PCNE Designing, Planning, and Prototyping a GCP Network — 30 Questions

Question 1

A company has deployed a Global External HTTP(S) Load Balancer with a backend service that points to an instance group in us-central1. The load balancer's frontend uses a reserved static external IP address. Users in Europe report high latency, while users in Asia cannot reach the application at all. The application works fine when accessed directly via the instance group's internal IPs from within us-central1. Which action should be taken to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the load balancer to a regional load balancer and deploy additional instance groups in other regions.. The Global External HTTP(S) Load Balancer distributes traffic to backends across regions, but if the backend is only in us-central1, users far away experience high latency and, in some cases, cannot reach the application due to network distance or peering issues. The recommended solution is to use regional load balancers with backend instance groups in each region where users are located. This ensures low latency and high availability globally.

Answer

Enable Cloud CDN on the backend service to cache content closer to users.

Answer

Configure a DNS A record for the load balancer's IP address with a low TTL.

Answer

Ensure the backend service's 'Enable Global Access' checkbox is selected in the instance group's network settings.

Question 2

Which THREE of the following are required to set up a highly available Cloud VPN with dynamic routing? (Choose THREE.)

Accepted Answer

A Cloud Router with BGP configured for each tunnel.. A is correct because Cloud Router with BGP is required for dynamic routing and route exchange. D is correct because HA VPN requires two VPN tunnels, one from each gateway to the on-premises router, to provide redundancy. E is correct because each gateway needs a unique external IP for the tunnels. B is incorrect because the two gateways must be in the same region (different zones), not different regions.

Answer

Two Cloud VPN gateways in different regions.

Answer

Redundant on-premises VPN gateways.

Question 3

A company has a complex on-premises network with multiple BGP AS numbers. They are connecting to GCP using Cloud VPN and wish to advertise specific prefixes. They want to ensure that only selected on-prem prefixes are advertised to GCP and no other prefixes leak. What is the best approach?

Accepted Answer

Use route advertisements from on-prem routers and rely on GCP's route import policy. Cloud Router allows you to configure inbound BGP route filtering using route import policies (BGP prefix filters). By applying these filters, you can specify which on-premises prefixes are accepted, ensuring only selected prefixes are learned by GCP. This prevents unwanted prefix leaks and gives you direct control over what enters your VPC from the on-premises network via Cloud VPN. Custom advertised route maps control outbound advertisements from GCP, not inbound filtering.

Answer

Configure Cloud Router with custom advertised route maps to filter prefixes

Answer

Use VPC firewall rules to restrict incoming traffic

Answer

Set up a separate Cloud Router for each prefix

Question 4

Which TWO services can be used to provide outbound connectivity to the internet for private VMs in a VPC? (Assume VMs have no external IPs.)

Accepted Answer

Instance with external IP. Both options A and D provide outbound internet connectivity for private VMs (without external IPs) in a VPC. Option A, an instance with an external IP, can be configured as a NAT gateway or proxy to forward traffic from private VMs to the internet. Option D, Cloud NAT, is a managed service that uses source network address translation (SNAT) to enable private VMs to reach the internet without assigning external IPs to the VMs. Private Google Access (C) only provides access to Google APIs and services, not general internet. Cloud Router (B) is used for dynamic routing with VPN or Interconnect, and Cloud VPN (E) creates encrypted tunnels but does not provide NAT functionality.

Answer

Cloud Router

Answer

Private Google Access

Answer

Cloud VPN

Question 5

Refer to the exhibit. A network engineer checks the BGP status of a Cloud Router. The on-prem router has two BGP peers configured. What is the most likely cause of the IDLE session for the second peer?

Accepted Answer

The peer router's firewall is blocking TCP port 179. The IDLE state in BGP indicates that the session has not been established or has been reset. Since the on-prem router has two BGP peers and only one is IDLE, a per-peer issue like a firewall blocking TCP port 179 on the second peer's router is the most likely cause. This prevents the TCP three-way handshake required for BGP session establishment, leaving the session stuck in IDLE.

