PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 2 — 15 Questions

Question 1

A security engineer wants to monitor and analyze traffic to a load-balanced web application. Which TWO services can provide detailed logs of HTTP requests and responses?

Accepted Answer

HTTP Load Balancer access logs. HTTP Load Balancer access logs capture request details. Cloud Armor request logs provide additional security insights. VPC Flow Logs and Firewall logs do not provide HTTP-level details.

Answer

Cloud NAT logging

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Question 2

A company is experiencing a BGP session flap between Cloud Router and an on-premises router. Which THREE actions should the engineer take to diagnose the issue?

Accepted Answer

Check VPN tunnel status and IKE parameters. Check Cloud Router logs for BGP events, verify firewall rules allow BGP traffic (TCP 179), and check VPN tunnel status if using VPN. VPC Flow Logs and Network Topology are less relevant.

Answer

Enable VPC Flow Logs on the subnet

Answer

Review Network Topology for path changes

Question 3

A company wants to reduce outbound data transfer costs from Compute Engine to the internet. Which TWO strategies are effective?

Accepted Answer

Use a regional external HTTP(S) load balancer instead of global. Using Cloud CDN reduces egress by caching at edge. Using a regional load balancer avoids premium tier costs. Private Google Access reduces internet egress for Google APIs but not general internet traffic. Squid proxy or in-region resources do not reduce egress.

Answer

Enable Private Google Access on subnets

Answer

Deploy a Squid proxy instance to cache content

Answer

Move all instances to the same region

Question 4

A network engineer wants to test reachability between a Compute Engine instance in VPC A and a Cloud SQL instance in VPC B, which are connected via VPC peering. Which Google Cloud tool should be used to check if firewall rules or routes are blocking traffic?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to define source and destination and checks configurations like firewall rules, routes, and VPC peering to determine if traffic can flow.

Answer

Packet Mirroring

Answer

VPC Flow Logs

Answer

Firewall Insights

Question 5

A company has enabled VPC Flow Logs on a subnet with the default sample rate. They notice that only 50% of flows are being logged. What is the most likely reason?

Accepted Answer

The sample rate is set to 50% by default. The default sampling rate for VPC Flow Logs is 50%. This means only half of the network flows are captured to reduce cost and volume.

Answer

Flow logs only capture TCP traffic

Answer

Flow logs are disabled by default on all subnets

Answer

The subnet is using a custom sample rate of 50%

Question 6

An organization has a VPC with multiple subnets and Cloud NAT configured for outbound internet access. They need to analyze which instances are using the most egress bandwidth to optimize costs. Which approach is most effective?

Accepted Answer

Export VPC Flow Logs to BigQuery and query by source instance. VPC Flow Logs exported to BigQuery allow detailed analysis of traffic patterns, including source IP, destination, and bytes transferred, enabling cost attribution.

Answer

Enable Cloud NAT logging and analyze logs in Cloud Logging

Answer

Use Firewall Insights to identify high-traffic instances

Answer

Use the Performance Dashboard to see bandwidth usage per region

Question 7

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Answer

Cloud NAT logging

Question 8

An organization is using Cloud CDN to deliver content globally. Which of the following is a primary benefit of using Cloud CDN?

Accepted Answer

Reduces latency for users by caching content at edge locations. Cloud CDN caches content at edge locations, reducing egress costs from the origin and improving latency for users.

Answer

Provides DDoS protection only

Answer

Increases bandwidth to the origin server

Answer

Eliminates the need for SSL certificates

Question 9

A company has a VPC with a Cloud Router using BGP to advertise prefixes to an on-premises network. The BGP session keeps flapping. What is a likely cause?

Accepted Answer

There is an MTU mismatch causing packet drops. MTU mismatch can cause packets to be dropped, leading to BGP session instability. Ensure consistent MTU across the path.

Answer

VPC Flow Logs are enabled on the subnet

Answer

The firewall rules are blocking BGP traffic

Answer

The Cloud Router is configured with the wrong ASN

Question 10

A company wants to reduce egress costs for traffic going to Google APIs (e.g., Cloud Storage, BigQuery) from Compute Engine instances. Which configuration should they use?

Accepted Answer

Enable Private Google Access on the subnet. Private Google Access allows instances without external IPs to reach Google APIs over the internal network, avoiding internet egress charges.

Answer

Use VPC Flow Logs to monitor traffic

Answer

Assign external IPs to the instances

Answer

Set up Cloud NAT for the instances

Question 11

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

Accepted Answer

One VPC has a more specific route that overrides the peering route. If both VPCs have routes to each other via different paths (e.g., one using peering and the other using a VPN), traffic may take asymmetric paths. VPC peering does not support transitive routing, but misconfigured routes can cause asymmetry.

Answer

VPC Flow Logs are not enabled

Answer

The MTU is mismatched between the VPCs

Answer

Firewall rules are blocking the return traffic

Question 12

A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?

Accepted Answer

Export logs to BigQuery. Load balancing logs can be exported to BigQuery for powerful SQL-based analysis and long-term retention.

Answer

Use VPC Flow Logs instead

Answer

View logs in the Cloud Logging dashboard

Answer

Store logs in Cloud Storage and use grep

Question 13

An organization has a project with multiple VPCs. They need to know the maximum number of firewall rules allowed per VPC. Where should they look?

Accepted Answer

IAM & Admin Quotas page. VPC quotas are documented in the Quotas page under VPC Network, showing limits per VPC such as firewall rules, routes, etc.

Answer

Cloud Logging

Answer

Network Topology

Answer

Firewall Insights

Question 14

A company is using a global external HTTP(S) load balancer to serve traffic from multiple regions. They notice high egress costs for traffic served to users in Asia. What change could reduce costs?

Accepted Answer

Use a regional external load balancer in Asia and enable Cloud CDN. A regional load balancer can be used for each region where users are located, avoiding the cost of global load balancing, and Cloud CDN can cache content closer to users, reducing origin egress.

Answer

Switch to a regional internal load balancer

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Increase the number of backend instances in Asia

Question 15

A network engineer is using Connectivity Tests to diagnose a reachability issue between two instances in the same VPC but different subnets. The test indicates that traffic is denied by firewall rules. However, the engineer cannot find any firewall rule denying the traffic. What is a possible explanation?

Accepted Answer

The firewall rule is in a different project that is not being checked. If there is an implied deny rule that is not explicitly listed, Connectivity Tests may still show it as the reason. Also, firewall rules are stateful; if return traffic is not matched, it could be denied. But a common oversight is that the firewall rule is in a different project (if using shared VPC) or the rule is disabled.

Answer

The subnet is in a different region

Answer

VPC Flow Logs are not enabled

Answer

The instances have external IPs