PCNE Implementing VPC Instances — Timed 30 Questions

Question 1

A company has a VPC with a subnet in us-central1. They launched a Compute Engine instance named "app-server" in that subnet without an external IP. They need the instance to be able to download updates from the internet. Which two steps must be taken?

30 minute time limit — choose an answer to begin.

Accepted Answer

Create a Cloud NAT gateway and a Cloud Router in us-central1.. The instance needs outbound internet access via Cloud NAT, which requires a Cloud Router in the region.

Answer

Configure Private Google Access on the subnet.

Answer

Create a VPC firewall rule to allow egress to 0.0.0.0/0.

Answer

Assign a static external IP to the instance.

Question 2

What is the default MTU for Compute Engine instances on Google Cloud?

Accepted Answer

1460. Google Compute Engine instances use a default MTU of 1460 bytes on their network interfaces, not the standard Ethernet 1500. This reduced value accounts for the VXLAN encapsulation overhead (50 bytes) that Google's Andromeda SDN uses to carry traffic between VMs. The 1460 value ensures that guest VM packets, once encapsulated, fit within the underlying physical network's 1500-byte MTU without fragmentation.

Answer

9000

Answer

1400

Answer

1500

Question 3

A company wants to restrict access to Google Cloud Storage so that only traffic originating from a specific VPC network is allowed. They also need to prevent data exfiltration to other VPCs. Which two services should they use? (Choose two.)

Accepted Answer

VPC Service Controls. VPC Service Controls (option A) is correct because it creates a service perimeter around Cloud Storage that blocks access from outside the authorized VPC network and prevents data exfiltration to other VPCs or projects, which directly satisfies both requirements. Private Google Access (option E) is correct because it lets VM instances in a subnet without external IP addresses reach Google APIs and services such as Cloud Storage through internal IP addresses, ensuring traffic originates from the specified VPC network. Cloud VPN (option B) only provides encrypted tunnels between networks and does not restrict Cloud Storage access or prevent exfiltration. Cloud NAT (option C) merely allows outbound internet access for instances without public IPs and offers no access control over Cloud Storage. Firewall rules (option D) control traffic to and from VM instances but cannot govern access to Google Cloud Storage or stop data exfiltration to other VPCs.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Firewall rules

Question 4

A company has Compute Engine instances without external IPs in a VPC. They need to reach Google APIs such as Cloud Storage and BigQuery. Which configuration will meet this requirement with minimal cost and operational overhead?

Accepted Answer

Configure the subnet to have Private Google Access enabled. Ensure the instances have the appropriate DNS resolution for private.googleapis.com.. Private Google Access allows VM instances with only internal IP addresses to reach Google APIs and services (such as Cloud Storage and BigQuery) using the default or private.googleapis.com DNS names, without requiring external IPs or Cloud NAT. It is enabled per subnet, costs nothing extra, and requires no additional infrastructure, making it the lowest-cost, lowest-overhead solution. The instances must resolve the Google API hostnames to the restricted VIP ranges (199.36.153.8/30 for private.googleapis.com or 199.36.153.4/30 for restricted.googleapis.com).

Answer

Set up a Squid proxy on a bastion host with an external IP and route all API traffic through it.

Answer

Create a Cloud NAT gateway in the same region and attach it to the VPC.

Answer

Assign external IPs to the instances and create firewall rules to allow traffic to Google APIs.

Question 5

A network engineer wants to restrict access to a Cloud Storage bucket from only a specific set of Compute Engine instances in a VPC. The instances have no external IPs. What is the most effective way to enforce this restriction?

Accepted Answer

Enable Private Google Access on the subnet and use VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. Using Private Google Access with Private Service Connect allows instances to reach Google APIs via internal IPs. By using VPC Service Controls, you can create a service perimeter that restricts access to the Cloud Storage bucket from the specific VPC and projects. This provides a defense-in-depth approach.

Answer

Assign a unique service account to the instances and use IAM conditions to allow the service account access to the bucket only when connecting from the VPC network.

Answer

Configure a firewall rule that allows egress traffic to the Cloud Storage API only from the instances' subnet.

Answer

Create an IAM condition that restricts access based on the instance's internal IP address range.

