PCNE Implementing a Virtual Private Cloud — 20 Questions

Question 1

An organization has a VPC with custom mode subnets in us-central1 and europe-west1. They create a VM instance in us-central1 with an internal IP 10.0.1.2 and a VM in europe-west1 with internal IP 10.0.2.2. They want to enable communication between these instances using internal IPs. What must be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the VPC firewall rules allow ingress from the source subnet or instance.. VPC firewall rules are stateful and must allow ingress traffic from the source subnet (10.0.1.0/24) or the specific source instance (10.0.1.2) to the destination VM in europe-west1. In a custom VPC, there are no default firewall rules that automatically allow internal traffic between subnets, even within the same VPC. Therefore, explicit ingress firewall rules are required to permit traffic between subnets in different regions. The rule should specify the source IP range or tag and the destination protocol/port (e.g., ICMP, TCP/22) to enable communication.

Answer

Set up VPC peering between the two regions.

Answer

No additional configuration is needed because internal IPs are routable within the VPC.

Answer

Enable Cloud NAT for the VPC.

Question 2

A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which TWO conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?

Accepted Answer

The rule must have action set to 'deny' and apply to all instances in Subnet-B.. Ingress firewall rules in Google Cloud VPC do not have a 'destination' field; the destination is implicitly the instances to which the rule applies (via target tags or service accounts). To block traffic from Subnet-A to Subnet-B, you need an ingress rule on Subnet-B with source set to Subnet-A's IP range, action set to 'deny', and it must apply to all instances in Subnet-B (Option C). Additionally, the rule must have a lower priority number (higher priority) than any allow rules that would otherwise permit the traffic (Option E). Options A and D are not required.

Answer

The rule must be applied using network tags on instances in Subnet-A.

Answer

The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.

Answer

The rule must also allow return traffic from Subnet-B to Subnet-A.

Question 3

A developer needs to allow a VM in subnet A to reach a VM in subnet B in the same VPC. What is the default behavior?

Accepted Answer

The default firewall rule allows all internal traffic within the VPC.. Within a VPC, subnets can communicate by default using internal IP addresses. The VPC has an implied firewall rule that allows traffic between all instances using internal IPs, so no additional routes or firewall rules are needed. Therefore, option C is correct. Option A is incorrect because custom routes are not required for internal subnet traffic; the VPC automatically handles routing. Option B is incorrect because the default firewall rule already allows internal traffic. Option D is incorrect because VPC peering is for connecting separate VPCs, not for communication within the same VPC.

Answer

A custom route must be added to route between subnets.

Answer

A firewall rule must be added to allow traffic between subnets.

Answer

VPC peering is required for communication between subnets.

Question 4

An organization uses Shared VPC with multiple service projects. They want to ensure that only certain service projects can use a specific subnet. How can this be achieved?

Accepted Answer

Use IAM roles on the subnet to grant access to specific service projects.. Shared VPC subnet-level IAM allows granting access to specific service projects. Option A is incorrect because secondary IP ranges are used for IP address management, not for controlling project access. Option C is incorrect because network tags are primarily used for firewall rules, not subnet permissions. Option D is incorrect because firewall rules with service accounts control traffic flow, not which service projects can use a subnet.

Answer

Use VPC subnet secondary IP ranges.

Answer

Use VPC Network Tags on the VM instances.

Answer

Use VPC firewall rules with service accounts to restrict access.

Question 5

Which TWO of the following are required to enable Private Google Access for a subnet?

Accepted Answer

Enable Private Google Access on the subnet.. To enable Private Google Access, you must enable the setting on the subnet (option B) and have a default route with next-hop internet gateway (option D) for traffic to Google APIs. Option A is incorrect because private services access is for Google managed services like Cloud SQL. Option C is incorrect because Cloud NAT is not required. Option E is incorrect because VPC flow logs are optional.

Answer

Create a private services access connection.

Answer

Create a Cloud NAT.

Answer

Enable VPC flow logs.

Question 6

A company is designing a multi-region architecture with Active/Active failover across two regions using Cloud VPN. They want to ensure that traffic from on-premises to a global external HTTPS load balancer is routed to the nearest region based on latency. What should they configure on the on-premises side?

Accepted Answer

Local preference on the on-premises router.. To direct traffic from on-premises to the nearest region based on latency, the on-premises routers should use BGP local preference to prefer the path with lower latency. Local preference is an attribute set on the on-premises router to influence outbound traffic selection; a higher local preference is preferred. Option A is correct. Option D is wrong because AS Path prepending is applied by the route advertiser (Google Cloud) to make a path appear longer, not by the on-premises routers. The on-premises routers receive routes and can influence their selection using local preference, not AS Path prepending.

