PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 8 — 15 Questions

Question 1

A company plans to connect an on-premises network to Google Cloud using HA VPN with dynamic routing (BGP). The on-premises side supports BGP and has two independent routers for redundancy. The company wants to ensure failover within seconds if one tunnel goes down. Which configuration meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises router, and configure a separate Cloud Router on each gateway with BGP.. Deploying two Cloud VPN gateways in different regions with separate Cloud Routers ensures true regional redundancy. If one gateway or its tunnel fails, BGP sessions on the other gateway remain active, and Google Cloud's network can immediately route traffic via the surviving path. This architecture meets the sub-second failover requirement by avoiding a single point of failure at the gateway level and leveraging BGP's fast convergence.

Answer

Create two VPN tunnels from one Cloud VPN gateway to both on-premises routers, and configure one Cloud Router with active/passive BGP.

Answer

Create two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises router, and use static routing with route metrics for failover.

Answer

Create two VPN tunnels from one Cloud VPN gateway to both on-premises routers, and configure a single Cloud Router with BGP.

Question 2

A company uses a Shared VPC host project with three service projects: Prod, Staging, and Dev. All service projects have similar network requirements except that Prod requires Private Google Access to access Google APIs from VM instances without external IP addresses. The network team creates a single subnet in the Shared VPC with Private Google Access enabled. However, Staging and Dev teams report that their VMs cannot reach external IP addresses on the internet because the subnet's route has a next hop of default internet gateway. What is the most cost-effective solution that meets all requirements?

Accepted Answer

Configure Cloud NAT in the Shared VPC for the Staging and Dev service projects to allow outbound internet access from their VMs without external IPs.. Cloud NAT provides outbound internet connectivity for VM instances without external IP addresses, which is exactly what Staging and Dev need. Since Private Google Access is already enabled on the shared subnet, Prod VMs can reach Google APIs without external IPs, while Cloud NAT handles the general internet access for the other projects. This is the most cost-effective solution because Cloud NAT incurs only egress data processing charges and does not require additional subnets or complex routing changes.

Answer

Create a separate subnet for each service project in the Shared VPC and enable Private Google Access only on the Prod subnet.

Answer

Enable Private Google Access on the Shared VPC's subnet for all projects and configure Cloud Router with BGP to advertise a default route.

Answer

Disable Private Google Access on the subnet and create a separate subnet for Prod with Private Google Access enabled.

Question 3

Which TWO statements about VPC Network Peering are correct? (Choose TWO.)

Accepted Answer

Transitive peering is not supported; if Network A is peered with Network B and Network A is peered with Network C, Network B cannot communicate with Network C through Network A.. VPC Network Peering is non-transitive by design. This means that if Network A is peered with both Network B and Network C, traffic cannot flow from Network B to Network C through Network A. Each peering connection is a direct, point-to-point link, and routing is not propagated across multiple peering hops. This behavior is enforced by the GCP networking stack to prevent complex and unintended routing topologies.

Answer

Peered networks can use globally distributed routing to communicate across regions without additional configuration.

Answer

Default routes (0.0.0.0/0) are automatically exported and imported between peered networks.

Answer

Firewall rules from one network are automatically applied to the peered network.

Question 4

Your company has a hybrid network architecture with two Cloud VPN tunnels (tunnel-a and tunnel-b) from an on-premises router to a Cloud VPN gateway in us-central1, and one Dedicated Interconnect connection from the same on-premises router to a VLAN attachment in us-east1. All connections use BGP to exchange routes. The on-premises router advertises the same CIDR block 10.0.0.0/8 to both VPN and Interconnect. Google Cloud routes for on-premises prefixes are learned via both paths with the same priority. You notice that traffic from Google Cloud VMs in us-central1 to on-premises destinations sometimes fails during periods of high load. Additionally, you observe ICMP redirects from the VMs. What is the most likely cause and recommended action?

Accepted Answer

Configure BGP ASN prepending on the Cloud Router associated with the VPN tunnels to make the Interconnect path more preferred for on-premises traffic back to Google Cloud.. The issue is asymmetric routing: traffic from Google Cloud VMs in us-central1 to on-premises destinations uses the Interconnect (us-east1) due to equal-cost multipath (ECMP) or routing decisions, but return traffic from on-premises may prefer the VPN tunnels (tunnel-a/tunnel-b) because BGP path selection (e.g., local preference, AS path length) is not influenced. This causes ICMP redirects and failures under load. Option A corrects this by using BGP ASN prepending on the Cloud Router for the VPN tunnels, artificially lengthening the AS path for routes learned via VPN, making the Interconnect path more preferred for return traffic, ensuring symmetric routing.

