PCNE Implementing a Virtual Private Cloud Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. You are troubleshooting an on-premises to Cloud VPN connection with dynamic routing. The BGP session is CONNECTED, but no routes are received from the on-premises router. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises router is not configured to advertise routes.. The BGP session is up, but routesReceived is 0, indicating the on-premises router is not advertising routes.

Answer

The firewall rules are blocking BGP traffic.

Answer

The VPN tunnel is down.

Answer

The cloud router is not advertising any routes.

Question 2

Refer to the exhibit. Instances in subnet-b cannot access the internet through Cloud NAT. What is the most likely reason?

Accepted Answer

Subnet-b is not included in the Cloud NAT configuration.. The Cloud NAT configuration only includes subnet-a, so subnet-b is not NATed.

Answer

The firewall rules in subnet-b block egress.

Answer

The NAT IP address pool is exhausted.

Answer

Subnet-b has overlapping subnets.

Question 3

A company has two VPC networks in the same project: 'vpc-a' (us-central1) and 'vpc-b' (us-east1). They are connected via VPC Network Peering. An instance in vpc-a can ping the internal IP of an instance in vpc-b, but cannot reach it on TCP port 8080. The firewall rule in vpc-b allows ingress from the peered network's subnets. What is the most likely cause?

Accepted Answer

The firewall rule for port 8080 is missing or uses an incorrect target tag or service account.. Since ICMP (ping) works, VPC Network Peering is functioning correctly, and the firewall rule in vpc-b allows ingress from the peered network's subnets. The failure on TCP 8080 indicates a missing or misconfigured firewall rule specific to that port, possibly due to incorrect target tags or service accounts. Option D is incorrect because the rule already permits ingress from the peered subnets; the issue is that no rule explicitly allows TCP 8080. Therefore, the most likely cause is that the firewall rule for port 8080 is missing or uses an incorrect target tag or service account, making option C correct.

Answer

The instance in vpc-b has a firewall rule that denies TCP port 8080 explicitly.

Answer

The subnet in vpc-a is in a different region, so peering does not support cross-region communication.

Answer

The firewall rule in vpc-b must allow ingress from the entire CIDR of vpc-a's subnet, not just the peered network.

Question 4

A company is designing a Shared VPC architecture for multiple projects. The host project hosts three VPC networks: 'prod', 'staging', 'dev'. Each service project needs access to a specific network. Some service projects require access to multiple networks. The security team wants to minimize the number of firewall rules and use IAM for centralized control. Which approach meets these requirements?

Accepted Answer

Attach each service project to one host project network and use IAM roles to grant access to specific subnets in other networks with a cross-project service account.. In Shared VPC, a service project can only be attached to one VPC network per host project. To provide access to multiple VPC networks, you can use IAM roles such as compute.networkUser on specific subnets across different host projects or use a cross-project service account. Option A allows each service project to be attached to one network and then grants IAM permissions to access subnets in other networks, meeting the requirement to minimize firewall rules and use IAM for centralized control. Option B (VPC peering) does not provide centralized IAM control. Option C (separate host projects) increases management overhead. Option D (single VPC) defeats the purpose of isolation.

Answer

Use VPC Network Peering between each service project's VPC and the host project's networks.

Answer

Create a separate host project for each environment and attach service projects accordingly.

Answer

Create a single VPC network that encompasses all environments, and use subnet-level firewall rules to isolate environments.

Question 5

A company has an on-premises data center connected to Google Cloud via Dedicated Interconnect. They have a VPC with subnets in us-central1 and us-west1. They want compute instances in us-central1 to access Google APIs (e.g., Cloud Storage) without traversing the internet, but the on-premises network must also be able to access those APIs via the interconnect. They have configured Private Google Access (PGA) on all subnets. However, on-premises users report that they cannot access Cloud Storage buckets using the private IP of a forward proxy in us-central1 (the proxy is configured to use the default internet gateway for egress). What is the most likely reason?

Accepted Answer

There is a custom static route for 199.36.153.4/30 (Google API VIP) that points to the interconnect, overriding the default route for the proxy's outbound traffic.. Private Google Access (PGA) allows instances with only internal IPs to reach Google APIs via the default internet gateway (0.0.0.0/0 route). However, if a more specific static route exists for the Google API IP range (199.36.153.4/30) that points to the interconnect, traffic from the forward proxy to Google APIs will be routed to the on-premises network instead of the internet. Since the proxy is in us-central1 and uses its VPC routing, the custom route overrides the default route, preventing the proxy from reaching Google APIs. Option C correctly identifies this misconfiguration.

Answer

Private Google Access is not supported on subnets in us-central1.

