PCNE sample questions

Question 1

You want to configure load balancing for an internet-facing, standard voice-over-IP (VOIP) application. Which type of load balancer should you use?

Accepted Answer

Internal TCP/UDP load balancer

Answer

HTTP(S) load balancer

Answer

Network load balancer

Answer

TCP/SSL proxy load balancer

Question 2

You want to create a service in GCP using IPv6. What should you do?

Accepted Answer

Configure a TCP Proxy with the designated IPv6 address.

Answer

Create the instance with the designated IPv6 address.

Answer

Configure a global load balancer with the designated IPv6 address.

Answer

Configure an internal load balancer with the designated IPv6 address.

Question 3

You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly. How should you configure the health check?

Accepted Answer

Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies theh ealth check.

Answer

Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.

Answer

Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.

Answer

Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.

Question 4

You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC. How should you configure the Distribution VPC?

Accepted Answer

Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.

Answer

Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.

Answer

Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.

Answer

Rename the default VPC as "Distribution" and peer it via network peering.

Question 5

You are migrating to Cloud DNS and want to import your BIND zone file. Which command should you use?

Accepted Answer

gcloud dns record-sets import ZONE_FILE -zone-file-format -zone MANAGED_ZONE

Answer

gcloud dns record-sets import ZONE_FILE -zone MANAGED_ZONE

Answer

gcloud dns record-sets import ZONE_FILE -replace-origin-ns -zone MANAGED_ZONE

Answer

gcloud dns record-sets import ZONE_FILE -delete-all-existing -zone MANAGED ZONE

Question 6

Your end users are located in close proximity to us-east1 and europe-westl. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.

How should you design this topology?

Accepted Answer

Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.

Answer

Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.

Answer

Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.

Answer

Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.

Question 7

You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.

What should you do?

Accepted Answer

Grant the iam.serviceAccountUser to your user account.

Answer

Grant the compute.instanceAdmin to your user account.

Answer

Grant the read-only privilege to the service account for the Cloud Storage bucket.

Answer

Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.

Question 8

Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers. The migration to GCP will be Iift-and-shift, and all requests to the servers will be served by a single network load balancer frontend. You want to use a GCP-native solution when possible.

How should you deploy this service in GCP?

Accepted Answer

Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.

Answer

Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.

Answer

Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.

Answer

Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal-priority static routes to the backend servers.

Question 9

You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses.

Which subnet mask should you use for the Pod IP address range?

Accepted Answer

/25

Answer

/21

Answer

/22

Answer

/23

Question 10

You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.

What should you do?

Accepted Answer

Check the VPC flow logs for the instance.

Answer

Try connecting to the instance via SSH, and check the logs.

Answer

Create a new firewall rule to allow traffic from port 22, and enable logs.

Answer

Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.

PCNE Sample Questions & Answers

Ready for the real thing?

PCNE Sample Questions & Answers

Related practice tests

Ready for the real thing?