PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 2 — 15 Questions

Question 1

A startup is setting up a new GCP project and needs to create a VPC that will have predictable IP ranges for future peering with other VPCs. They do not anticipate needing to grow the network beyond the initial IP range. Which VPC type should they choose?

Accepted Answer

Custom mode VPC. Custom mode VPCs allow you to define your own subnets with specific IP ranges. Auto mode VPCs automatically create subnets in every region, which can cause IP overlap when peering. For controlled, predictable IP ranges, custom mode is appropriate.

Answer

Auto mode VPC

Answer

Shared VPC

Answer

Legacy network

Question 2

An organization is migrating on-premises workloads to GCP. They need a dedicated, high-bandwidth connection with a 99.99% SLA. They have a co-location facility near a Google Cloud region. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct physical connections (10G or 100G links) between on-premises and Google's network, offering a 99.99% SLA when using redundant connections.

Answer

HA VPN

Answer

Cloud VPN (Classic VPN)

Answer

Partner Interconnect

Question 3

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 4

A network engineer is setting up HA VPN between an on-premises network and a GCP VPC. They have configured two Cloud VPN gateways in GCP, each with two interfaces, and four tunnels. They are using BGP with Cloud Router. However, only one of the four tunnels is established. What is the most likely cause?

Accepted Answer

The on-premises VPN gateway is using the same peer IP for multiple tunnels. For HA VPN, each VPN gateway has two external IP addresses. Tunnels should be configured between each GCP IP and the corresponding on-premises peer IP. If the on-premises peer IPs are not unique per tunnel (e.g., both tunnels on-prem use the same IP), BGP sessions may not form correctly. The issue is often due to duplicate peer IPs or misconfiguration of BGP ASNs.

Answer

The Cloud Router ASN is not unique to the project

Answer

The Cloud Router is not advertising the default route

Answer

The VPC firewall rules are blocking UDP port 500

Question 5

A company wants to use Cloud DNS to resolve queries for a private zone (e.g., example.internal) from multiple VPCs in the same project. They need to ensure that instances in all VPCs can resolve the zone. What is the simplest approach?

Accepted Answer

Create a private zone and associate it with all relevant VPCs. A private managed zone can be associated with one or more VPCs in the same project. By associating the zone with all VPCs that need resolution, instances in those VPCs can resolve the zone without additional peering.

Answer

Configure each VM to use a custom DNS resolver

Answer

Use Cloud DNS peering to forward queries between VPCs

Answer

Create a public zone and set visibility to private

Question 6

An organization is designing IP address planning for hybrid connectivity. They have three VPCs (Prod, Dev, Test) that will be peered with each other and also connected to an on-premises network via Cloud VPN. Which practice should they follow to avoid IP address overlap?

Accepted Answer

Allocate unique, non-overlapping IP ranges for each VPC and on-premises network. To avoid routing conflicts, each VPC and the on-premises network should use unique, non-overlapping RFC 1918 CIDR blocks. Overlap would cause routing issues and potential traffic blackholing.

Answer

Use overlapping IP ranges but rely on NAT to resolve conflicts

Answer

Use carrier-grade NAT (CGNAT) ranges for all VPCs to avoid private IP conflicts

Answer

Use the same /16 range for all VPCs to simplify route summarization

Question 7

A company has a Shared VPC setup with a host project and several service projects. They want to grant a service project's network admin the ability to create VM instances using a specific subnet from the host project. Which IAM role should they assign at the subnet level?

Accepted Answer

Compute Network User (roles/compute.networkUser) on the specific subnet. Shared VPC allows granting IAM roles on individual subnets. The Compute Network User role (roles/compute.networkUser) allows a principal to use a subnet to create resources, without giving them broader network management permissions.

Answer

Project Owner on the host project

Answer

Compute Instance Admin (roles/compute.instanceAdmin) on the service project

Answer

Compute Network Admin (roles/compute.networkAdmin) on the host project

Question 8

A network engineer is troubleshooting BGP route propagation between an on-premises network and a GCP VPC via Cloud Router. The on-premises router is advertising a specific subnet (10.1.0.0/16), but GCP is not receiving the route. Cloud Router BGP sessions are established. Which configuration could be the issue?

Accepted Answer

The Cloud Router is configured to only accept routes from a specific set of prefixes. Cloud Router has an option to set custom route advertisements. If the on-premises route is not being accepted, it could be because the Cloud Router is configured with 'advertised route priority' or 'advertised IP ranges' that exclude the on-premises prefixes. More likely, the BGP peer is configured to accept only specific prefixes via 'advertised route priority' or 'advertised groups'. Another common issue: the on-premises router needs to advertise the route; Cloud Router must have 'advertise custom routes' enabled or the route must be within the allowed prefixes.