Answer

The forward proxy must use an external IP address to use Private Google Access.

Answer

The on-premises network must be configured with a default route pointing to the internet.

Question 6

A company wants to enable VPC Flow Logs for a subnet to troubleshoot connectivity issues. They have enabled flow logs with a sample rate of 1.0 and metadata annotation enabled. After a few hours, they notice that logs are being generated but they are missing flows from a specific application server to a database server in the same subnet. Both servers are Compute Engine instances with internal IPs only. What could be the cause?

Accepted Answer

VPC Flow Logs do not capture traffic between instances in the same subnet because it does not traverse the VPC router.. VPC Flow Logs capture IP traffic that traverses the VPC router. Traffic between two instances within the same subnet is forwarded at layer 2, without going through the router, so it is not captured by flow logs. This is why the flows from the application server to the database server are missing. Option D correctly identifies this behavior.

Answer

The instances are using internal DNS names, and flow logs only capture traffic by IP address.

Answer

The sample rate of 1.0 means all flows are sampled, but metadata annotation may be causing some flows to be dropped.

Answer

Flow logs must be enabled on the VPC network, not just the subnet.

Question 7

A company has a VPC with three tiers: web, app, and db. They want to enforce that only the web tier can communicate with the app tier on TCP port 8080, and only the app tier can communicate with the db tier on TCP port 3306. All instances are in the same region but different subnets. Which TWO firewall rules should be created? (Choose 2.)

Accepted Answer

An ingress rule on the db tier instances with tag 'db' allowing TCP 3306 from instances with tag 'app'.. To control traffic between tiers, ingress firewall rules should be applied to the destination instances using target tags. For web-to-app (TCP 8080), place an ingress rule on app instances (tag 'app') allowing TCP 8080 from source tag 'web' (Option D). For app-to-db (TCP 3306), place an ingress rule on db instances (tag 'db') allowing TCP 3306 from source tag 'app' (Option A).

Option B is an egress rule on web, which controls outbound traffic but does not prevent other sources from reaching app. Option C allows traffic to any destination, violating the principle of least privilege. Option E incorrectly places an ingress rule on the web subnet, but the web tier should be the source, not the destination. Therefore, the correct answers are A and D.

Answer

An egress rule on the web instances with tag 'web' allowing TCP 8080 to the app subnet.

Answer

An egress rule on the web subnet allowing TCP 8080 to any destination.

Answer

An ingress rule on the web subnet allowing TCP 8080 from the app subnet.

Question 8

A company has a VPC that is connected to an on-premises network via a Cloud VPN tunnel using dynamic routing (BGP). They have set up a Cloud Router with an advertised IP range of 10.0.0.0/8. The on-premises network advertises 172.16.0.0/12. They also have a custom static route in the VPC for 10.0.0.0/8 that points to a next-hop VPN tunnel (the same tunnel) with priority 100. Recently, they added a new subnet 10.1.0.0/24 in the VPC. Traffic from on-premises to 10.1.0.0/24 is not working. Which THREE steps should they take to troubleshoot and resolve the issue? (Choose 3.)

Accepted Answer

Verify that the Cloud Router is advertising the 10.1.0.0/24 subnet to on-premises.. The issue is that traffic from on-premises to the new subnet 10.1.0.0/24 is not working. Since the VPC already has a Cloud VPN tunnel with dynamic routing (BGP) and a Cloud Router advertising 10.0.0.0/8, the new subnet 10.1.0.0/24 is more specific. Static routes with priority 100 for 10.0.0.0/8 do not override more specific dynamically learned routes; the most specific prefix wins. Therefore, the most likely causes are: the Cloud Router is not advertising the new subnet to on-premises (B), the on-premises firewall or route tables do not allow 10.1.0.0/24 (C), or the BGP session between Cloud Router and on-premises router is down (E). Checking BGP session status (E) is a fundamental step. Deleting the static route (D) is unnecessary, and changing priority (A) is not relevant because dynamic routes already have higher priority and more specific routes are preferred regardless. Thus, the correct steps are B, C, and E.

Answer

Change the static route priority to 1000 to match dynamic routes.

Answer

Delete the static route for 10.0.0.0/8 and rely solely on dynamic routing.

