PCNE Implementing a Virtual Private Cloud Practice Test 5 — 15 Questions

Question 1

A financial services company is deploying a multi-tier application in a custom VPC with three subnets: web (10.0.1.0/24), app (10.0.2.0/24), and db (10.0.3.0/24). They use a Cloud VPN with dynamic routing (BGP) to connect to their on-premises data center (10.1.0.0/16). The on-premises network administrator reports that traffic from the web tier (10.0.1.0/24) to on-premises is working, but traffic from the app tier (10.0.2.0/24) to on-premises is failing. The company uses an Identity-Aware Proxy (IAP) for SSH access. The following configurations are in place:
- Cloud Router advertises all VPC subnets via BGP.
- On-premises router advertises 10.1.0.0/16.
- Firewall rules allow all traffic from 10.0.0.0/16 to 10.1.0.0/16.
- The app tier instances have a network tag 'app-tier' and a service account 'app-sa@project.iam.gserviceaccount.com'.
- There is a firewall rule with priority 1000 that denies egress from tags 'app-tier' to 10.1.0.0/16.
What is the most likely cause of the failure?

Accepted Answer

A firewall egress rule with priority 1000 denies traffic from instances with tag 'app-tier' to 10.1.0.0/16.. The firewall egress rule with priority 1000 explicitly denies traffic from instances tagged 'app-tier' to the on-premises network (10.1.0.0/16). Since firewall rules are evaluated in order of priority (lower numbers are higher priority), and this rule has a relatively low priority number, it will override any higher-numbered (lower priority) allow rules. The fact that web tier traffic works confirms that routing and VPN are functional, isolating the issue to the egress deny rule targeting the app tier.

Answer

The service account 'app-sa' does not have permissions to send traffic through the VPN.

Answer

IAP is blocking traffic from the app tier because it is not configured for that subnet.

Answer

The Cloud Router is not advertising the 10.0.2.0/24 subnet to on-premises.

Question 2

Your company has a VPC with a single subnet in us-central1 (10.0.1.0/24). You have a managed instance group (MIG) of web servers (10.0.1.2-10.0.1.10) and a standalone database instance (10.0.1.100). The web servers need to communicate with the database on TCP port 3306. You have configured a firewall rule allowing ingress from 10.0.1.0/24 to 10.0.1.100 on tcp:3306. However, the web servers cannot connect to the database. You verified that the database is running and listening on port 3306, and that the web servers can ping the database. What should you do to resolve the issue?

Accepted Answer

Check the database instance's OS-level firewall (e.g., iptables) and ensure it allows traffic on port 3306 from the web servers.. The firewall rule is correctly configured at the VPC level to allow ingress from the web servers' subnet to the database on TCP port 3306. Since the web servers can ping the database, network connectivity exists, but the application-layer connection fails. This indicates the database instance's OS-level firewall (e.g., iptables on Linux) is blocking the port, as cloud VPC firewall rules and guest OS firewalls operate independently.

Answer

Create a custom route from the web servers to the database.

Answer

Add a network tag 'db' to the database instance and update the firewall rule to target 'db'.

Answer

Configure the firewall rule to use the database's service account as the target.

Question 3

An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?

Accepted Answer

The firewall rules have a source or destination filter that excludes the new subnet's CIDR.. In Google Cloud, firewall rules can include source or destination IP range filters. Even if target tags match, if the rule also specifies a source or destination range that does not include the new subnet's CIDR (192.168.1.0/24), the rule will not apply to instances in that subnet. Option A is incorrect because although firewall rules are scoped to the VPC, that does not explain the issue; the rules still apply to all subnets, but specific IP range filters can limit applicability. Option B is incorrect because there is no concept of 'firewall rule enforcement' on subnets. Option C is incorrect because firewall rule changes apply immediately; instances do not need to be recreated.

Answer

Firewall rules are scoped to a VPC, not to subnets.

Answer

The new subnet was created without enabling firewall rule enforcement.

Answer

The instances need to be recreated for the new rules to apply.

