PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 15 — 15 Questions

Question 1

An organization has multiple GCP projects that need to share a common network infrastructure. They want to centralize network administration in a single project while allowing service projects to create their own resources in shared subnets. Which networking approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shared VPC. Shared VPC allows a host project to share subnets with service projects, with IAM controls for centralized administration.

Answer

Multi-NIC instances in a single project

Answer

VPC peering between all projects

Answer

Network Connectivity Center

Question 2

A company is setting up VPC peering between two VPCs. They need the peered VPC to be able to reach the entire subnets of their VPC, including those that may be added in the future. Which configuration is required?

Accepted Answer

Enable 'Export custom routes' on the peering connection. Exporting custom routes from the VPC ensures that any future subnets (which create custom routes) are advertised to the peer.

Answer

Create static routes in the peer VPC for each subnet

Answer

Use a VPN instead of VPC peering

Answer

Enable 'Import custom routes' on the peering connection

Question 3

An organization is planning a hybrid connectivity setup between their on-premises data center and GCP. They require a 99.99% SLA and want to use a single physical connection at 10 Gbps. Which connectivity option should they choose?

Accepted Answer

HA VPN with two external IP addresses and four tunnels. The customer requires a 99.99% SLA and wants to use a single physical connection at 10 Gbps. However, no physical connection option (Dedicated Interconnect or Partner Interconnect) can provide a 99.99% SLA with just one physical link—they require multiple links for redundancy. Therefore, the best option that meets the 99.99% SLA requirement without requiring multiple physical connections is HA VPN, which uses a logical VPN connection over the internet, not a physical one. When configured with two external IP addresses and four tunnels, HA VPN achieves the 99.99% SLA. Thus, HA VPN is the only viable choice given the constraints.

Answer

Dedicated Interconnect with a single 10 Gbps link and single VLAN attachment

Answer

Partner Interconnect with 10 Gbps link

Answer

Dedicated Interconnect with two 10 Gbps links (one active, one standby) and two VLAN attachments

Question 4

A company needs to connect multiple on-premises sites and multiple GCP VPCs in a hub-and-spoke topology using Google Cloud. Which service provides a centralized hub for managing such connectivity?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is the correct choice because it provides a centralized hub-and-spoke topology for connecting multiple on-premises sites (via VPN, Interconnect, or third-party SD-WAN appliances) and multiple GCP VPCs. It manages routing and policy distribution across spokes, eliminating the need for individual peering or complex route tables, and supports both intra- and cross-region connectivity.

Answer

VPC Peering

Answer

Shared VPC

Answer

Cloud Router

Question 5

A team is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They need to set up BGP sessions. Which of the following is a required parameter when creating a BGP peer on the Cloud Router?

Accepted Answer

Peer ASN. The peer ASN is required to configure the BGP session; the Cloud Router ASN is set at the router level.

Answer

Route priority (MED)

Answer

VLAN ID

Answer

Peer IP address

Question 6

An organization has a hybrid network with multiple BGP sessions between on-premises and GCP. They want to influence outbound traffic from GCP to prefer a specific path. Which BGP attribute should they adjust on the Cloud Router?

Accepted Answer

Local Preference. To influence outbound traffic from GCP (i.e., which path GCP uses to send traffic to on-premises), the correct BGP attribute is Local Preference. Local Preference is an attribute that influences the outbound path selection within the local AS. On Cloud Router, setting a higher Local Preference for a specific BGP session makes GCP prefer that path for outbound traffic. MED, on the other hand, is used to influence inbound traffic to GCP by telling neighboring ASes which path to prefer.

Answer

MED (Multi-Exit Discriminator)

Answer

Next hop

Answer

AS Path prepend

Question 7

A company wants to run a DNS resolution service for their hybrid cloud environment. They need on-premises servers to resolve GCP private VM hostnames, and GCP VMs to resolve on-premises hostnames. Which Google Cloud service should they use?

Accepted Answer

Cloud DNS with inbound and outbound DNS forwarding. Cloud DNS with inbound and outbound DNS forwarding enables bidirectional DNS resolution between on-premises and GCP.