Question 9

A large enterprise has a Google Cloud environment with multiple projects under an organization. They have a Shared VPC host project with a VPC named 'shared-vpc' that has subnets in us-central1 and europe-west1. Several service projects are attached to this host project. One service project, 'proj-analytics', has a Compute Engine instance 'vm-analytics' in us-central1 that needs to connect to a Cloud SQL PostgreSQL instance (private IP) also in us-central1, but within a different service project 'proj-db'. The Cloud SQL instance is configured with a private IP address 10.0.1.5 from a subnet in 'shared-vpc' (the same VPC). The vm-analytics instance has an internal IP 10.0.0.5 from a different subnet in 'shared-vpc'. The two subnets are in the same region, and there is a firewall rule allowing all traffic from 10.0.0.0/16 (the entire VPC range) to the Cloud SQL subnet. However, vm-analytics cannot connect to the Cloud SQL instance. The error on vm-analytics is 'Connection timed out'. There are no firewall rules blocking egress from vm-analytics. What is the most likely cause and solution?

Accepted Answer

Grant the service project's compute engine default service account the Compute Network User role on the host project.. The most likely cause is that the service project's Compute Engine default service account lacks the necessary IAM permissions to use the Shared VPC network resources. The Cloud SQL instance with a private IP is accessible via the Shared VPC, but the service project's instances need the Compute Network User role on the host project to allow them to use the VPC network and its subnets. Without this role, the traffic from vm-analytics cannot reach the Cloud SQL private IP, resulting in a timeout. Option A is correct because granting the Compute Network User role to the service project's default compute service account enables the necessary network access. Option B is incorrect because Private Google Access is for accessing Google APIs without external IPs, not for Cloud SQL private connectivity. Option C is unnecessary because firewall rules already allow traffic from the entire VPC range to the Cloud SQL subnet. Option D is incorrect because Cloud Router is used for hybrid connectivity and dynamic routing, but the issue is IAM, not routing.

Answer

Enable Private Google Access on the vm-analytics subnet.

Answer

Create a firewall rule in the host project allowing ingress from the service project's subnets to the Cloud SQL subnet.

Answer

Configure a Cloud Router in the service project to advertise routes to the Cloud SQL subnet.

Question 10

A company is migrating from an on-premises data center to Google Cloud. They have set up a High-Availability VPN (with two tunnels) between their on-premises router and a Cloud VPN gateway in a VPC. They use static routing. The on-premises network uses RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the VPC uses 10.1.0.0/16. They have configured static routes in the VPC for the on-premises ranges pointing to the VPN gateway. However, they notice that traffic from on-premises to the VPC is intermittent: sometimes packets go through tunnel 1, sometimes through tunnel 2, and sometimes they drop. The on-premises router is configured to use both tunnels in an active-active mode with equal-cost multipath (ECMP). What is the most likely cause of the intermittent drops?

Accepted Answer

Change from static routing to dynamic routing (BGP) to allow the Cloud VPN gateway to advertise routes and avoid ECMP issues.. The most likely cause of intermittent drops is that the on-premises router is using ECMP to distribute traffic across both VPN tunnels, but Cloud VPN with static routing does not support ECMP for incoming traffic. This can lead to out-of-order packets or drops for the same flow if packets arrive on different tunnels. Switching to dynamic routing with BGP allows the Cloud VPN gateway to establish BGP sessions over each tunnel, which enables proper route advertisement and ECMP support by creating a single logical interface. BGP routing also allows the gateway to better handle path selection and failover, thus resolving the intermittent drops. Therefore, option B is correct.

Answer

Increase the number of tunnels to four to distribute traffic better.

Answer

Set the on-premises router to active-passive mode using only one tunnel at a time.

Answer

Configure traffic selector policies on the VPN tunnels to ensure each tunnel only handles specific subnets.

Question 11

A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?

Accepted Answer

Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.. Cloud NAT uses source network address translation (SNAT) and maps internal IPs to the NAT IP using ports. By default, Cloud NAT allocates a range of ports per VM. If the instances are making many connections, they may exhaust the allocated ports. The symptom that only some instances fail suggests that the failing instances may have run out of ephemeral ports. Option D is correct: Increase the number of NAT IP addresses or increase the minimum ports per VM.

Answer

The instances are using different service accounts, and the NAT is not configured to allow all.

Answer

The Cloud NAT's idle timeout is set too low, causing connections to be dropped.

Answer

The external API endpoint has a rate limit that is being hit by the NAT IP.

Question 12

A small company has a single VPC with one subnet in us-central1 (10.0.1.0/24). They have a Compute Engine instance that needs to be reachable from the internet via HTTP (port 80) and HTTPS (port 443). The instance has an external IP address (ephemeral). They have created firewall rules allowing ingress on TCP 80 and 443 from 0.0.0.0/0, with target tags 'web-server'. The instance has been assigned the tag 'web-server'. However, external users report that they cannot access the instance's public IP on either port. The instance's OS firewall (iptables) is default allow. What is the most likely cause?

