PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 6 — 15 Questions

Question 1

A startup is deploying its first application on Google Cloud and needs to create a VPC network. They want to avoid manual subnet planning and prefer that Google automatically creates subnets in each region as they expand. Which VPC type should they choose?

Accepted Answer

Auto mode VPC. Auto mode VPCs automatically create subnets in each region with predetermined IP ranges, simplifying initial setup. Custom mode VPCs require manual subnet creation.

Answer

Shared VPC

Answer

VPC Network Peering

Answer

Custom mode VPC

Question 2

An organization wants to connect its on-premises data center to Google Cloud using Dedicated Interconnect. They require 99.99% availability SLA. Which configuration meets this requirement?

Accepted Answer

Two 10Gbps Dedicated Interconnect connections, each with its own VLAN attachment and BGP session, from the same provider. Dedicated Interconnect offers 99.99% SLA when you have two separate physical connections (each 10Gbps or 100Gbps) from the same provider, each with its own VLAN attachment and BGP session, and they are configured in a redundant manner.

Answer

A single 10Gbps Dedicated Interconnect connection with one VLAN attachment and one BGP session

Answer

A single 100Gbps Dedicated Interconnect connection with two VLAN attachments and two BGP sessions

Answer

Two Partner Interconnect connections with 99.9% SLA each

Question 3

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.0.0.0/16). They want to establish VPC Network Peering between them. What is the outcome?

Accepted Answer

Peering fails because subnets overlap. VPC Network Peering requires that the subnets in the two VPCs do not overlap. Since both VPCs use the same CIDR block (10.0.0.0/16), peering will fail due to subnet overlap.

Answer

Peering succeeds, and only non-overlapping subnets are used

Answer

Peering succeeds, and routes are exchanged, but traffic may be unpredictable

Answer

Peering succeeds, but routes are not exchanged

Question 4

An engineer needs to configure a Cloud Router for a VPN tunnel to an on-premises network. The on-premises BGP ASN is 64512. Which ASN should the engineer assign to the Cloud Router?

Accepted Answer

64513. Cloud Router requires a unique ASN (typically a private ASN from 64512-65534) that does not conflict with the on-premises ASN. The default ASN for Cloud Router is 64512, but it must be changed if the on-premises ASN is the same. The engineer should use a different private ASN, such as 64513.

Answer

64512

Answer

Any public ASN

Answer

0

Question 5

Which Google Cloud service allows you to create a hub-and-spoke topology for connecting on-premises networks and VPCs?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) provides a hub-and-spoke model to interconnect on-premises networks and VPCs centrally.

Answer

Cloud VPN

Answer

VPC Network Peering

Answer

Cloud Interconnect

Question 6

A company wants to resolve DNS queries from their on-premises network for Google Cloud private zones (e.g., example.internal) without duplicating DNS data. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS forwarding. Cloud DNS inbound server policy allows on-premises DNS resolvers to forward queries to Cloud DNS for resolution of private zones. This avoids the need to replicate zone data on-premises.

Answer

DNS peering

Answer

Private DNS zones

Answer

Outbound DNS forwarding

Question 7

An organization is migrating a legacy application to GCP. The application requires static routing and does not support BGP. Which VPN option should they use?

Accepted Answer

Classic VPN. Classic VPN supports static routing (policy-based or route-based) without BGP. Cloud VPN (HA VPN) and Partner Interconnect require BGP, and Dedicated Interconnect uses BGP for VLAN attachments.

Answer

Dedicated Interconnect

Answer

Partner Interconnect

Answer

HA VPN

Question 8

A company uses Shared VPC to grant separate teams access to subnets in a host project. They want to allow Team A to create VM instances in subnet-1, but not delete the subnet itself. Which IAM role should be granted to Team A on subnet-1?

Accepted Answer

roles/compute.networkUser. The Compute Network User role (roles/compute.networkUser) grants permissions to use existing networks and subnets (create VMs, attach disks, etc.) but not to delete or modify network resources.

Answer

roles/owner

Answer

roles/compute.networkAdmin

Answer

roles/compute.instanceAdmin.v1

Question 9

Which IP address type in Google Cloud can communicate with the internet but is not reachable from the internet?

Accepted Answer

Internal IP address. Private IP addresses (RFC 1918) are used for internal communication within a VPC and cannot be directly reached from the internet. They can access the internet via Cloud NAT or a VM with a public IP.

Answer

Public IP address

Answer

External IP address

Answer

Ephemeral IP address

Question 10

An engineer is troubleshooting a VPC Network Peering connection between VPC-A and VPC-B. They have verified that the peering is active. However, an instance in VPC-A cannot reach an instance in VPC-B using its internal IP. Both VPCs have firewall rules allowing the traffic. What is the most likely cause?

Accepted Answer

Custom routes are not being exchanged between the VPCs. When VPC Network Peering is active but traffic fails, the most common cause is that custom routes are not being exchanged. By default, only subnet routes are exchanged; custom routes (e.g., static routes or routes from VPNs) are not shared unless explicitly configured using the 'export custom routes' option in the peering settings. Without this, the instance in VPC-A has no route to the internal IP of the instance in VPC-B, even if firewall rules allow the traffic.

Answer

The firewall rules are not applied to the correct tags

Answer

The subnet IP ranges overlap

Answer

The instance in VPC-A does not have a default route

Question 11

A company needs to resolve DNS queries for a private zone (e.g., corp.example.com) from multiple GCP projects that are not in the same organization. Which Cloud DNS feature should they use?

Accepted Answer

DNS peering. DNS peering allows you to resolve DNS queries across different GCP projects, even if they are not in the same organization, by establishing a peering relationship between two VPC networks. This enables the private zone (corp.example.com) in one project to be queried from instances in another project without exposing the zone to the internet or requiring shared VPC.

