PCNE practice questions 11–20

1. Question 11 · 255 in bank

   You are the Organization Admin for your company. One of your engineers is responsible for setting up multiple host projects across multiple folders and sharing subnets with service projects. You need to enable the engineer's Identity and Access Management (IAM) configuration to complete their task in the fewest number of steps. What should you do?

   • ASet up the engineer with Compute Shared VPC Admin IAM role at the folder level.
   • BSet up the engineer with Compute Shared VPC Admin IAM role at the organization level.
   • CSet up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the folder level.
   • DSet up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the organization level.

   Show answer

   Answer: B

   Explanation

   I'm not 100% sure for this question. for me, this question is about shared vpc, go to documentation: https://cloud.google.com/vpc/docs/shared-vpc "Implement a security best practice of least privilege for network administration, auditing, and access control. Shared VPC Admins can delegate network administration tasks to Network and Security Admins in the Shared VPC network without allowing Service Project Admins" following this recommendation above, cann't be letter C and D, definitely. So, can be A or B. But question say: "across multiple folders" and "task in the fewest number of steps" If we go to letter A, this configuration cann't be complete with fewest steps, principal if we have 100 folders. In my opinion is letter B, this is a personal opinion.

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation

   Next question

2. Question 12 · 255 in bank

   You recently deployed Compute Engine instances in regions us-west1 and us-east1 in a Virtual Private Cloud (VPC) with default routing configurations. Your company security policy mandates that virtual machines (VMs) must not have public IP addresses attached to them. You need to allow your instances to fetch updates from the internet while preventing external access. What should you do?

   • ACreate a Cloud NAT gateway and Cloud Router in both us-west1 and us-east1.
   • BCreate a single global Cloud NAT gateway and global Cloud Router in the VPC.
   • CChange the instances’ network interface external IP address from None to Ephemeral.
   • DCreate a firewall rule that allows egress to destination 0.0.0.0/0.

   Show answer

   Answer: A

   Explanation

   100% sure for A: B) wrong, cloud nat is regional (https://cloud.google.com/nat/docs/overview#specifications) C) wrong, there's security policy this scenario block associate external IP D) no make sense, this is default setup, not necessary allow outbound rule.

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 13 · 255 in bank

   You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary. Which level of permissions should you request?

   • ASecurity Admin privileges from the Shared VPC Admin.
   • BService Project Admin privileges from the Shared VPC Admin.
   • CShared VPC Admin privileges from the Organization Admin.
   • DOrganization Admin privileges from the Organization Admin.

   Show answer

   Answer: A

   Explanation

   Answer is A: A Shared VPC Admin can define a Security Admin by granting an IAM member the Security Admin (compute.securityAdmin) role to the host project. Security Admins manage firewall rules and SSL certificates.

   Source: Adapted from community discussion — ss_1982

   References

   • Google Cloud documentation

   Next question

4. Question 14 · 255 in bank

   You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial-of-service and application layer (layer 7) attacks. What should you do?

   • AConfigure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.
   • BConfigure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.
   • CConfigure VPC firewall rules to protect the Compute Engine instances against distributed denial-of-service attacks.
   • DConfigure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level.

   Show answer

   Answer: B

   Explanation

   B. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application. https://cloud.google.com/armor https://youtu.be/Ti-ln36t__I

   Source: Adapted from community discussion — AzureDP900

   References

   • Google Cloud documentation

   Next question

5. Question 15 · 255 in bank

   Your organization's security policy requires that all internet-bound traffic return to your on-premises data center through HA VPN tunnels before egressing to the internet, while allowing virtual machines (VMs) to leverage private Google APIs using private virtual IP addresses 199.36.153.4/30. You need to configure the routes to enable these traffic flows. What should you do?

