PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 3 — 15 Questions

Question 1

A company is creating a new VPC to host a set of microservices on Compute Engine. The network architect wants to minimize operational overhead and allow automatic subnet creation as new regions are added. Which VPC mode should be used?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region as they become available, reducing operational overhead. Custom mode requires manual subnet creation.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 2

An organization has two VPCs, VPC-A and VPC-B, in the same project. They need to allow communication between instances in these VPCs without using the public internet. The solution must support dynamic routes and be non-transitive. What should they configure?

Accepted Answer

Configure VPC Network Peering between the two VPCs. VPC Network Peering allows direct connectivity between two VPCs with non-transitive peering. It supports dynamic routes via custom route exchange and does not use the internet.

Answer

Add a route in each VPC pointing to the other's subnet via the default internet gateway

Answer

Create a VPN tunnel between VPC-A and VPC-B

Answer

Use Shared VPC with a host project and attach both VPCs as service projects

Question 3

A company is planning to connect their on-premises data center to Google Cloud using a Dedicated Interconnect. They require 20 Gbps of total bandwidth and want to achieve the highest SLA. What is the minimum number of 10 Gbps connections needed?

Accepted Answer

Two 10 Gbps links. Dedicated Interconnect offers 10 Gbps or 100 Gbps per link. To achieve 20 Gbps, at least two 10 Gbps links are needed. For the highest SLA (99.99%), two connections are required (one must be redundant).

Answer

One 10 Gbps link and one Partner Interconnect 10 Gbps link

Answer

One 100 Gbps link

Answer

Four 10 Gbps links

Question 4

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

Accepted Answer

MED (Multi-Exit Discriminator). MED (Multi-Exit Discriminator) is used to influence inbound route preference. A lower MED value is preferred. Setting a lower MED for the specific subnet will make it preferred over the less specific route.

Answer

Local preference

Answer

AS path prepend

Answer

Weight

Question 5

A company wants to use Cloud DNS to resolve DNS queries from their on-premises network for a private zone that contains internal GCP resource names. They do not want to manage DNS servers on-premises. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS server policy. Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS private zones, enabling resolution without managing on-premises DNS servers.

Answer

Private DNS zone

Answer

Outbound DNS server policy

Answer

DNS peering

Question 6

An organization has multiple VPCs in different projects that need to share subnets to create a common network segment. They want central control over network administration while allowing individual project teams to deploy resources. Which approach should they use?

Accepted Answer

Shared VPC with a host project and service projects. Shared VPC allows a host project to share subnets with service projects, providing central network administration while allowing teams to deploy resources independently.

Answer

VPN tunnels connecting all VPCs

Answer

VPC Network Peering between all VPCs

Answer

Creating a single VPC in one project and granting IAM permissions to other projects

Question 7

A company is designing a hybrid network using HA VPN with two external IP VPN gateways and four IKEv2 tunnels with BGP dynamic routing. They want to maintain connectivity during a zonal failure. What is the minimum number of Cloud VPN gateways needed in GCP?

Accepted Answer

1 Cloud VPN gateway. HA VPN uses two external IP addresses on a single gateway, one in each zone. One gateway supports two IPs and four tunnels, meeting the requirement with 99.99% SLA.

Answer

8 Cloud VPN gateways

Answer

4 Cloud VPN gateways

Answer

2 Cloud VPN gateways

Question 8

A network engineer needs to create a private Google Kubernetes Engine (GKE) cluster with a secondary IP range for pods and another for services. They must ensure the pod CIDR does not conflict with any VPC subnets or on-premises ranges. Which step is essential during cluster creation?

Accepted Answer

Specify the pod and service secondary IP ranges using the --cluster-secondary-range-name and --service-secondary-range-name flags. GKE clusters can specify secondary IP ranges for pods and services during creation. To avoid conflicts, the engineer must explicitly define these ranges using the --cluster-secondary-range-name and --service-secondary-range-name flags.

