PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 4 — 15 Questions

Question 1

You manage a Shared VPC host project with several service projects. A service project team reports that they cannot create a VM with an external IP in subnet 'app-subnet' (us-central1). You need to determine whether the Shared VPC subnet has external IP addresses disabled. Which gcloud command should you run?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud compute networks subnets describe app-subnet --region=us-central1 --project=HOST_PROJECT. To inspect whether a Shared VPC subnet allows external IPs, you must describe the subnet in the host project. The 'gcloud compute networks subnets describe' command returns the subnet's configuration, including the 'privateIpGoogleAccess' field, which, when true, disables external IPs for instances in that subnet. Since the subnet belongs to the host project, you must specify the host project in the command. Other commands either target the wrong resource, wrong project, or irrelevant settings.

Answer

gcloud compute firewall-rules list --filter='network:app-subnet' --project=HOST_PROJECT

Answer

gcloud compute networks subnets get-iam-policy app-subnet --region=us-central1 --project=SERVICE_PROJECT

Answer

gcloud compute shared-vpc associated-projects list --project=HOST_PROJECT

Question 2

You need to monitor the latency of traffic between two Compute Engine instances in different regions. You want to receive an alert if the round-trip time exceeds 100 ms. Which Google Cloud service should you use?

Accepted Answer

Cloud Network Intelligence Center's Performance Dashboard.. Network Intelligence Center's Performance Dashboard provides network latency and packet loss metrics for Google Cloud traffic, including between regions and zones. It can measure the round-trip time between two Compute Engine instances. You can create alerting policies in Cloud Monitoring based on these metrics to trigger when latency exceeds 100 ms. The other options do not provide the specific network latency measurement between two VMs.

Answer

Cloud Trace with network latency annotations.

Answer

VPC Flow Logs with latency analysis in BigQuery.

Answer

Cloud Monitoring uptime checks with a custom latency threshold.

Question 3

A company has a VPC network with several subnets. They want to monitor the amount of egress traffic leaving the VPC to the internet and set up an alert if it exceeds a certain threshold. Which Google Cloud feature should they use to collect the necessary metrics?

Accepted Answer

Cloud Monitoring's built-in metrics for Compute Engine network egress. Cloud Monitoring automatically collects network egress metrics for Compute Engine instances. These metrics can be aggregated and used in alerting policies to notify when egress exceeds a threshold. This is the simplest and most direct method. Other options involve logging that is either not comprehensive or not designed for volume aggregation.

Answer

Firewall Rules Logging to count bytes allowed by egress rules

Answer

Cloud NAT logging to track translated connections and their bytes

Answer

VPC Flow Logs exported to Cloud Logging, then create a log-based metric and alert

Question 4

A financial services company has a Shared VPC host project with multiple service projects. The network team wants to monitor all VPC Flow Logs from all service projects in a central Cloud Logging bucket for long-term retention and analysis. They need to ensure that the logs are stored in a single project and are accessible only to the central security team. Which configuration should they implement?

Accepted Answer

Create a log sink in each service project that routes VPC Flow Logs to a Cloud Logging bucket in the host project, and grant the security team the roles/logging.bucketViewer role on the bucket.. To centralize VPC Flow Logs from multiple service projects into a single Cloud Logging bucket in the host project, you must create a log sink in each service project that exports logs to the host project's bucket. Access control is then managed at the bucket level using IAM roles such as roles/logging.bucketViewer, which grants read access to the logs in that bucket. This ensures the security team has the necessary access while other users do not.

Answer

Create a log sink in each service project that routes VPC Flow Logs to a Cloud Logging bucket in the host project, and grant the security team the roles/logging.viewer role on that bucket.

Answer

Create a log sink in the host project that includes all service projects as sources, and route the logs to a Cloud Logging bucket in the host project. Grant the security team the roles/logging.privateLogViewer role on the bucket.

Answer

Enable VPC Flow Logs in the host project only, and use a single log sink in the host project to export all logs to a Cloud Logging bucket in the same project.

Question 5

A company has a VPC with several subnets. They want to monitor network traffic for security analysis and need to retain flow logs for 1 year at the lowest cost. Where should they store the flow logs?

Accepted Answer

In a Cloud Storage bucket with a 1-year retention policy, using a log sink.. For long-term retention of VPC Flow Logs at the lowest cost, route them to Cloud Storage using a log sink. Cloud Storage offers inexpensive object storage with lifecycle management, and you can set a retention policy for 1 year. This avoids the higher per-gigabyte costs of Cloud Logging and BigQuery.

Answer

In Cloud Logging custom bucket with a 1-year retention period.

Answer

In Cloud Logging default bucket with a 1-year retention period.

