Hard — PCNE Practice Quiz

Question 1

A retail company runs a public web application behind a global external Application Load Balancer, protected by a Cloud Armor security policy. The security team enables the preconfigured SQL injection (sqli-v33-stable) WAF rule at its default sensitivity. Immediately, legitimate users report that they can no longer submit product reviews containing text like "O'Brien's shop is great", and logs show these requests are being blocked by the sqli rule. The team must keep strong SQLi protection but stop blocking valid review submissions. What is the most appropriate action?

Accepted Answer

Lower the preconfigured sqli rule sensitivity level and/or exclude the specific request field (the review body) from inspection using the rule's opt-out expression, then retest.

Answer

Delete the sqli-v33-stable rule entirely and rely on Adaptive Protection to detect any injection attempts automatically.

Answer

Add a higher-priority allow rule that matches all requests to the review submission URL path, bypassing WAF evaluation for that path.

Answer

Switch the security policy to preview (dry-run) mode so the sqli rule logs matches but never blocks any traffic.

Question 2

A fleet of 200 instances in a private subnet uses a single Cloud NAT gateway to reach an external payment API. During peak traffic, application logs show many outbound connections to the same API endpoint failing intermittently. Cloud Monitoring shows the 'dropped_sent_packets' metric for the NAT gateway spiking, while CPU and bandwidth on the instances remain low. What is the most likely cause and the correct remediation?

Accepted Answer

NAT port exhaustion because too few ports are allocated per VM for many connections to the same destination; increase minimum ports per VM or enable Dynamic Port Allocation.

Answer

The NAT gateway has reached its bandwidth limit; add a second Cloud NAT gateway in the same region to load-balance egress.

Answer

MTU mismatch on the egress path; lower the interface MTU to 1460 on all instances to prevent fragmentation drops.

Answer

The default route to the internet gateway was deleted; recreate the 0.0.0.0/0 route pointing to the default internet gateway.

Question 3

A financial services company runs Compute Engine VMs with no external IP addresses in a private subnet. The security team requires two things for internet egress: (1) all outbound HTTP/HTTPS traffic must be restricted to an approved list of FQDNs (e.g., only *.partnerbank.com and api.provider.net), and (2) any non-HTTP(S) egress that is still permitted must be source-NATed through a predictable set of static IP addresses so partners can allowlist them. What should you deploy to meet BOTH requirements with the least operational overhead?

Accepted Answer

Deploy Secure Web Proxy with a URL/FQDN allowlist policy for HTTP/HTTPS egress, and configure Cloud NAT with manually assigned static external IP addresses for the remaining permitted egress traffic.

Answer

Configure Cloud NAT with automatic IP allocation and add hierarchical firewall rules that match destination FQDNs to filter HTTP/HTTPS egress.

Answer

Deploy a self-managed NGINX proxy appliance with IP forwarding as the only egress path and rely on Cloud Armor named IP lists to restrict destinations.

Answer

Use VPC Service Controls perimeters to restrict egress to approved FQDNs and enable Private Google Access so VMs reach the internet through Google's front end.

Question 4

A workload on VM-A (subnet 10.0.1.0/24) cannot reach an internal passthrough Network Load Balancer VIP in another VPC connected via VPC peering. You run a Connectivity Test from VM-A to the VIP, and the test reports 'Reachable' for the forward path. However, actual application traffic still times out. You suspect an asymmetric routing or return-path problem. Which action within Network Intelligence Center best confirms the return-path issue?

Accepted Answer

Run a second Connectivity Test with the source and destination reversed (from the backend/VIP side toward VM-A) to evaluate the return path independently.

Answer

Increase the VPC Flow Logs sampling rate to 100% on VM-A's subnet and wait for the timeout to appear in logs.

Answer

Enable Firewall Rules Logging on VM-A's egress rule and confirm packets are being allowed outbound.

Answer

Review the Performance Dashboard for packet loss between the two Google Cloud regions hosting the VPCs.

