PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 12 — 15 Questions

Question 1

Which TWO statements are true about VPC Network Peering? (Choose 2)

Accepted Answer

You can export custom routes to a peered VPC.. VPC Network Peering allows you to export custom routes (including static and dynamically learned routes) to a peered VPC by enabling the 'Export custom routes' option on the peering connection. Option B is correct because peering is non-transitive: traffic cannot flow through an intermediate VPC to reach a third VPC; each peering connection is direct and isolated. Options C, D, and E are incorrect: global routing mode is a VPC-level setting, not a peering property; peering is never transitive by default; and peered VPCs must have non-overlapping IP ranges to avoid conflicts.

Answer

Peering supports global routing mode.

Answer

Peering is transitive by default.

Answer

Peered VPCs can have overlapping IP ranges.

Question 2

Which THREE are valid considerations when planning IP address ranges for VPCs that will be connected via VPC Peering and Cloud VPN? (Choose 3)

Accepted Answer

Plan for future growth by leaving unused CIDR blocks.. Avoid overlapping ranges, use RFC 1918 addresses, and ensure unique ranges for each subnet.

Answer

Use overlapping IP ranges to conserve address space.

Answer

Use public IP ranges for all VMs.

Question 3

A company is setting up HA VPN between GCP and on-premises. They want 99.99% SLA. Which TWO configurations are required? (Choose 2)

Accepted Answer

Four IKEv2 tunnels with BGP. The 99.99% SLA for Cloud HA VPN requires two interfaces on the Cloud VPN gateway, each with a unique external IP address (two external IPs total — option D). Additionally, each interface must have two tunnels, resulting in four tunnels total, and these tunnels must use IKEv2 and BGP dynamic routing (option B). Cloud Router with BGP is required for dynamic routing, but the two specific configurations from the options are two external IP addresses and four IKEv2 tunnels with BGP. Therefore, options B and D are correct.

Answer

One external IP address on the Cloud VPN gateway

Answer

Cloud Router configured with BGP

Answer

Static routing

Question 4

A startup is setting up their first GCP VPC. They want minimal manual configuration and need subnets in multiple regions. Which VPC creation mode should they use, and why?

Accepted Answer

Auto mode, because it automatically creates subnets in all regions with predefined IP ranges.. Auto mode VPCs automatically create a subnet in each region with predefined IP ranges, reducing manual effort. Custom mode requires manual subnet creation.

Answer

Auto mode, because it allows overlapping IP ranges with on-premises networks.

Answer

Custom mode, because it is the only mode that supports Shared VPC.

Answer

Custom mode, because it provides full control over IP ranges.

Question 5

An organization needs to connect two VPCs in different projects so that all subnets can communicate using internal IPs, but the connection must not be transitive (i.e., VPC A cannot use VPC B's connection to reach VPC C). Which GCP networking feature should they use?

Accepted Answer

VPC Network Peering. VPC peering is non-transitive and directly connects two VPCs. Shared VPC is transitive; VPN and Interconnect are for hybrid connectivity.

Answer

Cloud VPN

Answer

Shared VPC

Answer

Dedicated Interconnect

Question 6

A company has a GKE cluster that needs to be accessed by pods and services. The cluster is deployed in a VPC with a primary subnet 10.0.0.0/16. To avoid IP exhaustion, they want to use separate IP ranges for pods and services. Which approach should they take?

Accepted Answer

Create secondary IP ranges on the subnet for pods and services.. GKE supports secondary IP ranges for pods and services, which are defined on the subnet and allocated separately from the primary range.

Answer

Use a separate VPC for the GKE cluster with its own subnet.

Answer

Use the primary subnet range for pods and create a separate subnet for services.

Answer

Use alias IP ranges on the VM instances for pods and services.

Question 7

An enterprise is planning a Dedicated Interconnect connection to GCP. They require 99.99% availability and expect to use multiple VLAN attachments. What is the minimum number of 10 Gbps links and VLAN attachments needed to meet the availability goal?

Accepted Answer

Two 10 Gbps links and two VLAN attachments. To achieve 99.99% availability, Dedicated Interconnect requires at least two links (each 10 Gbps or 100 Gbps) in different edge availability domains, and at least two VLAN attachments.