Answer

Multi-Exit Discriminator (MED) on the Google Cloud side.

Answer

Static routes pointing to the VPC subnet in each region.

Answer

BGP AS Path prepending to make one path appear longer.

Question 7

A company is planning to migrate its on-premises workloads to Google Cloud. They have a few dedicated servers that need to be reachable from the internet via specific public IPs. Which TWO options should they consider to assign static public IP addresses to their Compute Engine instances? (Choose 2.)

Accepted Answer

Promote an existing ephemeral external IP address to static.. To assign a static public IP address to a Compute Engine instance, you can either promote an existing ephemeral external IP to static (Option A) or reserve a new static external IP address and then assign it to the instance's network interface (Option B). Option C is incorrect because internal IP addresses are not directly accessible from the internet. Option D is incorrect because Cloud NAT is used for outbound internet access, not for assigning static public IPs for inbound traffic. Option E is incorrect because an instance's internal IP cannot be used as a public IP via VPC firewall configuration.

Answer

Assign a static internal IP address and use it as the public IP via DNS.

Answer

Configure Cloud NAT to assign a static IP for inbound traffic.

Answer

Use the instance's internal IP address as the public IP by configuring the VPC firewall.

Question 8

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

Accepted Answer

Use three separate VPCs for each tier and connect them using VPC peering.. Using three separate VPCs with VPC peering enforces strict network segmentation: the web tier VPC has a public subnet with an internet gateway, the application tier VPC is peered only to the web tier VPC (no internet gateway), and the database tier VPC is peered only to the application tier VPC (no public IPs). This design ensures that the database tier has no public IP addresses and is only reachable through the application tier, meeting all security requirements.

Answer

Use a Shared VPC with separate subnets in different projects for each tier.

Answer

Use a single VPC and connect the database tier via Cloud VPN to on-premises.

Answer

Use a single VPC with separate subnets for each tier and configure firewall rules to restrict traffic.

Question 9

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

Accepted Answer

Auto mode subnet. An auto mode subnet automatically creates subnets in each region and assigns IP address ranges from a predefined pool that can expand as you add more VM instances. This allows the subnet to grow without manual intervention, making it ideal for startups that need dynamic scaling.

Answer

Custom mode subnet

Answer

Dynamic subnet

Answer

Legacy network

Question 10

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

Accepted Answer

Create the subnet with primary range 10.0.2.0/24 and specify the secondary range at creation time.. In Google Cloud VPC, a subnet can have both a primary IP range and one or more secondary IP ranges, and these secondary ranges must be specified at subnet creation time. For a Kubernetes cluster, the secondary range for pods is required, and it cannot be added after the subnet is created; it must be defined during the initial subnet creation.

Answer

Create the subnet with primary range 10.0.2.0/24 and then update it to add the secondary range.

Answer

Create two subnets: one with 10.0.2.0/24 for primary and another for the secondary range.

Answer

Create an auto mode subnet and let Google Cloud assign the secondary range automatically.

Question 11

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

Accepted Answer

Cloud Router. Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Answer

Cloud NAT

Answer

VPC peering

Answer

VPC Flow Logs

Question 12

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Accepted Answer

Assign an external IP address to the VM.. A VM must have an external (public) IP address assigned to be directly reachable from the internet. Without an external IP, the VM cannot receive inbound traffic initiated from outside the VPC, even with proper firewall rules. This is a fundamental requirement for internet-facing workloads in Google Cloud.

Answer

Configure Cloud NAT for the VPC.

Answer

Enable Private Google Access on the subnet.

Answer

Assign a static internal IP address to the VM.

Question 13

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Accepted Answer

Service projects. A is correct because service projects in a Shared VPC architecture allow each project to host its own resources (e.g., Compute Engine instances) while maintaining separate firewall rules and security policies. This enables centralized network administration via the host project while giving each project autonomy over its own firewall configurations, meeting the requirement for multiple projects with independent firewall rules.

Answer

Cloud VPN

Answer

VPC peering

Question 14

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

Accepted Answer

Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.. Deploying two Cloud VPN tunnels from two Cloud Routers with BGP sessions provides high availability and automatic failover. The two Cloud Routers in different zones ensure redundancy, and BGP (Border Gateway Protocol) dynamically advertises routes and detects tunnel failures, allowing traffic to automatically switch to the healthy tunnel without manual intervention. This meets the requirement for an IPsec VPN connection to a third-party SaaS provider that only supports IPsec VPN.

Answer

Use Dedicated Interconnect with VLAN attachments to the SaaS provider.

Answer

Deploy a Classic VPN tunnel with policy-based routing.

