PCNE Configuring Network Services Practice Test 5 — 15 Questions

Question 1

A company is deploying an internal HTTP application on Compute Engine instances. The application must be load-balanced across multiple instances in different regions, but only accessible from within the same VPC. Which load balancer type meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Internal HTTP(S) Load Balancer. An Internal HTTP(S) Load Balancer is a regional, internal-only load balancer that distributes HTTP/HTTPS traffic among Compute Engine instances within the same VPC network. It uses an internal IP address and is not accessible from outside the VPC, meeting the requirement for internal-only access while providing cross-region load balancing via a multi-region backend service.

Answer

External TCP/UDP Load Balancer

Answer

External HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 2

An organization has a Dedicated Interconnect with Cloud Router configured for BGP. The on-premises network advertises a prefix that overlaps with an existing VPC subnet. How does Google Cloud handle the overlapping prefix?

Accepted Answer

It rejects the prefix and does not install a dynamic route for it.. When a Dedicated Interconnect with Cloud Router receives a BGP advertisement for a prefix that overlaps with an existing VPC subnet, Google Cloud rejects the prefix and does not install a dynamic route for it. This is because VPC subnet routes always take precedence over dynamically learned routes, and accepting an overlapping prefix would create ambiguity in forwarding decisions. The Cloud Router enforces this behavior to maintain the integrity of the VPC's internal addressing.

Answer

It accepts the prefix but static routes have higher priority.

Answer

It accepts the prefix and gives it higher priority than the VPC subnet.

Answer

It accepts the prefix and load balances traffic between the two locations.

Question 3

A company wants to forward DNS queries from their on-premises network to Google Cloud for resolution of private zone names. Which configuration is required?

Accepted Answer

DNS inbound server policy. A DNS inbound server policy allows an on-premises DNS resolver to forward queries to Google Cloud, enabling resolution of private zone names. This policy creates a forwarding path from on-premises to Cloud DNS using a specific inbound endpoint, which is required for hybrid cloud DNS resolution.

Answer

DNS peering

Answer

DNS forwarding zone

Answer

Managed private zone

Question 4

A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?

Accepted Answer

Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'. It defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.

Answer

Ingress rule: allow tcp:3306, source IP range 10.0.0.0/8, target tags 'db'

Answer

Ingress rule: allow tcp:3306, source tags 'web', target service account 'db-sa'

Answer

Egress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'

Question 5

A large organization uses Shared VPC with multiple service projects. They have an on-premises network connected via Cloud Interconnect. They want the on-premises network to be able to reach instances in all service projects. What is the recommended configuration?

Accepted Answer

Configure Cloud Router in the host project to advertise all subnets via BGP.. In a Shared VPC architecture, the host project owns the VPC network and subnets, and Cloud Router with BGP is used to advertise the subnets from the host project to the on-premises network over Cloud Interconnect. This allows the on-premises network to reach instances in all service projects, as those instances reside in the host project's subnets. Cloud Router dynamically advertises the host project's VPC subnets via BGP, enabling seamless Layer 3 connectivity without additional per-service-project configurations.

Answer

Configure Cloud NAT in each service project for on-prem access.

Answer

Use VPC peering between the host project and each service project.

Answer

Create separate Interconnect VLAN attachments for each service project.

Question 6

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

Accepted Answer

It reduces latency by serving content from edge locations.. Cloud CDN caches content at Google's global edge locations, which are geographically closer to end users. By serving static content from these edge caches instead of the origin HTTP load balancer, the request latency is significantly reduced because the data travels a shorter distance over the network.

Answer

It eliminates the need for SSL certificates.

Answer

It provides DDoS protection only.

Answer

It increases compute instance capacity.

Question 7

A company wants to protect their application behind an external HTTP(S) load balancer from SQL injection attacks. Which Cloud Armor feature should be used?

Accepted Answer

Pre-configured WAF rules. Pre-configured WAF rules in Cloud Armor include a SQL injection (SQLi) rule that inspects HTTP(S) request bodies, headers, and URIs for SQL injection patterns. This rule uses a set of signatures to detect and block malicious SQL queries, directly addressing the requirement to protect against SQL injection attacks on an external HTTP(S) load balancer.

Answer

IP allowlist/denylist

Answer

Named IP address lists

Answer

Rate limiting

Question 8

A company has Compute Engine instances in a VPC that only have internal IP addresses. They need to access Google Cloud services like Cloud Storage and BigQuery. They also have on-premises servers that need to access the same instances via a Cloud VPN tunnel. What must be enabled for the instances to access Google APIs without public IPs?

