PCNE Implementing a Virtual Private Cloud Practice Test 4 — 15 Questions

Question 1

A company has a VPC with a subnet 'subnet-a' in us-central1. They want to create a firewall rule that allows ingress traffic to all instances in the VPC from any source on port 22, but only for instances with the tag 'ssh-server'. Which command should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud compute firewall-rules create allow-ssh --network=my-vpc --allow=tcp:22 --source-ranges=0.0.0.0/0 --target-tags=ssh-server. The correct command uses the required flags: --network, --allow, --source-ranges, and --target-tags. It creates an ingress rule that allows SSH from anywhere to instances tagged 'ssh-server'. The other options add unnecessary or invalid flags.

Answer

gcloud compute firewall-rules create allow-ssh --network=my-vpc --allow=tcp:22 --source-ranges=0.0.0.0/0 --target-tags=ssh-server --action=ALLOW

Answer

gcloud compute firewall-rules create allow-ssh --network=my-vpc --allow=tcp:22 --source-ranges=0.0.0.0/0 --target-tags=ssh-server --priority=1000

Answer

gcloud compute firewall-rules create allow-ssh --network=my-vpc --allow=tcp:22 --source-ranges=0.0.0.0/0 --target-tags=ssh-server --direction=INGRESS

Question 2

A network engineer needs to create a VPC network that has no subnets in any region, and later add subnets only in us-central1 and europe-west1. The VPC must not automatically create subnets in other regions. Which command should the engineer use?

Accepted Answer

gcloud compute networks create my-vpc --subnet-mode=custom. A custom mode VPC network starts with no subnets, allowing the engineer to manually create subnets only in the desired regions. This provides precise control over IP address ranges and regional presence, which is essential for many production architectures. Auto mode would create subnets everywhere, and legacy mode is deprecated and lacks required features.

Answer

gcloud compute networks create my-vpc --subnet-mode=auto

Answer

gcloud compute networks create my-vpc --subnet-mode=legacy

Answer

gcloud compute networks create my-vpc --subnet-mode=custom --auto-create-subnets=false

Question 3

You manage a VPC named `prod-vpc` with subnets in `us-central1` and `europe-west1`. You need to create a new subnet in `asia-east1` that provides secondary IP ranges for a GKE cluster. The cluster requires a secondary range for Pods and another for Services. Which command should you run?

Accepted Answer

gcloud compute networks subnets create asia-subnet --network=prod-vpc --region=asia-east1 --range=10.0.0.0/20 --secondary-range pods=10.1.0.0/16,services=10.2.0.0/20. To create a subnet with secondary ranges for GKE, you must use the --secondary-range flag with a comma-separated list of name=CIDR pairs. The correct command creates the subnet in asia-east1 with primary range and two named secondary ranges. Other options either omit names, repeat the flag, or use incorrect separators, resulting in failure or misconfiguration.

Answer

gcloud compute networks subnets create asia-subnet --network=prod-vpc --region=asia-east1 --range=10.0.0.0/20 --secondary-range pods=10.1.0.0/16 --secondary-range services=10.2.0.0/20

Answer

gcloud compute networks subnets create asia-subnet --network=prod-vpc --region=asia-east1 --range=10.0.0.0/20 --secondary-range pods=10.1.0.0/16 services=10.2.0.0/20

Answer

gcloud compute networks subnets create asia-subnet --network=prod-vpc --region=asia-east1 --range=10.0.0.0/20 --secondary-range=10.1.0.0/16,10.2.0.0/20

Question 4

A company is designing a VPC network for a new application. They need to ensure that instances in the VPC can resolve internal DNS names of other instances and access Google APIs without using external IP addresses. They also want to minimize management overhead. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable Private Google Access on the subnet.. Private Google Access on subnets allows instances without external IPs to reach Google APIs using internal IPs. Using a custom mode VPC network provides control and avoids unnecessary subnets, reducing management overhead. Cloud NAT is for general internet access, default DNS does not address API access, and external IPs violate the no-external-IP requirement.

Answer

Configure a Cloud NAT gateway for the subnet.

Answer

Use the default VPC network's internal DNS resolution.

Answer

Assign external IP addresses to all instances.

Question 5

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) in us-central1 and subnet-b (10.0.2.0/24) in europe-west1. They need to ensure that traffic between VMs in these subnets is allowed, but only for specific protocols. They have created firewall rules with the appropriate source and target tags. However, traffic is still being blocked. What is the most likely cause?

Accepted Answer

The firewall rules are egress rules, but traffic between subnets requires ingress rules to be allowed on the destination VMs.. Traffic between VMs in different subnets within the same VPC is subject to ingress firewall rules on the destination VM. Even though the VPC is global, firewall rules must be ingress to allow the traffic. If the rules were mistakenly created as egress rules, they would not permit the incoming packets, and the default implied deny ingress rule would block them. The correct configuration requires ingress rules that match the source and target tags.

