PCNE Configuring Network Services Practice Test 3 — 15 Questions

Question 1

Drag and drop the steps to set up a Cloud Interconnect connection for dedicated on-premises connectivity into the correct order.

Accepted Answer

1. Order Cloud Interconnect, 2. Create VLAN attachment, 3. Complete cross-connect, 4. Configure BGP session, 5. Verify connectivity. Cloud Interconnect requires ordering, VLAN attachment, cross-connect, BGP, and verification.

Answer

1. Create VLAN attachment, 2. Order Cloud Interconnect, 3. Complete cross-connect, 4. Configure BGP session, 5. Verify connectivity

Answer

1. Order Cloud Interconnect, 2. Complete cross-connect, 3. Create VLAN attachment, 4. Configure BGP session, 5. Verify connectivity

Answer

1. Order Cloud Interconnect, 2. Configure BGP session, 3. Create VLAN attachment, 4. Complete cross-connect, 5. Verify connectivity

Question 2

Match each Cloud Load Balancing type to its description.

Accepted Answer

External HTTP(S) Load Balancer: Distributes traffic from the internet to backend instances, supports HTTP/HTTPS protocols, can be global or regional.. The correct matches are: External HTTP(S) Load Balancer handles internet HTTP/HTTPS traffic; Internal TCP/UDP Load Balancer handles internal TCP/UDP traffic. Common confusions include mixing external/internal roles and protocol support.

Answer

External HTTP(S) Load Balancer: Distributes traffic from internal clients to backend instances, supports TCP/UDP protocols, regional.

Answer

Internal TCP/UDP Load Balancer: Distributes traffic from the internet to backend instances, supports HTTP/HTTPS protocols, global or regional.

Answer

External TCP/UDP Load Balancer: Terminates SSL and forwards to backend instances.

Question 3

Match each network pricing model to its description.

Accepted Answer

Egress pricing: Charges for data leaving Google Cloud to the internet. Correct matches: Egress charges for outbound data; Ingress is free; Cloud Interconnect charges by bandwidth; VPN charges hourly plus egress. Common confusions include swapping egress/ingress definitions and confusing Interconnect with VPN.

Answer

Egress pricing: No charge for data leaving Google Cloud

Answer

Cloud Interconnect pricing: Charges include hourly tunnel fee

Question 4

A company wants to securely connect an on-premises data center to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) that overlap with the VPC subnet (10.0.1.0/24). They need connectivity to specific workloads in the VPC without changing IP addresses on premises. What should they do?

Accepted Answer

Deploy Private Service Connect to expose the VPC workloads as endpoints accessible from on-premises.. Private Service Connect (PSC) allows on-premises clients to access specific VPC workloads via internal IP addresses (RFC 1918) without requiring VPC peering or VPN. PSC publishes the workloads as endpoints reachable through a Private Service Connect endpoint in the on-premises network, avoiding IP overlap by using a separate IP address range for the endpoint. This solution meets the requirement of not changing on-premises IPs while providing secure, targeted connectivity.

Answer

Use VPC Network Peering with a custom route exchange to filter the overlapping range.

Answer

Set up Dedicated Interconnect and configure BGP with the on-premises router, advertising a more specific prefix.

Answer

Use Cloud NAT and configure a firewall rule to allow traffic from the on-premises network.

Question 5

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Accepted Answer

Use a global external HTTP(S) load balancer with an anycast IP and enable Cloud CDN.. A global external HTTP(S) load balancer uses a single anycast IP address, which directs each user to the closest healthy backend based on the user's geographic location and backend health. Enabling Cloud CDN further reduces latency by caching content at Google's global edge locations, ensuring that static and dynamic content is served from the nearest point of presence.

Answer

Deploy a regional external HTTP(S) load balancer in each region and use Cloud CDN to cache content.

Answer

Configure an internal TCP/UDP load balancer in each region with DNS-based geolocation routing.

Answer

Set up a global external TCP proxy load balancer with SSL termination at each backend.

