PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 13 — 15 Questions

Question 1

A developer wants to configure Cloud DNS for split-horizon DNS where internal queries resolve to private IPs and external queries resolve to public IPs. Which TWO steps should they take?

Accepted Answer

Create a public managed zone for the domain.. Split-horizon DNS is achieved by having a private zone for internal resolution and a public zone for external resolution, both authoritative for the same domain.

Answer

Set up DNS peering between the zones.

Answer

Configure the private zone with a VPC network binding.

Answer

Use DNS forwarding to on-premises servers.

Question 2

A startup is deploying its first application on Google Cloud and needs to create a VPC network. They want to avoid manual subnet planning and prefer that Google automatically creates subnets in each region as they expand. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region with predetermined IP ranges, simplifying initial setup. Custom mode VPCs require manual subnet creation.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 3

An organization wants to connect its on-premises data center to Google Cloud using Dedicated Interconnect. They require 99.99% availability SLA. Which configuration meets this requirement?

Accepted Answer

Two 10Gbps Dedicated Interconnect connections, each with its own VLAN attachment and BGP session, from the same provider. Dedicated Interconnect offers 99.99% SLA when you have two separate physical connections (each 10Gbps or 100Gbps) from the same provider, each with its own VLAN attachment and BGP session, and they are configured in a redundant manner.

Answer

A single 10Gbps Dedicated Interconnect connection with one VLAN attachment and one BGP session

Answer

A single 100Gbps Dedicated Interconnect connection with two VLAN attachments and two BGP sessions

Answer

Two Partner Interconnect connections with 99.9% SLA each

Question 4

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.0.0.0/16). They want to establish VPC Network Peering between them. What is the outcome?

Accepted Answer

Peering fails because subnets overlap. VPC Network Peering requires that the subnets in the two VPCs do not overlap. Since both VPCs use the same CIDR block (10.0.0.0/16), peering will fail due to subnet overlap.

Answer

Peering succeeds, and only non-overlapping subnets are used

Answer

Peering succeeds, and routes are exchanged, but traffic may be unpredictable

Answer

Peering succeeds, but routes are not exchanged

Question 5

An engineer needs to configure a Cloud Router for a VPN tunnel to an on-premises network. The on-premises BGP ASN is 64512. Which ASN should the engineer assign to the Cloud Router?

Accepted Answer

64513. Cloud Router requires a unique ASN (typically a private ASN from 64512-65534) that does not conflict with the on-premises ASN. The default ASN for Cloud Router is 64512, but it must be changed if the on-premises ASN is the same. The engineer should use a different private ASN, such as 64513.

Answer

64512

Answer

Any public ASN

Answer

0

Question 6

Which Google Cloud service allows you to create a hub-and-spoke topology for connecting on-premises networks and VPCs?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) provides a hub-and-spoke model to interconnect on-premises networks and VPCs centrally.

Answer

Cloud VPN

Answer

VPC Network Peering

Answer

Cloud Interconnect

Question 7

A company wants to resolve DNS queries from their on-premises network for Google Cloud private zones (e.g., example.internal) without duplicating DNS data. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS forwarding. Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS for resolution of private zones. This avoids the need to replicate zone data on-premises.

Answer

DNS peering

Answer

Private DNS zones

Answer

Outbound DNS forwarding

Question 8

An organization is migrating a legacy application to GCP. The application requires static routing and does not support BGP. Which VPN option should they use?

Accepted Answer

Classic VPN. Classic VPN supports static routing (policy-based or route-based) without BGP. Cloud VPN (HA VPN) and Partner Interconnect require BGP, and Dedicated Interconnect uses BGP for VLAN attachments.

Answer

Dedicated Interconnect

Answer

Partner Interconnect

Answer

HA VPN

Question 9

A company uses Shared VPC to grant separate teams access to subnets in a host project. They want to allow Team A to create VM instances in subnet-1, but not delete the subnet itself. Which IAM role should be granted to Team A on subnet-1?

Accepted Answer

roles/compute.networkUser. The Compute Network User role (roles/compute.networkUser) grants permissions to use existing networks and subnets (create VMs, attach disks, etc.) but not to delete or modify network resources.

