PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 3 — 15 Questions

Question 1

A company wants to audit firewall rules for security best practices. They need to identify overly permissive rules (e.g., allowing all traffic from 0.0.0.0/0) and rules that are never used. Which two Google Cloud tools can help? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Firewall Insights. Firewall Insights provides analytics on rule usage (including shadowed and overly permissive rules) and suggests improvements. VPC Flow Logs can be analyzed to see which firewall rules are matched by actual traffic, identifying unused rules. Connectivity Tests is for reachability testing, not auditing. Packet Mirroring is for traffic capture. Cloud Armor is for WAF.

Answer

Packet Mirroring

Answer

Cloud Armor

Answer

Connectivity Tests

Question 2

A company uses Cloud NAT for outbound internet access from private instances. They want to monitor for connection failures due to NAT resource exhaustion. Which two steps should they take? (Choose two.)

Accepted Answer

Enable Cloud NAT logging. Enable Cloud NAT logging to capture connection and allocation failures. Set up alerts on NAT logs to detect failures. VPC Flow Logs do not capture NAT-specific failures. Firewall Insights are for firewall rules. Packet Mirroring is not relevant.

Answer

Enable VPC Flow Logs on the subnet

Answer

Use Packet Mirroring to capture NAT traffic

Answer

Use Firewall Insights to check for blocked traffic

Question 3

A company is experiencing packet loss between two Compute Engine instances in different zones within the same region. They suspect MTU issues. Which three actions should they take to diagnose and resolve? (Choose three.)

Accepted Answer

Verify that the network path between instances does not have a smaller MTU (e.g., VPN or load balancer). Check the MTU settings on the instances (default 1460 for GCP). Use packet capture to see if fragmentation is occurring. Ensure that the path MTU is consistent (e.g., between VMs and any load balancers). VPC Flow Logs do not show MTU. Cloud NAT is not relevant. Connectivity Tests do not test MTU.

Answer

Enable Cloud NAT to reduce packet size

Answer

Use VPC Flow Logs to check for packet drops

Question 4

A network engineer wants to test whether a Compute Engine VM can reach a Cloud SQL instance in a different VPC network, considering firewall rules and VPC peering. Which Google Cloud tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to specify source and destination (including IP addresses, instances, or Google APIs) and evaluate reachability based on firewall rules, routes, VPC peering, and other policy configurations.

Answer

VPC Flow Logs

Answer

Firewall Insights

Answer

Packet Mirroring

Question 5

A company has deployed a global HTTP Load Balancer with Cloud CDN to serve content to users worldwide. They notice high egress costs from the origin region. What is the most cost-effective solution to reduce egress from the origin?

Accepted Answer

Enable Cloud CDN with general-purpose cache mode. Using Cloud CDN with a general-purpose cache mode caches content at Google's edge locations, reducing requests to the origin and lowering egress costs for served content.

Answer

Use Private Google Access

Answer

Increase the number of backend instances

Answer

Switch to a regional load balancer

Question 6

An engineer notices that some packets sent from a Compute Engine VM in GCP to an on-premises server via a VPN tunnel are being fragmented. The on-premises server is not receiving the fragmented packets. What is the most likely cause?

Accepted Answer

The VM's MTU is set to 1500. GCP uses an MTU of 1460 bytes on VMs, while the internet standard is 1500. If the VPN encapsulates packets, the additional overhead reduces effective MTU. Fragmentation may occur but is often problematic. The issue is typically due to an MTU mismatch, and setting the VM's MTU to 1460 or lower (e.g., 1400) ensures no fragmentation.

Answer

Cloud NAT is not configured

Answer

The VPN tunnel is using UDP encapsulation

Answer

The on-premises firewall is dropping ICMP

Question 7

A security team needs to capture all traffic to and from a specific Compute Engine instance for forensic analysis. They want to send the mirrored traffic to a third-party IDS appliance running on a separate VM in the same VPC. Which GCP feature should they use, and what is a key consideration?

Accepted Answer

Packet Mirroring, and the collector must be in the same VPC network as the mirrored instance. Packet Mirroring allows copying all traffic from a source instance (the mirrored instance) and sending it to a collector. A key consideration is that the collector must be in the same VPC network and must not be the same instance as the source.

Answer

Firewall Rules Logging, which logs allow/deny events

Answer

VPC Flow Logs, since logs are stored in Stackdriver and can be exported

Answer

Cloud NAT logging, which logs all outbound connections

Question 8

An organization has multiple VPC networks in a project and wants to centrally manage firewall rules across all networks using a single set of rules. Which approach should they take?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules are per network. To centrally manage rules, you can use hierarchical firewall policies (part of VPC Firewall Policies) applied at the organization or folder level, which override network-specific rules.