Answer

Two 10 Gbps links and one VLAN attachment

Answer

One 100 Gbps link and one VLAN attachment

Answer

One 10 Gbps link and one VLAN attachment

Question 8

A network engineer is configuring HA VPN between an on-premises network and GCP. They have created two external VPN gateways in GCP (one per region) and two Cloud Routers. How many IKEv2 tunnels and BGP sessions are required to achieve the 99.99% SLA?

Accepted Answer

Four tunnels, four BGP sessions. HA VPN requires four tunnels (two per gateway) and four BGP sessions (one per tunnel) to achieve 99.99% SLA.

Answer

Two tunnels, two BGP sessions

Answer

Four tunnels, two BGP sessions

Answer

Two tunnels, four BGP sessions

Question 9

An engineer configures a Cloud Router with BGP to advertise a custom learned route for 10.0.0.0/8 to an on-premises router. The on-premises router also receives the same prefix from another path with a lower MED. Which route will the on-premises router prefer?

Accepted Answer

The route from the other path with lower MED. BGP route selection prefers the lowest MED value among routes received from the same neighboring AS. Since the on-premises router receives 10.0.0.0/8 from two paths, and the other path has a lower MED, that route will be preferred. The Cloud Router's advertisement with a higher MED will be less preferred, making option D correct.

Answer

Both routes are used for load balancing

Answer

The on-premises router will ignore MED and prefer the route with higher local preference

Answer

The route advertised by Cloud Router

Question 10

A company needs to connect multiple branch offices to GCP using Partner Interconnect. They need at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps. Which type of Partner Interconnect should they choose?

Accepted Answer

Single connection with 99.9% SLA. Partner Interconnect offers two SLA tiers: 99.9% for a single connection and 99.99% for dual connections. Since the requirement is at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps, a single connection with 99.9% SLA meets both criteria without the cost and complexity of dual connections.

Answer

Single connection with 99.99% SLA

Answer

Classic VPN

Answer

Dual connection with 99.99% SLA

Question 11

An organization wants to design IP addresses for their GCP VPC that will be peered with an on-premises network using 10.0.0.0/8. Which subnet IP range should they avoid to prevent overlap?

Accepted Answer

10.1.0.0/16. Both option A (10.1.0.0/16) and option C (10.0.0.0/8) overlap with the on-premises network using 10.0.0.0/8. Option A is a subset, and option C is the exact same range. Peering requires non-overlapping CIDR blocks, so both must be avoided.

Answer

192.168.0.0/16

Answer

172.16.0.0/12

Question 12

A company uses Shared VPC with a host project and several service projects. They want to allow only a specific team to create subnets in the host project, and another team to use those subnets in their service projects. Which IAM roles should be assigned?

Accepted Answer

Compute Network Admin on host project for subnet creators; Compute Network User on host project for subnet users.. To create subnets, a user needs the Compute Network Admin role on the host project. To use subnets, a user needs the Compute Network User role on the host project or specific subnets.

Answer

Compute Network Admin on host project for both teams.

Answer

Compute Shared VPC Admin on host project for subnet creators; Compute Network User on host project for subnet users.

Answer

Compute Network User on host project for subnet creators; Compute Network Admin on service projects for subnet users.

Question 13

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

Accepted Answer

DNS peering. DNS peering allows forwarding DNS queries from one VPC to another VPC's DNS for resolution, without zone transfer.

Answer

DNS forwarding (inbound)

Answer

Managed zone with cross-project binding

Answer

Global DNS configuration

Question 14

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. NCC supports both VPC spokes and hybrid spokes (VPN/Interconnect). It does not support direct VPC-to-VPC peering; that's VPC peering. Route propagation is automatic within NCC.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.

Question 15

An organization needs to design a hybrid connectivity solution with 99.99% availability for a mission-critical application. They have a co-location facility near a GCP region. Which THREE components are required to meet this SLA?

Accepted Answer

Two VLAN attachments. For 99.99% SLA with Dedicated Interconnect, you need two links in different edge availability domains, two VLAN attachments, and BGP sessions with Cloud Router.

Answer

One Dedicated Interconnect link with multiple VLAN attachments

Answer

Classic VPN as a backup