Medium — PCNE Practice Quiz

Question 1

A retail company started with a single auto-mode VPC that automatically created a /20 subnet in every Google Cloud region. As they expand globally and plan to add many custom subnets, peer with a partner VPC, and tightly control IP address allocation per region, the network team is concerned about the fixed 10.128.0.0/9 range auto mode uses and the risk of overlap with the partner. What is the recommended approach to gain full control of subnet CIDR planning while preserving existing workloads?

Accepted Answer

Convert the auto-mode VPC to custom mode, then manually manage all subnet ranges going forward

Answer

Delete the auto-mode VPC and recreate all resources in a brand-new custom-mode VPC

Answer

Enable a hierarchical firewall policy to override the auto-mode subnet ranges

Answer

Add secondary IP ranges to each auto-created subnet to replace the primary ranges

Question 2

You are designing a new production VPC for a retail company. The network must connect to two on-premises data centers via HA VPN, and the on-premises teams have already allocated the 10.128.0.0/9 range for their infrastructure. The cloud team wants precise control over which regions have subnets and the exact CIDR ranges used, to avoid any overlap with on-premises addressing. Which VPC design should you choose?

Accepted Answer

Create a custom mode VPC and manually define subnets only in the regions you need with non-overlapping CIDR ranges.

Answer

Create an auto mode VPC so subnets are automatically provisioned in every region with predefined ranges.

Answer

Create an auto mode VPC and rely on custom routes to prevent overlap with the on-premises 10.128.0.0/9 range.

Answer

Create a custom mode VPC but let Google auto-assign secondary ranges to guarantee no overlap.

Question 3

You are designing a new production VPC for a company that will initially deploy workloads in us-central1 and europe-west1, with plans to add three more regions over the next two years. The network team requires strict control over which subnet CIDR ranges exist in each region and wants to avoid any automatically created subnets that could later overlap with on-premises ranges reachable over Cloud Interconnect. Which VPC design best meets these requirements?

Accepted Answer

Create a custom mode VPC and manually define subnets with explicitly chosen CIDR ranges only in the regions you intend to use.

Answer

Create an auto mode VPC, then delete the subnets in unused regions to prevent CIDR overlap with on-premises networks.

Answer

Create an auto mode VPC because it automatically assigns non-overlapping ranges and later convert it to custom mode when adding regions.

Answer

Create a custom mode VPC and enable auto-subnet creation so new regions receive predefined 10.128.0.0/9 ranges as they launch.

Question 4

Your company runs a Classic VPN gateway connecting its on-premises data center to a Google Cloud VPC. The Classic VPN uses static routes and a single tunnel. Leadership now requires a 99.99% availability SLA for this hybrid connection. Which approach correctly migrates the connectivity to meet the SLA requirement?

Accepted Answer

Deploy an HA VPN gateway with two interfaces, configure two tunnels to two separate on-premises peer devices (or a single device with two interfaces), and establish BGP sessions through a Cloud Router.

Answer

Add a second static-route tunnel to the existing Classic VPN gateway and enable ECMP so both tunnels carry traffic simultaneously.

Answer

Upgrade the Classic VPN gateway to enable dynamic routing with a Cloud Router while keeping the single tunnel, since BGP alone provides the 99.99% SLA.

Answer

Deploy an HA VPN gateway with a single tunnel to one on-premises peer device and configure a Cloud Router with BGP for automatic failover.

Question 5

A retail company runs a public storefront behind a global external Application Load Balancer with a Cloud Armor security policy attached to the backend service. During a flash sale, the site experiences a sudden surge of HTTP requests that appear to originate from thousands of distinct IP addresses with subtly varied request patterns, overwhelming the backends. The security team cannot manually author rate-limit or IP-deny rules fast enough to keep pace with the shifting attack signatures. Which Cloud Armor capability should they enable to automatically detect and generate a suggested mitigation rule for this Layer 7 volumetric attack?

Accepted Answer

Enable Adaptive Protection on the Cloud Armor security policy so it baselines normal traffic and auto-generates a suggested rule to mitigate the anomalous Layer 7 attack.

Answer

Configure a preconfigured WAF rule using the OWASP ModSecurity Core Rule Set (CRS) to block the SQL injection signatures in the requests.

Answer

Attach a rate-limiting throttle rule keyed on a single named IP address list containing the known attacker ranges.

