PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. A VM in the default VPC with IP 10.0.0.5 is unable to receive traffic from another VM in the same VPC with IP 10.0.1.5. The firewall rule shown is in place. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The target service account does not match the VM's service account. The firewall rule shown uses a target service account, which means it applies only to VM instances that are associated with that specific service account. If the VM at 10.0.0.5 has a different service account (or no service account) than the one specified in the rule, the rule will not apply to it, and traffic will be blocked by the implicit deny-all egress/ingress firewall rules. This is the most likely reason the VM cannot receive traffic from 10.0.1.5.

Answer

The source range does not include 10.0.1.5

Answer

The rule only allows TCP but the traffic is UDP

Answer

The priority is too low

Question 2

Refer to the exhibit. A company has enabled Private Google Access on the subnet. What effect does this have on VMs in the subnet?

Accepted Answer

VMs can access Google services using only internal IPs. Private Google Access enables VMs in a subnet that have only internal IP addresses (RFC 1918) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through Google's internal network. The traffic is routed via the default internet gateway (which does not require an external IP on the VM) and uses a special 0.0.0.0/0 route with next hop 'default internet gateway' to reach Google's external IPs, but the VM itself never needs a public IP. This is why D is correct: VMs can access Google services using only internal IPs.

Answer

VMs can use external IPs to access Google services

Answer

VMs can access the internet using Cloud NAT

Answer

VMs can communicate with each other without firewall rules

Question 3

A company is designing a hybrid network architecture to connect their on-premises data center to Google Cloud. They need high availability and bandwidth of at least 10 Gbps. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect with two circuits (each 10 Gbps) to different edge locations. Dedicated Interconnect with two 10 Gbps circuits to different edge locations meets the 10 Gbps bandwidth requirement and provides high availability through diverse physical paths. Cloud VPN maxes out at 3 Gbps per tunnel, Direct Peering does not offer SLA-backed bandwidth or support for 10 Gbps single connections, and Partner Interconnect typically caps at 1 Gbps per VLAN attachment.

Answer

Cloud VPN with two tunnels to different gateways

Answer

Direct Peering with multiple BGP sessions

Answer

Partner Interconnect with 1 Gbps VLAN attachments

Question 4

A startup is migrating a two-tier application to GCP. The web tier must be accessible from the internet, and the database tier must only be accessible from the web tier. Which network design should be used?

Accepted Answer

Place web servers in a public subnet with external IPs, database in a private subnet, and add a firewall rule allowing traffic from web subnet to database. It places the web servers in a public subnet with external IPs, allowing direct internet access, while the database resides in a private subnet with no external IP, enforcing isolation. A firewall rule (ingress on the database subnet) explicitly permits traffic from the web subnet’s CIDR range, typically on the database port (e.g., TCP 3306 for MySQL), ensuring the database is reachable only from the web tier. This design follows GCP’s best practice of using VPC firewall rules to control east-west traffic between subnets.

Answer

Place both tiers in separate VPCs and use VPC peering with no firewall rules

Answer

Place both tiers in the same subnet and configure firewall rules to restrict database access

Answer

Place web servers in a private subnet with Cloud NAT for outbound, database in the same private subnet

Question 5

An enterprise uses Shared VPC with a host project and multiple service projects. A service project team wants to create a Cloud VPN tunnel to their on-premises network. What must the network team configure in the host project to allow this?

Accepted Answer

The VPN gateway and Cloud Router must be created in the host project's VPC, and the service project must be granted compute.networkUser role on the host project. In a Shared VPC setup, the VPN gateway and Cloud Router must reside in the host project's VPC because the host project owns the underlying network infrastructure. The service project can then use the VPN tunnel by being granted the `compute.networkUser` role on the host project, which allows it to create forwarding rules and use the VPN resources. This ensures that the VPN termination point is within the shared VPC network, enabling connectivity to on-premises networks.

Answer

The service project can create the VPN gateway directly in its own project as long as it uses a VPC that is peered with the host project

Answer

The service project cannot use Cloud VPN with Shared VPC; they must use Dedicated Interconnect instead

Answer

A Cloud Router must be created in the service project, and the VPN gateway in the host project

Question 6

An organization needs to allow on-premises servers to resolve DNS names of GCP VM instances using RFC 1918 addresses. They have a Cloud VPN connection. Which DNS resolution approach should they implement?

