Free PCNE Practice Questions

Question 1

A software vendor runs a TCP service behind an internal passthrough Network Load Balancer. Customers remain in their own Google Cloud organizations, and several customer VPCs overlap the vendor's address ranges. Customers must reach only this service through internal IP addresses, without renumbering either side or exchanging subnet routes. Which connection model fits?

Accepted Answer

Publish a Private Service Connect service attachment and let customers create endpoints in their VPCs.

Answer

Peer each customer VPC with the vendor VPC and import only the subnet containing the service.

Answer

Attach the customer projects to the vendor's Shared VPC and grant access to the subnet containing the service.

Answer

Establish HA VPN tunnels between the VPCs and advertise the existing service subnet over BGP.

Question 2

During a load test, a Public NAT gateway uses static allocation of 1,024 ports per VM. Most VMs stay below 100 connections to any one destination; a few gradually ramp toward 1,800 concurrent connections to the same vendor IP and TCP port. Their port-usage metric approaches 1,024, and OUT_OF_RESOURCES drops increase. The NAT address pool has spare capacity, and endpoint-independent mapping is disabled. Which allocation change accommodates these bursts without reserving peak capacity for every VM?

Accepted Answer

Use dynamic allocation with a minimum of 1,024 and a maximum of 4,096 ports per VM.

Answer

Keep static allocation at 1,024 ports per VM and add more external addresses to the NAT gateway.

Answer

Raise the static allocation to 4,096 ports per VM so that every VM has enough capacity for a burst.

Answer

Shorten the TCP TIME_WAIT timeout to make more ports available while the vendor connections remain open.

Question 3

A nightly export from a VM in service perimeter 'analytics' must write to a Cloud Storage bucket in service perimeter 'archive'. IAM grants are correct, and analytics already permits the exact outbound identity, operation, and destination. The request is rejected with a VPC Service Controls ingress violation at archive. The two perimeters must remain separate. What is the narrowest corrective action?

Accepted Answer

Add an archive ingress rule limited to the export identity, source project, destination project, and required Cloud Storage operation.

Answer

Create a perimeter bridge between analytics and archive so that their protected resources can communicate.

Answer

Add an archive egress rule for the export identity, destination bucket, and required Cloud Storage operation.

Answer

Allow TCP 443 from the analytics subnet in the archive VPC's ingress firewall policy.

Question 4

Cloud DNS forwards corp.example queries to an on-premises resolver at 172.20.10.53 across HA VPN. A VM in 10.40.0.0/16 resolves the name when querying 172.20.10.53 directly, but queries through the VM's Google-provided resolver fail. An on-premises capture shows a forwarded query arriving from 35.199.196.20 and the DNS server sending a reply. The on-premises routing table sends only 10.40.0.0/16 through the VPN. What should be changed to complete the forwarding path?

Accepted Answer

Advertise 35.199.192.0/19 to the on-premises router through the VPN's Cloud Router.

Answer

Allow DNS requests from 10.40.0.0/16 at the on-premises resolver's firewall.

Answer

Create an inbound Cloud DNS server policy and forward the on-premises resolver's queries to its entry points.

Answer

Add a VPC route for 172.20.10.53/32 through the VPN, leaving the on-premises routes unchanged.

Question 5

At 09:20, a checkout service begins receiving confirmed SQL-injection attempts from rapidly changing source addresses. All requests pass through a global external Application Load Balancer. Its backend Cloud Armor policy has a tuned SQL-injection deny rule in preview mode ahead of the broad allow rule. Preview logs show matches for the attack traffic, and replay tests confirm that legitimate checkout requests do not match. The application patch is not ready. Which immediate action contains the attack with the least customer disruption?

Accepted Answer

Enforce the validated SQL-injection rule by turning off preview mode.

Answer

Withdraw the checkout frontend until the application patch is ready, preventing all further requests to the service.

Answer

Add deny rules for the source IP addresses already observed, leaving the SQL-injection rule in preview.

