PCNE Practice Test 5 — 25 Questions

Question 1

You need to create a serverless Network Endpoint Group (NEG) to attach to a Global HTTPS Load Balancer backend for a Cloud Run service. Which command should you use?

Accepted Answer

gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=serverless --cloud-run-service=my-service --region=us-central1. The correct command uses 'gcloud compute network-endpoint-groups create' with the '--network-endpoint-type=serverless' option and specifies the Cloud Run service via '--cloud-run-service'.

Answer

gcloud compute backend-services create backend-name --load-balancing-scheme=EXTERNAL --protocol=HTTP --global

Answer

gcloud compute instance-groups unmanaged create neg-name --zone=us-central1-a

Answer

gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=gce-vm-ip-port --zone=us-central1-a

Question 2

An engineer configures a Global HTTPS Load Balancer with a backend service pointing to an instance group. The health check is set to HTTP on port 80, check interval 5s, timeout 5s, healthy threshold 1, unhealthy threshold 1. After deployment, instances are marked unhealthy despite the application responding correctly on port 80. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the check interval. With timeout equal to check interval, the health check may not have enough time to complete before the next check starts, causing failures. The timeout should be less than the interval.

Answer

The health check is using HTTPS but the instance expects HTTP

Answer

The unhealthy threshold is set too high

Answer

The health check is not configured with a host header

Question 3

Your company uses Cloud DNS with a managed zone for example.com. You need to override DNS responses for a specific domain (e.g., internal.example.com) to point to an internal IP address. Which Cloud DNS feature should you use?

Accepted Answer

Response policies (RPZ). Cloud DNS response policies (RPZ) allow you to override DNS responses for domains within a VPC. You can create a response policy with rules that modify DNS responses for specified domains.

Answer

DNS forwarding zones

Answer

Peering zones

Answer

Managed zones with private visibility

Question 4

A company wants to use Cloud CDN to serve content from a custom origin that is not hosted on Google Cloud. They have enabled Cloud CDN with a backend bucket pointing to an external origin URL. However, content is not being cached. What is a likely reason?

Accepted Answer

The origin does not return Cache-Control or Expires headers.. Cloud CDN with an external origin requires the origin to return explicit cache headers (Cache-Control or Expires) to enable caching. If the origin does not return caching headers, Cloud CDN will not cache the content. Force cache all mode can override this, but if not set, caching may not occur.

Answer

The custom origin does not support HTTPS.

Answer

The origin is not configured in the backend bucket as an internet NEG.

Answer

The load balancer is a Global TCP Proxy, not HTTP.

Question 5

An engineer manages a global application using Global external HTTP(S) Load Balancer with URL map routing to multiple backend services. They want to enable Cloud CDN for the /images/* path. What is the correct way to enable CDN for that specific path?

Accepted Answer

Enable CDN on the backend service that serves /images/*. To enable CDN for a specific path, you must create a backend bucket (or backend service with CDN enabled) and configure a URL map rule that routes the path /images/* to that backend. Enabling CDN on the backend service itself will apply to all paths served by that backend.

Answer

Use the gcloud compute url-maps add-path-matcher command with --cache-mode

Answer

Set a cache key header for /images/* in the URL map

Answer

Enable Cloud CDN at the load balancer level

Question 6

An organization wants to direct traffic from a global load balancer to an on-premises data center using a hybrid connectivity NEG. Which connectivity option must be in place for this to work?

Accepted Answer

Cloud VPN or Cloud Interconnect. Hybrid connectivity NEGs require a Cloud VPN tunnel or Cloud Interconnect VLAN attachment to connect GCP to on-premises. The NEG points to endpoints reachable over that connection.

Answer

Dedicated Interconnect without VLAN attachments

Answer

Direct peering with Google

Answer

VPC Network Peering

Question 7

A network engineer is troubleshooting a global HTTPS load balancer that is not serving traffic to some users. The load balancer has a backend service with a zonal NEG in us-central1-a. Users report intermittent 502 errors. Which two checks should the engineer perform? (Choose two.)