Answer

Create the cluster in a Shared VPC with automatic subnet creation

Answer

Use VPC-native GKE without secondary ranges

Answer

Use the default pod and service ranges provided by GKE

Question 9

A company needs to connect multiple on-premises sites and cloud VPCs in a hub-and-spoke topology using a fully managed service. Which Google Cloud service should they use?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) provides a hub-and-spoke model for connecting on-premises networks and VPCs, reducing configuration complexity.

Answer

VPC Network Peering

Answer

Cloud Interconnect

Answer

Cloud VPN

Question 10

An organization uses Classic VPN with static routing to connect to GCP. They now need to add a new subnet in GCP and ensure on-premises traffic can reach it without manual updates. What should they do?

Accepted Answer

Convert the Classic VPN to HA VPN with dynamic routing (BGP). Classic VPN supports policy-based routing with static routes. To handle new subnets automatically, they should migrate to HA VPN with dynamic routing (BGP), which advertises routes via BGP.

Answer

Add a static route for the new subnet on the Classic VPN tunnel

Answer

Use Cloud Router with the Classic VPN

Answer

Create a new Classic VPN tunnel for the new subnet

Question 11

A company is planning a hybrid connectivity solution with 200 Gbps total bandwidth between their data center and Google Cloud. They need the highest SLA and lowest latency. Which combination of services would meet these requirements?

Accepted Answer

Two 100 Gbps Dedicated Interconnect connections. Dedicated Interconnect provides up to 100 Gbps per link. To achieve 200 Gbps, they need two 100 Gbps connections. Two connections provide redundancy and the 99.99% SLA.

Answer

One 100 Gbps Dedicated Interconnect and one 100 Gbps Partner Interconnect

Answer

Twenty 10 Gbps Dedicated Interconnect connections

Answer

Four 50 Gbps Partner Interconnect connections

Question 12

A company wants to resolve DNS queries from their on-premises DNS servers for a private zone hosted in Cloud DNS. They also need GCP resources to resolve on-premises hostnames. Which combination of Cloud DNS features should they configure?

Accepted Answer

Both inbound and outbound DNS server policies. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS private zones. Outbound DNS server policy allows GCP to forward queries to on-premises DNS servers.

Answer

Outbound DNS server policy only

Answer

DNS peering with the on-premises network

Answer

Inbound DNS server policy only

Question 13

A company is designing a Shared VPC environment with a host project and several service projects. Which two steps are required to allow a service project team to create Compute Engine instances with internal IP addresses from a shared subnet?

Accepted Answer

Ensure the host project and service project are in the same organization. To use a shared subnet, the host project must grant the service project's Compute Engine service account the necessary IAM role on the subnet. The service project team must also have permissions to use the subnet.

Answer

Create a VPC peering connection between the host and service projects

Answer

Grant the service project's network team the roles/compute.networkAdmin role on the host project

Answer

Assign the roles/compute.securityAdmin role to the service project team

Question 14

A company uses VPC Network Peering between VPC-A (project X) and VPC-B (project Y). They want resources in VPC-A to reach resources in VPC-B, but also need VPC-A to reach an on-premises network connected to VPC-B via Dedicated Interconnect. Which two steps must be configured?

Accepted Answer

Configure VPC-A to import custom routes from VPC-B. By default, VPC peering is non-transitive, so VPC-A cannot reach on-premises through VPC-B. To enable this, VPC-B must export custom routes to VPC-A, and the on-premises network's routes must be learned via BGP on Cloud Router in VPC-B.

Answer

Create a separate VPN tunnel between VPC-A and the on-premises network

Answer

Enable global routing mode in both VPCs

Answer

Configure VPC-A to advertise its subnets to VPC-B

Question 15

A company is designing IP address plans for multiple VPCs that will be connected via VPC Network Peering and to an on-premises network via HA VPN with dynamic routing. Which three practices should be followed to avoid IP address conflicts?

Accepted Answer

Reserve IP ranges for future VPCs and on-premises expansion. To avoid overlap, use unique private IP ranges per VPC, plan for future growth, and document all ranges. Using RFC 1918 addresses and avoiding overlapping CIDRs ensures successful peering and VPN connectivity.

Answer

Use only public IP addresses for all GCP resources

Answer

Use the same IP range for all VPCs to simplify management