Answer

The VPC firewall rules are blocking BGP traffic (TCP port 179)

Answer

The Cloud Router is configured with a higher MED value for the route

Answer

The on-premises router is not sending the AS_PATH attribute

Question 9

A developer needs to create a GKE cluster that uses a secondary IP range for pods and another for services. During VPC subnet creation, they set a primary IP range and two secondary ranges. Which flag must be used when creating the subnet to specify the pods range?

Accepted Answer

--secondary-range. When creating a subnet with secondary IP ranges, the '--secondary-range' flag is used to specify the name and range for pods (or services). The CLI command allows multiple secondary ranges.

Answer

--pods-range

Answer

--additional-ip-range

Answer

--auxiliary-range

Question 10

An organization needs DNS resolution for on-premises hosts to resolve GCP private zone names (e.g., myinstance.gcp.internal). They have Cloud DNS private zones in GCP. Which Cloud DNS feature should they configure to forward queries from on-premises to GCP?

Accepted Answer

Inbound DNS forwarding. Cloud DNS inbound server policy enables on-premises DNS resolvers to forward queries to Cloud DNS for resolution of private zones. This is the appropriate feature for on-premises to GCP DNS resolution.

Answer

Split-horizon DNS

Answer

DNS peering

Answer

Outbound DNS forwarding

Question 11

A company is using VPC Network Peering between two VPCs. They want to ensure that routes for a specific subnet in VPC A are exported to VPC B. However, VPC B should not export its routes to VPC A. What peering configuration should they set?

Accepted Answer

On VPC A's peering, enable 'Export selected custom routes' and specify the subnet; on VPC B's peering, disable all route export/import. VPC peering allows custom route export/import per peering session. To export selected custom routes from VPC A to VPC B without importing from VPC B, enable 'Export selected custom routes' on VPC A's peering, and disable 'Import custom routes' on VPC B's side.

Answer

On VPC B's peering, enable 'Import custom routes'; on VPC A's peering, disable 'Export custom routes'

Answer

Enable VPC Network Peering with default settings

Answer

On VPC A's peering, enable 'Export custom routes'; on VPC B's peering, disable 'Import custom routes'

Question 12

A company is using Partner Interconnect with a 2 Gbps VLAN attachment. They notice that throughput is only about 500 Mbps during peak hours. They have verified that the on-premises link is not saturated. What is the most likely cause?

Accepted Answer

The VLAN attachment is configured with a lower bandwidth cap. Partner Interconnect VLAN attachments have a maximum throughput that depends on the partner's capability. If the throughput is lower than expected, it may be due to the partner limiting the bandwidth or the VLAN attachment configuration. However, a common cause is that the BGP session's route advertisement or Cloud Router configuration is not using multiple paths. Another possibility: the traffic is not using the VLAN attachment because of routing preferences. But given the scenario, the most plausible cause is that the VLAN attachment is configured with a lower bandwidth limit than the physical link.

Answer

Cloud Router is not using the partner's ASN

Answer

The VPC MTU is set to 1500 bytes

Answer

The on-premises router does not support BGP multipath

Question 13

A company is planning to connect multiple VPCs in different projects to a common on-premises network using a hub-and-spoke topology. They want to use Network Connectivity Center (NCC). Which TWO components are required to set up this topology?

Accepted Answer

NCC hub. NCC uses a hub (NCC hub) and spokes (VPC spokes). Spokes are VPCs that connect to the hub. The hub acts as a central point for routing.

Answer

VPC Network Peering

Answer

Dedicated Interconnect VLAN attachments

Answer

Cloud Router

Question 14

A company wants to set up a hybrid network with HA VPN between an on-premises network and GCP. They need a 99.99% SLA. Which THREE conditions must be met to achieve this SLA?

Accepted Answer

Each tunnel uses a unique IKE pre-shared key. HA VPN provides 99.99% SLA when at least two tunnels are up, each using a separate external IP address on the GCP side, and the on-premises VPN gateway is also redundant with two peer IPs.

Answer

Cloud Router configured with global dynamic routing mode

Answer

Two Cloud VPN gateways in GCP, each with one interface

Question 15

A network engineer needs to design a DNS architecture for a hybrid cloud environment. The requirements: on-premises hosts must resolve GCP private zone names, and GCP instances must resolve on-premises DNS names. Which TWO Cloud DNS features should they use?

Accepted Answer

Outbound DNS server policy. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS. Outbound DNS server policy allows GCP to forward queries to on-premises DNS.

Answer

Split-horizon DNS

Answer

DNS managed zone with forwarding

Answer

DNS peering