Answer

Lower the policy's overall request-rate limit to throttle every client while retaining the current WAF settings.

Question 6

An IP allocation review for a new VPC-native GKE Standard cluster specifies a maximum of 52 Pods per node, including system Pods. The cluster must accommodate 28 regular nodes plus six additional nodes during upgrades, all using one dedicated Pod secondary IPv4 range. Node and Service address space is sufficient. The approved maximum-Pods setting cannot be reduced. Which is the smallest Pod range that supports the plan?

Accepted Answer

10.60.0.0/19

Answer

10.60.0.0/21

Answer

10.60.0.0/20

Answer

10.60.0.0/18

Question 7

A design review finds that an existing Dedicated Interconnect connection uses MACsec. A new security requirement calls for IPsec protection between the company's on-premises VPN appliance and Google Cloud's VPN gateway, with encrypted traffic remaining on the private Interconnect path. Which architecture satisfies the requirement?

Accepted Answer

Create encrypted VLAN attachments and establish HA VPN tunnels over the Interconnect connections.

Answer

Add BGP MD5 authentication to the existing MACsec-protected Interconnect.

Answer

Run HA VPN over the internet and retain Dedicated Interconnect for traffic that does not require IPsec.

Answer

Use application TLS over the MACsec-protected Interconnect connections.

Question 8

In a GKE Dataplane V2 cluster, payments Pods can resolve ledger's Service name but cannot connect to ledger on TCP 8443. The only egress policy selecting payments allows UDP and TCP port 53 to the DNS resolver. Ledger's ingress policy already allows payments Pods on TCP 8443. Routing and VPC firewall rules permit the traffic, and ledger is listening. Which policy change restores this connection without opening unrelated traffic?

Accepted Answer

Add payments egress permission to ledger Pods on TCP 8443.

Answer

Add a second ingress policy allowing payments Pods to reach ledger on TCP 8443.

Answer

Permit ledger egress to payments on ephemeral ports so replies can return through the cluster.

Answer

Allow TCP 8443 between the node subnets in the VPC firewall, leaving the Pod policies unchanged.

Question 9

A travel site serves public fare displays at /fares?currency=USD and /fares?currency=EUR. Direct origin requests return the correct currency, but Cloud CDN sometimes returns the currency requested by the previous visitor. The backend service's cache key excludes query parameters. Responses contain no user-specific data, and caching must remain enabled. Which change prevents the mix-up?

Accepted Answer

Include the currency query parameter in the backend service's cache key.

Answer

Disable CDN caching until fare responses are separated by deployment.

Answer

Reduce the cache TTL to 30 seconds while retaining a single cache key for all currency variants.

Answer

Enable session affinity on the fare origin's backend service.

Question 10

A global retailer runs the same HTTPS application in us-central1 and europe-west1. Each region can carry the full production load. Clients must use one stable public IPv4 address, and new requests must continue after either region fails without waiting for a DNS change. The frontend must also route /catalog and /checkout to different backend services. Which design should be deployed?

Accepted Answer

A Premium Tier global external Application Load Balancer with healthy backends in both regions.

Answer

Regional external Application Load Balancers in both regions, with Cloud DNS failover between their public addresses.

Answer

A regional external Application Load Balancer with Standard Tier addressing.

Answer

An external proxy Network Load Balancer with cross-region backends and TLS termination on port 443.

Free PCNE Practice Questions

Domain 1: Designing and planning a Google Cloud VPC network 21% of exam

Question 1

Question 2

Question 3

Domain 2: Implementing a VPC network 20% of exam

Question 4

Question 5

Domain 3: Configuring managed network services 16% of exam

Question 6

Question 7

Domain 4: Configuring and implementing hybrid and multicloud network interconnectivity 16% of exam

Question 8

Domain 5: Managing, monitoring, and troubleshooting network operations 14% of exam

Question 9

Domain 6: Configuring, implementing and managing a cloud network security solution 13% of exam

Question 10

That's 10 of 1,030