Accepted Answer

Configure Cloud DNS inbound server policy and set up forwarding from on-premises DNS to the Cloud DNS inbound endpoint. The on-premises servers need to resolve DNS names of GCP VM instances using RFC 1918 addresses over a Cloud VPN connection. Configuring a Cloud DNS inbound server policy creates a VPC-wide inbound DNS endpoint (using an internal IP address) that on-premises DNS servers can forward queries to. This allows the on-premises DNS to send DNS requests for GCP private zone records (e.g., `vm-instance.c.example.internal`) directly to the Cloud DNS inbound endpoint, which then resolves the private RFC 1918 addresses of the VM instances.

Answer

Set up a public zone and use the instance's external IP for DNS

Answer

Configure Cloud DNS outbound server policy and forward from Cloud DNS to on-premises DNS

Answer

Use DNS peering with a private zone in the on-premises DNS

Question 7

A company is deploying a global HTTP load balancer with a backend service that spans multiple regions. The backend instances are in a managed instance group. They want to use Cloud CDN to cache content. What is the minimal set of configurations required on the backend bucket or instance group to enable Cloud CDN?

Accepted Answer

Enable Cloud CDN on the backend service and ensure that the load balancer's frontend uses HTTP or HTTPS protocol. Cloud CDN must be enabled on the backend service of the HTTP(S) load balancer, and the frontend must use HTTP or HTTPS because Cloud CDN only supports HTTP(S) protocols. This is the minimal configuration; no changes to the backend bucket or instance group are required beyond ensuring the backend service is correctly associated with the load balancer.

Answer

Configure Identity-Aware Proxy (IAP) on the backend service to allow cache

Answer

Use the gcloud compute backend-services update command with the --enable-cdn flag on the load balancer itself

Answer

Create a Cloud Storage bucket with public access and set it as the backend

Question 8

A network engineer is designing a VPC with custom subnet mode. They need to allocate IP addresses for three tiers: web (100 instances), app (200 instances), and db (50 instances). The VPC will be in the us-central1 region. Which subnet plan is most cost-effective and scalable?

Accepted Answer

Create three subnets: 10.0.1.0/24 (web), 10.0.2.0/23 (app), 10.0.4.0/26 (db). It allocates IP addresses efficiently for each tier: a /24 (256 IPs) for web (100 instances), a /23 (512 IPs) for app (200 instances), and a /26 (64 IPs) for db (50 instances). This minimizes wasted IP space while providing room for growth, and using separate subnets per tier allows granular firewall rules and routing. In a custom VPC, this design is both cost-effective (no over-provisioning) and scalable (each tier can expand within its subnet).

Answer

Use one subnet per zone: us-central1-a: 10.0.0.0/22, us-central1-b: 10.0.4.0/22, us-central1-c: 10.0.8.0/22

Answer

Create two subnets: 10.0.1.0/24 (web+app) and 10.0.3.0/24 (db)

Answer

Create one subnet 10.0.0.0/20 and use network tags to isolate tiers via firewall rules

Question 9

A company has a VPC with a subnet in us-central1 (10.0.0.0/16) and a Cloud VPN tunnel to an on-premises network (192.168.0.0/16). They also have a static route for 0.0.0.0/0 internet gateway. On-premises traffic to 10.0.0.0/16 is working. However, traffic from a GCE instance in the VPC to an on-premises IP 192.168.1.10 is timing out. What is the most likely cause?

Accepted Answer

Missing a custom static route in the VPC for destination 192.168.0.0/16 with next hop VPN gateway. The VPC has a default route (0.0.0.0/0) pointing to the internet gateway, but no specific route for the on-premises network (192.168.0.0/16). Without a custom static route with next hop set to the VPN gateway, traffic from the GCE instance to 192.168.1.10 will be forwarded to the internet gateway instead of the VPN tunnel, causing a timeout.

Answer

Cloud NAT is not configured for the VPC

Answer

The VPN tunnel is down and BGP session is not established

Answer

Firewall rule does not allow inbound traffic from on-premises to the instance

Question 10

A developer wants to deploy a single Compute Engine instance that needs to initiate outbound connections to the internet, but should not have a public IP address. Which GCP networking feature must be configured?

