PCNE Implementing a Virtual Private Cloud Practice Test 2 — 15 Questions

Question 1

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall rules in the VPC are blocking ingress traffic from the on-premises network.. By default, the default VPC includes firewall rules that allow outbound traffic but restrict inbound traffic. Even though the Cloud VPN tunnel is established, the VPC firewall rules block ingress traffic from the on-premises network (e.g., ICMP for ping). To allow communication, a firewall rule must explicitly permit ingress traffic from the on-premises IP range or the remote tunnel IP.

Answer

The subnet IP range overlaps with the on-premises network.

Answer

The instance has IP forwarding disabled.

Answer

The default VPC does not have a default route to the internet.

Question 2

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Accepted Answer

Place both instances in the same VPC, using internal IP addresses.. Placing both Compute Engine instances in the same VPC and using internal IP addresses ensures traffic stays within Google's private network backbone, bypassing any external gateways or internet hops. This configuration leverages Google's internal routing with sub-millisecond latency between zones in the same region, as traffic is forwarded at the hypervisor level without encapsulation or additional network hops.

Answer

Use VPC Network Peering between two different VPCs.

Answer

Place instances in different VPCs and use a VPN between them.

Answer

Assign external IP addresses to both instances and communicate over the internet.

Question 3

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Accepted Answer

Private Google Access enabled on the subnet where the VPN gateway resides.. Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.

Answer

Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.

Answer

Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

Answer

Cloud NAT configured in the VPC.

Question 4

A financial services company is deploying a multi-tier application in a custom VPC with three subnets: web (10.0.1.0/24), app (10.0.2.0/24), and db (10.0.3.0/24). They use a Cloud VPN with dynamic routing (BGP) to connect to their on-premises data center (10.1.0.0/16). The on-premises network administrator reports that traffic from the web tier (10.0.1.0/24) to on-premises is working, but traffic from the app tier (10.0.2.0/24) to on-premises is failing. The company uses an Identity-Aware Proxy (IAP) for SSH access. The following configurations are in place:
- Cloud Router advertises all VPC subnets via BGP.
- On-premises router advertises 10.1.0.0/16.
- Firewall rules allow all traffic from 10.0.0.0/16 to 10.1.0.0/16.
- The app tier instances have a network tag 'app-tier' and a service account 'app-sa@project.iam.gserviceaccount.com'.
- There is a firewall rule with priority 1000 that denies egress from tags 'app-tier' to 10.1.0.0/16.
What is the most likely cause of the failure?

Accepted Answer

A firewall egress rule with priority 1000 denies traffic from instances with tag 'app-tier' to 10.1.0.0/16.. The firewall egress rule with priority 1000 explicitly denies traffic from instances tagged 'app-tier' to the on-premises network (10.1.0.0/16). Since firewall rules are evaluated in order of priority (lower numbers are higher priority), and this rule has a relatively low priority number, it will override any higher-numbered (lower priority) allow rules. The fact that web tier traffic works confirms that routing and VPN are functional, isolating the issue to the egress deny rule targeting the app tier.

Answer

The service account 'app-sa' does not have permissions to send traffic through the VPN.

Answer

IAP is blocking traffic from the app tier because it is not configured for that subnet.

Answer

The Cloud Router is not advertising the 10.0.2.0/24 subnet to on-premises.

Question 5

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

Accepted Answer

Move all resources to a single region, such as us-central1, and use a single VPC.. The latency issue stems from inter-region communication between the backend and Cloud SQL database. By moving all resources to a single region (us-central1), you eliminate cross-region traffic entirely, reducing latency to the minimum possible within that region. This is the most cost-effective solution as it avoids any additional networking costs and simplifies the architecture. While it may require a redesign of the MIGs, it directly addresses the root cause of high latency. Option B (Cloud VPN) adds a VPN tunnel over the Google backbone, which would introduce extra latency and cost without solving the underlying routing issue within the same VPC. Option C (VPC peering) is irrelevant since the resources are already in the same VPC. Option D (Cloud CDN) is designed for caching static content, not database queries, and would not reduce latency for dynamic database traffic.

Answer

Set up a Cloud VPN tunnel with Cloud Router and use BGP to advertise routes between the two regions.

Answer

Create a VPC peering connection between the frontend and backend VPCs.

