PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 2 — 15 Questions

Question 1

A developer wants to log all denied firewall rule events for security auditing purposes. What is the simplest way to achieve this without modifying existing firewall rules?

Accepted Answer

Create a deny-all firewall rule with logging enabled at the lowest priority. Creating a low-priority deny-all firewall rule with logging enabled captures all traffic that is not explicitly allowed by higher-priority rules, without modifying any existing rules. Because GCP firewall rules are evaluated by priority (lower number = higher priority), a deny-all rule at priority 65534 with logging enabled will log every denied packet, giving the developer the audit trail they need.

Answer

Use Cloud NAT logging

Answer

Enable firewall rule logging on existing rules

Answer

Enable VPC Flow Logs on all subnets

Question 2

An organization runs a web application on Compute Engine behind a regional external HTTP(S) load balancer. They need to log HTTP request details (e.g., user-agent, status codes) to BigQuery for analysis. Which logging feature should they enable?

Accepted Answer

Load balancing access logs. HTTP(S) load balancers support access logs that can be sent directly to BigQuery. You enable logging on the load balancer and configure the log sink to BigQuery.

Answer

Cloud Armor request logs

Answer

Firewall rules logging

Answer

VPC Flow Logs on the subnets

Question 3

A company is hitting the quota for number of firewall rules per VPC network. They need to add more rules without requesting a quota increase. Which approach can reduce the number of rules?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules can be consolidated using service accounts or tags. By grouping instances with tags and applying rules to those tags, you can reduce the number of rules. Also, hierarchical firewall policies (at folder or org level) have separate quotas and can offload rules from VPC-level quotas.

Answer

Convert all deny rules to allow rules

Answer

Use Cloud Firewall to manage rules

Answer

Delete unused subnets

Question 4

A network engineer is troubleshooting BGP session flaps between a Cloud Router and an on-premises router. The Cloud Router logs show that the session goes down and up repeatedly every few minutes. What is the most common cause of such flapping?

Accepted Answer

The on-premises router is experiencing high CPU load. The most common cause of BGP session flapping—where the session repeatedly goes down and up—is high CPU load on one of the BGP speakers. When the on-premises router's CPU is overloaded, it may fail to send or process BGP keepalive messages within the hold time, causing the session to time out and reset. This is a classic symptom in production networks, especially when the router is also handling heavy traffic or other processes.

Answer

There is a firewall rule blocking BGP port 179

Answer

The VLAN attachment is misconfigured

Answer

The Cloud Router's BGP timer values are too low

Question 5

A company is designing a multi-region application on GCP and wants to optimize egress costs. Which TWO of the following strategies will reduce cross-region egress costs? (Choose two.)

Accepted Answer

Use Cloud CDN to cache content at edge locations. Using Cloud CDN caches content at edge locations, reducing the need to fetch from the origin region. Using a regional load balancer instead of a global one can avoid cross-region traffic if users are in the same region as the backend. However, global LB with CDN is also good; but the question specifically asks for cost reduction. Cloud CDN reduces egress from origin. Regional LB avoids cross-region traffic altogether if the user and backend are in the same region.

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Deploy backends in multiple regions and use a global load balancer

Answer

Use Premium Tier networking

Question 6

A security engineer needs to identify overly permissive firewall rules and shadowed rules (rules that never match because a higher priority rule overrides them). Which TWO Network Intelligence Center tools can help? (Choose two.)

Accepted Answer

Firewall Insights. Firewall Insights is a Network Intelligence Center tool that provides analytics on firewall usage, helping identify overly permissive rules and shadowed rules. VPC Flow Logs, while useful for network monitoring, is not part of the Network Intelligence Center suite; it is a separate feature for logging network flows. Network Topology shows the network graph but does not analyze firewall rules. Connectivity Tests can verify reachability but does not analyze rule effectiveness. Performance Dashboard focuses on latency and packet loss, not firewall rule analysis.

Answer

Network Topology

Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

VPC Flow Logs

Question 7

A company is experiencing periodic packet loss between two Compute Engine instances in the same region but different zones. They have enabled VPC Flow Logs and see that the flows are marked with 'RTT' latency. Which THREE actions should they take to diagnose the issue? (Choose three.)

Accepted Answer

Check the Performance Dashboard for packet loss between the two zones. VPC Flow Logs provide RTT latency for TCP flows. Analyzing the RTT values can indicate congestion. Checking the Performance Dashboard can show packet loss between zones. Checking instance CPU metrics can reveal if one instance is overwhelmed. Checking firewall rules is less likely to cause intermittent loss; firewall rules either block or allow. Checking BGP sessions is irrelevant for intra-region traffic.

Answer

Verify that the firewall rules are not blocking ICMP

Answer

Check BGP session status on the Cloud Router

Question 8

An organization has a global web application deployed behind an External HTTPS Load Balancer. They want to reduce egress costs for users in Europe who are served from the same region. The application is already using Cloud CDN. Which additional action will MOST effectively reduce egress costs for these users?

Accepted Answer

Nothing; Cloud CDN already minimizes egress costs. Cloud CDN already caches content at edge locations, reducing egress costs by serving cached content from the edge rather than from the origin. For users in Europe, if the content is cached in European edge locations, egress costs are minimized because data is served from within the region, avoiding inter-region egress. Therefore, no additional action is needed.