Answer

The VLAN attachment is not configured

Answer

The BGP timers are misconfigured

Answer

The peer router is not configured with the correct BGP ASN

Question 6

A company is designing a global application that requires low-latency access to GCP services like Cloud Storage and BigQuery. They also need to minimize egress costs for traffic to the internet. Which network service tier should they choose for their GCP resources?

Accepted Answer

Premium Tier for all resources. Premium Tier routes traffic over Google's global network backbone, providing lower latency and higher performance for accessing GCP services like Cloud Storage and BigQuery. While Standard Tier has lower egress costs to the internet, it uses public internet routing, which would increase latency and not meet the low-latency requirement. Therefore, for a global application needing low-latency access to GCP services, Premium Tier is the appropriate choice.

Answer

Use a CDN to reduce latency and no specific tier

Answer

Premium Tier for Compute Engine instances and Standard Tier for Cloud Storage

Answer

Standard Tier for all resources

Question 7

An organization uses Shared VPC with a host project and multiple service projects. They want to allow a service project team to create Compute Engine instances using a specific subnet, but not manage other subnets. Which IAM role should they grant at the subnet level?

Accepted Answer

roles/compute.networkUser. The roles/compute.networkUser role grants read-only access to VPC networks, subnets, and firewall rules, and allows the creation of resources like Compute Engine instances on a specific subnet without granting management permissions over other subnets. This is the correct choice because it provides the minimum required permissions for a service project team to use a designated subnet while preventing them from modifying or viewing other subnets in the host project.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/compute.networkAdmin

Answer

roles/iam.securityAdmin

Question 8

A company uses Cloud DNS to manage their domain example.com. They want to resolve queries for example.com from their on-premises DNS servers without transferring the zone. Which Cloud DNS feature should they use?

Accepted Answer

DNS forwarding (outbound). To allow on-premises DNS servers to resolve Cloud DNS private zones without zone transfer, use an inbound DNS forwarding server policy. This policy forwards DNS queries from on-premises networks (connected via Cloud VPN or Dedicated Interconnect) to the VPC's Cloud DNS resolver, enabling resolution of private zones. Although the option lists 'outbound', the correct feature is inbound DNS forwarding, which is a type of DNS forwarding server policy.

Answer

Managed reverse lookup zone

Answer

DNS peering

Answer

Private zone with VPC network binding

Question 9

A company has two VPCs (Production and Development) that are peered. The Development VPC has a custom route to an on-premises network via a VPN tunnel. They want the Production VPC to automatically learn this route. What must be configured on the VPC peering?

Accepted Answer

Enable 'export custom routes' on Development VPC and 'import custom routes' on Production VPC.. For the Production VPC to automatically learn custom routes from the Development VPC, the Development VPC must enable 'export custom routes' on the peering, and the Production VPC must enable 'import custom routes' on the peering. This allows the route to the on-premises network to be propagated.

Answer

Enable 'export custom routes' on Production VPC and 'import custom routes' on Development VPC.

Answer

Enable 'import custom routes' on both VPCs.

Answer

Enable 'export custom routes' on both VPCs.

Question 10

An organization wants to use Cloud Router with BGP to advertise a specific on-premises subnet (10.0.1.0/24) to its GCP VPC. Which BGP attribute should they use to influence route selection if multiple paths exist?

Accepted Answer

Multi-Exit Discriminator (MED). The Multi-Exit Discriminator (MED) is used to influence inbound route selection from the perspective of the receiving AS. In this scenario, the on-premises network advertises the subnet 10.0.1.0/24 to GCP via Cloud Router. If there are multiple paths from the on-premises side to GCP (e.g., via different Cloud Routers or different on-premises routers), the on-premises router can set a lower MED value on the preferred path to suggest that GCP should use that path. MED is exchanged between ASes and is a hint to the receiving AS.

Answer

Weight

Answer

Local Preference

Answer

AS Path

Question 11

An organization wants to isolate development and production environments using separate VPC networks within the same project. They need the development VPC to have access to a shared service, such as a Cloud SQL instance, which resides in a separate project. Which THREE actions are required to achieve this? (Choose THREE.)

