PCNE Implementing VPC Instances Practice Test 2 — 15 Questions

Question 1

What is the default Maximum Transmission Unit (MTU) for Compute Engine virtual machines?

Accepted Answer

1460. GCP uses an MTU of 1460 for both VMs and the underlying network infrastructure.

Answer

1500

Answer

9001

Answer

1400

Question 2

An organization wants to allow on-premises hosts to connect to a Cloud SQL instance privately without traversing the public internet. They have a Cloud VPN tunnel set up. What additional step is required?

Accepted Answer

Enable Private Service Connect on the Cloud SQL instance. Cloud SQL is a managed Google service that lives in a Google-managed VPC, not the customer's VPC. To reach it privately from on-premises over an existing Cloud VPN tunnel, you must enable Private Service Connect (PSC) on the Cloud SQL instance and create a PSC endpoint/attachment in the customer VPC. The VPN tunnel then routes to that internal endpoint, keeping traffic off the public internet.

Answer

Create a VPC peering connection

Answer

Add a route with next hop set to the VPN gateway

Answer

Configure Cloud NAT

Question 3

What is the internal DNS name format for a Compute Engine instance named 'web-server' in zone 'us-central1-a' within project 'my-project'?

Accepted Answer

web-server.us-central1-a.c.my-project.internal. GCP internal DNS uses the format vm-name.zone.c.project-id.internal. For the given example, it is web-server.us-central1-a.c.my-project.internal.

Answer

web-server.us-central1-a.my-project.internal

Answer

web-server.my-project.c.us-central1-a.internal

Answer

web-server.internal

Question 4

Which THREE of the following are benefits of using hierarchical firewall policies? (Select 3)

Accepted Answer

They can be applied at the organization, folder, or project level. Option B is correct because hierarchical firewall policies are a Google Cloud resource that can be attached at the organization, folder, or project level, giving administrators a single policy that governs many projects. Option C is correct because a hierarchical firewall policy is automatically inherited by all resources beneath its attachment point, so child projects and folders receive the rules without per-project configuration. Option E is correct because hierarchical firewall policies support both allow and deny rules, unlike VPC firewall rules which only support allow rules (deny is implemented via implied rules or hierarchical policy deny rules). Option A is not correct because restricting access to specific Google APIs is done with VPC Service Controls or API restrictions, not hierarchical firewall policies. Option D is not correct because hierarchical firewall rules are evaluated before VPC firewall rules and do not simply override VPC rules of the same priority; the two rule sets are evaluated in a defined order rather than by priority comparison.

Answer

They can be used to restrict access to specific Google APIs

Answer

They override network firewall rules with the same priority

Question 5

A company wants to use Cloud Armor to block traffic from a specific IP range (198.51.100.0/24) and also apply rate limiting. Which TWO components are needed? (Select 2)

Accepted Answer

A Cloud Armor security policy with two rules: one for IP deny and one for rate limiting. Option C is correct because Cloud Armor security policies support multiple rules, and the recommended design is to create separate rules: a deny rule matching source IP range 198.51.100.0/24 with action 'deny(403)' (or 'deny(404)') and a separate rate-based ban rule with action 'rate_based_ban' or 'throttle' using the appropriate match conditions and enforce_on_key. Option E is correct because Cloud Armor security policies are attached to backend services of an external HTTPS (or HTTP/HTTPS) load balancer, so an HTTPS load balancer is required for the policy to take effect on incoming traffic. Option A is incorrect because a Cloud CDN cache rule controls caching behavior, not IP blocking or rate limiting. Option B is incorrect because a single Cloud Armor rule cannot combine an IP deny action with rate limiting; each rule has one action, so IP deny and rate limiting must be separate rules. Option D is incorrect because VPC firewall rules operate at the network layer on instances/tags and cannot enforce Cloud Armor rate limiting or be attached to a load balancer backend service.

Answer

A Cloud CDN cache rule

Answer

A Cloud Armor security policy with one rule that combines IP deny and rate limiting

Answer

A network firewall rule to block the IP range

Question 6

An organization has multiple VPCs in the same project. They want to apply consistent firewall rules to all VPCs at the project level. What is the most efficient way to achieve this?

Accepted Answer

Use hierarchical firewall policies at the project level. Hierarchical firewall policies in Google Cloud are designed to be applied at the organization or folder level, and they can also be applied at the project level to enforce consistent firewall rules across all VPCs within that project. When a hierarchical policy is associated with a project, it automatically applies to all VPC networks in that project, ensuring uniform rules without per-VPC configuration. This is the most efficient method because it centralizes management and eliminates the need to attach policies to each VPC individually.

Answer

Create a network firewall policy and attach it to each VPC

Answer

Create a firewall rules template using Deployment Manager

Answer

Use VPC Service Controls to enforce rules

Question 7

An engineer is troubleshooting outbound connectivity from a Compute Engine instance that has no external IP. The instance needs to reach an external service on the internet. Cloud NAT is configured on the VPC network. However, the instance cannot connect. What is the most likely cause?

Accepted Answer

Egress firewall rules are blocking the traffic. For Cloud NAT to work, the instance must be in a subnet for which a Cloud NAT gateway is configured, and the instance should not have an external IP. Additionally, firewall rules must allow egress traffic. The most common issue is missing egress firewall rules or incorrect NAT configuration.

Answer

Private Google Access is not enabled

Answer

The instance has an external IP assigned

Answer

The Cloud NAT gateway is in a different region than the instance

Question 8

A company wants to provide outbound internet access to Compute Engine instances without external IPs, while minimizing IP address consumption. Which Cloud NAT feature should be used to achieve minimal static IP usage?

