PCNE practice questions 101–110

1. Question 101 · 255 in bank

   You are configuring the intrusion prevention service (IPS) feature on Cloud Next Generation Firewall Enterprise. You deployed your firewall endpoints and you need to inspect the traffic of the VMs. What should you do?

   • AConfigure Packet Mirroring to match the source/destination IP addresses of the VMs.
   • BConfigure a firewall rule to match the source/destination IP addresses of the VMs, and use the goto_next action.
   • CConfigure a firewall rule to match the hostnames of the VMs, and use the apply_security_profile_group action.
   • DConfigure a firewall rule to match the source/destination IP addresses of the VMs, and use the apply_security_profile_group action.

   Show answer

   Answer: D

   Explanation

   continued --- > The NGFW endpoint inspects the traffic using the security profiles and applies actions such as blocking, alerting, or allowing based on configured threat severity levels.

   Source: Adapted from community discussion — b0b25

   Next question

2. Question 102 · 255 in bank

   Your organization recently exposed a set of services through a global external Application Load Balancer. After conducting some testing, you observed that responses would intermittently yield HTTP 4xx or 5xx error response codes. You already enabled and reviewed the health check logs. You need to identify the error. What should you do?

   • AAccess a VM in the VPC through SSH to access the backend VM directly. If the request is successful from the VM, increase the quantity of backends.
   • BDelete the load balancer and backend services. Create a new Passthrough Network Load Balancer. Configure a failover group of VMs for the backend.
   • CValidate the health of the backend service. Enable logging for the backend service and identify the error response in Cloud Logging. Review the statusDetails log field.
   • DValidate the health of the backend service. Disable any Cloud Armor policies on the backend service, and identify any error response in Cloud Logging. Review the statusDetails log field.

   Show answer

   Answer: C

   References

   • Google Cloud documentation

   Next question

3. Question 103 · 255 in bank

   Select 2

   Your company's current network architecture has two VPCs that are connected by a dual-NIC instance that acts as a bump-in-the-wire firewall between the two VPCs. Flows between pairs of subnets across the two VPCs are working correctly. Suddenly, you receive an alert that none of the flows between the two VPCs are working anymore. You need to troubleshoot the problem. What should you do? (Choose two.)

   • AVerify that a VPC Service Controls perimeter has not been enabled for the project that contains the two VPCs and the dual-NIC instance.
   • BUse Cloud Logging to verify that there were no modifications to the VPC firewall rules or policies that were applied to the two network interfaces of the dual-NIC instance.
   • CVerify that a public IP address has not been assigned to any network interface of the dual-NIC instance.
   • DVerify that the dual-NIC instance has the --can-Ip-Forward attribute enabled.
   • EVerify that the dual-NIC instance has not been added to a backend service.

   Show answer

   Answer: BD

   Next question

4. Question 104 · 255 in bank

   Your company deployed Cloud Next Generation Firewall Enterprise (Cloud NGFW Enterprise). You have already created a CA pool and a CA in Certificate Authority Service. You need to enable TLS inspection. What should you do?

   • AGrant the network security service agent service account the privateca.certificateRequester role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
   • BGrant the network security service agent service account the privateca.poolReader role. Create a TLS inspection policy linking to the CA pool. Configure your VPC endpoint associations to use the TLS inspection policy. Flip the TLS inspection flag in your firewall policy rules to true.
   • CGrant the network security service agent service account the privateca.certificateRequester role. Create a trust config in Certificate Manager Flip the TLS inspection flag in your firewall policy rules to true.
   • DGrant the network security service agent service account the privateca.certificateRequester role. Create a trust config in Certificate Manager. Flip the TLS inspection flag in your firewall policy rules to true.

   Show answer

   Answer: A

   References

   • Google Cloud documentation

   Next question

5. Question 105 · 255 in bank

   You have recently taken over responsibility for your organization's Google Cloud network security configurations. You want to review your Cloud Next Generation Firewall (Cloud NGFW) configurations and ensure there are no rules that are allowing ingress traffic to your VMs and services from the internet. You want to avoid manual work. What should you do?

   • AReview the firewall policy rules associated with the VPC, and filter for rules that allow ingress from 0.0.0.0/0.
   • BEnable "Overly permissive rules insights" in Firewall Insights. Review results for rules that show allowed ingress traffic from internet sources.
   • CRun Connectivity Tests from multiple external sources to double-check ingress traffic settings.
   • DEnable the Network Analyzer API and review the "VPC Network" category insights.