Question 6

A company has a VPC with a subnet in us-central1. They launched a Compute Engine instance named "app-server" in that subnet without an external IP. They need the instance to be able to download updates from the internet. Which two steps must be taken?

30 minute time limit — choose an answer to begin.

Accepted Answer

An egress firewall rule is missing that allows traffic from the instances to the internet via NAT.. Cloud NAT requires that the instances are allowed egress traffic to the internet. Without a suitable egress firewall rule, NAT traffic is blocked. The default firewall rules only allow egress to Google APIs (private.googleapis.com) but not to general internet destinations. A firewall rule allowing egress to 0.0.0.0/0 on the appropriate ports is required.

Answer

Cloud NAT is not configured in the correct region.

Answer

Private Google Access is enabled on the subnet, which overrides Cloud NAT.

Answer

The Cloud NAT router is not attached to the correct VPC network.

Question 7

A company wants to ensure that Compute Engine instances in a VPC can resolve internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. What is required for this to work?

Accepted Answer

No additional configuration is required; internal DNS resolution works by default.. Google Cloud provides internal DNS resolution for instances within the same VPC network. By default, instances can resolve DNS names for other instances in the same VPC if they are in the same network. There is no additional setup needed; it works out of the box. The DNS name format is [vm-name].[zone].c.[project-id].internal.

Answer

Assign a custom DNS server to the VPC using Cloud DNS inbound server policy.

Answer

Configure a DNS managed zone in Cloud DNS.

Answer

Enable Private Google Access on the subnet.

Question 8

A company has an HTTP Load Balancer that distributes traffic to a backend service consisting of Compute Engine instance groups. They need to block traffic from specific geographic regions and also rate-limit requests from any IP. Which THREE Cloud Armor features should they configure?

Accepted Answer

Rate limiting rules. The scenario requires blocking traffic from specific geographic regions, which is exactly what D (Geo-based access control / geoblocking) provides: Cloud Armor security policies support geo-based rules that match on the source country/region derived from the client IP, allowing you to deny or allow traffic by location. The scenario also requires rate-limiting requests from any IP, which is precisely B (Rate limiting rules): Cloud Armor's rate-based rules count requests per client (keyed on IP, and optionally on other inputs) over a configured interval and take an action such as deny or throttle once a threshold is exceeded. E (Custom rules with IP allow/deny) is also correct because Cloud Armor security policies are built from custom rules that match on IP addresses/CIDR ranges and take allow or deny actions, which is the mechanism used to enforce granular IP-based blocking alongside the geo and rate rules. A (Cloud Armor logging) is not a blocking or rate-limiting feature; it only records requests and rule matches for visibility and troubleshooting, so it does not fulfill either requirement. C (Pre-configured WAF rules such as OWASP Top 10) protects against web application attacks like SQL injection and XSS, but it does not perform geographic blocking or request rate limiting, so it is not needed here.

Answer

Cloud Armor logging

Answer

Pre-configured WAF rules (e.g., OWASP Top 10)

Question 9

An engineer needs to provide outbound internet access to Compute Engine instances that do not have external IP addresses. The solution must allow instances to access a specific set of external IPs only. What should the engineer configure?

Accepted Answer

Create a Cloud NAT gateway and configure firewall egress rules to allow traffic only to the specific IPs.. Cloud NAT lets instances without external IPs initiate outbound connections to the internet while remaining unreachable inbound. Firewall egress rules can then restrict which destination IP ranges the instances are permitted to reach, satisfying the requirement to allow only a specific set of external IPs. This combination provides outbound-only internet access with destination filtering.

Answer

Use Private Google Access only, which provides access to Google APIs and services.

Answer

Assign external IPs to instances and use firewall rules to restrict outbound traffic.

Answer

Deploy a NAT instance with iptables rules to restrict destination IPs.

Question 10

A company uses hierarchical firewall policies at the organization level. They need to allow SSH (TCP 22) access from a specific range 10.0.0.0/8 to all VMs, but a child folder has a policy that denies all ingress traffic. Which rule priority ordering ensures SSH access is allowed?

