PCNE Implementing a Virtual Private Cloud Practice Test 3 — 15 Questions

Question 1

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces. They help diagnose packet drops and latency issues. Cloud NAT logging provides logs about NAT connections, not general traffic. Packet Mirroring is for capturing and inspecting traffic for analysis, not for logging. Traffic Director is a service mesh control plane, not a traffic logging tool.

Answer

Cloud NAT logging

Answer

Packet Mirroring

Answer

Traffic Director

Question 2

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

Accepted Answer

No additional configuration is needed.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs. Once enabled on the subnet, Google automatically adds a private route for the Google API IP ranges, so no further configuration is required. Therefore, option C is correct. Option A is incorrect because a default route to the internet would send traffic to the internet, not to Google APIs via private access. Option B is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.

Answer

A default route to the internet must be created.

Answer

A Cloud NAT must be configured.

Answer

The instances must have external IPs.

Question 3

Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?

Accepted Answer

Create a Private Service Connect service attachment and publish the service.. The producer (VPC-A) must create a Private Service Connect service attachment that publishes the service. This attachment is associated with a load balancer or a service. Option A is incorrect because the endpoint is created in the consumer VPC (VPC-B). Option B is incorrect because VPC peering is not used with Private Service Connect (the services can be across organizations without peering). Option D is incorrect because Private Google Access is unrelated to publishing services.

Answer

Create a Private Service Connect endpoint in VPC-A.

Answer

Enable Private Google Access on the subnet where the service resides.

Answer

Create a VPC peering connection with VPC-B.

Question 4

A company has a VPC with firewall rules. They want to ensure that only traffic from known IP ranges can access their web server instances. Which two firewall rule configurations are appropriate? (Choose two.)

Accepted Answer

Ingress rule with source IP range of the company's public IPs and allow tcp:443. Options A and C are correct. Ingress firewall rules with source IP ranges limited to the company's known public IPs on ports 443 (HTTPS) and 80 (HTTP) ensure that only traffic from those IPs can access the web server instances. Option B is incorrect because source range 0.0.0.0/0 allows all IPs, which does not restrict to known IPs. Option D is incorrect because source tags identify target instances, not source IPs. Option E is incorrect because ingress rules use source IP ranges, not destination IP ranges, to restrict incoming traffic.

Answer

Ingress rule with source IP range 0.0.0.0/0 and allow tcp:80

Answer

Ingress rule with source tag 'web' and allow tcp:80

Answer

Ingress rule with destination IP range 0.0.0.0/0 and allow tcp:80

Question 5

An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)

Accepted Answer

Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.. Options B, D, and E are correct. Option B: Cloud NAT requires a default route (0.0.0.0/0) pointing to the internet gateway to forward traffic. Option D: You can specify a manual list of NAT IP addresses (static external IPs) for Cloud NAT to use. Option E: Cloud NAT supports both TCP and UDP protocols for outbound connections. Option A is incorrect because Cloud NAT is configured per region, not per subnet; it applies to all subnets in the region that are enabled for NAT. Option C is incorrect because Cloud NAT does not assign external IPs to instances; it provides NAT for instances without external IPs.

Answer

Cloud NAT can be configured per subnet or per region.

Answer

Cloud NAT automatically assigns external IP addresses to instances.

Question 6

A company is designing a VPC routing strategy. Which three are valid route types in Google Cloud VPC? (Choose three.)

Accepted Answer

System-generated routes. Options A, B, and D are correct. System-generated routes are created automatically for subnet ranges and default internet gateway. Custom static routes are manually defined by administrators. Dynamic routes are learned through BGP from on-premises or other networks. Option C is incorrect because 'VPN tunnel routes' is not a distinct route type; VPN tunnels utilize either static routes or BGP for route advertisement. Option E is incorrect because 'Peering routes' are not a separate type; they are system-generated routes imported from peered VPCs.

Answer

VPN tunnel routes

Answer

Peering routes

Question 7

A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?

Accepted Answer

The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.. A custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface is required to force traffic to go through that specific tunnel. Option B is incorrect because Cloud NAT is for outbound internet access, not routing to on-premises. Option C is incorrect because firewall rules control access but not routing. Option D is incorrect because on-premises BGP advertisement is for routes from on-premises to Google Cloud, not for directing traffic within Google Cloud.

Answer

Cloud NAT is enabled.

Answer

Firewall rules allow ingress from on-premises IPs.

Answer

The on-premises router is advertising the route via BGP.

Question 8

Which THREE of the following are benefits of using VPC Flow Logs?

Accepted Answer

Compliance and audit requirements.. VPC Flow Logs capture network traffic metadata, which can be used for compliance auditing (A), troubleshooting connectivity issues (B), and analyzing traffic patterns to detect DDoS attacks (C). Option D is incorrect because flow logs do not reduce latency; they only log data. Option E is incorrect because flow logs are not real-time; there is a delay in log delivery.

Answer

Reducing network latency.

Answer

Real-time network monitoring.

Question 9

A company has VPC peering between two VPC networks. They want to ensure that traffic from VPC A to VPC B can use a custom route in VPC A that points to a next-hop appliance in VPC A. Which TWO conditions must be met?

