PCNE Implementing a Virtual Private Cloud Practice Test 2 — 15 Questions

Question 1

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Accepted Answer

Set up VPC peering between the VPCs in each region.. Option A is correct because VPC peering allows direct, private IP connectivity between two VPCs using the AWS global network backbone, without traversing the public internet. This enables instances in different regions to communicate using internal IP addresses, provided the VPCs have non-overlapping CIDR blocks and appropriate route table entries are configured.

Answer

Create firewall rules allowing all traffic from the other region's subnet CIDR.

Answer

Configure instances to use external IP addresses for cross-region communication.

Answer

Use a shared VPC to connect both regions.

Question 2

Your company has a VPC with a single subnet in us-central1 (10.0.1.0/24). You have a managed instance group (MIG) of web servers (10.0.1.2-10.0.1.10) and a standalone database instance (10.0.1.100). The web servers need to communicate with the database on TCP port 3306. You have configured a firewall rule allowing ingress from 10.0.1.0/24 to 10.0.1.100 on tcp:3306. However, the web servers cannot connect to the database. You verified that the database is running and listening on port 3306, and that the web servers can ping the database. What should you do to resolve the issue?

Accepted Answer

Check the database instance's OS-level firewall (e.g., iptables) and ensure it allows traffic on port 3306 from the web servers.. The firewall rule is correctly configured at the VPC level to allow ingress from the web servers' subnet to the database on TCP port 3306. Since the web servers can ping the database, network connectivity exists, but the application-layer connection fails. This indicates the database instance's OS-level firewall (e.g., iptables on Linux) is blocking the port, as cloud VPC firewall rules and guest OS firewalls operate independently.

Answer

Create a custom route from the web servers to the database.

Answer

Add a network tag 'db' to the database instance and update the firewall rule to target 'db'.

Answer

Configure the firewall rule to use the database's service account as the target.

Question 3

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Question 4

Match each Cloud Router BGP attribute to its function.

Question 5

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

Accepted Answer

The subnet routes are exported from VPC-B to VPC-A.. Option D is correct because VPC Network Peering requires that subnet routes be exported from the peered VPC. By default, subnet routes are automatically exported, but if the peering configuration was modified (e.g., exportSubnetRoutesWithPublicIp set to false), routes may not be exported. The engineer should verify that VPC-B exports its subnet routes to VPC-A. Option A is incorrect because MTU mismatch is unlikely to cause complete lack of connectivity. Option B is incorrect because BGP is not used in VPC peering. Option C is incorrect because the route tables themselves are not the issue; the missing routes are due to export settings.

Answer

The BGP session status on the Cloud Router.

Answer

The MTU size of the instances.

Answer

The route tables for the peered network.

Question 6

A company wants to enable Private Google Access for an on-premises network connected via Cloud VPN. Which configuration step is required?

Accepted Answer

Enable Private Google Access on the VPC subnet that hosts the Cloud VPN gateway.. Option B is correct because Private Google Access must be enabled on the VPC subnet that hosts the Cloud VPN gateway. This allows on-premises hosts to use internal IPs to access Google APIs through the VPN tunnel. Option A is incorrect because a default route to the internet is not required; the traffic goes through the VPN. Option C is incorrect because Cloud NAT is for outbound internet from private instances, not for on-premises access. Option D is incorrect because VPC Flow Logs are for logging, not enabling access.

Answer

Enable VPC Flow Logs for the VPN tunnel.

Answer

Create a default route with next hop set to the internet gateway.

Answer

Configure a Cloud NAT gateway for the on-premises network.

Question 7

An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?

Accepted Answer

The firewall rules have a source or destination filter that excludes the new subnet's CIDR.. Option C is correct because firewall rules may include source or destination IP range filters. Even if tags match, if the rule also specifies a source or destination IP range that does not include 192.168.1.0/24, the rule will not apply. Option A is incorrect because firewall rules are scoped to the VPC, not to subnets, so tags work across subnets. Option B is incorrect because there is no such concept as firewall rule enforcement on subnets. Option D is incorrect because instances do not need to be recreated; changes to firewall rules apply immediately.

Answer

Firewall rules are scoped to a VPC, not to subnets.

Answer

The new subnet was created without enabling firewall rule enforcement.

Answer

The instances need to be recreated for the new rules to apply.

Question 8

A company wants to deploy a web application with a public-facing load balancer and a private backend. The backend instances must not have external IPs. Which statement about the VPC configuration is correct?

Accepted Answer

No additional configuration is required beyond creating the subnet.. Option D is correct because instances without external IPs can still receive traffic from a public load balancer. No additional configuration such as NAT or Private Google Access is needed for this purpose. Option A is incorrect because Private Google Access is for accessing Google APIs, not for load balancer traffic. Option B is incorrect because Cloud NAT provides outbound internet access, which is not required. Option C is incorrect because the backend subnet does not need a default route; traffic from the load balancer comes through the VPC internal routing.