Answer

Enable edge security policies with a country-based geo-match deny rule to block the source region generating the traffic.

Question 6

Your company serves static assets from a Cloud Storage backend bucket behind a global external Application Load Balancer with Cloud CDN enabled. Security wants to block requests from a list of known malicious IP ranges as early as possible—ideally at Google's edge and even for cached content served by CDN—before those requests reach the backend bucket or consume cache resources. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Attach an edge security policy to the backend bucket with deny rules matching the malicious IP ranges

Answer

Attach a backend security policy to the backend bucket with deny rules matching the malicious IP ranges

Answer

Configure a hierarchical firewall policy at the organization level to deny the malicious IP ranges

Answer

Add a VPC network firewall rule denying the malicious IP ranges on the load balancer's forwarding rule

Question 7

Your security team wants to allow a large SaaS partner's published IP ranges to reach your global external Application Load Balancer while blocking all other source IPs. The partner distributes their egress ranges as a curated list that Google maintains and updates automatically. You must implement this in a Cloud Armor security policy with minimal ongoing maintenance and without exceeding rule limits from listing hundreds of individual CIDRs. Which approach should you use?

Accepted Answer

Create a Cloud Armor security-policy rule whose match expression references the partner named IP address list (address-group / named IP list), set the rule action to allow, and add a default deny rule at the lowest priority.

Answer

Add every partner CIDR block as separate allow rules in the Cloud Armor policy and rely on rule priority to deny remaining traffic.

Answer

Configure a VPC firewall rule with the partner CIDRs as source ranges and attach it to the load balancer backend instances.

Answer

Enable Cloud Armor Adaptive Protection so it automatically learns and allowlists the partner's traffic patterns.

Question 8

You manage a Google Cloud Armor security policy attached to a global external Application Load Balancer serving a production e-commerce site. Your security team wants to introduce a new WAF rule that blocks requests matching a broad regular expression, but they are concerned it may inadvertently block legitimate customer traffic. They need to evaluate the real-world impact of the rule against live production traffic before it actually starts denying any requests. What should you configure?

Accepted Answer

Add the rule with the '--preview' flag enabled so matches are logged in Cloud Logging without enforcing the deny action.

Answer

Add the rule with action 'deny(403)' but set the rule to a lower priority than the default rule so it is never evaluated first.

Answer

Deploy the rule in a separate Cloud Armor edge security policy and monitor Adaptive Protection alerts before promoting it.

Answer

Enable Cloud Armor rate limiting in 'throttle' mode so the rule only restricts a percentage of matching requests during testing.

Question 9

An e-commerce company runs a public web application behind a global external Application Load Balancer protected by Google Cloud Armor. During flash sales, individual clients sometimes send bursts of requests to the /api/checkout path, degrading the backend for everyone. The security team wants to allow legitimate traffic to continue but automatically throttle any single client IP that exceeds 100 requests per minute to that path, without permanently blocking the client. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Create a throttle rule with rate_limit_options specifying a count of 100 per 60-second interval and enforce_on_key set to IP, matching requests to /api/checkout.

Answer

Create a rate-based ban rule with action 'deny(429)' that permanently blocks clients exceeding the threshold.

Answer

Enable Adaptive Protection on the security policy so it automatically learns and mitigates the traffic burst.

Answer

Configure Cloud NAT with a reduced minimum ports-per-VM setting to limit the number of concurrent client connections.

Question 10

A media company serves images through a global external Application Load Balancer with Cloud CDN enabled and cache mode set to CACHE_ALL_STATIC. An editor replaces the file at /assets/hero.jpg with corrected artwork, but users worldwide continue to receive the old image because it is still cached at Google's edge locations with a long TTL. The team needs the corrected image served immediately without waiting for the TTL to expire, and they want to minimize disruption to other cached content. What should they do?

Accepted Answer

Issue a Cloud CDN cache invalidation for the path /assets/hero.jpg on the backend service.

Answer

Disable Cloud CDN on the backend service and re-enable it to clear all cached objects.

Answer

Change the cache mode to USE_ORIGIN_HEADERS so the edge caches respect the origin's freshness.

Answer

Lower the default TTL on the backend service so the object expires from cache sooner.

Question 11

A media company hosts static images and CSS/JS bundles on a Cloud Storage bucket fronted by a global external Application Load Balancer with Cloud CDN enabled. The origin responses do NOT include any Cache-Control headers. The team wants Cloud CDN to cache as much of this static content as possible without requiring the developers to modify origin headers, while still respecting any explicit no-cache directives if they are added later. Which Cloud CDN cache mode should they configure?

