PCNE Configuring Network Services — 30 Questions

Question 1

A company wants to expose a globally distributed application using Cloud Run via a single anycast IP address, with SSL termination and content-based routing to different backend services. Which load balancer should they use?

Accepted Answer

Global External HTTPS Load Balancer. The Global External HTTPS Load Balancer provides a single anycast IP, SSL termination, and content-based routing via URL maps to backends like serverless NEGs pointing to Cloud Run.

Answer

Global External SSL Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global External TCP Proxy Load Balancer

Question 2

An organization uses Traffic Director with Envoy sidecars in GKE. They want to implement fault injection to test service resilience by injecting a 5-second delay into 10% of requests to a specific backend service. Which Traffic Director configuration resource should they use?

Accepted Answer

A fault injection policy in the TrafficDirectorRoute. Traffic Director supports fault injection via the Envoy HTTP connection manager. The correct approach is to configure a TrafficDirectorRoute with a fault injection policy, which is part of the routing configuration.

Answer

A backend service with outlier detection enabled

Answer

A network endpoint group with a health check that fails intermittently

Answer

A traffic splitting rule in the routing configuration

Question 3

You need to configure Cloud CDN to cache all content from a backend bucket, ignoring any Cache-Control headers sent by the origin. Which cache mode should you use?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL ignores origin headers and caches all responses for the specified TTL.

Answer

USE_ORIGIN_HEADERS

Answer

CACHE_ALL_STATIC

Answer

DYNAMIC_MODE

Question 4

A company has an on-premises data center connected to GCP via Cloud Interconnect. They want to expose an on-premises service to internet clients through Google Cloud's global load balancer. Which type of network endpoint group should they use?

Accepted Answer

Hybrid connectivity NEG. Hybrid connectivity NEGs allow you to expose on-premises destinations via Cloud Interconnect or VPN to a load balancer.

Answer

Zonal NEG

Answer

Internet NEG

Answer

Serverless NEG

Question 5

You are configuring a health check for a backend service that expects gRPC health probing. Which protocol should the health check use to verify gRPC service health?

Accepted Answer

gRPC. gRPC health checks use the gRPC protocol to query the standard gRPC health check endpoint.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 6

A company uses Cloud DNS. They want to override DNS resolution for a specific domain (e.g., mycompany.com) to point to an internal IP for all queries originating from their VPC, while leaving all other domains unaffected. Which Cloud DNS feature should they use?

Accepted Answer

A response policy zone (RPZ). Response Policy Zones (RPZ) allow you to create a local override zone that takes precedence over public DNS for specified domains within a VPC.

Answer

DNSSEC

Answer

A routing policy with a geo location rule

Answer

A managed private zone

Question 7

Which load balancer type preserves the client source IP address and can be used for TCP/UDP traffic on a specific port, passing traffic through to backend instances without proxy overhead?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. The Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and handles TCP/UDP traffic.

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global External TCP Proxy Load Balancer

Answer

Global External HTTPS Load Balancer

Question 8

You want to distribute traffic across multiple GKE clusters in different regions with automatic failover if a region becomes unhealthy. Which Cloud DNS routing policy should you use?

Accepted Answer

Failover. Failover routing policy allows you to set primary and secondary targets; DNS automatically responds with the secondary if the primary is unhealthy.

Answer

Simple (no policy)

Answer

Weighted round robin

Answer

Geolocation

Question 9

A company uses Cloud CDN to serve content. They need to generate signed URLs to allow temporary access to premium content. They have set up a signing key. Which command correctly generates a signed URL for the object /video.mp4 in a bucket served by a load balancer?

Accepted Answer

gcloud compute sign-url --key-name mykey --expires 2024-12-31T23:59:59Z https://example.com/video.mp4. The gcloud compute sign-url command is used to sign URLs for Cloud CDN. It requires the --key-name and --expires flags.

Answer

gcloud compute url-maps sign-url --key-name mykey https://example.com/video.mp4

Answer

gsutil signurl --key-name mykey https://example.com/video.mp4

Answer

gcloud storage sign-url --key-name mykey --expires 2024-12-31T23:59:59Z https://example.com/video.mp4

Question 10

You are designing a multi-tier application where an internal HTTP(S) load balancer should route requests to a backend service based on the URL path (e.g., /api/* to one service, /web/* to another). Which component is essential for this routing?

