PCNE Designing, Planning, and Prototyping a GCP Network — 20 Questions

Question 1

A company is designing a hybrid connectivity solution between an on-premises data center and Google Cloud. They have a high bandwidth requirement of 20 Gbps and need a service level agreement (SLA) of 99.99% availability. Which connectivity option should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dedicated Interconnect with two 10 Gbps connections. Dedicated Interconnect provides direct, private connections between your on-premises network and Google Cloud, supporting up to 10 Gbps per circuit. By using two 10 Gbps connections in an active-active or active-passive configuration, you can achieve the required 20 Gbps aggregate bandwidth and meet the 99.99% SLA, as Google guarantees this SLA when you have at least two redundant connections.

Answer

Cloud VPN with two tunnels each using 1 Gbps

Answer

Direct Peering

Answer

Partner Interconnect with two 10 Gbps connections

Question 2

Which THREE of the following are requirements for implementing a Global External HTTP(S) Load Balancer with an external backend?

Accepted Answer

The backend must support health checks from the load balancer's health check IP ranges.. Option B is correct because a Global External HTTP(S) Load Balancer relies on health checks originating from Google's health check source ranges (130.211.0.0/22 and 35.191.0.0/16) to determine backend health, so the external backend must permit and respond to those probes. Option D is correct because the load balancer's proxy systems forward user traffic from Google Front End IP ranges, so firewall rules on the external backend must allow inbound traffic from those ranges on the serving ports. Option E is correct because an external backend for a global external HTTP(S) load balancer must be reachable over the internet, meaning it needs a publicly routable IP address or equivalent public accessibility, since the load balancer's proxies connect to it from outside its network. Option A is not required because Private Google Access applies to internal Google API/service access from a VPC subnet, not to making an external backend reachable by a global external load balancer. Option C is not required because SSL/TLS termination for the client-facing side is handled by the load balancer's target HTTPS proxy and certificates, not by installing a certificate on the backend for this requirement.

Answer

The backend must be configured with Private Google Access.

Answer

The backend must have an SSL certificate installed.

Question 3

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth up to 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Partner Interconnect with redundant connections. The requirement for high availability (redundancy) and bandwidth up to 10 Gbps is best met by Partner Interconnect with redundant connections. Partner Interconnect supports bandwidths from 50 Mbps to 10 Gbps and allows you to connect through a supported service provider, while redundant connections ensure failover and meet the high-availability requirement. Dedicated Interconnect offers up to 10 Gbps per circuit but requires two separate connections for high availability, not a single connection.

Answer

VPN with Cloud Router

Answer

Direct Peering

Answer

Dedicated Interconnect with a single connection

Question 4

A network engineer is designing a VPC in Google Cloud with multiple subnets across different regions. The application requires low-latency communication between instances in the same region but not across regions. Which VPC network configuration should be used?

Accepted Answer

Custom mode VPC with regional subnets. Custom mode VPC with regional subnets (D) is correct because it allows you to explicitly define subnets in specific regions, ensuring that instances within the same region communicate over low-latency paths without cross-region traffic. This design avoids the automatic creation of subnets in every region (as in auto mode) and prevents the use of deprecated legacy networks, giving you full control over regional placement for latency-sensitive applications.

Answer

Auto mode VPC with global subnets

Answer

Legacy network

Answer

Auto mode VPC with regional subnets

Question 5

An organization wants to implement a hub-and-spoke network topology in Google Cloud using VPC Network Peering. The hub VPC hosts shared services and the spoke VPCs host application workloads. They need to ensure that spokes can communicate with each other through the hub. Which additional configuration is required?

Accepted Answer

Configure a managed VPN between the hub and each spoke, and enable dynamic routing. VPC Network Peering does not support transitive routing by default. To enable spoke-to-spoke communication through the hub, you must configure a managed VPN (Cloud VPN) between the hub and each spoke with dynamic routing (BGP). This creates a routed overlay that allows the hub to forward traffic between spokes, effectively achieving transitive routing.

Answer

Enable 'Export custom routes' on the hub VPC and 'Import custom routes' on the spoke VPCs

Answer

Use a shared VPC instead of VPC Network Peering

Answer

Create a peering connection between each pair of spokes

Question 6

A company is planning to migrate their on-premises application to Google Cloud. The application requires consistent high bandwidth and low latency to on-premises databases. They have a Dedicated Interconnect connection with a 10 Gbps link. To improve availability, they decide to add a second Interconnect connection. Which of the following is a best practice for configuring BGP sessions?

