PCNE Configuring Network Services Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. The Cloud Router is configured with custom BGP advertisements. The on-premises router receives only the two advertised ranges (10.1.0.0/24 and 10.2.0.0/24) but not the VPC subnets (e.g., 10.3.0.0/24). What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises router is filtering routes based on the BGP community or AS path.. Cloud Router custom advertisements can include BGP communities or AS-path attributes that the on-premises router may be filtering. If the on-premises router is configured to reject routes based on these attributes (e.g., only accepting routes with a specific community or AS-path length), it would drop the VPC subnet routes even if they are advertised. The scenario states that only the two explicitly advertised ranges are received, indicating a filtering mechanism on the on-premises side rather than a Cloud Router misconfiguration.

Answer

The on-premises router is configured to accept only prefixes longer than /24.

Answer

The advertised route priority of 100 is too high, causing the routes to be ignored.

Answer

The Cloud Router's custom advertisement includes both the ALL_SUBNETS group and the explicit ranges, so all subnets should be advertised.

Question 2

Refer to the exhibit. A VM in 'subnet-a' can access Google APIs via private IP, but a VM in 'subnet-b' cannot. What change should be made to fix this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a VM that has only an internal IP address (no external IP) to reach Google APIs and services through the default internet gateway using Google's private network. Since subnet-b lacks this setting, VMs there cannot reach Google APIs via private IP. Enabling Private Google Access on subnet-b resolves this by allowing the VM's traffic to be routed to Google APIs without needing an external IP.

Answer

Change the stack type of subnet-b to IPV4_IPV6.

Answer

Configure Cloud NAT in the region of subnet-b.

Answer

Add a firewall rule allowing egress to 0.0.0.0/0 on port 443 for subnet-b.

Question 3

A company runs a private GKE cluster in us-central1. Pods need to access the internet for updates. Which configuration is required?

Accepted Answer

Enable Cloud NAT on the cluster's subnet.. In a private GKE cluster, nodes do not have external IPs, so pods cannot reach the internet directly. Cloud NAT provides outbound connectivity by translating private IPs to a public IP, allowing pods to fetch updates while keeping the cluster private. This is the standard solution for outbound-only internet access from private GKE clusters.

Answer

Add network tags to allow egress traffic.

Answer

Create a Cloud Router with BGP peering.

Answer

Assign external IPs to the nodes.

Question 4

A company has an on-premises data center connected to GCP via Cloud VPN with dynamic routing (BGP). Recently, connectivity to a specific subnet (10.1.0.0/16) in GCP became intermittent. The VPN tunnel is up, and BGP sessions are established. What is the most likely cause?

Accepted Answer

The Cloud Router is not advertising the correct subnet range to the on-premises router.. Since the VPN tunnel is up and BGP sessions are established, the issue is not with the tunnel or BGP peering itself. Intermittent connectivity to a specific subnet (10.1.0.0/16) while other subnets remain reachable strongly indicates a route advertisement problem. The Cloud Router must be configured to advertise the correct subnet range to the on-premises router via BGP; if it is not, the on-premises router will lack a route for that subnet, causing intermittent or no connectivity.

Answer

The shared secret is misconfigured.

Answer

The VPN tunnel is flapping due to packet loss.

Answer

A firewall rule is blocking traffic from on-premises.

Question 5

An organization is deploying a Shared VPC with one host project and three service projects. Each service project has multiple VPC networks. They want to ensure that only the host project's network admin can create firewall rules affecting the shared VPC network. Which architecture satisfies this requirement?

Accepted Answer

Create the shared VPC network in the host project and grant the network admin IAM role only to host project users.. In a Shared VPC architecture, the host project owns the shared VPC network, and only IAM roles granted in the host project can manage that network's resources. By creating the shared VPC network in the host project and granting the network admin IAM role exclusively to host project users, you ensure that only those users can create firewall rules for the shared VPC. Service project users cannot modify the shared network's firewall rules because they lack the necessary IAM permissions on the host project.