Accepted Answer

Cloud NAT on the subnet or VPC. Cloud NAT (Network Address Translation) allows private Compute Engine instances to initiate outbound connections to the internet without assigning them public IP addresses. It translates the instance's private IP to a Cloud NAT external IP address for outbound traffic, while unsolicited inbound connections from the internet are blocked. This is the correct solution because the requirement explicitly states no public IP on the instance, yet outbound internet access is needed.

Answer

Configure a private Google access for the subnet

Answer

Assign a static external IP address to the instance

Answer

Set up an internal HTTP(S) load balancer

Question 11

Which TWO statements are true about VPC Network Peering?

Accepted Answer

Each VPC can have up to 25 peerings by default. The default limit for VPC Network Peering per VPC is 25, as documented in Google Cloud's quotas and limits. This is a soft limit that can be increased by requesting a quota adjustment, but by default, each VPC can have up to 25 peerings. Option B is correct because VPC Network Peering allows direct communication between VPCs using RFC 1918 private IP addresses without requiring VPN tunnels or Cloud Interconnect, as the peering connection uses Google's internal network infrastructure.

Answer

Firewall rules in one VPC are automatically applied to the peered VPC

Answer

VPC peering incurs additional cost beyond standard egress charges

Answer

Custom static routes are automatically exchanged between peered VPCs

Question 12

Which THREE actions are required to configure a High-Availability Cloud VPN (HA VPN) with dynamic routing to an on-premises peer?

Accepted Answer

Create two VPN tunnels, each associated with a different Cloud VPN gateway interface. HA VPN requires two tunnels, each attached to a different interface of the Cloud VPN gateway, to provide redundancy and failover. This ensures that if one tunnel or interface fails, traffic can continue through the other tunnel. Option C is correct because each tunnel must have its own external IP address, so you need to allocate two external IP addresses for the HA VPN gateway interfaces. Option D is correct because a Cloud Router must be created in the same region as the VPN gateway to manage BGP sessions for dynamic routing. Option B is incorrect because HA VPN uses a single Cloud Router to manage BGP sessions for both tunnels; separate Cloud Routers are not required. Option E is incorrect because with dynamic routing, static routes are not needed; the BGP sessions advertise routes automatically.

Answer

Create two separate Cloud Routers, one for each tunnel

Answer

Configure static routes for the remote network in the VPC

Question 13

Which TWO of the following are valid reasons to use a Shared VPC architecture?

Accepted Answer

To prevent individual projects from creating their own VPCs and force them to use a common VPC. A Shared VPC architecture allows an organization to enforce that individual projects cannot create their own VPCs; instead, they must use a common VPC that is centrally managed. This is achieved by designating a host project that contains the shared VPC network, and attaching service projects to it, which prevents the service projects from having their own independent VPC networks.

Answer

To reduce latency by placing resources in the same region within a single VPC

Answer

To improve network connectivity between different organizational units without using VPN or peering

Answer

To reduce egress costs by having all resources in one VPC

Question 14

A company wants to connect their on-premises data center to Google Cloud using a site-to-site VPN with dynamic routing. Which protocol should they use for route exchange?

Accepted Answer

BGP. C is correct because Cloud VPN with dynamic routing requires BGP (Border Gateway Protocol) to exchange routes between the on-premises router and the Cloud Router. BGP is the only dynamic routing protocol supported by Google Cloud for site-to-site VPN tunnels, as it allows route advertisement, failover, and policy-based control over multiple tunnels.

Answer

OSPF

Answer

Static routing

Answer

RIP

Question 15

A company wants to deploy an HTTP application on Compute Engine instances in us-east1 and europe-west1, and use a global external HTTP(S) load balancer. How should they configure the backend?

Accepted Answer

Create one backend service and add two instance groups, one from each region.. A global external HTTP(S) load balancer requires a single backend service that can span multiple regions. By adding one instance group from us-east1 and another from europe-west1 to the same backend service, the load balancer automatically routes traffic to the closest healthy backend based on the client's geographic location and the load balancer's anycast IP. This configuration leverages Google's global network infrastructure for optimal latency and failover.

Answer

Create a regional load balancer in each region and use DNS round-robin.

Answer

Create one backend service and add one instance group with instances in both regions.

Answer

Create two backend services, one per region, and attach to the same URL map.