Accepted Answer

Configure two BGP sessions with the same ASN and MED values. Using the same ASN for both BGP sessions is a best practice for Dedicated Interconnect redundancy. It ensures that the on-premises router treats both sessions as part of the same autonomous system, enabling consistent routing. MED (Multi-Exit Discriminator) values can then be used to influence path selection, allowing traffic engineering to prefer one connection over the other. Option B is incorrect because using different ASNs is not recommended; it can cause suboptimal routing and complicates path selection. Options C and D are incorrect because each Interconnect connection requires its own BGP session; a single session across both connections is not supported, and ECMP with a single session is not possible.

Answer

Configure two BGP sessions, each on a separate connection, with different ASNs and MED values to influence path selection

Answer

Enable ECMP across the two connections with a single BGP session

Answer

Use a single BGP session across both connections

Question 7

A network engineer is designing a Google Cloud network for a financial services company that requires strict compliance with PCI DSS. They need to isolate development, staging, and production environments. Which approach should they use to meet these requirements?

Accepted Answer

Use separate VPCs for each environment, connected via VPC Network Peering. PCI DSS requires strict network segmentation between environments handling cardholder data. Separate VPCs provide complete isolation at the network layer, preventing any accidental cross-environment traffic. VPC Network Peering allows controlled, encrypted communication between these isolated VPCs without reducing the security boundary, as peering does not merge routing domains or security policies.

Answer

Use a single VPC with separate subnets for each environment and firewall rules to restrict traffic

Answer

Use a single VPC with separate firewall rules for each environment

Answer

Use a Shared VPC with separate service projects for each environment

Question 8

A company has deployed a Global External HTTP(S) Load Balancer with a backend service that points to an instance group in us-central1. The load balancer's frontend uses a reserved static external IP address. Users in Europe report high latency, while users in Asia cannot reach the application at all. The application works fine when accessed directly via the instance group's internal IPs from within us-central1. Which action should be taken to resolve the issue?

Accepted Answer

Change the load balancer to a regional load balancer and deploy additional instance groups in other regions.. The Global External HTTP(S) Load Balancer distributes traffic to backends across regions, but if the backend is only in us-central1, users far away experience high latency and, in some cases, cannot reach the application due to network distance or peering issues. The recommended solution is to use regional load balancers with backend instance groups in each region where users are located. This ensures low latency and high availability globally.

Answer

Enable Cloud CDN on the backend service to cache content closer to users.

Answer

Configure a DNS A record for the load balancer's IP address with a low TTL.

Answer

Ensure the backend service's 'Enable Global Access' checkbox is selected in the instance group's network settings.

Question 9

A company is deploying a multi-tier application on Google Cloud. The frontend tier runs in a managed instance group behind a global external HTTP(S) load balancer. The backend tier runs on Compute Engine instances in a different VPC subnet. The frontend instances must communicate with the backend instances using internal IP addresses only. Which configuration should the network engineer use?

Accepted Answer

Set up VPC Network Peering between the frontend VPC and the backend VPC.. VPC Network Peering allows two separate VPC networks to communicate using internal IP addresses without traversing the internet or requiring a VPN. Since the frontend and backend are in different VPCs (implied by the need for peering), peering enables direct internal IP connectivity between the frontend instances and the backend instances, satisfying the requirement for internal-only communication.

Answer

Use Cloud NAT to allow the frontend to reach the backend via the internet.

Answer

Use an internal TCP/UDP load balancer in the backend VPC and configure the frontend to send traffic to the load balancer's internal IP.

Answer

Place both frontend and backend instances in the same VPC but different subnets, and use firewall rules to allow traffic.

Question 10

Drag and drop the steps to create a VPC with custom subnet mode in Google Cloud into the correct order.

Accepted Answer

Name the VPC, Select custom subnet mode, Define subnets, Create VPC. Custom subnet mode requires manual subnet creation. The steps include naming the VPC, selecting custom mode, and defining subnets.

Answer

Name the VPC, Define subnets, Select custom subnet mode, Create VPC

Answer

Select custom subnet mode, Name the VPC, Define subnets, Create VPC

Answer

Define subnets, Name the VPC, Select custom subnet mode, Create VPC

Question 11

A company needs to connect their on-premises data center to Google Cloud using a VPN with high availability. They have two VPN appliances on-premises in different locations. What is the best design on the GCP side?

