PCNE Practice Test 11 — 15 Questions

Question 1

You need to create a serverless Network Endpoint Group (NEG) to attach to a Global HTTPS Load Balancer backend for a Cloud Run service. Which command should you use?

Accepted Answer

gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=serverless --cloud-run-service=my-service --region=us-central1. The correct command uses 'gcloud compute network-endpoint-groups create' with the '--network-endpoint-type=serverless' option and specifies the Cloud Run service via '--cloud-run-service'.

Answer

gcloud compute backend-services create backend-name --load-balancing-scheme=EXTERNAL --protocol=HTTP --global

Answer

gcloud compute instance-groups unmanaged create neg-name --zone=us-central1-a

Answer

gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=gce-vm-ip-port --zone=us-central1-a

Question 2

An engineer configures a Global HTTPS Load Balancer with a backend service pointing to an instance group. The health check is set to HTTP on port 80, check interval 5s, timeout 5s, healthy threshold 1, unhealthy threshold 1. After deployment, instances are marked unhealthy despite the application responding correctly on port 80. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the check interval. With timeout equal to check interval, the health check may not have enough time to complete before the next check starts, causing failures. The timeout should be less than the interval.

Answer

The health check is using HTTPS but the instance expects HTTP

Answer

The unhealthy threshold is set too high

Answer

The health check is not configured with a host header

Question 3

Your company uses Cloud DNS with a managed zone for example.com. You need to override DNS responses for a specific domain (e.g., internal.example.com) to point to an internal IP address. Which Cloud DNS feature should you use?

Accepted Answer

Response policies (RPZ). Cloud DNS response policies (RPZ) allow you to override DNS responses for domains within a VPC. You can create a response policy with rules that modify DNS responses for specified domains.

Answer

DNS forwarding zones

Answer

Peering zones

Answer

Managed zones with private visibility

Question 4

A company wants to use Cloud CDN to serve content from a custom origin that is not hosted on Google Cloud. They have enabled Cloud CDN with a backend bucket pointing to an external origin URL. However, content is not being cached. What is a likely reason?

Accepted Answer

The origin does not return Cache-Control or Expires headers.. Cloud CDN with an external origin requires the origin to return explicit cache headers (Cache-Control or Expires) to enable caching. If the origin does not return caching headers, Cloud CDN will not cache the content. Force cache all mode can override this, but if not set, caching may not occur.

Answer

The custom origin does not support HTTPS.

Answer

The origin is not configured in the backend bucket as an internet NEG.

Answer

The load balancer is a Global TCP Proxy, not HTTP.

Question 5

An engineer manages a global application using Global external HTTP(S) Load Balancer with URL map routing to multiple backend services. They want to enable Cloud CDN for the /images/* path. What is the correct way to enable CDN for that specific path?

Accepted Answer

Enable CDN on the backend service that serves /images/*. To enable CDN for a specific path, you must create a backend bucket (or backend service with CDN enabled) and configure a URL map rule that routes the path /images/* to that backend. Enabling CDN on the backend service itself will apply to all paths served by that backend.

Answer

Use the gcloud compute url-maps add-path-matcher command with --cache-mode

Answer

Set a cache key header for /images/* in the URL map

Answer

Enable Cloud CDN at the load balancer level

Question 6

An organization wants to direct traffic from a global load balancer to an on-premises data center using a hybrid connectivity NEG. Which connectivity option must be in place for this to work?

Accepted Answer

Cloud VPN or Cloud Interconnect. Hybrid connectivity NEGs require a Cloud VPN tunnel or Cloud Interconnect VLAN attachment to connect GCP to on-premises. The NEG points to endpoints reachable over that connection.

Answer

Dedicated Interconnect without VLAN attachments

Answer

Direct peering with Google

Answer

VPC Network Peering

Question 7

A network engineer is troubleshooting a global HTTPS load balancer that is not serving traffic to some users. The load balancer has a backend service with a zonal NEG in us-central1-a. Users report intermittent 502 errors. Which two checks should the engineer perform? (Choose two.)

Accepted Answer

Verify that the health check for the backend service is passing. Common causes for 502 errors include health check failures and mismatched SSL certificates. Check that the health check passes and that the SSL certificate covers the domain.

