PCNE Configuring Network Services Practice Test 6 — 15 Questions

Question 1

Your organization has an internal HTTP load balancer (ILB) in us-central1. The backend service is a managed instance group with a health check on port 8080. Recently, some instances are reported as unhealthy despite the application running fine. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).. The most likely cause is that the firewall rule allowing health check probes does not include the required Google Cloud health check source IP ranges (35.191.0.0/16 and 130.211.0.0/22). For internal HTTP load balancers, the health check probes originate from these specific ranges, not from within the VPC. If the firewall rule only permits traffic from the VPC internal ranges, health checks will fail even if the application is running. Option A is wrong because the health check source range is not the same as VPC internal traffic; it must be the GCP health check ranges. Option B is wrong because proxy protocol does not affect health check source IPs for internal load balancers. Option D is wrong because preemptible instances do not become unhealthy after 24 hours due to preemption; they are terminated, not marked unhealthy.

Answer

The health check firewall rule is configured for the same source range as the VPC internal traffic.

Answer

The internal load balancer is using a proxy protocol which changes the health check source IP.

Answer

The instances are preemptible and become unhealthy after 24 hours.

Question 2

A media streaming company uses Cloud CDN with signed URLs to protect content. They want to invalidate cached content for a specific file after a security incident. The file is stored in a Cloud Storage bucket and the CDN cache key includes the URL. They run: gcloud compute url-maps invalidate-cdn-cache URL_MAP --path "/videos/incident.mp4". The invalidation succeeds but the old content is still served. What is the most likely reason?

Accepted Answer

The invalidation path does not match the cache key because signed URLs include query parameters.. Cloud CDN's cache key for signed URLs includes the query parameters (e.g., `?Expires=...&Signature=...`). The invalidation command specifies only the path `/videos/incident.mp4`, which does not match the full cache key that includes the query string. As a result, the invalidation does not purge the cached entry for the signed URL, and the old content continues to be served.

Answer

The Cloud CDN cache key does not include query parameters, so the invalidation should work.

Answer

The Cache-Control header on the object is set to public, max-age=31536000.

Answer

The Cloud Storage bucket requires object versioning to be enabled for invalidation.

Question 3

You need to allow on-premises servers to access a Google Cloud VM's internal IP without using a public IP. The on-premises network is connected via Cloud VPN. What configuration is required on the Google Cloud side?

Accepted Answer

Enable Private Google Access on the VPC subnet where the VM resides. [wrong]. None of the provided options are correct. To allow on-premises servers to access a Google Cloud VM's internal IP over Cloud VPN, no special Google Cloud-side configuration is required beyond ensuring that the VPC subnet route is advertised to the on-premises network via Cloud Router and that firewall rules allow the traffic. Private Google Access is for accessing Google APIs, not VM internal IPs. Cloud NAT is for outbound traffic. A global static external IP exposes the VM externally. Cloud DNS forwarding is for DNS resolution, not IP reachability.

Answer

Configure Cloud NAT for the on-premises network.

Answer

Assign a global static external IP to the VM.

Answer

Configure Cloud DNS forwarding to the on-premises DNS servers.

Question 4

Your security team wants to block specific SQL injection attacks using Cloud Armor. You have configured a security policy with a preconfigured WAF rule for SQL injection (evaluatePreconfiguredExpr('sqli-stable')). The rule is set to DENY. However, legitimate traffic is being blocked intermittently. What should you adjust?

Accepted Answer

Modify the WAF rule to use a lower sensitivity level or exclude certain request attributes.. The preconfigured WAF rule for SQL injection (sqli-stable) uses a default sensitivity level that may be too aggressive, causing false positives on legitimate traffic. By lowering the sensitivity level or excluding specific request attributes (e.g., headers, cookies, or URI paths), you can reduce false positives while still blocking actual SQL injection attempts. Cloud Armor allows fine-tuning of preconfigured rules via the `sensitivity` parameter and `exclude` lists, which is the correct approach here.

Answer

Add a rate-based rule to limit the number of requests per second.

Answer

Create a rule with higher priority to allow the legitimate traffic before the WAF rule.

Answer

Enable TLS inspection for the load balancer to fully inspect encrypted traffic.

Question 5

You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?

Accepted Answer

The domain is not verified for the Google-managed certificate on the frontend.. When a Google-managed certificate is used on the frontend of an SSL proxy load balancer, the domain must be verified via DNS or a challenge file. If the domain is not verified, the certificate cannot be provisioned or validated, causing a mismatch between the certificate's Subject Alternative Names (SANs) and the domain clients are connecting to, resulting in SSL errors.

Answer

The SSL policy is configured to require TLS 1.3 only.

Answer

The backend self-managed certificate is not signed by a public CA.

Answer

The backend service must use a Google-managed certificate as well.

