PCNE Implementing a Virtual Private Cloud — 50 Questions

Question 1

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use three separate VPCs for each tier and connect them using VPC peering.. Using three separate VPCs with VPC peering enforces strict network segmentation: the web tier VPC has a public subnet with an internet gateway, the application tier VPC is peered only to the web tier VPC (no internet gateway), and the database tier VPC is peered only to the application tier VPC (no public IPs). This design ensures that the database tier has no public IP addresses and is only reachable through the application tier, meeting all security requirements.

Answer

Use a Shared VPC with separate subnets in different projects for each tier.

Answer

Use a single VPC and connect the database tier via Cloud VPN to on-premises.

Answer

Use a single VPC with separate subnets for each tier and configure firewall rules to restrict traffic.

Question 2

An organization has a VPC with custom mode subnets in us-central1 and europe-west1. They create a VM instance in us-central1 with an internal IP 10.0.1.2 and a VM in europe-west1 with internal IP 10.0.2.2. They want to enable communication between these instances using internal IPs. What must be configured?

Accepted Answer

Ensure the VPC firewall rules allow ingress from the source subnet or instance.. VPC firewall rules are stateful and must allow ingress traffic from the source subnet (10.0.1.0/24) or the specific source instance (10.0.1.2) to the destination VM in europe-west1. In a custom VPC, there are no default firewall rules that automatically allow internal traffic between subnets, even within the same VPC. Therefore, explicit ingress firewall rules are required to permit traffic between subnets in different regions. The rule should specify the source IP range or tag and the destination protocol/port (e.g., ICMP, TCP/22) to enable communication.

Answer

Set up VPC peering between the two regions.

Answer

No additional configuration is needed because internal IPs are routable within the VPC.

Answer

Enable Cloud NAT for the VPC.

Question 3

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

Accepted Answer

Auto mode subnet. An auto mode subnet automatically creates subnets in each region and assigns IP address ranges from a predefined pool that can expand as you add more VM instances. This allows the subnet to grow without manual intervention, making it ideal for startups that need dynamic scaling.

Answer

Custom mode subnet

Answer

Dynamic subnet

Answer

Legacy network

Question 4

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

Accepted Answer

Create the subnet with primary range 10.0.2.0/24 and specify the secondary range at creation time.. In Google Cloud VPC, a subnet can have both a primary IP range and one or more secondary IP ranges, and these secondary ranges must be specified at subnet creation time. For a Kubernetes cluster, the secondary range for pods is required, and it cannot be added after the subnet is created; it must be defined during the initial subnet creation.

Answer

Create the subnet with primary range 10.0.2.0/24 and then update it to add the secondary range.

Answer

Create two subnets: one with 10.0.2.0/24 for primary and another for the secondary range.

Answer

Create an auto mode subnet and let Google Cloud assign the secondary range automatically.

Question 5

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

Accepted Answer

The firewall rules in the VPC are blocking ingress traffic from the on-premises network.. By default, the default VPC includes firewall rules that allow outbound traffic but restrict inbound traffic. Even though the Cloud VPN tunnel is established, the VPC firewall rules block ingress traffic from the on-premises network (e.g., ICMP for ping). To allow communication, a firewall rule must explicitly permit ingress traffic from the on-premises IP range or the remote tunnel IP.

Answer

The subnet IP range overlaps with the on-premises network.

Answer

The instance has IP forwarding disabled.

Answer

The default VPC does not have a default route to the internet.

Question 6

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Accepted Answer

Place both instances in the same VPC, using internal IP addresses.. Placing both Compute Engine instances in the same VPC and using internal IP addresses ensures traffic stays within Google's private network backbone, bypassing any external gateways or internet hops. This configuration leverages Google's internal routing with sub-millisecond latency between zones in the same region, as traffic is forwarded at the hypervisor level without encapsulation or additional network hops.

Answer

Use VPC Network Peering between two different VPCs.

Answer

Place instances in different VPCs and use a VPN between them.

Answer

Assign external IP addresses to both instances and communicate over the internet.

Question 7

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Accepted Answer

Private Google Access enabled on the subnet where the VPN gateway resides.. Option B is correct because Private Google Access must be enabled on the subnet where the Cloud VPN gateway (or the resources initiating traffic) resides, so that VMs and on-premises hosts reaching Google APIs via that subnet can use private IP addresses instead of external IPs. Option E is correct because on-premises hosts need a custom route in the VPC directing traffic for the restricted Google APIs VIP ranges 199.36.153.4/30 and 199.36.153.8/30 (used by private.googleapis.com and restricted.googleapis.com) through the VPN tunnel, so that API requests are routed over the private connection. Option A is not required because Private Google Access does not depend on a Cloud DNS forwarding zone to public DNS; name resolution can use the standard Google DNS names or private DNS zones. Option C is not required because a firewall rule allowing ingress from on-premises to 0.0.0.0/0 is overly broad and not the mechanism that enables private API access. Option D is not required because Cloud NAT provides outbound internet access for resources without external IPs, which is unnecessary when using Private Google Access over VPN.

Answer

Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.