Answer

Enable Cloud CDN on the backend load balancer to cache database responses.

Question 6

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Accepted Answer

Create firewall rules allowing all traffic from the other region's subnet CIDR.. In Google Cloud, a VPC is a global resource. Subnets are regional, but they all belong to the same VPC. Instances in different regions within the same VPC can communicate using internal IP addresses automatically over Google's global network, without needing VPC peering, VPN, or Dedicated Interconnect. The only requirement is that firewall rules permit the traffic. Therefore, the necessary action is to create firewall rules (Option C). Options A and B are for connecting separate VPCs, which is not the scenario here. Options D and E are incorrect because using external IPs would traverse the internet, and Shared VPC is for sharing subnets across projects, not for connecting regions.

Answer

Set up VPC peering between the VPCs in each region.

Answer

Set up Cloud VPN or Dedicated Interconnect between the two VPCs.

Answer

Configure instances to use external IP addresses for cross-region communication.

Answer

Use a shared VPC to connect both regions.

Question 7

Your company has a VPC with a single subnet in us-central1 (10.0.1.0/24). You have a managed instance group (MIG) of web servers (10.0.1.2-10.0.1.10) and a standalone database instance (10.0.1.100). The web servers need to communicate with the database on TCP port 3306. You have configured a firewall rule allowing ingress from 10.0.1.0/24 to 10.0.1.100 on tcp:3306. However, the web servers cannot connect to the database. You verified that the database is running and listening on port 3306, and that the web servers can ping the database. What should you do to resolve the issue?

Accepted Answer

Check the database instance's OS-level firewall (e.g., iptables) and ensure it allows traffic on port 3306 from the web servers.. The firewall rule is correctly configured at the VPC level to allow ingress from the web servers' subnet to the database on TCP port 3306. Since the web servers can ping the database, network connectivity exists, but the application-layer connection fails. This indicates the database instance's OS-level firewall (e.g., iptables on Linux) is blocking the port, as cloud VPC firewall rules and guest OS firewalls operate independently.

Answer

Create a custom route from the web servers to the database.

Answer

Add a network tag 'db' to the database instance and update the firewall rule to target 'db'.

Answer

Configure the firewall rule to use the database's service account as the target.

Question 8

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Accepted Answer

Create a Cloud Router in the region, then create a Cloud NAT gateway using that router, then assign static IP addresses to the NAT, then apply the NAT to the desired subnets, then test connectivity from a private instance.. Cloud NAT requires a Cloud Router first. Then create NAT, assign IPs, and apply to subnets. Testing confirms internet access.

Answer

Create a Cloud NAT gateway first, then create a Cloud Router, then assign IP addresses, then apply to subnets, then test connectivity.

Answer

Create a Cloud Router, then assign IP addresses to the NAT, then create the Cloud NAT, then apply to subnets, then test.

Answer

Create a Cloud Router, then create a Cloud NAT and apply it to subnets, then assign IP addresses, then test connectivity.

Question 9

Match each Cloud Router BGP attribute to its function.

Accepted Answer

ASN: The autonomous system number for the Cloud Router. The correct matches: ASN → local autonomous system number, BGP peer IP → on-premises router IP, Advertised route priority → MED value. Common confusions include swapping ASN with peer IP, and route priority with advertised IP ranges.

Answer

ASN: The IP address of the BGP peer on the on-premises side

Answer

BGP peer IP: The autonomous system number for the Cloud Router

Answer

Advertised route priority: The IP range advertised to the peer

Question 10

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

Accepted Answer

The subnet routes are exported from VPC-B to VPC-A.. VPC Network Peering requires that subnet routes be exported from the peered VPC. By default, subnet routes are automatically exported, but if the peering configuration was modified (e.g., exportSubnetRoutesWithPublicIp set to false), routes may not be exported. The engineer should verify that VPC-B exports its subnet routes to VPC-A. Option B is incorrect because BGP is not used in VPC peering; Cloud Router is used for Cloud VPN or Dedicated Interconnect, not peering. Option C is incorrect because MTU mismatch is unlikely to cause complete lack of connectivity. Option D is incorrect because the route tables themselves are not the issue; the missing routes are due to export settings, not the presence of route tables.

Answer

The BGP session status on the Cloud Router.

Answer

The MTU size of the instances.

Answer

The route tables for the peered network.

