PCNE Designing, Planning, and Prototyping a GCP Network Practice Test 9 — 15 Questions

Question 1

A company needs to advertise a specific prefix from their on-premises network to GCP via Cloud Router. They do not want to advertise all connected networks. What should they configure on the Cloud Router's BGP peer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route advertisements with custom learned routes. Custom learned routes allow you to specify which prefixes are advertised to GCP via BGP.

Answer

Use a static route instead

Answer

Export custom routes

Answer

Global routing mode

Question 2

A company is planning to use Partner Interconnect to connect their on-premises network to GCP. Which TWO of the following are characteristics of Partner Interconnect?

Accepted Answer

Uses VLAN attachments. Partner Interconnect supports bandwidth from 50 Mbps to 10 Gbps and provides a 99.9% or 99.99% SLA depending on configuration. It does not require colocation facility presence; the partner handles that.

Answer

Requires colocation facility presence

Answer

Supports up to 100 Gbps

Answer

Provides 99.99% SLA with a single connection

Question 3

A company needs to design a split-horizon DNS solution where internal queries resolve to private IPs and external queries resolve to public IPs for the same domain. Which TWO services or configurations should they use?

Accepted Answer

Cloud DNS public managed zone. Split-horizon DNS is achieved by having a public zone for external resolution and a private zone for internal resolution within the same domain.

Answer

Shared VPC

Answer

DNS peering

Answer

DNS forwarding

Question 4

A company has multiple VPCs in different projects and wants to connect them all to a single on-premises data center using a hub-and-spoke model with Network Connectivity Center (NCC). Which THREE components are required for this setup?

Accepted Answer

NCC hub. NCC requires a hub, spokes (VPC spokes or on-prem spokes via interconnect/VPN), and a Cloud Router for dynamic routing.

Answer

Cloud NAT

Answer

VPC peering between spokes

Question 5

A startup is setting up a new GCP project and needs to create a VPC that will have predictable IP ranges for future peering with other VPCs. They do not anticipate needing to grow the network beyond the initial IP range. Which VPC type should they choose?

Accepted Answer

Custom mode VPC. Custom mode VPCs allow you to define your own subnets with specific IP ranges. Auto mode VPCs automatically create subnets in every region, which can cause IP overlap when peering. For controlled, predictable IP ranges, custom mode is appropriate.

Answer

Auto mode VPC

Answer

Shared VPC

Answer

Legacy network

Question 6

An organization is migrating on-premises workloads to GCP. They need a dedicated, high-bandwidth connection with a 99.99% SLA. They have a co-location facility near a Google Cloud region. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct physical connections (10G or 100G links) between on-premises and Google's network, offering a 99.99% SLA when using redundant connections.

Answer

HA VPN

Answer

Cloud VPN (Classic VPN)

Answer

Partner Interconnect

Question 7

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 8

A network engineer is setting up HA VPN between an on-premises network and a GCP VPC. They have configured two Cloud VPN gateways in GCP, each with two interfaces, and four tunnels. They are using BGP with Cloud Router. However, only one of the four tunnels is established. What is the most likely cause?

Accepted Answer

The on-premises VPN gateway is using the same peer IP for multiple tunnels. For HA VPN, each VPN gateway has two external IP addresses. Tunnels should be configured between each GCP IP and the corresponding on-premises peer IP. If the on-premises peer IPs are not unique per tunnel (e.g., both tunnels on-prem use the same IP), BGP sessions may not form correctly. The issue is often due to duplicate peer IPs or misconfiguration of BGP ASNs.

Answer

The Cloud Router ASN is not unique to the project

Answer

The Cloud Router is not advertising the default route

Answer

The VPC firewall rules are blocking UDP port 500

Question 9

A company wants to use Cloud DNS to resolve queries for a private zone (e.g., example.internal) from multiple VPCs in the same project. They need to ensure that instances in all VPCs can resolve the zone. What is the simplest approach?

Accepted Answer

Create a private zone and associate it with all relevant VPCs. A private managed zone can be associated with one or more VPCs in the same project. By associating the zone with all VPCs that need resolution, instances in those VPCs can resolve the zone without additional peering.

Answer

Configure each VM to use a custom DNS resolver

Answer

Use Cloud DNS peering to forward queries between VPCs

Answer

Create a public zone and set visibility to private

Question 10

An organization is designing IP address planning for hybrid connectivity. They have three VPCs (Prod, Dev, Test) that will be peered with each other and also connected to an on-premises network via Cloud VPN. Which practice should they follow to avoid IP address overlap?

