PCNE Implementing a Virtual Private Cloud Practice Test 3 — 15 Questions

Question 1

Which TWO statements about VPC peering are correct?

Accepted Answer

VPC peering requires that all subnet CIDR ranges be unique across both VPCs.. Option D is correct because VPC peering requires that subnet CIDR ranges do not overlap between the two peered VPCs; if any subnet ranges overlap, the peering cannot be established or routes will not work correctly. Option E is correct because VPC peering can be created across projects, organizations, and even across different billing accounts, as long as the peering request is accepted and the CIDR ranges are non-overlapping. Option A is incorrect because firewall rules still apply to traffic over a VPC peering connection; peering does not bypass firewall enforcement. Option B is incorrect because custom routes are not automatically exported by default in VPC peering; route exchange must be configured or enabled where applicable. Option C is incorrect because VPC peering can be established between VPCs in different regions, not only within the same region.

Answer

VPC peering allows traffic without firewall rules if both VPCs are in the same project.

Answer

VPC peering automatically exports custom routes.

Answer

VPC peering can only be established for VPCs in the same region.

Question 2

Which THREE statements about VPC Flow Logs are correct?

Accepted Answer

Flow logs support sampling with a configurable interval.. Option A is correct because VPC Flow Logs support sampling, and you can configure the sampling interval (for example, 5-second or 10-second aggregation intervals) to control how frequently flow data is captured and reported. Option B is correct because flow logs can be exported to BigQuery, where you can run SQL-based analysis and join the data with other datasets for deeper network traffic insights. Option E is correct because VPC Flow Logs are enabled at the subnet level, meaning you turn them on for a specific subnet to capture traffic for resources within that subnet. Option C is incorrect because flow logs capture traffic to and from all IP addresses, not only external ones, including internal VPC traffic. Option D is incorrect because flow logs are not enabled by default; you must explicitly enable them for each subnet you want to monitor.

Answer

Flow logs record traffic to and from external IP addresses only.

Answer

Flow logs are enabled by default for all subnets.

Question 3

A company is designing a Shared VPC architecture for multiple projects. The host project hosts three VPC networks: 'prod', 'staging', 'dev'. Each service project needs access to a specific network. Some service projects require access to multiple networks. The security team wants to minimize the number of firewall rules and use IAM for centralized control. Which approach meets these requirements?

Accepted Answer

Attach each service project to one host project network and use IAM roles to grant access to specific subnets in other networks with a cross-project service account.. In a Shared VPC architecture, service projects can be attached to specific subnets in the host project's networks. To grant access to multiple networks, you can use IAM roles to allow cross-project service accounts to access subnets in other networks. This approach minimizes firewall rules because firewall rules are defined at the VPC level in the host project and can be shared, and IAM provides centralized control. The other options either require more firewall rules, create separate host projects, or use a single VPC with subnet-level isolation, which may not meet the requirement of minimizing firewall rules and using IAM for centralized control.

Answer

Use VPC Network Peering between each service project's VPC and the host project's networks.

Answer

Create a separate host project for each environment and attach service projects accordingly.

Answer

Create a single VPC network that encompasses all environments, and use subnet-level firewall rules to isolate environments.

Question 4

A company has an on-premises data center connected to Google Cloud via Dedicated Interconnect. They have a VPC with subnets in us-central1 and us-west1. They want compute instances in us-central1 to access Google APIs (e.g., Cloud Storage) without traversing the internet, but the on-premises network must also be able to access those APIs via the interconnect. They have configured Private Google Access (PGA) on all subnets. However, on-premises users report that they cannot access Cloud Storage buckets using the private IP of a forward proxy in us-central1 (the proxy is configured to use the default internet gateway for egress). What is the most likely reason?

Accepted Answer

There is a custom static route for 199.36.153.4/30 (Google API VIP) that points to the interconnect, overriding the default route for the proxy's outbound traffic.. Private Google Access allows instances without external IPs to reach Google APIs using the private VIPs (199.36.153.4/30 for private.googleapis.com). If a custom static route for that VIP range points to the interconnect instead of the default internet gateway, the proxy's traffic to Google APIs is sent over the interconnect and fails, because the on-premises network cannot route back to the Google API VIPs via that path.

Answer

Private Google Access is not supported on subnets in us-central1.

Answer

The forward proxy must use an external IP address to use Private Google Access.

Answer

The on-premises network must be configured with a default route pointing to the internet.

Question 5

A company wants to enable VPC Flow Logs for a subnet to troubleshoot connectivity issues. They have enabled flow logs with a sample rate of 1.0 and metadata annotation enabled. After a few hours, they notice that logs are being generated but they are missing flows from a specific application server to a database server in the same subnet. Both servers are Compute Engine instances with internal IPs only. What could be the cause?