Answer

Private DNS zones

Answer

DNS forwarding

Answer

Shared VPC

Question 12

An organization wants to use Cloud Router with BGP to advertise a specific on-premises subnet (10.0.1.0/24) to its GCP VPC. Which BGP attribute should they use to influence route selection if multiple paths exist?

Accepted Answer

Multi-Exit Discriminator (MED). The Multi-Exit Discriminator (MED) is the correct BGP attribute for influencing inbound route selection when multiple paths exist from different autonomous systems (ASes). In this scenario, the organization advertises 10.0.1.0/24 via Cloud Router, and MED allows the on-premises router to prefer a specific path by suggesting a lower metric value (default 0, lower is better). Unlike Weight or Local Preference, MED is exchanged between ASes and directly affects how the on-premises side selects among multiple GVP paths.

Answer

Weight

Answer

Local Preference

Answer

AS Path

Question 13

A company is planning a hybrid connectivity strategy between their on-premises data center and GCP. They require at least 99.9% availability and are open to using a third-party service provider. Which TWO options meet these requirements? (Choose TWO.)

Accepted Answer

Dedicated Interconnect (single 10 Gbps connection). Partner Interconnect with two connections offers 99.99% SLA, but a single connection offers 99.9%. HA VPN with two tunnels offers 99.99% SLA, but the scenario requires at least 99.9%, so any option meeting that is acceptable. Dedicated Interconnect with one connection offers 99.9% SLA, but it's not via a third-party provider. Classic VPN does not have a 99.9% SLA.

Answer

VPC Network Peering

Answer

Classic VPN (static routing)

Answer

HA VPN (single tunnel)

Question 14

An organization wants to isolate development and production environments using separate VPC networks within the same project. They need the development VPC to have access to a shared service, such as a Cloud SQL instance, which resides in a separate project. Which THREE actions are required to achieve this? (Choose THREE.)

Accepted Answer

Configure Shared VPC with the Cloud SQL project as the host project. Shared VPC allows a host project to share subnets with service projects. In this case, the shared service project can be the host project, and the development VPC can be attached to it. Alternatively, VPC peering can connect the development VPC to the service project's VPC. Cloud SQL private services access requires a VPC peering between the Cloud SQL VPC and the client VPC. However, the simplest approach is to use Shared VPC: the service project (with Cloud SQL) becomes the host project, and the development VPC is created in a service project attached to it. But the question says 'within the same project' for development and production VPCs, so those VPCs are in the same project. The shared service is in a separate project. So to access Cloud SQL privately, they need to either use Private Services Access (which requires VPC peering) or use Shared VPC where the host project contains the Cloud SQL VPC. Since the VPCs are in the same project, they can use a single VPC with subnets, but to isolate, they prefer separate VPCs. The correct combination: create the development VPC as a service project of the shared VPC host project (which contains the Cloud SQL), enable Private Services Access between the host project VPC and the Cloud SQL VPC (which is in a separate project), and configure firewall rules. However, Private Services Access is configured once per VPC. The three actions: 1. Configure the shared VPC host project to include the Cloud SQL VPC (actually Private Services Access is set up on the host VPC). 2. Attach the development VPC's project as a service project to the shared VPC host project. 3. Set up VPC Network Peering between the host VPC and the Cloud SQL VPC (if Cloud SQL is in a separate project). But Private Services Access automatically creates a peering. Alternatively, using Cloud SQL private services access requires the VPC to be in the same project or connected via Shared VPC. Let's think: Cloud SQL can be configured with private IP in a VPC. If that VPC is in a separate project, it cannot be directly accessed from another project's VPC without peering. So the actions would be: create a shared VPC host project, attach the Cloud SQL project as a service project (if Cloud SQL is in that project), but Cloud SQL is already in a separate project. Actually, the simplest is to use VPC peering between the development VPC and the Cloud SQL VPC. But that requires manual peering. Given the options, the correct three are: A, D, and C? Let's assume the options include: A. Configure Shared VPC with the Cloud SQL project as host project. B. Configure VPC Network Peering between the development VPC and the Cloud SQL VPC. C. Enable Private Services Access on the development VPC. D. Attach the development project as a service project to the shared VPC host project. E. Create a firewall rule allowing traffic from the development VPC to the Cloud SQL IP range. The correct answer: A, D, and C? Actually, to use Cloud SQL private IP, you need Private Services Access enabled on the VPC. If you use Shared VPC, the host project's VPC is used. So you would enable Private Services Access on the host VPC, attach the development project as a service project, and ensure the Cloud SQL instance is in the host project's VPC. But Cloud SQL is in a separate project. So you would need to either move it or use peering. Given typical exam, the answer might be: Configure Shared VPC, attach the development project as a service project, and enable Private Services Access on the host VPC. So let's choose A, D, C.

Answer

Create a firewall rule allowing ingress from the Cloud SQL instance to the development VPC

Answer

Configure VPC Network Peering between the development VPC and the Cloud SQL VPC

Question 15

A company has multiple GCP projects that need to resolve DNS queries for a private zone (e.g., example.internal) that is hosted in a central project. They want to avoid copying zone data. Which TWO features can be used to achieve this? (Choose TWO.)

Accepted Answer

DNS peering. DNS peering allows a zone to be shared from one project to another. Shared VPC can also enable DNS resolution if the private zone is attached to the shared VPC host project and service projects use that VPC. However, DNS peering is more direct. Outbound forwarding is for on-premises resolution, not cross-project. Inbound forwarding is for on-premises to Cloud DNS. Private zones are per-project and don't automatically resolve cross-project.

Answer

Outbound DNS forwarding

Answer

Creating duplicate private zones in each project

Answer

Inbound DNS forwarding