Accepted Answer

Verify that the health check for the backend service is passing. Common causes for 502 errors include health check failures and mismatched SSL certificates. Check that the health check passes and that the SSL certificate covers the domain.

Answer

Increase the size of the instance group

Answer

Disable HTTP/2 on the backend

Answer

Ensure Cloud CDN is enabled

Question 8

You are migrating an on-premises application to Google Cloud and need to connect it to Cloud Run services via a load balancer. The on-premises network uses a VPN to GCP. Which TWO components are required to route traffic from on-premises to a serverless NEG? (Choose 2)

Accepted Answer

Regional Internal HTTP(S) Load Balancer. A hybrid connectivity NEG is used to route traffic to on-premises backends. For traffic from on-premises to serverless, you need a serverless NEG and an internal load balancer that can route to it. The hybrid NEG is for the reverse direction.

Answer

Cloud Router

Answer

Hybrid connectivity NEG

Answer

Cloud VPN tunnel

Question 9

You are deploying a microservices architecture on Google Kubernetes Engine (GKE) with Traffic Director for traffic management. You want to implement fault injection to test the resilience of your services. Which two types of fault injection does Traffic Director support? (Choose two.)

Accepted Answer

Delay. Traffic Director supports fault injection of delays and errors (aborts).

Answer

CPU exhaustion

Answer

Packet loss

Answer

Bandwidth throttling

Question 10

A team needs to perform a health check for a gRPC backend service. Which health check type should they use?

Accepted Answer

gRPC health check. Cloud Load Balancing supports HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC health checks. For gRPC backends, the gRPC health check is the most appropriate.

Answer

HTTP health check

Answer

TCP health check

Answer

SSL health check

Question 11

A global HTTPS load balancer is configured with a backend service that points to a serverless NEG for Cloud Run services. Some requests are failing with 502 errors. What is a likely cause?

Accepted Answer

The serverless NEG is in a different region than the load balancer's forwarding rule.. Serverless NEGs require the load balancer to be in the same region as the Cloud Run service, or use a global external load balancer with serverless NEGs in multiple regions. A 502 error often indicates connectivity issues, such as the load balancer not being able to reach the backend due to missing network endpoint group or incorrect region.

Answer

The SSL certificate is expired.

Answer

The Cloud Run service requires IAP authentication.

Answer

The health check is misconfigured for serverless NEGs.

Question 12

You need to distribute incoming TCP traffic to a set of Compute Engine instances in the same region while preserving the client IP address. The load balancer must be used for non-HTTP(S) workloads. Which load balancer should you choose?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and works for TCP/UDP traffic.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 13

A company wants to serve static content from a Cloud Storage bucket and dynamic content from Compute Engine VMs behind a single external URL. Which GCP feature allows this configuration?

Accepted Answer

URL map. URL map in the Global HTTPS Load Balancer can route requests to different backends (backend bucket for static, backend service for dynamic) based on URL path.

Answer

Traffic Director

Answer

Cloud CDN

Answer

Cloud DNS

Question 14

An organization is deploying a Global HTTPS Load Balancer with Cloud Armor and Cloud CDN. They want to ensure that only requests with a valid signed cookie can access private content. Which three steps are required? (Choose THREE.)

Accepted Answer

Create the signed cookie using the key and set it in the client.. To use signed cookies with Cloud CDN, you must: 1) Enable Cloud CDN on the backend service or bucket, 2) Create a Cloud CDN signed request key (key name and secret), 3) Create the signed cookie with the key and set it on the client. The load balancer will then validate the cookie. There is no need to configure a separate IAM policy for the cookie.

Answer

Configure a Cloud Armor security policy to validate the cookie.

Answer

Set a Cache-Control header to private.

Question 15

A developer is configuring a Compute Engine VM to host a web server. They want to ensure that only HTTP (port 80) and HTTPS (port 443) traffic from the internet is allowed. Which firewall rule should they create?

Accepted Answer

Ingress allow rule for TCP ports 80 and 443 from 0.0.0.0/0.. For web server traffic, you need ingress rules that allow TCP on ports 80 and 443 from source 0.0.0.0/0. The target should be the VM (by tag or service account). A single rule can specify multiple ports.