Answer

Use firewall rules with global scope

Answer

Create a single VPC network and use subnetting

Answer

Use shared VPC and apply firewall rules to the host project

Question 9

A network engineer wants to see a real-time graphical representation of the topology of their VPC network, including instances, subnets, and load balancers. Which Network Intelligence Center tool should they use?

Accepted Answer

Network Topology. Network Topology provides a visual map of your VPC network's resources and their relationships, updated in near real-time.

Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Firewall Insights

Question 10

A company has two VPC networks connected via VPC peering. They notice asymmetric routing: traffic from Network A to Network B follows one path, but return traffic from B to A takes a different path. This is causing connectivity issues for stateful firewalls. What is the likely cause?

Accepted Answer

Both VPCs have a default route (0.0.0.0/0) pointing to different next hops. VPC peering does not enforce symmetric routing by default. If both networks have subnet CIDRs that overlap, or if one network has a route that sends traffic to the other via a different next hop (e.g., VPN or NAT), asymmetric routing can occur. The most common cause is when both VPCs have a default route pointing to different next hops (e.g., one to the internet, one to a VPN), causing different paths.

Answer

The peering connection is in an inactive state

Answer

The firewall rules in Network A are more permissive than in Network B

Answer

There is a Cloud NAT configured in Network A but not in Network B

Question 11

A developer wants to log all denied firewall rule events for security auditing purposes. What is the simplest way to achieve this without modifying existing firewall rules?

Accepted Answer

Create a deny-all firewall rule with logging enabled at the lowest priority. Firewall rules logging can be enabled per rule. However, if you want to log all denied traffic without modifying existing rules, you can create a high-priority deny-all rule (e.g., priority 65535) with logging enabled. This will log any traffic not explicitly allowed.

Answer

Use Cloud NAT logging

Answer

Enable firewall rule logging on existing rules

Answer

Enable VPC Flow Logs on all subnets

Question 12

An organization runs a web application on Compute Engine behind a regional external HTTP(S) load balancer. They need to log HTTP request details (e.g., user-agent, status codes) to BigQuery for analysis. Which logging feature should they enable?

Accepted Answer

Load balancing access logs. HTTP(S) load balancers support access logs that can be sent directly to BigQuery. You enable logging on the load balancer and configure the log sink to BigQuery.

Answer

Cloud Armor request logs

Answer

Firewall rules logging

Answer

VPC Flow Logs on the subnets

Question 13

A company is hitting the quota for number of firewall rules per VPC network. They need to add more rules without requesting a quota increase. Which approach can reduce the number of rules?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules can be consolidated using service accounts or tags. By grouping instances with tags and applying rules to those tags, you can reduce the number of rules. Also, hierarchical firewall policies (at folder or org level) have separate quotas and can offload rules from VPC-level quotas.

Answer

Convert all deny rules to allow rules

Answer

Use Cloud Firewall to manage rules

Answer

Delete unused subnets

Question 14

A network engineer is troubleshooting BGP session flaps between a Cloud Router and an on-premises router. The Cloud Router logs show that the session goes down and up repeatedly every few minutes. What is the most common cause of such flapping?

Accepted Answer

The on-premises router is experiencing high CPU load. BGP session flaps often occur due to hold timer expiration caused by network congestion, high CPU on either router, or packet loss. The most common cause in GCP is when the on-premises router does not process keepalives fast enough due to high CPU or memory pressure.

Answer

There is a firewall rule blocking BGP port 179

Answer

The VLAN attachment is misconfigured

Answer

The Cloud Router's BGP timer values are too low

Question 15

A company is designing a multi-region application on GCP and wants to optimize egress costs. Which TWO of the following strategies will reduce cross-region egress costs? (Choose two.)

Accepted Answer

Use Cloud CDN to cache content at edge locations. Using Cloud CDN caches content at edge locations, reducing the need to fetch from the origin region. Using a regional load balancer instead of a global one can avoid cross-region traffic if users are in the same region as the backend. However, global LB with CDN is also good; but the question specifically asks for cost reduction. Cloud CDN reduces egress from origin. Regional LB avoids cross-region traffic altogether if the user and backend are in the same region.

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Deploy backends in multiple regions and use a global load balancer

Answer

Use Premium Tier networking