PCNE Implementing a Virtual Private Cloud Practice Test 2 — 15 Questions

Question 1

An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall rules in the VPC allowing incoming traffic from the on-premises CIDR.. With Cloud VPN and BGP, the tunnel being up and the BGP session established only confirms control-plane connectivity. The most common cause of data-plane failure where on-prem hosts cannot reach VPC instances is that VPC firewall rules do not permit ingress from the on-premises CIDR range. GCP firewall rules are stateful and default-deny ingress, so even with valid routes and an active tunnel, traffic is dropped unless an allow rule explicitly matches the source range and protocol.

Answer

The advertised route from the on-premises router is a default route.

Answer

The MTU size of the VPN tunnel.

Answer

The Cloud VPN gateway is assigned an external IP address.

Question 2

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

Accepted Answer

Ingress rule with source IP range of the company's public IPs and allow tcp:443. Options A and C are correct because both restrict ingress to the company's known public IP ranges, which is exactly the requirement to allow only traffic from trusted source addresses. Option A permits HTTPS traffic on tcp:443 from those public IPs, and Option C permits HTTP traffic on tcp:80 from those same public IPs, so together they enforce source-based filtering for web access. Option B is wrong because 0.0.0.0/0 allows traffic from any IPv4 address, which violates the restriction to known IP ranges. Option D is wrong because a source tag identifies instances within the VPC rather than external known public IP ranges, so it does not meet the stated requirement. Option E is wrong because firewall ingress rules are evaluated on source, not destination, and 0.0.0.0/0 as a destination would not restrict access to the company's known IPs.

Answer

Ingress rule with source IP range 0.0.0.0/0 and allow tcp:80

Answer

Ingress rule with source tag 'web' and allow tcp:80

Answer

Ingress rule with destination IP range 0.0.0.0/0 and allow tcp:80

Question 3

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Accepted Answer

Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.. Option B is correct because Cloud NAT requires a route in the VPC that directs traffic destined for 0.0.0.0/0 to the default internet gateway, so that packets from private instances can be sent toward the NAT gateway for translation. Option D is correct because Cloud NAT lets you choose between automatic NAT IP allocation or manually specifying a list of external IP addresses to use for NAT, which is useful for allowlisting or predictable egress. Option E is correct because Cloud NAT supports TCP and UDP (and ICMP for some use cases), so it can translate common connectionless and connection-oriented traffic from private instances. Option A is not correct because Cloud NAT is a regional resource configured at the region level and associated with a Cloud Router, not configured per subnet. Option C is not correct because Cloud NAT does not assign external IP addresses to the instances themselves; it performs source NAT so the instances keep only their private IPs while the NAT gateway uses its own external IPs.

Answer

Cloud NAT can be configured per subnet or per region.

Answer

Cloud NAT automatically assigns external IP addresses to instances.

Question 4

A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?

Accepted Answer

The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.. A custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface is required to force traffic to go through that specific tunnel. Option B is incorrect because Cloud NAT is for outbound internet access, not routing to on-premises. Option C is incorrect because firewall rules control access but not routing. Option D is incorrect because on-premises BGP advertisement is for routes from on-premises to Google Cloud, not for directing traffic within Google Cloud.

Answer

Cloud NAT is enabled.

Answer

Firewall rules allow ingress from on-premises IPs.

Answer

The on-premises router is advertising the route via BGP.

Question 5

An organization uses Shared VPC with multiple service projects. They want to ensure that only certain service projects can use a specific subnet. How can this be achieved?

Accepted Answer

Use IAM roles on the subnet to grant access to specific service projects.. In Google Cloud, Shared VPC allows sharing subnets across projects. To restrict which service projects can use a specific subnet, you use IAM roles on the subnet. By granting the 'compute.networkUser' role to specific service projects (or their service accounts) on the subnet, only those projects can use it. This is the standard method for fine-grained access control.

Answer

Use VPC subnet secondary IP ranges.

Answer

Use VPC Network Tags on the VM instances.

Answer

Use VPC firewall rules with service accounts to restrict access.

Question 6

Which TWO of the following are required to enable Private Google Access for a subnet?

Accepted Answer

Enable Private Google Access on the subnet.. To enable Private Google Access, you must enable the setting on the subnet (option B) and have a default route with next-hop internet gateway (option D) for traffic to Google APIs. Option A is incorrect because private services access is for Google managed services like Cloud SQL. Option C is incorrect because Cloud NAT is not required. Option E is incorrect because VPC flow logs are optional.

Answer

Create a private services access connection.

Answer

Create a Cloud NAT.

Answer

Enable VPC flow logs.

Question 7

A company has VPC peering between two VPC networks. They want to ensure that traffic from VPC A to VPC B can use a custom route in VPC A that points to a next-hop appliance in VPC A. Which TWO conditions must be met?

Accepted Answer

VPC peering must be set up with 'export custom routes' enabled from VPC A.. Required because custom routes must be exported from VPC A to VPC B via peering. This allows VPC B to learn the route and send return traffic back through the same appliance, ensuring bidirectional communication via the appliance. Without exporting custom routes, VPC B would send return traffic directly via the peering connection, bypassing the appliance. Option E is required because VPC A must have a route that specifies the destination inside VPC B and sets the next-hop to the appliance. This route is what directs the traffic from VPC A to VPC B through the appliance. Options A, C, and D are not necessary for the forward path: VPC B does not need a route back (the return path is handled via export), the appliance can be in any region (it just needs connectivity), and a firewall rule on the appliance is needed but is not a condition specific to using the custom route via peering.

Answer

VPC B must have a route back to VPC A.

Answer

The appliance must be in the same region as VPC A.

Answer

The appliance must have a firewall rule allowing traffic from VPC B.