Answer

Cloud NAT must be configured for the backend subnet.

Answer

The backend subnet must have a default route to the internet.

Answer

Private Google Access must be enabled on the backend subnet.

Question 9

An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?

Accepted Answer

The firewall rules in the VPC allowing incoming traffic from the on-premises CIDR.. Option C is correct because even with BGP routes, the VPC firewall rules must permit incoming traffic from the on-premises CIDR. If no appropriate ingress rule exists, traffic will be blocked. Option A is incorrect because MTU might cause packet loss but not complete failure. Option B is incorrect because advertised routes from the on-premises router are being learned (BGP is up). Option D is incorrect because the VPN gateway's external IP is necessary for the tunnel but not the immediate cause of connectivity failure.

Answer

The advertised route from the on-premises router is a default route.

Answer

The MTU size of the VPN tunnel.

Answer

The Cloud VPN gateway is assigned an external IP address.

Question 10

A company uses Shared VPC with a host project and multiple service projects. A service project administrator wants to create a VM with an internal IP from a specific subnet in the host project. The operation fails with a permission error. What is the most likely missing permission?

Accepted Answer

compute.subnetworks.use on the host project subnet.. Option D is correct because the service project needs the compute.subnetworks.use permission on the specific subnet in the host project. This permission is part of the roles/compute.networkUser role. Option A is incorrect because compute.networks.use is needed for using the VPC network, but the error is more specific to subnet use. Option B is incorrect because compute.instances.create is for creating instances, not for using a subnet. Option C is incorrect because resourcemanager.projects.get is not related to subnet usage.

Answer

resourcemanager.projects.get on the host project.

Answer

compute.instances.create on the service project.

Answer

compute.networks.use on the host project VPC.

Question 11

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

Accepted Answer

VPC Flow Logs. Option A is correct because VPC Flow Logs capture information about IP traffic going to and from network interfaces. They help diagnose packet drops and latency issues. Option B is incorrect because Cloud NAT logging provides logs about NAT connections. Option C is incorrect because Packet Mirroring is for capturing and inspecting traffic, not for logging. Option D is incorrect because Traffic Director is a service mesh control plane, not a traffic logging tool.

Answer

Cloud NAT logging

Answer

Packet Mirroring

Answer

Traffic Director

Question 12

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

Accepted Answer

No additional configuration is needed.. Option A is correct because enabling Private Google Access on the subnet allows instances without external IPs to access Google APIs via the automatically generated default route for the private Google access ranges. No additional configuration is needed. Option B is incorrect because an explicit default route to the internet would send traffic to the internet, not to Google APIs via private access. Option C is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.

Answer

A default route to the internet must be created.

Answer

A Cloud NAT must be configured.

Answer

The instances must have external IPs.

Question 13

Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?

Accepted Answer

Create a Private Service Connect service attachment and publish the service.. Option C is correct because the producer (VPC-A) must create a Private Service Connect service attachment that publishes the service. This attachment is associated with a load balancer or a service. Option A is incorrect because the endpoint is created in the consumer VPC (VPC-B). Option B is incorrect because VPC peering is not used with Private Service Connect (the services can be across organizations without peering). Option D is incorrect because Private Google Access is unrelated to publishing services.

Answer

Create a Private Service Connect endpoint in VPC-A.

Answer

Enable Private Google Access on the subnet where the service resides.

Answer

Create a VPC peering connection with VPC-B.

Question 14

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

Accepted Answer

Ingress rule with source IP range of the company's public IPs and allow tcp:443. Options C and E are correct because ingress rules with source IP ranges from known company IPs on the required ports (HTTP/HTTPS) restrict access appropriately. Option A is incorrect because it allows all traffic. Option B is incorrect because a source tag is not used to identify source IPs; tags are for target instances. Option D is incorrect because it uses destination IP range, which is not the correct way to restrict incoming traffic.

Answer

Ingress rule with source IP range 0.0.0.0/0 and allow tcp:80

Answer

Ingress rule with source tag 'web' and allow tcp:80

Answer

Ingress rule with destination IP range 0.0.0.0/0 and allow tcp:80

Question 15

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Accepted Answer

Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.. Options A, C, and D are correct. Option A: Cloud NAT supports both TCP and UDP. Option C: Cloud NAT requires a default route (0.0.0.0/0) to the internet gateway to function. Option D: Cloud NAT can be configured with a manual list of NAT IP addresses. Option B is incorrect because Cloud NAT provides NAT for instances without external IPs; it does not assign external IPs to instances. Option E is incorrect because Cloud NAT is regional, not per subnet; it applies to all subnets in the region that are configured to use it.

Answer

Cloud NAT can be configured per subnet or per region.

Answer

Cloud NAT automatically assigns external IP addresses to instances.