PCNE Practice Test 25 — 15 Questions

Question 1

You are configuring a Global External HTTPS Load Balancer. Which TWO components are required to route traffic to a Cloud Run service via a serverless NEG? (Select two.)

Accepted Answer

Serverless NEG. A serverless NEG is a backend that points to a Cloud Run service, and a backend service is needed to define health checks and other settings.

Answer

Health check

Answer

Target proxy

Answer

URL map

Question 2

A company hosts a web application on Cloud Run and wants to serve content from a Cloud Storage bucket for static assets. They plan to use a global HTTPS load balancer with a URL map to route requests. Which backend type should they configure for the static content?

Accepted Answer

Backend bucket (Cloud Storage bucket). Backend buckets are used to serve content from Cloud Storage buckets via a load balancer. Serverless NEGs are for Cloud Run/Functions, not Cloud Storage.

Answer

Serverless NEG (Cloud Run)

Answer

Zonal NEG (Compute Engine)

Answer

Internet NEG (external endpoint)

Question 3

A company wants to enable mTLS between microservices in a service mesh managed by Traffic Director. They have deployed Envoy sidecars. What must be configured to enforce mTLS?

Accepted Answer

The mTLS mode in Traffic Director's mesh configuration. Traffic Director uses the mTLS mode in the Envoy configuration. The correct way is to set the tls_mode to STRICT in the TrafficDirector's mesh configuration.

Answer

An SSL policy on the load balancer

Answer

A VPC Service Controls perimeter

Answer

A Cloud Armor security policy

Question 4

A company uses Traffic Director with Envoy sidecars. They want to implement traffic splitting to gradually migrate traffic from version v1 to v2 of a service. Which TWO resources must be configured? (Select two.)

Accepted Answer

TrafficDirectorRoute with traffic splitting rules. Traffic splitting in Traffic Director is configured via routing rules (TrafficDirectorRoute) and backend services (or weighted backends).

Answer

Health check

Answer

Firewall rule

Answer

Cloud CDN cache key

Question 5

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between services. Which configuration must be enabled?

Accepted Answer

Enable mTLS in the Traffic Director mesh configuration. Traffic Director supports mTLS through the Mesh TLS configuration, which enforces TLS mutual authentication between sidecars.

Answer

Configure SSL certificates on each Envoy sidecar manually

Answer

Use Cloud NAT to hide internal IPs

Answer

Enable Cloud Armor on the service

Question 6

A network engineer configures a Global external HTTP(S) Load Balancer with a serverless NEG backend pointing to Cloud Run. The load balancer returns 502 Bad Gateway errors. What is the most likely cause?

Accepted Answer

The Cloud Run service has ingress set to 'internal'. Serverless NEG for Cloud Run requires that the Cloud Run service is publicly accessible or that the ingress is set to allow all traffic. Additionally, the load balancer's health checks must pass. A common cause is that the Cloud Run service has ingress restricted to internal traffic only.

Answer

The URL map is misconfigured

Answer

The SSL certificate is expired

Answer

The serverless NEG is not supported for Cloud Run

Question 7

You want to distribute traffic across multiple GKE clusters in different regions with automatic failover if a region becomes unhealthy. Which Cloud DNS routing policy should you use?

Accepted Answer

Failover. Failover routing policy allows you to set primary and secondary targets; DNS automatically responds with the secondary if the primary is unhealthy.

Answer

Simple (no policy)

Answer

Weighted round robin

Answer

Geolocation

Question 8

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between all services. Which component is responsible for issuing and distributing certificates to the Envoy proxies?

Accepted Answer

Google Cloud Certificate Authority Service. Traffic Director integrates with Certificate Authority Service (CAS) or uses its own CA to issue certificates for mTLS. Envoy's SDS (Secret Discovery Service) can also be used, but Traffic Director manages the CA.

Answer

Envoy's built-in certificate management

Answer

Secret Manager

Answer

Cloud KMS

Question 9

A company uses Cloud CDN to serve content. They need to generate signed URLs to allow temporary access to premium content. They have set up a signing key. Which command correctly generates a signed URL for the object /video.mp4 in a bucket served by a load balancer?

Accepted Answer

gcloud compute sign-url --key-name mykey --expires 2024-12-31T23:59:59Z https://example.com/video.mp4. The gcloud compute sign-url command is used to sign URLs for Cloud CDN. It requires the --key-name and --expires flags.

Answer

gcloud compute url-maps sign-url --key-name mykey https://example.com/video.mp4

Answer

gsutil signurl --key-name mykey https://example.com/video.mp4

Answer

gcloud storage sign-url --key-name mykey --expires 2024-12-31T23:59:59Z https://example.com/video.mp4

Question 10

You need to configure health checks for a backend service that uses gRPC for health checking. Which health check type should you use?

Accepted Answer

gRPC. For gRPC health checks, the correct health check type is gRPC, which sends a gRPC HealthCheckRequest to the backend.

Answer

HTTP

Answer

TCP

Answer

HTTPS

Question 11

A company wants to use Cloud CDN to serve private content to authenticated users only. Which feature should they use?

Accepted Answer

Signed URLs. Signed URLs or signed cookies allow Cloud CDN to serve private content by requiring a valid signature for access.

Answer

Cache invalidation

Answer

IAM roles on the backend bucket

Answer

Cloud Armor

Question 12

A company wants to cache static content globally to reduce latency for their users. They are using a Global HTTPS Load Balancer with a backend bucket. Which Cloud CDN cache mode should they use?

Accepted Answer

CACHE_ALL_STATIC. CACHE_ALL_STATIC caches static content based on file extension and response headers, which is suitable for a backend bucket serving static files.

Answer

None: Cloud CDN cannot be used with backend buckets

Answer

USE_ORIGIN_HEADERS

Answer

FORCE_CACHE_ALL

Question 13

An engineer wants to use Traffic Director to split traffic between two versions of a microservice running on Compute Engine with Envoy sidecars. They want to send 10% of traffic to the new version. Which configuration should they apply?

Accepted Answer

Create a weighted backend service with versionA weight 90 and versionB weight 10. Traffic Director uses traffic splitting rules with weight percentages. The backend service or routing rule allows assigning weights to different versions.

Answer

Use HTTP load balancer URL map to route 10% of requests

Answer

Configure a firewall rule to drop 10% of traffic to versionA

Answer

Deploy versionB in a different region and use geo-routing

Question 14

While configuring a health check for a backend service, an engineer notices that the health check is failing even though the instances are healthy. The health check is HTTP on port 80 with a request path of /health. The instances respond to curl http://localhost:80/health with 200 OK. What is a likely cause?

Accepted Answer

Firewall rules are blocking traffic from health check ranges. Health checks originate from Google's health check systems, which use source IP ranges. A firewall rule must allow traffic from those ranges. Other options are not as likely.

Answer

The backend service is not using an instance group

Answer

The health check protocol should be HTTPS

Answer

The health check interval is too long

Question 15

A company needs to map multiple domain names to different backend services on a single Global HTTPS Load Balancer. Which resource should they configure to direct traffic based on the requested hostname?

Accepted Answer

URL map. The URL map defines rules for routing based on hostnames and paths. SSL certificates are for termination, target proxies forward traffic, and backend services are the destination.

Answer

Backend service

Answer

Target proxy

Answer

SSL certificate