PCNE Implementing a Virtual Private Cloud Practice Test 4 — 15 Questions

Question 1

An organization uses Shared VPC with multiple service projects. They want to allow a service project to create a VM in a subnet that belongs to the host project. The subnet has an IAM policy that grants the compute.instanceAdmin role to the service project's service account. However, the service project is unable to create VMs in that subnet. What is the most likely reason?

Accepted Answer

The service project is missing the compute.networkUser role on the host project.. In addition to subnet-level IAM, the service project must have the compute.networkUser role on the host project to use the Shared VPC. Option A is correct. Option B is wrong because the subnet IAM is sufficient for subnet access once the network user role is granted. Option C is wrong because service project's own IAM does not grant access to host project resources. Option D is wrong because quota is not the issue here.

Answer

The subnet IAM policy does not include the service project's service account.

Answer

The subnet is out of IP addresses.

Answer

The service project does not have the compute.instanceAdmin role on itself.

Question 2

A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud NAT. Cloud NAT allows instances without external IPs to access the internet. Other options are for different purposes.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering

Question 3

A network engineer is configuring VPC peering between two VPCs in the same project. The peering status is ACTIVE, but instances in one VPC cannot reach instances in the other VPC using internal IPs. The firewall rules are default (ingress deny all). What is the most likely cause?

Accepted Answer

The engineer forgot to add firewall rules to allow traffic from the peer range.. Default firewall rules deny all ingress, so even with peering, traffic is blocked unless allow rules are added.

Answer

The VPCs use different routing modes.

Answer

The IAM permissions for the peering are missing.

Answer

The VPCs have overlapping subnet CIDR ranges.

Question 4

A company uses VPC Flow Logs for traffic analysis. They notice that logs are missing for a specific Compute Engine instance that handles high traffic. The subnet has Flow Logs enabled. What is the most likely reason?

Accepted Answer

Flow Logs are sampled and may drop high-throughput traffic.. VPC Flow Logs use sampling; high throughput can lead to sampling reduction or dropped logs.

Answer

The instance is using Private Google Access.

Answer

The instance's network interface has an external IP.

Answer

The instance is in a different region from the log sink.

Question 5

An organization needs to connect two VPCs in different regions using Google's backbone. What is the recommended solution?

Accepted Answer

VPC Peering. VPC Peering uses Google's backbone to connect VPCs across regions without public internet.

Answer

Cloud VPN

Answer

Dedicated Interconnect

Answer

Cloud NAT

Question 6

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Accepted Answer

Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.. Cloud NAT uses network tags to filter which instances use it.

Answer

Assign external IPs to non-NAT instances.

Answer

Use firewall rules to allow NAT for tagged instances.

Answer

Create separate subnets for NAT instances.

Question 7

An engineer runs 'gcloud compute networks peerings list' and sees state 'INACTIVE' for a peering connection. Which is the most likely cause?

Accepted Answer

The subnet CIDR ranges overlap.. Overlapping subnet CIDRs cause the peering to be INACTIVE.

Answer

The IAM permissions for the peer are insufficient.

Answer

The dynamic routing mode differs.

Answer

The firewall rules are missing.

Question 8

Which of the following is a benefit of using Shared VPC?

Accepted Answer

Centralized network administration and separation from application projects.. Shared VPC allows centralized network administration with separation of application projects.

Answer

Lower cost compared to VPC peering.

Answer

Automatic failover for applications.

Answer

Reduced latency between instances.

Question 9

A company needs to connect on-premises to Google Cloud with overlapping IP ranges. The on-premises network uses 10.0.0.0/16 and the VPC uses 10.0.0.0/16. What is the best approach?

Accepted Answer

Use Cloud VPN with source NAT on the on-premises side.. Cloud VPN with source NAT on the on-premises side translates overlapping addresses.

Answer

Use Cloud NAT.

Answer

Use VPC peering.

Answer

Use Private Google Access.

Question 10

A security team wants to restrict which Google services can be accessed from their VPC without external IPs. They use Private Google Access. What should they use to block access to specific services?

Accepted Answer

VPC Service Controls. VPC Service Controls allows creating security perimeters that restrict access to services.

Answer

Firewall rules blocking destination IPs

Answer

Cloud NAT with a specific IP range

Answer

Private Google Access with restricted VIPs

Question 11

Which TWO statements about VPC peering are correct?

Accepted Answer

VPC peering requires that all subnet CIDR ranges be unique across both VPCs.. Peering can be across organizations and requires non-overlapping subnets.

Answer

VPC peering allows traffic without firewall rules if both VPCs are in the same project.

Answer

VPC peering automatically exports custom routes.

Answer

VPC peering can only be established for VPCs in the same region.

Question 12

Which THREE statements about Shared VPC are correct?

Accepted Answer

The Shared VPC admin role can be assigned to manage the host VPC network.. Shared VPC allows service projects to use host VPC subnets, requires same organization, and can be managed via Shared VPC admin role.

Answer

Service projects can delete subnets in the host VPC.

Answer

Service projects can create their own VPCs that peer with the host VPC.

Question 13

Which THREE statements about VPC Flow Logs are correct?

Accepted Answer

Flow logs support sampling with a configurable interval.. Flow logs are subnet-level, can be sent to BigQuery, and support configurable sampling.

Answer

Flow logs record traffic to and from external IP addresses only.

Answer

Flow logs are enabled by default for all subnets.

Question 14

Refer to the exhibit. You have two VPCs, vpc-a and vpc-b, with VPC peering configured and custom route import/export enabled. An instance in subnet-a (10.0.1.2) cannot ping an instance in subnet-b (10.0.2.2) using internal IP. Firewall rules are default (deny all ingress). What is the required action?

Accepted Answer

Add a firewall rule allowing ICMP from 10.0.1.0/24 to 10.0.2.0/24.. Even with peering, firewall rules are needed to allow traffic. Default deny all ingress blocks the ping.

Answer

Add a static route for the peer range.

Answer

Enable Private Google Access.

Answer

Create a Cloud VPN tunnel.

Question 15

Refer to the exhibit. You are troubleshooting an on-premises to Cloud VPN connection with dynamic routing. The BGP session is CONNECTED, but no routes are received from the on-premises router. What is the most likely cause?

Accepted Answer

The on-premises router is not configured to advertise routes.. The BGP session is up, but routesReceived is 0, indicating the on-premises router is not advertising routes.

Answer

The firewall rules are blocking BGP traffic.

Answer

The VPN tunnel is down.

Answer

The cloud router is not advertising any routes.