Question 11

A company wants to enable Private Google Access for an on-premises network connected via Cloud VPN. Which configuration step is required?

Accepted Answer

Enable Private Google Access on the VPC subnet that hosts the Cloud VPN gateway.. Private Google Access must be enabled on the VPC subnet that hosts the Cloud VPN gateway. This allows on-premises hosts to use internal IPs to access Google APIs through the VPN tunnel. Option B is incorrect because VPC Flow Logs are for logging, not enabling access. Option C is incorrect because a default route to the internet gateway is not required; traffic goes through the VPN. Option D is incorrect because Cloud NAT is for outbound internet from private instances, not for on-premises access.

Answer

Enable VPC Flow Logs for the VPN tunnel.

Answer

Create a default route with next hop set to the internet gateway.

Answer

Configure a Cloud NAT gateway for the on-premises network.

Question 12

An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?

Accepted Answer

The firewall rules have a source or destination filter that excludes the new subnet's CIDR.. In Google Cloud, firewall rules can include source or destination IP range filters. Even if target tags match, if the rule also specifies a source or destination range that does not include the new subnet's CIDR (192.168.1.0/24), the rule will not apply to instances in that subnet. Option A is incorrect because although firewall rules are scoped to the VPC, that does not explain the issue; the rules still apply to all subnets, but specific IP range filters can limit applicability. Option B is incorrect because there is no concept of 'firewall rule enforcement' on subnets. Option C is incorrect because firewall rule changes apply immediately; instances do not need to be recreated.

Answer

Firewall rules are scoped to a VPC, not to subnets.

Answer

The new subnet was created without enabling firewall rule enforcement.

Answer

The instances need to be recreated for the new rules to apply.

Question 13

A company wants to deploy a web application with a public-facing load balancer and a private backend. The backend instances must not have external IPs. Which statement about the VPC configuration is correct?

Accepted Answer

No additional configuration is required beyond creating the subnet.. Instances without external IPs can still receive traffic from a public load balancer. No additional configuration such as NAT or Private Google Access is needed. Option A is incorrect because Cloud NAT provides outbound internet access, not required for load balancer traffic. Option B is incorrect because the backend subnet does not need a default route to the internet; the load balancer uses internal routing. Option C is incorrect because Private Google Access is for accessing Google APIs, not for load balancer traffic.

Answer

Cloud NAT must be configured for the backend subnet.

Answer

The backend subnet must have a default route to the internet.

Answer

Private Google Access must be enabled on the backend subnet.

Question 14

An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?

Accepted Answer

The firewall rules in the VPC allowing incoming traffic from the on-premises CIDR.. The first thing to check is the VPC firewall rules because even if BGP routes are exchanged and the tunnel is up, traffic can be blocked by firewall rules if there is no ingress rule allowing traffic from the on-premises CIDR. The tunnel being established and BGP session up indicates Layer 3 connectivity, but Layer 4 filtering via firewall rules can still block traffic. Option A is incorrect: a default route advertised from on-premises is fine as long as the route is learned and points to the correct next hop. Option B is incorrect: MTU issues would typically cause fragmentation problems, not complete inability to reach instances. Option C is incorrect: the Cloud VPN gateway must have an external IP for the tunnel to be established; if it were missing, the tunnel wouldn't be up.

Answer

The advertised route from the on-premises router is a default route.

Answer

The MTU size of the VPN tunnel.

Answer

The Cloud VPN gateway is assigned an external IP address.

Question 15

A company uses Shared VPC with a host project and multiple service projects. A service project administrator wants to create a VM with an internal IP from a specific subnet in the host project. The operation fails with a permission error. What is the most likely missing permission?

Accepted Answer

compute.subnetworks.use on the host project subnet.. To create a VM in a service project using a subnet from the host project, the service project administrator needs the compute.subnetworks.use permission on that specific subnet. This permission is granted through the roles/compute.networkUser role. Option A is incorrect because resourcemanager.projects.get is not related to subnet usage. Option C is incorrect because compute.instances.create is for creating instances globally, but the missing permission is for using the subnet. Option D is incorrect because compute.networks.use is for using the VPC network, but the error is more specific to subnet use.

Answer

resourcemanager.projects.get on the host project.

Answer

compute.instances.create on the service project.

Answer

compute.networks.use on the host project VPC.