PCNE practice questions 1–10

1. Question 1 · 255 in bank

   You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect. What should you do?

   • ACreate a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
   • BCreate a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
   • CTag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
   • DLabel the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.

   Show answer

   Answer: C

   Explanation

   Answer C. This question is actually asking specifically about using firewall with a Network LB, because Network Load Balancing is a pass-through load balancer, you control access to the load balancer's backends using Google Cloud firewall rules. https://cloud.google.com/load-balancing/docs/network/networklb-backend-service#firewall_rules

   Source: Adapted from community discussion — PeppaPig

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 2 · 255 in bank

   You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic. What should you do?

   • ACheck the VPC flow logs for the instance.
   • BTry connecting to the instance via SSH, and check the logs.
   • CCreate a new firewall rule to allow traffic from port 22, and enable logs.
   • DCreate a new firewall rule with priority 65500 to deny all traffic, and enable logs.

   Show answer

   Answer: D

   Explanation

   I think correct answer should be D. https://cloud.google.com/blog/products/identity-security/google-cloud-firewall-rules-logging-how-and-why-you-should-use-it "Since we have implicit ingress and the denial rule is not being logged, we create a “deny all” rule with priority 65534 to capture anything that gets denied" https://cloud.google.com/vpc/docs/firewall-rules-logging

   Source: Adapted from community discussion — elguije

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 3 · 255 in bank

   You are designing the network architecture for your organization. Your organization has three developer teams: Web, App, and Database. All of the developer teams require access to Compute Engine instances to perform their critical tasks. You are part of a small network and security team that needs to provide network access to the developers. You need to maintain centralized control over network resources, including subnets, routes, and firewalls. You want to minimize operational overhead. How should you design this topology?

   • AConfigure a host project with a Shared VPC. Create service projects for Web, App, and Database.
   • BConfigure one VPC for Web, one VPC for App, and one VPC for Database. Configure HA VPN between each VPC.
   • CConfigure three Shared VPC host projects, each with a service project: one for Web, one for App, and one for Database.
   • DConfigure one VPC for Web, one VPC for App, and one VPC for Database. Use VPC Network Peering to connect all VPCs in a full mesh.

   Show answer

   Answer: A

   Explanation

   A. Configure a host project with a Shared VPC. Create service projects for Web, App, and Database. The best solution to meet the requirements is to use a Shared VPC. This allows for centralized control over subnets, routes, and firewalls while providing network access to the developers. By configuring a host project with a Shared VPC, the network and security team can manage the resources centrally. Each developer team can then have its own service project and be given the necessary permissions to access Compute Engine instances. This approach minimizes operational overhead while providing the required network access to the developer teams.

   Source: Adapted from community discussion — Ben756

   Next question

4. Question 4 · 255 in bank

   Your company has 10 separate Virtual Private Cloud (VPC) networks, with one VPC per project in a single region in Google Cloud. Your security team requires each VPC network to have private connectivity to the main on-premises location via a Partner Interconnect connection in the same region. To optimize cost and operations, the same connectivity must be shared with all projects. You must ensure that all traffic between different projects, on-premises locations, and the internet can be inspected using the same third-party appliances. What should you do?

   • AConfigure the third-party appliances with multiple interfaces and specific Partner Interconnect VLAN attachments per project. Create the relevant routes on the third-party appliances and VPC networks.
   • BConfigure the third-party appliances with multiple interfaces, with each interface connected to a separate VPC network. Create separate VPC networks for on-premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks.
   • CConsolidate all existing projects’ subnetworks into a single VPCreate separate VPC networks for on-premises and internet connectivity. Configure the third-party appliances with multiple interfaces, with each interface connected to a separate VPC network. Create the relevant routes on the third-party appliances and VPC networks.
   • DConfigure the third-party appliances with multiple interfaces. Create a hub VPC network for all projects, and create separate VPC networks for on-premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks. Use VPC Network Peering to connect all projects’ VPC networks to the hub VPC. Export custom routes from the hub VPC and import on all projects’ VPC networks.