Accepted Answer

The instance's external IP is ephemeral and may have changed, so users should use the new IP or reserve a static IP.. The VPC automatically has a default route to the internet gateway, so no custom route is needed. Firewall rules with target tags 'web-server' are correctly applied to the instance with that tag. The instance's OS firewall (iptables) is default allow, so it is not blocking traffic. The most likely cause is that the instance's external IP is ephemeral and may have changed after a stop/start operation. Users may be attempting to connect to the old IP address. To resolve this, the company should assign a static external IP to the instance.

Answer

The instance's OS firewall is blocking the traffic; check iptables.

Answer

The VPC needs a custom route for the internet gateway.

Answer

The firewall rules must be applied to the subnet, not the instance tag.

Question 13

A company has a multi-region VPC with subnets in us-central1 (10.0.0.0/24) and europe-west1 (10.0.1.0/24). They have deployed a global Application Load Balancer (ALB) with backend services in both regions. The backends are instance groups with instances in each subnet. The ALB uses internal IP addresses from a subnet in each region for the backend services. The company wants to restrict access to the ALB so that only traffic from a specific list of external IP addresses (e.g., corporate VPN) can reach the load balancer. They have created a firewall rule allowing ingress from those IP addresses to the ALB's forwarding rule IP (which is a global IP). However, external traffic from allowed IPs is still being blocked. What is the most likely reason?

Accepted Answer

VPC firewall rules do not apply to global load balancer's frontend; use Cloud Armor with IP whitelist.. The Global Application Load Balancer (external) uses a global anycast IP that is part of Google's frontend infrastructure, not a VPC resource. VPC firewall rules apply only to traffic entering or leaving VPC network interfaces, such as VM instances or internal load balancers. Traffic to the global ALB's frontend IP is handled before it reaches the VPC, so VPC firewall rules cannot filter it. To restrict access based on source IP addresses, you must use Cloud Armor security policies attached to the load balancer. Therefore, option B is correct. Option A is incorrect because priority is not the issue; firewall rules simply do not apply to the global frontend. Option C and D are incorrect because they refer to backend instances, but the problem is at the frontend. Option B is the correct solution: use Cloud Armor with an IP whitelist.

Answer

The firewall rule should be created with priority lower than 1000 to override default deny.

Answer

The firewall rule must allow ingress from the allowed IPs to the backend instance's internal IPs.

Answer

The firewall rule must be applied to the backend instances' tags, not the forwarding rule IP.

Question 14

A company has a VPC with a single subnet in us-central1 (10.0.0.0/24). They have a Compute Engine instance running a database that uses an internal IP address 10.0.0.10. They need to ensure that this database instance can be accessed by a legacy on-premises application via a Cloud VPN tunnel. The on-premises network uses 192.168.0.0/16. They have set up a HA VPN gateway with two tunnels and BGP routing. The Cloud Router is configured to advertise the subnet 10.0.0.0/24. On the on-premises side, the router receives the route for 10.0.0.0/24 and has a static route for 10.0.0.0/24 pointing to the VPN tunnel. However, the on-premises application cannot reach the database. The application's server can ping the on-premises gateway, but not the database IP. The database instance's OS firewall allows all traffic from 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The VPC firewall rules are blocking ingress from on-premises; add a rule allowing traffic from 192.168.0.0/16 to the database IP.. The issue is likely that the VPC firewall rules are blocking ingress traffic from the on-premises network. Even though the database OS firewall is permissive, the VPC firewall must allow ingress from the on-premises IP range (192.168.0.0/16) to the database's IP. Option B is correct: Create a firewall rule allowing ingress from 192.168.0.0/16 to 10.0.0.10 on the required port.

Answer

The database instance's OS firewall is blocking the traffic despite the setting.

Answer

The Cloud Router is not advertising the specific database IP 10.0.0.10, only the subnet 10.0.0.0/24.

Answer

The BGP session is not establishing properly; check the shared secret and IP addresses.

Question 15

A company wants to establish a VPC peering connection between two VPCs in different projects. Which two steps are mandatory to create the peering connection?

Accepted Answer

Ensure the VPCs have non-overlapping subnet IP address ranges.. VPC peering relies on private IP routing between the two VPCs. If the IP address ranges overlap, the VPC route tables cannot distinguish which VPC a packet belongs to, causing routing conflicts and preventing the peering connection from being established. Google Cloud requires that the VPCs have non-overlapping subnet CIDR blocks for successful peering.

Answer

Assign a public IP to the VMs in both VPCs.

Answer

Create a firewall rule allowing all traffic between the VPCs.

Answer

Configure a Cloud Router with BGP sessions.