Question 6

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

Accepted Answer

Reserve a static internal IP address in the same region and subnetwork.. A static internal IP address is reserved within a specific region and subnetwork, ensuring the IP persists even after the VM is stopped or deleted. This meets the requirement for a fixed internal address that remains available for reassignment to the same or a different VM in the same subnet. Ephemeral IPs are released on VM stop/delete, and external IPs are not relevant for internal-only communication.

Answer

Configure an alias IP range on the VM's network interface.

Answer

Assign an ephemeral external IP and configure a firewall rule.

Answer

Use a regional internal IP address with auto-delete set to false.

Question 7

A financial services company needs to audit all VPC firewall rule changes in real time. They want to receive notifications whenever a rule is created, modified, or deleted. What is the most efficient way to achieve this?

Accepted Answer

Use Cloud Logging with a filter on firewall rule updates and create a logs-based metric with an alert.. Cloud Logging can capture Admin Activity audit logs for firewall rule changes, and a logs-based metric with an alert provides real-time notifications. Option A is incorrect because VPC Flow Logs capture network traffic, not firewall rule changes. Option C is incorrect because VPC Firewall Rules Logging logs traffic hits, not rule configuration changes. Option D is incorrect because storing Cloud Audit Logs in a bucket requires manual or periodic checking, which is not real-time.

Answer

Enable VPC Flow Logs and export them to BigQuery for analysis.

Answer

Enable VPC Firewall Rules Logging and send logs to Pub/Sub with a Cloud Function trigger.

Answer

Store Cloud Audit Logs in a Cloud Storage bucket and periodically check for changes.

Question 8

A company uses Cloud NAT to allow private VMs to access the internet. They notice that some VMs are unable to reach a specific set of external IP addresses, but other VMs can. The firewall rules are correctly configured. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway uses a static IP address that is not allowed by the external service's firewall.. Cloud NAT uses a source IP address (either a static IP you assign or an ephemeral IP from the NAT gateway's IP range) when translating outbound traffic from private VMs. If the external service's firewall only allows traffic from specific IP addresses, and the Cloud NAT gateway is using a static IP that is not on that allowlist, the affected VMs' traffic will be blocked. Other VMs might reach the service if they use a different NAT gateway or if the service's firewall permits their translated IP.

Answer

The default route (0.0.0.0/0) is missing for the VPC.

Answer

The VPC firewall rules have a deny rule for the source IP range of the affected VMs.

Answer

The VMs have a tag that overrides the Cloud NAT routing.

Question 9

A company wants to connect two VPCs in the same project using VPC Network Peering. Each VPC has non-overlapping subnets. What is the minimum number of peering connections required to enable full bidirectional communication?

Accepted Answer

Two peering connections: one from VPC1 to VPC2, and one from VPC2 to VPC1.. VPC Network Peering requires a peering connection to be established in each direction to enable full bidirectional communication. A single peering connection from VPC1 to VPC2 only allows VPC1 to initiate traffic to VPC2; for VPC2 to initiate traffic back to VPC1, a separate peering connection from VPC2 to VPC1 is needed. Therefore, two peering connections (one from each VPC to the other) are the minimum required.

Answer

One peering connection from VPC1 to VPC2.

Answer

Two peering connections from each VPC to the other (total four).

Answer

A Shared VPC with subnetworks from both VPCs.

Question 10

A DevOps team is configuring a VPC with a subnet in us-east1. They need to allow a specific VM (source IP 10.0.1.2) to access a database VM (destination IP 10.0.2.3) on port 3306, but only from that specific source. All other traffic should be denied. Which firewall rule configuration should they use?

Accepted Answer

Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol tcp:3306, target tags = db, and assign the 'db' tag to the database VM.. It creates an ingress firewall rule with the highest priority (1000 is the default for custom rules) that explicitly allows TCP traffic on port 3306 from source IP 10.0.1.2/32 to any VM tagged with 'db'. By assigning the 'db' tag to the database VM, the rule applies only to that target, and since VPC firewall rules are stateful, the corresponding return traffic is automatically allowed. All other traffic is denied by the implied deny-all rule (priority 65535), meeting the requirement.

