PCNE Implementing VPC Instances Practice Test 4 — 15 Questions

Question 1

A company has a VPC with several instances that do not have external IP addresses. The instances need to download updates from the internet. Which TWO configurations will allow the instances to access the internet? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign external IP addresses to all instances.. Instances without external IPs can access the internet either by using Cloud NAT, which provides managed NAT, or by assigning external IP addresses. Private Google Access only allows access to Google APIs, not the general internet. A default route alone does not provide NAT, and VPN to on-premises is an indirect solution.

Answer

Enable Private Google Access on the subnet.

Answer

Set up a VPN tunnel to an on-premises network that has internet access.

Answer

Create a route with destination 0.0.0.0/0 and next hop as the default internet gateway.

Question 2

A network engineer is configuring a Compute Engine instance with multiple network interfaces (nic0, nic1, nic2) in a single VPC network. The instance is used as a high-performance appliance that needs to handle traffic from three different subnets. The engineer creates the instance with three NICs, each in a different subnet. After testing, the engineer finds that only nic0 can reach external destinations, while nic1 and nic2 cannot. What is the most likely cause?

Accepted Answer

Only nic0 can have an external IP address and a default route to the internet; nic1 and nic2 require a NAT gateway or custom routes for external connectivity.. In Google Cloud, only the first network interface (nic0) of a Compute Engine instance can be assigned an external IP address and receive a default route to the internet. Additional interfaces (nic1, nic2) are limited to internal traffic within the VPC or connected networks. To allow traffic from those interfaces to reach external destinations, you must implement a NAT solution such as Cloud NAT or configure custom routes through a NAT instance. This design ensures predictable routing and security.

Answer

The default route of the VPC applies only to nic0, and nic1 and nic2 lack a route to the internet because they do not have external IP addresses.

Answer

Firewall rules are blocking traffic on nic1 and nic2 because they are not associated with a network tag.

Answer

The instance's guest OS is not configured to use policy-based routing to direct traffic from nic1 and nic2 to the correct gateway.

Question 3

You are designing a VPC network for a high-throughput application that requires instances to handle millions of concurrent connections. You need to choose the appropriate machine type and network interface configuration. Which of the following is a valid consideration for maximizing network throughput on Compute Engine instances?

Accepted Answer

Use a machine type with a higher number of vCPUs, as network bandwidth scales with vCPU count up to a limit.. Network bandwidth on Compute Engine is largely determined by the machine type's vCPU count. Higher vCPU counts allow greater maximum egress throughput, up to the platform limit. Multiple network interfaces do not aggregate bandwidth for a single instance, jumbo frames are not supported, and legacy networks are deprecated and offer no advantage.

Answer

Enable jumbo frames on the VPC network to increase packet size and reduce overhead.

Answer

Attach multiple network interfaces to a single instance to multiply the available bandwidth.

Answer

Use a legacy network instead of a VPC network to avoid bandwidth limitations.

Question 4

A financial services company runs a Compute Engine instance in a VPC network with no external IP address. The instance must download packages from a public Debian repository on the internet during a one-time maintenance window, and the security team forbids assigning an external IP or using a NAT gateway. The engineer has full control of the VPC and the instance. What should the engineer do to allow the instance to reach the internet temporarily?

Accepted Answer

Configure an HTTP(S) proxy on a separate instance and set the http_proxy environment variable on the maintenance instance.. The constraint forbids both an external IP on the instance and a NAT gateway, so the remaining viable pattern is to route egress through a proxy that itself has internet access. The maintenance instance keeps its private-only configuration, reaches the proxy over the internal VPC network, and the proxy performs the outbound fetch. This meets the one-time access need without violating either prohibition.

Answer

Use Private Google Access to reach the Debian repository.

Answer

Assign an ephemeral external IP to the instance, perform the download, then remove the external IP.

Answer

Configure Cloud NAT on the instance's subnet and create a firewall rule allowing egress to 0.0.0.0/0.

Question 5

A company has a VPC network with two subnets: subnet-a in us-central1 and subnet-b in europe-west1. They deploy a Compute Engine instance in subnet-a and another in subnet-b. Both instances have only internal IP addresses. The company wants the instance in subnet-a to communicate with the instance in subnet-b using internal IP addresses. What must they configure?

Accepted Answer

Ensure that the VPC network's firewall rules allow ingress traffic from the source subnet to the destination subnet.. Instances in different subnets within the same VPC network can communicate using internal IP addresses because the VPC automatically has routes for all subnets. However, the default firewall configuration denies ingress, so you must create a firewall rule to allow the traffic. Private Google Access and custom routes are not needed for this intra-VPC communication.

Answer

Enable Private Google Access on both subnets.

Answer

Create a firewall rule allowing ingress from the subnet-b CIDR range to the instance in subnet-a.

Answer

Configure a route in the VPC network to direct traffic between the subnets.

Question 6

A network engineer is troubleshooting a Compute Engine instance with two vNICs, nic0 in subnet-a and nic1 in subnet-b of the same VPC. Return traffic from connections that arrived on nic1 is being sent out nic0, breaking the appliance's session handling. Which mechanism should the engineer use to ensure replies for those flows leave through nic1?

Accepted Answer

Create a policy-based route that matches the source subnet of the flows and sets nic1 as the next hop.. Because the default route is tied to the primary interface, replies can egress nic0 even when the request arrived on nic1. A policy-based route can match the relevant flows, such as by source range, and direct them to nic1 as the next hop. This restores symmetric routing so the appliance processes both directions of the session on the correct interface.

Answer

Enable IP forwarding on the instance so replies are automatically routed out the correct interface.

