PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are true regarding VPC Network Peering? (Choose TWO.)

Accepted Answer

The VPCs' subnet IP ranges must not overlap.. VPC Network Peering requires that the subnet IP ranges of the peered VPCs do not overlap. Overlapping ranges would cause routing conflicts and ambiguous destination addresses, as GCP uses the subnet CIDR blocks to determine the next hop for traffic. If two VPCs have overlapping ranges, packets cannot be reliably forwarded to the correct destination, breaking the peering connection.

Answer

It supports transitive routing across multiple peering connections.

Answer

It supports exchange of routes with custom dynamic routing.

Answer

Custom dynamic routes are automatically exchanged.

Question 2

Which TWO of the following are advantages of using the Premium Tier of Google Cloud's Network Service Tiers? (Choose TWO.)

Accepted Answer

Global load balancing with a single anycast IP address.. Option B is correct. Premium Tier offers global load balancing with a single anycast IP address. Option C is incorrect because while Premium Tier provides lower latency, it typically has higher egress costs compared to Standard Tier, so the claim of lower egress costs is false. Option A is incorrect because Premium Tier costs more than Standard Tier. Option D is incorrect because Premium Tier supports global load balancers, not just regional ones. Option E is incorrect because Premium Tier assigns public IP addresses from a global pool, not a regional one.

Answer

Reduced cost compared to Standard Tier.

Answer

Lower latency and egress costs for traffic originating in regions far from users.

Answer

Supports regional load balancers only.

Answer

Public IP addresses are assigned from a regional pool.

Question 3

A network engineer runs the gcloud command above for a Cloud NAT configured in us-central1. The VPC has 20 instances without external IPs in us-central1. They notice that only three instances have NAT mappings displayed. What could explain this?

Accepted Answer

Only instances with active outbound connections are shown.. The `gcloud compute nat-gateways list-mappings` command only displays NAT mappings for instances that currently have active outbound connections traversing the Cloud NAT gateway. Cloud NAT uses dynamic port address translation (PAT) and only creates a mapping entry when an instance sends traffic that requires source NAT. Instances without active sessions will not appear in the listing, even though they are configured to use the NAT gateway.

Answer

The NAT gateway is configured only for a specific subnet.

Answer

Only instances with external IPs are mapped.

Answer

The other instances are using a different NAT gateway.

Question 4

A team is deploying a new service in a Compute Engine instance without an external IP in subnet-b. The service needs to access Google Cloud Storage using internal IPs. What must the team do to enable this?

Accepted Answer

Enable Private Google Access on subnet-b.. Private Google Access enables a Compute Engine instance without an external IP address to reach Google APIs and services (including Cloud Storage) over the internal VPC network using RFC 1918 addresses. By enabling this feature on subnet-b, the instance can access Cloud Storage via internal IPs without needing an external IP or NAT gateway. This is the correct and minimal configuration for the requirement.

Answer

Assign an external IP address to the instance.

Answer

Move the instance to subnet-a where Private Google Access is already enabled.

Answer

Set up Cloud NAT on the VPC to allow outbound access to Google APIs.

Question 5

A request comes from IP 192.0.2.5, with origin region code 'US', and path '/admin/dashboard'. What will be the final action?

Accepted Answer

Deny by rule priority 2000.. The request matches a rule with priority 2000 that denies traffic from IP 192.0.2.5 to path '/admin/dashboard' with origin region 'US'. Since Cloud Armor security policies evaluate rules in ascending priority order, rule 2000 is evaluated before rule 3000 and after rule 1000. Rule 1000 does not match (likely a different condition), so rule 2000 applies and denies the request.

Answer

Deny by rule priority 1000.

Answer

Deny by rule priority 3000.

Answer

Allow (default rule).

Question 6

A company wants to connect on-premise to GCP via Cloud VPN with dynamic routing. They have two on-prem routers for redundancy. Which configuration ensures automatic failover?

Accepted Answer

Create two VPN tunnels using Cloud Router with BGP and the same ASN. Creating two VPN tunnels with Cloud Router using BGP and the same ASN on both on-prem routers enables dynamic routing and automatic failover. Cloud Router establishes BGP sessions with each on-prem router, and when both tunnels advertise the same routes with the same ASN, Cloud Router can detect a BGP session failure and automatically route traffic through the remaining healthy tunnel. This setup ensures seamless failover without manual intervention.

Answer

Create two VPN tunnels each with static routes pointing to the other router

Answer

Create one VPN tunnel with BGP and two interfaces

Answer

Create two VPN tunnels with BGP but different ASNs on each tunnel

Question 7

A company uses Shared VPC with multiple service projects. They need to allow certain service projects to create internal load balancers (ILBs) that are accessible from all projects in the organization. What is the best practice?

Accepted Answer

Create the ILB in the host project and share the backend. In a Shared VPC architecture, the host project owns the VPC network and its resources, including internal load balancers (ILBs). By creating the ILB in the host project and sharing its backend (e.g., instance groups from service projects), the ILB becomes accessible from all projects in the organization without additional connectivity. This approach centralizes network control and ensures the ILB's IP address is routable within the shared VPC, meeting the requirement for cross-project access.

Answer

Deploy ILB in each service project and use global access

Answer

Use Cloud NAT for outbound connectivity

Answer

Use VPC peering between each service project and the host project

Answer

Enable Private Service Connect

Question 8

A financial company requires encrypted traffic between on-premise and GCP. They have strict compliance requiring that encryption keys are managed on-premise and rotated every 30 days. Which connectivity solution should they use?

