PCNE Configuring Network Services — 15 Questions

Question 1

Which THREE components are necessary to configure a global external HTTP(S) load balancer with Cloud CDN and an origin backend that requires authentication? (Choose three.)

Accepted Answer

An origin access identity (e.g., service account) to authenticate to the backend.. To configure a global external HTTP(S) load balancer with Cloud CDN and an authenticated origin backend, two components are essential: an origin access identity (e.g., a Google-managed service account) to authenticate requests from Cloud CDN to the backend (Option C), and a backend bucket with Cloud CDN enabled (Option D) to serve cached content. Cloud Armor (Option E) is optional for security, not a requirement. A TCP/SSL proxy (Option A) is for non-HTTP(S) traffic, and a regional load balancer (Option B) does not support Cloud CDN's global anycast IP.

Answer

A TCP or SSL proxy for protocol optimization.

Answer

A regional external HTTP(S) load balancer as the entry point.

Answer

Cloud Armor security policies to protect against attacks.

Question 2

You are using Serverless VPC Access to connect Cloud Run services to a VPC network. The connector is in us-central1 with a /28 subnet. You have a Cloud SQL instance (private IP) in the same region but in a different VPC network (peered). The Cloud Run service cannot reach the Cloud SQL instance. What is the most likely cause?

Accepted Answer

The VPC connector's subnet does not have a route to the peered VPC where Cloud SQL resides.. Serverless VPC Access routes traffic from Cloud Run through the connector's VPC. If the Cloud SQL instance is in a different VPC (even if peered), the connector's VPC must have a route to the peered VPC's subnet for the Cloud SQL private IP range. Since the connector's subnet is in us-central1 with a /28, it may not have such a route automatically. Option A is incorrect because Cloud SQL Proxy is not required for private IP access; it is needed for public IP or IAM-based access. Option B is incorrect because Private Google Access is used for accessing Google APIs, not for connectivity to a peered VPC. Option C is incorrect because Cloud SQL with private IP does not require an external IP; it is accessible within the VPC or through peering.

Answer

The Cloud SQL instance must have the Cloud SQL Proxy configured.

Answer

Serverless VPC Access requires Private Google Access to be enabled on the connector's subnet.

Answer

Cloud SQL requires an external IP for Serverless VPC Access connectivity.

Question 3

You want to manage DNS records for a domain that you own in Google Cloud DNS. You create a public managed zone and add A records. After waiting several hours, the domain does not resolve. What is the most likely missing step?

Accepted Answer

Update the registrar's name servers to the Google Cloud DNS name servers.. After creating a public zone, you must update the domain's registrar name servers to point to the Google Cloud DNS name servers assigned to the zone. Option B is wrong because a private zone is for internal DNS. Option C is wrong because DNSSEC is optional. Option D is wrong because forwarding is not required for public resolution.

Answer

Create a private zone for the domain.

Answer

Enable DNSSEC for the zone.

Answer

Set up DNS forwarding to Google's public DNS.

Question 4

Which TWO actions should you take to configure Private Google Access for on-premises hosts connected via Cloud Interconnect?

Accepted Answer

Advertise the reserved IP ranges (199.36.153.4/30, 199.36.153.8/30) to the on-premises router via BGP.. Correct answers: C and E. Option C is correct because you must advertise the reserved IP ranges (199.36.153.4/30 and 199.36.153.8/30) to the on-premises router via BGP to allow on-premises hosts to reach Google APIs through Cloud Interconnect. Option E is correct because Private Google Access must be enabled on the VPC subnet that has the interconnect attachment so that the subnet can route traffic to Google APIs privately. Option A is incorrect because Cloud NAT is for VMs without external IPs, not for on-premises networks. Option B is incorrect because DNS forwarding is not required; Private Google Access uses Google's internal DNS resolution. Option D is incorrect because Private Service Connect is for accessing managed services privately, not for general Private Google Access.

Answer

Configure Cloud NAT for the on-premises network.

Answer

Configure DNS forwarding to 8.8.8.8.

Answer

Create a Private Service Connect endpoint in the VPC.

Question 5

Which THREE considerations are important when designing a Cloud CDN configuration for a global web application that serves both static and dynamic content?