Accepted Answer

VPC Flow Logs do not capture traffic between instances in the same subnet because it does not traverse the VPC router.. VPC Flow Logs capture IP traffic that traverses the VPC router. Traffic between two instances within the same subnet is forwarded at layer 2, without going through the router, so it is not captured by flow logs. This is why the flows from the application server to the database server are missing. Option D correctly identifies this behavior.

Answer

The instances are using internal DNS names, and flow logs only capture traffic by IP address.

Answer

The sample rate of 1.0 means all flows are sampled, but metadata annotation may be causing some flows to be dropped.

Answer

Flow logs must be enabled on the VPC network, not just the subnet.

Question 6

A company has a VPC with three tiers: web, app, and db. They want to enforce that only the web tier can communicate with the app tier on TCP port 8080, and only the app tier can communicate with the db tier on TCP port 3306. All instances are in the same region but different subnets. Which TWO firewall rules should be created? (Choose 2.)

Accepted Answer

An ingress rule on the db tier instances with tag 'db' allowing TCP 3306 from instances with tag 'app'.. Option D is correct because the app tier must accept inbound traffic on TCP port 8080, and scoping the ingress rule to instances tagged 'app' with a source of instances tagged 'web' enforces that only the web tier can reach the app tier on that port. Option A is correct because the db tier must accept inbound traffic on TCP port 3306, and scoping the ingress rule to instances tagged 'db' with a source of instances tagged 'app' enforces that only the app tier can reach the db tier on that port. Together these two ingress rules implement the required tier-to-tier access control using tag-based security group references rather than broad subnet CIDRs. Option B is not needed because egress rules are not what enforce who may connect to the app tier, and it targets a subnet rather than the app instances by tag. Option C is incorrect because allowing TCP 8080 to any destination from the web subnet is overly permissive and does not restrict traffic to the app tier. Option E is incorrect because it is an ingress rule on the web subnet for port 8080 from the app subnet, which reverses the intended direction and does not control access to the app tier.

Answer

An egress rule on the web instances with tag 'web' allowing TCP 8080 to the app subnet.

Answer

An egress rule on the web subnet allowing TCP 8080 to any destination.

Answer

An ingress rule on the web subnet allowing TCP 8080 from the app subnet.

Question 7

A company has a VPC that is connected to an on-premises network via a Cloud VPN tunnel using dynamic routing (BGP). They have set up a Cloud Router with an advertised IP range of 10.0.0.0/8. The on-premises network advertises 172.16.0.0/12. They also have a custom static route in the VPC for 10.0.0.0/8 that points to a next-hop VPN tunnel (the same tunnel) with priority 100. Recently, they added a new subnet 10.1.0.0/24 in the VPC. Traffic from on-premises to 10.1.0.0/24 is not working. Which THREE steps should they take to troubleshoot and resolve the issue? (Choose 3.)

Accepted Answer

Verify that the Cloud Router is advertising the 10.1.0.0/24 subnet to on-premises.. Option B is correct because the on-premises side learns VPC destinations through the Cloud Router's BGP advertisements, so the new 10.1.0.0/24 subnet must be included in the advertised range (or the router must be reconfigured to advertise it) for on-premises traffic to have a return path. Option C is correct because even if routing is propagated, the on-premises firewall and route tables must permit and forward traffic to 10.1.0.0/24; a missing allow rule or route there would silently drop the traffic. Option E is correct because the Cloud VPN uses dynamic BGP routing, and if the BGP session is down or not Established, no dynamic routes (including the new subnet) will be exchanged in either direction. Option A is wrong because changing a static route's priority to 1000 does not fix the missing advertisement or firewall/route issue and could even make the static route less preferred than dynamic routes. Option D is wrong because deleting the static route is not required to make the new subnet reachable and could disrupt existing traffic that depends on it; the problem is advertisement and on-premises filtering, not the static route itself.

Answer

Change the static route priority to 1000 to match dynamic routes.

Answer

Delete the static route for 10.0.0.0/8 and rely solely on dynamic routing.