Accepted Answer

Private Google Access. Private Google Access enables Compute Engine instances that have only internal IP addresses (no external IPs) to reach Google APIs and services such as Cloud Storage and BigQuery. It works by routing traffic destined for Google API IP ranges through the default internet gateway, using the VPC's internal DNS resolution to map the API hostnames to Google's internal IP addresses, without requiring a public IP on the instance.

Answer

Cloud Router

Answer

VPC peering

Answer

Cloud NAT

Question 9

Which TWO of the following are benefits of using Cloud NAT?

Accepted Answer

Enables outbound traffic from instances without public IPs. Cloud NAT enables outbound connectivity from private instances that lack public IP addresses. It translates private source IPs to a single or a pool of external IPs, allowing instances to reach the internet while remaining unreachable from outside. This is essential for security and compliance in VPC networks.

Answer

Supports static IP addresses for all instances

Answer

Provides inbound port forwarding

Answer

Automatically scales with the number of instances

Question 10

Which THREE of the following are requirements for VPC Network Peering?

Accepted Answer

The VPCs must have non-overlapping subnet IP ranges.. VPC Network Peering requires non-overlapping subnet IP ranges to prevent routing conflicts and ensure that traffic is correctly directed between the peered VPCs. Overlapping CIDR blocks would cause ambiguous routing, as the same IP address could exist in both VPCs, making it impossible for the VPC routers to determine the correct destination.

Answer

Peering supports transitive routing.

Answer

The VPCs must be in the same project.

Question 11

Which TWO of the following load balancer types can distribute traffic to backends in multiple regions?

Accepted Answer

External HTTP(S) Load Balancer. The External HTTP(S) Load Balancer is a global load balancer that can distribute traffic to backends in multiple regions using anycast IP addresses and Google's global network. It supports cross-regional backend services, making it suitable for global applications.

Answer

Internal HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP/UDP Load Balancer

Question 12

Refer to the exhibit. A Compute Engine instance has the network tags 'http-server' and 'ssh-server'. It also has a public IP address. Which of the following statements about traffic to this instance is true?

Accepted Answer

HTTP traffic from the internet is allowed.. The instance has the network tag 'http-server', which is used by the default VPC firewall rule 'default-allow-http' to permit inbound TCP traffic on port 80 from any source (0.0.0.0/0). Since the instance also has a public IP address, HTTP traffic from the internet can reach it. The other tags and the public IP do not override this allow rule.

Answer

All traffic from the internet is denied because of the deny-all rule.

Answer

SSH traffic from the internet is allowed.

Answer

HTTPS traffic from the internet is allowed.

Question 13

Refer to the exhibit. A Cloud Router has two BGP sessions. The first session is UP, the second is DOWN. What is the most likely cause for the second session being down?

Accepted Answer

The session initialization mode is set to PASSIVE.. The second session has sessionInitializationMode set to PASSIVE. If the peer router is also configured as PASSIVE, the BGP session will never establish. The first session is ACTIVE, so it came up. This is a common misconfiguration.

Answer

The advertised route priority is too low.

Answer

The peer IP address 169.254.1.2 is not routable.

Answer

The BFD multiplier is too low (3).

Question 14

Refer to the exhibit. A DNS managed zone is configured with private visibility and associated with a VPC network. A Compute Engine instance in a different VPC network tries to resolve 'test.example.com' but fails. What is the most likely reason?

Accepted Answer

The instance's VPC is not in the list of authorized networks.. Private zones only respond to queries from authorized VPC networks. The instance is in a different VPC, so resolution fails.

Answer

The zone is not set as authoritative for example.com.

Answer

The Cloud DNS name servers are not reachable from the instance.

Answer

The instance does not have the required IAM permissions.

Question 15

A company uses Cloud NAT to enable outbound connectivity for private VMs. They notice that some VMs are not able to reach a specific external IP range. The VMs have no tags or service accounts. What is the most likely cause?

Accepted Answer

The VMs might be in a different subnet than the one where Cloud NAT is configured.. The most likely cause is that the VMs are in a subnet that does not have Cloud NAT configured. Cloud NAT is configured on a per-subnet basis, and only VMs in subnets with Cloud NAT enabled can use it for outbound traffic. Option A is incorrect because Cloud NAT does not require each VM to have a unique external IP; it uses a pool of NAT IPs. Option B is incorrect because VMs already have a default route (0.0.0.0/0) via the default internet gateway, and Cloud NAT works with that route; there is no need for a route pointing to the NAT gateway. Option C is incorrect because no static route is needed for specific external IP ranges; Cloud NAT uses the default route and performs source NAT for all outbound traffic.

Answer

Cloud NAT requires each VM to have a unique external IP address.

Answer

The VMs need a default route pointing to the NAT gateway.

Answer

A static route must be created for the external IP range via the NAT gateway.