Answer

Deploy a single Cloud VPN tunnel and use static routing.

Question 15

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

Accepted Answer

Deploy a global HTTP(S) Load Balancer with backend services in each region.. A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Answer

Use Cloud DNS with geo-routing to direct users to regional load balancers.

Answer

Set up Cloud NAT with multiple static IP addresses for each region.

Answer

Assign a global anycast IP address to all instances and use BGP to advertise it.

Question 16

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

Accepted Answer

The firewall rules in the VPC are blocking ingress traffic from the on-premises network.. By default, the default VPC includes firewall rules that allow outbound traffic but restrict inbound traffic. Even though the Cloud VPN tunnel is established, the VPC firewall rules block ingress traffic from the on-premises network (e.g., ICMP for ping). To allow communication, a firewall rule must explicitly permit ingress traffic from the on-premises IP range or the remote tunnel IP.

Answer

The subnet IP range overlaps with the on-premises network.

Answer

The instance has IP forwarding disabled.

Answer

The default VPC does not have a default route to the internet.

Question 17

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Accepted Answer

Place both instances in the same VPC, using internal IP addresses.. Placing both Compute Engine instances in the same VPC and using internal IP addresses ensures traffic stays within Google's private network backbone, bypassing any external gateways or internet hops. This configuration leverages Google's internal routing with sub-millisecond latency between zones in the same region, as traffic is forwarded at the hypervisor level without encapsulation or additional network hops.

Answer

Use VPC Network Peering between two different VPCs.

Answer

Place instances in different VPCs and use a VPN between them.

Answer

Assign external IP addresses to both instances and communicate over the internet.

Question 18

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Accepted Answer

Private Google Access enabled on the subnet where the VPN gateway resides.. Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.

Answer

Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.

Answer

Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

Answer

Cloud NAT configured in the VPC.

Question 19

A financial services company is deploying a multi-tier application in a custom VPC with three subnets: web (10.0.1.0/24), app (10.0.2.0/24), and db (10.0.3.0/24). They use a Cloud VPN with dynamic routing (BGP) to connect to their on-premises data center (10.1.0.0/16). The on-premises network administrator reports that traffic from the web tier (10.0.1.0/24) to on-premises is working, but traffic from the app tier (10.0.2.0/24) to on-premises is failing. The company uses an Identity-Aware Proxy (IAP) for SSH access. The following configurations are in place:
- Cloud Router advertises all VPC subnets via BGP.
- On-premises router advertises 10.1.0.0/16.
- Firewall rules allow all traffic from 10.0.0.0/16 to 10.1.0.0/16.
- The app tier instances have a network tag 'app-tier' and a service account 'app-sa@project.iam.gserviceaccount.com'.
- There is a firewall rule with priority 1000 that denies egress from tags 'app-tier' to 10.1.0.0/16.
What is the most likely cause of the failure?

Accepted Answer

A firewall egress rule with priority 1000 denies traffic from instances with tag 'app-tier' to 10.1.0.0/16.. The firewall egress rule with priority 1000 explicitly denies traffic from instances tagged 'app-tier' to the on-premises network (10.1.0.0/16). Since firewall rules are evaluated in order of priority (lower numbers are higher priority), and this rule has a relatively low priority number, it will override any higher-numbered (lower priority) allow rules. The fact that web tier traffic works confirms that routing and VPN are functional, isolating the issue to the egress deny rule targeting the app tier.

Answer

The service account 'app-sa' does not have permissions to send traffic through the VPN.

Answer

IAP is blocking traffic from the app tier because it is not configured for that subnet.

Answer

The Cloud Router is not advertising the 10.0.2.0/24 subnet to on-premises.

Question 20

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

Accepted Answer

Move all resources to a single region, such as us-central1, and use a single VPC.. The latency issue stems from inter-region communication between the backend and Cloud SQL database. By moving all resources to a single region (us-central1), you eliminate cross-region traffic entirely, reducing latency to the minimum possible within that region. This is the most cost-effective solution as it avoids any additional networking costs and simplifies the architecture. While it may require a redesign of the MIGs, it directly addresses the root cause of high latency. Option B (Cloud VPN) adds a VPN tunnel over the Google backbone, which would introduce extra latency and cost without solving the underlying routing issue within the same VPC. Option C (VPC peering) is irrelevant since the resources are already in the same VPC. Option D (Cloud CDN) is designed for caching static content, not database queries, and would not reduce latency for dynamic database traffic.

Answer

Set up a Cloud VPN tunnel with Cloud Router and use BGP to advertise routes between the two regions.

Answer

Create a VPC peering connection between the frontend and backend VPCs.

Answer

Enable Cloud CDN on the backend load balancer to cache database responses.