PCNE Configuring Network Services Practice Test 7 — 15 Questions

Question 1

A company uses Cloud VPN with dynamic routing (BGP). The on-premises network advertises a prefix that overlaps with a subnet in the VPC. Which TWO actions can resolve this conflict? (Choose TWO.)

Accepted Answer

Modify the on-premises BGP advertisement to use a more specific prefix (longer subnet mask) that does not overlap.. By advertising a more specific prefix (longer subnet mask) from on-premises, that route will be preferred over the less specific VPC subnet route due to longest prefix match. Option E is correct: Cloud Router custom route advertisements allow you to filter or modify which routes are learned or advertised, which can be used to prevent the overlapping route from being installed. Options A, C, and D are incorrect: deleting the subnet is unnecessary; route propagation filters are not a native feature; and a static route with the same prefix length would not override a dynamic BGP route.

Answer

Delete the conflicting subnet in the VPC.

Answer

Use route propagation with a filter in the VPC route table.

Answer

Create a static route in the VPC with the same prefix as the overlapping route.

Question 2

A company has a VPC with subnet 10.1.0.0/24 in us-central1. They created a Cloud NAT gateway named 'nat-us-central1' attached to that subnet. During peak hours, many VM instances in the subnet cannot connect to the internet. The NAT configuration shows only one NAT IP. Firewall rules allow egress traffic, and health checks confirm the NAT gateway is functioning. What is the most likely cause of the failure?

Accepted Answer

Port exhaustion due to insufficient NAT IP addresses.. With only one NAT IP address and many VM instances sharing it, the available source ports (65,535 per IP) are quickly exhausted during peak hours. Each concurrent outbound connection consumes a unique source port; once all ports are in use, new connections fail. This is a classic port exhaustion scenario, not a configuration or firewall issue.

Answer

The Cloud Router is missing or misconfigured.

Answer

The NAT gateway is not attached to the correct subnet.

Answer

An egress firewall rule blocks ICMP packets.

Question 3

A company has two VPC networks in the same project: Network A (hosting a private zone for 'example.internal.') and Network B. They are connected via VPC peering. The network engineer created a DNS peering zone in Network B for 'example.internal.' pointing to Network A. However, instances in Network B cannot resolve 'host.example.internal.' which is defined in Network A's private zone. The engineer verified that the peering zone is active and the networks are properly peered. What is the most likely reason for the resolution failure?

Accepted Answer

The private zone in Network A is not configured to allow resolution from peered networks.. Cloud DNS private zones do not automatically allow resolution from peered VPC networks unless explicitly configured. Even though VPC peering and DNS peering are active, the private zone in Network A must have its 'Allow resolution from peered networks' setting enabled. Without this, queries from Network B via the DNS peering zone are rejected, causing resolution failures for records like 'host.example.internal.'.

Answer

An inbound server policy must be created in Network A.

Answer

The peering zone should be a forwarding zone instead.

Answer

An outbound server policy must be created in Network B.

Question 4

A company uses Cloud Armor with an external HTTPS load balancer to protect their web application. They have a security policy 'my-policy' attached to the backend service. The policy includes an allow rule (priority 1000) for their corporate IP range (203.0.113.0/24) and a deny rule (priority 2000) for all other IPs. The company has an office at a remote location that uses a different IP range (198.51.100.0/24). Employees from the remote office report they cannot access the application. Meanwhile, employees from the corporate office (203.0.113.0/24) can access. The engineer checks the Cloud Armor policy and sees the rule configuration as shown. What is the most likely cause?

Accepted Answer

The remote office IP range is not included in an allow rule in the security policy.. The remote office IP range (198.51.100.0/24) is not explicitly allowed by any rule in the security policy. The only allow rule (priority 1000) permits traffic from the corporate IP range (203.0.113.0/24), and the deny rule (priority 2000) blocks all other IPs. Since the remote office IPs are not covered by the allow rule, they are denied by default, which explains their inability to access the application.

Answer

The rule evaluation order is wrong; the deny rule should have higher priority (lower number).

Answer

The deny rule uses 'SRC_IPS_V2' which is an invalid expression.

Answer

The load balancer's frontend IP blocks traffic from certain geographic regions.

Question 5

A service provider uses a Shared VPC with multiple service projects. The host project has a Cloud NAT configured for subnet 10.1.0.0/24 to provide outbound internet access to all service projects using that subnet. A new service project needs to use its own Cloud NAT for its VM instances in subnet 10.1.0.0/24 to meet compliance requirements. The network engineer attempts to create a Cloud NAT in the service project for that subnet but receives an error that the subnet already has a NAT gateway. What action should the engineer take to meet the compliance requirement?

