PCNE practice questions 71–80

1. Question 71 · 255 in bank

   You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible. To ease the transition, you decided to use the same architecture as your on-premises network: a hub-and-spoke model. Your on-premises architecture consists of over 50 spokes. Each spoke does not have connectivity to the other spokes, and all traffic is sent through the hub for security reasons. You need to ensure that the Google Cloud architecture matches your on-premises architecture. You want to implement a solution that minimizes management overhead and cost, and uses default networking quotas and limits. What should you do?

   • AConnect all the spokes to the hub with Cloud VPN.
   • BConnect all the spokes to the hub with VPC Network Peering.
   • CConnect all the spokes to the hub with Cloud VPN. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.
   • DConnect all the spokes to the hub with VPC Network Peering. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.

   Show answer

   Answer: C

   Explanation

   Correct answer is C. Forget the points about non-transitive routing that folks are making. The key point is in the question that they want to stay within the GCP quotas and limits. VPC peering max is 25. The customer has 50 spokes in their on-premises hub-n-spoke design and the want to "replicate" that design in the cloud. VPC peering won't work as 50 is beyond the limit. Answer is C.

   Source: Adapted from community discussion — 3fd692e

   Next question

2. Question 72 · 255 in bank

   You have the networking configuration shown in the diagram. Two VLAN attachments associated with two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BGP) sessions associated with each of the VLAN attachments. You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow?

   

   • AFrom the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results.
   • BFrom the Cloud CLI, run gcloud compute –-project PROJECT_ID routers get-status mycloudrouter –-region REGION and review the results.
   • CFrom the Google Cloud console, navigate to the Hybrid Connectivity, select the Cloud Router, and view BGP sessions.
   • DFrom the Cloud CLI, run gcloud compute routers describe mycloudrouter –-region REGION and review the results.

   Show answer

   Answer: C

   Next question

3. Question 73 · 255 in bank

   You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network. Currently, there is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability. What should you do?

   • AUse one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
   • BUse a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
   • CUse two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
   • DUse HA VPN. Configure one tunnel from each interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.

   Show answer

   Answer: D

   Explanation

   For Dedicated Interconnects: At least four Dedicated Interconnect connections, two connections in one metropolitan area (metro) and two connections in another metro. Connections that are in the same metro must be placed in different edge availability domains (metro availability zones) to achieve 99.99% availability. For HA VPN: HA VPN to peer VPN gateways Connect an HA VPN gateway to one or two separate peer VPN devices 99.99% HA VPN between two Google Cloud networks Connect two Google Cloud VPC networks in a single region by using an HA VPN gateway in each network 99.99%

   Source: Adapted from community discussion — desertlotus1211

   Next question

4. Question 74 · 255 in bank

   Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node. Which Pod per node CIDR range should you use?

   • A/24
   • B/25
   • C/26
   • D/28

   Show answer

   Answer: A

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 75 · 255 in bank

   You are designing a packet mirroring policy as part of your network security architecture for your gaming workload. Your infrastructure is located in the us-west2 region and deployed across several zones: us-west2-a, us-west2-b, and us-west2-c. The infrastructure is running a web-based application on TCP ports 80 and 443 with other game servers that utilize the UDP protocol. You need to deploy packet mirroring policies and collector instances to monitor web application traffic while minimizing inter-zonal network egress costs. Following Google-recommended practices, how should you deploy the packet mirroring policies and collector instances?

   • ACrate three packet mirroring policies: one for each zone. Create one group of collector instances for the us-west2 region. Configure each packet mirroring policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
   • BCreate one packet mirroring policy for the us-west2 region. Create one group of collector instances for the us-west2 region. Configure the packet mirroring policy to match traffic for web server instances based on instance-tags, and create a filter for TCP traffic.
   • CCreate three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
   • DCreate three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on subnets, and create a filter for TCP traffic.

   Show answer

   Answer: B

   Explanation

   To deploy packet mirroring policies and collector instances following Google-recommended practices while minimizing inter-zonal network egress costs, we need to consider the requirements and best practices outlined in the scenario. Given that the infrastructure is deployed across multiple zones within the us-west2 region and that the goal is to monitor web application traffic while minimizing egress costs, the most appropriate approach would be to consolidate collector instances and policies to cover the entire region. Option B seems to align with this approach

   Source: Adapted from community discussion — [Removed]

   Next question

6. Question 76 · 255 in bank

   Your company recently migrated to Google Cloud. You configured separate Virtual Private Cloud (VPC) networks for Department A and Department B. You need to configure both VPC networks to have access to the same on-premises location through separate links with full isolation between the VPC networks. Your design must also query on-premises DNS servers from workloads in Google Cloud using conditional forwarding. You want to minimize operational overhead. What should you do?