Accepted Answer

Configure Shared VPC with the Cloud SQL project as the host project. To allow a development VPC in one project to privately access a Cloud SQL instance in a separate project, the recommended approach is to use Shared VPC. The project containing the Cloud SQL instance becomes the host project (A). Private Services Access must be enabled on the host VPC to allocate private IP addresses for the Cloud SQL instance (D). The development project is then attached as a service project to the shared VPC host project, allowing the development VPC to use subnets from the host project and thereby reach the Cloud SQL instance privately (E). VPC peering is not required because Shared VPC provides the connectivity. Firewall rules are needed but not sufficient alone; the correct three actions are A, D, and E.

Answer

Create a firewall rule allowing ingress from the Cloud SQL instance to the development VPC

Answer

Configure VPC Network Peering between the development VPC and the Cloud SQL VPC

Question 12

A company is migrating workloads to Google Cloud and wants to use Cloud Interconnect for low-latency connectivity. They have two on-premises locations and need to connect to multiple GCP regions. Which two statements are true about using VLAN attachments with Dedicated Interconnect? (Choose TWO.)

Accepted Answer

Multiple VLAN attachments can be created over a single physical interconnect link.. True: multiple VLAN attachments can be created over a single physical interconnect link using different VLAN IDs. Option B is true: VLAN attachments are used with both Dedicated and Partner Interconnect to provide connectivity to Google Cloud. Option C is false because each VLAN attachment is regional and cannot span multiple geographic regions. Option D is false because while each VLAN attachment is associated with a single Cloud Router, this statement is not one of the two correct ones—the key differentiators are the ability to create multiple attachments per link and the support for both interconnect types. Option E is false because a VLAN attachment connects to a single VPC, not multiple.

Answer

A VLAN attachment can span multiple geographic regions.

Answer

Each VLAN attachment connects to a single Cloud Router.

Answer

A single VLAN attachment can connect to multiple VPCs.

Question 13

Your company is deploying a multi-tier web application on Google Kubernetes Engine (GKE) with a regional cluster. You need to design network policies to allow traffic only from the frontend pods to the backend pods on port 8080. Which of the following is the most secure and recommended approach?

Accepted Answer

Define a Kubernetes NetworkPolicy that allows ingress to backend pods from frontend pods on port 8080.. A Kubernetes NetworkPolicy is the native and most secure way to control pod-to-pod traffic within a GKE cluster. By defining an ingress rule that allows traffic only from frontend pods (selected via pod labels) to backend pods on TCP port 8080, you enforce micro-segmentation at the pod level, which is the recommended practice for multi-tier applications. This approach works regardless of the underlying node or VPC configuration and is fully integrated with GKE's network policies engine (Calico or Cilium).

Answer

Configure Private Service Connect to restrict access to backend pods.

Answer

Create VPC firewall rules to allow ingress from frontend pods to backend pods on port 8080.

Answer

Use Cloud Armor security policies to restrict traffic to backend pods.

Question 14

A company is designing a hybrid connectivity solution between an on-premises data center and Google Cloud. They have a high bandwidth requirement of 20 Gbps and need a service level agreement (SLA) of 99.99% availability. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect with two 10 Gbps connections. Dedicated Interconnect provides direct, private connections between your on-premises network and Google Cloud, supporting up to 10 Gbps per circuit. By using two 10 Gbps connections in an active-active or active-passive configuration, you can achieve the required 20 Gbps aggregate bandwidth and meet the 99.99% SLA, as Google guarantees this SLA when you have at least two redundant connections.

Answer

Cloud VPN with two tunnels each using 1 Gbps

Answer

Direct Peering

Answer

Partner Interconnect with two 10 Gbps connections

Question 15

A network engineer needs to design a VPC network for a global application that will have Compute Engine instances in multiple regions. The instances need to communicate with each other using internal IP addresses. What is the simplest way to enable this communication?

Accepted Answer

Create a single VPC network with subnets in each region.. A single VPC network is global and can contain subnets in any region. By placing subnets in each required region within the same VPC, instances can communicate using internal IP addresses (RFC 1918) without any additional connectivity services. This is the simplest and most scalable approach because VPCs inherently provide global routing between subnets.

Answer

Use Dedicated Interconnect to connect regions.