Answer

Use Cloud Armor to block non-European traffic

Answer

Deploy a regional load balancer in Europe

Answer

Enable Private Google Access

Question 9

A network engineer notices asymmetric routing between two VPCs connected via VPC peering. Traffic from VPC A to VPC B flows correctly, but return traffic from VPC B to VPC A drops. What is the most likely cause?

Accepted Answer

Overlapping CIDR ranges in the peered VPCs. Asymmetric routing in VPC peering often occurs when VPCs have overlapping CIDR ranges or when one VPC has a default route that points to another peering, causing the return traffic to take a different path that may be blocked by firewall rules or not have a route.

Answer

MTU mismatch between VPCs

Answer

BGP session flaps on Cloud Router

Answer

Firewall rules blocking ICMP

Question 10

A company wants to analyze VPC Flow Logs to identify the top talkers (source IPs) generating the most traffic to their web servers. They have enabled VPC Flow Logs on the subnet. Where should they export the logs for cost-effective querying and analysis?

Accepted Answer

BigQuery. BigQuery is a serverless, petabyte-scale analytics data warehouse that can query VPC Flow Logs exported to Cloud Storage or streamed via Pub/Sub with standard SQL, making it the most cost-effective option for ad-hoc analysis like identifying top talkers. Its columnar storage and on-demand pricing (per TB scanned) suit periodic log analysis better than real-time monitoring tools.

Answer

Cloud Monitoring (Stackdriver)

Answer

Cloud Pub/Sub

Answer

Cloud Storage

Question 11

A network engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but different subnets (us-east1 and europe-west1). The engineer suspects an MTU issue. What is the default MTU for traffic within Google Cloud, and what MTU should the engineer expect when packets traverse the internet?

Accepted Answer

1460 bytes internally, 1500 bytes internet. Google Cloud VPC networks use a default MTU of 1460 bytes for traffic within the VPC (including between subnets and regions), while packets traversing the public internet are limited to the standard 1500-byte Ethernet MTU. The 1460 value accounts for the 40-byte overhead of the VPC's encapsulation (e.g., Geneve), leaving 1460 bytes for the payload.

Answer

1400 bytes internally, 1500 bytes internet

Answer

1500 bytes both internally and internet

Answer

1500 bytes internally, 1460 bytes internet

Question 12

A company has a VPC with 200 custom routes and wants to set up VPC peering with another VPC. The VPC peering quota limits the number of routes per VPC. What should the engineer do to avoid hitting the quota?

Accepted Answer

Request a VPC route quota increase. VPC quota for routes per VPC is 200 by default. To exceed this, a quota increase request must be submitted to Google Cloud Support.

Answer

Use subnet routes instead of custom routes

Answer

Delete unused routes

Answer

Use a shared VPC to consolidate routes

Question 13

A network engineer is investigating packet loss between two GCP regions using the Performance Dashboard. The dashboard shows high packet loss but no corresponding latency increase. What is the most likely cause of this packet loss?

Accepted Answer

Normal network behavior; small packet loss is expected. The Performance Dashboard measures packet loss and latency between regions. Packet loss without latency increase often indicates transient congestion or minor issues that cause drops but not queuing delay. It is normal to see some loss; the dashboard shows real measurements.

Answer

A misconfigured firewall rule blocking ICMP

Answer

A BGP session flap on Cloud Router

Answer

Cloud Armor blocking traffic

Question 14

A developer wants to enable VPC Flow Logs on a subnet to capture metadata about IP traffic. They want to reduce costs by logging only a sample of traffic. What is the default sampling rate for VPC Flow Logs?

Accepted Answer

50%. The default sampling rate for VPC Flow Logs is 50%. This can be adjusted to reduce costs but may miss some flows.

Answer

10%

Answer

100%

Answer

25%

Question 15

A security team wants to capture and analyze all DNS queries from their Compute Engine instances to detect potential data exfiltration. They have enabled VPC Flow Logs. Which TWO additional steps should they take to capture DNS query details?

Accepted Answer

Enable Packet Mirroring on the instances. Option A (Enable Packet Mirroring on the instances) is correct because VPC Flow Logs only record metadata about connections (5-tuple, bytes, etc.) and never the DNS query payload; Packet Mirroring copies the actual packet contents, including DNS query names and record types, to a collector for deep inspection. Option B (Enable Cloud DNS logging) is correct because Cloud DNS query logging captures the DNS queries and responses handled by Cloud DNS (query name, type, source, response code) directly, which is exactly the query-level detail needed to spot exfiltration domains. Option C (firewall rule logging) is wrong because it only logs whether connections were allowed or denied by firewall rules, not DNS query contents. Option D (increasing VPC Flow Logs sampling rate to 100%) is wrong because even full sampling only yields flow metadata, not DNS payloads. Option E (exporting VPC Flow Logs to BigQuery) is wrong because it merely changes where flow metadata is stored for analysis and still contains no DNS query details.

Answer

Enable firewall rule logging

Answer

Increase VPC Flow Logs sampling rate to 100%

Answer

Export VPC Flow Logs to BigQuery