PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 3 — 15 Questions

Question 1

A network engineer wants to test whether a Compute Engine VM can reach a Cloud SQL instance in a different VPC network, considering firewall rules and VPC peering. Which Google Cloud tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to specify source and destination (including IP addresses, instances, or Google APIs) and evaluate reachability based on firewall rules, routes, VPC peering, and other policy configurations.

Answer

VPC Flow Logs

Answer

Firewall Insights

Answer

Packet Mirroring

Question 2

A company has deployed a global HTTP Load Balancer with Cloud CDN to serve content to users worldwide. They notice high egress costs from the origin region. What is the most cost-effective solution to reduce egress from the origin?

Accepted Answer

Enable Cloud CDN with general-purpose cache mode. Using Cloud CDN with a general-purpose cache mode caches content at Google's edge locations, reducing requests to the origin and lowering egress costs for served content.

Answer

Use Private Google Access

Answer

Increase the number of backend instances

Answer

Switch to a regional load balancer

Question 3

An engineer notices that some packets sent from a Compute Engine VM in GCP to an on-premises server via a VPN tunnel are being fragmented. The on-premises server is not receiving the fragmented packets. What is the most likely cause?

Accepted Answer

The VM's MTU is set to 1500. GCP uses an MTU of 1460 bytes on VMs, while the internet standard is 1500. If the VPN encapsulates packets, the additional overhead reduces effective MTU. Fragmentation may occur but is often problematic. The issue is typically due to an MTU mismatch, and setting the VM's MTU to 1460 or lower (e.g., 1400) ensures no fragmentation.

Answer

Cloud NAT is not configured

Answer

The VPN tunnel is using UDP encapsulation

Answer

The on-premises firewall is dropping ICMP

Question 4

A security team needs to capture all traffic to and from a specific Compute Engine instance for forensic analysis. They want to send the mirrored traffic to a third-party IDS appliance running on a separate VM in the same VPC. Which GCP feature should they use, and what is a key consideration?

Accepted Answer

Packet Mirroring, and the collector must be in the same VPC network as the mirrored instance. Packet Mirroring allows copying all traffic from a source instance (the mirrored instance) and sending it to a collector. A key consideration is that the collector must be in the same VPC network and must not be the same instance as the source.

Answer

Firewall Rules Logging, which logs allow/deny events

Answer

VPC Flow Logs, since logs are stored in Stackdriver and can be exported

Answer

Cloud NAT logging, which logs all outbound connections

Question 5

A company is using VPC Flow Logs to analyze traffic patterns. They need to reduce the volume of logs by approximately 75% while still capturing representative data for troubleshooting. What is the most effective configuration change?

Accepted Answer

Set the sampling rate to 0.25. VPC Flow Logs allow sampling rate configuration (from 0.5 to 1.0). The default is 0.5 (50%). Setting it to 0.25 (25%) reduces logs by half again, roughly 75% reduction from original, but still provides representative samples.

Answer

Export logs only to BigQuery instead of Stackdriver

Answer

Filter logs to only include traffic on port 80

Answer

Disable VPC Flow Logs on subnets with low traffic

Question 6

An organization has multiple VPC networks in a project and wants to centrally manage firewall rules across all networks using a single set of rules. Which approach should they take?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules are per network. To centrally manage rules, you can use hierarchical firewall policies (part of VPC Firewall Policies) applied at the organization or folder level, which override network-specific rules.

Answer

Use firewall rules with global scope

Answer

Create a single VPC network and use subnetting

Answer

Use shared VPC and apply firewall rules to the host project

Question 7

A network engineer wants to see a real-time graphical representation of the topology of their VPC network, including instances, subnets, and load balancers. Which Network Intelligence Center tool should they use?

Accepted Answer

Network Topology. Network Topology provides a visual map of your VPC network's resources and their relationships, updated in near real-time.

Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Firewall Insights

Question 8

A company has two VPC networks connected via VPC peering. They notice asymmetric routing: traffic from Network A to Network B follows one path, but return traffic from B to A takes a different path. This is causing connectivity issues for stateful firewalls. What is the likely cause?

Accepted Answer

Both VPCs have a default route (0.0.0.0/0) pointing to different next hops. VPC peering does not enforce symmetric routing by default. If both networks have subnet CIDRs that overlap, or if one network has a route that sends traffic to the other via a different next hop (e.g., VPN or NAT), asymmetric routing can occur. The most common cause is when both VPCs have a default route pointing to different next hops (e.g., one to the internet, one to a VPN), causing different paths.

