PCNE Timed Practice Test 4 — 10 Questions

Question 1

A company has a VPC with subnets in us-central1 and europe-west1. They create a Private Service Connect endpoint for a managed service in us-central1. Can Compute Engine instances in europe-west1 access the endpoint?

Accepted Answer

No, because the endpoint is only accessible from the same region.. Private Service Connect (PSC) endpoints are regional resources. An endpoint created in us-central1 is only accessible from Compute Engine instances within the same region (us-central1) of the VPC. Instances in europe-west1 cannot directly reach the endpoint because traffic would need to cross regional boundaries, which PSC does not support for producer endpoints. Option D correctly identifies this regional restriction.

Answer

Yes, if they use a global load balancer in front of the endpoint.

Answer

No, unless the VPC is peered with another VPC that contains the endpoint.

Answer

Yes, because the endpoint is accessible from any region in the VPC.

Question 2

A company has deployed a Global External Application Load Balancer with Premium Tier and enables Cloud CDN. Users in Europe report high latency, while users in the US have good performance. The backend is a regional NEG in us-west1. What is the most likely cause?

Accepted Answer

The origin server is sending 'Cache-Control: private' headers, preventing Cloud CDN from caching.. Option D is correct because Cloud CDN cannot cache responses that include a 'Cache-Control: private' header. This header instructs intermediate caches (including CDN nodes) not to store the response, forcing all requests to go to the origin server in us-west1. Users in Europe experience high latency because their requests must traverse the long distance to the US origin, while US users benefit from shorter paths. Enabling Cloud CDN alone does not guarantee caching; the origin must also allow caching by omitting 'private' or setting appropriate 'Cache-Control: public' and 'max-age' directives.

Answer

The load balancer is using Premium Tier, which routes to the nearest backend; the backend is only in us-west1.

Answer

Cloud CDN is not enabled on the load balancer.

Answer

The load balancer is using Standard Tier, which does not support global anycast.

Question 3

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

Accepted Answer

Use Cloud NAT to allow outbound internet access without public IPs. Cloud NAT enables outbound internet access for private VMs without assigning them public IP addresses, which reduces the attack surface. This is a secure alternative to direct internet access because it allows outbound connections initiated by the VMs while blocking unsolicited inbound traffic from the internet. It works by translating private IP addresses to a set of ephemeral public IPs managed by Google Cloud.

Answer

Assign public IP addresses to all VMs for direct internet access

Answer

Enable VPC Flow Logs to block malicious traffic

Question 4

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

Accepted Answer

Check if the external service is blocking the Cloud NAT IP addresses.. Option A is correct because Cloud NAT uses a set of public IP addresses for outbound traffic. If the external service has firewall rules or access control lists that block these specific IP addresses, the instances will be unable to reach it. Checking for IP-based blocking is a standard first step in troubleshooting connectivity issues through a NAT gateway.

Answer

Ensure that the VPC has a default route to the internet gateway.

Answer

Check the DNS resolution for the external service.

Question 5

A company is setting up a Dedicated Interconnect connection between their on-premises network and Google Cloud. They have configured a VLAN attachment and assigned a Cloud Router with BGP sessions. They notice that traffic is being dropped intermittently. The BGP session status shows 'Established' but routes are not being exchanged consistently. What is the most likely cause?

Accepted Answer

Bidirectional Forwarding Detection (BFD) is not enabled on the BGP session. When BFD is not enabled on a BGP session, the BGP keepalive timers (typically 60 seconds) are used to detect failures, which can cause intermittent traffic drops because BGP does not detect link failures quickly enough. With BFD enabled (default interval of 300ms), failures are detected in sub-seconds, preventing route flapping and ensuring consistent route exchange. The 'Established' BGP state with inconsistent route exchange is a classic symptom of BFD being absent, as routes may be withdrawn and re-advertised due to transient link issues that BGP alone cannot react to fast enough.