Accepted Answer

CACHE_ALL_STATIC, which caches successful responses for common static content types even without cache headers, but honors explicit no-cache directives

Answer

USE_ORIGIN_HEADERS, so caching only occurs when the origin explicitly sets caching headers

Answer

FORCE_CACHE_ALL, which caches all successful responses and ignores any origin cache directives

Answer

BYPASS_CACHE, which forwards all requests to the origin without caching

Question 12

Your company hosts a large library of static marketing assets (images, PDFs, videos) in a Cloud Storage bucket. You want to serve these assets globally with low latency and caching, using a global external Application Load Balancer with Cloud CDN enabled. The team wants the simplest configuration that requires no compute instances and lets Cloud CDN cache directly from the bucket. Which backend configuration should you use?

Accepted Answer

Create a backend bucket that references the Cloud Storage bucket and enable Cloud CDN on the backend bucket.

Answer

Create a backend service with a managed instance group of NGINX proxies that read from the bucket, then enable Cloud CDN on the backend service.

Answer

Create an internet network endpoint group (NEG) pointing to storage.googleapis.com and attach it to a backend service with Cloud CDN.

Answer

Create a serverless NEG backed by a Cloud Run service that streams objects from the bucket, then enable Cloud CDN.

Question 13

Your team runs a global external Application Load Balancer with Cloud CDN enabled in CACHE_ALL_STATIC mode fronting a backend service. During a recent origin outage, clients received many HTTP 404 and 5xx responses. You notice these error responses are being cached at the edge with default TTLs, and stale 404s continued to be served to users even after the objects were restored on the origin. You want to keep error responses out of the cache (or minimize how long they are cached) while retaining normal caching for successful static content. What should you configure?

Accepted Answer

Enable negative caching on the backend service and set a negative caching policy that assigns a TTL of 0 to the specific supported negative-caching status codes (such as 404 and 410) rather than general 5xx status codes.

Answer

Switch the cache mode to USE_ORIGIN_HEADERS so that only responses with explicit Cache-Control headers are cached.

Answer

Issue a cache invalidation with the path /* every time the origin returns an error response.

Answer

Set the default TTL and max TTL on the backend service to 0 to prevent any responses from being cached.

Question 14

A media streaming company uses an external Application Load Balancer with Cloud CDN enabled to deliver video content stored in a Cloud Storage backend bucket. Each video is segmented into hundreds of individual files (manifests and chunks) that must all be protected so only paying subscribers can access them. The company wants to authorize access to an entire set of files with a single authorization step per user session, rather than issuing a separate token for every file. Which Cloud CDN access-control mechanism should they use?

Accepted Answer

Signed cookies, scoped to a URL prefix covering all the video's files

Answer

Signed URLs, generating one signed URL per video segment file

Answer

IAM policies on the backend bucket granting subscribers the objectViewer role

Answer

A Google-managed SSL certificate attached to the load balancer's target proxy

Question 15

A media company serves premium video files from a Cloud Storage bucket that is configured as a backend bucket behind a global external Application Load Balancer with Cloud CDN enabled. The company wants to ensure that only paying subscribers can download individual video files, and each access grant must automatically expire after a short time window. They do not want to modify the client application to send custom authentication headers, and access should be enforced at the CDN edge before the origin is contacted. Which approach should they implement?

Accepted Answer

Configure Cloud CDN signed URLs by adding a signed URL key to the backend bucket and generating time-limited signed URLs for each authorized request.

Answer

Set the Cloud CDN cache mode to USE_ORIGIN_HEADERS and rely on the bucket's IAM policy to grant temporary access to subscribers.

Answer

Enable Identity-Aware Proxy (IAP) on the backend bucket so that users must authenticate with Google credentials before downloading files.

Answer

Create a Cloud Armor security policy that allows requests only from subscriber IP ranges and attach it to the backend bucket.

Question 16

A financial services company hosts its public domain 'example-bank.com' in a Cloud DNS public managed zone. Security auditors require protection against DNS cache poisoning and spoofing so that resolvers can cryptographically validate the authenticity of DNS responses. What should the network engineer do?