Answer

roles/owner

Answer

roles/compute.networkAdmin

Answer

roles/compute.instanceAdmin.v1

Question 10

Which IP address type in Google Cloud can communicate with the internet but is not reachable from the internet?

Accepted Answer

Internal IP address. Private IP addresses (RFC 1918) are used for internal communication within a VPC and cannot be directly reached from the internet. They can access the internet via Cloud NAT or a VM with a public IP.

Answer

Public IP address

Answer

External IP address

Answer

Ephemeral IP address

Question 11

An engineer is troubleshooting a VPC Network Peering connection between VPC-A and VPC-B. They have verified that the peering is active. However, an instance in VPC-A cannot reach an instance in VPC-B using its internal IP. Both VPCs have firewall rules allowing the traffic. What is the most likely cause?

Accepted Answer

Custom routes are not being exchanged between the VPCs. When VPC Network Peering is active but traffic fails, the most common cause is that custom routes are not being exchanged. By default, only subnet routes are exchanged; custom routes (e.g., static routes or routes from VPNs) are not shared unless explicitly configured using the 'export custom routes' option in the peering settings. Without this, the instance in VPC-A has no route to the internal IP of the instance in VPC-B, even if firewall rules allow the traffic.

Answer

The firewall rules are not applied to the correct tags

Answer

The subnet IP ranges overlap

Answer

The instance in VPC-A does not have a default route

Question 12

A company needs to resolve DNS queries for a private zone (e.g., corp.example.com) from multiple GCP projects that are not in the same organization. Which Cloud DNS feature should they use?

Accepted Answer

DNS peering. DNS peering allows you to resolve DNS queries across different GCP projects, even if they are not in the same organization, by establishing a peering relationship between two VPC networks. This enables the private zone (corp.example.com) in one project to be queried from instances in another project without exposing the zone to the internet or requiring shared VPC.

Answer

Private DNS zones

Answer

DNS forwarding

Answer

Shared VPC

Question 13

A company is planning a hybrid connectivity strategy between their on-premises data center and GCP. They require at least 99.9% availability and are open to using a third-party service provider. Which TWO options meet these requirements? (Choose TWO.)

Accepted Answer

Dedicated Interconnect (single 10 Gbps connection). Partner Interconnect with two connections offers 99.99% SLA, but a single connection offers 99.9%. HA VPN with two tunnels offers 99.99% SLA, but the scenario requires at least 99.9%, so any option meeting that is acceptable. Dedicated Interconnect with one connection offers 99.9% SLA, but it's not via a third-party provider. Classic VPN does not have a 99.9% SLA.

Answer

VPC Network Peering

Answer

Classic VPN (static routing)

Answer

HA VPN (single tunnel)

Question 14

A company has multiple GCP projects that need to resolve DNS queries for a private zone (e.g., example.internal) that is hosted in a central project. They want to avoid copying zone data. Which TWO features can be used to achieve this? (Choose TWO.)

Accepted Answer

DNS peering. DNS peering allows a zone to be shared from one project to another. Shared VPC can also enable DNS resolution if the private zone is attached to the shared VPC host project and service projects use that VPC. However, DNS peering is more direct. Outbound forwarding is for on-premises resolution, not cross-project. Inbound forwarding is for on-premises to Cloud DNS. Private zones are per-project and don't automatically resolve cross-project.

Answer

Outbound DNS forwarding

Answer

Creating duplicate private zones in each project

Answer

Inbound DNS forwarding

Question 15

A company wants to connect two VPCs in different GCP projects so that they can communicate using internal IP addresses. The VPCs have overlapping IP ranges. Which approach allows connectivity without changing existing IP addresses?

Accepted Answer

None of these. VPC Network Peering requires non-overlapping subnets. Shared VPC is for multiple projects using a common VPC. Cloud VPN or Interconnect are hybrid connectivity options but also require non-overlapping IP ranges. None of the options allow overlapping IPs.

Answer

VPC Network Peering

Answer

Cloud VPN with dynamic routing

Answer

Shared VPC