Answer

In BigQuery with a 1-year partition expiration.

Question 6

A startup has a VPC network with several subnets in us-central1. They want to capture IP traffic metadata for all VM instances in these subnets to troubleshoot connectivity issues. They need to enable VPC Flow Logs with minimal configuration and retain logs for 30 days. What should they do?

Accepted Answer

Enable VPC Flow Logs on each subnet, keep the default settings, and configure a log sink to export logs to Cloud Storage with a 30-day retention policy.. VPC Flow Logs are enabled per subnet, so enabling them on each subnet is necessary. Using default settings provides a good balance of granularity and cost for troubleshooting. Cloud Logging retains logs for 30 days by default, so no additional sink is strictly required, but if a sink is used, exporting to Cloud Storage with a 30-day retention policy ensures compliance. The other options either misconfigure the scope, reduce data quality, or add unnecessary complexity.

Answer

Enable VPC Flow Logs on each subnet, set the aggregation interval to 5 seconds, and set the log sampling rate to 100%.

Answer

Enable VPC Flow Logs at the VPC network level, set the aggregation interval to 10 minutes, and set the sampling rate to 50%.

Answer

Enable VPC Flow Logs on each subnet, set the aggregation interval to 5 minutes, and set the sampling rate to 10% to reduce costs, then export to BigQuery for 30-day retention.

Question 7

A healthcare company has a VPC with several subnets and uses Cloud NAT for outbound internet access. The security team needs to identify which Compute Engine instances are making outbound connections to a specific external IP address for compliance auditing. They want to minimize logging costs and only capture the necessary data. Which logging configuration should they use?

Accepted Answer

Enable Cloud NAT logging with a filter that logs only connections to the specific external IP, and set the log filter to include only errors and translations.. Cloud NAT logging is designed to capture NAT translation events, including the internal IP of the instance and the external IP used. By filtering logs to only connections to the specific external IP, you can identify the instances making those connections while keeping logging costs low. This is the most direct and efficient method for the compliance auditing requirement.

Answer

Enable firewall rule logging on the egress firewall rules that allow outbound traffic, and filter logs by the destination IP address.

Answer

Use Packet Mirroring to capture all traffic from the instances and analyze the packets to identify connections to the specific external IP.

Answer

Enable VPC Flow Logs on all subnets with a filter that includes only traffic to the specific external IP, and set the aggregation interval to 5 minutes.

Question 8

A company uses a global external HTTP(S) load balancer with a backend service that has instances in multiple regions. The security team wants to analyze the load balancer's logs to detect potential DDoS attacks. They need to query the logs for requests with specific HTTP status codes and client IPs, and they want to retain the logs for 90 days for forensic analysis. Which approach should they take?

Accepted Answer

Enable logging on the load balancer, configure a log sink to BigQuery, and set the BigQuery dataset's default table expiration to 90 days.. To analyze HTTP(S) load balancer logs for DDoS detection, you need to enable logging on the load balancer and export logs to a system that supports fast querying. BigQuery is ideal for this, allowing SQL queries on fields like status and remoteIp. Setting the dataset's default table expiration to 90 days ensures retention compliance. Cloud Storage is for archival, Cloud Armor logs are incomplete, and VPC Flow Logs lack HTTP details. Thus, the log sink to BigQuery is the correct approach.

Answer

Enable logging on the backend service, set the sample rate to 100%, and export logs to Cloud Storage with a 90-day retention policy.

Answer

Enable VPC Flow Logs on the load balancer's subnets, and export to BigQuery with a 90-day retention.

Answer

Use Cloud Armor with security policies to log all requests, and export logs to Cloud Logging with a 90-day retention.

Question 9

A healthcare company has a VPC with Cloud NAT configured for outbound internet access. They need to monitor and alert on the number of allocated ports in the NAT gateway to prevent port exhaustion, which could disrupt outbound connections. They want to use Cloud Monitoring and receive notifications when port utilization exceeds 80%. What should they do?

Accepted Answer

Create a Cloud Monitoring alerting policy based on the router.googleapis.com/nat/allocated_ports metric, with a condition that the ratio of allocated ports to the NAT gateway's port capacity exceeds 0.8.. Cloud NAT exposes the metric router.googleapis.com/nat/allocated_ports, which tracks the number of ports allocated by the NAT gateway. To alert on port exhaustion risk, you should create an alerting policy that compares allocated ports to the gateway's total port capacity, triggering when the ratio exceeds 0.8. This uses the correct metric and aggregation level, providing proactive notification before ports run out. Other options either misinterpret the metric's scope, use unrelated logs, or rely on manual processes.