Accepted Answer

Enable DNSSEC on the public managed zone and add the DS record to the domain registrar

Answer

Configure a DNS forwarding zone that routes queries through Google Public DNS at 8.8.8.8

Answer

Enable DNSSEC on a private managed zone and configure split-horizon DNS for the domain

Answer

Create signed URLs for the DNS records and distribute the signing keys to trusted resolvers

Question 17

Your company runs an internal application in a Google Cloud VPC. Applications on Compute Engine instances must resolve hostnames in the internal domain 'corp.example.internal', which is managed by DNS servers running in your on-premises data center reachable over an existing HA VPN connection (private IP 10.20.0.53). Google Cloud must send queries for this domain to the on-premises resolver, but all other queries should continue to use Google's default resolution. What should you configure in Cloud DNS?

Accepted Answer

Create a Cloud DNS forwarding zone for 'corp.example.internal' with forwarding targets set to the on-premises resolver IP 10.20.0.53.

Answer

Create a private managed zone for 'corp.example.internal' with DNSSEC enabled and add A records manually for each on-premises host.

Answer

Create a DNS peering zone for 'corp.example.internal' that peers with the on-premises DNS servers over the HA VPN.

Answer

Enable inbound DNS forwarding by creating an inbound server policy so on-premises servers can query Cloud DNS for 'corp.example.internal'.

Question 18

A retailer runs workloads in a Google Cloud VPC and maintains a large on-premises data center connected via HA VPN. Applications in the VPC must resolve private hostnames hosted by the on-premises Microsoft AD DNS servers, and on-premises clients must resolve records for private Cloud DNS zones used by the cloud workloads. The team wants a fully managed solution without deploying and maintaining DNS proxy VMs in Google Cloud. Which Cloud DNS configuration should they implement?

Accepted Answer

Create a Cloud DNS private zone with forwarding to the on-premises servers, and configure a Cloud DNS server policy that enables inbound DNS forwarding so on-premises clients query the assigned inbound forwarder IPs.

Answer

Deploy DNS forwarder VM instances in the VPC that relay queries in both directions and point both environments at these instances.

Answer

Use Cloud DNS peering between the VPC and the on-premises DNS servers so records are exchanged bidirectionally.

Answer

Configure a single Cloud DNS public managed zone and enable DNSSEC so both environments resolve each other's records over the internet.

Question 19

A retail company runs an internal application in a Google Cloud VPC. The same hostname, app.retail.internal, must resolve to a private RFC 1918 address for clients inside the VPC, but to a public-facing external IP for clients querying from the internet. The DNS team wants a Google-managed solution that avoids maintaining separate hostnames and works without deploying custom DNS servers. Which Cloud DNS approach should they implement?

Accepted Answer

Create a Cloud DNS private zone and a separate public managed zone, both named for a domain you own such as corp.retailexample.com, and add differing A records for app.corp.retailexample.com in each — using Cloud DNS split-horizon (response policy is not required).

Answer

Create a single public managed zone with two A records for app.retail.internal and rely on Cloud DNS to return the private record only to internal VPC clients.

Answer

Deploy BIND on a Compute Engine instance to serve split-horizon views, and point the VPC's DNS server policy to that instance.

Answer

Use Cloud DNS DNS peering to forward app.retail.internal queries from the VPC to the public zone while internet clients query the public zone directly.

Question 20

A financial services company is designing a Dedicated Interconnect connection between their on-premises data center and Google Cloud. A compliance requirement mandates that all traffic traversing the physical link between their edge router and Google's peering edge must be encrypted at Layer 2. The design must minimize latency overhead and avoid tunnel-based encryption. Which approach should the network engineer choose?

Accepted Answer

Enable MACsec for Cloud Interconnect on the Dedicated Interconnect connection

Answer

Deploy HA VPN tunnels over the Dedicated Interconnect using IPsec encryption

Answer

Configure Cloud Interconnect with private Google Access and rely on Google's default in-transit encryption

Answer

Use Partner Interconnect and request the connectivity provider to encrypt the VLAN attachment

Question 21

You operate a production VPC connected to on-premises via HA VPN. Last week a tunnel went down for 40 minutes before anyone noticed, causing an outage. The network team wants to be paged immediately whenever any VPN tunnel loses its BGP session or drops. Using Google Cloud Observability, what is the most appropriate way to implement this proactive notification?

Accepted Answer

Create a Cloud Monitoring alerting policy on the VPN Gateway metric 'vpn.googleapis.com/tunnel_established' (and/or the BGP session state metric) with a notification channel that pages the on-call team.

