PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 4 — 15 Questions

Question 1

A company is experiencing periodic packet loss between two Compute Engine instances in the same region but different zones. They have enabled VPC Flow Logs and see that the flows are marked with 'RTT' latency. Which THREE actions should they take to diagnose the issue? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Performance Dashboard for packet loss between the two zones. VPC Flow Logs provide RTT latency for TCP flows. Analyzing the RTT values can indicate congestion. Checking the Performance Dashboard can show packet loss between zones. Checking instance CPU metrics can reveal if one instance is overwhelmed. Checking firewall rules is less likely to cause intermittent loss; firewall rules either block or allow. Checking BGP sessions is irrelevant for intra-region traffic.

Answer

Verify that the firewall rules are not blocking ICMP

Answer

Check BGP session status on the Cloud Router

Question 2

A network engineer wants to test whether a VM in VPC A can reach a VM in VPC B that is connected via VPC peering. The engineer suspects that firewall rules or routes are blocking traffic. Which Google Cloud service should they use to test the path and identify the blocking rule?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to check reachability between source and destination endpoints, analyzing firewall rules, routes, and VPC peering configurations to identify the blocking rule.

Answer

Performance Dashboard

Answer

VPC Flow Logs

Answer

Firewall Insights

Question 3

A company is using Cloud NAT to allow private VMs to access the internet. They want to troubleshoot connectivity failures and analyze connection attempts that were dropped due to NAT resource exhaustion. What should they enable?

Accepted Answer

Cloud NAT logging. Cloud NAT logging captures connection and allocation failures, which helps troubleshoot NAT resource exhaustion and other issues.

Answer

VPC Flow Logs on the subnet

Answer

Firewall rule logging

Answer

Packet Mirroring

Question 4

An organization has a global web application deployed behind an External HTTPS Load Balancer. They want to reduce egress costs for users in Europe who are served from the same region. The application is already using Cloud CDN. Which additional action will MOST effectively reduce egress costs for these users?

Accepted Answer

Nothing; Cloud CDN already minimizes egress costs. Cloud CDN caches content at edge locations closer to users, reducing egress costs by serving cached responses from the edge. For users in Europe, if the origin is in the US, Cloud CDN will serve from European caches after the first request, minimizing cross-region egress.

Answer

Use Cloud Armor to block non-European traffic

Answer

Deploy a regional load balancer in Europe

Answer

Enable Private Google Access

Question 5

A network engineer notices asymmetric routing between two VPCs connected via VPC peering. Traffic from VPC A to VPC B flows correctly, but return traffic from VPC B to VPC A drops. What is the most likely cause?

Accepted Answer

Overlapping CIDR ranges in the peered VPCs. Asymmetric routing in VPC peering often occurs when VPCs have overlapping CIDR ranges or when one VPC has a default route that points to another peering, causing the return traffic to take a different path that may be blocked by firewall rules or not have a route.

Answer

MTU mismatch between VPCs

Answer

BGP session flaps on Cloud Router

Answer

Firewall rules blocking ICMP

Question 6

A company wants to analyze VPC Flow Logs to identify the top talkers (source IPs) generating the most traffic to their web servers. They have enabled VPC Flow Logs on the subnet. Where should they export the logs for cost-effective querying and analysis?

Accepted Answer

BigQuery. BigQuery is the best choice for querying large volumes of VPC Flow Logs with SQL, enabling cost-effective analysis of top talkers. Stackdriver (Cloud Monitoring) is for metrics, not log analysis; Cloud Storage is for archival; Pub/Sub for streaming.

Answer

Cloud Monitoring (Stackdriver)

Answer

Cloud Pub/Sub

Answer

Cloud Storage

Question 7

An organization has a VPC with several subnets and wants to monitor firewall rule usage to identify rules that are overly permissive (e.g., allowing all traffic from 0.0.0.0/0). Which Google Cloud service provides this insight?

Accepted Answer

Firewall Insights. Firewall Insights in Network Intelligence Center provides analytics on firewall rules, including overly permissive rules and shadowed rules.

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Answer

Cloud Logging

Question 8

A company uses an external HTTP Load Balancer with Cloud Armor. They want to log all requests that are blocked by Cloud Armor security policies for compliance auditing. What should they enable?