Accepted Answer

Dynamic port allocation. Cloud NAT supports dynamic port allocation, which uses ephemeral IP addresses from the NAT IP pool. Static port allocation reserves ports per VM and may require more IPs. The question asks to minimize IP consumption, so using dynamic allocation with a small number of NAT IPs is optimal.

Answer

Using a single NAT IP for all VMs

Answer

Enabling Cloud NAT logging

Answer

Static port allocation

Question 9

An engineer needs to create a firewall rule that applies only to instances with the tag 'web-server' in a specific VPC network. The rule should allow ingress from any source on TCP port 80. Which combination of fields must be set in the gcloud command?

Accepted Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-tags=web-server --source-ranges=0.0.0.0/0. To target instances by tag, use --target-tags. For source, --source-ranges (any source: 0.0.0.0/0). For protocol/port, --allow tcp:80. Network is specified with --network. Direction is implied by 'ingress'.

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-tags=web-server --source-tags=0.0.0.0/0

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-service-accounts=web-server@project.iam.gserviceaccount.com

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --source-tags=web-server

Question 10

A company uses VPC Service Controls with a service perimeter that includes Project A. They want to allow an external identity from Project B (outside the perimeter) to access a Cloud Storage bucket in Project A, but only during business hours. Which VPC Service Controls feature should they use?

Accepted Answer

Access levels with time constraint and an ingress rule. VPC Service Controls use access levels (e.g., based on IP, time) and ingress rules to allow traffic from outside the perimeter. Ingress rules define which identities and resources can access perimeters.

Answer

Egress rules with IP whitelisting

Answer

Cloud Armor geoblocking

Answer

Private Google Access

Question 11

An organization wants to enforce that only instances with specific service accounts can be accessed via SSH (TCP 22) from the internet. Which two attributes should be used in the firewall rule to achieve this? (Choose two.)

Accepted Answer

--source-ranges 0.0.0.0/0. In Google Cloud VPC firewall rules, the --target-service-accounts flag (option E) scopes the rule to instances running with a specific service account, which is exactly how you restrict which instances the SSH rule applies to. The --source-ranges 0.0.0.0/0 flag (option B) is required because the scenario specifies SSH access from the internet, meaning the source must be any IPv4 address. Together, these two attributes create a rule that allows TCP 22 from anywhere only to instances associated with the chosen service account. Option A (--source-service-accounts) is wrong because it filters by the service account of the source, not the target instances, and service accounts are not used to identify internet sources. Option C (--target-tags) is a valid targeting mechanism but does not match the requirement of targeting by service account. Option D (--destination-ranges) is not used to identify target instances in this context and would not enforce the service-account restriction.

Answer

--source-service-accounts

Answer

--target-tags

Answer

--destination-ranges

Question 12

An organization has multiple projects under an organization node. They need to enforce a security policy that denies all inbound SSH traffic (tcp:22) to all VMs across all projects, but must allow certain projects to override this. Which approach should be used?

Accepted Answer

Create a network firewall policy for each VPC with a deny rule for SSH. Use service accounts for exceptions.. Network firewall policies are applied at the VPC level and can be used to enforce a deny rule for SSH traffic. By using service accounts to identify VMs that should be exempt, you can allow certain projects (by assigning the appropriate service accounts) to override the deny. This approach allows per-project customization while maintaining a baseline deny. Option B is incorrect because hierarchical firewall policies do not support targeting entire projects directly; they rely on VM-level tags or service accounts, which would require manual tagging of every VM. Additionally, a hierarchical allow rule with a lower priority would apply to all VMs matching the target, not just the intended projects, potentially causing security gaps. Option A is incorrect because VPC Service Controls is designed for data exfiltration prevention, not traffic filtering. Option D is incorrect because a hierarchical deny rule cannot be overridden by a VPC-level allow rule.

Answer

Use VPC Service Controls to create a service perimeter that blocks SSH traffic to all projects.

Answer

Create a hierarchical firewall policy at the organization level with a rule that allows SSH for specific projects (using target service accounts or tags) at priority 1000, and a deny rule for all SSH at priority 2000.

Answer

Create a hierarchical firewall policy at the organization level denying SSH (tcp:22). Then create a network firewall policy at each VPC allowing SSH for exempted projects.

Question 13

An engineer is deploying a network appliance (e.g., a firewall) in a VPC. The appliance needs to handle traffic between different subnets. How many network interfaces should the appliance VM have, and why?

Accepted Answer

Two NICs: one for management, one for data traffic. Network appliances often use multiple NICs for traffic segregation: one for management, others for data traffic. Each NIC can be in a different subnet. NIC0 is the primary and must be connected. Up to 8 NICs are supported.

Answer

Zero NICs: use an internal load balancer

Answer

One NIC, with IP forwarding enabled

Answer

Three NICs: one for each subnet it routes between

Question 14

A company has an application running on Compute Engine that needs to send traffic to a third-party SaaS service on the internet. The VMs have no external IPs. Which solution provides outbound connectivity with minimal configuration and allows source IP preservation?

Accepted Answer

Use Cloud NAT with a static NAT IP. Cloud NAT allows VMs without external IPs to reach the internet. It preserves the source IP (the NAT IP) for outbound connections. It is regional and can be configured per subnet.

Answer

Configure a proxy instance with an external IP and route traffic through it

Answer

Assign external IPs to each VM

Answer

Use Private Google Access

Question 15

What is the default MTU for Compute Engine virtual machines?

Accepted Answer

1460. Compute Engine instances use an MTU of 1460 bytes by default (the Ethernet maximum 1500 minus the IP/GRE overhead for tunneling). Some instance types support jumbo frames (MTU 8896).

Answer

1400

Answer

1500

Answer

8896