PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 8 — 15 Questions

Question 1

A company wants to create a new VPC for a production environment. They need predictable IP addresses and want to avoid any automatic subnet creation. Which type of VPC should they use?

Accepted Answer

Custom mode VPC. Custom mode VPCs do not create subnets automatically, giving full control over IP ranges.

Answer

Legacy VPC

Answer

Shared VPC

Answer

Auto mode VPC

Question 2

An organization has multiple GCP projects that need to share a common network infrastructure. They want to centralize network administration in a single project while allowing service projects to create their own resources in shared subnets. Which networking approach should they use?

Accepted Answer

Shared VPC. Shared VPC allows a host project to share subnets with service projects, with IAM controls for centralized administration.

Answer

Multi-NIC instances in a single project

Answer

VPC peering between all projects

Answer

Network Connectivity Center

Question 3

A company is setting up VPC peering between two VPCs. They need the peered VPC to be able to reach the entire subnets of their VPC, including those that may be added in the future. Which configuration is required?

Accepted Answer

Enable 'Export custom routes' on the peering connection. Exporting custom routes from the VPC ensures that any future subnets (which create custom routes) are advertised to the peer.

Answer

Create static routes in the peer VPC for each subnet

Answer

Use a VPN instead of VPC peering

Answer

Enable 'Import custom routes' on the peering connection

Question 4

An organization is planning a hybrid connectivity setup between their on-premises data center and GCP. They require a 99.99% SLA and want to use a single physical connection at 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect with two 10 Gbps links (one active, one standby) and two VLAN attachments. Option D is correct because Dedicated Interconnect with two 10 Gbps links (one active, one standby) and two VLAN attachments meets the 99.99% SLA requirement. A single physical connection cannot achieve 99.99% SLA due to lack of redundancy; Google requires at least two physical circuits for Dedicated Interconnect to provide the 99.99% SLA. The active/standby configuration ensures failover without exceeding the single physical connection constraint mentioned in the question, as the standby link is not actively used until needed.

Answer

Dedicated Interconnect with a single 10 Gbps link and single VLAN attachment

Answer

Partner Interconnect with 10 Gbps link

Answer

HA VPN with two external IP addresses and four tunnels

Question 5

A company needs to connect multiple on-premises sites and multiple GCP VPCs in a hub-and-spoke topology using Google Cloud. Which service provides a centralized hub for managing such connectivity?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) is the correct choice because it provides a centralized hub-and-spoke topology for connecting multiple on-premises sites (via VPN, Interconnect, or third-party SD-WAN appliances) and multiple GCP VPCs. It manages routing and policy distribution across spokes, eliminating the need for individual peering or complex route tables, and supports both intra- and cross-region connectivity.

Answer

VPC Peering

Answer

Shared VPC

Answer

Cloud Router

Question 6

A team is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They need to set up BGP sessions. Which of the following is a required parameter when creating a BGP peer on the Cloud Router?

Accepted Answer

Peer ASN. The peer ASN is required to configure the BGP session; the Cloud Router ASN is set at the router level.

Answer

Route priority (MED)

Answer

VLAN ID

Answer

Peer IP address

Question 7

An organization has a hybrid network with multiple BGP sessions between on-premises and GCP. They want to influence outbound traffic from GCP to prefer a specific path. Which BGP attribute should they adjust on the Cloud Router?

Accepted Answer

MED (Multi-Exit Discriminator). MED (Multi-Exit Discriminator) is the correct BGP attribute to influence outbound traffic from GCP because it is a metric that tells neighboring ASes which path to prefer when multiple entry points exist. On Cloud Router, adjusting the MED value on the BGP session makes GCP advertise a lower MED for the preferred path, causing on-premises routers to select that path for inbound traffic (from on-premises to GCP). This directly influences the outbound traffic from GCP by controlling how on-premises routers route return traffic, which is the key requirement.

Answer

Local Preference

Answer

Next hop

Answer

AS Path prepend

Question 8

A company wants to run a DNS resolution service for their hybrid cloud environment. They need on-premises servers to resolve GCP private VM hostnames, and GCP VMs to resolve on-premises hostnames. Which Google Cloud service should they use?