Question 6

Your company uses Network Connectivity Center (NCC) to manage multiple on-premises sites connected via Cloud VPN and Partner Interconnect. You create a NCC hub and attach spokes (VPN tunnels and VLAN attachments). Traffic between two on-premises sites (Site A and Site B) should flow through Google Cloud. However, traffic is not passing between the sites. What is the most likely cause?

Accepted Answer

The VPN spokes do not have custom dynamic route exchange enabled, so routes from Site A are not advertised to Site B.. The most likely cause is that custom dynamic route exchange is not enabled on the VPN spokes. By default, NCC does not advertise routes between VPN spokes unless you explicitly enable custom dynamic route exchange. Without this, routes from Site A are not propagated to Site B, preventing inter-site traffic through Google Cloud. Option A is incorrect because NCC uses dynamic routing, so static routes to the VPC are unnecessary. Option B is correct because it correctly identifies the need for custom dynamic route exchange to advertise routes between spokes. Option C is incorrect because NCC fully supports Cloud VPN as a spoke type. Option D is incorrect because the NCC hub is a global resource and does not need to reside in the same VPC as the sites' VPCs.

Answer

The on-premises routers need static routes pointing to the Google Cloud VPC for inter-site traffic.

Answer

Network Connectivity Center does not support Cloud VPN as a spoke type.

Answer

The NCC hub must be in the same VPC network as the sites' VPCs.

Question 7

Which TWO of the following are required when setting up an internal TCP/UDP load balancer (ILB) in a shared VPC environment?

Accepted Answer

A health check must be configured for the backend service.. Correct answers: A and D. A: A health check is mandatory for an internal TCP/UDP load balancer (ILB) backend service to determine instance health. D: The ILB forwarding rule must be in the same region as the backend instances because ILB is a regional load balancer. B: Incorrect. ILB does not use proxy-only subnets; firewall rules for proxy-only subnets are required only for load balancers that use Envoy proxies (e.g., HTTP(S) LB). C: Incorrect. While the forwarding rule's IP address is taken from a subnet in the shared VPC (owned by the host project), this is not a separate requirement; the critical requirement is that the forwarding rule and backends are in the same region. E: Incorrect. Global routing is not needed for ILB; it operates within a single region.

Answer

A firewall rule must allow traffic from the proxy-only subnet.

Answer

The forwarding rule's IP address must be from the host project's subnet.

Answer

Global routing must be enabled in the VPC.

Question 8

Your company has a hybrid cloud architecture with two on-premises data centers: DC1 and DC2. Each DC is connected to Google Cloud via separate Cloud VPN tunnels (tunnel1 from DC1, tunnel2 from DC2) to a VPC in us-west1. The VPC has two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). DC1 has a subnet 192.168.1.0/24 and DC2 has 192.168.2.0/24. You configure BGP on both tunnels with the VPC dynamic routing, and each on-premises router advertises its local subnet. The VPC automatically imports the learned routes. You notice that traffic from DC1 to an instance in subnet-a (10.0.1.5) works, but traffic from DC2 to the same instance fails intermittently. Additionally, traffic from DC2 to DC1 (192.168.1.0/24) fails completely. You check the route tables and see that both tunnels have learned the routes for the remote subnets. What is the most likely cause and solution?

Accepted Answer

Configure each Cloud VPN tunnel with a separate Cloud Router and assign different BGP priorities to influence route selection, or use distinct regions for the VPN gateways.. The issue is that both Cloud VPN tunnels are using the same Cloud Router, causing BGP to learn identical routes for the on-premises subnets from both tunnels. This leads to asymmetric routing and potential black-holing, especially when traffic from DC2 to DC1 or to subnet-a is routed via DC1's tunnel due to equal-cost multi-path (ECMP) or default BGP tie-breaking. By configuring separate Cloud Routers with different BGP priorities (MED or local preference), you can force traffic from each DC to use its own tunnel, ensuring symmetric routing and consistent connectivity.

Answer

Create a new VPN tunnel from DC2 to a different VPC and use VPC peering.

Answer

Increase the MTU on the VPN tunnels to avoid fragmentation.

Answer

Disable dynamic routing on both tunnels and use static routes instead.

Question 9

A company has deployed an HTTP load balancer with a backend service configured to use an unmanaged instance group. Users report that traffic is not reaching the backend instances. The backend instances are healthy and have proper firewall rules allowing traffic from the load balancer. What step should the network engineer take to resolve the issue?

Accepted Answer

Add a route for the load balancer's IP range.. The load balancer sends traffic to backend instances using their internal IP addresses. If there is no route from the load balancer's frontend IP range to the subnet containing the backend instances, traffic will be dropped. Adding a route for the load balancer's IP range ensures that packets can reach the instances. Since the problem states firewall rules are already proper, Option A (health check firewall rules) is unnecessary. Health checks are already configured (Option B is not needed). Instances do not require external IPs (Option C). Therefore, the correct step is to add the missing route.