Question 5

Your security team requires that a set of Compute Engine instances in the 'restricted-vpc' custom-mode VPC have absolutely no direct path to the public internet, while still allowing them to reach Google APIs privately. Currently the VPC has the default 0.0.0.0/0 route pointing to the default internet gateway. The instances have no external IP addresses. What is the most effective way to guarantee these instances cannot egress to the internet through the default gateway while preserving private access to Google APIs?

Accepted Answer

Delete the default 0.0.0.0/0 route to the default internet gateway, enable Private Google Access on the relevant subnets, and add a route for restricted.googleapis.com via the default internet gateway.

Answer

Keep the default route but attach a network tag to the instances and create a deny-all egress firewall rule that blocks 0.0.0.0/0 for that tag.

Answer

Remove the external IP addresses from the instances and rely on the absence of Cloud NAT to prevent internet egress.

Answer

Lower the priority of the default internet gateway route to 65535 so that Private Google Access routes are always preferred.

Question 6

Your company runs a custom-mode VPC with many Compute Engine instances in the subnet 10.20.0.0/16. Most instances must send all internet-bound traffic through a self-managed NAT/firewall appliance (a VM with IP 10.20.1.10) for inspection. However, a small group of instances tagged 'direct-egress' must instead use the default internet gateway route for maximum throughput and bypass inspection. Both route types point to 0.0.0.0/0. How should you configure routing so that only the tagged instances bypass the appliance?

Accepted Answer

Create a custom static route for 0.0.0.0/0 with next hop the appliance VM and no tags, and create a second custom static route for 0.0.0.0/0 with the network tag 'direct-egress', next hop default internet gateway, and a lower (better) priority value.

Answer

Delete the default internet gateway route, then create a single tagged static route for 'direct-egress' instances pointing to the internet gateway; untagged instances will automatically fall back to the appliance.

Answer

Apply a hierarchical firewall policy that forces untagged instances through the appliance and allows tagged instances direct egress.

Answer

Configure Cloud NAT for the subnet and attach the 'direct-egress' tag to the NAT gateway so only tagged instances use it.

Question 7

Your company deployed a firewall virtual appliance in a VPC to inspect all egress traffic to the internet. You created a custom static route with destination 0.0.0.0/0 and next hop set to the appliance instance, with priority 1000. However, traffic from workload VMs is still bypassing the appliance and going directly to the internet via the default route. You need all workload VM egress to flow through the appliance while leaving other VMs unaffected. What should you do?

Accepted Answer

Create a new custom static route to 0.0.0.0/0 with next hop the appliance, set a priority value lower than 1000 (e.g., 100), and apply an instance tag that matches only the workload VMs.

Answer

Delete the default 0.0.0.0/0 internet gateway route so that the appliance route becomes the only default route in the VPC.

Answer

Increase the priority value of the existing appliance route to 2000 so it takes precedence over the default internet gateway route.

Answer

Add a network tag to the appliance instance and reference that tag in the existing route so only tagged traffic is forwarded.

Question 8

Your organization runs three separate VPC networks (prod-vpc, staging-vpc, and tools-vpc) that are not peered with each other. A central 'shared-services-vpc' hosts a Cloud DNS private zone (internal.example.com) plus an inbound forwarding configuration that resolves on-premises records. You need all three isolated VPCs to resolve both the internal.example.com records and the on-premises records managed in shared-services-vpc, without creating full mesh VPC peering and without duplicating zone data in each VPC. What should you implement?

Accepted Answer

Create a Cloud DNS peering zone in each of the three VPCs that targets shared-services-vpc as the DNS peering network.

Answer

Configure VPC Network Peering between each isolated VPC and shared-services-vpc, then rely on automatic DNS resolution across the peering.

Answer

Create a private DNS forwarding zone in each VPC pointing to the inbound forwarder IP of shared-services-vpc for all queries.

Answer

Attach all three VPCs as spokes to a Network Connectivity Center hub so DNS zones are shared automatically across the mesh.