Answer

The firewall rules have a priority that is higher than the implied deny rule, but the source tags are not correctly applied to the VMs.

Answer

The firewall rules are ingress rules, but traffic between subnets in different regions is considered egress and requires separate egress rules.

Answer

The firewall rules are not applied because the VPC is in custom mode and requires explicit rules for all traffic.

Question 6

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) in us-central1 and subnet-b (10.0.2.0/24) in europe-west1. They have a firewall rule with target tag 'web' that allows tcp:80 from 0.0.0.0/0. VMs in subnet-a with tag 'web' can be accessed via HTTP, but VMs in subnet-b with the same tag cannot. What is the most likely cause?

Accepted Answer

The VMs in subnet-b do not have an external IP address, so they cannot receive traffic from the internet.. Firewall rules are global and apply to all instances with matching tags, regardless of region. The inability to access VMs in subnet-b via HTTP from the internet is most likely because those VMs lack external IP addresses. Without an external IP, a VM cannot receive direct inbound traffic from the internet, even if firewall rules permit it. This is a common configuration difference between regions.

Answer

The firewall rule is regional and only applies to the region where it was created.

Answer

A higher-priority deny rule is blocking traffic to subnet-b.

Answer

The firewall rule's target tag 'web' is not applied to the VMs in subnet-b.

Question 7

A company needs to ensure that a specific VM instance in their VPC can only communicate with other instances in the same subnet, and cannot reach any other subnet or the internet. They want to use firewall rules to enforce this. What should they do?

Accepted Answer

Create a firewall rule with priority 1000 that allows ingress from the subnet's IP range to the VM's network tag, and a rule with priority 1001 that denies ingress from all other sources (0.0.0.0/0) to the VM's network tag.. To restrict a VM to only communicate within its subnet, you can use ingress firewall rules that allow traffic only from the subnet's CIDR range and deny all other ingress. Since communication requires both sending and receiving, blocking unwanted ingress effectively prevents the VM from communicating with other subnets or the internet. This approach uses network tags to target the specific VM.

Answer

Remove the default allow all egress rule and create a specific egress rule that allows traffic only to the subnet's IP range.

Answer

Create a firewall rule with priority 1000 that allows all ingress traffic from the subnet's IP range, and another rule with priority 1001 that denies all egress traffic to 0.0.0.0/0.

Answer

Assign the VM an external IP address and use a firewall rule to block all traffic to and from that IP.

Question 8

A network engineer is configuring a VPC network with a custom mode. They need to create a subnet with a primary IP range of 10.0.0.0/24 and a secondary range for pods of 10.1.0.0/16. They also require that the subnet be created in the europe-west1 region. Which gcloud command will accomplish this?

Accepted Answer

gcloud compute networks subnets create SUBNET_NAME --network=VPC_NAME --region=europe-west1 --range=10.0.0.0/24 --secondary-range=pod-range=10.1.0.0/16. The correct command uses gcloud compute networks subnets create with --range for the primary range and --secondary-range for the secondary range, specifying the network and region. This precisely fulfills the requirements without adding unrequested features.

Answer

gcloud compute networks subnets create SUBNET_NAME --network=VPC_NAME --region=europe-west1 --range=10.0.0.0/24 --add-secondary-ranges=pod-range=10.1.0.0/16

Answer

gcloud compute networks subnets create SUBNET_NAME --network=VPC_NAME --region=europe-west1 --range=10.0.0.0/24 --secondary-range=pod-range=10.1.0.0/16 --enable-private-ip-google-access

Answer

gcloud compute networks subnets create SUBNET_NAME --network=VPC_NAME --region=europe-west1 --range=10.0.0.0/24 --secondary-range=pod-range=10.1.0.0/16 --enable-flow-logs

Question 9

You are designing a VPC for a new application that requires high availability across regions. You need to create a VPC that automatically creates subnets in each region and allows you to add custom subnets later. You also want to minimize administrative overhead. Which two actions should you take? (Choose two.)

Accepted Answer

Enable auto mode for the VPC and later add custom subnets as needed.. Auto mode VPC networks automatically create one subnet in each region with predefined IP ranges, minimizing administrative overhead. You can later add custom subnets if needed, providing flexibility. This meets the requirements for high availability and low management effort. Custom mode or Shared VPC would require more manual configuration.

Answer

Create a VPC network in custom mode and manually create subnets in each region.

Answer

Create a Shared VPC host project and attach service projects.

Answer

Use the default VPC network that comes with each project.

Question 10

You have a VPC with two subnets in the same region: `subnet-1` (10.0.1.0/24) and `subnet-2` (10.0.2.0/24). You want to ensure that instances in `subnet-1` can communicate with instances in `subnet-2` using their internal IP addresses, but you want to restrict access to only HTTP (port 80) and HTTPS (port 443). You also want to log all denied traffic. What should you do?

