PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 4 — 15 Questions

Question 1

A startup is creating a new VPC for their production environment. They want to minimize management overhead and plan to use multiple regions. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region and manage IP ranges, reducing management overhead. Custom mode requires manual subnet creation.

Answer

Custom mode VPC

Answer

Shared VPC

Answer

VPC Network Peering

Question 2

An organization wants to connect two VPCs in different projects so that they can communicate using private IPs. The connection must not be transitive. Which solution meets these requirements?

Accepted Answer

VPC Network Peering. VPC Network Peering directly connects two VPCs and is non-transitive by default.

Answer

Cloud Interconnect

Answer

Shared VPC

Answer

Cloud VPN

Question 3

A company is planning a hybrid cloud architecture with GCP. They need a dedicated, high-bandwidth connection from their on-premises data center to GCP with 99.99% SLA and the ability to scale beyond 10 Gbps. Which connection type should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between an on-premises data center and Google Cloud, supporting speeds of 10 Gbps or 100 Gbps per link. It offers a 99.99% SLA when configured with redundant links (two circuits) and can scale beyond 10 Gbps by adding additional 10 Gbps or 100 Gbps connections, meeting the requirement for high bandwidth and high availability.

Answer

Classic VPN

Answer

HA VPN

Answer

Partner Interconnect

Question 4

You are configuring Cloud Router for BGP sessions with an on-premises router. You need to ensure that the on-premises network can reach Google Cloud services using the advertiser’s IP addresses. Which option should you configure on the Cloud Router?

Accepted Answer

Advertise all subnets visible by the Cloud Router. Option D is correct because Cloud Router must advertise all subnets visible to it to ensure that the on-premises router learns the IP prefixes for Google Cloud services (e.g., Google APIs, GKE control planes) that are reachable via Private Google Access or Private Service Connect. By default, Cloud Router only advertises VPC subnet routes; enabling 'Advertise all subnets visible by the Cloud Router' includes custom IP ranges and service producer ranges, allowing the on-premises network to route traffic to those services using the advertiser's IP addresses.

Answer

Set the global routing mode

Answer

Configure custom route exchange in VPC Peering

Answer

Enable VPC Flow Logs

Question 5

An organization uses Shared VPC with a host project and multiple service projects. They want to allow a service project team to create Compute Engine instances using a specific subnet, but not manage other subnets. Which IAM role should they grant at the subnet level?

Accepted Answer

roles/compute.networkUser. The roles/compute.networkUser role grants read-only access to VPC networks, subnets, and firewall rules, and allows the creation of resources like Compute Engine instances on a specific subnet without granting management permissions over other subnets. This is the correct choice because it provides the minimum required permissions for a service project team to use a designated subnet while preventing them from modifying or viewing other subnets in the host project.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/compute.networkAdmin

Answer

roles/iam.securityAdmin

Question 6

A company has a GKE cluster with pods and services that need to communicate with on-premises resources over a VPN. The on-premises firewall requires the source IP of the pods to be from a specific range. Which secondary IP ranges should be configured on the VPC subnet?

Accepted Answer

Secondary pod range and secondary service range. Option C is correct because in GKE, pods are assigned IP addresses from the secondary pod range, and services (of type ClusterIP) are assigned IPs from the secondary service range. For on-premises resources to allow traffic from pods via a VPN, the firewall must see the pod IPs (not node IPs), so the secondary pod range must be configured on the VPC subnet. The secondary service range is also required for service discovery and proper routing, but the source IP seen by on-premises will be the pod IP from the secondary pod range.

Answer

Primary IP range and secondary pod range

Answer

Only the secondary service range

Answer

Primary IP range and secondary service range

Question 7

You are designing DNS resolution for a hybrid cloud. On-premises DNS servers must resolve GCP private VM hostnames, and GCP VMs must resolve on-premises hostnames. Which Cloud DNS feature should you use?

Accepted Answer

DNS forwarding (inbound and outbound). DNS forwarding with inbound and outbound policies is the correct choice because it enables bidirectional resolution between on-premises and GCP VMs. Outbound forwarding sends queries from GCP to on-premises DNS servers, while inbound forwarding allows on-premises clients to resolve GCP private VM hostnames by forwarding queries to Cloud DNS. This creates a seamless hybrid DNS namespace without exposing private zones to the internet.

