PCNE Managing, Monitoring, and Optimising Network Operations Practice Test 5 — 15 Questions

Question 1

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Accepted Answer

Cloud NAT logging with filter for errors

Answer

Firewall Rules logging

Answer

VPC Flow Logs on the subnet

Answer

Cloud Armor request logs

Question 2

An organization needs to reduce egress costs for a global application serving users worldwide. The application serves static content from Compute Engine instances. Which action is most cost-effective?

Accepted Answer

Use Cloud CDN to cache content at edge locations. Cloud CDN caches content at Google's globally distributed edge locations, reducing the distance data must travel to reach users. This decreases egress traffic from the origin Compute Engine instances because repeated requests are served from cache, directly lowering egress costs. It also improves latency and offloads origin servers.

Answer

Move all instances to a single region to reduce cross-region traffic

Answer

Upgrade to premium tier networking

Answer

Enable Private Google Access

Question 3

A network engineer has set up a Cloud Router with BGP for an HA VPN. The BGP session is flapping. Which log should be examined to diagnose the issue?

Accepted Answer

Cloud Router logs. Cloud Router logs capture BGP session state changes, route advertisements, and peering errors, making them the correct source for diagnosing a flapping BGP session. BGP runs on the Cloud Router, so any session reset, hold-timer expiry, or ASN mismatch will be recorded there. VPN tunnel logs only show IPsec/IKE events, not BGP-level behavior.

Answer

Firewall Rules logs

Answer

VPN tunnel logs

Answer

VPC Flow Logs

Question 4

A company wants to analyze firewall rule effectiveness by identifying rules that are never hit or are shadowed. Which Network Intelligence Center tool should be used?

Accepted Answer

Firewall Insights

Answer

Network Topology

Answer

Performance Dashboard

Answer

Connectivity Tests

Question 5

A security engineer wants to monitor and analyze traffic to a load-balanced web application. Which TWO services can provide detailed logs of HTTP requests and responses?

Accepted Answer

HTTP Load Balancer access logs. HTTP Load Balancer access logs (option A) are correct because they capture detailed per-request data for HTTP(S) traffic handled by the load balancer, including request URL, response status, latency, and client/server bytes. Cloud Armor request logs (option E) are correct because Cloud Armor is attached to the HTTP(S) load balancer and logs each request it evaluates, including matched security policies, rule outcomes, and request details. Cloud NAT logging (option B) only records NAT translations and connection metadata, not HTTP request/response content. VPC Flow Logs (option C) capture IP-level flow metadata (5-tuple, bytes, packets) but not HTTP-layer details. Firewall Rules logging (option D) records allow/deny decisions for firewall rules, not HTTP request and response payloads.

Answer

Cloud NAT logging

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Question 6

A network engineer wants to test reachability between a Compute Engine instance in VPC A and a Cloud SQL instance in VPC B, which are connected via VPC peering. Which Google Cloud tool should be used to check if firewall rules or routes are blocking traffic?

Accepted Answer

Connectivity Tests. Connectivity Tests in Google Cloud allows you to run a diagnostic test between a source and destination endpoint to verify reachability and identify misconfigured firewall rules or routes. It simulates the packet's path and provides detailed information about which firewall rules or routes are blocking traffic, making it ideal for troubleshooting VPC peering scenarios.

Answer

Packet Mirroring

Answer

VPC Flow Logs

Answer

Firewall Insights

Question 7

An organization has a VPC with multiple subnets and Cloud NAT configured for outbound internet access. They need to analyze which instances are using the most egress bandwidth to optimize costs. Which approach is most effective?

Accepted Answer

Export VPC Flow Logs to BigQuery and query by source instance. VPC Flow Logs capture per-connection metadata including source instance, destination, and bytes sent, and exporting them to BigQuery enables SQL-based aggregation to identify which instances generate the most egress traffic. This is the most granular and queryable approach for cost optimization analysis.

Answer

Enable Cloud NAT logging and analyze logs in Cloud Logging

Answer

Use Firewall Insights to identify high-traffic instances

Answer

Use the Performance Dashboard to see bandwidth usage per region

Question 8

A network engineer wants to capture all network traffic from a set of Compute Engine instances for security monitoring by an IDS appliance. Which Google Cloud service should be used?

Accepted Answer

Packet Mirroring. Packet Mirroring copies traffic from designated instances and sends it to a collector (e.g., IDS appliance) for analysis.

Answer

VPC Flow Logs

Answer

Firewall Rules logging

Answer

Cloud NAT logging

Question 9

An organization is using Cloud CDN to deliver content globally. Which of the following is a primary benefit of using Cloud CDN?