Accepted Answer

Organization allow rule priority 100, folder deny rule priority 200.. In hierarchical firewall policies, rules are evaluated by priority, with lower numbers taking precedence. An organization-level allow rule with priority 100 will be evaluated before a folder-level deny rule with priority 200, so SSH traffic from 10.0.0.0/8 will be allowed. This ordering ensures the allow rule takes effect despite the child folder's deny rule.

Answer

Folder allow rule priority 100, folder deny rule priority 200.

Answer

Remove the folder deny rule and use network firewall rules.

Answer

Organization allow rule priority 200, folder deny rule priority 100.

Question 11

Your VPC has instances with internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. You need to ensure that DNS resolution works for instances in the same zone using short names (e.g., 'instance1'). Which condition must be met?

Accepted Answer

The instances must be in the same zone and VPC network.. Google Cloud automatically creates internal DNS names in the format 'instance-name.zone.c.project.internal'. Short-name resolution (using just 'instance1') works only when the instances are in the same VPC network and the same zone, because the short name is resolved via the zone-scoped DNS suffix that is automatically appended. If the instances are in different zones or different VPCs, the short name will not resolve without additional DNS configuration.

Answer

Custom DNS must be configured via Cloud DNS.

Answer

The VPC must have Private Google Access enabled.

Answer

The instance must have a network tag 'dns-enabled'.

Question 12

You are deploying a third-party network appliance (e.g., firewall) in a GCP VPC. The appliance requires multiple network interfaces for traffic isolation. You create a VM with three NICs in different subnets. What is a key consideration for routing traffic through the appliance?

Accepted Answer

Custom routes must be created to direct traffic to a specific NIC using the VM's IP as next hop.. In GCP, when a VM has multiple NICs, each NIC has its own IP address and is attached to a specific subnet. To route traffic through a specific NIC (e.g., for a firewall appliance), you must create custom routes that specify the VM's IP as the next hop, and the route must be associated with the appropriate NIC. This is because GCP routes are not automatically aware of multiple NICs; you must explicitly direct traffic to the desired interface.

Answer

The VM must have an external IP on each NIC.

Answer

The VM must have IP forwarding disabled.

Answer

All NICs must be in the same subnet.

Question 13

You have a Cloud NAT gateway configured in a region with 256 available ports. You allocate static NAT ports to a specific VM for outbound connections. What is the minimum number of ports you should allocate to ensure the VM can handle 500 concurrent connections?

Accepted Answer

512. Cloud NAT uses ports for source NAT. A single connection uses one port. To support 500 concurrent connections, you need at least 500 ports. However, Cloud NAT allows port sharing for the same destination IP and port, but static port allocation per VM typically reserves ports exclusively. To be safe, allocate at least 500 ports.

Answer

128

Answer

256

Answer

64

Question 14

You need to allow instances with network tag 'db' in subnet-a to only accept connections on TCP port 3306 from instances with network tag 'app' in subnet-b. Which TWO firewall rules should you create? (Choose 2)

Accepted Answer

Ingress rule: target tag 'db', source tag 'app', allow tcp:3306, priority 1000.. To allow only instances with tag 'app' in subnet-b to connect to instances with tag 'db' in subnet-a on TCP port 3306, you need two ingress firewall rules on the db instances: one to allow traffic from the app source tag, and one to deny traffic from all other sources. The allow rule must have a higher priority (lower number) than the deny rule to take effect. Thus, option A (allow from app, priority 1000) and option C (deny from all, priority 2000) together achieve the goal.

Answer

Egress rule: target tag 'app', destination tag 'db', allow tcp:3306, priority 1000.

Answer

Ingress rule: target tag 'db', source tag 'app', deny tcp:3306, priority 1000.

Answer

Ingress rule: target tag 'db', source 0.0.0.0/0, deny all ports, priority 500.

Question 15

An engineer needs to deploy a VM that acts as a internet gateway for other instances in the same VPC. The VM must have IP forwarding enabled and must be able to accept traffic on multiple NICs. Which TWO actions are required? (Choose 2)

Accepted Answer

Create firewall rules to allow traffic to the VM's NICs.. To use a VM as a gateway, IP forwarding must be enabled on the VM. Additionally, firewall rules must allow ingress traffic to the VM's NICs that will forward traffic. The VM itself must have routes pointing to it as next hop.

