PCNE Managing, Monitoring, and Optimising Network Operations — 15 Questions

Question 1

An engineer notices that VPC Flow Logs are enabling on a subnet but only a fraction of traffic is logged. What is the most likely cause?

Accepted Answer

Default sampling rate of 50% is applied. VPC Flow Logs use sampling by default (50%) to reduce cost and volume. This means only half of the flows are logged.

Answer

The log export filter is too restrictive

Answer

The subnet has an insufficient sampling rate set to 0.5

Answer

Flow Logs only log TCP traffic

Question 2

A company has two VPCs connected via VPC Network Peering. Traffic from an instance in VPC A to an instance in VPC B is failing. Connectivity Tests show that the expected route exists and firewall rules allow the traffic. What is a possible cause?

Accepted Answer

Asymmetric routing due to conflicting routes. Asymmetric routing occurs when traffic from VPC A to VPC B takes one path while return traffic takes a different path, causing stateful firewalls or connection tracking to drop packets. In VPC Network Peering, if conflicting routes (e.g., a custom route or a VPN/Interconnect route) cause return traffic to egress via a different next hop, the peering connection may not see the return packets, and connectivity fails even though routes and firewall rules appear correct. Connectivity Tests may show the expected route exists, but it does not always detect asymmetric return paths.

Answer

VPC Flow Logs are disabled

Answer

The MTU of the instances is set to 1500

Answer

The VPC peering is not in active state

Question 3

An engineer is troubleshooting high latency between a Compute Engine instance in us-central1 and an instance in europe-west1. Which tool can show per-region latency and packet loss?

Accepted Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Network Topology

Answer

Firewall Insights

Question 4

What is the default MTU for packets sent between VMs within the same VPC network in Google Cloud?

Accepted Answer

1460 bytes

Answer

8970 bytes

Answer

1400 bytes

Answer

1500 bytes

Question 5

A company is experiencing a BGP session flap between Cloud Router and an on-premises router. Which THREE actions should the engineer take to diagnose the issue?

Accepted Answer

Check VPN tunnel status and IKE parameters. Check Cloud Router logs for BGP events, verify firewall rules allow BGP traffic (TCP 179), and check VPN tunnel status if using VPN. VPC Flow Logs and Network Topology are less relevant.

Answer

Enable VPC Flow Logs on the subnet

Answer

Review Network Topology for path changes

Question 6

A company wants to reduce outbound data transfer costs from Compute Engine to the internet. Which TWO strategies are effective?

Accepted Answer

Use a regional external HTTP(S) load balancer instead of global. Using Cloud CDN reduces egress by caching at edge. Using a regional load balancer avoids premium tier costs. Private Google Access reduces internet egress for Google APIs but not general internet traffic. Squid proxy or in-region resources do not reduce egress.

Answer

Enable Private Google Access on subnets

Answer

Deploy a Squid proxy instance to cache content

Answer

Move all instances to the same region

Question 7

A company has enabled VPC Flow Logs on a subnet with the default sample rate. They notice that only 50% of flows are being logged. What is the most likely reason?

Accepted Answer

The sample rate is set to 50% by default. The default sampling rate for VPC Flow Logs is 50%. This means only half of the network flows are captured to reduce cost and volume.

Answer

Flow logs only capture TCP traffic

Answer

Flow logs are disabled by default on all subnets

Answer

The subnet is using a custom sample rate of 50%

Question 8

A company has a VPC with a Cloud Router using BGP to advertise prefixes to an on-premises network. The BGP session keeps flapping. What is a likely cause?

Accepted Answer

There is an MTU mismatch causing packet drops. A common cause of BGP session flapping in a Cloud Router environment is an MTU mismatch between the on-premises device and the Cloud Router, which can cause large BGP update packets (e.g., containing many prefixes) to be dropped, leading to session resets. BGP uses TCP port 179, and if the MTU is not consistent, fragmentation or drops can occur, causing the session to flap. Therefore, an MTU mismatch is a likely cause.

Answer

VPC Flow Logs are enabled on the subnet

Answer

The firewall rules are blocking BGP traffic

Answer

The Cloud Router is configured with the wrong ASN

Question 9

A company is using a global external HTTP(S) load balancer to serve traffic from multiple regions. They notice high egress costs for traffic served to users in Asia. What change could reduce costs?

Accepted Answer

Use a regional external load balancer in Asia and enable Cloud CDN. A regional load balancer can be used for each region where users are located, avoiding the cost of global load balancing, and Cloud CDN can cache content closer to users, reducing origin egress.

