PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 10 — 15 Questions

Question 1

A company is using Partner Interconnect with a 2 Gbps VLAN attachment. They notice that throughput is only about 500 Mbps during peak hours. They have verified that the on-premises link is not saturated. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VLAN attachment is configured with a lower bandwidth cap. Partner Interconnect VLAN attachments have a maximum throughput that depends on the partner's capability. If the throughput is lower than expected, it may be due to the partner limiting the bandwidth or the VLAN attachment configuration. However, a common cause is that the BGP session's route advertisement or Cloud Router configuration is not using multiple paths. Another possibility: the traffic is not using the VLAN attachment because of routing preferences. But given the scenario, the most plausible cause is that the VLAN attachment is configured with a lower bandwidth limit than the physical link.

Answer

Cloud Router is not using the partner's ASN

Answer

The VPC MTU is set to 1500 bytes

Answer

The on-premises router does not support BGP multipath

Question 2

A company is planning to connect multiple VPCs in different projects to a common on-premises network using a hub-and-spoke topology. They want to use Network Connectivity Center (NCC). Which TWO components are required to set up this topology?

Accepted Answer

NCC hub. NCC uses a hub (NCC hub) and spokes (VPC spokes). Spokes are VPCs that connect to the hub. The hub acts as a central point for routing.

Answer

VPC Network Peering

Answer

Dedicated Interconnect VLAN attachments

Answer

Cloud Router

Question 3

A company wants to set up a hybrid network with HA VPN between an on-premises network and GCP. They need a 99.99% SLA. Which THREE conditions must be met to achieve this SLA?

Accepted Answer

Two or more tunnels established with BGP sessions. To achieve a 99.99% SLA with HA VPN, you need at least two tunnels, each with a separate external IP on the GCP side, and the on-premises gateway must have two distinct public IP addresses. Unique pre-shared keys per tunnel are recommended for security but are not a requirement for the SLA.

Answer

Cloud Router configured with global dynamic routing mode

Answer

Two Cloud VPN gateways in GCP, each with one interface

Answer

Each tunnel uses a unique IKE pre-shared key

Question 4

A network engineer needs to design a DNS architecture for a hybrid cloud environment. The requirements: on-premises hosts must resolve GCP private zone names, and GCP instances must resolve on-premises DNS names. Which TWO Cloud DNS features should they use?

Accepted Answer

Outbound DNS server policy. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS. Outbound DNS server policy allows GCP to forward queries to on-premises DNS.

Answer

Split-horizon DNS

Answer

DNS managed zone with forwarding

Answer

DNS peering

Question 5

A company is creating a new VPC to host a set of microservices on Compute Engine. The network architect wants to minimize operational overhead and allow automatic subnet creation as new regions are added. Which VPC mode should be used?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region as they become available, reducing operational overhead. Custom mode requires manual subnet creation.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 6

An organization has two VPCs, VPC-A and VPC-B, in the same project. They need to allow communication between instances in these VPCs without using the public internet. The solution must support dynamic routes and be non-transitive. What should they configure?

Accepted Answer

Configure VPC Network Peering between the two VPCs. VPC Network Peering allows direct connectivity between two VPCs with non-transitive peering. It supports dynamic routes via custom route exchange and does not use the internet.

Answer

Add a route in each VPC pointing to the other's subnet via the default internet gateway

Answer

Create a VPN tunnel between VPC-A and VPC-B

Answer

Use Shared VPC with a host project and attach both VPCs as service projects

Question 7

A company is planning to connect their on-premises data center to Google Cloud using a Dedicated Interconnect. They require 20 Gbps of total bandwidth and want to achieve the highest SLA. What is the minimum number of 10 Gbps connections needed?

Accepted Answer

Two 10 Gbps links. Dedicated Interconnect offers 10 Gbps or 100 Gbps per link. To achieve 20 Gbps, at least two 10 Gbps links are needed. For the highest SLA (99.99%), two connections are required (one must be redundant).

