PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 11 — 15 Questions

Question 1

A company wants to resolve DNS queries from their on-premises DNS servers for a private zone hosted in Cloud DNS. They also need GCP resources to resolve on-premises hostnames. Which combination of Cloud DNS features should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Both inbound and outbound DNS server policies. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS private zones. Outbound DNS server policy allows GCP to forward queries to on-premises DNS servers.

Answer

Outbound DNS server policy only

Answer

DNS peering with the on-premises network

Answer

Inbound DNS server policy only

Question 2

A company is designing a Shared VPC environment with a host project and several service projects. Which two steps are required to allow a service project team to create Compute Engine instances with internal IP addresses from a shared subnet?

Accepted Answer

Ensure the host project and service project are in the same organization. To use a shared subnet, the host project must grant the service project's Compute Engine service account the necessary IAM role on the subnet. The service project team must also have permissions to use the subnet.

Answer

Create a VPC peering connection between the host and service projects

Answer

Grant the service project's network team the roles/compute.networkAdmin role on the host project

Answer

Assign the roles/compute.securityAdmin role to the service project team

Question 3

A company uses VPC Network Peering between VPC-A (project X) and VPC-B (project Y). They want resources in VPC-A to reach resources in VPC-B, but also need VPC-A to reach an on-premises network connected to VPC-B via Dedicated Interconnect. Which two steps must be configured?

Accepted Answer

Configure VPC-A to import custom routes from VPC-B. By default, VPC peering is non-transitive, so VPC-A cannot reach on-premises through VPC-B. To enable this, VPC-B must export custom routes to VPC-A, and the on-premises network's routes must be learned via BGP on Cloud Router in VPC-B.

Answer

Create a separate VPN tunnel between VPC-A and the on-premises network

Answer

Enable global routing mode in both VPCs

Answer

Configure VPC-A to advertise its subnets to VPC-B

Question 4

A company is designing IP address plans for multiple VPCs that will be connected via VPC Network Peering and to an on-premises network via HA VPN with dynamic routing. Which three practices should be followed to avoid IP address conflicts?

Accepted Answer

Reserve IP ranges for future VPCs and on-premises expansion. To avoid overlap, use unique private IP ranges per VPC, plan for future growth, and document all ranges. Using RFC 1918 addresses and avoiding overlapping CIDRs ensures successful peering and VPN connectivity.

Answer

Use only public IP addresses for all GCP resources

Answer

Use the same IP range for all VPCs to simplify management

Question 5

A startup is creating a new VPC for their production environment. They want to minimize management overhead and plan to use multiple regions. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region and manage IP ranges, reducing management overhead. Custom mode requires manual subnet creation.

Answer

Custom mode VPC

Answer

Shared VPC

Answer

VPC Network Peering

Question 6

An organization wants to connect two VPCs in different projects so that they can communicate using private IPs. The connection must not be transitive. Which solution meets these requirements?

Accepted Answer

VPC Network Peering. VPC Network Peering directly connects two VPCs and is non-transitive by default.

Answer

Cloud Interconnect

Answer

Shared VPC

Answer

Cloud VPN

Question 7

A company is planning a hybrid cloud architecture with GCP. They need a dedicated, high-bandwidth connection from their on-premises data center to GCP with 99.99% SLA and the ability to scale beyond 10 Gbps. Which connection type should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between an on-premises data center and Google Cloud, supporting speeds of 10 Gbps or 100 Gbps per link. It offers a 99.99% SLA when configured with redundant links (two circuits) and can scale beyond 10 Gbps by adding additional 10 Gbps or 100 Gbps connections, meeting the requirement for high bandwidth and high availability.

Answer

Classic VPN

Answer

HA VPN

Answer

Partner Interconnect

Question 8

You are configuring Cloud Router for BGP sessions with an on-premises router. You need to ensure that the on-premises network can reach Google Cloud services using the advertiser’s IP addresses. Which option should you configure on the Cloud Router?

Accepted Answer

Advertise all subnets visible by the Cloud Router. Cloud Router must advertise all subnets visible to it to ensure that the on-premises router learns the IP prefixes for Google Cloud services (e.g., Google APIs, GKE control planes) that are reachable via Private Google Access or Private Service Connect. By default, Cloud Router only advertises VPC subnet routes; enabling 'Advertise all subnets visible by the Cloud Router' includes custom IP ranges and service producer ranges, allowing the on-premises network to route traffic to those services using the advertiser's IP addresses.

Answer

Set the global routing mode

Answer

Configure custom route exchange in VPC Peering

Answer

Enable VPC Flow Logs

Question 9

A company has a GKE cluster with pods and services that need to communicate with on-premises resources over a VPN. The on-premises firewall requires the source IP of the pods to be from a specific range. Which secondary IP ranges should be configured on the VPC subnet?

