PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are benefits of using Shared VPC?

Accepted Answer

Automatic cross-project routing. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling automatic cross-project routing. This is because all subnets in the host project are directly reachable from any service project attached to that host, without needing additional VPC peering or VPN tunnels. Option B is correct because this inherent routing simplifies network connectivity and reduces administrative overhead.

Answer

Enhanced security through VPC Service Perimeters

Answer

Reduced IP address usage

Answer

Separation of network and application teams

Question 2

A company needs to connect three VPC networks in separate projects (two in the same organization, one in a different organization) to each other for private IP communication. Which TWO GCP solutions should they consider? (Choose 2.)

Accepted Answer

VPC Network Peering. Options D and E are correct for connecting three VPC networks in separate projects, including across organizations. VPC Network Peering (D) directly connects VPCs, allowing private IP communication, but it is non-transitive, so a full mesh of peerings is required for all three VPCs to communicate. Cloud VPN with dynamic routing (E) can also be used to create routed connections between VPCs via Cloud Routers, enabling private IP communication even across organizations, though it involves more overhead. Option B (hub-and-spoke topology) is incorrect because VPC peering is non-transitive; spokes cannot communicate through the hub without additional routing, so a hub-and-spoke design alone does not enable full connectivity among all three VPCs. Shared VPC (C) is limited to projects within the same organization, and Cloud Interconnect (A) is designed for on-premises to VPC connections, not VPC-to-VPC.

Answer

Cloud Interconnect

Answer

VPC Network Peering hub-and-spoke topology

Answer

Shared VPC

Question 3

Which THREE factors should be considered when designing a Cloud VPN for high availability? (Choose 3.)

Accepted Answer

Enable BGP for dynamic routing. Enabling BGP (Border Gateway Protocol) for dynamic routing is correct because it allows the Cloud VPN to automatically detect and route around failures. BGP exchanges route information between the on-premises router and the Cloud Router, enabling dynamic failover and load balancing across multiple tunnels. Without BGP, you would rely on static routes, which cannot adapt to network changes and require manual intervention during a failure.

Answer

Use static routes for failover

Answer

Use a single Cloud Router for simplicity

Question 4

Refer to the exhibit. A network engineer reviews the firewall rules in a VPC. What is the most significant security concern?

Accepted Answer

SSH is allowed from any source.. Allowing SSH (TCP/22) from any source (0.0.0.0/0) exposes the VPC instances to brute-force attacks, unauthorized access, and potential compromise. This violates the principle of least privilege and is a critical security misconfiguration in a VPC firewall rule.

Answer

There is no deny rule.

Answer

RDP is allowed from 10.0.0.0/8.

Answer

Firewall rules are not in order.

Question 5

Refer to the exhibit. What is the purpose of the --enable-private-ip-google-access flag?

Accepted Answer

Allows VMs to access Google APIs without requiring an external IP.. The `--enable-private-ip-google-access` flag, when set to `true` on a subnet, allows VM instances in that subnet to reach Google APIs and services (e.g., Cloud Storage, BigQuery) using their private IP addresses, without requiring an external (public) IP. This works by routing traffic through Google's internal network to the Google API frontend, bypassing the public internet.

Answer

Enables the subnet to be used for Cloud VPN tunnels.

Answer

Allows external traffic to reach VMs using private IPs.

Answer

Enables Cloud NAT on this subnet.

Question 6

Refer to the exhibit. What is the purpose of the IP address 169.254.0.1 assigned to the Cloud Router interface?

Accepted Answer

It is a link-local IP address used for BGP sessions between the Cloud Router and the VPN gateway.. The IP address 169.254.0.1 falls within the 169.254.0.0/16 range, which is reserved for link-local addressing (RFC 3927). In Google Cloud, Cloud Routers use link-local addresses for BGP sessions with VPN gateways (both HA VPN and Classic VPN). This address is not routable and is used exclusively for BGP peering between the Cloud Router and the VPN gateway, ensuring that the BGP session operates over the VPN tunnel without conflicting with other IP assignments.

Answer

It is the public IP address of the VPN gateway.

Answer

It is a private IP address for BGP peering with the on-premises router.

Answer

It is the management IP address of the Cloud Router.

Question 7

A company is designing a VPC network to support multiple projects that require isolation but also need to communicate with a shared services project. Which approach should the company use to minimize administrative overhead while ensuring isolation?

Accepted Answer

Implement a Shared VPC in the host project and attach all service projects to it.. A Shared VPC (XPN) allows an organization to connect resources from multiple service projects to a common host project's VPC network, enabling isolated projects to communicate with shared services while centralizing network administration. This minimizes administrative overhead because network policies, firewall rules, and routing are managed in one place, and service projects do not need to manage their own VPC infrastructure.

Answer

Assign all projects to a single VPC with separate subnets for each project.

Answer

Use dedicated VPCs for each project and connect via Cloud VPN tunnels.

Answer

Create a separate VPC for each project and peer them with the shared services VPC.

Question 8

A company has Compute Engine instances without external IP addresses that need to access external APIs. The instances are in multiple zones within a region, and each zone has a subnet. The company wants a cost-effective and highly available solution that does not require manual failover. What should they do?

Accepted Answer

Create a Cloud NAT gateway in each zone and configure region-specific NAT rules.. A Cloud NAT gateway per zone provides highly available outbound connectivity for instances without external IPs. By placing a gateway in each zone, traffic from instances in that zone uses the local gateway, avoiding cross-zone hops and ensuring automatic failover if a zone fails. This meets the cost-effective and no-manual-failover requirements without needing instance-level external IPs.

Answer

Create a Cloud NAT gateway in one zone and configure an instance tag-based route to the gateway.