Accepted Answer

Cloud Armor request logs. Cloud Armor request logs capture details about requests that are allowed or blocked by security policies. Enabling these logs provides the required auditing.

Answer

VPC Flow Logs

Answer

Load balancer access logs

Answer

Firewall rule logging

Question 9

A network engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but different subnets (us-east1 and europe-west1). The engineer suspects an MTU issue. What is the default MTU for traffic within Google Cloud, and what MTU should the engineer expect when packets traverse the internet?

Accepted Answer

1460 bytes internally, 1500 bytes internet. Google Cloud uses an MTU of 1460 bytes (64 bytes less than the standard 1500) to accommodate encapsulation headers. Internet traffic typically uses 1500 bytes. Fragmentation can occur if a packet larger than 1460 bytes is sent over a path that expects 1500 but the internal path is 1460.

Answer

1400 bytes internally, 1500 bytes internet

Answer

1500 bytes both internally and internet

Answer

1500 bytes internally, 1460 bytes internet

Question 10

An organization wants to mirror all traffic from a set of Compute Engine instances to a third-party IDS appliance running on a separate instance in the same VPC. The IDS appliance must receive a copy of both ingress and egress traffic without impacting production traffic. Which Google Cloud service should they use?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from source instances (mirror source) to a collector (IDS appliance) for monitoring. It is designed for this purpose without affecting production.

Answer

Firewall Insights

Answer

VPC Flow Logs

Answer

Cloud NAT logging

Question 11

A company has a VPC with 200 custom routes and wants to set up VPC peering with another VPC. The VPC peering quota limits the number of routes per VPC. What should the engineer do to avoid hitting the quota?

Accepted Answer

Request a VPC route quota increase. VPC quota for routes per VPC is 200 by default. To exceed this, a quota increase request must be submitted to Google Cloud Support.

Answer

Use subnet routes instead of custom routes

Answer

Delete unused routes

Answer

Use a shared VPC to consolidate routes

Question 12

A network engineer is investigating packet loss between two GCP regions using the Performance Dashboard. The dashboard shows high packet loss but no corresponding latency increase. What is the most likely cause of this packet loss?

Accepted Answer

Normal network behavior; small packet loss is expected. The Performance Dashboard measures packet loss and latency between regions. Packet loss without latency increase often indicates transient congestion or minor issues that cause drops but not queuing delay. It is normal to see some loss; the dashboard shows real measurements.

Answer

A misconfigured firewall rule blocking ICMP

Answer

A BGP session flap on Cloud Router

Answer

Cloud Armor blocking traffic

Question 13

A developer wants to enable VPC Flow Logs on a subnet to capture metadata about IP traffic. They want to reduce costs by logging only a sample of traffic. What is the default sampling rate for VPC Flow Logs?

Accepted Answer

50%. The default sampling rate for VPC Flow Logs is 50%. This can be adjusted to reduce costs but may miss some flows.

Answer

10%

Answer

100%

Answer

25%

Question 14

A security team wants to capture and analyze all DNS queries from their Compute Engine instances to detect potential data exfiltration. They have enabled VPC Flow Logs. Which TWO additional steps should they take to capture DNS query details?

Accepted Answer

Enable Packet Mirroring on the instances. VPC Flow Logs do not include DNS query names. To capture DNS queries, they need to enable DNS logging (which logs queries sent to Cloud DNS) or use Packet Mirroring to capture the full DNS packets for analysis.

Answer

Enable firewall rule logging

Answer

Increase VPC Flow Logs sampling rate to 100%

Answer

Export VPC Flow Logs to BigQuery

Question 15

A company is using Cloud Router with BGP for connectivity to an on-premises network via Partner Interconnect. The BGP session is flapping. Which THREE actions should the engineer take to diagnose the issue?

Accepted Answer

Verify BGP timers (keepalive/hold) match on both sides. Common causes of BGP flaps include MTU mismatch, misconfigured timers, or routing policy issues. Checking MTU, BGP timers, and route advertisements helps identify the root cause.

Answer

Disable ECMP on Cloud Router

Answer

Enable VPC Flow Logs on the interconnect subnet