PCNE Managing, Monitoring, and Optimising Network Operations — 15 Questions

Question 1

A network engineer needs to verify that traffic from a specific Compute Engine instance can reach a Cloud SQL database in a different VPC. Which Google Cloud tool should be used to test this reachability?

Accepted Answer

Connectivity Tests. Network Intelligence Center Connectivity Tests allow you to check reachability between source and destination, analyzing firewall rules, routes, and VPC peering. It can pinpoint where traffic is blocked.

Answer

Cloud Monitoring

Answer

Network Topology

Answer

VPC Flow Logs

Question 2

A company wants to analyze VPC Flow Logs to understand which external IPs are generating the most outbound traffic. What is the most scalable way to store and query these logs?

Accepted Answer

BigQuery. VPC Flow Logs can be exported to BigQuery, which provides scalable SQL analysis for large datasets. This is the recommended approach for complex queries.

Answer

Cloud Storage and analyze with gsutil

Answer

Cloud Logging with Logs Explorer

Answer

Cloud Monitoring Metrics

Question 3

An engineer notices that VPC Flow Logs are enabling on a subnet but only a fraction of traffic is logged. What is the most likely cause?

Accepted Answer

Default sampling rate of 50% is applied. VPC Flow Logs use sampling by default (50%) to reduce cost and volume. This means only half of the flows are logged.

Answer

The log export filter is too restrictive

Answer

The subnet has an insufficient sampling rate set to 0.5

Answer

Flow Logs only log TCP traffic

Question 4

Which Network Intelligence Center tool provides a visual representation of your VPC network, including instances, subnets, firewall rules, and routes?

Accepted Answer

Network Topology

Answer

Connectivity Tests

Answer

Firewall Insights

Answer

Performance Dashboard

Question 5

A company has two VPCs connected via VPC Network Peering. Traffic from an instance in VPC A to an instance in VPC B is failing. Connectivity Tests show that the expected route exists and firewall rules allow the traffic. What is a possible cause?

Accepted Answer

Asymmetric routing due to conflicting routes. Asymmetric routing can occur when a packet goes from A to B via peering, but the return packet takes a different path (e.g., through a VPN) due to route priorities. This can result in dropped packets.

Answer

VPC Flow Logs are disabled

Answer

The MTU of the instances is set to 1500

Answer

The VPC peering is not in active state

Question 6

A security team wants to capture all traffic from a Compute Engine instance for intrusion detection. Which service should be used to copy traffic to a third-party IDS appliance running on another instance?

Accepted Answer

Packet Mirroring

Answer

Firewall Rules logging

Answer

VPC Flow Logs

Answer

Cloud NAT logging

Question 7

An engineer is troubleshooting high latency between a Compute Engine instance in us-central1 and an instance in europe-west1. Which tool can show per-region latency and packet loss?

Accepted Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Network Topology

Answer

Firewall Insights

Question 8

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Accepted Answer

Cloud NAT logging with filter for errors

Answer

Firewall Rules logging

Answer

VPC Flow Logs on the subnet

Answer

Cloud Armor request logs

Question 9

An organization needs to reduce egress costs for a global application serving users worldwide. The application serves static content from Compute Engine instances. Which action is most cost-effective?

Accepted Answer

Use Cloud CDN to cache content at edge locations

Answer

Move all instances to a single region to reduce cross-region traffic

Answer

Upgrade to premium tier networking

Answer

Enable Private Google Access

Question 10

What is the default MTU for packets sent between VMs within the same VPC network in Google Cloud?

Accepted Answer

1460 bytes

Answer

8970 bytes

Answer

1400 bytes

Answer

1500 bytes

Question 11

A network engineer has set up a Cloud Router with BGP for an HA VPN. The BGP session is flapping. Which log should be examined to diagnose the issue?

Accepted Answer

Cloud Router logs

Answer

Firewall Rules logs

Answer

VPN tunnel logs

Answer

VPC Flow Logs

Question 12

A company wants to analyze firewall rule effectiveness by identifying rules that are never hit or are shadowed. Which Network Intelligence Center tool should be used?

Accepted Answer

Firewall Insights

Answer

Network Topology

Answer

Performance Dashboard

Answer

Connectivity Tests

Question 13

A security engineer wants to monitor and analyze traffic to a load-balanced web application. Which TWO services can provide detailed logs of HTTP requests and responses?

Accepted Answer

HTTP Load Balancer access logs. HTTP Load Balancer access logs capture request details. Cloud Armor request logs provide additional security insights. VPC Flow Logs and Firewall logs do not provide HTTP-level details.

Answer

Cloud NAT logging

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Question 14

A company is experiencing a BGP session flap between Cloud Router and an on-premises router. Which THREE actions should the engineer take to diagnose the issue?

Accepted Answer

Check VPN tunnel status and IKE parameters. Check Cloud Router logs for BGP events, verify firewall rules allow BGP traffic (TCP 179), and check VPN tunnel status if using VPN. VPC Flow Logs and Network Topology are less relevant.

Answer

Enable VPC Flow Logs on the subnet

Answer

Review Network Topology for path changes

Question 15

A company wants to reduce outbound data transfer costs from Compute Engine to the internet. Which TWO strategies are effective?

Accepted Answer

Use a regional external HTTP(S) load balancer instead of global. Using Cloud CDN reduces egress by caching at edge. Using a regional load balancer avoids premium tier costs. Private Google Access reduces internet egress for Google APIs but not general internet traffic. Squid proxy or in-region resources do not reduce egress.

Answer

Enable Private Google Access on subnets

Answer

Deploy a Squid proxy instance to cache content

Answer

Move all instances to the same region