Accepted Answer

Secondary pod range and secondary service range. In GKE, pods are assigned IP addresses from the secondary pod range, and services (of type ClusterIP) are assigned IPs from the secondary service range. For on-premises resources to allow traffic from pods via a VPN, the firewall must see the pod IPs (not node IPs), so the secondary pod range must be configured on the VPC subnet. The secondary service range is also required for service discovery and proper routing, but the source IP seen by on-premises will be the pod IP from the secondary pod range.

Answer

Primary IP range and secondary pod range

Answer

Only the secondary service range

Answer

Primary IP range and secondary service range

Question 10

You are designing DNS resolution for a hybrid cloud. On-premises DNS servers must resolve GCP private VM hostnames, and GCP VMs must resolve on-premises hostnames. Which Cloud DNS feature should you use?

Accepted Answer

DNS forwarding (inbound and outbound). DNS forwarding with inbound and outbound policies is the correct choice because it enables bidirectional resolution between on-premises and GCP VMs. Outbound forwarding sends queries from GCP to on-premises DNS servers, while inbound forwarding allows on-premises clients to resolve GCP private VM hostnames by forwarding queries to Cloud DNS. This creates a seamless hybrid DNS namespace without exposing private zones to the internet.

Answer

DNS peering

Answer

Cloud DNS public zones

Answer

Split-horizon DNS

Question 11

A company needs to connect multiple VPCs in different projects and regions to a common hub VPC for centralized inspection. They want to avoid complex mesh peering configurations. Which service should they use?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is the correct choice because it provides a hub-and-spoke topology that connects multiple VPCs across projects and regions to a central hub VPC for centralized inspection, without requiring complex mesh peering. NCC uses a software-defined networking (SDN) controller to manage inter-VPC connectivity and routing, enabling traffic to flow through the hub VPC for inspection appliances like firewalls or IDS/IPS.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 12

A company has two VPCs (Prod and Dev) that are peered. Both VPCs have routes to an on-premises network via separate Cloud VPN tunnels. The on-prem network has routes to both VPCs. The Dev VPC recently added a subnet that overlaps with an on-prem subnet. What is the likely impact on the Prod VPC?

Accepted Answer

Dev VPC cannot communicate with on-prem due to overlap. When the Dev VPC adds a subnet that overlaps with an on-premises subnet, Cloud VPN routes for that overlapping prefix become ambiguous. GCP Cloud Router uses dynamic routing (BGP) and will prefer the more specific route, but if the prefixes are identical, the route to the on-premises network via the Dev VPN tunnel may be withdrawn or become unreachable due to the conflict. This directly impacts the Dev VPC's ability to communicate with the on-premises network over the VPN, while the Prod VPC, with its non-overlapping subnet, remains unaffected.

Answer

No impact on either VPC

Answer

Prod VPC loses connectivity to the on-premises network

Answer

Prod VPC can now communicate with Dev VPC via on-prem

Question 13

An organization uses Dedicated Interconnect with VLAN attachments in multiple regions. They need to ensure that traffic from one region to another flows over the interconnect backbone instead of the internet. Which configuration is required?

Accepted Answer

Enable global routing mode on the VPC. C is correct because enabling global routing mode on the VPC allows the VPC to use the same Dedicated Interconnect VLAN attachments across all regions. With global routing, routes learned via BGP over the interconnect are propagated to every region, ensuring that inter-region traffic is forwarded through the interconnect backbone rather than the public internet. Without global routing, each region would have its own VPC and would not share the interconnect routes, causing traffic to egress via the internet.

Answer

Use Partner Interconnect instead

Answer

Configure Network Connectivity Center

Answer

Set BGP MED values on Cloud Router

Question 14

You are configuring an HA VPN tunnel between GCP and on-premises. The on-premises VPN device only supports IKEv1 and static routing. Which of the following is true regarding this setup?

Accepted Answer

Classic VPN must be used. HA VPN requires IKEv2 and dynamic routing (BGP). Classic VPN supports IKEv1 and static routing.

Answer

Partner Interconnect can be used instead

Answer

HA VPN can be used with static routing if you disable BGP

Answer

HA VPN can be configured with IKEv1 and static routes

Question 15

A company wants to resolve DNS queries for a private zone (e.g., example.internal) from multiple service projects using the same host project's Cloud DNS private zone. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows Cloud DNS private zones from one project (the host project) to be resolved by VPCs in other projects (service projects) without requiring Shared VPC or network connectivity. By setting up a DNS peering zone in each service project that targets the host project's private zone, DNS queries for example.internal are forwarded to the host project's authoritative DNS servers. This is the correct approach because it directly enables cross-project DNS resolution for private zones while keeping the zones managed centrally.

Answer

Shared VPC

Answer

DNS forwarding

Answer

Create a public zone