Answer

Use Cloud VPN to connect the instances.

Answer

Create separate VPC networks per region and peer them.

Question 16

Which TWO of the following are valid methods to reduce latency between users in Europe and a GCP-hosted application?

Accepted Answer

Use Cloud CDN to cache content at edge locations.. Cloud CDN uses Google's globally distributed edge caches to serve content from locations closer to users, reducing round-trip time and latency. For users in Europe, cached static or dynamic content is delivered from a nearby edge PoP, bypassing the need to fetch from the origin server in a potentially distant region.

Answer

Establish a Cloud VPN tunnel to the user's ISP.

Answer

Use Premium Tier networking instead of Standard Tier.

Answer

Use Cloud NAT for outbound traffic.

Question 17

Which THREE of the following are requirements for implementing a Global External HTTP(S) Load Balancer with an external backend?

Accepted Answer

The backend must support health checks from the load balancer's health check IP ranges.. Global External HTTP(S) Load Balancers use Google's frontend (proxying) IP ranges to send health checks to backends. The backend must allow inbound traffic from these specific health check IP ranges (e.g., 35.191.0.0/16 and 130.211.0.0/22) to receive health probes; otherwise, the load balancer will mark the backend as unhealthy and stop forwarding traffic.

Answer

The backend must be configured with Private Google Access.

Answer

The backend must have an SSL certificate installed.

Question 18

A network engineer is troubleshooting connectivity from a Compute Engine instance in subnet-a to a Google Cloud Storage bucket. The instance has no external IP address. Based on the exhibit, what is the most likely cause of the connectivity issue?

Accepted Answer

Private Google Access is disabled on the subnet.. The instance has no external IP address, so it must use Private Google Access to reach Google APIs and services like Cloud Storage. Private Google Access is enabled at the subnet level; if it is disabled, the instance cannot route traffic to the Google API VIPs through the default route (0.0.0.0/0) without a NAT gateway or external IP. Option B correctly identifies this as the most likely cause.

Answer

The subnet purpose is PRIVATE, which blocks Google APIs.

Answer

The subnet CIDR range is too small.

Answer

Flow logs are disabled, so traffic is not logged.

Question 19

Based on the exhibit, what is the purpose of Cloud Router's BGP configuration?

Accepted Answer

To advertise the VPC's IP range to the on-premises network.. Cloud Router uses BGP to dynamically exchange routes between a VPC network and an on-premises network over a VPN tunnel or Dedicated Interconnect. In this configuration, the purpose is to advertise the VPC's IP range (the custom or auto-mode subnet CIDR) to the on-premises router, enabling on-premises hosts to route traffic back to the VPC. This is achieved by configuring the Cloud Router with a BGP session and setting the advertised route for the VPC's IP range.

Answer

To load balance traffic across multiple VPN tunnels.

Answer

To receive a default route from the on-premises network.

Answer

To advertise a default route to the on-premises network.

Question 20

A company has a VPC with subnets in us-east1 and europe-west1. They have a Compute Engine instance in us-east1 with an internal IP 10.0.1.2. They need to allow SSH (port 22) from a specific on-premises IP 203.0.113.5 via Cloud VPN. The Cloud VPN tunnel uses a Cloud Router with BGP. The on-premises network advertises the route for 203.0.113.5/32 to the Cloud Router. Which firewall rule must be created?

Accepted Answer

Ingress rule: source 203.0.113.5/32, destination 10.0.1.2/32, tcp:22. Firewall rules in GCP are stateful and applied at the instance level, not the VPN tunnel. The rule must allow ingress traffic from the on-premises source IP (203.0.113.5/32) to the Compute Engine instance's internal IP (10.0.1.2/32) on TCP port 22. The Cloud VPN and Cloud Router handle routing, but the firewall rule explicitly defines the allowed traffic flow.

Answer

Ingress rule: source 203.0.113.5/32, destination 169.254.0.1/32, tcp:22

Answer

Ingress rule: source 10.0.1.2/32, destination 203.0.113.5/32, tcp:22

Answer

Ingress rule: source 0.0.0.0/0, destination 203.0.113.5/32, tcp:22