PCNE Designing, Planning, and Prototyping a GCP Network — Timed 15 Questions

Question 1

A company wants to connect two VPCs in the same region so that they can communicate using internal IP addresses without transiting the internet. They have no overlapping IP ranges. Which GCP networking feature should they use?

Accepted Answer

VPC peering. VPC peering allows two VPCs to communicate using internal IPs without a VPN or internet gateway, as long as there is no IP overlap.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Cloud Interconnect

Question 2

An organization needs to create a VPC that automatically creates subnets in every region as new regions become available. Which VPC type should they use?

Accepted Answer

Auto mode VPC. Auto mode VPCs create subnets in all regions automatically and expand to new regions as they become available.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Custom mode VPC

Question 3

A company has two VPCs connected via VPC peering. They want resources in VPC A to be able to reach a service in VPC B that uses a custom static route. What must be configured on the VPC peering connection?

Accepted Answer

Enable export of custom routes in VPC B and import of custom routes in VPC A. By default, custom static routes are not exchanged across VPC peering. You must export custom routes from VPC B and import them into VPC A.

Answer

Enable VPC Flow Logs on both VPCs

Answer

Use a VPN between the VPCs

Answer

Create a Cloud Router in VPC A

Question 4

A financial services company requires a dedicated, low-latency connection between their on-premises data center and Google Cloud. They need a 99.99% SLA and bandwidth of 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides 10 Gbps or 100 Gbps links with a 99.99% SLA when configured with two connections.

Answer

HA VPN

Answer

Partner Interconnect

Answer

Classic VPN

Question 5

A company is planning a hybrid connectivity setup using HA VPN. They want to ensure high availability by using two Cloud VPN gateways. How many tunnels and external IP addresses are required for the HA VPN to achieve 99.99% SLA?

Accepted Answer

2 external IPs, 4 tunnels. HA VPN uses two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP to provide a 99.99% SLA.

Answer

4 external IPs, 4 tunnels

Answer

2 external IPs, 2 tunnels

Answer

1 external IP, 2 tunnels

Question 6

A company uses Cloud DNS private zones for their internal network. They have multiple projects and want to resolve DNS names from one project's private zone in another project. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows you to set up cross-project DNS resolution by peering a private zone in one project to a VPC in another project.

Answer

DNS forwarding

Answer

Shared VPC

Answer

VPC peering

Question 7

An organization has multiple VPCs in a Shared VPC setup. They want to allow only certain service projects to use a specific subnet in the host project. What should they configure?

Accepted Answer

Use shared subnet IAM to grant compute.subnetUser on the specific subnet. Shared VPC allows IAM permissions on individual subnets. You can grant the compute.subnetUser role on a specific subnet to a service project.

Answer

Use VPC peering between host and service projects

Answer

Grant the compute.networkUser role to the service project

Answer

Create a separate host project for each service project

Question 8

A company is connecting their on-premises network to GCP via Cloud Interconnect with VLAN attachments and BGP sessions. They want to prefer one attachment over the other for traffic to a specific prefix. Which BGP attribute should they use?

Accepted Answer

MED. Multi-Exit Discriminator (MED) is used to influence inbound traffic from a peer AS. Lower MED values are preferred.

Answer

AS path prepend

Answer

Weight

Answer

Local preference

Question 9

A developer wants to create a GKE cluster with a separate subnet for pods and services to avoid IP address exhaustion. What type of secondary IP ranges should they configure on the VPC subnet?

Accepted Answer

Secondary IP ranges for pods and services. GKE uses secondary IP ranges for pods and services. You specify these ranges when creating the subnet.

Answer

Primary IP ranges

Answer

External IP ranges

Answer

Alias IP ranges

Question 10

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) uses a hub-and-spoke model to connect on-premises networks and VPCs.

Answer

Cloud VPN

Answer

VPC peering

Answer

Cloud Router

Question 11

An on-premises DNS server is configured to forward queries for a private zone in GCP. They set up inbound DNS forwarding from on-prem to GCP using Cloud DNS forwarding. What must be configured on the VPC?

Accepted Answer

Inbound DNS server policy. Inbound DNS forwarding requires a Cloud DNS inbound server policy that specifies the VPC and the IP addresses of the on-premises DNS resolvers.

Answer

DNS peering zone

Answer

Outbound DNS server policy

Answer

Private zone with an authoritative name server

Question 12

A company needs to advertise a specific prefix from their on-premises network to GCP via Cloud Router. They do not want to advertise all connected networks. What should they configure on the Cloud Router's BGP peer?

Accepted Answer

Route advertisements with custom learned routes. Custom learned routes allow you to specify which prefixes are advertised to GCP via BGP.

Answer

Use a static route instead

Answer

Export custom routes

Answer

Global routing mode

Question 13

A company is planning to use Partner Interconnect to connect their on-premises network to GCP. Which TWO of the following are characteristics of Partner Interconnect?

Accepted Answer

Uses VLAN attachments. Partner Interconnect supports bandwidth from 50 Mbps to 10 Gbps and provides a 99.9% or 99.99% SLA depending on configuration. It does not require colocation facility presence; the partner handles that.

Answer

Requires colocation facility presence

Answer

Supports up to 100 Gbps

Answer

Provides 99.99% SLA with a single connection

Question 14

A company needs to design a split-horizon DNS solution where internal queries resolve to private IPs and external queries resolve to public IPs for the same domain. Which TWO services or configurations should they use?

Accepted Answer

Cloud DNS public managed zone. Split-horizon DNS is achieved by having a public zone for external resolution and a private zone for internal resolution within the same domain.

Answer

Shared VPC

Answer

DNS peering

Answer

DNS forwarding

Question 15

A company has multiple VPCs in different projects and wants to connect them all to a single on-premises data center using a hub-and-spoke model with Network Connectivity Center (NCC). Which THREE components are required for this setup?

Accepted Answer

NCC hub. NCC requires a hub, spokes (VPC spokes or on-prem spokes via interconnect/VPN), and a Cloud Router for dynamic routing.

Answer

Cloud NAT

Answer

VPC peering between spokes