Accepted Answer

Remove the host project's NAT from the subnet and create a Cloud NAT in the service project for that subnet.. A subnet can have only one NAT gateway associated. To allow the service project to use its own Cloud NAT for subnet 10.1.0.0/24, the host project's Cloud NAT must first be removed from that subnet. Then the service project can create its own Cloud NAT for the same subnet. Option A is not possible due to the conflict. Option B (VPC peering) would not allow the service project to have its own NAT on the same subnet. Option C (proxy instance) introduces management overhead and is not a native solution.

Answer

Create a new Cloud NAT in the service project for the same subnet, overwriting the existing one.

Answer

Use VPC peering to connect the service project to a different network that has a Cloud NAT.

Answer

Implement a proxy instance with an external IP in the service project.

Question 6

A company has two VPC networks (VPC-A and VPC-B) in the same project. They are connected via VPC peering. VPC-A contains an internal TCP load balancer with IP 10.1.2.3 serving on port 80. VPC-B needs to access this load balancer. The network engineer has verified that the firewall rules allow traffic from VPC-B to the load balancer's IP and port. However, instances in VPC-B cannot connect to 10.1.2.3:80. What is the most likely reason for this failure?

Accepted Answer

Internal load balancers are regional; clients must be in the same region as the load balancer when using VPC peering.. Internal TCP/UDP load balancers are regional and only accept traffic from clients in the same region when using VPC peering. If VPC-B's instances are in a different region than the load balancer, they cannot reach it via peering unless the load balancer has global access enabled (which is only available for external LBs). Option B is incorrect: VPC peering does propagate subnets, but the issue is not routing; it's the regional constraint. Option C is incorrect: Health checks affect the load balancer's ability to send traffic to backends, not clients' ability to connect to the load balancer IP. Option D is incorrect: Firewall rules were already verified as allowing traffic.

Answer

The VPC peering connection does not propagate routes for the load balancer IP.

Answer

The backend instances are unhealthy and the load balancer is not serving traffic.

Answer

Firewall rules in VPC-B are not allowing egress to the load balancer IP.

Question 7

A company has deployed an external HTTPS load balancer with a Cloud CDN backend. The load balancer uses a managed SSL certificate. Recently, the company updated their DNS record to point to a different IP address of a new load balancer. After the change, some users are still being served from the old load balancer's cache. The network engineer has confirmed that the DNS TTL has expired. What is the most likely cause of this issue?

Accepted Answer

Cloud CDN cached responses from the old load balancer may still be served until their cache TTL expires.. Cloud CDN caches content at Google's edge caches based on the cache-control headers or default cache TTL. When the DNS record is updated to point to a new load balancer, the old load balancer's cached responses may still be served from edge caches until their cache TTL expires, even after the DNS TTL has expired. This is because Cloud CDN caches are independent of DNS resolution and are governed by HTTP caching rules.

Answer

The old load balancer's SSL certificate is still cached by clients.

Answer

The DNS change has not propagated globally despite the TTL expiring.

Answer

The old load balancer's IP address is still being served by Google's edge network due to anycast.

Question 8

A company has deployed a web application on Compute Engine instances in a VPC with subnet 10.1.0.0/20. The instances need to access an external API that whitelists IP addresses. The company uses Cloud NAT to provide outbound connectivity. The API integration tests are failing, and the operations team suspects that the source IP addresses seen by the API are not consistent. What is the most likely cause and solution?

Accepted Answer

Cloud NAT is configured with a default rule that does not include the subnet; add a custom NAT rule that specifically includes subnet 10.1.0.0/20.. If Cloud NAT's default rule does not include the subnet 10.1.0.0/20, instances in that subnet will not have their outbound traffic translated through the NAT gateway, causing them to use their ephemeral public IPs (if any) or fail to reach the external API. Adding a custom NAT rule that explicitly includes the subnet ensures all outbound traffic from those instances uses the consistent NAT IP address that the API whitelist expects.

Answer

Cloud NAT is configured with endpoint-independent mapping; change to endpoint-dependent mapping to ensure consistent source IP.

Answer

Cloud NAT is configured with dynamic port allocation; use static port allocation instead.

Answer

Cloud NAT is using a manual NAT IP address that is not assigned to the instances; assign the NAT IP to the instances as an alias IP range.

Question 9

A network engineer is designing a hybrid cloud architecture connecting an on-premises data center to Google Cloud via Dedicated Interconnect. The on-premises network uses BGP for dynamic routing. The engineer needs to configure Cloud Router to exchange routes with the on-premises router. Which two configuration steps are required? (Choose two.)

Accepted Answer

Enable the BGP session on the Cloud Router and configure the peer IP address and ASN.. Cloud Router uses BGP to dynamically exchange routes with the on-premises router over Dedicated Interconnect. Enabling the BGP session requires configuring the peer IP address (the on-premises router's interface IP) and the on-premises ASN, which allows the two routers to establish a BGP peering and exchange prefixes.

