PCNE Practice Questions

Question 1

A company is designing IP address plans for multiple VPCs that will be connected via VPC Network Peering and to an on-premises network via HA VPN with dynamic routing. Which three practices should be followed to avoid IP address conflicts?

Accepted Answer

Reserve IP ranges for future VPCs and on-premises expansion. To avoid overlap, use unique private IP ranges per VPC, plan for future growth, and document all ranges. Using RFC 1918 addresses and avoiding overlapping CIDRs ensures successful peering and VPN connectivity.

Answer

Use only public IP addresses for all GCP resources

Answer

Use the same IP range for all VPCs to simplify management

Question 2

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

Accepted Answer

USE_ORIGIN_HEADERS. USE_ORIGIN_HEADERS respects the origin's Cache-Control headers, so only objects with headers indicating public cacheability (e.g., Cache-Control: public) will be cached. This mode ensures that the CDN does not cache content that the origin marks as private or no-store. It is the most conservative caching mode and is suitable when the origin's caching directives are authoritative.

Answer

CACHE_ALL_STATIC

Answer

None of the above

Answer

FORCE_CACHE_ALL

Question 3

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking health check probes from Google Cloud. Hybrid connectivity NEGs rely on health checks from Google Cloud to determine endpoint health. If the on-premises firewall blocks these health check probes (which originate from Google's health check IP ranges), the NEG marks the endpoint as unhealthy, and Traffic Director stops routing traffic, causing connection timeouts. The most likely cause is the firewall blocking these probes.

Answer

The hybrid connectivity NEG is not supported with Traffic Director

Answer

The Cloud VPN tunnel is not established

Answer

Traffic Director requires mTLS for all hybrid endpoints

Question 4

An engineer is configuring a Global HTTPS Load Balancer with a serverless NEG pointing to Cloud Run. The deployment fails with a health check error. What is the most likely cause?

Accepted Answer

The serverless NEG does not support health checks. Serverless NEGs (Network Endpoint Groups) for Cloud Run do not support health checks because Cloud Run services are fully managed and inherently highly available. The load balancer cannot perform health checks on serverless backends; instead, it relies on the serverless platform's own health management. Therefore, attempting to configure a health check for a serverless NEG will cause a deployment failure. The most likely cause is that the serverless NEG does not support health checks.

Answer

The Cloud Run service is not deployed

Answer

The health check interval is too short

Answer

The SSL certificate is misconfigured

Question 5

A company wants to resolve DNS queries from their on-premises DNS servers for a private zone hosted in Cloud DNS. They also need GCP resources to resolve on-premises hostnames. Which combination of Cloud DNS features should they configure?

Accepted Answer

Both inbound and outbound DNS server policies. Inbound DNS server policy allows on-premises to forward queries to Cloud DNS private zones. Outbound DNS server policy allows GCP to forward queries to on-premises DNS servers.

Answer

Outbound DNS server policy only

Answer

DNS peering with the on-premises network

Answer

Inbound DNS server policy only

Question 6

A company uses Shared VPC with a host project and several service projects. They want to allow only a specific team to create subnets in the host project, and another team to use those subnets in their service projects. Which IAM roles should be assigned?

Accepted Answer

Compute Network Admin on host project for subnet creators; Compute Network User on host project for subnet users.. To create subnets, a user needs the Compute Network Admin role on the host project. To use subnets, a user needs the Compute Network User role on the host project or specific subnets.

Answer

Compute Network Admin on host project for both teams.

Answer

Compute Shared VPC Admin on host project for subnet creators; Compute Network User on host project for subnet users.

Answer

Compute Network User on host project for subnet creators; Compute Network Admin on service projects for subnet users.

Question 7

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

Accepted Answer

Use a Cloud Router with BGP and establish multiple BGP sessions over each Interconnect. Cloud Router with BGP enables dynamic routing, allowing multiple BGP sessions over each Cloud Interconnect. When one interconnect fails, BGP withdraws the affected routes, and traffic is automatically redistributed across the remaining BGP sessions without manual intervention. This meets the requirement for automatic failover and load balancing across the five 10 Gbps connections.

Answer

Configure multiple VLAN attachments on a single Cloud Router and rely on link aggregation

Answer

Deploy Cloud VPN tunnels as backup and configure static routes with lower priority

Answer

Configure VPC Network Peering between all data centers and Google Cloud

Question 8

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

Accepted Answer

Reserve a static internal IP address in the same region and subnetwork.. A static internal IP address is reserved within a specific region and subnetwork, ensuring the IP persists even after the VM is stopped or deleted. This meets the requirement for a fixed internal address that remains available for reassignment to the same or a different VM in the same subnet. Ephemeral IPs are released on VM stop/delete, and external IPs are not relevant for internal-only communication.