Question 9

Your team runs a UDP-based gaming service on Compute Engine instances in us-central1. You need a regional external passthrough Network Load Balancer that supports weighted distribution across backends, connection draining during instance removal, and non-legacy health checks. You are choosing the backend architecture for the load balancer. Which configuration meets these requirements?

Accepted Answer

A backend service-based external passthrough Network Load Balancer using a regional backend service with a managed instance group backend

Answer

A target pool-based external passthrough Network Load Balancer with an HTTP health check attached to the target pool

Answer

A global external Application Load Balancer with a serverless NEG backend

Answer

An internal passthrough Network Load Balancer with a regional backend service and session affinity

Question 10

Your team runs a VPC-native GKE cluster with a Pod secondary range of 10.60.0.0/14. Pods must communicate with an on-premises database at 172.16.5.10 reachable over Cloud Interconnect. The on-premises firewall only permits traffic sourced from the cluster's node subnet (10.10.0.0/24). Currently, connections from Pods to the on-premises database are being dropped because the on-premises firewall sees the Pod IP addresses as the source. What is the correct way to resolve this while keeping intra-cluster and Google API traffic unmasqueraded?

Accepted Answer

Deploy the ip-masq-agent DaemonSet and configure a nonMasqueradeCIDRs list that includes the Pod, Service, and Google API ranges, so that only traffic to on-premises destinations is SNATed to the node IP.

Answer

Add a custom static route in the VPC directing 172.16.5.10/32 through the Cloud Router, which will automatically rewrite the Pod source addresses to the node subnet.

Answer

Enable Private Google Access on the node subnet so Pod traffic to on-premises is translated to the subnet's primary range.

Answer

Configure Cloud NAT for the Pod secondary range so that Pod egress to on-premises appears to come from the node subnet.

Question 11

Your team deployed a private GKE cluster with a private control plane endpoint. The control plane runs in a Google-managed VPC that is connected to your cluster's VPC using VPC Network Peering. Developers connecting from an on-premises data center over an HA VPN tunnel to your VPC report they cannot reach the private control plane endpoint, even though nodes in the cluster communicate with it successfully. What is the most likely cause and how should you resolve it?

Accepted Answer

The VPC peering with the control plane's Google-managed VPC does not export custom routes by default; enable custom route export on the peering so the on-premises VPN routes are advertised to the control plane.

Answer

The on-premises CIDR must be added to the cluster's authorized networks list, but private endpoint access from on-premises additionally requires custom route exchange on the peering to be disabled.

Answer

Private control plane endpoints only accept traffic from within the cluster's VPC; on-premises access is impossible and you must enable the public endpoint instead.

Answer

The HA VPN tunnel is advertising the wrong MED value, so Cloud Router is deprioritizing the control plane route; raise the tunnel priority to fix reachability.

Question 12

Your company is deploying a new GKE cluster to host a microservices platform. Security requires that cluster nodes have no public IP addresses. The platform team expects the number of Pods to grow significantly over the next two years, and they want to avoid re-creating the cluster to accommodate more Pod IPs. The cluster will run in an existing Shared VPC subnet that already has a primary range and one secondary range reserved for Services. How should you design the cluster's IP addressing?

Accepted Answer

Create a VPC-native (alias IP) private cluster and assign a secondary range for Pods that you can later expand with additional non-contiguous secondary ranges (multi-Pod CIDR).

Answer

Create a routes-based private cluster and rely on custom static routes so more Pod IPs can be added without re-creating the cluster.

Answer

Create a VPC-native public cluster using the subnet primary range for Pods so the range can be resized in place at any time.

Answer

Create a VPC-native private cluster and place both Pods and Services in the single existing Services secondary range to conserve address space.

Question 13

A large enterprise organizes its Google Cloud resources with an organization node, a 'security-controls' folder, and multiple team folders beneath it. The central security team defines a hierarchical firewall policy attached at the organization level that must enforce a mandatory deny on all inbound RDP (TCP 3389) from the internet, while allowing individual application teams to define their own rules for other traffic in their project-level network firewall policies. However, for a specific range of trusted corporate egress IPs, the security team wants lower-level policies and rules to be able to make the final allow/deny decision for RDP rather than having it blocked at the org level. Which configuration correctly meets these requirements?