Answer

Cloud DNS public zone

Answer

Cloud DNS private zone with DNS peering

Answer

Cloud NAT

Question 8

An engineer is planning IP address ranges for two VPCs that will be connected via VPC peering. One VPC uses 10.1.0.0/16 and the other uses 10.2.0.0/16. They also plan to use HA VPN to an on-premises network using 10.0.0.0/8. Which IP range assignment could cause a conflict?

Accepted Answer

Conflict between on-premises (10.0.0.0/8) and both VPCs. The on-premises range 10.0.0.0/8 overlaps with both VPC ranges; VPC peering and VPN both require non-overlapping ranges.

Answer

Conflict between the two VPCs (10.1.0.0/16 and 10.2.0.0/16)

Answer

Conflict between VPC1 (10.1.0.0/16) and on-premises (10.0.0.0/8)

Answer

No conflict; all ranges are non-overlapping

Question 9

A developer needs to create a subnet for GKE pods that will be used by a cluster. They need to specify a secondary IP range for pods. What is the purpose of the 'purpose' field when creating a subnet?

Accepted Answer

It indicates the subnet is used for GKE pods or services. The purpose field determines the subnet's usage; for GKE pods, you set purpose to 'PRIVATE_RFC_1918' or use a secondary range with specific purpose.

Answer

It enables private Google access

Answer

It defines whether the subnet is auto or custom

Answer

It sets the region for the subnet

Question 10

A company is using a Classic VPN with static routing to connect to GCP. They need to add a new subnet in GCP and make it reachable from on-premises without manual configuration changes on-premises. What is the limitation of Classic VPN in this scenario?

Accepted Answer

Classic VPN requires manual route updates on-premises. Classic VPN with static routing requires manual route updates; dynamic routing (BGP) is needed for automatic route advertisement.

Answer

Classic VPN does not support IKEv2

Answer

Classic VPN supports BGP, so routes are automatically advertised

Answer

Classic VPN cannot be used with multiple subnets

Question 11

An organization wants to use Cloud DNS to resolve queries for a custom domain 'example.internal' across multiple projects in the same organization. They have a private zone in project A and want project B to be able to resolve records in that zone. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows a private zone in one project to be shared with other projects for DNS resolution.

Answer

Shared VPC

Answer

Public zone with visibility

Answer

DNS forwarding

Question 12

An organization needs to connect three GCP VPCs (VPC-A, VPC-B, VPC-C) so that all VPCs can communicate with each other. They want a solution that is transitive and does not require full mesh peering. Which TWO approaches meet these requirements?

Accepted Answer

Use Network Connectivity Center with all VPCs as spokes. Network Connectivity Center hub-and-spoke and a VPN appliance in a shared VPC can provide transitive routing. VPC peering is non-transitive and would require full mesh.

Answer

Use Cloud VPN with HA VPN to connect all VPCs

Answer

Use a single shared VPC with subnets for all three networks

Answer

Establish VPC peering between each pair of VPCs (full mesh)

Question 13

A company is designing a hybrid network using Dedicated Interconnect. They want to achieve a 99.99% SLA for availability. Which THREE configurations are required to meet this SLA?

Accepted Answer

Two VLAN attachments (one per connection). Two physical connections, two VLAN attachments, and two BGP sessions (one per attachment) are needed for 99.99% SLA.

Answer

Cloud Router in global dynamic routing mode

Answer

A single 10 Gbps physical connection

Question 14

An engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They want to control which on-premises subnets are advertised to GCP. Which TWO methods can they use?

Accepted Answer

Apply BGP filters on the on-premises router to limit advertised prefixes. Custom learned routes can be configured to filter prefixes, and BGP filters can be applied on the on-premises side.

Answer

Change the Cloud Router ASN

Answer

Use route priority in the VPC

Answer

Set MED on the on-premises router

Question 15

A company wants to connect two VPCs in different GCP projects so that they can exchange traffic using internal IP addresses. They do not need centralized management or transitive routing between the VPCs. Which GCP networking feature should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering allows direct connectivity between two VPCs using internal IPs, with no transitive routing. It is a simple, decentralized option for connecting two VPCs.

Answer

Network Connectivity Center

Answer

Cloud VPN

Answer

Shared VPC