   Show answer

   Answer: B

   References

   • Google Cloud documentation

   Next question

6. Question 106 · 255 in bank

   Your company's cloud network has hybrid connectivity to an on-premises environment through Cloud Interconnect in two regions (us-east4 and us-west1). You received complaints that some on-premises destinations are no longer reachable from us-east4, after changes were made to advertise additional routes to us-west1. You need to troubleshoot to see if any routes were dropped. What should you do?

   • AQuery the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the global routing_mode metric attribute.
   • BQuery the dynamic_routes/learned_routes/unique_destinations_limit metric and review the global routing_mode metric attribute.
   • CQuery the dynamic_routes/learned_routes/any_dropped_unique_destinations metric and review the regional routing_mode metric attribute.
   • DQuery the dynamic_routes/learned_routes/dropped_unique_destinations metric and review the regional routing_mode metric attribute.

   Show answer

   Answer: A

   Next question

7. Question 107 · 255 in bank

   Your organization has resources in two different VPCs, each in different Google Cloud projects, which require connectivity between them. You have already determined that there is no IP address overlap; however, one VPC uses privately used public IP (PUPI) ranges. You would like to enable connectivity between these resources by using a lower cost and higher performance method. What should you do?

   • ACreate a HA VPN between the two VPCs that includes the PUPI ranges in the Custom Route Advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using network tags as the source filter.
   • BCreate a HA VPN between the two VPCs that includes the PUPI ranges in the Custom Route Advertisements of the Cloud Router. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.
   • CCreate a VPC Peering between the two VPCs that allows the export and import of custom routes. Create the necessary ingress VPC firewall rules that target the specific resources by using service accounts as the source filter.
   • DCreate a VPC Peering between the two VPCs that allows the export and import of subnet routes with public IP addresses. Create the necessary ingress VPC firewall rules that target the specific resources by using IP ranges as the source filter.

   Show answer

   Answer: D

   References

   • Google Cloud documentation

   Next question

8. Question 108 · 255 in bank

   Your organization recently re-architected your cloud environment to use Network Connectivity Center. However, an error occurred when you tried to add a new VPC, named vpc-dev, as a spoke. The error indicated that there was an issue with an existing spoke and the IP space of a VPC, named vpc-pre-prod. You must complete the migration quickly and efficiently. What should you do?

   • ADelete the VMs associated with the conflicting subnets, then delete the conflicting subnets in vpc-dev. Recreate the subnets with a new IP range and redeploy the previously-deleted VMs in the new subnets. Add the VPC spoke for vpc-dev.
   • BExclude the conflicting IP range by using the --exclude-export-ranges flag when creating the VPC spoke for vpc-dev.
   • CExclude the conflicting IP range by using the --exclude-export-ranges flag in the hub when attaching the VPC spoke for vpc-dev.
   • DRemove the conflicting VPC spoke for vpc-pre-prod from the set of VPC spokes in Network Connectivity Center. Add the VPC spoke for vpc-dev. Add the previously removed vpc-pre-prod as a VPC spoke.

   Show answer

   Answer: B

   References

   • Google Cloud documentation

   Next question

9. Question 109 · 255 in bank

   Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency. How should you design this topology?

   • ACreate 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
   • BCreate 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
   • CCreate 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
   • DCreate 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.

   Show answer

   Answer: D

   Explanation

   The correct answer is D. However the explanation is wrong. We create one VPC network in auto mode that creates one subnet in each Google Cloud region automatically. So, region us-east1 and europe-west1 are in the same network and they can communicate using their internal IP address even though they are in different Regions. They take advantage of Google's global fiber network. Creating an auto mode network https://cloud.google.com/vpc/docs/using-vpc#create-auto-network

   Source: Adapted from community discussion — HateMicrosoft

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 110 · 255 in bank

    You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby. Which BGP attribute should you use on your on-premises router?

    • AAS-Path
    • BCommunity
    • CLocal Preference
    • DMulti-exit Discriminator

    Show answer

    Answer: D

    Explanation

    I was struggling with choosing between A and D. Because BGP selects shortest AS path first when sending traffic. In our On-prem router, we can actually prepend AS path for the standby BGP session. However, after learning from GCP's documentations(as referenced below) that GCP uses MED to set base priority. I decided to choose D. Additional ref: https://cloud.google.com/network-connectivity/docs/router/concepts/overview#route-metrics https://cloud.google.com/network-connectivity/docs/router/concepts/overview#suggested_base_priority_values

    Source: Adapted from community discussion — densnoigaskogen

    References

    • Google Cloud documentation
    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 101. 255 questions available.