Accepted Answer

Create an org-level hierarchical policy with a 'deny' rule for TCP 3389 from 0.0.0.0/0, plus a higher-priority 'goto_next' rule for TCP 3389 from the trusted corporate IP range.

Answer

Create an org-level hierarchical policy with an 'allow' rule for TCP 3389 from the trusted corporate IP range, and rely on VPC implied rules to deny all other RDP.

Answer

Create the deny rule for TCP 3389 only in each project's network firewall policy, since hierarchical policies cannot use the 'goto_next' action.

Answer

Attach the hierarchical policy to the 'security-controls' folder with a single 'deny' rule for TCP 3389, which automatically exempts the trusted IP range through evaluation order.

Question 14

A financial services company uses a Google Cloud organization with three folders: 'prod', 'dev', and 'shared-services'. The central security team must enforce a non-overridable rule that blocks all inbound RDP (TCP 3389) traffic to every VPC in the organization, while allowing individual project teams to still define their own additional allow/deny rules for other ports. The security team also wants a separate rule in the 'dev' folder that permits SSH (TCP 22) from the corporate CIDR range, but this rule should be evaluatable by lower-level project rules if they choose to override. Which design meets these requirements?

Accepted Answer

Create an organization-level hierarchical firewall policy with a 'deny' rule for TCP 3389 using the 'goto_next' action disabled, and a folder-level hierarchical firewall policy on 'dev' with a rule for TCP 22 that uses the 'goto_next' action so evaluation is delegated to (and thus overridable by) lower-level policies.

Answer

Create VPC firewall rules in every project to deny TCP 3389 and rely on project owners to keep them in sync; add an allow rule for TCP 22 in each 'dev' project.

Answer

Create an organization-level hierarchical firewall policy with an 'allow' rule for TCP 3389 and a folder-level policy on 'dev' that denies TCP 22, both using 'goto_next' so projects can override them.

Answer

Create a single VPC-level firewall policy in the Shared VPC host project that denies TCP 3389 for all attached service projects and allows TCP 22 in the 'dev' subnet ranges.

Question 15

A company runs an application on Compute Engine VMs in a VPC configured with an MTU of 1460. The VMs communicate with an on-premises data center over an HA VPN tunnel. Users report that small requests succeed, but large file transfers and certain database queries hang or time out intermittently. Ping with default packet sizes works fine between the VMs and on-premises hosts. What is the MOST likely cause and the correct action to resolve it?

Accepted Answer

Packets larger than the VPN tunnel's supported MTU are being dropped because the payload exceeds the overhead-adjusted limit; lower the MTU/MSS on the endpoints or enable MSS clamping so TCP segments fit within the tunnel.

Answer

The VPC firewall is blocking large packets; add an ingress rule permitting packet sizes above 1400 bytes.

Answer

BGP on the Cloud Router is advertising incorrect routes; reset the BGP session to re-learn the on-premises prefixes.

Answer

VPC Flow Logs sampling is too low to capture the large transfers; increase the sampling rate to 1.0 to restore connectivity.

Question 16

Your company uses Network Connectivity Center with a single hub to connect four regional VPC spokes. Currently all spokes can communicate with each other in a full mesh. A new security requirement mandates that two of the spokes (spoke-C and spoke-D) must only be able to reach spoke-A (a shared services VPC) and must NOT be able to reach each other or spoke-B. You want to enforce this at the connectivity layer without deploying firewall appliances. What should you do?

Accepted Answer

Create a new Network Connectivity Center hub configured for star topology (topology is set at hub creation and cannot be changed in place), designating spoke-A as the center and spoke-C/spoke-D as edge spokes so they can only communicate with the center spoke.

Answer

Create a second Network Connectivity Center hub and move spoke-C and spoke-D to it, then peer the two hubs together.