Question 8

Refer to the exhibit. A VM in the default VPC with tag 'internal' and IP 10.128.1.2 is unable to communicate with another VM with IP 10.132.0.3 and tag 'internal'. What is the most likely cause?

Accepted Answer

The source range 10.128.0.0/14 does not include 10.132.0.3.. The source range 10.128.0.0/14 covers addresses from 10.128.0.0 through 10.131.255.255. The destination VM at 10.132.0.3 falls outside this CIDR block, so the firewall rule does not match the traffic and the connection is blocked. This is a classic subnetting error where the /14 mask is too narrow to include the 10.132.x.x range.

Answer

The rule only applies to ingress traffic.

Answer

The rule only allows TCP and UDP, not ICMP.

Answer

The rule priority is too low.

Question 9

Refer to the exhibit. A company uses a Cloud Router with two BGP sessions for an HA VPN to on-premises. Traffic is not flowing correctly to the on-premises network. What is the most likely issue?

Accepted Answer

The BGP session with vpn-tunnel-2 is down, causing asymmetric routing.. In a Google Cloud HA VPN with two BGP sessions, if one session (vpn-tunnel-2) is down, traffic may be routed asymmetrically. The Cloud Router will still advertise routes, but if the on-premises router sends traffic back through the down tunnel, packets are dropped. This causes connectivity issues. The most likely issue is that the BGP session with vpn-tunnel-2 is down, leading to asymmetric routing.

Answer

The advertised route priority is too low.

Answer

The keepalive interval is too high.

Answer

The ASN 65000 is private and not allowed.

Question 10

A company is designing a multi-region architecture with Active/Active failover across two regions using Cloud VPN. They want to ensure that traffic from on-premises to a global external HTTPS load balancer is routed to the nearest region based on latency. What should they configure on the on-premises side?

Accepted Answer

Local preference on the on-premises router.. To direct traffic from on-premises to the nearest region based on latency, the on-premises routers should use BGP local preference to prefer the path with lower latency. Local preference is an attribute set on the on-premises router to influence outbound traffic selection; a higher local preference is preferred. Option A is correct. Option D is wrong because AS Path prepending is applied by the route advertiser (Google Cloud) to make a path appear longer, not by the on-premises routers. The on-premises routers receive routes and can influence their selection using local preference, not AS Path prepending.

Answer

Multi-Exit Discriminator (MED) on the Google Cloud side.

Answer

Static routes pointing to the VPC subnet in each region.

Answer

BGP AS Path prepending to make one path appear longer.

Question 11

A developer wants to create a VM that can communicate with all Google APIs without requiring an external IP address. Which configuration is necessary?

Accepted Answer

Enable Private Google Access on the subnet.. Private Google Access allows VM instances that only have internal IP addresses to reach Google APIs and services without needing an external IP. It works by routing traffic to the default internet gateway, which then forwards it to Google APIs. This is the correct configuration because it directly enables communication with Google APIs without external IPs.

Answer

Configure a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Set up VPC peering with the Google APIs service producer.

Question 12

An organization uses Shared VPC with multiple service projects. They want to allow a service project to create a VM in a subnet that belongs to the host project. The subnet has an IAM policy that grants the compute.instanceAdmin role to the service project's service account. However, the service project is unable to create VMs in that subnet. What is the most likely reason?

Accepted Answer

The service project is missing the compute.networkUser role on the host project.. In Shared VPC, the service project's service account needs the compute.networkUser role on the host project (or on the specific subnet) to use the shared subnet. The compute.instanceAdmin role on the subnet allows instance administration but does not grant network usage. Without compute.networkUser, the service project cannot create VMs in the host project's subnet.

Answer

The subnet IAM policy does not include the service project's service account.

Answer

The subnet is out of IP addresses.

Answer

The service project does not have the compute.instanceAdmin role on itself.

Question 13

A company uses VPC Flow Logs for traffic analysis. They notice that logs are missing for a specific Compute Engine instance that handles high traffic. The subnet has Flow Logs enabled. What is the most likely reason?

Accepted Answer

Flow Logs are sampled and may drop high-throughput traffic.. VPC Flow Logs use sampling to capture traffic data, and under high-throughput conditions the sampling rate means not every flow is logged, so logs can appear missing for a busy instance. The subnet-level Flow Logs setting is correct, but sampling is an inherent characteristic of the feature, not a configuration error. This is the most likely reason logs are incomplete for a high-traffic Compute Engine instance.

Answer

The instance is using Private Google Access.

Answer

The instance's network interface has an external IP.

Answer

The instance is in a different region from the log sink.

Question 14

An organization needs to connect two VPCs in different regions using Google's backbone. What is the recommended solution?

Accepted Answer

VPC Peering. VPC Peering is the recommended solution to connect two VPCs in different regions using Google's backbone. VPC peering allows private connectivity between VPC networks, and it supports cross-region peering, routing traffic over Google's global network. This provides low-latency, high-bandwidth connectivity without requiring external IPs or VPNs.

Answer

Cloud VPN

Answer

Dedicated Interconnect

Answer

Cloud NAT

Question 15

An engineer runs 'gcloud compute networks peerings list' and sees state 'INACTIVE' for a peering connection. Which is the most likely cause?

Accepted Answer

The subnet CIDR ranges overlap.. In Google Cloud VPC peering, an INACTIVE state typically indicates that the peering configuration is incomplete or invalid, and overlapping subnet CIDR ranges between the two peered networks is a common cause. When CIDR ranges overlap, the peering cannot become active because routing would be ambiguous. The engineer must resolve the overlap by re-IPing one of the subnets or using a different peering topology.

Answer

The IAM permissions for the peer are insufficient.

Answer

The dynamic routing mode differs.

Answer

The firewall rules are missing.