PCNE Implementing a Virtual Private Cloud Practice Test 4 — 15 Questions

Question 1

A company has a VPC with subnets in us-central1 and europe-west1. They want to deploy a Cloud NAT to allow VMs in both regions to access the internet. How many Cloud NAT gateways are needed?

Accepted Answer

Two Cloud NAT gateways, one per region.. Cloud NAT is a regional resource; each region requires its own Cloud NAT gateway. A single gateway cannot cover multiple regions because Cloud NAT does not support global scope. For VMs in us-central1 and europe-west1 to access the internet, you need one Cloud NAT gateway per region, totaling two. Therefore, option C is correct. Option A is incorrect because Cloud NAT is necessary for private VMs to reach the internet without external IP addresses. Option B is incorrect because Cloud NAT operates at the region level, not per subnet; a regional gateway serves all subnets in that region. Option D is incorrect because Cloud NAT is regional, not global.

Answer

None; Cloud NAT is not required for internet access.

Answer

One Cloud NAT gateway per subnet.

Answer

One Cloud NAT gateway covering both regions.

Question 2

An organization uses Shared VPC with multiple service projects. They want to allow a service project to create a VM in a subnet that belongs to the host project. The subnet has an IAM policy that grants the compute.instanceAdmin role to the service project's service account. However, the service project is unable to create VMs in that subnet. What is the most likely reason?

Accepted Answer

The service project is missing the compute.networkUser role on the host project.. In Shared VPC, a service project must have the compute.networkUser role on the host project to use its networks. Without this role, subnet-level IAM permissions (like compute.instanceAdmin) are ineffective because the service project cannot even access the network. Therefore, even though the subnet IAM may be correctly configured, the missing networkUser role prevents VM creation. Option D is correct. Option A is incorrect because the subnet IAM policy is not the issue; the problem is at the host project level. Option B is incorrect because IP exhaustion would give a different error (e.g., IP space full), not a permission error. Option C is incorrect because the service project's own IAM roles are irrelevant for accessing host project resources.

Answer

The subnet IAM policy does not include the service project's service account.

Answer

The subnet is out of IP addresses.

Answer

The service project does not have the compute.instanceAdmin role on itself.

Question 3

A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud NAT. Cloud NAT allows instances without external IPs to access the internet. Other options are for different purposes.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering

Question 4

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

Accepted Answer

The engineer forgot to add firewall rules to allow traffic from the peer range.. Default firewall rules deny all ingress, so even with peering, traffic is blocked unless allow rules are added.

Answer

The VPCs use different routing modes.

Answer

The IAM permissions for the peering are missing.

Answer

The VPCs have overlapping subnet CIDR ranges.

Question 5

A company uses VPC Flow Logs for traffic analysis. They notice that logs are missing for a specific Compute Engine instance that handles high traffic. The subnet has Flow Logs enabled. What is the most likely reason?

Accepted Answer

Flow Logs are sampled and may drop high-throughput traffic.. VPC Flow Logs use sampling; high throughput can lead to sampling reduction or dropped logs.

Answer

The instance is using Private Google Access.

Answer

The instance's network interface has an external IP.

Answer

The instance is in a different region from the log sink.

Question 6

An organization needs to connect two VPCs in different regions using Google's backbone. What is the recommended solution?

Accepted Answer

VPC Peering. VPC Peering uses Google's backbone to connect VPCs across regions without public internet.

Answer

Cloud VPN

Answer

Dedicated Interconnect

Answer

Cloud NAT

Question 7

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Accepted Answer

Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.. Cloud NAT uses network tags to filter which instances use it.

Answer

Assign external IPs to non-NAT instances.

Answer

Use firewall rules to allow NAT for tagged instances.

Answer

Create separate subnets for NAT instances.

Question 8

An engineer runs 'gcloud compute networks peerings list' and sees state 'INACTIVE' for a peering connection. Which is the most likely cause?

Accepted Answer

The subnet CIDR ranges overlap.. Overlapping subnet CIDRs cause the peering to be INACTIVE.

Answer

The IAM permissions for the peer are insufficient.

Answer

The dynamic routing mode differs.

Answer

The firewall rules are missing.

Question 9

Which of the following is a benefit of using Shared VPC?

Accepted Answer

Centralized network administration and separation from application projects.. Shared VPC allows centralized network administration with separation of application projects.

Answer

Lower cost compared to VPC peering.

Answer

Automatic failover for applications.

Answer

Reduced latency between instances.

Question 10

A company needs to connect on-premises to Google Cloud with overlapping IP ranges. The on-premises network uses 10.0.0.0/16 and the VPC uses 10.0.0.0/16. What is the best approach?

Accepted Answer

Use Cloud VPN with source NAT on the on-premises side.. Cloud VPN with source NAT on the on-premises side translates overlapping addresses.

Answer

Use Cloud NAT.

Answer

Use VPC peering.

Answer

Use Private Google Access.

Question 11

A security team wants to restrict which Google services can be accessed from their VPC without external IPs. They use Private Google Access. What should they use to block access to specific services?

Accepted Answer

VPC Service Controls. VPC Service Controls allows creating security perimeters that restrict access to services.

Answer

Firewall rules blocking destination IPs

Answer

Cloud NAT with a specific IP range

Answer

Private Google Access with restricted VIPs

Question 12

Which TWO statements about VPC peering are correct?

Accepted Answer

VPC peering requires that all subnet CIDR ranges be unique across both VPCs.. Peering can be across organizations and requires non-overlapping subnets.

Answer

VPC peering allows traffic without firewall rules if both VPCs are in the same project.

Answer

VPC peering automatically exports custom routes.

Answer

VPC peering can only be established for VPCs in the same region.

Question 13

Which THREE statements about Shared VPC are correct?

Accepted Answer

The Shared VPC admin role can be assigned to manage the host VPC network.. Shared VPC allows service projects to use host VPC subnets, requires same organization, and can be managed via Shared VPC admin role.

Answer

Service projects can delete subnets in the host VPC.

Answer

Service projects can create their own VPCs that peer with the host VPC.

Question 14

Which THREE statements about VPC Flow Logs are correct?

Accepted Answer

Flow logs support sampling with a configurable interval.. Flow logs are subnet-level, can be sent to BigQuery, and support configurable sampling.

Answer

Flow logs record traffic to and from external IP addresses only.

Answer

Flow logs are enabled by default for all subnets.

Question 15

Refer to the exhibit. You have two VPCs, vpc-a and vpc-b, with VPC peering configured and custom route import/export enabled. An instance in subnet-a (10.0.1.2) cannot ping an instance in subnet-b (10.0.2.2) using internal IP. Firewall rules are default (deny all ingress). What is the required action?

Accepted Answer

Add a firewall rule allowing ICMP from 10.0.1.0/24 to 10.0.2.0/24.. Even with peering, firewall rules are needed to allow traffic. Default deny all ingress blocks the ping.

Answer

Add a static route for the peer range.

Answer

Enable Private Google Access.

Answer

Create a Cloud VPN tunnel.