PCNE Managing, Monitoring, and Optimising Network Operations — Timed 15 Questions

Question 1

A company is using VPC Flow Logs to analyze traffic patterns. They need to reduce the volume of logs by approximately 75% while still capturing representative data for troubleshooting. What is the most effective configuration change?

15 minute time limit — choose an answer to begin.

Accepted Answer

Disable VPC Flow Logs on subnets with low traffic. VPC Flow Logs supports a configurable sampling rate between 0.25 and 1.0, with a default of 0.5 (50%). Setting the sampling rate to 0.25 (25%) reduces the log volume by 75% compared to capturing all flows (1.0) and by 50% compared to the default. This still captures representative samples for troubleshooting, making it the most effective option among the choices.

Answer

Export logs only to BigQuery instead of Stackdriver

Answer

Filter logs to only include traffic on port 80

Answer

Set the sampling rate to 0.25

Question 2

A security engineer needs to identify overly permissive firewall rules and shadowed rules (rules that never match because a higher priority rule overrides them). Which TWO Network Intelligence Center tools can help? (Choose two.)

Accepted Answer

Firewall Insights. Firewall Insights is a Network Intelligence Center tool that provides analytics on firewall usage, helping identify overly permissive rules and shadowed rules. VPC Flow Logs, while useful for network monitoring, is not part of the Network Intelligence Center suite; it is a separate feature for logging network flows. Network Topology shows the network graph but does not analyze firewall rules. Connectivity Tests can verify reachability but does not analyze rule effectiveness. Performance Dashboard focuses on latency and packet loss, not firewall rule analysis.

Answer

Network Topology

Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

VPC Flow Logs

Question 3

A company uses VPC Flow Logs exported to BigQuery for security analysis. They need to identify traffic to a known malicious IP. Which THREE fields can be used in a BigQuery query to filter this traffic? (Choose THREE.)

Accepted Answer

dst_ip. VPC Flow Logs contain fields such as src_ip, dst_ip, protocol, src_port, dst_port, and others. To filter traffic destined for a known malicious IP, the dst_ip field is the primary filter. The src_ip field can identify which source IPs are initiating traffic to that destination, and the protocol field narrows down the traffic type (e.g., TCP, UDP). Therefore, all three fields can be used in a BigQuery WHERE clause to filter the relevant traffic.

Answer

src_port

Answer

bytes_sent

Question 4

A network engineer needs to verify that traffic from a specific Compute Engine instance can reach a Cloud SQL database in a different VPC. Which Google Cloud tool should be used to test this reachability?

Accepted Answer

Connectivity Tests. Network Intelligence Center Connectivity Tests allow you to check reachability between source and destination, analyzing firewall rules, routes, and VPC peering. It can pinpoint where traffic is blocked.

Answer

Cloud Monitoring

Answer

Network Topology

Answer

VPC Flow Logs

Question 5

A company wants to analyze VPC Flow Logs to understand which external IPs are generating the most outbound traffic. What is the most scalable way to store and query these logs?

Accepted Answer

BigQuery. VPC Flow Logs can be exported to BigQuery, which provides scalable SQL analysis for large datasets. This is the recommended approach for complex queries.

Answer

Cloud Storage and analyze with gsutil

Answer

Cloud Logging with Logs Explorer

Answer

Cloud Monitoring Metrics

Question 6

An engineer notices that VPC Flow Logs are enabling on a subnet but only a fraction of traffic is logged. What is the most likely cause?

Accepted Answer

Default sampling rate of 50% is applied. VPC Flow Logs use sampling by default (50%) to reduce cost and volume. This means only half of the flows are logged.

Answer

The log export filter is too restrictive

Answer

The subnet has an insufficient sampling rate set to 0.5

Answer

Flow Logs only log TCP traffic

Question 7

Which Network Intelligence Center tool provides a visual representation of your VPC network, including instances, subnets, firewall rules, and routes?

Accepted Answer

Network Topology

Answer

Connectivity Tests

Answer

Firewall Insights

Answer

Performance Dashboard

Question 8

A company has two VPCs connected via VPC Network Peering. Traffic from an instance in VPC A to an instance in VPC B is failing. Connectivity Tests show that the expected route exists and firewall rules allow the traffic. What is a possible cause?

Accepted Answer

Asymmetric routing due to conflicting routes. Asymmetric routing can occur when a packet goes from A to B via peering, but the return packet takes a different path (e.g., through a VPN) due to route priorities. This can result in dropped packets.

Answer

VPC Flow Logs are disabled

Answer

The MTU of the instances is set to 1500

Answer

The VPC peering is not in active state

Question 9

A security team wants to capture all traffic from a Compute Engine instance for intrusion detection. Which service should be used to copy traffic to a third-party IDS appliance running on another instance?

Accepted Answer

Packet Mirroring

Answer

Firewall Rules logging

Answer

VPC Flow Logs

Answer

Cloud NAT logging

Question 10

An engineer is troubleshooting high latency between a Compute Engine instance in us-central1 and an instance in europe-west1. Which tool can show per-region latency and packet loss?

Accepted Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Network Topology

Answer

Firewall Insights

Question 11

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Accepted Answer

Cloud NAT logging with filter for errors

Answer

Firewall Rules logging

Answer

VPC Flow Logs on the subnet

Answer

Cloud Armor request logs

Question 12

An organization needs to reduce egress costs for a global application serving users worldwide. The application serves static content from Compute Engine instances. Which action is most cost-effective?

Accepted Answer

Use Cloud CDN to cache content at edge locations

Answer

Move all instances to a single region to reduce cross-region traffic

Answer

Upgrade to premium tier networking

Answer

Enable Private Google Access

Question 13

What is the default MTU for packets sent between VMs within the same VPC network in Google Cloud?

Accepted Answer

1460 bytes

Answer

8970 bytes

Answer

1400 bytes

Answer

1500 bytes

Question 14

A network engineer has set up a Cloud Router with BGP for an HA VPN. The BGP session is flapping. Which log should be examined to diagnose the issue?

Accepted Answer

Cloud Router logs

Answer

Firewall Rules logs

Answer

VPN tunnel logs

Answer

VPC Flow Logs

Question 15

A company wants to analyze firewall rule effectiveness by identifying rules that are never hit or are shadowed. Which Network Intelligence Center tool should be used?

Accepted Answer

Firewall Insights

Answer

Network Topology

Answer

Performance Dashboard

Answer

Connectivity Tests