Accepted Answer

Configure the cache key to ignore query parameters that are session-specific to improve cache hit ratio.. Correct answers: B, C, D. Option B is correct because ignoring session-specific query parameters in the cache key increases cache hits by preventing duplicate cache entries for the same content. Option C is correct because using FORCE_CACHE_ALL for static assets maximizes caching, while USE_ORIGIN_HEADERS respects the origin's cache-control headers for dynamic content, ensuring appropriate caching behavior for each type. Option D is correct because origin shield adds an intermediary caching layer that reduces the number of requests to the origin server, improving performance and scalability. Option A is incorrect: negative caching for 404 responses is not a primary consideration for a global web application and can lead to unintended consequences if not configured carefully. Option E is incorrect: signed URLs are used for access control and content protection, not for caching optimization; they would unnecessarily restrict access to public content.

Answer

Enable negative caching for 404 responses to prevent unnecessary backend hits.

Answer

Use signed URLs for all content to ensure only authenticated users can access it.

Question 6

A company wants to use Traffic Director to implement circuit breaking for their microservices. Which two resources must be configured to enable circuit breaking? (Choose TWO.)

Accepted Answer

Traffic Director cluster. Traffic Director uses Envoy configurations. Circuit breaking is configured via the Envoy cluster resource by setting circuit breakers, and it relies on health check configurations to determine when to break circuits. The Traffic Director cluster resource holds the circuit breaker settings, while the health check configuration provides the health criteria for those circuit breakers.

Answer

Traffic Director service

Answer

Traffic Director route

Answer

Envoy filter

Question 7

A company runs a stateful TCP application on a zonal Managed Instance Group (MIG). They need to expose it to the internet using a load balancer that preserves the client IP address. Which TWO load balancer types meet this requirement? (Choose two.)

Accepted Answer

Regional External TCP/UDP Network Load Balancer. The requirement is for a load balancer that exposes a stateful TCP application to the internet while preserving client IP. The Regional External TCP/UDP Network Load Balancer (option E) is a passthrough load balancer that forwards packets directly to the backend instances, preserving the client IP. The other options (A, B, D) are proxy load balancers that terminate connections and do not preserve client IP. Option C is an internal load balancer that cannot directly expose the application to the internet.

Answer

Global External HTTPS Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Regional Internal TCP/UDP Network Load Balancer

Answer

Global SSL Proxy Load Balancer

Question 8

An organization has an internal application that runs on Compute Engine and needs to be load balanced within the same region using a Layer 7 load balancer. They want the load balancer to be accessible only from within their VPC. Which THREE components are needed? (Choose three.)

Accepted Answer

A Regional Internal HTTP(S) Load Balancer forwarding rule. The three required components for a Regional Internal HTTP(S) Load Balancer are the forwarding rule, backend service, and URL map. While a health check is necessary to define in the backend service, it is not a separate component of the load balancer itself. The SSL certificate is optional and only needed if HTTPS is used, not for basic internal load balancing.

Answer

A health check

Answer

An SSL certificate

Question 9

A company wants to migrate part of their on-premises workloads to Google Cloud but maintain connectivity using a hybrid NEG. Which TWO types of NEGs can be used for hybrid connectivity backends? (Choose two.)

Accepted Answer

Hybrid connectivity NEG. Only Hybrid connectivity NEGs (option A) are designed for on-premises endpoints connected via VPN or Dedicated Interconnect. Option C is not a distinct type; it is just a different instance of the same hybrid connectivity NEG. The question asks for two types, but there is only one type for hybrid connectivity backends.

Answer

Internet NEG

Answer

Another hybrid connectivity NEG with different endpoint groups

Answer

Serverless NEG

Answer

Zonal NEG

Question 10

A company has deployed a Global External Application Load Balancer with Premium Tier and enables Cloud CDN. Users in Europe report high latency, while users in the US have good performance. The backend is a regional NEG in us-west1. What is the most likely cause?

Accepted Answer

The origin server is sending 'Cache-Control: private' headers, preventing Cloud CDN from caching.. Cloud CDN cannot cache responses that include a 'Cache-Control: private' header. This header instructs intermediate caches (including CDN nodes) not to store the response, forcing all requests to go to the origin server in us-west1. Users in Europe experience high latency because their requests must traverse the long distance to the US origin, while US users benefit from shorter paths. Enabling Cloud CDN alone does not guarantee caching; the origin must also allow caching by omitting 'private' or setting appropriate 'Cache-Control: public' and 'max-age' directives.

Answer

The load balancer is using Premium Tier, which routes to the nearest backend; the backend is only in us-west1.