Question 8

A large enterprise has a Google Cloud environment with multiple projects under an organization. They have a Shared VPC host project with a VPC named 'shared-vpc' that has subnets in us-central1 and europe-west1. Several service projects are attached to this host project. One service project, 'proj-analytics', has a Compute Engine instance 'vm-analytics' in us-central1 that needs to connect to a Cloud SQL PostgreSQL instance (private IP) also in us-central1, but within a different service project 'proj-db'. The Cloud SQL instance is configured with a private IP address 10.0.1.5 from a subnet in 'shared-vpc' (the same VPC). The vm-analytics instance has an internal IP 10.0.0.5 from a different subnet in 'shared-vpc'. The two subnets are in the same region, and there is a firewall rule allowing all traffic from 10.0.0.0/16 (the entire VPC range) to the Cloud SQL subnet. However, vm-analytics cannot connect to the Cloud SQL instance. The error on vm-analytics is 'Connection timed out'. There are no firewall rules blocking egress from vm-analytics. What is the most likely cause and solution?

Accepted Answer

Grant the service project's compute engine default service account the Compute Network User role on the host project.. In a Shared VPC, the host project owns the network, but service projects' resources need explicit permission to use the shared subnets. The Compute Engine default service account in the service project must be granted the Compute Network User role (roles/compute.networkUser) on the host project (or on the specific subnet) to attach to and use the shared VPC. Without this IAM binding, the VM cannot route traffic through the shared VPC to reach the Cloud SQL private IP, causing the connection timeout.

Answer

Enable Private Google Access on the vm-analytics subnet.

Answer

Create a firewall rule in the host project allowing ingress from the service project's subnets to the Cloud SQL subnet.

Answer

Configure a Cloud Router in the service project to advertise routes to the Cloud SQL subnet.

Question 9

A company is migrating from an on-premises data center to Google Cloud. They have set up a High-Availability VPN (with two tunnels) between their on-premises router and a Cloud VPN gateway in a VPC. They use static routing. The on-premises network uses RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the VPC uses 10.1.0.0/16. They have configured static routes in the VPC for the on-premises ranges pointing to the VPN gateway. However, they notice that traffic from on-premises to the VPC is intermittent: sometimes packets go through tunnel 1, sometimes through tunnel 2, and sometimes they drop. The on-premises router is configured to use both tunnels in an active-active mode with equal-cost multipath (ECMP). What is the most likely cause of the intermittent drops?

Accepted Answer

Change from static routing to dynamic routing (BGP) to allow the Cloud VPN gateway to advertise routes and avoid ECMP issues.. Google Cloud HA VPN with static routing does not support active-active ECMP across both tunnels in the way on-premises routers expect. Cloud VPN's static routing model effectively designates one tunnel as active for a given route, and the on-premises router's ECMP hashing across two tunnels causes asymmetric flows and drops because the Cloud VPN gateway does not load-balance return traffic the same way. Switching to dynamic routing (BGP) lets the Cloud VPN gateway advertise routes and participate in path selection, eliminating the ECMP mismatch.

Answer

Increase the number of tunnels to four to distribute traffic better.

Answer

Set the on-premises router to active-passive mode using only one tunnel at a time.

Answer

Configure traffic selector policies on the VPN tunnels to ensure each tunnel only handles specific subnets.

Question 10

A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?

Accepted Answer

Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.. Cloud NAT uses source network address translation (SNAT) and maps internal IPs to the NAT IP using ports. By default, Cloud NAT allocates a range of ports per VM. If the instances are making many connections, they may exhaust the allocated ports. The symptom that only some instances fail suggests that the failing instances may have run out of ephemeral ports. Option D is correct: Increase the number of NAT IP addresses or increase the minimum ports per VM.

Answer

The instances are using different service accounts, and the NAT is not configured to allow all.

Answer

The Cloud NAT's idle timeout is set too low, causing connections to be dropped.

Answer

The external API endpoint has a rate limit that is being hit by the NAT IP.

Question 11

A small company has a single VPC with one subnet in us-central1 (10.0.1.0/24). They have a Compute Engine instance that needs to be reachable from the internet via HTTP (port 80) and HTTPS (port 443). The instance has an external IP address (ephemeral). They have created firewall rules allowing ingress on TCP 80 and 443 from 0.0.0.0/0, with target tags 'web-server'. The instance has been assigned the tag 'web-server'. However, external users report that they cannot access the instance's public IP on either port. The instance's OS firewall (iptables) is default allow. What is the most likely cause?

Accepted Answer

The instance's external IP is ephemeral and may have changed, so users should use the new IP or reserve a static IP.. The VPC automatically has a default route to the internet gateway, so no custom route is needed. Firewall rules with target tags 'web-server' are correctly applied to the instance with that tag. The instance's OS firewall (iptables) is default allow, so it is not blocking traffic. The most likely cause is that the instance's external IP is ephemeral and may have changed after a stop/start operation. Users may be attempting to connect to the old IP address. To resolve this, the company should assign a static external IP to the instance.