Question 4

A company uses Shared VPC with a host project and multiple service projects. A service project administrator wants to create a VM with an internal IP from a specific subnet in the host project. The operation fails with a permission error. What is the most likely missing permission?

Accepted Answer

compute.subnetworks.use on the host project subnet.. In a Shared VPC, a service project administrator needs permission to use a subnet from the host project. The specific IAM permission required to use a subnet when creating a VM is 'compute.subnetworks.use' on the host project's subnet. Without this permission, the VM creation fails with a permission error even if the user has instance creation rights in the service project.

Answer

resourcemanager.projects.get on the host project.

Answer

compute.instances.create on the service project.

Answer

compute.networks.use on the host project VPC.

Question 5

An engineer is troubleshooting high latency in a VPC and suspects packet drops. Which VPC feature should they enable to get detailed information about network traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocol, and whether traffic was allowed or denied. Enabling Flow Logs provides the detailed traffic data needed to diagnose packet drops and high latency.

Answer

Cloud NAT logging

Answer

Packet Mirroring

Answer

Traffic Director

Question 6

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

Accepted Answer

No additional configuration is needed.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs. Once enabled on the subnet, Google automatically adds a private route for the Google API IP ranges, so no further configuration is required. Therefore, option C is correct. Option A is incorrect because a default route to the internet would send traffic to the internet, not to Google APIs via private access. Option B is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.

Answer

A default route to the internet must be created.

Answer

A Cloud NAT must be configured.

Answer

The instances must have external IPs.

Question 7

Two organizations have their own GCP projects with VPCs that are peered. They want to allow a service in VPC-A to be consumed by VPC-B using Private Service Connect. What configuration is required in VPC-A?

Accepted Answer

Create a Private Service Connect service attachment and publish the service.. The producer (VPC-A) must create a Private Service Connect service attachment that publishes the service. This attachment is associated with a load balancer or a service. Option A is incorrect because the endpoint is created in the consumer VPC (VPC-B). Option B is incorrect because VPC peering is not used with Private Service Connect (the services can be across organizations without peering). Option D is incorrect because Private Google Access is unrelated to publishing services.

Answer

Create a Private Service Connect endpoint in VPC-A.

Answer

Enable Private Google Access on the subnet where the service resides.

Answer

Create a VPC peering connection with VPC-B.

Question 8

A company is designing a VPC routing strategy. Which three are valid route types in Google Cloud VPC? (Choose three.)

Accepted Answer

System-generated routes. Option A (System-generated routes) is correct because every VPC automatically creates default routes (e.g., a 0.0.0.0/0 route to the default internet gateway and subnet routes for each subnet's primary and secondary CIDR ranges) that are managed by Google Cloud. Option B (Dynamic routes learned through BGP) is correct because Cloud Router uses BGP to dynamically exchange routes with on-premises networks over Cloud VPN or Cloud Interconnect, and these learned routes are installed in the VPC route table. Option D (Custom static routes) is correct because users can manually create static routes in a VPC to direct traffic to specific destinations via next hops such as instances, VPN tunnels, or load balancers. Option C (VPN tunnel routes) is not a distinct route type; routes associated with VPN tunnels are either dynamic BGP-learned routes or custom static routes, so it is not separately valid. Option E (Peering routes) is also not a distinct route type; VPC peering exchanges subnet routes that appear as system-generated or dynamic routes, not as a separate 'peering route' category.

Answer

VPN tunnel routes

Answer

Peering routes

Question 9

A developer needs to allow a VM in subnet A to reach a VM in subnet B in the same VPC. What is the default behavior?

Accepted Answer

The default firewall rule allows all internal traffic within the VPC.. In a VPC, the default firewall rule (often called 'default-allow-internal' or equivalent) permits all internal traffic between instances within the VPC, including across subnets. Since subnets in the same VPC are connected by the VPC's implicit routing, a VM in subnet A can reach a VM in subnet B without adding routes or firewall rules, provided the default rule is intact.

Answer

A custom route must be added to route between subnets.

Answer

A firewall rule must be added to allow traffic between subnets.

Answer

VPC peering is required for communication between subnets.

