PCNE Timed Practice Test 3 — 10 Questions

Question 1

An organization is using Cloud VPN with dynamic routing and wants to improve failover time between two VPN tunnels. Which THREE configuration changes can help reduce failover time?

Accepted Answer

Set a lower BGP MED value on the primary tunnel. Option A is correct because lowering the BGP Multi-Exit Discriminator (MED) value on the primary tunnel makes it more preferred by the BGP best-path selection process. When the primary tunnel fails, BGP withdraws the route, and the backup tunnel (with a higher MED) is immediately used without waiting for timers to expire. This reduces failover time by ensuring the backup path is already known and only needs to be selected upon withdrawal.

Answer

Increase the BGP keepalive interval to reduce overhead

Answer

Add static routes with a higher priority than BGP routes

Question 2

A company has a VPC with multiple subnets. They want to restrict traffic between two specific subnets (10.0.1.0/24 and 10.0.2.0/24) while allowing all other traffic. They create a firewall rule with priority 1000 denying ingress from 10.0.1.0/24 to 10.0.2.0/24. However, traffic is still allowed. What is the most likely reason?

Accepted Answer

There is a higher priority allow rule that matches the traffic. Option C is correct because in Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence. A rule with priority 1000 is evaluated after any rule with a priority lower than 1000 (e.g., priority 65535 is the default allow rule). If a higher priority (lower number) allow rule exists that matches the same traffic, it will override the deny rule. The default VPC firewall rules include an implicit allow rule for egress and an ingress allow rule for traffic within the same VPC, which may have a higher priority than 1000, thus permitting the traffic despite the deny rule.

Answer

The rule is incorrectly applied to the wrong network tag

Answer

The traffic is going through the metadata server

Answer

Firewall rules are stateless, so return traffic is blocked

Question 3

Which TWO considerations are important when designing a VPC peering strategy between multiple projects in Google Cloud?

Accepted Answer

Subnet IP ranges in peered VPCs must not overlap. Option B is correct because VPC peering requires that subnet IP ranges in peered VPCs do not overlap. This is a fundamental constraint of VPC peering in Google Cloud: if two VPCs have overlapping CIDR blocks, routes cannot be exchanged unambiguously, and the peering connection will fail to establish or will cause routing conflicts. Overlapping ranges would break the ability to route traffic correctly between the VPCs, as there would be no way to determine which subnet a packet should be delivered to.

Answer

Peering is transitive by default

Answer

Firewall rules in one VPC automatically apply to peered VPCs

Answer

VPC peering can only be used within the same project

Question 4

You have a Cloud Router with the configuration shown. The on-premises network (ASN 65002) is not receiving any routes from Google Cloud. What is the most likely cause?

Accepted Answer

The router is in custom advertise mode but does not advertise the VPC subnets. When a Cloud Router is configured in custom advertise mode, it only advertises the routes explicitly specified in the custom advertisement list. If the VPC subnets are not included in that list, the on-premises network will not receive any routes from Google Cloud, even if the BGP session is established. This is the most likely cause because the question states the on-premises network is not receiving any routes, which aligns with a missing custom advertisement rather than a session or timer issue.

Answer

The BGP keepalive interval is set too low

Answer

The BGP session is not established

Answer

The on-premises subnet 10.0.1.0/24 is not advertised

Question 5

A company wants to migrate a legacy application to Google Cloud that requires low-latency communication with on-premises databases. The application is latency-sensitive and must use private IP addresses only. Which hybrid connectivity solution should they choose?

Accepted Answer

Partner Interconnect. Partner Interconnect is the correct choice because it provides a dedicated, high-bandwidth connection with low latency, supports private IP addresses, and meets the requirement for latency-sensitive communication with on-premises databases. Unlike other options, it offers a Service Level Agreement (SLA) for uptime and performance, ensuring consistent low-latency connectivity.

Answer

Cloud VPN

Answer

Carrier Peering

Answer

Direct Peering

Question 6

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

Accepted Answer

Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).. Option A is correct because it uses a service account filter to allow traffic from the cloud-services service account, which is the identity used by Cloud Load Balancing to forward traffic to backend instances. This ensures that only traffic originating from the load balancer (including health check probes) is permitted, while also automatically covering the health check ranges (35.191.0.0/16, 130.211.0.0/22) without needing to hardcode IP ranges. This approach is more secure and scalable than IP-based rules, as it avoids the risk of IP range changes and provides identity-based access control.

Answer

Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.

Answer

Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.

Answer

Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.

Question 7

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Accepted Answer

Private Google Access enabled on the subnet where the VPN gateway resides.. Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.

Answer

Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.

Answer

Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

Answer

Cloud NAT configured in the VPC.

Question 8

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

Accepted Answer

Create the subnet with primary range 10.0.2.0/24 and specify the secondary range at creation time.. Option A is correct because in Google Cloud VPC, a subnet can have both a primary IP range and one or more secondary IP ranges, and these secondary ranges must be specified at subnet creation time. For a Kubernetes cluster, the secondary range for pods is required, and it cannot be added after the subnet is created; it must be defined during the initial subnet creation.

Answer

Create the subnet with primary range 10.0.2.0/24 and then update it to add the secondary range.

Answer

Create two subnets: one with 10.0.2.0/24 for primary and another for the secondary range.

Answer

Create an auto mode subnet and let Google Cloud assign the secondary range automatically.

Question 9

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Accepted Answer

Assign an external IP address to the VM.. Option B is correct because a VM must have an external (public) IP address assigned to be directly reachable from the internet. Without an external IP, the VM cannot receive inbound traffic initiated from outside the VPC, even with proper firewall rules. This is a fundamental requirement for internet-facing workloads in Google Cloud.

Answer

Configure Cloud NAT for the VPC.

Answer

Enable Private Google Access on the subnet.

Answer

Assign a static internal IP address to the VM.

Question 10

A large enterprise is migrating to Google Cloud and needs to establish connectivity between on-premises and VPCs in two different regions (us-east1 and europe-west1). They have a single Partner Interconnect connection at a co-location facility in New York. They want to use the same interconnect for both regions. Which configuration should they use?

Accepted Answer

Create two VLAN attachments, one for each region, over the same interconnect. A is correct because a single Partner Interconnect connection can support multiple VLAN attachments, each associated with a different region. By creating two VLAN attachments over the same interconnect—one for us-east1 and one for europe-west1—the enterprise can route traffic from the on-premises network to both VPCs using the same physical link, leveraging Google Cloud's support for multiple VLAN attachments per interconnect.

Answer

Create one VLAN attachment and attach it to both VPCs

Answer

Use HA VPN over the interconnect to connect both regions

Answer

Create two Cloud VPN tunnels from on-prem to each VPC