Accepted Answer

Deploy two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.. It provides true high availability by using two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance. This design ensures that if one region or gateway fails, traffic can still flow through the other region, meeting the requirement for high availability. Using separate Cloud Routers allows for dynamic routing with BGP, enabling automatic failover and load balancing across the two tunnels.

Answer

Deploy one Cloud VPN gateway with two tunnels to both on-premises appliances, using one Cloud Router.

Answer

Deploy two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.

Answer

Deploy one Cloud VPN gateway with a single tunnel to one on-premises appliance.

Question 12

A company has a VPC with subnets in us-east1 and europe-west1. They need low-latency communication between instances in these regions using private IPs only. Which solution should they use?

Accepted Answer

Use a Global VPC (default VPC mode).. A Global VPC (default VPC mode) allows subnets in multiple regions to communicate using private IPs natively, without any additional VPN or peering configuration. This is because a Global VPC spans all regions, and instances within the same VPC can reach each other via internal IPs using Google's global network, providing low-latency communication.

Answer

Use Cloud VPN to connect the regions.

Answer

Use Cloud Interconnect to connect the regions.

Answer

Use VPC Network Peering between the two regional subnets.

Question 13

A company has Compute Engine instances without external IPs that need to access the internet for updates. They do not want any inbound traffic. What is the best design?

Accepted Answer

Configure Cloud NAT and add firewall rules to allow only necessary egress and deny all ingress.. Cloud NAT provides outbound internet connectivity for instances without external IPs, and the explicit firewall rules ensure only necessary egress traffic is allowed while denying all ingress, meeting the requirement of no inbound traffic. Default firewall rules allow some ingress (e.g., ICMP), so they must be overridden with a deny-all-ingress rule to fully block inbound traffic.

Answer

Configure Cloud NAT and rely on default firewall rules.

Answer

Configure Cloud NAT and add a firewall rule to allow all egress traffic.

Answer

Configure Cloud NAT and add a firewall rule to deny all ingress and egress.

Question 14

Which TWO of the following are benefits of using Shared VPC?

Accepted Answer

Automatic cross-project routing. Option B is correct because Shared VPC lets resources in service projects use subnets defined in the host project, and Google Cloud automatically programs routes across those projects so instances can communicate without manual peering or route configuration. Option C is correct because firewall rules are defined on the host project's VPC network and apply uniformly to all attached service projects, giving network admins a single, centralized place to manage policy. Option A is not a Shared VPC benefit per se; VPC Service Perimeters come from VPC Service Controls, a separate security product. Option D is wrong because Shared VPC does not reduce IP address consumption—subnets are still allocated from the host project's CIDR ranges. Option E is a design consideration rather than a built-in benefit, and Shared VPC actually centralizes network administration under the host project, which can blur rather than enforce team separation.

Answer

Enhanced security through VPC Service Perimeters

Answer

Reduced IP address usage

Answer

Separation of network and application teams

Question 15

A company needs to connect three VPC networks in separate projects (two in the same organization, one in a different organization) to each other for private IP communication. Which TWO GCP solutions should they consider? (Choose 2.)

Accepted Answer

VPC Network Peering. VPC Network Peering (D) is correct because it connects VPC networks across projects and even across organizations using private RFC 1918 IP addresses, with no gateway or public internet dependency, which directly satisfies the requirement for private IP communication between the three networks. Cloud VPN with dynamic routing (E) is correct because it can link VPC networks in different projects and organizations over an encrypted tunnel using Cloud Router and BGP, providing private IP connectivity when peering is not feasible or when cross-organization transit is needed. Cloud Interconnect (A) is not appropriate here because it provides dedicated physical connectivity between on-premises networks and GCP, not VPC-to-VPC connectivity between projects. Shared VPC (C) does not apply because it only shares subnets within a single organization and cannot span a different organization. VPC Network Peering hub-and-spoke topology (B) is not a distinct GCP solution and, more importantly, VPC peering is non-transitive, so a hub-and-spoke design would not by itself provide full private communication among all three networks.

Answer

Cloud Interconnect

Answer

VPC Network Peering hub-and-spoke topology

Answer

Shared VPC

Question 16

Which THREE factors should be considered when designing a Cloud VPN for high availability? (Choose 3.)