Question 10

Which THREE of the following are benefits of using VPC Flow Logs?

Accepted Answer

Compliance and audit requirements.. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packets, bytes, accept/reject) for ENIs, subnets, or VPCs, which directly supports compliance and audit requirements (A) by providing an immutable record of network activity for auditors and forensic review. They are also a primary troubleshooting tool (B) because the ACCEPT/REJECT action field lets you pinpoint security group, NACL, or routing problems causing connectivity failures. In addition, flow logs help detect DDoS attacks (C) by revealing abnormal traffic patterns such as massive volumes of REJECTed packets or traffic from unusual source IPs that indicate a flood. Option D is wrong because flow logs are passive metadata records and do not alter routing, bandwidth, or latency. Option E is wrong because flow logs are delivered to CloudWatch Logs or S3 with aggregation intervals of up to 10 minutes, so they are near-real-time at best, not real-time network monitoring.

Answer

Reducing network latency.

Answer

Real-time network monitoring.

Question 11

Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?

Accepted Answer

Enable Private Google Access on the subnet.. A VM without an external IP cannot reach Google APIs because it lacks a path to the internet. Enabling Private Google Access on the subnet allows VMs to reach Google APIs and services using internal IP addresses, without needing an external IP or Cloud NAT. This is the correct configuration.

Answer

Create a Cloud NAT.

Answer

Add a firewall rule to allow egress to 0.0.0.0/0.

Answer

Add a default route to the internet gateway.

Question 12

A company wants to connect two VPC networks using VPC Network Peering. What is required for this setup?

Accepted Answer

The VPCs must have non-overlapping IP ranges.. VPC Network Peering requires that the IP address ranges of the two VPC networks do not overlap. This is because peering creates a direct private connection between the VPCs, and overlapping CIDR blocks would cause routing ambiguity and conflicts. Google Cloud validates this at peering creation time and rejects the peering if any subnet ranges overlap.

Answer

A Cloud VPN tunnel must be established.

Answer

Both VPCs must belong to the same organization.

Answer

Both VPCs must be in the same region.

Question 13

A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises network does not have a route back to the VPC subnet.. The VM can initiate and reach the on-premises server, which proves the forward path (VPC route, Cloud VPN tunnel, and on-prem firewall) is working. Return traffic is dropped because the on-premises network has no route pointing back to the VPC subnet range, so replies are either dropped or sent to a default gateway that discards them. In a Cloud VPN, routing is bidirectional and must be configured on both sides — the VPC side has a route to on-prem, but the on-prem router needs a matching route to the VPC CIDR.

Answer

A firewall rule is blocking ingress traffic from the on-premises network.

Answer

The BGP session is down.

Answer

The Cloud Router is not configured.

Question 14

A company has a VPC with subnets in us-central1 and europe-west1. They want to deploy a Cloud NAT to allow VMs in both regions to access the internet. How many Cloud NAT gateways are needed?

Accepted Answer

Two Cloud NAT gateways, one per region.. Cloud NAT is a regional resource; each region requires its own Cloud NAT gateway. A single gateway cannot cover multiple regions because Cloud NAT does not support global scope. For VMs in us-central1 and europe-west1 to access the internet, you need one Cloud NAT gateway per region, totaling two. Therefore, option C is correct. Option A is incorrect because Cloud NAT is necessary for private VMs to reach the internet without external IP addresses. Option B is incorrect because Cloud NAT operates at the region level, not per subnet; a regional gateway serves all subnets in that region. Option D is incorrect because Cloud NAT is regional, not global.

Answer

None; Cloud NAT is not required for internet access.

Answer

One Cloud NAT gateway per subnet.

Answer

One Cloud NAT gateway covering both regions.

Question 15

A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud NAT. Cloud NAT (Network Address Translation) allows Compute Engine instances without external IP addresses to initiate outbound connections to the internet. It provides many-to-one IP translation using a NAT gateway in the VPC, enabling internet access while keeping instances private. This is the standard Google Cloud solution for outbound-only internet access from private instances.

Answer

Cloud VPN

Answer

Private Google Access

Answer

VPC Peering