Answer

Configure a static route in Google Cloud VPC with the on-premises prefix.

Answer

Assign a primary and secondary IP range to the Cloud Router interface.

Answer

Configure the Cloud Router with the same ASN as the on-premises router.

Question 10

Refer to the exhibit. A network team has created this load balancer. Clients inside the VPC are unable to connect to the load balancer's IP address from a Compute Engine instance in the same VPC. What is the most likely cause?

Accepted Answer

The load balancer is configured with network tier STANDARD, which does not support internal traffic.. A load balancer configured with network tier STANDARD uses the Premium Tier's external IP addressing, which does not support internal traffic routing within the same VPC. Clients inside the VPC attempting to connect to the load balancer's IP address from a Compute Engine instance in the same VPC will fail because STANDARD tier IPs are designed for external internet-facing traffic and cannot be reached from within the VPC without a public IP and appropriate routing. The load balancer must use the Premium Tier (network tier PREMIUM) to support internal client traffic within the same VPC.

Answer

The target HTTPS proxy is not properly configured to use a backend service.

Answer

The load balancer is using INTERNAL_MANAGED scheme, which requires the clients to be in a different region.

Answer

The load balancer does not have a backend service configured.

Question 11

A multinational corporation has deployed a multi-region application on Google Kubernetes Engine (GKE) clusters in us-central1 and europe-west1. The application serves global users and requires low-latency access to a shared database hosted on Cloud SQL in us-central1. The network team has configured Cloud VPN tunnels between each region and the on-premises data center for administrative access. The application instances in europe-west1 are experiencing high latency when connecting to the Cloud SQL instance in us-central1. The team wants to reduce latency without migrating the database. The team has already verified that the Cloud SQL instance has private IP enabled and is peered to a shared VPC that spans both regions. The GKE clusters are in the same shared VPC. What should the team do?

Accepted Answer

Configure Private Service Connect to expose the Cloud SQL instance from us-central1 and access it via a service attachment from europe-west1.. Private Service Connect (PSC) allows the Cloud SQL instance in us-central1 to be accessed from europe-west1 via a service attachment and a private endpoint, enabling traffic to traverse Google's internal network without backhauling through the on-premises data center. This reduces latency by keeping the traffic within Google's backbone, avoiding the longer path through the Cloud VPN and on-premises network. PSC supports cross-region connectivity with private IP, which aligns with the requirement to not migrate the database.

Answer

Configure a global external HTTP(S) load balancer in front of the Cloud SQL instance.

Answer

Create a Cloud Interconnect connection from europe-west1 to the on-premises data center and route traffic through the on-premises network to reach us-central1.

Answer

Enable Cloud SQL public IP and allow the GKE nodes in europe-west1 to connect over the internet using Cloud NAT.

Question 12

A company wants to expose a globally distributed application using Cloud Run via a single anycast IP address, with SSL termination and content-based routing to different backend services. Which load balancer should they use?

Accepted Answer

Global External HTTPS Load Balancer. The Global External HTTPS Load Balancer provides a single anycast IP, SSL termination, and content-based routing via URL maps to backends like serverless NEGs pointing to Cloud Run.

Answer

Global External SSL Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global External TCP Proxy Load Balancer

Question 13

An organization uses Traffic Director with Envoy sidecars in GKE. They want to implement fault injection to test service resilience by injecting a 5-second delay into 10% of requests to a specific backend service. Which Traffic Director configuration resource should they use?

Accepted Answer

A fault injection policy in the TrafficDirectorRoute. Traffic Director supports fault injection via the Envoy HTTP connection manager. The correct approach is to configure a TrafficDirectorRoute with a fault injection policy, which is part of the routing configuration.

Answer

A backend service with outlier detection enabled

Answer

A network endpoint group with a health check that fails intermittently

Answer

A traffic splitting rule in the routing configuration

Question 14

You need to configure Cloud CDN to cache all content from a backend bucket, ignoring any Cache-Control headers sent by the origin. Which cache mode should you use?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL ignores origin headers and caches all responses for the specified TTL.

Answer

USE_ORIGIN_HEADERS

Answer

CACHE_ALL_STATIC

Answer

DYNAMIC_MODE

Question 15

A company has an on-premises data center connected to GCP via Cloud Interconnect. They want to expose an on-premises service to internet clients through Google Cloud's global load balancer. Which type of network endpoint group should they use?

Accepted Answer

Hybrid connectivity NEG. Hybrid connectivity NEGs allow you to expose on-premises destinations via Cloud Interconnect or VPN to a load balancer.

Answer

Zonal NEG

Answer

Internet NEG

Answer

Serverless NEG