Accepted Answer

Cloud DNS with inbound and outbound DNS forwarding. Cloud DNS with inbound and outbound DNS forwarding enables bidirectional DNS resolution between on-premises and GCP.

Answer

Cloud DNS public zone

Answer

Cloud DNS private zone with DNS peering

Answer

Cloud NAT

Question 9

An engineer is planning IP address ranges for two VPCs that will be connected via VPC peering. One VPC uses 10.1.0.0/16 and the other uses 10.2.0.0/16. They also plan to use HA VPN to an on-premises network using 10.0.0.0/8. Which IP range assignment could cause a conflict?

Accepted Answer

Conflict between on-premises (10.0.0.0/8) and both VPCs. The on-premises range 10.0.0.0/8 overlaps with both VPC ranges; VPC peering and VPN both require non-overlapping ranges.

Answer

Conflict between the two VPCs (10.1.0.0/16 and 10.2.0.0/16)

Answer

Conflict between VPC1 (10.1.0.0/16) and on-premises (10.0.0.0/8)

Answer

No conflict; all ranges are non-overlapping

Question 10

A developer needs to create a subnet for GKE pods that will be used by a cluster. They need to specify a secondary IP range for pods. What is the purpose of the 'purpose' field when creating a subnet?

Accepted Answer

It indicates the subnet is used for GKE pods or services. The purpose field determines the subnet's usage; for GKE pods, you set purpose to 'PRIVATE_RFC_1918' or use a secondary range with specific purpose.

Answer

It enables private Google access

Answer

It defines whether the subnet is auto or custom

Answer

It sets the region for the subnet

Question 11

A company is using a Classic VPN with static routing to connect to GCP. They need to add a new subnet in GCP and make it reachable from on-premises without manual configuration changes on-premises. What is the limitation of Classic VPN in this scenario?

Accepted Answer

Classic VPN requires manual route updates on-premises. Classic VPN with static routing requires manual route updates; dynamic routing (BGP) is needed for automatic route advertisement.

Answer

Classic VPN does not support IKEv2

Answer

Classic VPN supports BGP, so routes are automatically advertised

Answer

Classic VPN cannot be used with multiple subnets

Question 12

An organization wants to use Cloud DNS to resolve queries for a custom domain 'example.internal' across multiple projects in the same organization. They have a private zone in project A and want project B to be able to resolve records in that zone. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows a private zone in one project to be shared with other projects for DNS resolution.

Answer

Shared VPC

Answer

Public zone with visibility

Answer

DNS forwarding

Question 13

An organization needs to connect three GCP VPCs (VPC-A, VPC-B, VPC-C) so that all VPCs can communicate with each other. They want a solution that is transitive and does not require full mesh peering. Which TWO approaches meet these requirements?

Accepted Answer

Use Network Connectivity Center with all VPCs as spokes. Network Connectivity Center hub-and-spoke and a VPN appliance in a shared VPC can provide transitive routing. VPC peering is non-transitive and would require full mesh.

Answer

Use Cloud VPN with HA VPN to connect all VPCs

Answer

Use a single shared VPC with subnets for all three networks

Answer

Establish VPC peering between each pair of VPCs (full mesh)

Question 14

A company is designing a hybrid network using Dedicated Interconnect. They want to achieve a 99.99% SLA for availability. Which THREE configurations are required to meet this SLA?

Accepted Answer

Two VLAN attachments (one per connection). Two physical connections, two VLAN attachments, and two BGP sessions (one per attachment) are needed for 99.99% SLA.

Answer

Cloud Router in global dynamic routing mode

Answer

A single 10 Gbps physical connection

Question 15

An engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. They want to control which on-premises subnets are advertised to GCP. Which TWO methods can they use?

Accepted Answer

Apply BGP filters on the on-premises router to limit advertised prefixes. Custom learned routes can be configured to filter prefixes, and BGP filters can be applied on the on-premises side.

Answer

Change the Cloud Router ASN

Answer

Use route priority in the VPC

Answer

Set MED on the on-premises router