Answer

One 10 Gbps link and one Partner Interconnect 10 Gbps link

Answer

One 100 Gbps link

Answer

Four 10 Gbps links

Question 8

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

Accepted Answer

MED (Multi-Exit Discriminator). MED (Multi-Exit Discriminator) is used to influence inbound route preference. A lower MED value is preferred. Setting a lower MED for the specific subnet will make it preferred over the less specific route.

Answer

Local preference

Answer

AS path prepend

Answer

Weight

Question 9

A company wants to use Cloud DNS to resolve DNS queries from their on-premises network for a private zone that contains internal GCP resource names. They do not want to manage DNS servers on-premises. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS server policy. Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS private zones, enabling resolution without managing on-premises DNS servers.

Answer

Private DNS zone

Answer

Outbound DNS server policy

Answer

DNS peering

Question 10

An organization has multiple VPCs in different projects that need to share subnets to create a common network segment. They want central control over network administration while allowing individual project teams to deploy resources. Which approach should they use?

Accepted Answer

Shared VPC with a host project and service projects. Shared VPC allows a host project to share subnets with service projects, providing central network administration while allowing teams to deploy resources independently.

Answer

VPN tunnels connecting all VPCs

Answer

VPC Network Peering between all VPCs

Answer

Creating a single VPC in one project and granting IAM permissions to other projects

Question 11

A company is designing a hybrid network using HA VPN with two external IP VPN gateways and four IKEv2 tunnels with BGP dynamic routing. They want to maintain connectivity during a zonal failure. What is the minimum number of Cloud VPN gateways needed in GCP?

Accepted Answer

1 Cloud VPN gateway. HA VPN uses two external IP addresses on a single gateway, one in each zone. One gateway supports two IPs and four tunnels, meeting the requirement with 99.99% SLA.

Answer

8 Cloud VPN gateways

Answer

4 Cloud VPN gateways

Answer

2 Cloud VPN gateways

Question 12

A network engineer needs to create a private Google Kubernetes Engine (GKE) cluster with a secondary IP range for pods and another for services. They must ensure the pod CIDR does not conflict with any VPC subnets or on-premises ranges. Which step is essential during cluster creation?

Accepted Answer

Specify the pod and service secondary IP ranges using the --cluster-secondary-range-name and --service-secondary-range-name flags. GKE clusters can specify secondary IP ranges for pods and services during creation. To avoid conflicts, the engineer must explicitly define these ranges using the --cluster-secondary-range-name and --service-secondary-range-name flags.

Answer

Create the cluster in a Shared VPC with automatic subnet creation

Answer

Use VPC-native GKE without secondary ranges

Answer

Use the default pod and service ranges provided by GKE

Question 13

A company needs to connect multiple on-premises sites and cloud VPCs in a hub-and-spoke topology using a fully managed service. Which Google Cloud service should they use?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) provides a hub-and-spoke model for connecting on-premises networks and VPCs, reducing configuration complexity.

Answer

VPC Network Peering

Answer

Cloud Interconnect

Answer

Cloud VPN

Question 14

An organization uses Classic VPN with static routing to connect to GCP. They now need to add a new subnet in GCP and ensure on-premises traffic can reach it without manual updates. What should they do?

Accepted Answer

Convert the Classic VPN to HA VPN with dynamic routing (BGP). Classic VPN supports policy-based routing with static routes. To handle new subnets automatically, they should migrate to HA VPN with dynamic routing (BGP), which advertises routes via BGP.

Answer

Add a static route for the new subnet on the Classic VPN tunnel

Answer

Use Cloud Router with the Classic VPN

Answer

Create a new Classic VPN tunnel for the new subnet

Question 15

A company is planning a hybrid connectivity solution with 200 Gbps total bandwidth between their data center and Google Cloud. They need the highest SLA and lowest latency. Which combination of services would meet these requirements?

Accepted Answer

Two 100 Gbps Dedicated Interconnect connections. Dedicated Interconnect provides up to 100 Gbps per link. To achieve 200 Gbps, they need two 100 Gbps connections. Two connections provide redundancy and the 99.99% SLA.

Answer

One 100 Gbps Dedicated Interconnect and one 100 Gbps Partner Interconnect

Answer

Twenty 10 Gbps Dedicated Interconnect connections

Answer

Four 50 Gbps Partner Interconnect connections