Answer

Create an egress rule on the source VM's network interface allowing traffic to 10.0.2.3/32 on port 3306.

Answer

Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol all, target service account = db-sa.

Answer

Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol tcp:3306, target 10.0.2.3/32.

Question 11

A company has a VPC with multiple subnets and uses Cloud VPN tunnels to connect to on-premises. They want to ensure that only traffic destined for on-premises is sent through the VPN tunnels; all other traffic should use the internet. Which route configuration should they implement?

Accepted Answer

Use Cloud Router with BGP to exchange specific routes with on-premises, and keep the default internet route for other traffic.. Using Cloud Router with BGP allows the VPC to dynamically learn specific routes from the on-premises network via the VPN tunnels. The default route (0.0.0.0/0) remains pointing to the internet gateway, so only traffic destined for the learned on-premises prefixes is sent through the VPN, while all other traffic uses the internet. This provides precise control without overriding the default route.

Answer

Add a static route for 0.0.0.0/0 with next hop VPN gateway, and set a lower priority than the internet default route.

Answer

Configure the Cloud VPN to advertise a default route to on-premises, and rely on local preference.

Answer

Use VPC Network Peering with the on-premises network and configure custom route exchange.

Question 12

A startup is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose a service to the internet using a load balancer that provides SSL termination and supports WebSocket. Which type of Service should they use?

Accepted Answer

Create a Service of type LoadBalancer with an HTTP(S) load balancer.. A Service of type LoadBalancer with an HTTP(S) load balancer is correct because it provides a public IP address, handles SSL termination at the load balancer level, and natively supports WebSocket connections without additional configuration. This is the simplest and most direct way to expose a microservice to the internet with these requirements on GKE.

Answer

Create a Service of type ClusterIP and use an Ingress resource with a backendConfig.

Answer

Create a Service of type NodePort and configure an external TCP/UDP load balancer.

Answer

Create a Headless Service with an external DNS A record pointing to the pod IPs.

Question 13

Which TWO network services are required to enable private Google access for on-premises hosts using a Dedicated Interconnect connection? (Choose two.)

Accepted Answer

Cloud Router with BGP. Cloud Router with BGP is required because Dedicated Interconnect uses BGP sessions between the on-premises router and Google's edge router to exchange routes. Without BGP, the on-premises network cannot advertise or receive the routes necessary for private Google access, such as the 199.36.153.4/30 or 199.36.153.8/30 ranges used for Private Google Access for on-premises.

Answer

Cloud NAT

Answer

VPC Flow Logs

Answer

Cloud VPN

Question 14

Which TWO network services can be used to provide secure connectivity between a VPC and an on-premises data center without traversing the public internet? (Choose two.)

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (C) provides a direct, private physical connection between your on-premises network and Google's VPC, bypassing the public internet entirely. This ensures low latency, high bandwidth, and consistent network performance for secure hybrid cloud connectivity.

Answer

Cloud VPN with IPsec

Answer

Cloud NAT

Answer

VPC Network Peering

Question 15

Refer to the exhibit. A VM with the 'ssh-allowed' tag is unreachable via SSH from the internet, while other VMs with the same tag work. What is the most likely cause?

Accepted Answer

A firewall rule with priority 500 denies ingress traffic to the VM's tag or IP range.. The most likely cause is that a firewall rule with priority 500 explicitly denies ingress traffic to the specific VM's tag or IP range, overriding the allow-ssh rule (which has a lower priority, i.e., a higher numerical value). In Google Cloud Platform (GCP), firewall rules are evaluated from lowest to highest priority number, and a deny rule with a lower priority number (e.g., 500) takes precedence over an allow rule with a higher priority number (e.g., 1000). This explains why other VMs with the same 'ssh-allowed' tag remain reachable, as they are not affected by the specific deny rule.

Answer

The rule source range is set to 0.0.0.0/0, which includes all internet IPs, so it should allow SSH.

Answer

The VM is in a different VPC that does not have the allow-ssh rule.

Answer

The firewall rule 'allow-ssh' has a higher priority (1000) than the implicit deny (65535), so it should work.