Answer

Use VPC Network Peering between each service project and the host project, and allow each service project admin to manage their own firewall rules.

Answer

Assign the network admin role to users in each service project for the shared VPC network.

Answer

Create separate VPC networks in each service project and use VPC Network Peering to interconnect them.

Question 6

A company wants to serve global static content from a Cloud Storage bucket. They need low latency worldwide and SSL termination at the edge. Which solution should they choose?

Accepted Answer

Configure a global external HTTP(S) load balancer with a backend bucket.. A global external HTTP(S) load balancer with a backend bucket is the correct choice because it provides SSL termination at the edge (using Google Front Ends) and routes traffic over Google's global network to the nearest Cloud Storage bucket, ensuring low latency worldwide. The HTTP(S) load balancer supports global anycast IP addresses and integrates natively with Cloud Storage backends, making it ideal for serving static content globally.

Answer

Use a TCP/UDP network load balancer with the bucket as backend.

Answer

Deploy an internal TCP/UDP load balancer with the bucket as backend.

Answer

Set up Cloud CDN directly on the bucket without a load balancer.

Question 7

A company uses Private Service Connect (PSC) to access a managed SaaS application published by another company. The SaaS provider publishes a service attachment in their VPC. Which resource must the consumer create to connect to the service?

Accepted Answer

Private Service Connect endpoint. When a consumer wants to connect to a managed SaaS application published via Private Service Connect (PSC), they must create a Private Service Connect endpoint in their own VPC. This endpoint is a regional resource that uses an internal IP address from the consumer's VPC and establishes a connection to the service attachment published by the provider. The endpoint effectively makes the SaaS service accessible as if it were a resource inside the consumer's VPC, without requiring public IPs or VPNs.

Answer

Service attachment

Answer

Internal forwarding rule

Answer

Cloud VPN tunnel

Question 8

A company has a Dedicated Interconnect connection from their on-premises data center to GCP. They have set up BGP sessions over VLAN attachments to peer with their VPC. Traffic from on-premises to GCP works, but return traffic from GCP to on-premises is dropped at the on-premises firewall. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the on-premises prefix to GCP via BGP.. The most likely cause is that the on-premises router is not advertising the on-premises prefix to GCP via BGP. For return traffic from GCP to be routed correctly, GCP must learn the on-premises network prefix through a BGP advertisement from the on-premises router. Without this advertisement, GCP has no route to send traffic back, causing the firewall to drop the packets as they have no valid path.

Answer

The VLAN attachment is in a different region than the GCP resources.

Answer

A GCP firewall rule is blocking the return traffic.

Answer

The MTU size is inconsistent between the on-premises router and GCP.

Question 9

A company is migrating an on-premises DNS service to Cloud DNS. They want to resolve on-premises hostnames from GCP VMs and resolve Google Cloud private zone names from on-premises. They have a Cloud VPN with BGP. Which architecture should they implement?

Accepted Answer

Configure a Cloud DNS forwarding zone for on-premises names and a private zone for GCP names. Then create an inbound server policy for on-premises to query Cloud DNS.. Cloud DNS supports inbound server policies that allow on-premises DNS resolvers to forward queries for private zone names (e.g., `gcp.internal`) to Cloud DNS via the Cloud VPN. A forwarding zone in the VPC directs queries for on-premises hostnames (e.g., `corp.example.com`) to the on-premises DNS servers. This bidirectional resolution is achieved without exposing DNS to the internet, leveraging BGP for routing.

Answer

Configure a split-horizon DNS with separate DNS servers for each environment.

Answer

Set up Cloud DNS peering zones between the VPC and on-premises.

Answer

Use DNS over HTTPS from on-premises to Google's public DNS.

