PCNE Designing, Planning, and Prototyping a GCP Network — Timed 50 Questions

Question 1

A company wants to connect two VPCs in the same region so that they can communicate using internal IP addresses without transiting the internet. They have no overlapping IP ranges. Which GCP networking feature should they use?

Accepted Answer

VPC peering. VPC peering allows two VPCs to communicate using internal IPs without a VPN or internet gateway, as long as there is no IP overlap.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Cloud Interconnect

Question 2

An organization needs to create a VPC that automatically creates subnets in every region as new regions become available. Which VPC type should they use?

Accepted Answer

Auto mode VPC. Auto mode VPCs create subnets in all regions automatically and expand to new regions as they become available.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Custom mode VPC

Question 3

A company has two VPCs connected via VPC peering. They want resources in VPC A to be able to reach a service in VPC B that uses a custom static route. What must be configured on the VPC peering connection?

Accepted Answer

Enable export of custom routes in VPC B and import of custom routes in VPC A. By default, custom static routes are not exchanged across VPC peering. You must export custom routes from VPC B and import them into VPC A.

Answer

Enable VPC Flow Logs on both VPCs

Answer

Use a VPN between the VPCs

Answer

Create a Cloud Router in VPC A

Question 4

A financial services company requires a dedicated, low-latency connection between their on-premises data center and Google Cloud. They need a 99.99% SLA and bandwidth of 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides 10 Gbps or 100 Gbps links with a 99.99% SLA when configured with two connections.

Answer

HA VPN

Answer

Partner Interconnect

Answer

Classic VPN

Question 5

A company is planning a hybrid connectivity setup using HA VPN. They want to ensure high availability by using two Cloud VPN gateways. How many tunnels and external IP addresses are required for the HA VPN to achieve 99.99% SLA?

Accepted Answer

2 external IPs, 4 tunnels. HA VPN uses two external IP addresses (one per gateway) and four tunnels (two per gateway) with BGP to provide a 99.99% SLA.

Answer

4 external IPs, 4 tunnels

Answer

2 external IPs, 2 tunnels

Answer

1 external IP, 2 tunnels

Question 6

A company uses Cloud DNS private zones for their internal network. They have multiple projects and want to resolve DNS names from one project's private zone in another project. Which feature should they use?

Accepted Answer

DNS peering. DNS peering allows you to set up cross-project DNS resolution by peering a private zone in one project to a VPC in another project.

Answer

DNS forwarding

Answer

Shared VPC

Answer

VPC peering

Question 7

An organization has multiple VPCs in a Shared VPC setup. They want to allow only certain service projects to use a specific subnet in the host project. What should they configure?

Accepted Answer

Use shared subnet IAM to grant compute.subnetUser on the specific subnet. Shared VPC allows IAM permissions on individual subnets. You can grant the compute.subnetUser role on a specific subnet to a service project.

Answer

Use VPC peering between host and service projects

Answer

Grant the compute.networkUser role to the service project

Answer

Create a separate host project for each service project

Question 8

A company is connecting their on-premises network to GCP via Cloud Interconnect with VLAN attachments and BGP sessions. They want to prefer one attachment over the other for traffic to a specific prefix. Which BGP attribute should they use?

Accepted Answer

MED. Multi-Exit Discriminator (MED) is used to influence inbound traffic from a peer AS. Lower MED values are preferred.

Answer

AS path prepend

Answer

Weight

Answer

Local preference

Question 9

A developer wants to create a GKE cluster with a separate subnet for pods and services to avoid IP address exhaustion. What type of secondary IP ranges should they configure on the VPC subnet?

Accepted Answer

Secondary IP ranges for pods and services. GKE uses secondary IP ranges for pods and services. You specify these ranges when creating the subnet.

Answer

Primary IP ranges

Answer

External IP ranges

Answer

Alias IP ranges

Question 10

A company wants to connect multiple on-premises data centers and multiple GCP VPCs in a hub-and-spoke topology using GCP's managed service. Which service provides this capability?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) uses a hub-and-spoke model to connect on-premises networks and VPCs.

Answer

Cloud VPN

Answer

VPC peering

Answer

Cloud Router

Question 11

An on-premises DNS server is configured to forward queries for a private zone in GCP. They set up inbound DNS forwarding from on-prem to GCP using Cloud DNS forwarding. What must be configured on the VPC?

Accepted Answer

Inbound DNS server policy. Inbound DNS forwarding requires a Cloud DNS inbound server policy that specifies the VPC and the IP addresses of the on-premises DNS resolvers.

