PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 5 — 15 Questions

Question 1

A startup is setting up their first GCP VPC. They want minimal manual configuration and need subnets in multiple regions. Which VPC creation mode should they use, and why?

Accepted Answer

Auto mode, because it automatically creates subnets in all regions with predefined IP ranges.. Auto mode VPCs automatically create a subnet in each region with predefined IP ranges, reducing manual effort. Custom mode requires manual subnet creation.

Answer

Auto mode, because it allows overlapping IP ranges with on-premises networks.

Answer

Custom mode, because it is the only mode that supports Shared VPC.

Answer

Custom mode, because it provides full control over IP ranges.

Question 2

An organization needs to connect two VPCs in different projects so that all subnets can communicate using internal IPs, but the connection must not be transitive (i.e., VPC A cannot use VPC B's connection to reach VPC C). Which GCP networking feature should they use?

Accepted Answer

VPC Network Peering. VPC peering is non-transitive and directly connects two VPCs. Shared VPC is transitive; VPN and Interconnect are for hybrid connectivity.

Answer

Cloud VPN

Answer

Shared VPC

Answer

Dedicated Interconnect

Question 3

A company has a GKE cluster that needs to be accessed by pods and services. The cluster is deployed in a VPC with a primary subnet 10.0.0.0/16. To avoid IP exhaustion, they want to use separate IP ranges for pods and services. Which approach should they take?

Accepted Answer

Create secondary IP ranges on the subnet for pods and services.. GKE supports secondary IP ranges for pods and services, which are defined on the subnet and allocated separately from the primary range.

Answer

Use a separate VPC for the GKE cluster with its own subnet.

Answer

Use the primary subnet range for pods and create a separate subnet for services.

Answer

Use alias IP ranges on the VM instances for pods and services.

Question 4

An enterprise is planning a Dedicated Interconnect connection to GCP. They require 99.99% availability and expect to use multiple VLAN attachments. What is the minimum number of 10 Gbps links and VLAN attachments needed to meet the availability goal?

Accepted Answer

Two 10 Gbps links and two VLAN attachments. To achieve 99.99% availability, Dedicated Interconnect requires at least two links (each 10 Gbps or 100 Gbps) in different edge availability domains, and at least two VLAN attachments.

Answer

Two 10 Gbps links and one VLAN attachment

Answer

One 100 Gbps link and one VLAN attachment

Answer

One 10 Gbps link and one VLAN attachment

Question 5

A network engineer is configuring HA VPN between an on-premises network and GCP. They have created two external VPN gateways in GCP (one per region) and two Cloud Routers. How many IKEv2 tunnels and BGP sessions are required to achieve the 99.99% SLA?

Accepted Answer

Four tunnels, four BGP sessions. HA VPN requires four tunnels (two per gateway) and four BGP sessions (one per tunnel) to achieve 99.99% SLA.

Answer

Two tunnels, two BGP sessions

Answer

Four tunnels, two BGP sessions

Answer

Two tunnels, four BGP sessions

Question 6

A company uses Cloud DNS to manage their domain example.com. They want to resolve queries for example.com from their on-premises DNS servers without transferring the zone. Which Cloud DNS feature should they use?

Accepted Answer

DNS peering. DNS peering allows forwarding queries for a zone to a different network for resolution, without zone transfer.

Answer

DNS forwarding (outbound)

Answer

Managed reverse lookup zone

Answer

Private zone with VPC network binding

Question 7

A company has two VPCs (Production and Development) that are peered. The Development VPC has a custom route to an on-premises network via a VPN tunnel. They want the Production VPC to automatically learn this route. What must be configured on the VPC peering?

Accepted Answer

Enable 'export custom routes' on Development VPC and 'import custom routes' on Production VPC.. To allow exchange of custom routes between peered VPCs, both VPCs must enable 'export custom routes' and 'import custom routes' on the peering connection.

Answer

Enable 'export custom routes' on Production VPC and 'import custom routes' on Development VPC.

Answer

Enable 'import custom routes' on both VPCs.

Answer

Enable 'export custom routes' on both VPCs.

Question 8

An engineer configures a Cloud Router with BGP to advertise a custom learned route for 10.0.0.0/8 to an on-premises router. The on-premises router also receives the same prefix from another path with a lower MED. Which route will the on-premises router prefer?

