PCNE Practice Test 20 — 15 Questions

Question 1

An organization uses Cloud DNS with a managed zone for example.com. They want to block or override DNS queries for a specific malicious domain (malware.com) to return a sinkhole IP address. Which Cloud DNS feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Response Policy Zone (RPZ). Response Policy Zones (RPZ) allow DNS administrators to override DNS responses for specific domains, such as redirecting malicious domains to a sinkhole.

Answer

DNS forwarding

Answer

DNS peering

Answer

Managed zone with DNSSEC

Question 2

An organization uses Cloud CDN to serve static content from a backend bucket. They want to ensure that content is always served from the edge regardless of cache-control headers from the origin. Which cache mode should they set?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL mode forces Cloud CDN to cache all content, ignoring origin cache directives. CACHE_ALL_STATIC caches based on file type, USE_ORIGIN_HEADERS respects origin headers.

Answer

USE_ORIGIN_HEADERS

Answer

ENABLE_CACHE

Answer

CACHE_ALL_STATIC

Question 3

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

Accepted Answer

USE_ORIGIN_HEADERS. USE_ORIGIN_HEADERS mode respects the origin's Cache-Control headers. Only objects with Cache-Control: public or similar will be cached.

Answer

CACHE_ALL_STATIC

Answer

None of the above

Answer

FORCE_CACHE_ALL

Question 4

To enable DNSSEC for a Cloud DNS managed zone, what must be configured?

Accepted Answer

Set the DNSSEC state to 'on' for the zone. DNSSEC is enabled at the zone level by setting the DNSSEC state to 'on'. This can be done via the console or gcloud with '--dnssec-state=on'.

Answer

Create a response policy

Answer

Add DS records to the parent zone

Answer

Set the zone type to private

Question 5

Which Google Cloud service provides a managed Envoy proxy control plane for traffic management, including traffic splitting and fault injection, in a service mesh?

Accepted Answer

Traffic Director. Traffic Director is the managed control plane for Envoy-based service mesh, providing traffic management features.

Answer

Cloud Endpoints

Answer

Cloud Load Balancing

Answer

Anthos Service Mesh

Question 6

Which Traffic Director feature ensures that a service does not receive more requests than it can handle by setting a maximum number of concurrent requests or connections?

Accepted Answer

Circuit breakers. Circuit breakers are used to limit the number of concurrent connections or requests to a service to prevent overload. Fault injection is for testing. Traffic splitting is for gradual rollouts. mTLS is for mutual TLS authentication.

Answer

Traffic splitting

Answer

mTLS

Answer

Fault injection

Question 7

You need to migrate traffic gradually from an old version of a microservice to a new version using Traffic Director. You want to send 10% of traffic to the new version and 90% to the old version. Which configuration should you use?

Accepted Answer

Configure a weighted destination rule in the Envoy route with weights 9:1.. Traffic Director supports traffic splitting via weighted destination rules in the Envoy configuration. The correct approach is to specify weights for each service version in the route rule. Setting circuit breaker thresholds or using connection draining does not achieve traffic splitting.

Answer

Create two separate backend services and use a URL map to distribute traffic.

Answer

Set circuit breaker thresholds to limit connections to the new version.

Answer

Use a health check to gradually remove the old version instances.

Question 8

A company uses Cloud DNS with a managed zone for 'example.com'. They want to implement a failover routing policy so that if the primary health check fails, traffic is sent to a secondary IP. Which THREE resources need to be configured? (Choose three.)

Accepted Answer

A DNS record set of type A with a routing policy. To set up failover routing, you need a health check for the primary endpoint, a DNS record set with a routing policy that specifies the primary and secondary targets, and the routing policy configured with failover type. A network tag is not used in DNS. A load balancer is not required; failover routing can point directly to IP addresses.

Answer

A network tag on the Compute Engine instances

Answer

A load balancer to front the endpoints

Question 9

You are designing a global web application that uses Cloud Run for the backend and Cloud Storage for static assets. You need to serve content securely over HTTPS with a custom domain, using Cloud CDN for caching. Which resources must be created or configured? (Choose three.)

Accepted Answer

SSL certificate resource. Global HTTPS LB with backend bucket (for GCS) and serverless NEG (for Cloud Run) is the architecture. SSL certificate is needed for HTTPS. IAP is for authentication, not required. URL map is required for routing. Zonal NEG is not needed for Cloud Run.

Answer

Zonal NEG for Cloud Run

Answer

Identity-Aware Proxy (IAP)

Question 10

A network engineer wants to test whether a Compute Engine VM can reach a Cloud SQL instance in a different VPC network, considering firewall rules and VPC peering. Which Google Cloud tool should they use?

Accepted Answer

Connectivity Tests. Connectivity Tests in Network Intelligence Center allows you to specify source and destination (including IP addresses, instances, or Google APIs) and evaluate reachability based on firewall rules, routes, VPC peering, and other policy configurations.

Answer

VPC Flow Logs

Answer

Firewall Insights

Answer

Packet Mirroring

Question 11

A network engineer is using Connectivity Tests to diagnose a reachability issue between two instances in the same VPC but different subnets. The test indicates that traffic is denied by firewall rules. However, the engineer cannot find any firewall rule denying the traffic. What is a possible explanation?

Accepted Answer

The firewall rule is in a different project that is not being checked. If there is an implied deny rule that is not explicitly listed, Connectivity Tests may still show it as the reason. Also, firewall rules are stateful; if return traffic is not matched, it could be denied. But a common oversight is that the firewall rule is in a different project (if using shared VPC) or the rule is disabled.

Answer

The subnet is in a different region

Answer

VPC Flow Logs are not enabled

Answer

The instances have external IPs

Question 12

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

Accepted Answer

One VPC has a more specific route that overrides the peering route. If both VPCs have routes to each other via different paths (e.g., one using peering and the other using a VPN), traffic may take asymmetric paths. VPC peering does not support transitive routing, but misconfigured routes can cause asymmetry.

Answer

VPC Flow Logs are not enabled

Answer

The MTU is mismatched between the VPCs

Answer

Firewall rules are blocking the return traffic

Question 13

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Accepted Answer

Geo routing policy. Geo routing policy directs traffic based on user location, and failover policy provides automatic failover to a backup if health check fails. Weighted round-robin distributes by weight, not location. DNSSEC is a security extension.

Answer

Weighted round-robin

Answer

DNSSEC

Answer

Response policy zone

Question 14

An organization uses Cloud DNS private zones for internal service discovery. They want to override DNS responses for a specific domain (e.g., 'internal.example.com') to block access to malicious domains and redirect certain queries to a different IP for compliance. Which Cloud DNS feature should they use?

Accepted Answer

Response Policies (RPZ). Cloud DNS Response Policies (RPZ) allow overriding DNS responses based on policy rules. They can be used to block domains (by returning NXDOMAIN or redirecting to a sink IP) or to reroute queries to alternative IPs. Routing policies are for authoritative zones to control traffic distribution, not for overriding responses. DNSSEC ensures authenticity but does not override DNS responses. Peering is for querying other zones, not overriding.

Answer

DNSSEC

Answer

Routing policies (weighted round robin, geolocation, failover)

Answer

Cloud DNS peering

Question 15

A network engineer wants to see a real-time graphical representation of the topology of their VPC network, including instances, subnets, and load balancers. Which Network Intelligence Center tool should they use?

Accepted Answer

Network Topology. Network Topology provides a visual map of your VPC network's resources and their relationships, updated in near real-time.

Answer

Performance Dashboard

Answer

Connectivity Tests

Answer

Firewall Insights