Accepted Answer

Cloud Interconnect with MACsec. B is correct because MACsec (IEEE 802.1AE) provides encryption at Layer 2, which is required for Cloud Interconnect to secure traffic between on-premise and GCP. Unlike VPN solutions, MACsec allows the customer to manage encryption keys on-premise and rotate them every 30 days, meeting strict compliance requirements. Cloud Interconnect with MACsec ensures low-latency, high-bandwidth connectivity while keeping key management under the customer's control.

Answer

Cloud VPN with certificate-based authentication using on-prem CA

Answer

Cloud VPN with IKEv2 and pre-shared keys

Answer

Cloud Interconnect with VLAN attachments

Answer

Partner Interconnect with a service provider that supports MACsec

Question 9

A company is designing a VPC for a multi-tier application. The web tier must be accessible from the internet, the app tier only from the web tier, and the db tier only from the app tier. Which combination of firewall rules is appropriate?

Accepted Answer

Ingress allow from 0.0.0.0/0 to web, ingress allow from web subnets to app, ingress allow from app subnets to db. It follows the principle of least privilege for a multi-tier VPC. The web tier must be accessible from the internet (0.0.0.0/0) on ingress, the app tier must only accept ingress from the web tier subnets, and the db tier must only accept ingress from the app tier subnets. This ensures that each tier is isolated and only reachable from the immediate upstream tier, which is a fundamental security best practice for multi-tier architectures in Google Cloud.

Answer

Ingress allow from web to app, ingress allow from app to db, no rule for web

Answer

Ingress allow from 0.0.0.0/0 to web, ingress allow from all subnets to app, ingress allow from app to db

Answer

Ingress allow from web to app, ingress allow from web to db, ingress allow from app to db

Question 10

An organization is deploying a global application and wants to use an Internal Load Balancer (ILB) across multiple regions. What is the correct configuration?

Accepted Answer

Deploy Internal Load Balancer (ILB) in each region and use DNS to route traffic. Google Cloud does not support a native cross-region Internal Load Balancer (ILB). To distribute traffic across multiple regions, you must deploy a separate Internal TCP/UDP Load Balancer in each region and use DNS-based routing (e.g., Cloud DNS with geo-routing or weighted record sets) to direct clients to the appropriate regional ILB. This approach provides regional high availability and global reach without exposing internal IPs externally.

Answer

Use a cross-region ILB by enabling global access

Answer

Use an Internal TCP/UDP Load Balancer in one region and route traffic via Cloud VPN

Answer

Use a global External Load Balancer with internal backend

Question 11

A startup wants to minimize costs for their development VPC. They have a few VMs that need occasional internet access for updates. What is the most cost-effective approach?

Accepted Answer

Use Cloud NAT with a static IP. Cloud NAT with a static IP is the most cost-effective approach because it allows multiple VMs to share a single static IP address for outbound internet access, eliminating the need for individual external IPs. This reduces costs since external IP addresses incur charges, and Cloud NAT provides managed, scalable outbound connectivity without requiring a VPN or dedicated gateway.

Answer

Use Private Google Access

Answer

Use a VPN to an on-prem network for internet

Answer

Assign external IPs to each VM

Question 12

A company needs to ensure that all traffic between GCP VMs in different regions is encrypted in transit. What is the recommended approach?

Accepted Answer

By default, traffic between GCP VMs is encrypted. Google Cloud encrypts all traffic between VMs at the hypervisor level, regardless of region, using application-layer encryption (e.g., TLS) and network-layer encryption (e.g., IPSec) by default. This encryption is transparent, always-on, and does not require any configuration, making option B the correct answer. The encryption covers all VM-to-VM traffic within the same VPC or across VPCs, including inter-region communication.

Answer

Use VPC peering with encryption enabled

Answer

Use Cloud VPN between the two regions

Answer

Enable IPsec on the VPC

Question 13

An organization is using Shared VPC with 100 service projects. They want to allow each service project to manage its own Cloud NAT, but the network administration team wants to control the outbound IP addresses used. What is the best design?

Accepted Answer

Create Cloud NAT in each service project with the same external IPs. In Shared VPC, Cloud NAT can be created in each service project, using the same set of external IP addresses. This allows service projects to manage their own NAT gateways (e.g., configure NAT rules and logging) while the network administration team controls the outbound IPs by reserving the IP addresses in the host project. The IPs can be shared across multiple NAT gateways across different service projects, as long as they are in the same region and the IPs are allocated from a common pool in the host project. Option A is wrong because a single Cloud NAT in the host project cannot be managed by service projects. Option B is wrong because a NAT instance does not allow service projects to manage their own Cloud NAT; it is a single instance managed centrally. Option D is wrong because Private Google Access is for accessing Google APIs privately, not for general outbound NAT.

Answer

Create a single Cloud NAT in the host project and share it

Answer

Use a NAT instance with an external IP in the host project and route traffic from service projects

Answer

Use Private Google Access with Cloud NAT in the host project

Question 14

Which TWO statements about VPC Network Peering are correct?

Accepted Answer

VPC peering is supported within the same organization. VPC Network Peering is designed to connect VPCs within the same organization (or across different organizations) without requiring a VPN or gateway. It allows private RFC 1918 IP communication between VPCs, and when both VPCs belong to the same organization, the peering setup is straightforward and does not involve cross-organization trust policies. This is a fundamental use case for peering in Google Cloud.

Answer

VPC peering supports global load balancing with internal IPs

Answer

VPC peering supports transitivity across multiple peerings

Answer

VPC peering allows overlapping CIDR ranges

Question 15

Which THREE components are part of a typical Cloud Hybrid Networking architecture?

Accepted Answer

Cloud Router. Cloud Router is a core component of Cloud Hybrid Networking because it enables dynamic route exchange between a GCP VPC and an on-premises network using BGP. It works with Cloud VPN or Cloud Interconnect to automatically learn and propagate routes, eliminating the need for static route management.

Answer

VPC

Answer

Cloud CDN