Accepted Answer

VPC peering must be set up with 'export custom routes' enabled from VPC A.. Required because custom routes must be exported from VPC A to VPC B via peering. This allows VPC B to learn the route and send return traffic back through the same appliance, ensuring bidirectional communication via the appliance. Without exporting custom routes, VPC B would send return traffic directly via the peering connection, bypassing the appliance. Option E is required because VPC A must have a route that specifies the destination inside VPC B and sets the next-hop to the appliance. This route is what directs the traffic from VPC A to VPC B through the appliance. Options A, C, and D are not necessary for the forward path: VPC B does not need a route back (the return path is handled via export), the appliance can be in any region (it just needs connectivity), and a firewall rule on the appliance is needed but is not a condition specific to using the custom route via peering.

Answer

VPC B must have a route back to VPC A.

Answer

The appliance must be in the same region as VPC A.

Answer

The appliance must have a firewall rule allowing traffic from VPC B.

Question 10

Refer to the exhibit. A VM in the default VPC with tag 'internal' and IP 10.128.1.2 is unable to communicate with another VM with IP 10.132.0.3 and tag 'internal'. What is the most likely cause?

Accepted Answer

The source range 10.128.0.0/14 does not include 10.132.0.3.. The firewall rule shown allows ingress traffic from source range 10.128.0.0/14, which covers IP addresses from 10.128.0.0 to 10.131.255.255. The destination VM with IP 10.132.0.3 is outside this range (10.132.0.3 is in 10.132.0.0/16, not within 10.128.0.0/14). Therefore, traffic from the source VM (10.128.1.2) to the destination VM (10.132.0.3) is blocked because the destination IP is not allowed by the rule's source range. Option D correctly identifies this. Option A is incorrect because the rule direction is ingress, which is correct for receiving traffic; the issue is the source range. Option B is incorrect because even though ICMP may be used, the fundamental problem is the IP range mismatch. Option C is incorrect because priority 1000 is valid and does not cause blocking.

Answer

The rule only applies to ingress traffic.

Answer

The rule only allows TCP and UDP, not ICMP.

Answer

The rule priority is too low.

Question 11

Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?

Accepted Answer

Enable Private Google Access on the subnet.. The subnet has privateIpGoogleAccess set to false, which must be enabled for VMs without external IPs to access Google APIs via Private Google Access. Option C (Enable Private Google Access on the subnet) is the correct configuration. Option A (Cloud NAT) is for outbound internet to non-Google destinations, not for Google APIs. Option B is not needed because egress to 0.0.0.0/0 is allowed by default. Option D is not missing; a default route exists as indicated by gatewayAddress.

Answer

Create a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Add a default route to the internet gateway.

Question 12

Refer to the exhibit. A company uses a Cloud Router with two BGP sessions for an HA VPN to on-premises. Traffic is not flowing correctly to the on-premises network. What is the most likely issue?

Accepted Answer

The BGP session with vpn-tunnel-2 is down, causing asymmetric routing.. The exhibit shows that vpn-tunnel-2's BGP session is in a state other than 'established' (likely down), while vpn-tunnel-1 is established. A down BGP session on one tunnel can cause asymmetric routing or loss of connectivity, especially if traffic is sent over the down tunnel. Option B correctly identifies this. Option A is incorrect because the advertised route priority (MED) of 100 is not the issue; the problem is the session state. Option C is incorrect because keepalive interval 20 seconds is standard. Option D is incorrect because private ASN 65000 is allowed in Cloud Router BGP configurations.

Answer

The advertised route priority is too low.

Answer

The keepalive interval is too high.

Answer

The ASN 65000 is private and not allowed.

Question 13

A company wants to connect two VPC networks using VPC Network Peering. What is required for this setup?

Accepted Answer

The VPCs must have non-overlapping IP ranges.. VPC Network Peering requires that the IP ranges of the peered networks do not overlap. Option C is correct. Option A is wrong because a Cloud VPN tunnel is not required for peering; peering is a direct connection. Option B is wrong because VPCs can be in different organizations and still be peered. Option D is wrong because VPCs can be in different regions.

Answer

A Cloud VPN tunnel must be established.

Answer

Both VPCs must belong to the same organization.

Answer

Both VPCs must be in the same region.

Question 14

A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises network does not have a route back to the VPC subnet.. The most likely cause is that the on-premises network lacks a route back to the VPC subnet. For Cloud VPN, return traffic from the on-premises server must have a route pointing to the on-premises VPN gateway to reach the VM. Without this route, packets are dropped, causing asymmetric routing. Option B is incorrect because firewall rules affect all traffic, not just the return path. Option C is incorrect because if the BGP session were down, no connectivity would exist at all. Option D is incorrect because Cloud Router is used for dynamic routing, but a missing return route would still cause the issue even with static routes.

Answer

A firewall rule is blocking ingress traffic from the on-premises network.

Answer

The BGP session is down.

Answer

The Cloud Router is not configured.

Question 15

A developer wants to create a VM that can communicate with all Google APIs without requiring an external IP address. Which configuration is necessary?

Accepted Answer

Enable Private Google Access on the subnet.. To enable a VM to communicate with Google APIs without an external IP, Private Google Access must be enabled on the subnet. This allows instances with only internal IPs to reach Google APIs and services through Google's internal network. Option A (Cloud NAT) provides internet access for non-Google destinations, not specifically for Google APIs. Option B (firewall rule to 0.0.0.0/0) would allow egress to the internet, but the VM still needs an external IP if Private Google Access is not enabled. Option C (VPC peering) is used to connect VPCs, not to access Google APIs. Therefore, Option D is correct.

Answer

Configure a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Set up VPC peering with the Google APIs service producer.