Answer

Enable Private Google Access on the subnets and configure a Cloud NAT gateway in one zone.

Answer

Assign external IP addresses to each instance and create appropriate firewall rules.

Question 9

An organization is connecting their on-premises data center to GCP using Dedicated Interconnect with multiple VLAN attachments. They have configured Cloud Router with BGP sessions for each VLAN attachment. They notice that traffic from GCP to on-premises is not load-balanced across the attachments; instead, all traffic uses a single link. What is the most likely cause?

Accepted Answer

Cloud Router's BGP is not configured for multipath; it selects only one best path per prefix.. Cloud Router uses BGP to exchange routes with the on-premises router. By default, BGP selects only a single best path per prefix based on the lowest MED, weight, local preference, AS-path length, or IGP metric. Without BGP multipath enabled (e.g., 'maximum-paths' or 'bgp multipath' configuration), Cloud Router will not load-balance traffic across multiple VLAN attachments even if multiple equal-cost paths are available. This causes all traffic to egress through a single link.

Answer

The on-premises router is not advertising the same routes over all BGP sessions.

Answer

The VLAN attachments have different bandwidths, causing BGP to prefer the higher bandwidth link.

Answer

The BGP keepalive timers are misconfigured, causing session flapping.

Question 10

A company has multiple projects that each need their own administrative control but must share a common VPC network. Which networking solution should they use?

Accepted Answer

Use Shared VPC with the host project and attach service projects.. Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, enabling centralized control of the network while maintaining administrative isolation for each project. The host project owns the VPC and firewall rules, and service projects can use subnets within that VPC, meeting the requirement for separate administrative control with a shared network.

Answer

Create a single VPC in one project and grant all users access to that project.

Answer

Create separate VPCs for each project and connect via Cloud VPN.

Answer

Create a VPC in each project and peer them all together.

Question 11

An organization has Compute Engine instances in a VPC without external IP addresses. They need to allow these instances to access Google Cloud Storage buckets but not the internet. What should they configure?

Accepted Answer

Enable Private Google Access on the subnets where the instances reside.. Private Google Access allows Compute Engine instances without external IP addresses to reach Google APIs and services, including Cloud Storage, through the VPC network's default route to the internet gateway, but only to Google's published IP ranges. This is the correct solution because it provides the required access without exposing the instances to the general internet.

Answer

Set up Cloud NAT and configure a firewall rule to allow egress to Google Cloud Storage IP ranges.

Answer

Peer the VPC with the Google Cloud Storage service VPC.

Answer

Create an egress firewall rule allowing traffic to 0.0.0.0/0 and a route to the default internet gateway.

Question 12

A company runs a Kubernetes cluster on GKE with a VPC-native cluster (alias IP ranges). They have pods that need to communicate with on-premises services via a Cloud VPN tunnel. Which networking configuration is required to enable pod-to-on-premises communication?

Accepted Answer

Advertise the pod IP ranges over the Cloud Router BGP session to the on-premises router.. VPC-native clusters assign alias IP ranges to pods directly from the VPC subnet's secondary CIDR ranges. To enable on-premises routing to these pods, the pod IP ranges must be advertised over the Cloud Router BGP session to the on-premises router. This ensures the on-premises network learns the routes to the pod CIDRs and can forward traffic back through the Cloud VPN tunnel.

Answer

Enable VPC Flow Logs for the subnets to allow traffic to be routed.

Answer

Configure a firewall rule allowing traffic from pod CIDR to on-premises subnets.

Answer

Create a VPC peering connection between the VPC and the on-premises network.

Question 13

A company has a VPC with three subnets and multiple firewall rules. They want to ensure that the most specific firewall rule takes precedence when there is a conflict. What is the default evaluation order of firewall rules?

Accepted Answer

The rule with the highest priority (lowest priority number) is evaluated first.. In Google Cloud Platform (GCP) VPC firewall rules, the default evaluation order is based on priority. Each rule is assigned a priority number from 0 to 65535 (lower number = higher priority), and rules are evaluated from highest priority (lowest number) to lowest priority. When multiple rules match traffic, the rule with the highest priority (lowest priority number) is applied first, and its action (allow/deny) is definitive; lower-priority rules are not evaluated for that traffic.

Answer

Egress rules are evaluated before ingress rules.

Answer

The more restrictive rule (with smaller IP range) is applied first.

Answer

Rules are evaluated in the order they were created.

Question 14

A company needs a dedicated, low-latency connection from their on-premises data center to GCP with a 10 Gbps capacity. They require the highest availability and service level agreement (SLA). Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect with two connections to different meet-me rooms.. Dedicated Interconnect provides a direct, private connection between the on-premises data center and GCP with 10 Gbps capacity. By using two connections to different meet-me rooms, the company achieves the highest availability and meets the 99.99% SLA, as this eliminates single points of failure at the physical layer and within a single facility.

Answer

Carrier Peering using Equinix or other carrier.

Answer

Partner Interconnect with two VLAN attachments from different providers.

Answer

Cloud VPN with two tunnels from different VPN gateways.

Question 15

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

Accepted Answer

Traffic is taking one tunnel for outbound and the other for return, causing stateful firewall to drop packets.. The most likely cause is asymmetric routing, where outbound traffic from GCP to on-premises takes one VPN tunnel while return traffic takes the other. Stateful firewalls track connection state based on the first packet seen; if return packets arrive via a different tunnel (and thus a different source IP or interface), the firewall does not recognize them as part of an existing session and drops them. This is a classic symptom of asymmetric routing with multiple BGP sessions over separate tunnels.

Answer

BGP keepalive timers are set too low, causing session flapping.

Answer

The MTU is mismatched between the tunnels.

Answer

The on-premises router is not receiving the VPC routes via BGP.