Accepted Answer

Create a single ingress firewall rule with source ranges 10.0.1.0/24 and 10.0.2.0/24, allowing tcp:80,443. Create a lower-priority deny rule with logging enabled.. To allow HTTP and HTTPS between the subnets, a single ingress rule with both source ranges and allowing tcp:80,443 is sufficient. To log denied traffic, you need a deny rule with logging enabled, placed at a lower priority than the allow rule. This ensures that denied traffic is logged while allowed traffic is not logged by the deny rule.

Answer

Create a single ingress firewall rule with source ranges 10.0.1.0/24 and 10.0.2.0/24, allowing tcp:80,443. Enable VPC Flow Logs on both subnets.

Answer

Create a single ingress firewall rule with source ranges 10.0.1.0/24 and 10.0.2.0/24, allowing tcp:80,443. Enable logging on the rule.

Answer

Create ingress firewall rules allowing tcp:80,443 from 10.0.1.0/24 to instances in subnet-2, and from 10.0.2.0/24 to instances in subnet-1. Enable logging on these rules.

Question 11

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

Accepted Answer

Cloud Router. Cloud Router is required when using Cloud VPN with dynamic routing (BGP) because it manages the BGP sessions between the on-premises router and the Google Cloud VPN gateway. It exchanges routes dynamically, enabling automatic route propagation and failover without manual static route configuration.

Answer

Cloud NAT

Answer

VPC peering

Answer

VPC Flow Logs

Question 12

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Accepted Answer

Assign an external IP address to the VM.. Option B is correct because a VM instance needs an external (public) IP address to be directly reachable from the internet; without one, inbound connections from internet clients cannot be routed to the instance. Option E is correct because Google Cloud VPC firewall rules are required to permit ingress traffic, and a rule allowing TCP port 80 from 0.0.0.0/0 explicitly authorizes HTTP traffic from any internet source to reach the VM. Together, the external IP provides the routable address and the firewall rule provides the permission, satisfying both the addressing and access-control requirements. Option A is incorrect because Cloud NAT provides outbound internet access for instances without external IPs and does not enable inbound connections. Option C is incorrect because Private Google Access only allows instances without external IPs to reach Google APIs and services, not general internet HTTP clients. Option D is incorrect because a static internal IP address is only routable within the VPC and cannot be reached from the internet.

Answer

Configure Cloud NAT for the VPC.

Answer

Enable Private Google Access on the subnet.

Answer

Assign a static internal IP address to the VM.

Question 13

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Accepted Answer

Service projects. Shared VPC (E) is the correct architecture because it lets a host project centrally own and administer the VPC network while attaching multiple service projects to it, satisfying the centralized network administration requirement. The host project (B) is the project that owns the Shared VPC network and its subnets, and it is where network administrators manage the shared resources. Service projects (A) are the projects that are attached to the host project's Shared VPC, allowing each project to deploy resources into shared subnets and apply its own firewall rules, which meets the multiple-projects and per-project firewall requirements. Cloud VPN (C) is only a connectivity mechanism for encrypted tunnels to a VPC and does not provide multi-project network sharing or centralized administration. VPC peering (D) connects separate VPC networks but does not centralize network administration or give each project its own firewall rules within a single shared network.

Answer

Cloud VPN

Answer

VPC peering

Question 14

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

Accepted Answer

Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.. Deploying two Cloud VPN tunnels from two Cloud Routers with BGP sessions provides high availability and automatic failover. The two Cloud Routers in different zones ensure redundancy, and BGP (Border Gateway Protocol) dynamically advertises routes and detects tunnel failures, allowing traffic to automatically switch to the healthy tunnel without manual intervention. This meets the requirement for an IPsec VPN connection to a third-party SaaS provider that only supports IPsec VPN.

Answer

Use Dedicated Interconnect with VLAN attachments to the SaaS provider.

Answer

Deploy a Classic VPN tunnel with policy-based routing.

Answer

Deploy a single Cloud VPN tunnel and use static routing.

Question 15

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

Accepted Answer

Deploy a global HTTP(S) Load Balancer with backend services in each region.. A global HTTP(S) Load Balancer uses Google Cloud's global anycast IP address and the Google Front End (GFE) infrastructure to route traffic over Google's private network to the closest healthy backend instance. This reduces latency by avoiding the public internet and leveraging Google's global fiber backbone, making it the correct choice for improving performance for a globally distributed application.

Answer

Use Cloud DNS with geo-routing to direct users to regional load balancers.

Answer

Set up Cloud NAT with multiple static IP addresses for each region.

Answer

Assign a global anycast IP address to all instances and use BGP to advertise it.