Accepted Answer

The route from the other path with lower MED. BGP route selection prefers the lowest MED value among routes received from the same neighboring AS. Since the on-premises router receives 10.0.0.0/8 from two paths, and the other path has a lower MED, that route will be preferred. The Cloud Router's advertisement with a higher MED will be less preferred, making option D correct.

Answer

Both routes are used for load balancing

Answer

The on-premises router will ignore MED and prefer the route with higher local preference

Answer

The route advertised by Cloud Router

Question 9

A company needs to connect multiple branch offices to GCP using Partner Interconnect. They need at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps. Which type of Partner Interconnect should they choose?

Accepted Answer

Single connection with 99.9% SLA. Partner Interconnect offers two SLA tiers: 99.9% for a single connection and 99.99% for dual connections. Since the requirement is at least 99.9% availability and bandwidth between 50 Mbps and 10 Gbps, a single connection with 99.9% SLA meets both criteria without the cost and complexity of dual connections.

Answer

Single connection with 99.99% SLA

Answer

Classic VPN

Answer

Dual connection with 99.99% SLA

Question 10

An organization wants to design IP addresses for their GCP VPC that will be peered with an on-premises network using 10.0.0.0/8. Which subnet IP range should they avoid to prevent overlap?

Accepted Answer

10.1.0.0/16. Option A (10.1.0.0/16) is correct because the on-premises network uses 10.0.0.0/8, which encompasses all IPs from 10.0.0.0 to 10.255.255.255. The subnet 10.1.0.0/16 falls entirely within this range, so peering would cause an IP address overlap, breaking routing between the VPC and on-premises. GCP VPC peering requires non-overlapping CIDR blocks to avoid conflicts.

Answer

192.168.0.0/16

Answer

10.0.0.0/8

Answer

172.16.0.0/12

Question 11

A company uses Shared VPC with a host project and several service projects. They want to allow only a specific team to create subnets in the host project, and another team to use those subnets in their service projects. Which IAM roles should be assigned?

Accepted Answer

Compute Network Admin on host project for subnet creators; Compute Network User on host project for subnet users.. To create subnets, a user needs the Compute Network Admin role on the host project. To use subnets, a user needs the Compute Network User role on the host project or specific subnets.

Answer

Compute Network Admin on host project for both teams.

Answer

Compute Shared VPC Admin on host project for subnet creators; Compute Network User on host project for subnet users.

Answer

Compute Network User on host project for subnet creators; Compute Network Admin on service projects for subnet users.

Question 12

A company has multiple VPCs in different projects that need to resolve DNS names across projects. They want a centralized DNS architecture without transferring zone ownership. Which Cloud DNS feature should they implement?

Accepted Answer

DNS peering. DNS peering allows forwarding DNS queries from one VPC to another VPC's DNS for resolution, without zone transfer.

Answer

DNS forwarding (inbound)

Answer

Managed zone with cross-project binding

Answer

Global DNS configuration

Question 13

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Accepted Answer

NCC automatically propagates routes between all spokes.. NCC supports both VPC spokes and hybrid spokes (VPN/Interconnect). It does not support direct VPC-to-VPC peering; that's VPC peering. Route propagation is automatic within NCC.

Answer

NCC supports direct VPC-to-VPC peering without a hub.

Answer

NCC can only connect to on-premises networks via Dedicated Interconnect.

Answer

NCC requires all spokes to be in the same region.

Question 14

An organization needs to design a hybrid connectivity solution with 99.99% availability for a mission-critical application. They have a co-location facility near a GCP region. Which THREE components are required to meet this SLA?

Accepted Answer

Two VLAN attachments. For 99.99% SLA with Dedicated Interconnect, you need two links in different edge availability domains, two VLAN attachments, and BGP sessions with Cloud Router.

Answer

One Dedicated Interconnect link with multiple VLAN attachments

Answer

Classic VPN as a backup

Question 15

A developer wants to configure Cloud DNS for split-horizon DNS where internal queries resolve to private IPs and external queries resolve to public IPs. Which TWO steps should they take?

Accepted Answer

Create a public managed zone for the domain.. Split-horizon DNS is achieved by having a private zone for internal resolution and a public zone for external resolution, both authoritative for the same domain.

Answer

Set up DNS peering between the zones.

Answer

Configure the private zone with a VPC network binding.

Answer

Use DNS forwarding to on-premises servers.