Answer

Configure an alias IP range on the VM's network interface.

Answer

Assign an ephemeral external IP and configure a firewall rule.

Answer

Use a regional internal IP address with auto-delete set to false.

Question 9

An engineer manages a global application using Global external HTTP(S) Load Balancer with URL map routing to multiple backend services. They want to enable Cloud CDN for the /images/* path. What is the correct way to enable CDN for that specific path?

Accepted Answer

Enable CDN on the backend service that serves /images/*. Cloud CDN is enabled at the backend service level, not at the load balancer or URL map level. Because the URL map routes /images/* to a specific backend service, enabling CDN on that backend service scopes caching precisely to that path. This is the supported and documented configuration model.

Answer

Use the gcloud compute url-maps add-path-matcher command with --cache-mode

Answer

Set a cache key header for /images/* in the URL map

Answer

Enable Cloud CDN at the load balancer level

Question 10

A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?

Accepted Answer

No additional configuration is needed.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs. Once enabled on the subnet, Google automatically adds a private route for the Google API IP ranges, so no further configuration is required. Therefore, option C is correct. Option A is incorrect because a default route to the internet would send traffic to the internet, not to Google APIs via private access. Option B is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.

Answer

A default route to the internet must be created.

Answer

A Cloud NAT must be configured.

Answer

The instances must have external IPs.

Question 11

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

Accepted Answer

Inbound DNS policy. Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Answer

DNS peering

Answer

Outbound DNS forwarding zone

Answer

Private zone with DNS forwarding

Question 12

An organization wants to reduce egress costs for data sent from Compute Engine instances to users worldwide. Which TWO approaches should they consider? (Choose TWO.)

Accepted Answer

Deploy instances in multiple regions closer to users.. Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network routes traffic over Google's network, which may not reduce egress cost but improves performance; however, Standard Tier egress is cheaper than Premium Tier for internet egress. For reducing costs, Cloud CDN and using Standard Tier (if acceptable) can help. But among the options, Cloud CDN and placing instances in multiple regions (to serve users locally) reduce egress.

Answer

Enable Private Google Access to avoid internet egress for Google APIs.

Answer

Use global load balancers instead of regional load balancers.

Answer

Use Premium Tier networking to route traffic over Google's network.

Question 13

A security team needs to capture all traffic to and from a specific Compute Engine instance for forensic analysis. They want to send the mirrored traffic to a third-party IDS appliance running on a separate VM in the same VPC. Which GCP feature should they use, and what is a key consideration?

Accepted Answer

Packet Mirroring, and the collector must be in the same VPC network as the mirrored instance. Packet Mirroring in GCP captures traffic to and from a specific Compute Engine instance and forwards it to a collector instance for analysis. A key requirement is that the collector must be in the same VPC network as the mirrored instance, ensuring the mirrored traffic can be delivered without crossing network boundaries. This makes it suitable for sending traffic to a third-party IDS appliance on a separate VM.

Answer

Firewall Rules Logging, which logs allow/deny events

Answer

VPC Flow Logs, since logs are stored in Stackdriver and can be exported

Answer

Cloud NAT logging, which logs all outbound connections

Question 14

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Accepted Answer

Verify the BGP session status on the Cloud Router.. BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Answer

Check the MTU configuration on the on-premises router.

Answer

Verify the physical interconnect location and cable connections.

Answer

Review the Cloud NAT configuration for the VPC network.

Question 15

A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?

Accepted Answer

Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.. Firewall rules are evaluated in order of priority (lower number = higher priority). The deny rule at priority 1000 will deny all IPs. To allow the VPN IP, a higher priority (lower number) allow rule must be created for that specific IP, before the deny rule is evaluated. The correct approach is to create an allow rule with priority 100 (or any lower number) for source IP 203.0.0.0/8 (or the specific IP) targeting web-server.

Answer

Modify the existing deny rule to include an exception for the VPN IP in the source IP field.

Answer

Delete the deny rule and create a single rule that denies all IPs except the VPN IP using the 'except' option.

Answer

Change the priority of the existing deny rule to 1 and create an allow rule with priority 2 for the VPN IP.

Google Professional Cloud Network Engineer PCNE practice test

Three ways to study

Study PCNE by domain

Study PCNE by topic

Configuring Network Services practice questions

Managing, Monitoring, and Optimising Network Operations practice questions

Implementing Hybrid Interconnectivity practice questions

Designing, Planning, and Prototyping a GCP Network practice questions

Implementing VPC Instances practice questions

Implementing network security practice questions

Implementing a Virtual Private Cloud practice questions

PCNE fundamentals practice questions

PCNE scenario practice questions

PCNE troubleshooting practice questions

Top PCNE questions

Google Professional Cloud Network Engineer practice questions