Answer

Keep the mesh topology and rely on VPC Network Peering export/import route filtering between spoke-C, spoke-D, and spoke-B.

Answer

Add hierarchical firewall policies at the organization level that block traffic between spoke-C, spoke-D, and spoke-B.

Question 17

A retail company runs an SD-WAN overlay connecting 40 physical stores. Each store already has an SD-WAN edge appliance. The networking team wants to bring this SD-WAN fabric into Google Cloud so that store traffic can reach workloads in a central VPC, and they want to deploy virtual SD-WAN appliances inside the VPC that peer with the on-prem edges using BGP. They need a Google-managed hub that dynamically exchanges routes between these virtual appliances and the VPC without building point-to-point VPN tunnels for every store. Which design should they use?

Accepted Answer

Deploy the virtual SD-WAN instances as Router appliance spokes attached to a Network Connectivity Center hub, and establish BGP sessions between the appliances and Cloud Router.

Answer

Create HA VPN gateways in the VPC and configure one pair of tunnels per store directly to each SD-WAN edge appliance.

Answer

Use VPC Network Peering between the central VPC and a transit VPC that hosts the virtual SD-WAN appliances so routes propagate automatically.

Answer

Attach the central VPC as a VPC spoke to a Network Connectivity Center hub and rely on Private Service Connect to reach the on-prem edges.

Question 18

A security engineer manages a global network firewall policy in a Shared VPC host project. Application VMs in multiple service projects need a rule that allows TCP 8443 traffic only between VMs that share a common workload identity, regardless of their IP addresses, which change frequently due to autoscaling. The engineer wants the rule to remain valid even if VMs are recreated with new IPs, and to work across the VPC network. Which approach should the engineer use to define the source and target in the network firewall policy rule?

Accepted Answer

Use secure tags (resource manager tags bound to the VM instances) as both the source and target in the firewall policy rule.

Answer

Use network tags on the VM instances as both the source and target in the firewall policy rule.

Answer

Create named IP lists in Cloud Armor referencing the VM IPs and reference them in the firewall policy rule.

Answer

Use service accounts as the source and a CIDR range covering the subnet as the target in the firewall policy rule.

Question 19

Your company runs on-premises data-processing servers that must call Google Cloud APIs (Cloud Storage and BigQuery) without traversing the public internet. These servers connect to your VPC through an existing HA VPN tunnel and use only internal RFC 1918 addresses. You must ensure the on-premises hosts can reach the Google APIs privately through the tunnel using the default domains (e.g., storage.googleapis.com), with minimal ongoing management. What should you design?

Accepted Answer

Enable Private Google Access for on-premises hosts by routing the restricted.googleapis.com (199.36.153.4/30) range through the VPN and configuring Cloud DNS response policy zones to resolve Google API domains to that VIP range.

Answer

Enable Private Google Access on each subnet in the VPC and rely on the subnet setting to automatically extend private API access to the on-premises hosts over the VPN.

Answer

Assign public IP addresses to the on-premises servers and add firewall rules that allow egress only to the published Google API public IP ranges.

Answer

Create a Private Service Connect endpoint for each Google API and advertise the endpoint's public IP addresses to on-premises over the VPN via Cloud Router.

Question 20

Your organization uses a Shared VPC host project managed by the central networking team. Application teams operate in service projects and repeatedly file tickets asking networking to create firewall rules for their specific workloads. The networking team wants to delegate firewall rule management for one particular subnet's workloads to an application team, while retaining control over the overall VPC, subnets, and routing. What is the most appropriate way to achieve this?

Accepted Answer

Grant the application team the compute.securityAdmin role at the host project level, but limit exposure by using an IAM condition or by having them manage rules scoped through network tags they own.

Answer

Grant the application team the compute.securityAdmin role on the host project so they can manage all firewall rules and SSL policies.

Answer

Create firewall rules that target the application team's service accounts, then grant the team the Network Admin role on the host project.

Answer

Migrate the application team's workloads out of the Shared VPC into a standalone VPC in the service project so they can manage their own firewall rules.