Answer

Increase the size of the instance group

Answer

Disable HTTP/2 on the backend

Answer

Ensure Cloud CDN is enabled

Question 8

You are migrating an on-premises application to Google Cloud and need to connect it to Cloud Run services via a load balancer. The on-premises network uses a VPN to GCP. Which TWO components are required to route traffic from on-premises to a serverless NEG? (Choose 2)

Accepted Answer

Regional Internal HTTP(S) Load Balancer. A hybrid connectivity NEG is used to route traffic to on-premises backends. For traffic from on-premises to serverless, you need a serverless NEG and an internal load balancer that can route to it. The hybrid NEG is for the reverse direction.

Answer

Cloud Router

Answer

Hybrid connectivity NEG

Answer

Cloud VPN tunnel

Question 9

You are deploying a microservices architecture on Google Kubernetes Engine (GKE) with Traffic Director for traffic management. You want to implement fault injection to test the resilience of your services. Which two types of fault injection does Traffic Director support? (Choose two.)

Accepted Answer

Delay. Traffic Director supports fault injection of delays and errors (aborts).

Answer

CPU exhaustion

Answer

Packet loss

Answer

Bandwidth throttling

Question 10

A team needs to perform a health check for a gRPC backend service. Which health check type should they use?

Accepted Answer

gRPC health check. Cloud Load Balancing supports HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC health checks. For gRPC backends, the gRPC health check is the most appropriate.

Answer

HTTP health check

Answer

TCP health check

Answer

SSL health check

Question 11

A global HTTPS load balancer is configured with a backend service that points to a serverless NEG for Cloud Run services. Some requests are failing with 502 errors. What is a likely cause?

Accepted Answer

The serverless NEG is in a different region than the load balancer's forwarding rule.. Serverless NEGs require the load balancer to be in the same region as the Cloud Run service, or use a global external load balancer with serverless NEGs in multiple regions. A 502 error often indicates connectivity issues, such as the load balancer not being able to reach the backend due to missing network endpoint group or incorrect region.

Answer

The SSL certificate is expired.

Answer

The Cloud Run service requires IAP authentication.

Answer

The health check is misconfigured for serverless NEGs.

Question 12

You need to distribute incoming TCP traffic to a set of Compute Engine instances in the same region while preserving the client IP address. The load balancer must be used for non-HTTP(S) workloads. Which load balancer should you choose?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and works for TCP/UDP traffic.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 13

A company wants to serve static content from a Cloud Storage bucket and dynamic content from Compute Engine VMs behind a single external URL. Which GCP feature allows this configuration?

Accepted Answer

URL map. URL map in the Global HTTPS Load Balancer can route requests to different backends (backend bucket for static, backend service for dynamic) based on URL path.

Answer

Traffic Director

Answer

Cloud CDN

Answer

Cloud DNS

Question 14

An organization is deploying a Global HTTPS Load Balancer with Cloud Armor and Cloud CDN. They want to ensure that only requests with a valid signed cookie can access private content. Which three steps are required? (Choose THREE.)

Accepted Answer

Create the signed cookie using the key and set it in the client.. To use signed cookies with Cloud CDN, you must: 1) Enable Cloud CDN on the backend service or bucket, 2) Create a Cloud CDN signed request key (key name and secret), 3) Create the signed cookie with the key and set it on the client. The load balancer will then validate the cookie. There is no need to configure a separate IAM policy for the cookie.

Answer

Configure a Cloud Armor security policy to validate the cookie.

Answer

Set a Cache-Control header to private.

Question 15

A developer is configuring a Compute Engine VM to host a web server. They want to ensure that only HTTP (port 80) and HTTPS (port 443) traffic from the internet is allowed. Which firewall rule should they create?

Accepted Answer

Ingress allow rule for TCP ports 80 and 443 from 0.0.0.0/0.. For web server traffic, you need ingress rules that allow TCP on ports 80 and 443 from source 0.0.0.0/0. The target should be the VM (by tag or service account). A single rule can specify multiple ports.

Answer

Egress allow rule for TCP ports 80 and 443 to 0.0.0.0/0.

Answer

Ingress deny rule for all ports except 80 and 443.

Answer

Egress deny rule for all ports.