Answer

Switch to a regional internal load balancer

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Increase the number of backend instances in Asia

Question 10

A company is experiencing packet loss between two Compute Engine instances in different zones within the same region. They suspect MTU issues. Which three actions should they take to diagnose and resolve? (Choose three.)

Accepted Answer

Verify that the network path between instances does not have a smaller MTU (e.g., VPN or load balancer). Option A is correct because the effective path MTU is the smallest MTU along the route, so any intermediate hop such as a Cloud VPN tunnel (1460-byte MTU) or a load balancer can silently drop packets that exceed that size, making it essential to verify the end-to-end path MTU. Option C is correct because each Compute Engine instance's NIC MTU must be checked and matched; Google Cloud's default VPC MTU is 1460 bytes, and a mismatch between the two instances (or with the on-premises/VPN side) causes large packets to be dropped. Option E is correct because running tcpdump on both instances lets you observe whether large packets are being sent but not received, and whether fragmentation or ICMP 'fragmentation needed' messages appear, which pinpoints an MTU black-hole. Option B is wrong because Cloud NAT performs address translation and does not reduce packet size or fix MTU problems. Option D is wrong because VPC Flow Logs record flow-level metadata (5-tuple, bytes, packets) and cannot show fragmentation or MTU-related drops, so it does not diagnose this issue.

Answer

Enable Cloud NAT to reduce packet size

Answer

Use VPC Flow Logs to check for packet drops

Question 11

A company has deployed a global HTTP Load Balancer with Cloud CDN to serve content to users worldwide. They notice high egress costs from the origin region. What is the most cost-effective solution to reduce egress from the origin?

Accepted Answer

Enable Cloud CDN with general-purpose cache mode. Using Cloud CDN with a general-purpose cache mode caches content at Google's edge locations, reducing requests to the origin and lowering egress costs for served content.

Answer

Use Private Google Access

Answer

Increase the number of backend instances

Answer

Switch to a regional load balancer

Question 12

An engineer notices that some packets sent from a Compute Engine VM in GCP to an on-premises server via a VPN tunnel are being fragmented. The on-premises server is not receiving the fragmented packets. What is the most likely cause?

Accepted Answer

The VM's MTU is set to 1500. GCP uses an MTU of 1460 bytes on VMs, while the internet standard is 1500. If the VPN encapsulates packets, the additional overhead reduces effective MTU. Fragmentation may occur but is often problematic. The issue is typically due to an MTU mismatch, and setting the VM's MTU to 1460 or lower (e.g., 1400) ensures no fragmentation.

Answer

Cloud NAT is not configured

Answer

The VPN tunnel is using UDP encapsulation

Answer

The on-premises firewall is dropping ICMP

Question 13

A company is using VPC Flow Logs to analyze traffic patterns. They need to reduce the volume of logs by approximately 75% while still capturing representative data for troubleshooting. What is the most effective configuration change?

Accepted Answer

Disable VPC Flow Logs on subnets with low traffic. VPC Flow Logs supports a configurable sampling rate between 0.25 and 1.0, with a default of 0.5 (50%). Setting the sampling rate to 0.25 (25%) reduces the log volume by 75% compared to capturing all flows (1.0) and by 50% compared to the default. This still captures representative samples for troubleshooting, making it the most effective option among the choices.

Answer

Export logs only to BigQuery instead of Stackdriver

Answer

Filter logs to only include traffic on port 80

Answer

Set the sampling rate to 0.25

Question 14

An organization has multiple VPC networks in a project and wants to centrally manage firewall rules across all networks using a single set of rules. Which approach should they take?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules are per network. To centrally manage rules, you can use hierarchical firewall policies (part of VPC Firewall Policies) applied at the organization or folder level, which override network-specific rules.

Answer

Use firewall rules with global scope

Answer

Create a single VPC network and use subnetting

Answer

Use shared VPC and apply firewall rules to the host project

Question 15

A company has two VPC networks connected via VPC peering. They notice asymmetric routing: traffic from Network A to Network B follows one path, but return traffic from B to A takes a different path. This is causing connectivity issues for stateful firewalls. What is the likely cause?

Accepted Answer

Both VPCs have a default route (0.0.0.0/0) pointing to different next hops. Asymmetric routing in VPC peering typically occurs when both VPCs have a default route (0.0.0.0/0) pointing to different next hops (e.g., different NAT gateways or VPN gateways). Traffic from A to B may go through the peering connection, but return traffic from B to A may be routed via the default route to a different path, breaking stateful firewall sessions. The correct answer is D because mismatched default routes cause the return path to diverge.

Answer

The peering connection is in an inactive state

Answer

The firewall rules in Network A are more permissive than in Network B

Answer

There is a Cloud NAT configured in Network A but not in Network B