PCNE Configuring Network Services Practice Test 10 — 15 Questions

Question 1

A media company uses Cloud CDN with signed URLs to distribute premium video content. They need to revoke access for a specific user immediately. Which approach should they take?

Accepted Answer

Delete the signed URL key that was used to sign the user's URL. Signed URLs are based on keys; to revoke access, you can either remove the key (invalidates all URLs signed with that key) or wait for expiration. There is no per-user revocation. The correct approach is to delete or disable the signing key, which invalidates all URLs signed with that key.

Answer

Use Cloud CDN cache invalidation to remove the user's content

Answer

Add the user's IP address to a deny list in the load balancer

Answer

Change the signing algorithm to SHA512

Question 2

You need to configure health checks for a backend service that uses gRPC for health checking. Which health check type should you use?

Accepted Answer

gRPC. For gRPC health checks, the correct health check type is gRPC, which sends a gRPC HealthCheckRequest to the backend.

Answer

HTTP

Answer

TCP

Answer

HTTPS

Question 3

An engineer manages a global application using Global external HTTP(S) Load Balancer with URL map routing to multiple backend services. They want to enable Cloud CDN for the /images/* path. What is the correct way to enable CDN for that specific path?

Accepted Answer

Enable CDN on the backend service that serves /images/*. To enable CDN for a specific path, you must create a backend bucket (or backend service with CDN enabled) and configure a URL map rule that routes the path /images/* to that backend. Enabling CDN on the backend service itself will apply to all paths served by that backend.

Answer

Use the gcloud compute url-maps add-path-matcher command with --cache-mode

Answer

Set a cache key header for /images/* in the URL map

Answer

Enable Cloud CDN at the load balancer level

Question 4

A company uses Traffic Director with Envoy sidecars for service mesh. They want to gradually shift traffic from version 1 to version 2 of a service, starting with 10% traffic to version 2. Which Traffic Director feature should they use?

Accepted Answer

Traffic splitting. Traffic Director supports traffic splitting via the service routing API (TrafficDirectorService). You can define weighted destinations in the routing rule to split traffic between versions.

Answer

Circuit breakers

Answer

Fault injection

Answer

mTLS authentication

Question 5

A network engineer configures a Global external HTTP(S) Load Balancer with a serverless NEG backend pointing to Cloud Run. The load balancer returns 502 Bad Gateway errors. What is the most likely cause?

Accepted Answer

The Cloud Run service has ingress set to 'internal'. Serverless NEG for Cloud Run requires that the Cloud Run service is publicly accessible or that the ingress is set to allow all traffic. Additionally, the load balancer's health checks must pass. A common cause is that the Cloud Run service has ingress restricted to internal traffic only.

Answer

The URL map is misconfigured

Answer

The SSL certificate is expired

Answer

The serverless NEG is not supported for Cloud Run

Question 6

Which Cloud DNS routing policy should you use to direct users to the nearest healthy backend based on their geographic location?

Accepted Answer

Geolocation. Geolocation routing policy directs traffic based on the user's geographic location. Weighted round robin distributes by weight, failover is for primary/backup.

Answer

Failover

Answer

Weighted round robin

Answer

Response policy

Question 7

You need to create a load balancer that distributes traffic across Compute Engine instances in multiple regions for a TCP application without SSL offload. The clients should connect to a single anycast IP. Which load balancer should you use?

Accepted Answer

Global external TCP Proxy Load Balancer. Global external TCP Proxy Load Balancer provides a single anycast IP and handles TCP traffic without SSL offload (though it supports SSL offload optionally). It is the only global TCP load balancer that does not require SSL termination.

Answer

External TCP/UDP Network Load Balancer

Answer

Global external SSL Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 8

An organization configures a Global external HTTP(S) Load Balancer with Cloud CDN. They notice that some users are getting stale content even after they have invalidated the cache for specific objects. What is the most likely reason?

Accepted Answer

Invalidation requests are queued and take time to propagate globally. Cache invalidation removes objects from cache but does not prevent new requests from being served stale content if the origin returns a 304 Not Modified or if there is a propagation delay. However, the most common cause is that the invalidation has not propagated to all edge caches yet.

