PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 3 — 15 Questions

Question 1

You run the command shown in the exhibit. Your on-premises network is connected to your VPC via a Cloud Router with two BGP sessions. You notice that your on-premises network receives routes for only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) but not for other subnets in the VPC. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Cloud Router is configured with custom route advertisement that only includes the two specified ranges.. The Cloud Router's custom route advertisement configuration explicitly controls which routes are advertised to on-premises via BGP. If only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) are included in the custom advertisement, other VPC subnets will not be advertised, even if they exist. The exhibit shows that the on-premises network receives only those two ranges, which directly matches a custom advertisement setup rather than the default ALL_SUBNETS behavior.

Answer

The BGP interface IP addresses 169.254.x.x are not reachable from the on-premises side.

Answer

The BGP peer ASN 65001 is not recognized by the on-premises router.

Answer

The advertisedGroups includes ALL_SUBNETS but the router is ignoring it because of a misconfiguration.

Question 2

A company is deploying a multi-tier application on Google Cloud. The frontend tier runs in a managed instance group behind a global external HTTP(S) load balancer. The backend tier runs on Compute Engine instances in a different VPC subnet. The frontend instances must communicate with the backend instances using internal IP addresses only. Which configuration should the network engineer use?

Accepted Answer

Set up VPC Network Peering between the frontend VPC and the backend VPC.. VPC Network Peering allows two separate VPC networks to communicate using internal IP addresses without traversing the internet or requiring a VPN. Since the frontend and backend are in different VPCs (implied by the need for peering), peering enables direct internal IP connectivity between the frontend instances and the backend instances, satisfying the requirement for internal-only communication.

Answer

Use Cloud NAT to allow the frontend to reach the backend via the internet.

Answer

Use an internal TCP/UDP load balancer in the backend VPC and configure the frontend to send traffic to the load balancer's internal IP.

Answer

Place both frontend and backend instances in the same VPC but different subnets, and use firewall rules to allow traffic.

Question 3

Drag and drop the steps to create a VPC with custom subnet mode in Google Cloud into the correct order.

Accepted Answer

Name the VPC, Select custom subnet mode, Define subnets, Create VPC. Custom subnet mode requires manual subnet creation. The steps include naming the VPC, selecting custom mode, and defining subnets.

Answer

Name the VPC, Define subnets, Select custom subnet mode, Create VPC

Answer

Select custom subnet mode, Name the VPC, Define subnets, Create VPC

Answer

Define subnets, Name the VPC, Select custom subnet mode, Create VPC

Question 4

Drag and drop the steps to set up a Private Service Connect for accessing Google APIs privately into the correct order.

Accepted Answer

Reserve a static internal IP address, then create a Private Service Connect endpoint using that IP, then configure DNS to point to the endpoint IP, then test connectivity.. Private Service Connect involves creating an endpoint, assigning IP, setting DNS, and testing.

Answer

Create a Private Service Connect endpoint, then reserve a static internal IP address, then configure DNS, then test.

Answer

Reserve a static internal IP address, then configure DNS, then create a Private Service Connect endpoint, then test.

Answer

Create a Private Service Connect endpoint, then configure DNS, then reserve a static internal IP address, then test.

Question 5

Match each Google Cloud networking service to its primary function.

Accepted Answer

Cloud Load Balancing: Distributes incoming traffic across multiple instances. Correct matches: Cloud Load Balancing distributes traffic, Cloud CDN caches content, Cloud DNS resolves domain names. Common confusions: Cloud NAT is for internet access without external IPs, Virtual Private Cloud provides isolated networks, and Cloud Interconnect connects on-premises to Google Cloud.

Answer

Cloud NAT: Caches content at edge locations

Answer

Virtual Private Cloud: Provides dedicated connection between on-premises and VPC

Answer

Cloud Interconnect: Translates domain names to IP addresses

Question 6

Match each network troubleshooting command/tool to its function.

Accepted Answer

ping: Tests reachability of a host and measures round-trip time. Common network troubleshooting tools: ping tests connectivity, traceroute maps the route, nslookup resolves DNS, netstat shows connections. The distractors swap ping and traceroute functions.

Answer

ping: Displays network connections and routing tables

Answer

traceroute: Tests reachability and measures round-trip time

Question 7

A company needs to connect their on-premises data center to Google Cloud using a VPN with high availability. They have two VPN appliances on-premises in different locations. What is the best design on the GCP side?

Accepted Answer

Deploy two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.. It provides true high availability by using two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises appliance. This design ensures that if one region or gateway fails, traffic can still flow through the other region, meeting the requirement for high availability. Using separate Cloud Routers allows for dynamic routing with BGP, enabling automatic failover and load balancing across the two tunnels.

Answer

Deploy one Cloud VPN gateway with two tunnels to both on-premises appliances, using one Cloud Router.

Answer

Deploy two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises appliance, using separate Cloud Routers.

Answer

Deploy one Cloud VPN gateway with a single tunnel to one on-premises appliance.