Answer

The on-premises firewall is blocking BGP port 179

Answer

The Cloud Router has reached the maximum number of routes

Answer

The MTU on the VLAN attachment is set too low

Question 6

A company needs to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have a service level agreement that requires 99.99% availability for the connection. What is the minimum number of VLAN attachments they must provision, and how should they be configured to meet this SLA?

Accepted Answer

Two VLAN attachments, each on a different Interconnect. To achieve 99.99% availability for Dedicated Interconnect, you must eliminate single points of failure. A single VLAN attachment on one Interconnect (Option A) provides no redundancy. Google Cloud requires at least two VLAN attachments, each on a different Interconnect (and ideally different edge availability domains), to meet this SLA. This ensures that if one Interconnect or VLAN attachment fails, traffic can fail over to the other, maintaining connectivity.

Answer

One VLAN attachment with a single Interconnect

Answer

Four VLAN attachments on two Interconnects

Answer

Two VLAN attachments on the same Interconnect

Question 7

A network engineer is troubleshooting a Cloud VPN tunnel that is not passing traffic. The tunnel status shows as established, and BGP sessions are up. However, traffic from an on-premises subnet (10.0.1.0/24) to a GCP subnet (192.168.1.0/24) is not working. What should the engineer check first?

Accepted Answer

Verify that the on-premises router is advertising the 10.0.1.0/24 prefix via BGP. Option A is correct because even though the VPN tunnel and BGP session are established, traffic may still fail if the on-premises router is not advertising the on-premises subnet (10.0.1.0/24) to GCP via BGP. Without this advertisement, GCP's Cloud Router has no route to reach that subnet, so return traffic from GCP to on-premises is dropped. The first step in troubleshooting is to verify that the on-premises BGP speaker is sending the correct prefix in its UPDATE messages.

Answer

Ensure that the Cloud Router is configured with the correct BGP ASN

Answer

Check that GCP has a static route for 10.0.1.0/24 pointing to the VPN tunnel

Answer

Check GCP firewall rules to allow ingress from 10.0.1.0/24

Question 8

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Accepted Answer

Set up VPC peering between the VPCs in each region.. Option A is correct because VPC peering allows direct, private IP connectivity between two VPCs using the AWS global network backbone, without traversing the public internet. This enables instances in different regions to communicate using internal IP addresses, provided the VPCs have non-overlapping CIDR blocks and appropriate route table entries are configured.

Answer

Create firewall rules allowing all traffic from the other region's subnet CIDR.

Answer

Configure instances to use external IP addresses for cross-region communication.

Answer

Use a shared VPC to connect both regions.

Question 9

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

Accepted Answer

Check Cloud NAT logs for port exhaustion. Option B is correct because Cloud NAT logs can reveal port exhaustion, which occurs when the NAT gateway runs out of available source ports for connections. Since all instances share the same NAT IP addresses, high connection counts from some instances can exhaust ports, preventing others from establishing new outbound connections. Checking these logs helps identify whether port exhaustion is the root cause of the connectivity issue.

Answer

Ensure Cloud NAT is enabled in each zone where instances are located

Answer

Verify that the instances have external IP addresses assigned

Answer

Review the health check configuration for the NAT gateway

Question 10

A network engineer is setting up Dedicated Interconnect and sees the output above. What does the 'encryption: IPSEC' field indicate about this VLAN attachment?

Accepted Answer

Traffic over this VLAN attachment is encrypted using IPsec. The 'encryption: IPSEC' field in the VLAN attachment output for Dedicated Interconnect indicates that traffic traversing this attachment is encrypted using IPsec. This is a feature of Google Cloud's Dedicated Interconnect that allows you to enable IPsec encryption on the VLAN attachment itself, providing confidentiality and integrity for data in transit without requiring a separate Cloud VPN tunnel.

Answer

The attachment is using Cloud VPN as the underlying transport

Answer

The attachment requires a Cloud VPN tunnel in addition to the Interconnect

Answer

The attachment is using MACsec encryption at layer 2