Answer

Add a custom static route with a lower priority than the default route for the peer subnet.

Answer

Assign an external IP to nic1 so return traffic prefers that interface.

Question 7

An engineer needs to provide outbound internet access to a set of Compute Engine instances that have only internal IP addresses. The instances must use a static IP address for outbound traffic. Which solution should they implement?

Accepted Answer

Create a Cloud NAT gateway with static IP address and configure it on the VPC network.. Cloud NAT with a static IP address allows instances with only internal IPs to access the internet using a reserved static external IP. It provides outbound NAT without requiring external IPs on the instances themselves. This meets the requirement for a static IP for outbound traffic.

Answer

Assign a static external IP to each instance and configure a firewall rule to allow egress.

Answer

Configure Private Google Access on the subnet to route traffic to Google APIs.

Answer

Deploy a Compute Engine instance as a NAT instance with IP forwarding enabled.

Question 8

A security team wants to enforce a policy that blocks all egress traffic to the internet from a specific set of VMs across multiple projects in an organization. The policy should be centrally managed and override VPC-level firewall rules. Which approach should they use?

Accepted Answer

Deploy a hierarchical firewall policy at the organization level with a deny egress rule targeting the VMs.. Hierarchical firewall policies are organization-level or folder-level resources that can contain rules to allow or deny traffic, and they are evaluated before VPC firewall rules. A deny egress rule in a hierarchical policy at the organization level will override any VPC-level allow rules, enforcing the block across all projects in the organization. This provides centralized management and ensures the policy cannot be overridden by project-level admins.

Answer

Create VPC firewall rules with deny egress for the specific VMs in each VPC.

Answer

Use a network firewall policy attached to each VPC network.

Answer

Configure Cloud Armor security policies on the load balancer to block egress.

Question 9

An organization needs to restrict access to Google Cloud APIs such that only traffic from a specific set of VMs inside a VPC can reach the APIs, and all other traffic (including from other VPCs) must be denied. The VMs do not have external IPs. Which combination of services should they use?

Accepted Answer

Private Google Access and VPC Service Controls. Private Google Access allows VMs without external IPs to reach Google APIs. VPC Service Controls can create a service perimeter that restricts access to APIs from only authorized VPCs.

Answer

Private Service Connect and VPC Service Controls

Answer

Cloud NAT and VPC Service Controls

Answer

Cloud NAT and Private Google Access

Question 10

A developer wants to allow HTTP (port 80) traffic from the internet to a set of Compute Engine instances that have a tag "web-server". Which firewall rule should they create?

Accepted Answer

Ingress rule: source 0.0.0.0/0, target tag "web-server", tcp:80. To allow HTTP traffic from the internet to specific instances, you need an ingress firewall rule. Ingress rules control incoming traffic, and you specify the source IP range (0.0.0.0/0 for internet), the target tags (web-server), and the protocol/port (tcp:80). This matches option B.

Answer

Egress rule: source 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Egress rule: destination 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Ingress rule: source 0.0.0.0/0, target service account "web-server", tcp:80

Question 11

An organization uses a hierarchical firewall policy at the organization level with a deny-all egress rule (priority 100). They also have a VPC-level firewall rule allowing egress to a specific external IP (priority 1000). Will traffic to that external IP be allowed?

Accepted Answer

No, because hierarchical firewall policies take precedence over VPC firewall rules.. Hierarchical firewall policies are evaluated before VPC firewall rules in the GCP firewall evaluation order. A deny at the organization level with priority 100 is evaluated first, so the more permissive VPC rule at priority 1000 is never reached and the traffic is blocked.

Answer

Yes, because VPC firewall rules override hierarchical policies for the same traffic.

Answer

Yes, because the VPC rule has a higher priority number and is more specific.

Answer

No, because both rules deny and allow cancel out, resulting in default deny.

Question 12

An engineer wants to allow traffic from a specific service account to a Compute Engine instance. Which firewall rule option should they use for the source?

Accepted Answer

Source service accounts. In Google Cloud firewall rules, the source can be specified as a service account, which allows traffic from VMs associated with that service account. This is the correct option to allow traffic from a specific service account.

Answer

Target service accounts

Answer

Source IP ranges

Answer

Source tags

Question 13

A company wants to publish a service running on Compute Engine instances in their VPC so that consumers in other VPCs can access it via private IPs without needing VPC peering. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows a producer to publish a service via a private endpoint that consumers can access from their own VPCs without peering.

Answer

VPC peering

Answer

Cloud VPN

Answer

Cloud NAT

Question 14

An organization needs to protect a web application behind an HTTPS Load Balancer from SQL injection attacks. They want to use a managed WAF solution. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's managed Web Application Firewall (WAF) that integrates directly with external HTTPS load balancers to protect against Layer 7 attacks including SQL injection and cross-site scripting. It provides preconfigured WAF rules based on the OWASP ModSecurity Core Rule Set, and security policies can be attached to backend services behind the load balancer. This makes it the correct managed WAF solution for the stated requirement.

Answer

VPC Service Controls

Answer

Cloud Firewall Rules

Answer

Cloud CDN

Question 15

An engineer needs to configure DNS resolution for a Compute Engine instance named "web-1" in zone us-central1-a of project my-project. What is the internal DNS name for this instance?

Accepted Answer

web-1.us-central1-a.c.my-project.internal. GCP internal DNS uses the format: [instance name].[zone].c.[project id].internal

Answer

web-1.us-central1.c.my-project.internal

Answer

web-1.c.my-project.us-central1-a.internal

Answer

web-1.us-central1-a.my-project.internal