PCNE Implementing a Virtual Private Cloud — 15 Questions

Question 1

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

Accepted Answer

Use three separate VPCs for each tier and connect them using VPC peering.. Option B is correct because using three separate VPCs with VPC peering enforces strict network segmentation: the web tier VPC has a public subnet with an internet gateway, the application tier VPC is peered only to the web tier VPC (no internet gateway), and the database tier VPC is peered only to the application tier VPC (no public IPs). This design ensures that the database tier has no public IP addresses and is only reachable through the application tier, meeting all security requirements.

Answer

Use a Shared VPC with separate subnets in different projects for each tier.

Answer

Use a single VPC and connect the database tier via Cloud VPN to on-premises.

Answer

Use a single VPC with separate subnets for each tier and configure firewall rules to restrict traffic.

Question 2

An organization has a VPC with custom mode subnets in us-central1 and europe-west1. They create a VM instance in us-central1 with an internal IP 10.0.1.2 and a VM in europe-west1 with internal IP 10.0.2.2. They want to enable communication between these instances using internal IPs. What must be configured?

Accepted Answer

Ensure the VPC firewall rules allow ingress from the source subnet or instance.. Option A is correct because VPC firewall rules are stateful and must allow ingress traffic from the source subnet (10.0.1.0/24) or the specific source instance (10.0.1.2) to the destination VM in europe-west1. By default, VPCs have an implied deny-all ingress rule, so explicit firewall rules are required to permit traffic between subnets in different regions within the same VPC. The rule should specify the source IP range or tag and the destination protocol/port (e.g., ICMP, TCP/22) to enable communication.

Answer

Set up VPC peering between the two regions.

Answer

No additional configuration is needed because internal IPs are routable within the VPC.

Answer

Enable Cloud NAT for the VPC.

Question 3

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

Accepted Answer

Auto mode subnet. An auto mode subnet automatically creates subnets in each region and assigns IP address ranges from a predefined pool that can expand as you add more VM instances. This allows the subnet to grow without manual intervention, making it ideal for startups that need dynamic scaling.

Answer

Custom mode subnet

Answer

Dynamic subnet

Answer

Legacy network

Question 4

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

Accepted Answer

Create the subnet with primary range 10.0.2.0/24 and specify the secondary range at creation time.. Option A is correct because in Google Cloud VPC, a subnet can have both a primary IP range and one or more secondary IP ranges, and these secondary ranges must be specified at subnet creation time. For a Kubernetes cluster, the secondary range for pods is required, and it cannot be added after the subnet is created; it must be defined during the initial subnet creation.

Answer

Create the subnet with primary range 10.0.2.0/24 and then update it to add the secondary range.

Answer

Create two subnets: one with 10.0.2.0/24 for primary and another for the secondary range.

Answer

Create an auto mode subnet and let Google Cloud assign the secondary range automatically.

Question 5

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

Accepted Answer

Cloud Router. Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Answer

Cloud NAT

Answer

VPC peering

Answer

VPC Flow Logs

Question 6

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Accepted Answer

Assign an external IP address to the VM.. Option B is correct because a VM must have an external (public) IP address assigned to be directly reachable from the internet. Without an external IP, the VM cannot receive inbound traffic initiated from outside the VPC, even with proper firewall rules. This is a fundamental requirement for internet-facing workloads in Google Cloud.

Answer

Configure Cloud NAT for the VPC.

Answer

Enable Private Google Access on the subnet.

Answer

Assign a static internal IP address to the VM.

Question 7

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Accepted Answer

Service projects. A is correct because service projects in a Shared VPC architecture allow each project to host its own resources (e.g., Compute Engine instances) while maintaining separate firewall rules and security policies. This enables centralized network administration via the host project while giving each project autonomy over its own firewall configurations, meeting the requirement for multiple projects with independent firewall rules.

Answer

Cloud VPN

Answer

VPC peering

Question 8

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

Accepted Answer

Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.. Option A is correct because deploying two Cloud VPN tunnels from two Cloud Routers with BGP sessions provides high availability and automatic failover. The two Cloud Routers in different zones ensure redundancy, and BGP (Border Gateway Protocol) dynamically advertises routes and detects tunnel failures, allowing traffic to automatically switch to the healthy tunnel without manual intervention. This meets the requirement for an IPsec VPN connection to a third-party SaaS provider that only supports IPsec VPN.

Answer

Use Dedicated Interconnect with VLAN attachments to the SaaS provider.

Answer

Deploy a Classic VPN tunnel with policy-based routing.

Answer

Deploy a single Cloud VPN tunnel and use static routing.

Question 9

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

Accepted Answer

Deploy a global HTTP(S) Load Balancer with backend services in each region.. A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Answer

Use Cloud DNS with geo-routing to direct users to regional load balancers.