Answer

Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

Answer

Cloud NAT configured in the VPC.

Question 8

A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which TWO conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?

Accepted Answer

The rule must have action set to 'deny' and apply to all instances in Subnet-B.. Ingress firewall rules in Google Cloud VPC do not have a 'destination' field; the destination is implicitly the instances to which the rule applies (via target tags or service accounts). To block traffic from Subnet-A to Subnet-B, you need an ingress rule on Subnet-B with source set to Subnet-A's IP range, action set to 'deny', and it must apply to all instances in Subnet-B (Option C). Additionally, the rule must have a lower priority number (higher priority) than any allow rules that would otherwise permit the traffic (Option E). Options A and D are not required.

Answer

The rule must be applied using network tags on instances in Subnet-A.

Answer

The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.

Answer

The rule must also allow return traffic from Subnet-B to Subnet-A.

Question 9

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

Accepted Answer

Move all resources to a single region, such as us-central1, and use a single VPC.. The latency issue stems from inter-region communication between the backend and Cloud SQL database. By moving all resources to a single region (us-central1), you eliminate cross-region traffic entirely, reducing latency to the minimum possible within that region. This is the most cost-effective solution as it avoids any additional networking costs and simplifies the architecture. While it may require a redesign of the MIGs, it directly addresses the root cause of high latency. Option B (Cloud VPN) adds a VPN tunnel over the Google backbone, which would introduce extra latency and cost without solving the underlying routing issue within the same VPC. Option C (VPC peering) is irrelevant since the resources are already in the same VPC. Option D (Cloud CDN) is designed for caching static content, not database queries, and would not reduce latency for dynamic database traffic.

Answer

Set up a Cloud VPN tunnel with Cloud Router and use BGP to advertise routes between the two regions.

Answer

Create a VPC peering connection between the frontend and backend VPCs.

Answer

Enable Cloud CDN on the backend load balancer to cache database responses.

Question 10

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Accepted Answer

Create firewall rules allowing all traffic from the other region's subnet CIDR.. In Google Cloud, a VPC is a global resource. Subnets are regional, but they all belong to the same VPC. Instances in different regions within the same VPC can communicate using internal IP addresses automatically over Google's global network, without needing VPC peering, VPN, or Dedicated Interconnect. The only requirement is that firewall rules permit the traffic. Therefore, the necessary action is to create firewall rules (Option C). Options A and B are for connecting separate VPCs, which is not the scenario here. Options D and E are incorrect because using external IPs would traverse the internet, and Shared VPC is for sharing subnets across projects, not for connecting regions.

Answer

Set up VPC peering between the VPCs in each region.

Answer

Set up Cloud VPN or Dedicated Interconnect between the two VPCs.

Answer

Configure instances to use external IP addresses for cross-region communication.

Answer

Use a shared VPC to connect both regions.

Question 11

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Accepted Answer

Create a Cloud Router in the region, then create a Cloud NAT gateway using that router, then assign static IP addresses to the NAT, then apply the NAT to the desired subnets, then test connectivity from a private instance.. Cloud NAT requires a Cloud Router first. Then create NAT, assign IPs, and apply to subnets. Testing confirms internet access.

Answer

Create a Cloud NAT gateway first, then create a Cloud Router, then assign IP addresses, then apply to subnets, then test connectivity.

Answer

Create a Cloud Router, then assign IP addresses to the NAT, then create the Cloud NAT, then apply to subnets, then test.

Answer

Create a Cloud Router, then create a Cloud NAT and apply it to subnets, then assign IP addresses, then test connectivity.

Question 12

Match each Cloud Router BGP attribute to its function.

Accepted Answer

ASN: The autonomous system number for the Cloud Router. The correct matches: ASN → local autonomous system number, BGP peer IP → on-premises router IP, Advertised route priority → MED value. Common confusions include swapping ASN with peer IP, and route priority with advertised IP ranges.

Answer

ASN: The IP address of the BGP peer on the on-premises side

Answer

BGP peer IP: The autonomous system number for the Cloud Router

Answer

Advertised route priority: The IP range advertised to the peer

Question 13

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

Accepted Answer

The subnet routes are exported from VPC-B to VPC-A.. In Google Cloud VPC Network Peering, routes are exchanged between peered networks. For instances in VPC-A to reach VPC-B, VPC-A must have routes to VPC-B's subnets. The option 'The subnet routes are exported from VPC-B to VPC-A' refers to the export of routes from VPC-B to VPC-A, which is necessary. By default, VPC peering does not export routes unless configured. The engineer should check if the subnet routes are being exported from VPC-B to VPC-A.

Answer

The BGP session status on the Cloud Router.

Answer

The MTU size of the instances.

Answer

The route tables for the peered network.

Question 14

A company wants to enable Private Google Access for an on-premises network connected via Cloud VPN. Which configuration step is required?

Accepted Answer

Enable Private Google Access on the VPC subnet that hosts the Cloud VPN gateway.. Private Google Access must be enabled on the VPC subnet that hosts the Cloud VPN gateway. This allows on-premises hosts to use internal IPs to access Google APIs through the VPN tunnel. Option B is incorrect because VPC Flow Logs are for logging, not enabling access. Option C is incorrect because a default route to the internet gateway is not required; traffic goes through the VPN. Option D is incorrect because Cloud NAT is for outbound internet from private instances, not for on-premises access.