Answer

Disable the VM's source/destination check.

Answer

Create a Cloud NAT gateway.

Answer

Assign an external IP to each NIC.

Question 16

What is the default Maximum Transmission Unit (MTU) for Compute Engine virtual machines?

Accepted Answer

1460. GCP uses an MTU of 1460 for both VMs and the underlying network infrastructure.

Answer

1500

Answer

9001

Answer

1400

Question 17

An organization wants to allow on-premises hosts to connect to a Cloud SQL instance privately without traversing the public internet. They have a Cloud VPN tunnel set up. What additional step is required?

Accepted Answer

Enable Private Service Connect on the Cloud SQL instance. Cloud SQL is a managed Google service that lives in a Google-managed VPC, not the customer's VPC. To reach it privately from on-premises over an existing Cloud VPN tunnel, you must enable Private Service Connect (PSC) on the Cloud SQL instance and create a PSC endpoint/attachment in the customer VPC. The VPN tunnel then routes to that internal endpoint, keeping traffic off the public internet.

Answer

Create a VPC peering connection

Answer

Add a route with next hop set to the VPN gateway

Answer

Configure Cloud NAT

Question 18

What is the internal DNS name format for a Compute Engine instance named 'web-server' in zone 'us-central1-a' within project 'my-project'?

Accepted Answer

web-server.us-central1-a.c.my-project.internal. GCP internal DNS uses the format vm-name.zone.c.project-id.internal. For the given example, it is web-server.us-central1-a.c.my-project.internal.

Answer

web-server.us-central1-a.my-project.internal

Answer

web-server.my-project.c.us-central1-a.internal

Answer

web-server.internal

Question 19

Which THREE of the following are benefits of using hierarchical firewall policies? (Select 3)

Accepted Answer

They can be applied at the organization, folder, or project level. Option B is correct because hierarchical firewall policies are a Google Cloud resource that can be attached at the organization, folder, or project level, giving administrators a single policy that governs many projects. Option C is correct because a hierarchical firewall policy is automatically inherited by all resources beneath its attachment point, so child projects and folders receive the rules without per-project configuration. Option E is correct because hierarchical firewall policies support both allow and deny rules, unlike VPC firewall rules which only support allow rules (deny is implemented via implied rules or hierarchical policy deny rules). Option A is not correct because restricting access to specific Google APIs is done with VPC Service Controls or API restrictions, not hierarchical firewall policies. Option D is not correct because hierarchical firewall rules are evaluated before VPC firewall rules and do not simply override VPC rules of the same priority; the two rule sets are evaluated in a defined order rather than by priority comparison.

Answer

They can be used to restrict access to specific Google APIs

Answer

They override network firewall rules with the same priority

Question 20

A company wants to use Cloud Armor to block traffic from a specific IP range (198.51.100.0/24) and also apply rate limiting. Which TWO components are needed? (Select 2)

Accepted Answer

A Cloud Armor security policy with two rules: one for IP deny and one for rate limiting. Option C is correct because Cloud Armor security policies support multiple rules, and the recommended design is to create separate rules: a deny rule matching source IP range 198.51.100.0/24 with action 'deny(403)' (or 'deny(404)') and a separate rate-based ban rule with action 'rate_based_ban' or 'throttle' using the appropriate match conditions and enforce_on_key. Option E is correct because Cloud Armor security policies are attached to backend services of an external HTTPS (or HTTP/HTTPS) load balancer, so an HTTPS load balancer is required for the policy to take effect on incoming traffic. Option A is incorrect because a Cloud CDN cache rule controls caching behavior, not IP blocking or rate limiting. Option B is incorrect because a single Cloud Armor rule cannot combine an IP deny action with rate limiting; each rule has one action, so IP deny and rate limiting must be separate rules. Option D is incorrect because VPC firewall rules operate at the network layer on instances/tags and cannot enforce Cloud Armor rate limiting or be attached to a load balancer backend service.

Answer

A Cloud CDN cache rule

Answer

A Cloud Armor security policy with one rule that combines IP deny and rate limiting

Answer

A network firewall rule to block the IP range