PCNE Managing, Monitoring, and Optimising Network Operations — 25 Questions

Question 1

A network engineer needs to verify that traffic from a specific Compute Engine instance can reach a Cloud SQL database in a different VPC. Which Google Cloud tool should be used to test this reachability?

Accepted Answer

Connectivity Tests. Network Intelligence Center Connectivity Tests allow you to check reachability between source and destination, analyzing firewall rules, routes, and VPC peering. It can pinpoint where traffic is blocked.

Answer

Cloud Monitoring

Answer

Network Topology

Answer

VPC Flow Logs

Question 2

A company wants to analyze VPC Flow Logs to understand which external IPs are generating the most outbound traffic. What is the most scalable way to store and query these logs?

Accepted Answer

BigQuery. VPC Flow Logs can be exported to BigQuery, which provides scalable SQL analysis for large datasets. This is the recommended approach for complex queries.

Answer

Cloud Storage and analyze with gsutil

Answer

Cloud Logging with Logs Explorer

Answer

Cloud Monitoring Metrics

Question 3

An engineer notices that VPC Flow Logs are enabling on a subnet but only a fraction of traffic is logged. What is the most likely cause?

Accepted Answer

Default sampling rate of 50% is applied. VPC Flow Logs use sampling by default (50%) to reduce cost and volume. This means only half of the flows are logged.

Answer

The log export filter is too restrictive

Answer

The subnet has an insufficient sampling rate set to 0.5

Answer

Flow Logs only log TCP traffic

Question 4

Which Network Intelligence Center tool provides a visual representation of your VPC network, including instances, subnets, firewall rules, and routes?

Accepted Answer

Network Topology

Answer

Connectivity Tests

Answer

Firewall Insights

Answer

Performance Dashboard

Question 5

A company has two VPCs connected via VPC Network Peering. Traffic from an instance in VPC A to an instance in VPC B is failing. Connectivity Tests show that the expected route exists and firewall rules allow the traffic. What is a possible cause?

Accepted Answer

Asymmetric routing due to conflicting routes. Asymmetric routing can occur when a packet goes from A to B via peering, but the return packet takes a different path (e.g., through a VPN) due to route priorities. This can result in dropped packets.

Answer

VPC Flow Logs are disabled

Answer

The MTU of the instances is set to 1500

Answer

The VPC peering is not in active state

Question 6

A security team wants to capture all traffic from a Compute Engine instance for intrusion detection. Which service should be used to copy traffic to a third-party IDS appliance running on another instance?

Accepted Answer

Packet Mirroring

Answer

Firewall Rules logging

Answer

VPC Flow Logs

Answer

Cloud NAT logging

Question 7

An engineer is troubleshooting high latency between a Compute Engine instance in us-central1 and an instance in europe-west1. Which tool can show per-region latency and packet loss?

Accepted Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Network Topology

Answer

Firewall Insights

Question 8

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Accepted Answer

Cloud NAT logging with filter for errors

Answer

Firewall Rules logging

Answer

VPC Flow Logs on the subnet

Answer

Cloud Armor request logs

Question 9

An organization needs to reduce egress costs for a global application serving users worldwide. The application serves static content from Compute Engine instances. Which action is most cost-effective?

Accepted Answer

Use Cloud CDN to cache content at edge locations

Answer

Move all instances to a single region to reduce cross-region traffic

Answer

Upgrade to premium tier networking

Answer

Enable Private Google Access

Question 10

What is the default MTU for packets sent between VMs within the same VPC network in Google Cloud?

Accepted Answer

1460 bytes

Answer

8970 bytes

Answer

1400 bytes

Answer

1500 bytes

Question 11

A network engineer has set up a Cloud Router with BGP for an HA VPN. The BGP session is flapping. Which log should be examined to diagnose the issue?

Accepted Answer

Cloud Router logs

Answer

Firewall Rules logs

Answer

VPN tunnel logs

Answer

VPC Flow Logs

Question 12

A company wants to analyze firewall rule effectiveness by identifying rules that are never hit or are shadowed. Which Network Intelligence Center tool should be used?

Accepted Answer

Firewall Insights

Answer

Network Topology

Answer

Performance Dashboard

Answer

Connectivity Tests

Question 13

A security engineer wants to monitor and analyze traffic to a load-balanced web application. Which TWO services can provide detailed logs of HTTP requests and responses?

Accepted Answer

HTTP Load Balancer access logs. HTTP Load Balancer access logs capture request details. Cloud Armor request logs provide additional security insights. VPC Flow Logs and Firewall logs do not provide HTTP-level details.

Answer

Cloud NAT logging

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Question 14

A company is experiencing a BGP session flap between Cloud Router and an on-premises router. Which THREE actions should the engineer take to diagnose the issue?

Accepted Answer

Check VPN tunnel status and IKE parameters. Check Cloud Router logs for BGP events, verify firewall rules allow BGP traffic (TCP 179), and check VPN tunnel status if using VPN. VPC Flow Logs and Network Topology are less relevant.

Answer

Enable VPC Flow Logs on the subnet

Answer

Review Network Topology for path changes

Question 15

A company wants to reduce outbound data transfer costs from Compute Engine to the internet. Which TWO strategies are effective?

Accepted Answer

Use a regional external HTTP(S) load balancer instead of global. Using Cloud CDN reduces egress by caching at edge. Using a regional load balancer avoids premium tier costs. Private Google Access reduces internet egress for Google APIs but not general internet traffic. Squid proxy or in-region resources do not reduce egress.

Answer

Enable Private Google Access on subnets

Answer

Deploy a Squid proxy instance to cache content

Answer

Move all instances to the same region

Question 16

A network engineer wants to test reachability between a Compute Engine instance in VPC A and a Cloud SQL instance in VPC B, which are connected via VPC peering. Which Google Cloud tool should be used to check if firewall rules or routes are blocking traffic?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to define source and destination and checks configurations like firewall rules, routes, and VPC peering to determine if traffic can flow.

Answer

Packet Mirroring

Answer

VPC Flow Logs

Answer

Firewall Insights

Question 17

A company has enabled VPC Flow Logs on a subnet with the default sample rate. They notice that only 50% of flows are being logged. What is the most likely reason?

Accepted Answer

The sample rate is set to 50% by default. The default sampling rate for VPC Flow Logs is 50%. This means only half of the network flows are captured to reduce cost and volume.

Answer

Flow logs only capture TCP traffic

Answer

Flow logs are disabled by default on all subnets

Answer

The subnet is using a custom sample rate of 50%

Question 18

An organization has a VPC with multiple subnets and Cloud NAT configured for outbound internet access. They need to analyze which instances are using the most egress bandwidth to optimize costs. Which approach is most effective?

Accepted Answer

Export VPC Flow Logs to BigQuery and query by source instance. VPC Flow Logs exported to BigQuery allow detailed analysis of traffic patterns, including source IP, destination, and bytes transferred, enabling cost attribution.

Answer

Enable Cloud NAT logging and analyze logs in Cloud Logging

Answer

Use Firewall Insights to identify high-traffic instances

Answer

Use the Performance Dashboard to see bandwidth usage per region

Question 19

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Answer

Cloud NAT logging

Question 20

An organization is using Cloud CDN to deliver content globally. Which of the following is a primary benefit of using Cloud CDN?

Accepted Answer

Reduces latency for users by caching content at edge locations. Cloud CDN caches content at edge locations, reducing egress costs from the origin and improving latency for users.

Answer

Provides DDoS protection only

Answer

Increases bandwidth to the origin server

Answer

Eliminates the need for SSL certificates