Answer

Set up Cloud NAT with multiple static IP addresses for each region.

Answer

Assign a global anycast IP address to all instances and use BGP to advertise it.

Question 10

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

Accepted Answer

The firewall rules in the VPC are blocking ingress traffic from the on-premises network.. Option D is correct because, by default, the default VPC includes firewall rules that allow outbound traffic but restrict inbound traffic. Even though the Cloud VPN tunnel is established, the VPC firewall rules block ingress traffic from the on-premises network (e.g., ICMP for ping). To allow communication, a firewall rule must explicitly permit ingress traffic from the on-premises IP range or the remote tunnel IP.

Answer

The subnet IP range overlaps with the on-premises network.

Answer

The instance has IP forwarding disabled.

Answer

The default VPC does not have a default route to the internet.

Question 11

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Accepted Answer

Place both instances in the same VPC, using internal IP addresses.. Option C is correct because placing both Compute Engine instances in the same VPC and using internal IP addresses ensures traffic stays within Google's private network backbone, bypassing any external gateways or internet hops. This configuration leverages Google's internal routing with sub-millisecond latency between zones in the same region, as traffic is forwarded at the hypervisor level without encapsulation or additional network hops.

Answer

Use VPC Network Peering between two different VPCs.

Answer

Place instances in different VPCs and use a VPN between them.

Answer

Assign external IP addresses to both instances and communicate over the internet.

Question 12

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Accepted Answer

Private Google Access enabled on the subnet where the VPN gateway resides.. Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.

Answer

Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.

Answer

Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

Answer

Cloud NAT configured in the VPC.

Question 13

A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which THREE conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?

Accepted Answer

The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.. Option B is correct because VPC firewall rules in Google Cloud are stateful and defined as ingress or egress rules. To block traffic from Subnet-A to Subnet-B, you need an ingress rule on Subnet-B (the destination) with the source set to Subnet-A's IP range and the destination set to Subnet-B's IP range. This ensures the rule applies to incoming traffic from Subnet-A, and the action 'deny' will drop the packets.

Answer

The rule must be applied using network tags on instances in Subnet-A.

Answer

The rule must also allow return traffic from Subnet-B to Subnet-A.

Question 14

A financial services company is deploying a multi-tier application in a custom VPC with three subnets: web (10.0.1.0/24), app (10.0.2.0/24), and db (10.0.3.0/24). They use a Cloud VPN with dynamic routing (BGP) to connect to their on-premises data center (10.1.0.0/16). The on-premises network administrator reports that traffic from the web tier (10.0.1.0/24) to on-premises is working, but traffic from the app tier (10.0.2.0/24) to on-premises is failing. The company uses an Identity-Aware Proxy (IAP) for SSH access. The following configurations are in place:
- Cloud Router advertises all VPC subnets via BGP.
- On-premises router advertises 10.1.0.0/16.
- Firewall rules allow all traffic from 10.0.0.0/16 to 10.1.0.0/16.
- The app tier instances have a network tag 'app-tier' and a service account 'app-sa@project.iam.gserviceaccount.com'.
- There is a firewall rule with priority 1000 that denies egress from tags 'app-tier' to 10.1.0.0/16.
What is the most likely cause of the failure?

Accepted Answer

A firewall egress rule with priority 1000 denies traffic from instances with tag 'app-tier' to 10.1.0.0/16.. Option C is correct because the firewall egress rule with priority 1000 explicitly denies traffic from instances tagged 'app-tier' to the on-premises network (10.1.0.0/16). Since firewall rules are evaluated in order of priority (lower numbers are higher priority), and this rule has a relatively low priority number, it will override any higher-numbered (lower priority) allow rules. The fact that web tier traffic works confirms that routing and VPN are functional, isolating the issue to the egress deny rule targeting the app tier.

Answer

The service account 'app-sa' does not have permissions to send traffic through the VPN.

Answer

IAP is blocking traffic from the app tier because it is not configured for that subnet.

Answer

The Cloud Router is not advertising the 10.0.2.0/24 subnet to on-premises.

Question 15

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

Accepted Answer

Set up a Cloud VPN tunnel with Cloud Router and use BGP to advertise routes between the two regions.. Option B is correct because Cloud VPN with Cloud Router and BGP enables dynamic route advertisement between the two regions, allowing traffic between the backend instances in us-west1 and the Cloud SQL database in us-central1 to traverse Google's global network with optimal routing. This minimizes latency by using Google's internal backbone rather than the public internet, and it is cost-effective because Cloud VPN charges only for the tunnel hours and egress traffic, with no per-GB data transfer costs for inter-region traffic within the same VPC.

Answer

Move all resources to a single region, such as us-central1, and use a single VPC.

Answer

Create a VPC peering connection between the frontend and backend VPCs.

Answer

Enable Cloud CDN on the backend load balancer to cache database responses.