Question 8

A company has a VPC with subnets in us-east1 and europe-west1. They need low-latency communication between instances in these regions using private IPs only. Which solution should they use?

Accepted Answer

Use a Global VPC (default VPC mode).. A Global VPC (default VPC mode) allows subnets in multiple regions to communicate using private IPs natively, without any additional VPN or peering configuration. This is because a Global VPC spans all regions, and instances within the same VPC can reach each other via internal IPs using Google's global network, providing low-latency communication.

Answer

Use Cloud VPN to connect the regions.

Answer

Use Cloud Interconnect to connect the regions.

Answer

Use VPC Network Peering between the two regional subnets.

Question 9

An organization wants to use Shared VPC but restrict access to certain subnets for specific service projects. Which GCP feature should they use?

Accepted Answer

Subnet-level IAM bindings. Subnet-level IAM bindings allow you to grant roles (e.g., compute.networkUser) on specific subnets within a Shared VPC to service project principals. This restricts access to only those subnets, while the service project can still use the shared network. It is the native GCP mechanism for fine-grained subnet access control in a Shared VPC environment.

Answer

VPC Network Peering

Answer

VPC Service Perimeters

Answer

Firewall rules

Question 10

A company has Compute Engine instances without external IPs that need to access the internet for updates. They do not want any inbound traffic. What is the best design?

Accepted Answer

Configure Cloud NAT and add firewall rules to allow only necessary egress and deny all ingress.. Cloud NAT provides outbound internet connectivity for instances without external IPs, and the explicit firewall rules ensure only necessary egress traffic is allowed while denying all ingress, meeting the requirement of no inbound traffic. Default firewall rules allow some ingress (e.g., ICMP), so they must be overridden with a deny-all-ingress rule to fully block inbound traffic.

Answer

Configure Cloud NAT and rely on default firewall rules.

Answer

Configure Cloud NAT and add a firewall rule to allow all egress traffic.

Answer

Configure Cloud NAT and add a firewall rule to deny all ingress and egress.

Question 11

A company wants to migrate an on-premises application that uses IPsec VPN tunnels to Google Cloud. They need to ensure encrypted connectivity between the on-premises network and a VPC. Which GCP service should they use?

Accepted Answer

Cloud VPN. Cloud VPN (D) is the correct service because it securely extends an on-premises network to a Google Cloud VPC over the public internet using IPsec VPN tunnels. It provides encrypted connectivity that matches the existing IPsec-based architecture, ensuring data confidentiality and integrity between the two sites.

Answer

Cloud Router

Answer

Cloud Interconnect

Answer

VPC Network

Question 12

An organization has two VPC networks in different Google Cloud organizations. They need to allow private IP communication between instances in these VPCs without using public IPs or VPNs. Which solution should they use?

Accepted Answer

VPC Network Peering. VPC Network Peering allows private IP connectivity between two VPC networks across different organizations without requiring public IPs, VPNs, or gateways. It uses the Google Cloud internal infrastructure to route traffic directly between instances, leveraging RFC 1918 addresses and supporting global peering.

Answer

Cloud NAT

Answer

Shared VPC

Answer

Cloud VPN

Question 13

Which GCP service provides a dedicated, low-latency connection from an on-premises data center to Google Cloud?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, low-latency connection from an on-premises data center to Google Cloud, bypassing the public internet. It offers two options: Dedicated Interconnect (a direct physical connection via a colocation facility) and Partner Interconnect (via a supported service provider). This ensures consistent bandwidth and lower latency compared to VPN-based solutions.

Answer

Cloud Router

Answer

Cloud VPN

Answer

VPC Network

Question 14

A company has a VPC with a firewall rule that allows SSH (tcp:22) from 0.0.0.0/0. They want to restrict SSH access to only the public IP address of their Cloud VPN gateway. How should they modify the firewall rule?

Accepted Answer

Change the source IP range to the VPN gateway's public IP address.. The firewall rule currently allows SSH from any source IP (0.0.0.0/0). To restrict access to only the Cloud VPN gateway, you must change the source IP range to the gateway's public IP address, because the SSH connection originates from the VPN gateway's public-facing interface over the internet. Internal IP addresses are not routable over the internet and would not match the source of the incoming SSH traffic.

Answer

Use Cloud Armor to block all SSH except from the VPN IP.

Answer

Change the source IP range to the VPN gateway's internal IP address.

Answer

Use IAP Tunneling instead of SSH firewall rules.

Question 15

A global application uses a global external HTTPS load balancer with backend NEGs in multiple regions. The content is static and must be cached at edge locations to reduce latency. Which GCP service should be enabled?

Accepted Answer

Cloud CDN. Cloud CDN is the correct service because it leverages Google's global edge cache network to cache static content from an external HTTPS load balancer with backend NEGs. When enabled, Cloud CDN intercepts requests at edge locations and serves cached responses, reducing latency and offloading origin servers. This directly addresses the requirement to cache static content at edge locations for a global application.

Answer

Cloud Storage

Answer

Cloud NAT

Answer

Cloud Memorystore