   • AConfigure a custom route 0.0.0.0/0 with a priority of 500 whose next hop is the default internet gateway. Configure another custom route 199.36.153.4/30 with priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.
   • BConfigure a custom route 0.0.0.0/0 with a priority of 1000 whose next hop is the internet gateway. Configure another custom route 199.36.153.4/30 with a priority of 500 whose next hop is the VPN tunnel back to the on-premises data center.
   • CAnnounce a 0.0.0.0/0 route from your on-premises router with a MED of 1000. Configure a custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the default internet gateway.
   • DAnnounce a 0.0.0.0/0 route from your on-premises router with a MED of 500. Configure another custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.

   Show answer

   Answer: C

   Explanation

   100% for C. Following this link (https://cloud.google.com/vmware-engine/docs/networking/workload-internet-access#use_an_on-premises_connection_for_workload_internet_access) we eliminate A and B. Requirement is on premise router sent 0.0.0.0/0, but this setup create black role to APIs google services. traffic to APIs (199.36.153.4/30) need still inside GCP, so is required adjust it, create custom routing to default gateway gcp (https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid#config-routing-custom) "If you've replaced or changed your default route, ensure that you have custom static routes configured for the destination IP ranges used by private.googleapis.com or restricted.googleapis.com" 100% sure for C.

   Source: Adapted from community discussion — ccieman2016

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 16 · 255 in bank

   Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments. What should you do?

   • ACreate a VPC firewall rule in each VPC to block traffic from any source, with priority 0.
   • BCreate a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.
   • CCreate two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.
   • DCreate two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.

   Show answer

   Answer: D

   Explanation

   Correct answer - D Hierarchical firewall policy rules have a new goto_next action that you can use to delegate connection evaluation to lower levels of the hierarchy. https://cloud.google.com/vpc/docs/firewall-policies#:~:text=Hierarchical%20firewall%20policy%20rules%20have%20a%20new%20goto_next%20action%20that%20you%20can%20use%20to%20delegate%20connection%20evaluation%20to%20lower%20levels%20of%20the%20hierarchy.

   Source: Adapted from community discussion — pfilourenco

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 17 · 255 in bank

   You have two Google Cloud projects in a perimeter to prevent data exfiltration. You need to move a third project inside the perimeter; however, the move could negatively impact the existing environment. You need to validate the impact of the change. What should you do?

   • AEnable Firewall Rules Logging inside the third project.
   • BModify the existing VPC Service Controls policy to include the new project in dry run mode.
   • CMonitor the Resource Manager audit logs inside the perimeter.
   • DEnable VPC Flow Logs inside the third project, and monitor the logs for negative impact.

   Show answer

   Answer: B

   Explanation

   B is right answer n dry run mode, requests that violate the perimeter policy are not denied, only logged. Dry run mode is used to test perimeter configuration and to monitor usage of services without preventing access to resources. Common use cases include: Determining the impact that changes to existing service perimeters will have. Previewing the impact that new service perimeters will have. Monitoring requests to protected services that originate from outside a service perimeter. For example, seeing where requests to a given service are coming from, or to identify unexpected service usage in your organization. In your development environments, creating an analogous perimeter architecture to your production environment. This allows you to identify and mitigate any issues that will be caused by your service perimeters before pushing changes to your production environment. Service perimeters can exist using dry run mode exclusively. You can also have service perimeters that use a hybrid of enforced and dry run modes. https://cloud.google.com/vpc-service-controls/docs/dry-run-mode

   Source: Adapted from community discussion — AzureDP900

   References

   • Google Cloud documentation

   Next question

8. Question 18 · 255 in bank

   You are configuring an HA VPN connection between your Virtual Private Cloud (VPC) and on-premises network. The VPN gateway is named VPN_GATEWAY_1. You need to restrict VPN tunnels created in the project to only connect to your on-premises VPN public IP address: 203.0.113.1/32. What should you do?