Accepted Answer

Enable BGP for dynamic routing. Option A (Enable BGP for dynamic routing) is correct because BGP allows Cloud Router to dynamically exchange routes with the on-premises peer, so if one tunnel fails, traffic is automatically rerouted to the remaining healthy tunnel without manual intervention. Option B (Deploy VPN gateways in different regions) is correct because placing HA VPN gateways in separate regions protects against a regional outage, ensuring that a failure in one region does not take down the entire VPN connectivity. Option C (Use two tunnels from each VPN gateway) is correct because each HA VPN gateway provides 99.99% availability only when at least two tunnels (each on a different interface with its own external IP) are configured, allowing one tunnel to fail while the other continues to carry traffic. Option D is not correct because static routes do not automatically fail over when a tunnel goes down; they require manual reconfiguration and cannot react to dynamic topology changes. Option E is not correct because a single Cloud Router is a single logical component and does not by itself provide redundancy across regions; high availability requires multiple gateways/tunnels and dynamic routing, not simplification to one router.

Answer

Use static routes for failover

Answer

Use a single Cloud Router for simplicity

Question 17

Refer to the exhibit. A network engineer reviews the firewall rules in a VPC. What is the most significant security concern?

Accepted Answer

SSH is allowed from any source.. Allowing SSH (TCP/22) from any source (0.0.0.0/0) exposes the VPC instances to brute-force attacks, unauthorized access, and potential compromise. This violates the principle of least privilege and is a critical security misconfiguration in a VPC firewall rule.

Answer

There is no deny rule.

Answer

RDP is allowed from 10.0.0.0/8.

Answer

Firewall rules are not in order.

Question 18

A company has Compute Engine instances without external IP addresses that need to access external APIs. The instances are in multiple zones within a region, and each zone has a subnet. The company wants a cost-effective and highly available solution that does not require manual failover. What should they do?

Accepted Answer

Create a Cloud NAT gateway in each zone and configure region-specific NAT rules.. A Cloud NAT gateway per zone provides highly available outbound connectivity for instances without external IPs. By placing a gateway in each zone, traffic from instances in that zone uses the local gateway, avoiding cross-zone hops and ensuring automatic failover if a zone fails. This meets the cost-effective and no-manual-failover requirements without needing instance-level external IPs.

Answer

Create a Cloud NAT gateway in one zone and configure an instance tag-based route to the gateway.

Answer

Enable Private Google Access on the subnets and configure a Cloud NAT gateway in one zone.

Answer

Assign external IP addresses to each instance and create appropriate firewall rules.

Question 19

An organization is connecting their on-premises data center to GCP using Dedicated Interconnect with multiple VLAN attachments. They have configured Cloud Router with BGP sessions for each VLAN attachment. They notice that traffic from GCP to on-premises is not load-balanced across the attachments; instead, all traffic uses a single link. What is the most likely cause?

Accepted Answer

Cloud Router's BGP is not configured for multipath; it selects only one best path per prefix.. Cloud Router uses BGP to exchange routes with the on-premises router. By default, BGP selects only a single best path per prefix based on the lowest MED, weight, local preference, AS-path length, or IGP metric. Without BGP multipath enabled (e.g., 'maximum-paths' or 'bgp multipath' configuration), Cloud Router will not load-balance traffic across multiple VLAN attachments even if multiple equal-cost paths are available. This causes all traffic to egress through a single link.

Answer

The on-premises router is not advertising the same routes over all BGP sessions.

Answer

The VLAN attachments have different bandwidths, causing BGP to prefer the higher bandwidth link.

Answer

The BGP keepalive timers are misconfigured, causing session flapping.

Question 20

An organization has Compute Engine instances in a VPC without external IP addresses. They need to allow these instances to access Google Cloud Storage buckets but not the internet. What should they configure?

Accepted Answer

Enable Private Google Access on the subnets where the instances reside.. Private Google Access allows Compute Engine instances without external IP addresses to reach Google APIs and services, including Cloud Storage, through the VPC network's default route to the internet gateway, but only to Google's published IP ranges. This is the correct solution because it provides the required access without exposing the instances to the general internet.

Answer

Set up Cloud NAT and configure a firewall rule to allow egress to Google Cloud Storage IP ranges.

Answer

Peer the VPC with the Google Cloud Storage service VPC.

Answer

Create an egress firewall rule allowing traffic to 0.0.0.0/0 and a route to the default internet gateway.