   Show answer

   Answer: D

   Explanation

   Option D is the recommended solution for this scenario. Option D involves creating a hub VPC network for all projects and creating separate VPC networks for on-premises and internet connectivity. This approach allows for the inspection of traffic between different projects, on-premises locations, and the internet using the same third-party appliances. It also allows for the export of custom routes from the hub VPC and their import on all projects’ VPC networks using VPC Network Peering. This solution provides a centralized management approach while ensuring the required level of security and isolation.

   Source: Adapted from community discussion — Ben756

   Next question

5. Question 5 · 255 in bank

   You have just deployed your infrastructure on Google Cloud. You now need to configure the DNS to meet the following requirements: • Your on-premises resources should resolve your Google Cloud zones. • Your Google Cloud resources should resolve your on-premises zones. • You need the ability to resolve “.internal” zones provisioned by Google Cloud. What should you do?

   • AConfigure an outbound server policy, and set your alternative name server to be your on-premises DNS resolver. Configure your on-premises DNS resolver to forward Google Cloud zone queries to Google's public DNS 8.8.8.8.
   • BConfigure both an inbound server policy and outbound DNS forwarding zones with the target as the on-premises DNS resolver. Configure your on-premises DNS resolver to forward Google Cloud zone queries to Google Cloud's DNS resolver.
   • CConfigure an outbound DNS server policy, and set your alternative name server to be your on-premises DNS resolver. Configure your on-premises DNS resolver to forward Google Cloud zone queries to Google Cloud's DNS resolver.
   • DConfigure Cloud DNS to DNS peer with your on-premises DNS resolver. Configure your on-premises DNS resolver to forward Google Cloud zone queries to Google's public DNS 8.8.8.8.

   Show answer

   Answer: B

   Explanation

   B is correct. We need configure dns policy to allow inbound request from outside vpc, and create forwarding DNS to on premise. Adjust on premise server is necessary too.

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation

   Next question

6. Question 6 · 255 in bank

   Your organization uses a hub-and-spoke architecture with critical Compute Engine instances in your Virtual Private Clouds (VPCs). You are responsible for the design of Cloud DNS in Google Cloud. You need to be able to resolve Cloud DNS private zones from your on-premises data center and enable on-premises name resolution from your hub-and-spoke VPC design. What should you do?

   • A1. Configure a private DNS zone in the hub VPC, and configure DNS forwarding to the on-premises server. 2. Configure DNS peering from the spoke VPCs to the hub VPC.
   • B1. Configure a DNS policy in the hub VPC to allow inbound query forwarding from the spoke VPCs. 2. Configure the spoke VPCs with a private zone, and set up DNS peering to the hub VPC.
   • C1. Configure a DNS policy in the spoke VPCs, and configure your on-premises DNS as an alternate DNS server. 2. Configure the hub VPC with a private zone, and set up DNS peering to each of the spoke VPCs.
   • D1. Configure a DNS policy in the hub VPC, and configure the on-premises DNS as an alternate DNS server. 2. Configure the spoke VPCs with a private zone, and set up DNS peering to the hub VPC.

   Show answer

   Answer: A

   Explanation

   I go with A. In my opinion C and D are wrong (on-premises DNS as an alternate DNS server?) B is also wrong: configure a DNS policy in the HUB VPC to allow inbound query forwarding from the spoke VPC. This is not needed " DNS peering runs in parallel with VPC Network Peering connections to allow name resolution between environments." A is correct, although is missing second part of requirements in the question (resolution from on-prem to Google Cloud). https://cloud.google.com/dns/docs/best-practices#hybrid-architecture-using-hub-vpc-network-connected-to-spoke-vpc-networks

   Source: Adapted from community discussion — al_zo

   References

   • Google Cloud documentation

   Next question

7. Question 7 · 255 in bank

   You have a Cloud Storage bucket in Google Cloud project XYZ. The bucket contains sensitive data. You need to design a solution to ensure that only instances belonging to VPCs under project XYZ can access the data stored in this Cloud Storage bucket. What should you do?

   • AConfigure Private Google Access to privately access the Cloud Storage service using private IP addresses.
   • BConfigure a VPC Service Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter.
   • CConfigure Cloud Storage with projectPrivate Access Control List (ACL) that gives permission to the project team based on their roles.
   • DConfigure Private Service Connect to privately access Cloud Storage from all VPCs under project XYZ.