Accepted Answer

Allocate unique, non-overlapping IP ranges for each VPC and on-premises network. To avoid routing conflicts, each VPC and the on-premises network should use unique, non-overlapping RFC 1918 CIDR blocks. Overlap would cause routing issues and potential traffic blackholing.

Answer

Use overlapping IP ranges but rely on NAT to resolve conflicts

Answer

Use carrier-grade NAT (CGNAT) ranges for all VPCs to avoid private IP conflicts

Answer

Use the same /16 range for all VPCs to simplify route summarization

Question 11

A company has a Shared VPC setup with a host project and several service projects. They want to grant a service project's network admin the ability to create VM instances using a specific subnet from the host project. Which IAM role should they assign at the subnet level?

Accepted Answer

Compute Network User (roles/compute.networkUser) on the specific subnet. Shared VPC allows granting IAM roles on individual subnets. The Compute Network User role (roles/compute.networkUser) allows a principal to use a subnet to create resources, without giving them broader network management permissions.

Answer

Project Owner on the host project

Answer

Compute Instance Admin (roles/compute.instanceAdmin) on the service project

Answer

Compute Network Admin (roles/compute.networkAdmin) on the host project

Question 12

A network engineer is troubleshooting BGP route propagation between an on-premises network and a GCP VPC via Cloud Router. The on-premises router is advertising a specific subnet (10.1.0.0/16), but GCP is not receiving the route. Cloud Router BGP sessions are established. Which configuration could be the issue?

Accepted Answer

The Cloud Router is configured to only accept routes from a specific set of prefixes. Cloud Router has an option to set custom route advertisements. If the on-premises route is not being accepted, it could be because the Cloud Router is configured with 'advertised route priority' or 'advertised IP ranges' that exclude the on-premises prefixes. More likely, the BGP peer is configured to accept only specific prefixes via 'advertised route priority' or 'advertised groups'. Another common issue: the on-premises router needs to advertise the route; Cloud Router must have 'advertise custom routes' enabled or the route must be within the allowed prefixes.

Answer

The VPC firewall rules are blocking BGP traffic (TCP port 179)

Answer

The Cloud Router is configured with a higher MED value for the route

Answer

The on-premises router is not sending the AS_PATH attribute

Question 13

A developer needs to create a GKE cluster that uses a secondary IP range for pods and another for services. During VPC subnet creation, they set a primary IP range and two secondary ranges. Which flag must be used when creating the subnet to specify the pods range?

Accepted Answer

--secondary-range. When creating a subnet with secondary IP ranges, the '--secondary-range' flag is used to specify the name and range for pods (or services). The CLI command allows multiple secondary ranges.

Answer

--pods-range

Answer

--additional-ip-range

Answer

--auxiliary-range

Question 14

An organization needs DNS resolution for on-premises hosts to resolve GCP private zone names (e.g., myinstance.gcp.internal). They have Cloud DNS private zones in GCP. Which Cloud DNS feature should they configure to forward queries from on-premises to GCP?

Accepted Answer

Inbound DNS forwarding. Cloud DNS inbound server policy enables on-premises DNS resolvers to forward queries to Cloud DNS for resolution of private zones. This is the appropriate feature for on-premises to GCP DNS resolution.

Answer

Split-horizon DNS

Answer

DNS peering

Answer

Outbound DNS forwarding

Question 15

A company is using VPC Network Peering between two VPCs. They want to ensure that routes for a specific subnet in VPC A are exported to VPC B. However, VPC B should not export its routes to VPC A. What peering configuration should they set?

Accepted Answer

On VPC B's peering, enable 'Import custom routes'; on VPC A's peering, disable 'Export custom routes'. VPC Network Peering consists of two separate peering connections: one from VPC A to VPC B and another from VPC B to VPC A. To ensure VPC B receives the specific subnet from VPC A, the import setting on VPC B's peering must be enabled to accept routes. Option B enables 'Import custom routes' on VPC B's peering, allowing B to import routes if they are exported by A. However, it disables 'Export custom routes' on VPC A's peering, which means A will not export its routes. Among the options, only B ensures import is enabled on B, which is necessary for receiving routes. The other options either disable import on B or do not allow selective export. While B does not fully meet the requirement, it is the closest correct configuration based on the available choices.

Answer

On VPC A's peering, enable 'Export selected custom routes' and specify the subnet; on VPC B's peering, disable all route export/import

Answer

Enable VPC Network Peering with default settings

Answer

On VPC A's peering, enable 'Export custom routes'; on VPC B's peering, disable 'Import custom routes'