   • ACustomize the operating system DNS configuration files to target the on-premises DNS servers.
   • BKeep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
   • CPeer Department A's and Department B's VPC networks to have all on-premises connectivity via a single VPC network. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
   • DConfigure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network.

   Show answer

   Answer: D

   Explanation

   Do not use outbound forwarding to your on-premises DNS servers from multiple VPC networks because it creates problems with the return traffic. Google Cloud accepts responses from your DNS servers only if they're routed to the VPC network from which the query originated. However, queries from any VPC network have the same IP range 35.199.192.0/19 as source. Therefore, responses can't be routed correctly unless you have separate environments on-premises.

   Source: Adapted from community discussion — hamish88

   References

   • Google Cloud documentation

   Next question

7. Question 77 · 255 in bank

   You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements: • Each Google Cloud project must represent an internal project that your team will work on. • After an internal project is finished, the infrastructure must be deleted. • Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources. • You have 10-100 projects deployed at a time. While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable with centralized management. What should you do?

   • ACreate a single project and single VPC for each internal project.
   • BCreate a single Shared VPC and attach each Google Cloud project as a service project.
   • CCreate a single project and additional VPCs for each internal project. D.O Create a Shared VPC and service project for each internal project.

   Show answer

   Answer: B

   Next question

8. Question 78 · 255 in bank

   You have the following Shared VPC design. VPC Flow Logs is configured for Subnet-1 in the host VPC. You also want to monitor flow logs for Subnet-2. What should you do?

   

   • AConfigure a VPC Flow Logs filter for Subnet-2 in the host project VPC.
   • BConfigure VPC Flow Logs in the service project VPC for Subnet-2.
   • CConfigure Packet Mirroring in both the host and service project VPCs.
   • DConfigure a firewall rule to permit Subnet-2 IP addresses outbound in the host project VPC.

   Show answer

   Answer: B

   Explanation

   A compute engine can't have multiple NICs in the same VPC, so in the figure the VPCs are two (even if with the same name), one in the host project and one in the service project. So the answer is B

   Source: Adapted from community discussion — Cris0303

   Next question

9. Question 79 · 255 in bank

   Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client IP address. You want to identify this actor while minimizing disruption to your legitimate users. What should you do?

   • ACreate a Cloud Armor Policy rule that denies traffic and review necessary logs.
   • BCreate a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.
   • CCreate a VPC Firewall rule that denies traffic, enable logging and set enforcement to disabled, and review necessary logs.
   • DCreate a VPC Firewall rule that denies traffic, enable logging and set enforcement to enabled, and review necessary logs.

   Show answer

   Answer: B

   Explanation

   Definitely B. It says you "believe" you have a bad actor, and want to confirm this "while minimizing disruption to your legitimate users." [A] would block the traffic suspected IP, causing disruption to a legitimate user if you were wrong about the actor [B] Correct - You can log the requests by Client IP, and Preview Mode will not cause disruption to anyone, while you investigate. [C] Global Load balancers are Proxies, as Jordi says. This could work for Network load balancers, which are not proxies, but they are regional and not global. [D] As above, even if you could block from an NLB, it would cause disruption to someone.

   Source: Adapted from community discussion — architect

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 80 · 255 in bank

    Select 2

    You are configuring your organization's Google Cloud environment to connect to your on-premises network, which does not support Border Gateway Protocol (BGP). Your on-premises network has 30 CIDR ranges that must be reachable from Google Cloud. Your VPN gateway creates a unique child security association (SA) per CIDR. You must ensure that the 30 CIDR ranges in your on-premises network are reachable from Google Cloud. Following Google-recommended practices, which two methods can you use to accomplish this? (Choose two.)

    • ACreate a single Cloud VPN tunnel that uses route-based VPN.
    • BCreate a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors.
    • CCreate multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to unique peer IP addresses.
    • DCreate multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the remote traffic selectors.
    • ECreate multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. Connect each tunnel to the same peer IP address.

    Show answer

    Answer: AC

    Explanation

    The documentation points towards A+C: https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing?hl=en#route-alignment For A: "Use a route-based VPN. Both traffic selectors are 0.0.0.0/0 by definition for route-based VPNs. You can create routes that are more specific than the traffic selectors." For C: "Use policy-based routing to create multiple Cloud VPN tunnels so that each tunnel only has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. (...) Your peer VPN gateway must offer separate external IP addresses to which each Cloud VPN tunnel can connect. Tunnels on the same Classic VPN gateway must connect to unique peer gateway IP addresses."

    Source: Adapted from community discussion — Positron75

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCNE practice, question 71. 255 questions available.