticky sessions to a distant backend. CLIENT_IP session affinity causes the load balancer to hash the client's IP address to a specific backend instance. If a user in Europe is hashed to a backend in us-east1, all their requests will be forwarded to that distant region, resulting in high latency. This occurs even though a healthy backend exists in europe-west1, because the affinity overrides the load balancer's normal least-latency or proximity-based routing.

Answer

Incorrect health check configuration causing backends to be marked unhealthy

Answer

Firewall rules blocking traffic from the load balancer's health check probes

Answer

The load balancer is not enabled for global access

Question 7

Which TWO considerations are important when designing a VPC peering strategy between multiple projects in Google Cloud?

Accepted Answer

Subnet IP ranges in peered VPCs must not overlap. VPC peering requires that subnet IP ranges in peered VPCs do not overlap. This is a fundamental constraint of VPC peering in Google Cloud: if two VPCs have overlapping CIDR blocks, routes cannot be exchanged unambiguously, and the peering connection will fail to establish or will cause routing conflicts. Overlapping ranges would break the ability to route traffic correctly between the VPCs, as there would be no way to determine which subnet a packet should be delivered to.

Answer

Peering is transitive by default

Answer

Firewall rules in one VPC automatically apply to peered VPCs

Answer

VPC peering can only be used within the same project

Question 8

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

Accepted Answer

Use Cloud NAT to allow outbound internet access without public IPs. Cloud NAT enables outbound internet access for private VMs without assigning them public IP addresses, which reduces the attack surface. This is a secure alternative to direct internet access because it allows outbound connections initiated by the VMs while blocking unsolicited inbound traffic from the internet. It works by translating private IP addresses to a set of ephemeral public IPs managed by Google Cloud.

Answer

Assign public IP addresses to all VMs for direct internet access

Answer

Enable VPC Flow Logs to block malicious traffic

Question 9

A company has a VPC with multiple subnets. They want to restrict traffic between two specific subnets (10.0.1.0/24 and 10.0.2.0/24) while allowing all other traffic. They create a firewall rule with priority 1000 denying ingress from 10.0.1.0/24 to 10.0.2.0/24. However, traffic is still allowed. What is the most likely reason?

Accepted Answer

There is a higher priority allow rule that matches the traffic. In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence. A rule with priority 1000 is evaluated after any rule with a priority lower than 1000 (e.g., priority 65535 is the default allow rule). If a higher priority (lower number) allow rule exists that matches the same traffic, it will override the deny rule. The default VPC firewall rules include an implicit allow rule for egress and an ingress allow rule for traffic within the same VPC, which may have a higher priority than 1000, thus permitting the traffic despite the deny rule.

Answer

The rule is incorrectly applied to the wrong network tag

Answer

The traffic is going through the metadata server

Answer

Firewall rules are stateless, so return traffic is blocked

Question 10

Your company runs a multi-tier web application on Google Cloud. The frontend is in us-central1 (3 instances behind an external HTTP(S) Load Balancer), the backend is in us-west1 (3 instances behind an internal TCP/UDP Load Balancer). The frontend instances are in a managed instance group (MIG) with autoscaling based on CPU utilization. Recently, you noticed that during traffic spikes, the frontend instances' CPU utilization remains low, but the backend instances' CPU utilization spikes to 90% and causes timeouts. The application uses a synchronous REST API; the frontend instances make requests to the internal load balancer's IP. What should you do to resolve the backend scaling issue?

Accepted Answer

Replace the internal TCP/UDP load balancer with an internal HTTP(S) load balancer and configure the backend MIG to autoscale based on the load balancing serving capacity or request count.. The internal TCP/UDP load balancer cannot provide request-level metrics (like requests per second) for autoscaling, as it operates at layer 4. Replacing it with an internal HTTP(S) load balancer (layer 7) allows the backend MIG to autoscale based on the load balancing serving capacity or request count, which directly correlates with the frontend's synchronous REST API calls. This resolves the backend CPU spike issue by scaling the backend instances before they become overloaded, rather than relying on CPU utilization which lags behind traffic spikes.