Answer

Configure a firewall rule to allow health check probes from the load balancer's health check ranges.

Answer

Enable HTTP health check on the backend service.

Answer

Assign an external IP address to each backend instance.

Question 10

A company uses Cloud NAT for outbound internet access. Engineering notices that some VM instances fail to connect to external services during peak hours. The network engineer suspects port exhaustion. Which action would best mitigate this issue?

Accepted Answer

Increase the number of NAT IP addresses assigned to the NAT gateway.. Port exhaustion occurs when the NAT gateway runs out of available source ports to map outbound connections. Increasing the number of NAT IP addresses assigned to the gateway multiplies the available port range (each IP provides 64,512 ports), directly alleviating port exhaustion during peak traffic. This is the standard mitigation for port exhaustion in Cloud NAT.

Answer

Change the NAT type from standard to public.

Answer

Enable TCP keepalive on the NAT gateway.

Answer

Reduce the number of NAT gateways in the region.

Question 11

A multinational company has a Shared VPC environment with multiple service projects. They need to allow a specific service project to use its own Cloud DNS private zone that resolves to internal IPs in the Shared VPC. Which configuration ensures this without exposing the zone to other projects?

Accepted Answer

Create a DNS response policy in the Shared VPC host project and associate it with the service project's VPC.. DNS response policies allow you to control DNS resolution per VPC in a Shared VPC environment. By creating a response policy in the host project and associating it with the service project's VPC, you enable that service project to use its own private zone without exposing it to other projects. Option A is incorrect because an inbound server policy is used for on-premises DNS resolution, not for granting private zone access to a service project. Option B is incorrect because VPC peering would allow the service project to manage DNS records, but it does not restrict access to the zone; moreover, peering is not the correct approach for selective DNS resolution in a Shared VPC. Option C is incorrect because granting IAM roles alone does not associate the private zone with a specific VPC; it would allow the service project to view or manage the zone, but the zone would still be visible to other projects with access.

Answer

Create a private zone in the service project and use an inbound server policy.

Answer

Use VPC peering and allow the service project to manage DNS records.

Answer

Grant the service project access to the Shared VPC's private zone via IAM roles.

Question 12

A company has a Cloud VPN tunnel to on-premises. They want on-premises clients to resolve private DNS names in the VPC. Which service should they configure?

Accepted Answer

Inbound DNS policy. An inbound DNS policy forwards DNS queries from on-premises DNS servers to Cloud DNS, enabling resolution of private zone names. Option B (Outbound DNS policy) is for forwarding queries from VMs to on-premises DNS, the opposite direction. Option C (Cloud NAT) provides outbound internet access for VMs, not DNS resolution. Option D (Private Google Access) allows VMs with internal IPs to reach Google APIs, not on-premises DNS resolution.

Answer

Outbound DNS policy

Answer

Cloud NAT

Answer

Private Google Access

Question 13

A gaming company uses Cloud Armor with an external HTTP(S) load balancer to protect against DDoS attacks. They need to restrict access to the load balancer based on geographic region. What should they configure?

Accepted Answer

Geo-match custom rule in Cloud Armor. Cloud Armor supports geo-match custom rules that allow you to allow or deny traffic based on the geographic region of the client IP address. When attached to an external HTTP(S) load balancer, these rules are evaluated at the edge before traffic reaches the backend, providing effective geo-based access control against DDoS attacks.

Answer

Geo-based routing policy on the backend service

Answer

A firewall rule that blocks IPs from certain countries

Answer

Use Cloud CDN with geo filtering

Question 14

Which TWO configurations can enable VM instances without external IPs to access the internet? (Choose TWO.)

Accepted Answer

VPC peering with a network that has Cloud NAT. Cloud NAT (Option E) provides source network address translation for VMs in a subnet, enabling outbound internet access without external IPs. VPC peering with a network that has Cloud NAT (Option B) allows VMs to use the NAT of the peered network for internet access. Option A (Direct peering with Google) only provides connectivity to Google services, not the full internet. Option C (Private Google Access) only grants access to Google APIs. Option D (Using a proxy instance with an external IP) is possible but not a native Google Cloud service and requires manual configuration.

Answer

Direct peering with Google

Answer

Private Google Access

Answer

Using a proxy instance with an external IP

Question 15

Which THREE components are required when configuring an internal TCP/UDP load balancer? (Choose THREE.)

Accepted Answer

Health check. The three required components for an internal TCP/UDP load balancer in Google Cloud are: a health check to determine backend instance health, a backend service to define the instance group and port mapping, and a forwarding rule to assign the internal VIP address. Option C (External IP address) is not used because internal load balancers use internal IP addresses. Option D (SSL certificate) is not required for internal load balancing, as SSL termination is handled by external load balancers or proxies.

Answer

External IP address

Answer

SSL certificate