Answer

Create a second Cloud VPN gateway in us-east1 and establish a separate VPN tunnel from on-premises to that gateway to provide symmetric routing.

Answer

Enable source NAT on the Cloud VPN gateway so that VMs' source IPs are rewritten, preventing ICMP redirects.

Answer

Disable route propagation on the Cloud Router in us-east1 to force all traffic through the VPN tunnels.

Question 5

A company wants to connect two VPCs in the same region so that they can communicate using internal IP addresses without transiting the internet. They have no overlapping IP ranges. Which GCP networking feature should they use?

Accepted Answer

VPC peering. VPC peering allows two VPCs to communicate using internal IPs without a VPN or internet gateway, as long as there is no IP overlap.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Cloud Interconnect

Question 6

An organization needs to create a VPC that automatically creates subnets in every region as new regions become available. Which VPC type should they use?

Accepted Answer

Auto mode VPC. Auto mode VPCs create subnets in all regions automatically and expand to new regions as they become available.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Custom mode VPC

Question 7

A company has two VPCs connected via VPC peering. They want resources in VPC A to be able to reach a service in VPC B that uses a custom static route. What must be configured on the VPC peering connection?

Accepted Answer

Enable export of custom routes in VPC B and import of custom routes in VPC A. By default, custom static routes are not exchanged across VPC peering. You must export custom routes from VPC B and import them into VPC A.

Answer

Enable VPC Flow Logs on both VPCs

Answer

Use a VPN between the VPCs

Answer

Create a Cloud Router in VPC A

Question 8

A financial services company requires a dedicated, low-latency connection between their on-premises data center and Google Cloud. They need a 99.99% SLA and bandwidth of 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides 10 Gbps or 100 Gbps links with a 99.99% SLA when configured with two connections.

Answer

HA VPN

Answer

Partner Interconnect

Answer

Classic VPN

Question 9

A company is planning a hybrid connectivity setup using HA VPN. They want to ensure high availability by using two Cloud VPN gateways. How many tunnels and external IP addresses are required for the HA VPN to achieve 99.99% SLA?

Accepted Answer

2 external IPs, 4 tunnels. HA VPN uses two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP to provide a 99.99% SLA.

Answer

4 external IPs, 4 tunnels

Answer

2 external IPs, 2 tunnels

Answer

1 external IP, 2 tunnels

Question 10

A company uses Cloud DNS private zones for their internal network. They have multiple projects and want to resolve DNS names from one project's private zone in another project. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows you to set up cross-project DNS resolution by peering a private zone in one project to a VPC in another project.

Answer

DNS forwarding

Answer

Shared VPC

Answer

VPC peering

Question 11

An organization has multiple VPCs in a Shared VPC setup. They want to allow only certain service projects to use a specific subnet in the host project. What should they configure?

Accepted Answer

Use shared subnet IAM to grant compute.subnetUser on the specific subnet. Shared VPC allows IAM permissions on individual subnets. You can grant the compute.subnetUser role on a specific subnet to a service project.

Answer

Use VPC peering between host and service projects

Answer

Grant the compute.networkUser role to the service project

Answer

Create a separate host project for each service project

Question 12

A company is connecting their on-premises network to GCP via Cloud Interconnect with VLAN attachments and BGP sessions. They want to prefer one attachment over the other for traffic to a specific prefix. Which BGP attribute should they use?

Accepted Answer

MED. Multi-Exit Discriminator (MED) is used to influence inbound traffic from a peer AS. Lower MED values are preferred.

Answer

AS path prepend

Answer

Weight

Answer

Local preference

Question 13

A developer wants to create a GKE cluster with a separate subnet for pods and services to avoid IP address exhaustion. What type of secondary IP ranges should they configure on the VPC subnet?

Accepted Answer

Secondary IP ranges for pods and services. GKE uses secondary IP ranges for pods and services. You specify these ranges when creating the subnet.

Answer

Primary IP ranges

Answer

External IP ranges

Answer

Alias IP ranges

Question 14

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) uses a hub-and-spoke model to connect on-premises networks and VPCs.

Answer

Cloud VPN

Answer

VPC peering

Answer

Cloud Router

Question 15

An on-premises DNS server is configured to forward queries for a private zone in GCP. They set up inbound DNS forwarding from on-prem to GCP using Cloud DNS forwarding. What must be configured on the VPC?

Accepted Answer

Inbound DNS server policy. Inbound DNS forwarding requires a Cloud DNS inbound server policy that specifies the VPC and the IP addresses of the on-premises DNS resolvers.

Answer

DNS peering zone

Answer

Outbound DNS server policy

Answer

Private zone with an authoritative name server