Answer

Egress allow rule for TCP ports 80 and 443 to 0.0.0.0/0.

Answer

Ingress deny rule for all ports except 80 and 443.

Answer

Egress deny rule for all ports.

Question 16

A company uses Dedicated Interconnect to connect their on-premises data center to Google Cloud. They have enabled Private Google Access on the VPC subnet to allow on-premises hosts to access Google APIs via private IPs over the interconnect. Performance tests show that throughput to Google APIs is lower than expected, and the interconnect link utilization is below 30%. What should they do to improve throughput?

Accepted Answer

Create a Private Service Connect endpoint for Google APIs with multiple IP addresses.. Private Google Access (PGA) uses the default Internet Gateway to route traffic to Google APIs, which can lead to throughput limitations due to source NAT and flow hashing constraints. Creating a Private Service Connect (PSC) endpoint for Google APIs with multiple IP addresses allows traffic to be load-balanced across multiple endpoints, improving throughput by enabling ECMP (Equal-Cost Multi-Path) routing over the Dedicated Interconnect, thus better utilizing the available bandwidth.

Answer

Reduce the MTU on the interconnect to reduce packet loss.

Answer

Add another Dedicated Interconnect attachment.

Answer

Enable Cloud NAT to provide multiple public IPs.

Question 17

A company is setting up VPC peering between two VPCs. They need the peered VPC to be able to reach the entire subnets of their VPC, including those that may be added in the future. Which configuration is required?

Accepted Answer

Enable 'Export custom routes' on the peering connection. Exporting custom routes from the VPC ensures that any future subnets (which create custom routes) are advertised to the peer.

Answer

Create static routes in the peer VPC for each subnet

Answer

Use a VPN instead of VPC peering

Answer

Enable 'Import custom routes' on the peering connection

Question 18

A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?

Accepted Answer

Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.. Cloud NAT uses source network address translation (SNAT) and maps internal IPs to the NAT IP using ports. By default, Cloud NAT allocates a range of ports per VM. If the instances are making many connections, they may exhaust the allocated ports. The symptom that only some instances fail suggests that the failing instances may have run out of ephemeral ports. Option D is correct: Increase the number of NAT IP addresses or increase the minimum ports per VM.

Answer

The instances are using different service accounts, and the NAT is not configured to allow all.

Answer

The Cloud NAT's idle timeout is set too low, causing connections to be dropped.

Answer

The external API endpoint has a rate limit that is being hit by the NAT IP.

Question 19

A company has deployed a Global External Application Load Balancer with Premium Tier and enables Cloud CDN. Users in Europe report high latency, while users in the US have good performance. The backend is a regional NEG in us-west1. What is the most likely cause?

Accepted Answer

The origin server is sending 'Cache-Control: private' headers, preventing Cloud CDN from caching.. Cloud CDN cannot cache responses that include a 'Cache-Control: private' header. This header instructs intermediate caches (including CDN nodes) not to store the response, forcing all requests to go to the origin server in us-west1. Users in Europe experience high latency because their requests must traverse the long distance to the US origin, while US users benefit from shorter paths. Enabling Cloud CDN alone does not guarantee caching; the origin must also allow caching by omitting 'private' or setting appropriate 'Cache-Control: public' and 'max-age' directives.

Answer

The load balancer is using Premium Tier, which routes to the nearest backend; the backend is only in us-west1.

Answer

Cloud CDN is not enabled on the load balancer.

Answer

The load balancer is using Standard Tier, which does not support global anycast.

Question 20

An organization has multiple VPC networks in a project and wants to centrally manage firewall rules across all networks using a single set of rules. Which approach should they take?

Accepted Answer

Use hierarchical firewall policies at the folder level. Firewall rules are per network. To centrally manage rules, you can use hierarchical firewall policies (part of VPC Firewall Policies) applied at the organization or folder level, which override network-specific rules.

Answer

Use firewall rules with global scope

Answer

Create a single VPC network and use subnetting

Answer

Use shared VPC and apply firewall rules to the host project