PCNE sample questions

Question 1

You want to configure a NAT to perform address translation between your on-premises network blocks and GCP. Which NAT solution should you use?

Accepted Answer

Cloud NAT

Answer

An instance with IP forwarding enabled

Answer

An instance configured with iptables DNAT rules

Answer

An instance configured with iptables SNAT rules

Question 2

You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect. What should you do?

Accepted Answer

Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.

Answer

Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.

Answer

Create a secure perimeter using VPC Service Co-ntrols, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.

Answer

Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.

Question 3

You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT. What is the most likely cause of this problem?

Accepted Answer

An external IP address has been configured on the instance.

Answer

The instance has been configured with multiple interfaces.

Answer

You have created static routes that use RFC1918 ranges.

Answer

The instance is accessible by a load balancer external IP address.

Question 4

You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.

Which two methods can you use to accomplish this? (Choose two.)

Accepted Answer

gcloud projects add-iam-policy-binding Sprojectname -member usenSusername -role roles/editor

Accepted Answer

Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.

Answer

GetlamPolicyO via REST API

Answer

setlamPolicyQ via REST API

Answer

gcloud pubsub add-iam-policy-binding Sprojectname -member usenSusername -role roles/editor

Question 5

A DevOps team needs to deploy a fleet of third-party security appliances as Network Virtual Appliances (NVAs) to inspect all traffic between a 'webapp' subnet and a 'database' subnet within the same VPC. You must ensure high availability for the inspection service. Which configuration should you implement?

graph TD subgraph VPC subgraph WebApp Subnet WebAppVM[Web App VM] end subgraph NVA Subnet ILB[Internal TCP/UDP LB] NVA1[NVA Instance 1] NVA2[NVA Instance 2] ILB --> NVA1 ILB --> NVA2 end subgraph Database Subnet DBVM[Database VM] end end WebAppVM -- Route --> ILB -- Inspected --> DBVM

Accepted Answer

Deploy the NVAs in a managed instance group. Place them behind an Internal TCP/UDP Load Balancer. Create a custom static route targeting traffic to the 'database' subnet, with the next-hop set to the forwarding rule of the Internal Load Balancer.

Answer

Create an unmanaged instance group for the NVAs and use an External Network Load Balancer as the next hop in a custom route.

Answer

Deploy the NVAs in a managed instance group. Create a custom static route with the destination as the 'database' subnet and set the next hop to the IP address of one of the NVA instances.

Answer

Configure each NVA with multiple NICs, one in each subnet. Use policy-based routing on the source VMs to direct traffic to the NVAs.

Question 6

You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.

What should you do?

Accepted Answer

Configure VPC peering in a full mesh.

Answer

Alter the routing table to resolve the asymmetric route.

Answer

Create network tags to allow connectivity between all three VPCs.

Answer

Delete the legacy network and recreate it to allow transitive peering.

Question 7

Your company’s Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure:

Which solution should you recommend?

Accepted Answer

Leave the directory structure as-is, create a URL map and leverage a path rule such as /‘/video and /*/audio.

Answer

Rearrange the directory structure, create a URL map and leverage a path rule such as /video/* and /audio/*.

Answer

Rearrange the directory structure, create DNS hostname entries for video and audio and leverage a path rule such as /video/* and /audio/*.

Answer

Leave the directory structure as-is, create a URL map and leverage a path rule such as V[a-z]{2}Vvideo and V[a-z]{2}Vaudio.

Question 8

You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.

What should you do?

Accepted Answer

• Create a Cloud VPN instance. • Create a route-based VPN tunnel. • Configure the appropriate local and remote traffic selectors to 0.0.0.0/0. • Configure the appropriate static routes.

Answer

• Create a Cloud VPN instance.
• Create a policy-based VPN tunnel per subnet.
• Configure the appropriate local and remote traffic selectors to match your local and remote networks.
• Create the appropriate static routes.

Answer

• Create a Cloud VPN instance.
• Create a policy-based VPN tunnel.
• Configure the appropriate local and remote traffic selectors to match your local and remote networks.
• Configure the appropriate static routes.

Answer

• Create a Cloud VPN instance.
• Create a route-based VPN tunnel.
• Configure the appropriate local and remote traffic selectors to match your local and remote networks.
• Configure the appropriate static routes.

Question 9

You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.

What should you do?

Accepted Answer

Disable DNSSEC at your domain registrar.

Answer

Update the TTL for the zone.

Answer

Set the zone to the TRANSFER state.

Answer

Transfer ownership of the domain to a new registrar.

Question 10

Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load- balanced across the 2 connections as desired.

During troubleshooting you find:

• Each on-premises router is configured with the same ASN.
• Each on-premises router is configured with the same routes and priorities.
• Both on-premises routers are configured with a VPN connected to a single Cloud Router.
• The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
• BGP session is not established between one on-premises router and the Cloud Router.

What is the most likely cause of this problem?

Accepted Answer

You do not have a load balancer to load-balance the network traffic.

Answer

One of the VPN sessions is configured incorrectly.

Answer

A firewall is blocking the traffic across the second VPN connection.

Answer

BGP sessions are not established between both on-premises routers and the Cloud Router.

PCNE Practice Questions

Unlock the full exam and previous versions

Create an account to continue.

Create an account to continue.

Related exams