Answer

Cloud CDN is not enabled on the load balancer.

Answer

The load balancer is using Standard Tier, which does not support global anycast.

Question 11

A company is migrating on-premises DNS to Google Cloud. They have a hybrid network using Cloud VPN and want to resolve on-premises hostnames from Compute Engine instances without custom scripts. Which service should they use?

Accepted Answer

Use Cloud DNS inbound server policy to forward queries to on-premises DNS.. Cloud DNS inbound server policy allows on-premises DNS servers to receive DNS queries from Compute Engine instances by creating a VPC-scoped policy that forwards queries to the IP addresses of on-premises DNS resolvers over Cloud VPN. This enables hybrid name resolution without custom scripts, as the policy automatically handles the forwarding of DNS requests from Google Cloud resources to the on-premises DNS infrastructure.

Answer

Create a forwarding zone in Cloud DNS and associate it with the VPC.

Answer

Enable Private Google Access on the VPC subnet.

Answer

Configure Cloud NAT to forward DNS queries to on-premises DNS servers.

Question 12

A network engineer is configuring a Cloud Router for BGP peering with an on-premises router over a VPN tunnel. The on-premises router uses 169.254.x.x link-local addresses. Which BGP peer IP should the engineer use in the Cloud Router configuration?

Accepted Answer

169.254.0.1. The correct BGP peer IP is 169.254.0.1 because Cloud Router uses the first IP in the 169.254.0.0/16 link-local range for BGP peering over a VPN tunnel. This is required by Google Cloud's implementation, where the on-premises router must use a link-local address from the 169.254.0.0/16 range, and Cloud Router automatically assigns 169.254.0.1 as its own BGP peer IP. The on-premises router typically uses 169.254.0.2 as its BGP peer IP, ensuring a point-to-point link-local BGP session.

Answer

10.0.0.1

Answer

The tunnel's external IP address

Answer

The on-premises router's external IP address

Question 13

A company uses an internal TCP/UDP load balancer to distribute traffic to a backend service. The backend instances are in an unmanaged instance group. Some instances fail health checks and are removed. What happens to existing connections to failed instances?

Accepted Answer

Existing connections are terminated immediately.. When an instance in an unmanaged instance group fails a health check, the internal TCP/UDP load balancer immediately terminates all existing connections to that instance. This is because the load balancer does not support connection draining for unmanaged instance groups; it simply stops forwarding new traffic and drops existing flows to the failed instance. The abrupt termination occurs because the load balancer operates at Layer 4 and has no mechanism to gracefully close TCP connections or wait for application-level cleanup.

Answer

The load balancer drains existing connections before removing the instance.

Answer

Existing connections are seamlessly redirected to healthy instances.

Answer

The load balancer waits for all existing connections to close before removing the instance.

Question 14

A company has a VPC with subnets in us-central1 and europe-west1. They create a Private Service Connect endpoint for a managed service in us-central1. Can Compute Engine instances in europe-west1 access the endpoint?

Accepted Answer

No, because the endpoint is only accessible from the same region.. Private Service Connect (PSC) endpoints are regional resources. An endpoint created in us-central1 is only accessible from Compute Engine instances within the same region (us-central1) of the VPC. Instances in europe-west1 cannot directly reach the endpoint because traffic would need to cross regional boundaries, which PSC does not support for producer endpoints. Option D correctly identifies this regional restriction.

Answer

Yes, if they use a global load balancer in front of the endpoint.

Answer

No, unless the VPC is peered with another VPC that contains the endpoint.

Answer

Yes, because the endpoint is accessible from any region in the VPC.

Question 15

A company is designing a hybrid network using Dedicated Interconnect. They want to configure BGP for load balancing across multiple VLAN attachments. Which TWO statements are correct?

Accepted Answer

You can configure the Cloud Router to advertise the same IP prefixes over both VLAN attachments.. A Cloud Router can advertise the same IP prefixes over multiple VLAN attachments to enable load balancing. This allows Google Cloud to use ECMP (Equal-Cost Multi-Path) routing to distribute outbound traffic across the two VLAN attachments, as long as the BGP attributes (e.g., AS path length, MED) are equal.

Answer

You must create a separate Cloud Router for each VLAN attachment.

Answer

You should use BGP MED to load balance outbound traffic from Google Cloud.

Answer

Load balancing across VLAN attachments requires a single BGP session.