PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 14 — 15 Questions

Question 1

An engineer needs to set up a VPN between an on-premises network and GCP. The on-premises VPN device does not support BGP and can only support static routing. Which VPN solution should the engineer choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Classic VPN. Classic VPN supports static routing (policy-based or route-based). HA VPN requires dynamic routing (BGP), and Partner Interconnect is a dedicated connection not a VPN.

Answer

Partner Interconnect

Answer

HA VPN

Answer

Dedicated Interconnect

Question 2

An organization has multiple VPCs in different projects that need to resolve DNS names across projects. They want to use Cloud DNS without creating a separate managed zone for each VPC. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows DNS resolution between projects without creating separate managed zones. DNS forwarding is for forwarding queries to an external DNS server.

Answer

Private managed zones

Answer

Shared VPC

Answer

DNS forwarding

Question 3

A company has a Dedicated Interconnect connection with a VLAN attachment in their GCP VPC. They want to use BGP to exchange routes with their on-premises router. Which GCP resource must be configured to establish the BGP session?

Accepted Answer

Cloud Router. A Cloud Router is required to establish BGP sessions over VLAN attachments. The Cloud Router manages BGP peers and route advertisements.

Answer

VPC peering

Answer

Network Connectivity Center

Answer

Cloud VPN gateway

Question 4

Which VPC type allows you to specify custom IP ranges and regions for subnets during creation, and does not automatically create subnets in every region?

Accepted Answer

Custom mode VPC. Custom mode VPCs let you define subnets manually. Auto mode creates a subnet per region automatically.

Answer

Auto mode VPC

Answer

Legacy Network

Answer

Shared VPC

Question 5

An engineer is designing a hybrid network with a 10 Gbps Dedicated Interconnect. They require 99.99% availability for the connection. What is the minimum number of VLAN attachments and BGP sessions recommended?

Accepted Answer

2 VLAN attachments, 2 BGP sessions (one per attachment). To achieve 99.99% availability, you need at least 2 VLAN attachments (each on different physical links) and 2 BGP sessions. For higher SLAs, use 2 attachments and 4 BGP sessions.

Answer

2 VLAN attachments, 4 BGP sessions

Answer

2 VLAN attachments, 1 BGP session

Answer

1 VLAN attachment, 1 BGP session

Question 6

A company has a Shared VPC with a host project and several service projects. They want to allow a service project's Network Engineer to create and manage Cloud Load Balancers, but not modify other networking resources in the shared VPC. Which IAM role should be granted at the service project level?

Accepted Answer

Compute Load Balancer Admin (roles/compute.loadBalancerAdmin). The Compute Load Balancer Admin role (roles/compute.loadBalancerAdmin) grants permissions to create, update, and delete load balancers. The Network Admin role (roles/compute.networkAdmin) would allow modifying other network resources, which is not desired.

Answer

Project Editor (roles/editor)

Answer

Compute Network Admin (roles/compute.networkAdmin)

Answer

Compute Security Admin (roles/compute.securityAdmin)

Question 7

An organization wants to connect multiple on-premises sites to multiple VPCs in GCP using a hub-and-spoke model. Which GCP service provides a centralized hub for managing such connectivity?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is designed for hub-and-spoke topologies, connecting on-premises networks and VPCs through a hub.

Answer

Cloud Router

Answer

VPC Peering

Answer

Cloud VPN

Question 8

A company has a GKE cluster with pods and services that need IP addresses. They want to plan IP address space to avoid overlapping with on-premises networks. Which GCP feature allows reserving separate IP ranges for GKE pods and services?

Accepted Answer

Secondary IP ranges. Secondary IP ranges on a subnet can be designated for GKE pods and services. These ranges are separate from the primary subnet range.

Answer

VPC peering

Answer

Alias IP ranges

Answer

Shared VPC

Question 9

An engineer is troubleshooting a VPC Network Peering connection between two VPCs. The peering is established, but traffic from VPC A to VPC B is not reaching a specific subnet. Both VPCs have custom routes. What is the most likely cause?

Accepted Answer

Export custom routes is not enabled on the VPC B side. A common issue is that the subnet's custom routes are not exported. VPC peering allows exporting custom routes, but this must be explicitly enabled. If not, only system-generated routes (subnet routes) are exchanged.

Answer

The subnet has overlapping IP with VPC A

Answer

The subnet in VPC B is in a different region

Answer

Export custom routes is not enabled on the VPC A side

Question 10

A company needs a hybrid connectivity solution with a bandwidth of 500 Mbps and a 99.9% SLA. They do not have a presence in a colocation facility that supports Dedicated Interconnect. Which GCP service should they use?

Accepted Answer

Partner Interconnect. Partner Interconnect provides connectivity through a supported service provider with bandwidth from 50 Mbps to 10 Gbps and offers 99.9% or 99.99% SLA. It does not require colocation facility access.

Answer

Classic VPN

Answer

HA VPN

Answer

Dedicated Interconnect

Question 11

Which Cloud DNS zone type is used to resolve DNS names for resources within a VPC network, and is not accessible from the internet?

Accepted Answer

Private managed zone. Private managed zones are associated with one or more VPC networks and are used for internal DNS resolution. Public managed zones are for internet-facing DNS.

Answer

Peering zone

Answer

Forwarding zone

Answer

Public managed zone

Question 12

A company is designing hybrid connectivity between on-premises and GCP. The on-premises network has multiple VPN gateways that support BGP. They require high availability with an SLA of 99.99% and want to use Cloud VPN. Which TWO configurations are required? (Choose two.)

Accepted Answer

Two Cloud VPN gateways. HA VPN provides 99.99% SLA with two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP. Two Cloud VPN gateways and four tunnels are needed.

Answer

Static routing

Answer

One Cloud VPN gateway with two interfaces

Answer

Policy-based VPN

Question 13

A company uses Shared VPC with a host project and multiple service projects. They want to grant a team in a service project the ability to create and manage firewall rules that apply to the shared VPC's subnets. Which THREE IAM roles or permissions are needed? (Choose three.)

Accepted Answer

compute.firewalls.create permission on the host project. To manage firewall rules on a shared VPC, the user needs compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete permissions, which are included in the Compute Security Admin role (roles/compute.securityAdmin) at the host project level. Additional roles may be needed depending on organization policies.

Answer

compute.firewalls.delete permission on the service project

Answer

Compute Network Admin (roles/compute.networkAdmin) on the service project

Question 14

An engineer needs to plan IP address ranges for a new GCP environment that will connect to an on-premises network via Dedicated Interconnect. The on-premises network uses 10.0.0.0/8. The GCP VPC must support GKE pods and services and future expansion. Which THREE best practices should the engineer follow? (Choose three.)

Accepted Answer

Plan secondary IP ranges for GKE pods and services. Best practices: Use RFC 1918 private ranges, avoid overlapping with on-premises, plan secondary ranges for GKE (pods and services), and use non-overlapping ranges for future expansion.

Answer

Use the same IP range as on-premises for simplicity

Answer

Use a public IP range for the VPC to avoid overlap

Question 15

A company wants to create a new VPC for a production environment. They need predictable IP addresses and want to avoid any automatic subnet creation. Which type of VPC should they use?

Accepted Answer

Custom mode VPC. Custom mode VPCs do not create subnets automatically, giving full control over IP ranges.

Answer

Legacy VPC

Answer

Shared VPC

Answer

Auto mode VPC