Answer

Enable VPC Flow Logs for the VPN tunnel.

Answer

Create a default route with next hop set to the internet gateway.

Answer

Configure a Cloud NAT gateway for the on-premises network.

Question 15

A company wants to deploy a web application with a public-facing load balancer and a private backend. The backend instances must not have external IPs. Which statement about the VPC configuration is correct?

Accepted Answer

No additional configuration is required beyond creating the subnet.. A VPC subnet, by default, provides internal connectivity for instances without external IPs, and a public-facing load balancer can forward traffic to private backends without any special subnet configuration. The backend instances simply need to be reachable from the load balancer, which happens automatically within the VPC; no NAT, default route, or Private Google Access is required for the load balancer to reach them.

Answer

Cloud NAT must be configured for the backend subnet.

Answer

The backend subnet must have a default route to the internet.

Answer

Private Google Access must be enabled on the backend subnet.

Question 16

An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?

Accepted Answer

The firewall rules in the VPC allowing incoming traffic from the on-premises CIDR.. With Cloud VPN and BGP, the tunnel being up and the BGP session established only confirms control-plane connectivity. The most common cause of data-plane failure where on-prem hosts cannot reach VPC instances is that VPC firewall rules do not permit ingress from the on-premises CIDR range. GCP firewall rules are stateful and default-deny ingress, so even with valid routes and an active tunnel, traffic is dropped unless an allow rule explicitly matches the source range and protocol.

Answer

The advertised route from the on-premises router is a default route.

Answer

The MTU size of the VPN tunnel.

Answer

The Cloud VPN gateway is assigned an external IP address.

Question 17

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

Accepted Answer

Ingress rule with source IP range of the company's public IPs and allow tcp:443. Options A and C are correct because both restrict ingress to the company's known public IP ranges, which is exactly the requirement to allow only traffic from trusted source addresses. Option A permits HTTPS traffic on tcp:443 from those public IPs, and Option C permits HTTP traffic on tcp:80 from those same public IPs, so together they enforce source-based filtering for web access. Option B is wrong because 0.0.0.0/0 allows traffic from any IPv4 address, which violates the restriction to known IP ranges. Option D is wrong because a source tag identifies instances within the VPC rather than external known public IP ranges, so it does not meet the stated requirement. Option E is wrong because firewall ingress rules are evaluated on source, not destination, and 0.0.0.0/0 as a destination would not restrict access to the company's known IPs.

Answer

Ingress rule with source IP range 0.0.0.0/0 and allow tcp:80

Answer

Ingress rule with source tag 'web' and allow tcp:80

Answer

Ingress rule with destination IP range 0.0.0.0/0 and allow tcp:80

Question 18

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Accepted Answer

Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.. Option B is correct because Cloud NAT requires a route in the VPC that directs traffic destined for 0.0.0.0/0 to the default internet gateway, so that packets from private instances can be sent toward the NAT gateway for translation. Option D is correct because Cloud NAT lets you choose between automatic NAT IP allocation or manually specifying a list of external IP addresses to use for NAT, which is useful for allowlisting or predictable egress. Option E is correct because Cloud NAT supports TCP and UDP (and ICMP for some use cases), so it can translate common connectionless and connection-oriented traffic from private instances. Option A is not correct because Cloud NAT is a regional resource configured at the region level and associated with a Cloud Router, not configured per subnet. Option C is not correct because Cloud NAT does not assign external IP addresses to the instances themselves; it performs source NAT so the instances keep only their private IPs while the NAT gateway uses its own external IPs.

Answer

Cloud NAT can be configured per subnet or per region.

Answer

Cloud NAT automatically assigns external IP addresses to instances.

Question 19

A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?

Accepted Answer

The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.. A custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface is required to force traffic to go through that specific tunnel. Option B is incorrect because Cloud NAT is for outbound internet access, not routing to on-premises. Option C is incorrect because firewall rules control access but not routing. Option D is incorrect because on-premises BGP advertisement is for routes from on-premises to Google Cloud, not for directing traffic within Google Cloud.

Answer

Cloud NAT is enabled.

Answer

Firewall rules allow ingress from on-premises IPs.

Answer

The on-premises router is advertising the route via BGP.

Question 20

An organization uses Shared VPC with multiple service projects. They want to ensure that only certain service projects can use a specific subnet. How can this be achieved?

Accepted Answer

Use IAM roles on the subnet to grant access to specific service projects.. In Google Cloud, Shared VPC allows sharing subnets across projects. To restrict which service projects can use a specific subnet, you use IAM roles on the subnet. By granting the 'compute.networkUser' role to specific service projects (or their service accounts) on the subnet, only those projects can use it. This is the standard method for fine-grained access control.

Answer

Use VPC subnet secondary IP ranges.

Answer

Use VPC Network Tags on the VM instances.

Answer

Use VPC firewall rules with service accounts to restrict access.