Accepted Answer

URL map. The Internal HTTP(S) Load Balancer uses a URL map to define path-based routing rules to backend services.

Answer

Cloud NAT

Answer

VPC peering

Answer

Firewall rules

Question 11

You need to configure SSL certificates for a Global HTTPS Load Balancer. The certificate should be automatically provisioned and managed by Google. Which type of certificate should you use?

Accepted Answer

Google-managed certificate. Google-managed certificates are automatically provisioned and renewed for load balancers.

Answer

Compute Engine instance certificate

Answer

Certificate Authority Service certificate

Answer

Self-managed certificate

Question 12

A company wants to enable mTLS between microservices in a service mesh managed by Traffic Director. They have deployed Envoy sidecars. What must be configured to enforce mTLS?

Accepted Answer

The mTLS mode in Traffic Director's mesh configuration. Traffic Director uses the mTLS mode in the Envoy configuration. The correct way is to set the tls_mode to STRICT in the TrafficDirector's mesh configuration.

Answer

An SSL policy on the load balancer

Answer

A VPC Service Controls perimeter

Answer

A Cloud Armor security policy

Question 13

You are configuring a Global External HTTPS Load Balancer. Which TWO components are required to route traffic to a Cloud Run service via a serverless NEG? (Select two.)

Accepted Answer

Serverless NEG. A serverless NEG is a backend that points to a Cloud Run service, and a backend service is needed to define health checks and other settings.

Answer

Health check

Answer

Target proxy

Answer

URL map

Question 14

A company uses Traffic Director with Envoy sidecars. They want to implement traffic splitting to gradually migrate traffic from version v1 to v2 of a service. Which TWO resources must be configured? (Select two.)

Accepted Answer

TrafficDirectorRoute with traffic splitting rules. Traffic splitting in Traffic Director is configured via routing rules (TrafficDirectorRoute) and backend services (or weighted backends).

Answer

Health check

Answer

Firewall rule

Answer

Cloud CDN cache key

Question 15

You need to configure a health check for a backend service that uses HTTP2. Which THREE settings must be configured correctly for the health check to work? (Select three.)

Accepted Answer

Request path. For an HTTP2 health check, you need to specify the protocol (HTTP2), a port, and a request path.

Answer

Proxy protocol

Answer

SSL certificate

Question 16

A company wants to expose a web application running on Cloud Run globally with the lowest latency and automatic SSL termination. Which load balancer should they use?

Accepted Answer

Global HTTPS Load Balancer. Global HTTPS Load Balancer supports serverless NEGs for Cloud Run and provides global anycast IP, automatic SSL, and integration with Cloud CDN.

Answer

Regional Internal HTTP(S) Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global SSL Proxy Load Balancer

Question 17

An organization needs to distribute incoming traffic across multiple GCE instances in the same region while preserving the client IP address. Which load balancer should they use?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves the client IP.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 18

A company wants to serve static content from a Cloud Storage bucket and dynamic content from Compute Engine VMs behind a single external URL. Which GCP feature allows this configuration?

Accepted Answer

URL map. URL map in the Global HTTPS Load Balancer can route requests to different backends (backend bucket for static, backend service for dynamic) based on URL path.

Answer

Traffic Director

Answer

Cloud CDN

Answer

Cloud DNS

Question 19

A company wants to cache static content globally to reduce latency for their users. They are using a Global HTTPS Load Balancer with a backend bucket. Which Cloud CDN cache mode should they use?

Accepted Answer

CACHE_ALL_STATIC. CACHE_ALL_STATIC caches static content based on file extension and response headers, which is suitable for a backend bucket serving static files.

Answer

None: Cloud CDN cannot be used with backend buckets

Answer

USE_ORIGIN_HEADERS

Answer

FORCE_CACHE_ALL

Question 20

An engineer is configuring a Global HTTPS Load Balancer with a serverless NEG pointing to Cloud Run. The deployment fails with a health check error. What is the most likely cause?

Accepted Answer

The serverless NEG does not support health checks. Serverless NEGs do not require health checks; the health check configuration is ignored. The error may be due to incorrect IAM permissions or service account.

Answer

The Cloud Run service is not deployed

Answer

The health check interval is too short

Answer

The SSL certificate is misconfigured