PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 2 — 15 Questions

Question 1

A network engineer wants to test reachability between a Compute Engine instance in VPC A and a Cloud SQL instance in VPC B, which are connected via VPC peering. Which Google Cloud tool should be used to check if firewall rules or routes are blocking traffic?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to define source and destination and checks configurations like firewall rules, routes, and VPC peering to determine if traffic can flow.

Answer

Packet Mirroring

Answer

VPC Flow Logs

Answer

Firewall Insights

Question 2

A company has enabled VPC Flow Logs on a subnet with the default sample rate. They notice that only 50% of flows are being logged. What is the most likely reason?

Accepted Answer

The sample rate is set to 50% by default. The default sampling rate for VPC Flow Logs is 50%. This means only half of the network flows are captured to reduce cost and volume.

Answer

Flow logs only capture TCP traffic

Answer

Flow logs are disabled by default on all subnets

Answer

The subnet is using a custom sample rate of 50%

Question 3

An organization has a VPC with multiple subnets and Cloud NAT configured for outbound internet access. They need to analyze which instances are using the most egress bandwidth to optimize costs. Which approach is most effective?

Accepted Answer

Export VPC Flow Logs to BigQuery and query by source instance. VPC Flow Logs exported to BigQuery allow detailed analysis of traffic patterns, including source IP, destination, and bytes transferred, enabling cost attribution.

Answer

Enable Cloud NAT logging and analyze logs in Cloud Logging

Answer

Use Firewall Insights to identify high-traffic instances

Answer

Use the Performance Dashboard to see bandwidth usage per region

Question 4

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Answer

Cloud NAT logging

Question 5

An organization is using Cloud CDN to deliver content globally. Which of the following is a primary benefit of using Cloud CDN?

Accepted Answer

Reduces latency for users by caching content at edge locations. Cloud CDN caches content at edge locations, reducing egress costs from the origin and improving latency for users.

Answer

Provides DDoS protection only

Answer

Increases bandwidth to the origin server

Answer

Eliminates the need for SSL certificates

Question 6

A company has a VPC with a Cloud Router using BGP to advertise prefixes to an on-premises network. The BGP session keeps flapping. What is a likely cause?

Accepted Answer

There is an MTU mismatch causing packet drops. MTU mismatch can cause packets to be dropped, leading to BGP session instability. Ensure consistent MTU across the path.

Answer

VPC Flow Logs are enabled on the subnet

Answer

The firewall rules are blocking BGP traffic

Answer

The Cloud Router is configured with the wrong ASN

Question 7

A company wants to reduce egress costs for traffic going to Google APIs (e.g., Cloud Storage, BigQuery) from Compute Engine instances. Which configuration should they use?

Accepted Answer

Enable Private Google Access on the subnet. Private Google Access allows instances without external IPs to reach Google APIs over the internal network, avoiding internet egress charges.

Answer

Use VPC Flow Logs to monitor traffic

Answer

Assign external IPs to the instances

Answer

Set up Cloud NAT for the instances

Question 8

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

Accepted Answer

One VPC has a more specific route that overrides the peering route. If both VPCs have routes to each other via different paths (e.g., one using peering and the other using a VPN), traffic may take asymmetric paths. VPC peering does not support transitive routing, but misconfigured routes can cause asymmetry.

Answer

VPC Flow Logs are not enabled

Answer

The MTU is mismatched between the VPCs

Answer

Firewall rules are blocking the return traffic

Question 9

A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?

Accepted Answer

Export logs to BigQuery. Load balancing logs can be exported to BigQuery for powerful SQL-based analysis and long-term retention.

Answer

Use VPC Flow Logs instead

Answer

View logs in the Cloud Logging dashboard

Answer

Store logs in Cloud Storage and use grep

Question 10

An organization has a project with multiple VPCs. They need to know the maximum number of firewall rules allowed per VPC. Where should they look?

Accepted Answer

IAM & Admin Quotas page. VPC quotas are documented in the Quotas page under VPC Network, showing limits per VPC such as firewall rules, routes, etc.

Answer

Cloud Logging

Answer

Network Topology

Answer

Firewall Insights

Question 11

A company is using a global external HTTP(S) load balancer to serve traffic from multiple regions. They notice high egress costs for traffic served to users in Asia. What change could reduce costs?

Accepted Answer

Use a regional external load balancer in Asia and enable Cloud CDN. A regional load balancer can be used for each region where users are located, avoiding the cost of global load balancing, and Cloud CDN can cache content closer to users, reducing origin egress.

Answer

Switch to a regional internal load balancer

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Increase the number of backend instances in Asia

Question 12

A network engineer is using Connectivity Tests to diagnose a reachability issue between two instances in the same VPC but different subnets. The test indicates that traffic is denied by firewall rules. However, the engineer cannot find any firewall rule denying the traffic. What is a possible explanation?

Accepted Answer

The firewall rule is in a different project that is not being checked. If there is an implied deny rule that is not explicitly listed, Connectivity Tests may still show it as the reason. Also, firewall rules are stateful; if return traffic is not matched, it could be denied. But a common oversight is that the firewall rule is in a different project (if using shared VPC) or the rule is disabled.

Answer

The subnet is in a different region

Answer

VPC Flow Logs are not enabled

Answer

The instances have external IPs

Question 13

A company wants to audit firewall rules for security best practices. They need to identify overly permissive rules (e.g., allowing all traffic from 0.0.0.0/0) and rules that are never used. Which two Google Cloud tools can help? (Choose two.)

Accepted Answer

Firewall Insights. Firewall Insights provides analytics on rule usage (including shadowed and overly permissive rules) and suggests improvements. VPC Flow Logs can be analyzed to see which firewall rules are matched by actual traffic, identifying unused rules. Connectivity Tests is for reachability testing, not auditing. Packet Mirroring is for traffic capture. Cloud Armor is for WAF.

Answer

Packet Mirroring

Answer

Cloud Armor

Answer

Connectivity Tests

Question 14

A company uses Cloud NAT for outbound internet access from private instances. They want to monitor for connection failures due to NAT resource exhaustion. Which two steps should they take? (Choose two.)

Accepted Answer

Enable Cloud NAT logging. Enable Cloud NAT logging to capture connection and allocation failures. Set up alerts on NAT logs to detect failures. VPC Flow Logs do not capture NAT-specific failures. Firewall Insights are for firewall rules. Packet Mirroring is not relevant.

Answer

Enable VPC Flow Logs on the subnet

Answer

Use Packet Mirroring to capture NAT traffic

Answer

Use Firewall Insights to check for blocked traffic

Question 15

A company is experiencing packet loss between two Compute Engine instances in different zones within the same region. They suspect MTU issues. Which three actions should they take to diagnose and resolve? (Choose three.)

Accepted Answer

Verify that the network path between instances does not have a smaller MTU (e.g., VPN or load balancer). Check the MTU settings on the instances (default 1460 for GCP). Use packet capture to see if fragmentation is occurring. Ensure that the path MTU is consistent (e.g., between VMs and any load balancers). VPC Flow Logs do not show MTU. Cloud NAT is not relevant. Connectivity Tests do not test MTU.

Answer

Enable Cloud NAT to reduce packet size

Answer

Use VPC Flow Logs to check for packet drops