Accepted Answer

Reduces latency for users by caching content at edge locations. Cloud CDN's primary benefit is reducing latency for users by caching content at edge locations close to them. When a user requests content, it is served from the nearest edge cache rather than the origin server, which decreases round-trip time and improves load times. This also reduces origin load and egress costs.

Answer

Provides DDoS protection only

Answer

Increases bandwidth to the origin server

Answer

Eliminates the need for SSL certificates

Question 10

A company wants to reduce egress costs for traffic going to Google APIs (e.g., Cloud Storage, BigQuery) from Compute Engine instances. Which configuration should they use?

Accepted Answer

Enable Private Google Access on the subnet. Enabling Private Google Access on the subnet allows Compute Engine instances without external IPs to reach Google APIs (Cloud Storage, BigQuery, etc.) using internal IP addresses, avoiding egress charges associated with going through the public internet. This is the recommended configuration to reduce egress costs for Google API traffic.

Answer

Use VPC Flow Logs to monitor traffic

Answer

Assign external IPs to the instances

Answer

Set up Cloud NAT for the instances

Question 11

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

Accepted Answer

One VPC has a more specific route that overrides the peering route. In VPC peering, each VPC's local routes are used to reach the peer, but if one VPC has a more specific route (longer prefix match) that also matches the destination — such as a static route or a route learned via VPN/Interconnect — that route takes precedence over the peering route. This causes outbound traffic to leave via the more specific path while return traffic comes back over the peering link, producing asymmetric routing.

Answer

VPC Flow Logs are not enabled

Answer

The MTU is mismatched between the VPCs

Answer

Firewall rules are blocking the return traffic

Question 12

A company wants to analyze HTTP load balancer access logs to understand user behavior and traffic patterns. Which approach is recommended for long-term analysis and querying?

Accepted Answer

Export logs to BigQuery. For long-term analysis and ad-hoc querying of HTTP load balancer access logs, exporting them to BigQuery is the recommended approach because BigQuery is a fully managed, petabyte-scale analytics data warehouse that supports fast SQL queries over massive datasets. Cloud Logging is designed for real-time monitoring and short-term retention (default 30 days), not for the complex, historical, large-scale analytical queries that user-behavior and traffic-pattern analysis requires.

Answer

Use VPC Flow Logs instead

Answer

View logs in the Cloud Logging dashboard

Answer

Store logs in Cloud Storage and use grep

Question 13

An organization has a project with multiple VPCs. They need to know the maximum number of firewall rules allowed per VPC. Where should they look?

Accepted Answer

IAM & Admin Quotas page. VPC quotas are documented in the Quotas page under VPC Network, showing limits per VPC such as firewall rules, routes, etc.

Answer

Cloud Logging

Answer

Network Topology

Answer

Firewall Insights

Question 14

A network engineer is using Connectivity Tests to diagnose a reachability issue between two instances in the same VPC but different subnets. The test indicates that traffic is denied by firewall rules. However, the engineer cannot find any firewall rule denying the traffic. What is a possible explanation?

Accepted Answer

The firewall rule is in a different project that is not being checked. Connectivity Tests in Google Cloud evaluate firewall rules across the relevant project and network scope, but if the denying rule lives in a different project that the test is not configured to inspect, the engineer will see a denial with no visible cause in the current project. Shared VPC and cross-project firewall configurations are common sources of this confusion. The fix is to verify the test's project scope and check firewall rules in all projects attached to the VPC.

Answer

The subnet is in a different region

Answer

VPC Flow Logs are not enabled

Answer

The instances have external IPs

Question 15

A company wants to audit firewall rules for security best practices. They need to identify overly permissive rules (e.g., allowing all traffic from 0.0.0.0/0) and rules that are never used. Which two Google Cloud tools can help? (Choose two.)

Accepted Answer

Firewall Insights. Firewall Insights (A) is correct because it analyzes VPC firewall rules and surfaces metrics such as shadowed rules, overly permissive rules (e.g., allow from 0.0.0.0/0), and rules with no hits, directly matching the audit requirement. VPC Flow Logs (D) is correct because it records sampled traffic for subnets, and analyzing these logs lets you determine which firewall rules are actually being used versus never matched. Packet Mirroring (B) only copies traffic to collector instances for deep inspection and does not evaluate rule permissiveness or usage. Cloud Armor (C) provides WAF/edge security policies for HTTP(S) load balancing, not VPC firewall rule auditing. Connectivity Tests (E) diagnoses connectivity paths and configuration issues but does not report overly permissive or unused firewall rules.

Answer

Packet Mirroring

Answer

Cloud Armor

Answer

Connectivity Tests