Answer

The URL map is routing to the wrong backend

Answer

The objects were cached with a very long TTL

Answer

Cloud CDN does not support invalidation for backend buckets

Question 9

A company wants to expose an internal HTTP service running on Compute Engine instances to other VPCs in the same project using a load balancer. The load balancer must support HTTP path-based routing and preserve the client source IP. Which load balancer types meet these requirements? (Choose two.)

Accepted Answer

External HTTP(S) Load Balancer (regional) [CORRECT]. Both the External HTTP(S) Load Balancer (regional) and the Internal HTTP(S) Load Balancer support HTTP path-based routing and preserve the client source IP via the X-Forwarded-For header. The External regional LB can be configured with a public IP, while the Internal LB uses a private IP within the VPC. Both are suitable for exposing an internal HTTP service to other VPCs in the same project, depending on whether internet access is needed.

Answer

Internal TCP/UDP Load Balancer [wrong]

Answer

Global external HTTP(S) Load Balancer [wrong]

Answer

External TCP/UDP Network Load Balancer [wrong]

Question 10

You are deploying a microservices architecture on Google Kubernetes Engine (GKE) with Traffic Director for traffic management. You want to implement fault injection to test the resilience of your services. Which two types of fault injection does Traffic Director support? (Choose two.)

Accepted Answer

Delay. Traffic Director supports fault injection of delays and errors (aborts).

Answer

CPU exhaustion

Answer

Packet loss

Answer

Bandwidth throttling

Question 11

A company wants to use Cloud DNS response policy zones (RPZ) to override DNS responses for a set of internal domains. They need to ensure that only specific VPC networks can use these overrides. Which three steps are required? (Choose three.)

Accepted Answer

Bind the response policy zone to the desired VPC networks. To use RPZ, you must create the response policy zone, bind it to the target VPC network(s), and ensure that the DNS queries from those VPCs use Cloud DNS. Additionally, you may need to configure the resolver. The correct steps: create the RPZ, bind it to VPC networks, and specify the DNS overrides (rules).

Answer

Create a forwarding zone for the overridden domains

Answer

Enable DNSSEC on the response policy zone

Question 12

An organization wants to distribute incoming HTTPS traffic across a set of Compute Engine instances in multiple regions, with SSL termination at the Google Cloud edge. They also need to protect against DDoS attacks at the edge. Which load balancing solution should they choose?

Accepted Answer

Global External HTTP(S) Load Balancer. Global HTTPS Load Balancer is an external, global, proxy-based load balancer that terminates SSL at the edge and integrates with Cloud Armor for DDoS protection. It distributes traffic across regions.

Answer

SSL Proxy Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 13

A company hosts a web application on Cloud Run and wants to serve content from a Cloud Storage bucket for static assets. They plan to use a global HTTPS load balancer with a URL map to route requests. Which backend type should they configure for the static content?

Accepted Answer

Backend bucket (Cloud Storage bucket). Backend buckets are used to serve content from Cloud Storage buckets via a load balancer. Serverless NEGs are for Cloud Run/Functions, not Cloud Storage.

Answer

Serverless NEG (Cloud Run)

Answer

Zonal NEG (Compute Engine)

Answer

Internet NEG (external endpoint)

Question 14

A network engineer is configuring a global HTTPS load balancer with Cloud CDN. They want to cache responses based on the request origin, query parameters, and user agent. Which cache key configuration should they use?

Accepted Answer

Enable custom cache keys and include the origin header, query string, and user-agent header. Custom cache keys allow inclusion of specific request headers, query parameters, and other attributes. The other options are either not valid or insufficient.

Answer

Use the default cache key, which includes host, scheme, and URL

Answer

Set cache mode to CACHE_ALL_STATIC and enable query string whitelist

Answer

Create a signed URL to include the required parameters

Question 15

A company wants to expose a set of internal services running on Compute Engine instances in a private VPC to other internal services using HTTP load balancing. They require L7 features like URL-based routing and SSL termination. Which load balancer should they use?

Accepted Answer

Regional Internal HTTP(S) Load Balancer. Regional Internal HTTP(S) Load Balancer is an Envoy-based L7 load balancer for internal traffic, supporting URL maps and SSL termination.

Answer

Global HTTPS Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

Regional External HTTP(S) Load Balancer