Answer

DNS peering

Answer

Cloud DNS public zones

Answer

Split-horizon DNS

Question 8

A company needs to connect multiple VPCs in different projects and regions to a common hub VPC for centralized inspection. They want to avoid complex mesh peering configurations. Which service should they use?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is the correct choice because it provides a hub-and-spoke topology that connects multiple VPCs across projects and regions to a central hub VPC for centralized inspection, without requiring complex mesh peering. NCC uses a software-defined networking (SDN) controller to manage inter-VPC connectivity and routing, enabling traffic to flow through the hub VPC for inspection appliances like firewalls or IDS/IPS.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 9

A company has two VPCs (Prod and Dev) that are peered. Both VPCs have routes to an on-premises network via separate Cloud VPN tunnels. The on-prem network has routes to both VPCs. The Dev VPC recently added a subnet that overlaps with an on-prem subnet. What is the likely impact on the Prod VPC?

Accepted Answer

Dev VPC cannot communicate with on-prem due to overlap. When the Dev VPC adds a subnet that overlaps with an on-premises subnet, Cloud VPN routes for that overlapping prefix become ambiguous. GCP Cloud Router uses dynamic routing (BGP) and will prefer the more specific route, but if the prefixes are identical, the route to the on-premises network via the Dev VPN tunnel may be withdrawn or become unreachable due to the conflict. This directly impacts the Dev VPC's ability to communicate with the on-premises network over the VPN, while the Prod VPC, with its non-overlapping subnet, remains unaffected.

Answer

No impact on either VPC

Answer

Prod VPC loses connectivity to the on-premises network

Answer

Prod VPC can now communicate with Dev VPC via on-prem

Question 10

An organization uses Dedicated Interconnect with VLAN attachments in multiple regions. They need to ensure that traffic from one region to another flows over the interconnect backbone instead of the internet. Which configuration is required?

Accepted Answer

Enable global routing mode on the VPC. C is correct because enabling global routing mode on the VPC allows the VPC to use the same Dedicated Interconnect VLAN attachments across all regions. With global routing, routes learned via BGP over the interconnect are propagated to every region, ensuring that inter-region traffic is forwarded through the interconnect backbone rather than the public internet. Without global routing, each region would have its own VPC and would not share the interconnect routes, causing traffic to egress via the internet.

Answer

Use Partner Interconnect instead

Answer

Configure Network Connectivity Center

Answer

Set BGP MED values on Cloud Router

Question 11

You are configuring an HA VPN tunnel between GCP and on-premises. The on-premises VPN device only supports IKEv1 and static routing. Which of the following is true regarding this setup?

Accepted Answer

Classic VPN must be used. HA VPN requires IKEv2 and dynamic routing (BGP). Classic VPN supports IKEv1 and static routing.

Answer

Partner Interconnect can be used instead

Answer

HA VPN can be used with static routing if you disable BGP

Answer

HA VPN can be configured with IKEv1 and static routes

Question 12

A company wants to resolve DNS queries for a private zone (e.g., example.internal) from multiple service projects using the same host project's Cloud DNS private zone. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows Cloud DNS private zones from one project (the host project) to be resolved by VPCs in other projects (service projects) without requiring Shared VPC or network connectivity. By setting up a DNS peering zone in each service project that targets the host project's private zone, DNS queries for example.internal are forwarded to the host project's authoritative DNS servers. This is the correct approach because it directly enables cross-project DNS resolution for private zones while keeping the zones managed centrally.

Answer

Shared VPC

Answer

DNS forwarding

Answer

Create a public zone

Question 13

Which TWO statements are true about VPC Network Peering? (Choose 2)

Accepted Answer

You can export custom routes to a peered VPC.. Option A is correct because VPC Network Peering allows you to export custom routes (including static and dynamically learned routes) to a peered VPC. This is done by enabling the 'Export custom routes' option on the VPC peering connection, which then advertises those routes to the peer, enabling traffic to be directed through the peering link for custom destinations.

Answer

Peering supports global routing mode.

Answer

Peering is transitive by default.

Answer

Peered VPCs can have overlapping IP ranges.

Question 14

Which THREE are valid considerations when planning IP address ranges for VPCs that will be connected via VPC Peering and Cloud VPN? (Choose 3)

Accepted Answer

Plan for future growth by leaving unused CIDR blocks.. Avoid overlapping ranges, use RFC 1918 addresses, and ensure unique ranges for each subnet.

Answer

Use overlapping IP ranges to conserve address space.

Answer

Use public IP ranges for all VMs.

Question 15

A company is setting up HA VPN between GCP and on-premises. They want 99.99% SLA. Which TWO configurations are required? (Choose 2)

Accepted Answer

Four IKEv2 tunnels with BGP. To achieve a 99.99% SLA for HA VPN, Google Cloud requires two Cloud VPN gateways, each with a unique external IP address, and two tunnels per gateway (four tunnels total) using IKEv2. BGP must be configured on a Cloud Router to provide dynamic routing and failover, ensuring that traffic is redirected if a tunnel or gateway fails.

Answer

One external IP address on the Cloud VPN gateway

Answer

Static routing