   Show answer

   Answer: B

   Explanation

   • B. Configure a VPC Service ***** Controls perimeter around project XYZ, and include storage.googleapis.com as a restricted service in the service perimeter. Overview of VPC Service Controls VPC Service Controls improves your ability to mitigate the risk of data exfiltration from Google Cloud services such as Cloud Storage and BigQuery. You can use VPC Service Controls to create perimeters that protect the resources and data of services that you explicitly specify. The following diagram shows a service perimeter that allows access from the internet to protected resources based on the configured access levels, such as IP address or device policy:

   Source: Adapted from community discussion — pk349

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 8 · 255 in bank

   You are maintaining a Shared VPC in a host project. Several departments within your company have infrastructure in different service projects attached to the Shared VPC and use Identity and Access Management (IAM) permissions to manage the cloud resources in those projects. VPC Network Peering is also set up between the Shared VPC and a common services VPC that is not in a service project. Several users are experiencing failed connectivity between certain instances in different Shared VPC service projects and between certain instances and the internet. You need to validate the network configuration to identify whether a misconfiguration is the root cause of the problem. What should you do?

   • AReview the VPC audit logs in Cloud Logging for the affected instances.
   • BUse Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.
   • CRun Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the internet.
   • DEnable VPC Flow Logs for all VPCs, and review the logs in Cloud Logging for the affected instances.

   Show answer

   Answer: C

   Explanation

   • C. Run Connectivity Tests from Network Intelligence Center to check connectivity between the affected ***** endpoints in your network and the internet. Why use Connectivity Tests? Connectivity Tests can help you troubleshoot the following network connectivity issues: • Unintended inconsistent ***** configurations • Obsolete configurations caused by network configuration changes or migrations • Configuration errors for a variety of network services and functions

   Source: Adapted from community discussion — pk349

   References

   • Google Cloud documentation

   Next question

9. Question 9 · 255 in bank

   Your organization has Compute Engine instances in us-east1, us-west2, and us-central1. Your organization also has an existing Cloud Interconnect physical connection in the East Coast of the United States with a single VLAN attachment and Cloud Router in us-east1. You need to provide a design with high availability and ensure that if a region goes down, you still have access to all your other Virtual Private Cloud (VPC) subnets. You need to accomplish this in the most cost-effective manner possible. What should you do?

   • A1. Configure your VPC routing in regional mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-east1 region, and configure a Cloud Router in us-east1.
   • B1. Configure your VPC routing in global mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-east1 region, and configure a Cloud Router in us-east1.
   • C1. Configure your VPC routing in global mode. 2. Add an additional Cloud Interconnect VLAN attachment in the us-west2 region, and configure a Cloud Router in us-west2.
   • D1. Configure your VPC routing in regional mode. 2. Add additional Cloud Interconnect VLAN attachments in the us-west2 and us-central1 regions, and configure Cloud Routers in us-west2 and us-central1.

   Show answer

   Answer: C

   Explanation

   A and D) wrong, there isn't vpc routing regional mode. B) wrong, requirements to Regional HA (provide a design with high availability and ensure that if a region goes down), in this case, first link is in us-east1, second Cann't install in same region. for me, letter C.

   Source: Adapted from community discussion — ccieman2016

   Next question

10. Question 10 · 255 in bank

    You recently configured Google Cloud Armor security policies to manage traffic to your application. You discover that Google Cloud Armor is incorrectly blocking some traffic to your application. You need to identity the web application firewall (WAF) rule that is incorrectly blocking traffic. What should you do?

    • AEnable firewall logs, and view the logs in Firewall Insights.
    • BEnable HTTP(S) Load Balancing logging with sampling rate equal to 1, and view the logs in Cloud Logging.
    • CEnable VPC Flow Logs, and view the logs in Cloud Logging.
    • DEnable Google Cloud Armor audit logs, and view the logs on the Activity page in the Google Cloud Console.

    Show answer

    Answer: B

    Explanation

    https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring n the Sample rate field, set the sampling probability. You can set a number from 0.0 through 1.0, where 0.0 means that no requests are logged and 1.0 means that 100% of the requests are logged. The default value is 1.0.

    Source: Adapted from community discussion — AzureDP900

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 1. 255 questions available.