Question 10

A network engineer notices unusual traffic patterns from a VM. They want to capture detailed information about each packet sent and received by the VM, including source and destination IPs, protocols, and ports. Which feature should they enable?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IPs, protocols, and ports. This feature is designed specifically for analyzing traffic patterns and troubleshooting connectivity issues at the network layer, making it the correct choice for the described requirement.

Answer

Packet Mirroring

Answer

Cloud Audit Logs

Answer

Firewall Rules Logging

Question 11

A company uses Cloud CDN with an external HTTP(S) load balancer. They have two origin server groups: a primary in us-central1 and a backup in europe-west1. They want traffic directed to the primary unless it is unhealthy, in which case traffic should fail over to the backup. Which configuration is required?

Accepted Answer

Create a backend service with two backends (primary and failover) and a failover policy that marks the primary as failover when unhealthy.. Cloud CDN with an external HTTP(S) load balancer uses a backend service that can contain multiple backends (e.g., instance groups or NEGs) with a failover policy. When the primary backend is marked as unhealthy by the health check, the load balancer automatically routes traffic to the failover backend. This configuration meets the requirement without manual intervention.

Answer

Create a Cloud CDN with two origins and enable failover in the CDN settings.

Answer

Use a TCP/UDP network load balancer with two target pools.

Answer

Configure a weighted round-robin with primary weight 100 and backup weight 0, and change weights manually.

Question 12

Which TWO are best practices for securing a VPC network? (Choose 2.)

Accepted Answer

Use firewall rules to restrict ingress traffic to only necessary ports and IPs.. Firewall rules are the primary mechanism for controlling ingress traffic in a VPC. By restricting traffic to only necessary ports and source IPs, you minimize the attack surface and enforce the principle of least privilege. This is a fundamental security best practice for network segmentation and access control.

Answer

Use VPC Network Peering to connect to other projects.

Answer

Create a VPC with default firewall rules.

Answer

Enable Private Google Access on all subnets.

Question 13

Which THREE factors should be considered when choosing between a global external HTTP(S) load balancer and a regional external HTTP(S) load balancer? (Choose 3.)

Accepted Answer

SSL termination at the edge (global) vs. at the backend (regional).. Regional external HTTP(S) load balancers terminate SSL at the backend (the backend service or instance), meaning the encrypted traffic must travel to the backend before decryption. Global external HTTP(S) load balancers terminate SSL at the edge (Google Front End), decrypting traffic at the closest point of presence and forwarding plaintext HTTP to the backend. This architectural difference impacts security, latency, and backend processing requirements, making it a key factor in choosing between the two.

Answer

Support for multiple backend types (Compute Engine, GKE, serverless).

Answer

Ability to use health checks.

Question 14

Which TWO steps are required to set up a Cloud VPN with dynamic routing (BGP)? (Choose 2.)

Accepted Answer

Create a VPN gateway and a VPN tunnel.. A Cloud VPN requires both a VPN gateway (the GCP-side endpoint for encrypted traffic) and a VPN tunnel (the actual IPSec tunnel configuration that defines the remote peer IP, shared secret, and IKE parameters). Option E is correct because dynamic routing with BGP mandates a Cloud Router in the same region as the VPN gateway to exchange BGP routes with the on-premises router; the Cloud Router advertises the VPC subnets and learns remote prefixes via BGP sessions over the tunnel.

Answer

Configure a static route for the remote network.

Answer

Create a Cloud NAT for outbound access.

Answer

Create firewall rules to allow traffic from the remote network.

Question 15

A company is running workloads on Compute Engine instances without public IP addresses. They need to allow these instances to securely access the internet for software updates. Which Google Cloud service should be configured?

Accepted Answer

Cloud NAT. Cloud NAT (Network Address Translation) allows Compute Engine instances without public IP addresses to initiate outbound connections to the internet for tasks like software updates. It translates the private IP addresses of the instances to a public IP address managed by Google Cloud, enabling secure outbound internet access without exposing the instances to inbound traffic.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering