PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 3 — 15 Questions

Question 1

A company is using Cloud Router with BGP for connectivity to an on-premises network via Partner Interconnect. The BGP session is flapping. Which THREE actions should the engineer take to diagnose the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify BGP timers (keepalive/hold) match on both sides. Common causes of BGP flaps include MTU mismatch, misconfigured timers, or routing policy issues. Checking MTU, BGP timers, and route advertisements helps identify the root cause.

Answer

Disable ECMP on Cloud Router

Answer

Enable VPC Flow Logs on the interconnect subnet

Question 2

A company uses VPC Flow Logs to analyze traffic patterns. They notice that the logs show only 50% of the actual flows. What is the most likely cause?

Accepted Answer

The default sampling rate of 50% is applied.. By default, VPC Flow Logs sample 50% of flows. This is a known behavior and can be adjusted by configuring the sampling rate.

Answer

The subnet does not have Flow Logs enabled.

Answer

Flow Logs are only generated for incoming traffic.

Answer

Logs are being filtered by a log sink.

Question 3

A company has two VPC networks connected via VPC Network Peering. They observe asymmetric routing causing connectivity issues. Which configuration is most likely to be the root cause?

Accepted Answer

One VPC has a static route pointing to the peering connection, and the other has a static route pointing to a VPN tunnel.. Asymmetric routing in VPC peering often occurs when both sides have overlapping or conflicting routes, such as custom static routes that point to different next hops. VPC peering requires symmetric routing.

Answer

One VPC has a custom route for 0.0.0.0/0 pointing to a NAT gateway.

Answer

Dynamic routing mode is set to regional on both sides.

Answer

Both VPCs have default internet gateways.

Question 4

A company uses VPC Flow Logs exported to BigQuery for security analysis. They need to identify traffic to a known malicious IP. Which THREE fields can be used in a BigQuery query to filter this traffic? (Choose THREE.)

Accepted Answer

dst_ip. Options A (dst_ip), D (src_ip), and E (protocol) are correct because VPC Flow Logs records include the source and destination IP addresses and the IP protocol number, which are the fields needed to match traffic involving a known malicious IP and to narrow it to a specific protocol. dst_ip lets you filter flows where the malicious IP is the destination, src_ip lets you filter flows where the malicious IP is the source, and protocol lets you restrict the query to a specific transport protocol (for example, 6 for TCP or 17 for UDP). Option B (src_port) is not among the marked correct answers here, and option C (bytes_sent) is a volume metric that does not identify the malicious IP itself, so neither belongs in the filter for this scenario.

Answer

src_port

Answer

bytes_sent

Question 5

A network engineer is troubleshooting high latency between two VM instances in different GCP regions. Which TWO tools can help identify packet loss and latency issues? (Choose TWO.)

Accepted Answer

Performance Dashboard. Performance Dashboard shows latency and packet loss between regions. Connectivity Tests can also report latency and packet loss along the path.

Answer

VPC Flow Logs

Answer

Network Topology

Answer

Firewall Insights

Question 6

A company is migrating to Google Cloud and needs to connect their on-premises data center to a VPC using Cloud VPN with dynamic routing (BGP). They want high availability and automatic failover. Which THREE components are required? (Choose THREE.)

Accepted Answer

Cloud Router with BGP enabled. Option A is correct because a Cloud Router is mandatory for Cloud VPN dynamic routing: it runs the BGP session (ASN 16550 by default) that exchanges routes between the VPC and the on-premises router, enabling automatic failover. Option C is correct because HA VPN requires two Cloud VPN gateway interfaces (each with its own external IP) in a 99.99% SLA configuration, providing the redundancy needed for high availability. Option E is correct because HA VPN pairs each gateway interface with a separate tunnel to a distinct peer gateway interface, so two tunnels on different gateways are needed for BGP failover. Option B is wrong because a single tunnel is a single point of failure and cannot deliver HA or automatic failover. Option D is wrong because VPC Network Peering connects two VPC networks within Google Cloud and does not provide on-premises-to-VPC connectivity or BGP routing.

Answer

A single VPN tunnel

Answer

VPC Network Peering

Question 7

An engineer needs to monitor Cloud NAT gateway usage for cost allocation and troubleshooting. Which TWO types of logs should they enable? (Choose TWO.)

Accepted Answer

Translation logs (failures). Option A (Translation logs (failures)) is correct because Cloud NAT translation logs record errors such as when a VM instance's connection cannot be translated due to port exhaustion or an unsupported protocol, which is essential for troubleshooting NAT failures. Option D (NAT logs (connections)) is correct because Cloud NAT connection logs capture details about each NAT connection, including source and destination IP addresses and ports, which supports both troubleshooting and cost allocation analysis of NAT gateway usage. Option B (VPC Flow Logs) is not correct because VPC Flow Logs capture IP traffic flow data at the subnet or VM level, not Cloud NAT gateway-specific translation or connection events. Option C (Load balancer access logs) is not correct because these logs record requests handled by load balancers, not NAT gateway activity. Option E (Firewall rules logs) is not correct because firewall rules logging records allowed and denied connections based on firewall rules, not Cloud NAT gateway usage or translation events.

Answer

VPC Flow Logs

Answer

Load balancer access logs

Answer

Firewall rules logs

Question 8

Your team manages a Shared VPC host project with 20 service projects. Security auditors require that all VPC Flow Logs across every service project subnet are aggregated into a single BigQuery dataset in the host project for correlation. You need a solution that scales as new service projects are added. What should you do?

Accepted Answer

Create an aggregated sink at the host project level with a filter for VPC Flow Logs and a BigQuery destination, and grant the host project's log writer identity write access to the dataset.. An aggregated sink at the host project level is the only option that automatically includes logs from all service projects, including future ones, without per-project configuration. It filters for VPC Flow Logs and sends them to a BigQuery dataset in the host project. Granting the host project's log writer identity write access ensures the sink can deliver logs, meeting the scalability and centralization requirements.

Answer

Enable VPC Flow Logs on each subnet individually and configure a Log Router sink in each service project to export logs to the host project's BigQuery dataset.

Answer

Enable VPC Flow Logs on the Shared VPC subnets and use Cloud Logging's default _Default sink to export all logs to a Cloud Storage bucket in the host project.

Answer

Use a log-based metric in each service project to count VPC Flow Log entries, then export the metrics to a single Cloud Monitoring workspace in the host project.

Question 9

Your team operates a Shared VPC host project that provides subnets to multiple service projects. A service project owner needs to see detailed flow logs for the subnet their VM uses, but you must prevent them from seeing flow logs for any other subnet in the Shared VPC. What should you do?

Accepted Answer

Grant the service project owner roles/compute.networkViewer on the specific subnet in the host project.. VPC Flow Logs are generated in the host project that owns the subnet. To let a service project user view only one subnet's flow logs, grant a role that includes log viewing permission scoped to that subnet resource. roles/compute.networkViewer on the specific subnet provides exactly that least-privilege access without exposing other subnets.

Answer

Enable VPC Flow Logs on the subnet in the service project instead of the host project.

Answer

Grant the service project owner the roles/logging.viewer role at the service project level.

Answer

Export the subnet's flow logs to a Cloud Logging bucket in the service project and grant access there.

Question 10

Your team runs a microservices application on GKE. You need to monitor the latency of individual services and identify which service calls are causing slowdowns. You want to use a managed service that automatically captures distributed traces without modifying application code. Which Google Cloud service should you use?

Accepted Answer

Cloud Trace. Cloud Trace is the managed distributed tracing service on Google Cloud. It automatically collects latency data from GKE workloads using eBPF or OpenTelemetry, without application changes. This allows you to see the full request path and identify which microservice contributes most to latency, making it ideal for diagnosing slowdowns in a microservices architecture.

Answer

Cloud Logging

Answer

Cloud Profiler

Answer

Cloud Monitoring

Question 11

A company runs a critical application on a Compute Engine managed instance group behind an internal TCP/UDP load balancer in us-central1. The operations team needs to be alerted whenever the number of healthy backends drops below the configured threshold for more than 5 minutes. They also want to avoid false alerts during planned maintenance. Which Google Cloud monitoring approach should they implement?

Accepted Answer

Create a Cloud Monitoring alerting policy based on the internal load balancer's health check metrics, using a metric threshold condition on the backend health state and a 5-minute alignment period. The internal TCP/UDP load balancer exposes health-related metrics in Cloud Monitoring. An alerting policy with a threshold condition on the number of healthy backends, evaluated over a 5-minute window, directly addresses the requirement. It also allows for maintenance windows via alerting policy settings. Other options either monitor irrelevant data or require custom development.

Answer

Configure a Cloud Pub/Sub notification from the load balancer's health check endpoint and trigger a Cloud Function to send an alert

Answer

Enable VPC Flow Logs on the load balancer's subnet and create a log-based alert for dropped packets

Answer

Use Cloud Logging to monitor the load balancer's audit logs for health check failures and set up a log-based alert

Question 12

Your company uses Cloud NAT for outbound traffic from a private GKE cluster. You need to monitor the NAT allocation and identify when a VM instance is using all its allocated ports, which could cause connection failures. Which Cloud NAT metric should you use?

Accepted Answer

nat_port_usage. Cloud NAT provides the nat_port_usage metric, which reports the number of ports allocated per VM instance. This metric is essential for detecting when an instance is nearing its port allocation limit, which can lead to connection failures. Monitoring this metric allows you to take corrective action, such as adding more NAT IP addresses or reducing the number of connections per instance.

Answer

nat_connections

Answer

nat_dropped_packets

Answer

nat_allocation_failed

Question 13

You have a VPC with two subnets in us-central1 and europe-west1. You need to capture flow logs for all VM traffic in both subnets, but you want to reduce log volume by excluding traffic to and from a specific CIDR range used for health checks. What should you do?

Accepted Answer

Enable VPC Flow Logs on each subnet, then create a log sink with an exclusion filter for the health check CIDR and export to a destination.. VPC Flow Logs are enabled per subnet and generate logs into Cloud Logging. To exclude specific CIDR ranges, you cannot filter at the subnet level; instead, create a log sink with an exclusion filter. The exclusion filter prevents matching entries from being exported to the sink destination, effectively reducing volume for analysis and storage.

Answer

Enable VPC Flow Logs on each subnet with a filter expression that excludes the health check CIDR.

Answer

Enable VPC Flow Logs on each subnet and set the aggregation interval to 5 seconds to reduce the number of log entries.

Answer

Enable VPC Flow Logs on each subnet and configure an exclusion filter in the log sink to drop entries with the health check CIDR.

Question 14

Your organization uses Cloud Logging to monitor network infrastructure. You need to create a log-based alert that notifies your team when a firewall rule is deleted in any project within the organization. Which two steps should you take? (Choose two.)

Accepted Answer

Create an alerting policy in Cloud Monitoring that uses the log-based metric for firewall deletions.. To alert on firewall deletions across projects, use Cloud Monitoring log-based alerts. First, define a log-based alert with a filter matching the firewall deletion method. Then, create an alerting policy that references that log-based metric or alert and configures notification channels. This provides real-time, organization-wide detection of the event.

Answer

Enable Data Access audit logs for all services at the organization level.

Answer

Export the logs to BigQuery and create a scheduled query to check for firewall deletions.

Answer

Create a log sink at the organization level with a filter for protoPayload.methodName="v1.compute.firewalls.delete".

Question 15

A retail company runs a three-tier web application on Compute Engine instances behind an internal TCP/UDP load balancer. The network operations team needs to monitor the distribution of traffic across the load balancer's backend instances and alert when any single instance receives more than 60% of the total traffic. Which approach should the team use to obtain per-backend traffic distribution metrics and configure an alerting policy?

Accepted Answer

Use Cloud Monitoring to query the loadbalancing.googleapis.com/internal_lb/backend_latencies and connection metrics, then create an alerting policy based on the distribution across backends.. Cloud Monitoring offers native load balancing metrics that expose per-backend connection counts and traffic distribution for internal TCP/UDP load balancers. These metrics can be used to compute the proportion of traffic each backend receives and to create an alerting policy that fires when any backend exceeds a defined percentage. This is the most direct and operationally sound method.

Answer

Enable firewall rule logging on the load balancer's backend firewall rules and analyze the logs in Cloud Logging to count accepted connections per instance.

Answer

Enable VPC Flow Logs on the load balancer's subnet and export the logs to Cloud Logging, then create a log-based metric for traffic volume per instance.

Answer

Install the Cloud Monitoring agent on each backend instance and create a custom metric that reports the number of active connections, then alert on the maximum value.