PCNE sample questions

Question 1

You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.

What should you do?

Accepted Answer

• Create a Cloud VPN instance.
• Create a route-based VPN tunnel.
• Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.
• Configure the appropriate static routes.

Answer

• Create a Cloud VPN instance.
• Create a policy-based VPN tunnel per subnet.
• Configure the appropriate local and remote traffic selectors to match your local and remote networks.
• Create the appropriate static routes.

Answer

• Create a Cloud VPN instance.
• Create a policy-based VPN tunnel.
• Configure the appropriate local and remote traffic selectors to match your local and remote networks.
• Configure the appropriate static routes.

Answer

• Create a Cloud VPN instance.
• Create a route-based VPN tunnel.
• Configure the appropriate local and remote traffic selectors to match your local and remote networks.
• Configure the appropriate static routes.

Question 2

You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.

What should you do?

Accepted Answer

Disable DNSSEC at your domain registrar.

Answer

Update the TTL for the zone.

Answer

Set the zone to the TRANSFER state.

Answer

Transfer ownership of the domain to a new registrar.

Question 3

Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load- balanced across the 2 connections as desired.

During troubleshooting you find:

• Each on-premises router is configured with the same ASN.
• Each on-premises router is configured with the same routes and priorities.
• Both on-premises routers are configured with a VPN connected to a single Cloud Router.
• The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
• BGP session is not established between one on-premises router and the Cloud Router.

What is the most likely cause of this problem?

Accepted Answer

You do not have a load balancer to load-balance the network traffic.

Answer

One of the VPN sessions is configured incorrectly.

Answer

A firewall is blocking the traffic across the second VPN connection.

Answer

BGP sessions are not established between both on-premises routers and the Cloud Router.

Question 4

You want to configure load balancing for an internet-facing, standard voice-over-IP (VOIP) application.

Which type of load balancer should you use?

Accepted Answer

Internal TCP/UDP load balancer

Answer

HTTP(S) load balancer

Answer

Network load balancer

Answer

TCP/SSL proxy load balancer

Question 5

You want to create a service in GCP using IPv6.

What should you do?

Accepted Answer

Configure a TCP Proxy with the designated IPv6 address.

Answer

Create the instance with the designated IPv6 address.

Answer

Configure a global load balancer with the designated IPv6 address.

Answer

Configure an internal load balancer with the designated IPv6 address.

Question 6

You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.

How should you configure the health check?

Accepted Answer

Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies theh ealth check.

Answer

Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.

Answer

Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.

Answer

Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.

Question 7

You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.

How should you configure the Distribution VPC?

Accepted Answer

Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.

Answer

Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.

Answer

Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.

Answer

Rename the default VPC as "Distribution" and peer it via network peering.

Question 8

You are migrating to Cloud DNS and want to import your BIND zone file.

Which command should you use?

Accepted Answer

gcloud dns record-sets import ZONE_FILE -zone-file-format -zone MANAGED_ZONE

Answer

gcloud dns record-sets import ZONE_FILE -zone MANAGED_ZONE

Answer

gcloud dns record-sets import ZONE_FILE -replace-origin-ns -zone MANAGED_ZONE

Answer

gcloud dns record-sets import ZONE_FILE -delete-all-existing -zone MANAGED ZONE

Question 9

Your end users are located in close proximity to us-east1 and europe-westl. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.

How should you design this topology?

Accepted Answer

Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.

Answer

Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.

Answer

Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.

Answer

Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.

Question 10

You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.

What should you do?

Accepted Answer

Grant the iam.serviceAccountUser to your user account.

Answer

Grant the compute.instanceAdmin to your user account.

Answer

Grant the read-only privilege to the service account for the Cloud Storage bucket.

Answer

Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.

Free PCNE sample questions

You want to configure load balancing for an internet-facing, standard voice-over-IP (VOIP) application. Which type of load balancer should you use?

You want to create a service in GCP using IPv6. What should you do?

You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly. How should you configure the health check?

You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC. How should you configure the Distribution VPC?

You are migrating to Cloud DNS and want to import your BIND zone file. Which command should you use?

Your end users are located in close proximity to us-east1 and europe-westl. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency. How should you design this topology?

You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible. What should you do?

10 more free samples are waiting