Answer

The peering connection is in an inactive state

Answer

The firewall rules in Network A are more permissive than in Network B

Answer

There is a Cloud NAT configured in Network A but not in Network B

Question 9

A developer wants to log all denied firewall rule events for security auditing purposes. What is the simplest way to achieve this without modifying existing firewall rules?

Accepted Answer

Create a deny-all firewall rule with logging enabled at the lowest priority. Firewall rules logging can be enabled per rule. However, if you want to log all denied traffic without modifying existing rules, you can create a high-priority deny-all rule (e.g., priority 65535) with logging enabled. This will log any traffic not explicitly allowed.

Answer

Use Cloud NAT logging

Answer

Enable firewall rule logging on existing rules

Answer

Enable VPC Flow Logs on all subnets

Question 10

An organization runs a web application on Compute Engine behind a regional external HTTP(S) load balancer. They need to log HTTP request details (e.g., user-agent, status codes) to BigQuery for analysis. Which logging feature should they enable?

Accepted Answer

Load balancing access logs. HTTP(S) load balancers support access logs that can be sent directly to BigQuery. You enable logging on the load balancer and configure the log sink to BigQuery.

Answer

Cloud Armor request logs

Answer

Firewall rules logging

Answer

VPC Flow Logs on the subnets

Question 11

A company is hitting the quota for number of firewall rules per VPC network. They need to add more rules without requesting a quota increase. Which approach can reduce the number of rules?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules can be consolidated using service accounts or tags. By grouping instances with tags and applying rules to those tags, you can reduce the number of rules. Also, hierarchical firewall policies (at folder or org level) have separate quotas and can offload rules from VPC-level quotas.

Answer

Convert all deny rules to allow rules

Answer

Use Cloud Firewall to manage rules

Answer

Delete unused subnets

Question 12

A network engineer is troubleshooting BGP session flaps between a Cloud Router and an on-premises router. The Cloud Router logs show that the session goes down and up repeatedly every few minutes. What is the most common cause of such flapping?

Accepted Answer

The on-premises router is experiencing high CPU load. BGP session flaps often occur due to hold timer expiration caused by network congestion, high CPU on either router, or packet loss. The most common cause in GCP is when the on-premises router does not process keepalives fast enough due to high CPU or memory pressure.

Answer

There is a firewall rule blocking BGP port 179

Answer

The VLAN attachment is misconfigured

Answer

The Cloud Router's BGP timer values are too low

Question 13

A company is designing a multi-region application on GCP and wants to optimize egress costs. Which TWO of the following strategies will reduce cross-region egress costs? (Choose two.)

Accepted Answer

Use Cloud CDN to cache content at edge locations. Using Cloud CDN caches content at edge locations, reducing the need to fetch from the origin region. Using a regional load balancer instead of a global one can avoid cross-region traffic if users are in the same region as the backend. However, global LB with CDN is also good; but the question specifically asks for cost reduction. Cloud CDN reduces egress from origin. Regional LB avoids cross-region traffic altogether if the user and backend are in the same region.

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Deploy backends in multiple regions and use a global load balancer

Answer

Use Premium Tier networking

Question 14

A security engineer needs to identify overly permissive firewall rules and shadowed rules (rules that never match because a higher priority rule overrides them). Which TWO Network Intelligence Center tools can help? (Choose two.)

Accepted Answer

Firewall Insights. Firewall Insights provides analytics on firewall usage, including identifying overly permissive rules and shadowed rules. Network Topology can show the network graph but not firewall rule analysis. Connectivity Tests can verify reachability but not analyze rules. Performance Dashboard is for latency/packet loss.

Answer

Network Topology

Answer

Performance Dashboard

Answer

Connectivity Tests

Question 15

A company is experiencing periodic packet loss between two Compute Engine instances in the same region but different zones. They have enabled VPC Flow Logs and see that the flows are marked with 'RTT' latency. Which THREE actions should they take to diagnose the issue? (Choose three.)

Accepted Answer

Check the Performance Dashboard for packet loss between the two zones. VPC Flow Logs provide RTT latency for TCP flows. Analyzing the RTT values can indicate congestion. Checking the Performance Dashboard can show packet loss between zones. Checking instance CPU metrics can reveal if one instance is overwhelmed. Checking firewall rules is less likely to cause intermittent loss; firewall rules either block or allow. Checking BGP sessions is irrelevant for intra-region traffic.

Answer

Verify that the firewall rules are not blocking ICMP

Answer

Check BGP session status on the Cloud Router