Question 21

Your company connects an on-premises data center to a Google Cloud VPC using two HA VPN tunnels terminating on a single Cloud Router in region us-central1. Both tunnels advertise the same on-premises prefix 10.50.0.0/16 via BGP. You want tunnel-1 to be the active path and tunnel-2 to serve only as a backup, becoming active automatically if tunnel-1 fails. Which configuration achieves this?

Accepted Answer

Configure the on-premises router to advertise 10.50.0.0/16 to Cloud Router with a lower MED value on tunnel-1 than on tunnel-2.

Answer

Configure the on-premises router to advertise 10.50.0.0/16 with a lower AS-path prepend on tunnel-1, and rely on the VPC's default route priority of 1000 for both tunnels.

Answer

Set a lower Cloud Router advertised route priority (MED) on the BGP session for tunnel-1 than on tunnel-2 so that Google Cloud prefers the tunnel-1-learned route.

Answer

Create a custom static route to 10.50.0.0/16 with priority 100 pointing at tunnel-1 and priority 200 pointing at tunnel-2.

Question 22

Your company runs two custom-mode VPCs, prod-vpc and hybrid-vpc, connected via VPC Network Peering. hybrid-vpc has a Cloud Router and HA VPN tunnels to your on-premises data center, and Cloud Router learns on-premises prefixes via BGP as dynamic routes. Instances in prod-vpc need to reach on-premises hosts, but after establishing the peering they still cannot connect, even though instances in hybrid-vpc reach on-premises successfully. What must you do so prod-vpc can use the on-premises routes?

Accepted Answer

Enable exchange of custom routes (export) on the hybrid-vpc side of the peering and import of custom routes on the prod-vpc side.

Answer

Create a Cloud Router in prod-vpc and configure it to peer with the same on-premises BGP router.

Answer

Add static routes in prod-vpc pointing to the HA VPN gateway in hybrid-vpc as the next hop.

Answer

Delete and recreate the peering with transitive routing enabled so learned routes propagate automatically.

Question 23

Your company has two custom-mode VPCs, prod-vpc and analytics-vpc, connected via VPC Network Peering. After the peering is established and reported as ACTIVE, engineers in analytics-vpc can reach existing instances in prod-vpc. A network admin later creates a brand-new subnet (10.30.0.0/20) in prod-vpc and launches instances there, but analytics-vpc instances cannot reach the new subnet. No firewall rules are blocking the traffic, and the peering state is still ACTIVE. What is the most likely explanation?

Accepted Answer

Subnet routes for new subnets are exchanged automatically across active peering connections, so the new subnet's /20 range likely overlaps with a range already in analytics-vpc, causing the route to be dropped.

Answer

Subnet routes for newly created subnets are automatically exchanged across an active peering, so the issue must be a missing custom route import setting that only affects new subnets.

Answer

VPC Network Peering does not automatically propagate subnet routes created after peering; the peering must be deleted and re-created to pick up the new subnet range.

Answer

The new subnet needs a manually created static route in analytics-vpc pointing to the peering connection, because peering only exchanges routes for subnets that existed at creation time.

Question 24

A healthcare company has two separate business units, each with its own VPC Service Controls perimeter protecting Cloud Storage and BigQuery. Unit A's data-science team runs analytics jobs that must read anonymized datasets stored in a Cloud Storage bucket owned by a project inside Unit B's perimeter. Both perimeters must otherwise remain isolated from each other and from the public internet, and no data must be allowed to leave either perimeter to unauthorized projects. What is the recommended way to enable only this specific cross-perimeter access?

Accepted Answer

Create a VPC Service Controls perimeter bridge that includes only the two specific projects that must share the bucket, allowing bidirectional access between just those projects.

Answer

Merge both business units into a single service perimeter so all projects can communicate freely without ingress or egress rules.

Answer

Add the public IP ranges of Unit A's analytics VMs to an access level and attach it to Unit B's perimeter.

Answer

Remove Cloud Storage from the restricted services list in Unit B's perimeter so external projects can reach the bucket.