   • AConfigure a firewall rule accepting 203.0.113.1/32, and set a target tag equal to VPN_GATEWAY_1.
   • BConfigure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs to use an allowList consisting of only the 203.0.113.1/32 address.
   • CConfigure a Google Cloud Armor security policy, and create a policy rule to allow 203.0.113.1/32.
   • DConfigure an access control list on the peer VPN gateway to deny all traffic except 203.0.113.1/32, and attach it to the primary external interface.

   Show answer

   Answer: B

   Explanation

   Correct answer - B To ensure that your VPN gateway is protected, use the org policy constraint named constraints/compute.restrictVpnPeerIPs. This constraint will limit the public IPs that are allowed to initiate IPSec sessions with your VPN gateway. https://cloud.google.com/blog/topics/developers-practitioners/limiting-public-ips-google-cloud#:~:text=For%20VPNs%2C%20a,VPN%20gateway.

   Source: Adapted from community discussion — jitu028

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 19 · 255 in bank

   Your company has recently installed a Cloud VPN tunnel between your on-premises data center and your Google Cloud Virtual Private Cloud (VPC). You need to configure access to the Cloud Functions API for your on-premises servers. The configuration must meet the following requirements: • Certain data must stay in the project where it is stored and not be exfiltrated to other projects. • Traffic from servers in your data center with RFC 1918 addresses do not use the internet to access Google Cloud APIs. • All DNS resolution must be done on-premises. • The solution should only provide access to APIs that are compatible with VPC Service Controls. What should you do?

   • A1. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
   • B1. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Configure your on-premises firewalls to allow traffic to the restricted.googleapis.com addresses.
   • C1. Create an A record for restricted.googleapis.com using the 199.36.153.4/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Remove the default internet gateway from the VPC where your Cloud VPN tunnel terminates.
   • D1. Create an A record for private.googleapis.com using the 199.36.153.8/30 address range. 2. Create a CNAME record for *.googleapis.com that points to the A record. 3. Configure your on-premises routers to use the Cloud VPN tunnel as the next hop for the addresses you used in the A record. 4. Configure your on-premises firewalls to allow traffic to the private.googleapis.com addresses.

   Show answer

   Answer: B

   Explanation

   A and D are eliminated as restricted.googleapis.com is the right URL (not private.googleapis.com) Between B and C, removing the default gateway at VPC does not help as this relates to on-premise. Instead opening a direct access to the API external IP address would enable the servers to access the API directly.

   Source: Adapted from community discussion — Thornadoo

   References

   • Google Cloud documentation

   Next question

10. Question 20 · 255 in bank

    You need to configure a Google Kubernetes Engine (GKE) cluster. The initial deployment should have 5 nodes with the potential to scale to 10 nodes. The maximum number of Pods per node is 8. The number of services could grow from 100 to up to 1024. How should you design the IP schema to optimally meet this requirement?

    • AConfigure a /28 primary IP address range for the node IP addresses. Configure a /25 secondary IP range for the Pods. Configure a /22 secondary IP range for the Services.
    • BConfigure a /28 primary IP address range for the node IP addresses. Configure a /25 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.
    • CConfigure a /28 primary IP address range for the node IP addresses. Configure a /28 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.
    • DConfigure a /28 primary IP address range for the node IP addresses. Configure a /24 secondary IP range for the Pads. Configure a /22 secondary IP range for the Services.

    Show answer

    Answer: D

    Explanation

    This is a tricky question. Keep in mind that Nodes use Primary IP ranges whereas Pods and Services use Secondary ranges. For secondary, as you can use all of the IP addresses unlike the Primary where 4 x IPs are reserved. E.g. Max hosts in /24 for Node is 252 vs. 256 for pods and services. If we gather the above logic: 1) 10 nodes = /28 2) 80 pods = /24 (Reason is /24 is the smallest possible Pod) 3) 1024 services = /22 (Can use all of 1024 IPs) https://cloud.google.com/kubernetes-engine/docs/concepts/alias-ips#cluster_sizing_secondary_range_pods

    Source: Adapted from community discussion — Thornadoo

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 11. 255 questions available.