PCNE Configuring Network Services Practice Test 11 — 15 Questions

Question 1

A developer needs to store a TLS certificate for use with a load balancer. Which Google Cloud service is used to create and manage SSL certificates?

Accepted Answer

Certificate Manager. Certificate Manager is the service for managing SSL/TLS certificates for load balancers. Cloud KMS is for encryption keys, Secret Manager for secrets, and Cloud IAM for access control.

Answer

Secret Manager

Answer

Cloud IAM

Answer

Cloud KMS

Question 2

An engineer wants to use Traffic Director to split traffic between two versions of a microservice running on Compute Engine with Envoy sidecars. They want to send 10% of traffic to the new version. Which configuration should they apply?

Accepted Answer

Create a weighted backend service with versionA weight 90 and versionB weight 10. Traffic Director uses traffic splitting rules with weight percentages. The backend service or routing rule allows assigning weights to different versions.

Answer

Use HTTP load balancer URL map to route 10% of requests

Answer

Configure a firewall rule to drop 10% of traffic to versionA

Answer

Deploy versionB in a different region and use geo-routing

Question 3

A company uses Cloud DNS with a managed zone for example.com. They want to override DNS responses for a specific subdomain, mail.example.com, to point to an internal IP address when queried from within the VPC, but external queries should resolve normally. Which feature should they use?

Accepted Answer

Response Policy Zone (RPZ). Response Policy Zones (RPZ) allow you to override DNS responses for specific domains based on the source network. This is used for DNS filtering or overriding.

Answer

DNS Security Extensions (DNSSEC)

Answer

Private DNS zone

Answer

Routing policy (weighted or geo)

Question 4

An organization wants to serve private content via Cloud CDN, ensuring that only authorized users can access cached objects. They need to generate time-limited access for specific URLs. Which method should they use?

Accepted Answer

Use signed URLs with a private key. Signed URLs allow you to grant time-limited access to specific URLs. Signed cookies are for sets of URLs, and Cloud Armor is for WAF, not authorization.

Answer

Set the Cache-Control header to private

Answer

Use Cloud Armor to restrict access by IP

Answer

Use signed cookies to restrict access

Question 5

A company wants to load balance TCP traffic (non-HTTP) across a group of Compute Engine instances in a single region, while preserving the client IP address. They also need to support session affinity based on client IP. Which load balancer should they choose?

Accepted Answer

External TCP/UDP Network Load Balancer. External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and supports session affinity. Other options either terminate connections or are HTTP-specific.

Answer

Global SSL Proxy Load Balancer

Answer

Global TCP Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 6

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between services. Which configuration must be enabled?

Accepted Answer

Enable mTLS in the Traffic Director mesh configuration. Traffic Director supports mTLS through the Mesh TLS configuration, which enforces TLS mutual authentication between sidecars.

Answer

Configure SSL certificates on each Envoy sidecar manually

Answer

Use Cloud NAT to hide internal IPs

Answer

Enable Cloud Armor on the service

Question 7

While configuring a health check for a backend service, an engineer notices that the health check is failing even though the instances are healthy. The health check is HTTP on port 80 with a request path of /health. The instances respond to curl http://localhost:80/health with 200 OK. What is a likely cause?

Accepted Answer

Firewall rules are blocking traffic from health check ranges. Health checks originate from Google's health check systems, which use source IP ranges. A firewall rule must allow traffic from those ranges. Other options are not as likely.

Answer

The backend service is not using an instance group

Answer

The health check protocol should be HTTPS

Answer

The health check interval is too long

Question 8

A company wants to use Cloud DNS to distribute traffic across multiple regional endpoints with failover: primary in us-central1, secondary in us-west1. If the primary health check fails, traffic should go to secondary. Which routing policy should they use?

Accepted Answer

Failover routing policy. Failover routing policy allows specifying primary and secondary targets with health checks. Geolocation and weighted round robin do not provide failover behavior.

Answer

Geolocation routing policy

Answer

Weighted round robin routing policy

Answer

Simple routing policy (A record)

Question 9

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Accepted Answer

URL map. To achieve this, you need a backend service (or backend bucket) for the service, a URL map to route requests, and an SSL certificate for the custom domain. The load balancer itself is the target proxy.

Answer

Cloud NAT gateway

Answer

Target TCP proxy

Question 10

A network engineer is troubleshooting a global HTTPS load balancer that is not serving traffic to some users. The load balancer has a backend service with a zonal NEG in us-central1-a. Users report intermittent 502 errors. Which two checks should the engineer perform? (Choose two.)

Accepted Answer

Verify that the health check for the backend service is passing. Common causes for 502 errors include health check failures and mismatched SSL certificates. Check that the health check passes and that the SSL certificate covers the domain.

Answer

Increase the size of the instance group

Answer

Disable HTTP/2 on the backend

Answer

Ensure Cloud CDN is enabled

Question 11

A company wants to use Traffic Director to implement fault injection for testing service resilience. They want to inject delays and errors into a percentage of requests. Which two configurations are required? (Choose two.)

Accepted Answer

Configure a fault injection policy in Traffic Director. Traffic Director supports fault injection policies, which require a traffic splitting rule to apply the policy to a portion of traffic, and the fault injection filter config in Envoy.

Answer

Enable Cloud Armor on the load balancer

Answer

Create a new backend service with different instance group

Answer

Configure a health check for the fault injection service

Question 12

A company wants to expose a web application running on Cloud Run to the internet with a single global IP address, SSL termination, and Cloud CDN. Which load balancer should they use?

Accepted Answer

Global External HTTP(S) Load Balancer. The Global HTTPS Load Balancer supports serverless backends via serverless NEG, provides SSL termination, Cloud CDN integration, and a single global IP address. The others are either regional or not suitable for serverless backends.

Answer

External TCP/UDP Network Load Balancer

Answer

Global TCP Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 13

An engineer is configuring a Global HTTPS Load Balancer with a backend service that points to a serverless NEG for Cloud Functions. The health checks are failing. What is the most likely cause?

Accepted Answer

Serverless NEGs do not support health checks. Serverless NEGs do not support health checks. The load balancer relies on the underlying Cloud Functions being healthy. Health checks must be disabled for serverless backends.

Answer

The health check path is incorrect

Answer

The backend service is not associated with the correct URL map

Answer

The health check protocol is set to HTTP instead of HTTPS

Question 14

A company has a TCP-based application running on a group of Compute Engine VMs in us-central1. They need to provide a static internal IP address to clients within the VPC, while preserving the client source IP for logging. Which load balancer should they use?

Accepted Answer

Regional Internal TCP/UDP Load Balancer. The Regional Internal TCP/UDP Load Balancer is a pass-through load balancer that preserves client IP. It provides a static internal IP and operates at L4.

Answer

Regional Internal HTTP(S) Load Balancer

Answer

Regional External TCP/UDP Network Load Balancer

Answer

Global Internal HTTP(S) Load Balancer

Question 15

An organization uses Cloud CDN to serve static content from a backend bucket. They want to ensure that content is always served from the edge regardless of cache-control headers from the origin. Which cache mode should they set?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL mode forces Cloud CDN to cache all content, ignoring origin cache directives. CACHE_ALL_STATIC caches based on file type, USE_ORIGIN_HEADERS respects origin headers.

Answer

USE_ORIGIN_HEADERS

Answer

ENABLE_CACHE

Answer

CACHE_ALL_STATIC