Answer

DNS peering zone

Answer

Outbound DNS server policy

Answer

Private zone with an authoritative name server

Question 12

A company needs to advertise a specific prefix from their on-premises network to GCP via Cloud Router. They do not want to advertise all connected networks. What should they configure on the Cloud Router's BGP peer?

Accepted Answer

Route advertisements with custom learned routes. Custom learned routes allow you to specify which prefixes are advertised to GCP via BGP.

Answer

Use a static route instead

Answer

Export custom routes

Answer

Global routing mode

Question 13

A company is planning to use Partner Interconnect to connect their on-premises network to GCP. Which TWO of the following are characteristics of Partner Interconnect?

Accepted Answer

Uses VLAN attachments. Partner Interconnect supports bandwidth from 50 Mbps to 10 Gbps and provides a 99.9% or 99.99% SLA depending on configuration. It does not require colocation facility presence; the partner handles that.

Answer

Requires colocation facility presence

Answer

Supports up to 100 Gbps

Answer

Provides 99.99% SLA with a single connection

Question 14

A company needs to design a split-horizon DNS solution where internal queries resolve to private IPs and external queries resolve to public IPs for the same domain. Which TWO services or configurations should they use?

Accepted Answer

Cloud DNS public managed zone. Split-horizon DNS is achieved by having a public zone for external resolution and a private zone for internal resolution within the same domain.

Answer

Shared VPC

Answer

DNS peering

Answer

DNS forwarding

Question 15

A company has multiple VPCs in different projects and wants to connect them all to a single on-premises data center using a hub-and-spoke model with Network Connectivity Center (NCC). Which THREE components are required for this setup?

Accepted Answer

NCC hub. NCC requires a hub, spokes (VPC spokes or on-prem spokes via interconnect/VPN), and a Cloud Router for dynamic routing.

Answer

Cloud NAT

Answer

VPC peering between spokes

Question 16

A startup is setting up a new GCP project and needs to create a VPC that will have predictable IP ranges for future peering with other VPCs. They do not anticipate needing to grow the network beyond the initial IP range. Which VPC type should they choose?

Accepted Answer

Custom mode VPC. Custom mode VPCs allow you to define your own subnets with specific IP ranges. Auto mode VPCs automatically create subnets in every region, which can cause IP overlap when peering. For controlled, predictable IP ranges, custom mode is appropriate.

Answer

Auto mode VPC

Answer

Shared VPC

Answer

Legacy network

Question 17

An organization is migrating on-premises workloads to GCP. They need a dedicated, high-bandwidth connection with a 99.99% SLA. They have a co-location facility near a Google Cloud region. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct physical connections (10G or 100G links) between on-premises and Google's network, offering a 99.99% SLA when using redundant connections.

Answer

HA VPN

Answer

Cloud VPN (Classic VPN)

Answer

Partner Interconnect

Question 18

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

Accepted Answer

Network Connectivity Center. Network Connectivity Center (NCC) allows you to create a hub-and-spoke model that connects multiple VPCs (spokes) through a common hub, enabling transitive routing without VPC peering limitations.

Answer

VPC Network Peering

Answer

Shared VPC

Answer

Cloud VPN

Question 19

A network engineer is setting up HA VPN between an on-premises network and a GCP VPC. They have configured two Cloud VPN gateways in GCP, each with two interfaces, and four tunnels. They are using BGP with Cloud Router. However, only one of the four tunnels is established. What is the most likely cause?

Accepted Answer

The on-premises VPN gateway is using the same peer IP for multiple tunnels. For HA VPN, each VPN gateway has two external IP addresses. Tunnels should be configured between each GCP IP and the corresponding on-premises peer IP. If the on-premises peer IPs are not unique per tunnel (e.g., both tunnels on-prem use the same IP), BGP sessions may not form correctly. The issue is often due to duplicate peer IPs or misconfiguration of BGP ASNs.

Answer

The Cloud Router ASN is not unique to the project

Answer

The Cloud Router is not advertising the default route

Answer

The VPC firewall rules are blocking UDP port 500

Question 20

A company wants to use Cloud DNS to resolve queries for a private zone (e.g., example.internal) from multiple VPCs in the same project. They need to ensure that instances in all VPCs can resolve the zone. What is the simplest approach?

Accepted Answer

Create a private zone and associate it with all relevant VPCs. A private managed zone can be associated with one or more VPCs in the same project. By associating the zone with all VPCs that need resolution, instances in those VPCs can resolve the zone without additional peering.

Answer

Configure each VM to use a custom DNS resolver

Answer

Use Cloud DNS peering to forward queries between VPCs

Answer

Create a public zone and set visibility to private