Answer

Enable VPC Flow Logs on the subnets behind the VPN and build a Logs-based metric that counts dropped packets, then alert when the count exceeds zero.

Answer

Schedule a recurring Connectivity Test every 5 minutes against the on-premises endpoint and email the results to the team.

Answer

Enable Firewall Rules Logging on the VPN traffic and create a dashboard that the NOC reviews hourly for tunnel status.

Question 22

Your company runs a fleet of Compute Engine VMs without external IP addresses in a subnet that uses Cloud NAT for internet egress. A SaaS partner requires that all outbound requests to their API originate from a small, fixed set of source IP addresses that you must provide to them for allowlisting. Currently the Cloud NAT gateway is configured with automatic NAT IP address allocation. What should you do to meet the partner's requirement while continuing to allow egress?

Accepted Answer

Reconfigure the Cloud NAT gateway to use manual NAT IP address allocation with reserved static external IP addresses, then share those addresses with the partner.

Answer

Assign ephemeral external IP addresses directly to each VM and remove the Cloud NAT gateway so traffic egresses with predictable addresses.

Answer

Keep automatic NAT IP allocation and enable Dynamic Port Allocation so the same IP addresses are always reused for the partner's traffic.

Answer

Create an egress VPC firewall rule that rewrites the source IP of outbound packets to a fixed address before they leave the gateway.

Question 23

You configured an HA VPN tunnel between Google Cloud and an on-premises router. The tunnel status shows 'Established', but the BGP session on the Cloud Router remains in a state where routes are not being exchanged. You verify that the Cloud Router uses Google ASN 65001 and advertises subnet routes correctly. On the on-premises side, the peer is configured with ASN 65001 as its local ASN, and the BGP peer IP addresses fall within the same /30 link-local range you assigned in the BGP session configuration. What is the most likely cause of the BGP session failure?

Accepted Answer

The on-premises router and Cloud Router are both configured with ASN 65001, causing an unintended iBGP relationship instead of the expected eBGP peering.

Answer

HA VPN requires the Cloud Router to use a 4-byte ASN, so 65001 is invalid and must be replaced with a value above 65535.

Answer

The BGP peer IP addresses must be from a public IP range, not link-local (169.254.0.0/16), for the session to establish.

Answer

BGP route exchange only begins after Cloud Router is set to a custom advertisement mode; the default base mode blocks all route exchange.

Question 24

Your company runs an HA VPN connection between an on-premises data center and a Google Cloud VPC named prod-vpc. The Cloud Router uses BGP to exchange routes. The on-premises router currently learns the subnet ranges in prod-vpc. You have now enabled Private Google Access and want the on-premises hosts to also reach Google APIs through the tunnel using the restricted.googleapis.com range (199.36.153.4/30), which is NOT a subnet in your VPC. What is the correct way to make the on-premises router learn this range via BGP?

Accepted Answer

Switch the Cloud Router (or the BGP session) to custom route advertisement mode and add 199.36.153.4/30 as a custom advertised IP range.

Answer

Keep the Cloud Router in base advertisement mode; subnet routes and the restricted VIP range are advertised automatically.

Answer

Add a custom static route for 199.36.153.4/30 in prod-vpc, which the Cloud Router will automatically redistribute into BGP in base mode.

Answer

Enable route exchange via VPC Network Peering so the restricted VIP range propagates to the on-premises router.

Question 25

Your company runs an HA VPN connection between an on-premises data center and a Google Cloud VPC, using a Cloud Router with BGP. During periods of transient network latency on the WAN link, the BGP sessions repeatedly drop and re-establish, causing routes to flap and briefly interrupting traffic. The on-premises router administrator asks what BGP timer setting on the Cloud Router side you can adjust to make the session more tolerant of brief connectivity interruptions before it is declared down. What should you do?

Accepted Answer

Increase the BGP keepalive interval on the Cloud Router, which raises the effective hold timer and gives the session more time to recover before it is torn down

Answer

Enable Bidirectional Forwarding Detection (BFD) with the shortest possible interval to detect failures faster and prevent flapping

Answer

Lower the BGP keepalive interval on the Cloud Router so that keepalives are sent more frequently and the peer never times out

Answer

Set the Cloud Router ASN to match the on-premises ASN so the session becomes iBGP and uses a longer default hold time