Answer

The instance's OS firewall is blocking the traffic; check iptables.

Answer

The VPC needs a custom route for the internet gateway.

Answer

The firewall rules must be applied to the subnet, not the instance tag.

Question 12

A company has a multi-region VPC with subnets in us-central1 (10.0.0.0/24) and europe-west1 (10.0.1.0/24). They have deployed a global Application Load Balancer (ALB) with backend services in both regions. The backends are instance groups with instances in each subnet. The ALB uses internal IP addresses from a subnet in each region for the backend services. The company wants to restrict access to the ALB so that only traffic from a specific list of external IP addresses (e.g., corporate VPN) can reach the load balancer. They have created a firewall rule allowing ingress from those IP addresses to the ALB's forwarding rule IP (which is a global IP). However, external traffic from allowed IPs is still being blocked. What is the most likely reason?

Accepted Answer

VPC firewall rules do not apply to global load balancer's frontend; use Cloud Armor with IP whitelist.. Google Cloud VPC firewall rules are stateful and apply to traffic destined for VM instances (and some internal load balancer addresses), not to the global external IP of an external Application Load Balancer's forwarding rule. The ALB frontend is a Google-managed proxy; client-to-ALB traffic is terminated at Google's edge and never traverses the customer VPC firewall. To filter by client source IP, you must attach a Cloud Armor security policy to the backend service with an allow-list rule.

Answer

The firewall rule should be created with priority lower than 1000 to override default deny.

Answer

The firewall rule must allow ingress from the allowed IPs to the backend instance's internal IPs.

Answer

The firewall rule must be applied to the backend instances' tags, not the forwarding rule IP.

Question 13

Refer to the exhibit. A VM in the my-vpc network is unable to reach an external HTTPS server. What is the most likely cause?

Accepted Answer

The deny-all-egress firewall rule blocks all outbound traffic.. The default VPC configuration includes a deny-all-egress firewall rule with the lowest priority (65535) that blocks all outbound traffic not explicitly allowed. Since no higher-priority rule permits outbound traffic to the external HTTPS server (port 443), the VM's HTTPS requests are dropped by this implicit deny rule, preventing connectivity.

Answer

The allow-custom-internal rule only allows inbound traffic.

Answer

No rule allows outbound traffic to port 443.

Answer

The default-allow-ssh rule has a low priority.

Question 14

A company uses a VPC with two subnets: subnet-a (10.0.1.0/24) with VMs tagged 'web', and subnet-b (10.0.2.0/24) with VMs tagged 'db'. They have a Cloud VPN tunnel to an on-premises network (172.16.0.0/16). The VPN tunnel is up and BGP is exchanging routes. A custom route for 172.16.0.0/16 with next hop VPN gateway exists, but it has a tag 'web', meaning it applies only to VMs with the 'web' tag. VMs in subnet-a can reach on-premises, but VMs in subnet-b cannot. Which step should be taken to allow subnet-b VMs to reach on-premises?

Accepted Answer

Add the 'db' tag to the custom route.. The custom route for 172.16.0.0/16 is tagged with 'web', so it only applies to VMs that have the 'web' tag. Subnet-b VMs are tagged 'db', so they do not match the route and cannot reach on-premises. Adding the 'db' tag to the route makes it apply to both tagged groups, enabling connectivity for subnet-b VMs without affecting existing traffic.

Answer

Create a new route for 172.16.0.0/16 with priority 1000 and no tag.

Answer

Remove the tag from the existing route.

Answer

Add a firewall rule to allow egress traffic from subnet-b.

Question 15

A company has a VPC with two subnets in the same region: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). An internal TCP load balancer is created in subnet-a. Backend instances in subnet-b are added to the load balancer's backend service, but health checks are failing. The firewall rules allow traffic from 130.211.0.0/22 and 35.191.0.0/16 to all instances on port 80. What is the most likely cause of the health check failures?

Accepted Answer

The backend instances in subnet-b do not have a route to the health check source IP ranges.. Health check probes for internal TCP load balancers originate from the health check source IP ranges and are delivered to the backend instances' internal IP addresses. For the health check to succeed, the backend instances must be able to send return traffic to those source ranges. If the instances are in a subnet without a route to the internet (e.g., no external IP and no Cloud NAT), and no custom route exists for the health check ranges, the return traffic is dropped, causing health checks to fail. The firewall rules alone are insufficient if routing is missing.

Answer

The health check source IP ranges are incorrect for internal TCP load balancers.

Answer

The health check probes originate from the load balancer's subnet, not from the health check source IP ranges.

Answer

The firewall rules allow traffic on port 80, but the health check probes use a different port.