Answer

Enable VPC Flow Logs on the subnets using Cloud NAT, then create a log-based alert that triggers when the number of logged connections exceeds a threshold.

Answer

Use the Cloud NAT dashboard in the Google Cloud Console to manually monitor port usage, and set up a Cloud Scheduler job to check the dashboard API every 5 minutes and send an email if usage is high.

Answer

Create a Cloud Monitoring alerting policy based on the router.googleapis.com/nat/allocated_ports metric, with a threshold of 80% of the maximum ports per VM instance.

Question 10

Your company runs a critical web application on a managed instance group behind an external TCP proxy load balancer. You need to receive alerts when the load balancer's backend health check status changes to UNHEALTHY. Which Google Cloud service should you use to monitor and alert on this metric?

Accepted Answer

Cloud Monitoring with an alerting policy on the 'loadbalancing.googleapis.com/backend/healthcheck/health' metric. Cloud Monitoring is the centralized service for collecting metrics and creating alerting policies. The load balancer backend health check metric is available in Cloud Monitoring. By configuring an alerting policy on that metric, you can be notified when a backend becomes unhealthy. Other services like Cloud Logging, Cloud Trace, and Cloud Profiler serve different purposes and do not directly monitor health check status.

Answer

Cloud Trace with a custom trace analysis for backend latency

Answer

Cloud Logging with a log-based alert on load balancer access logs

Answer

Cloud Profiler with a profiling analysis of backend instances

Question 11

Your organization uses a Cloud Interconnect connection to on-premises. You need to monitor the interconnect's utilization and receive alerts when it exceeds 80% for 5 minutes. Which Google Cloud service should you use to set up this alert?

Accepted Answer

Cloud Monitoring with an alerting policy on the 'interconnect/network/bandwidth' metric. Cloud Monitoring is the service for collecting and alerting on metrics. Cloud Interconnect exposes the 'interconnect/network/bandwidth' metric, which can be used in an alerting policy. By setting a threshold condition (e.g., >80% of capacity) for a duration of 5 minutes, you can receive alerts when utilization is high. Other services like Cloud Logging, Network Intelligence Center, and Cloud Trace do not provide the necessary real-time metric monitoring for this use case.

Answer

Cloud Trace with a custom trace analysis for interconnect latency

Answer

Network Intelligence Center with a connectivity test for the interconnect

Answer

Cloud Logging with a log-based alert on interconnect audit logs

Question 12

A network engineer needs to verify that traffic from a specific Compute Engine instance can reach a Cloud SQL database in a different VPC. Which Google Cloud tool should be used to test this reachability?

Accepted Answer

Connectivity Tests. Network Intelligence Center Connectivity Tests allow you to check reachability between source and destination, analyzing firewall rules, routes, and VPC peering. It can pinpoint where traffic is blocked.

Answer

Cloud Monitoring

Answer

Network Topology

Answer

VPC Flow Logs

Question 13

A company wants to analyze VPC Flow Logs to understand which external IPs are generating the most outbound traffic. What is the most scalable way to store and query these logs?

Accepted Answer

BigQuery. VPC Flow Logs can be exported to BigQuery, which provides scalable SQL analysis for large datasets. This is the recommended approach for complex queries.

Answer

Cloud Storage and analyze with gsutil

Answer

Cloud Logging with Logs Explorer

Answer

Cloud Monitoring Metrics

Question 14

Which Network Intelligence Center tool provides a visual representation of your VPC network, including instances, subnets, firewall rules, and routes?

Accepted Answer

Network Topology. Network Topology in Network Intelligence Center provides a visual, interactive representation of your VPC network, showing instances, subnets, firewall rules, routes, and their relationships across projects and regions. It is specifically designed for topology visualization and troubleshooting. Connectivity Tests, Firewall Insights, and Performance Dashboard serve different purposes (path simulation, firewall rule analysis, and latency/performance metrics).

Answer

Connectivity Tests

Answer

Firewall Insights

Answer

Performance Dashboard

Question 15

A security team wants to capture all traffic from a Compute Engine instance for intrusion detection. Which service should be used to copy traffic to a third-party IDS appliance running on another instance?

Accepted Answer

Packet Mirroring. Packet Mirroring is the Google Cloud feature designed to copy ingress and egress traffic from a Compute Engine instance (or set of instances) and deliver it to a collector instance for inspection. It mirrors the full packet payload, which is exactly what a third-party IDS appliance needs to perform deep packet inspection and signature matching. The mirrored traffic is sent to the target instance's internal IP, so the IDS can run on another VM in the same VPC.

Answer

Firewall Rules logging

Answer

VPC Flow Logs

Answer

Cloud NAT logging