Answer

Create a backend service with the backend MIG and attach it to the internal TCP/UDP load balancer, enabling connection draining.

Answer

Configure the internal TCP/UDP load balancer with a health check that monitors CPU utilization and adjust the autoscaling metric of the backend MIG accordingly.

Answer

Enable Cloud Armor on the external load balancer to rate-limit requests and prevent backend overload.

Question 11

Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.. Since the VM can ping the on-premises gateway (192.168.1.1) but not the server (192.168.1.100), the VPN tunnel and BGP session are working, and GCP has the correct route. The issue is that the on-premises router is not advertising or does not have a route for the GCP subnet 10.0.1.0/24 pointing back to the VPN tunnel, so return traffic from the server to the VM is dropped. Without this route, the on-premises router cannot forward packets destined for 10.0.1.10 back through the VPN.

Answer

The on-premises server is not configured with a default gateway pointing to the on-premises gateway.

Answer

The Cloud VPN tunnel is not configured with an IKE version supported by the on-premises device.

Answer

A firewall rule on the GCP VPC is blocking ICMP traffic from 192.168.1.100.

Question 12

A company is deploying a global application on Google Cloud using Cloud Load Balancing. They want to serve traffic from multiple regions and require the lowest possible latency for users worldwide. The application serves HTTP traffic and uses a static IP address. Which load balancing solution should they use?

Accepted Answer

External HTTP(S) Load Balancer with Premium Tier. The External HTTP(S) Load Balancer with Premium Tier is correct because it uses Google's global anycast IP address to route user traffic to the nearest frontend, minimizing latency worldwide. Premium Tier leverages Google's global network backbone, ensuring traffic enters and exits at the closest Google edge point of presence (PoP) for HTTP(S) traffic, which is essential for a global application requiring low latency and a static IP.

Answer

Network Load Balancer

Answer

Internal HTTP(S) Load Balancer

Answer

SSL Proxy Load Balancer

Question 13

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

Accepted Answer

Check Cloud NAT logs for port exhaustion. Cloud NAT logs can reveal port exhaustion, which occurs when the NAT gateway runs out of available source ports for connections. Since all instances share the same NAT IP addresses, high connection counts from some instances can exhaust ports, preventing others from establishing new outbound connections. Checking these logs helps identify whether port exhaustion is the root cause of the connectivity issue.

Answer

Ensure Cloud NAT is enabled in each zone where instances are located

Answer

Verify that the instances have external IP addresses assigned

Answer

Review the health check configuration for the NAT gateway

Question 14

An engineer creates a Cloud NAT configuration as shown in the exhibit. The test-instance is created without an external IP address. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The subnet subnet-a is in a region different from us-central1. Cloud NAT is a regional resource that applies to all instances within a given region. The exhibit shows subnet-a is in a different region than us-central1, so the NAT gateway cannot route traffic from instances in that subnet. Even though the instance is in us-central1, the subnet's region mismatch means the NAT configuration does not apply, leaving the instance without internet access.

Answer

The Cloud Router is not in the same zone as the instance

Answer

A firewall rule is blocking outbound traffic from the instance

Answer

Logging is enabled but not configured to send logs to Cloud Logging

Question 15

Drag and drop the steps to set up a Google Cloud Armor security policy for a backend service into the correct order.

Accepted Answer

Step 1: Create a Cloud Armor security policy. Step 2: Set the default action. Step 3: Add security rules. Step 4: Attach the policy to a backend service.. Security policy creation involves defining rules, setting default action, and attaching to a backend service. Testing ensures correct enforcement.

Answer

Step 1: Create a Cloud Armor security policy. Step 2: Add security rules. Step 3: Set the default action. Step 4: Attach the policy to a backend service.

Answer

Step 1: Add security rules. Step 2: Create a Cloud Armor security policy. Step 3: Set the default action. Step 4: Attach the policy to a backend service.

Answer

Step 1: Create a Cloud Armor security policy. Step 2: Set the default action. Step 3: Attach the policy to a backend service. Step 4: Add security rules.