PCNE Configuring Network Services Practice Test 12 — 15 Questions

Question 1

A company is using Traffic Director with Envoy sidecar proxies to manage traffic between microservices. They want to gradually shift 5% of traffic from version v1 to v2 of a service for testing. Which Traffic Director resource should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define a weighted traffic split in the HTTP route rule of the Traffic Director route configuration. Traffic Director supports traffic splitting via weighted routing in the HTTP route configuration, not in the backend service. The traffic splitting is done at the routing level.

Answer

Use the Envoy runtime to dynamically adjust traffic percentages

Answer

Create a new backend service for v2 and set the traffic split in the backend service

Answer

Configure a weighted round-robin routing policy in Cloud DNS

Question 2

A security team wants to serve private content through Cloud CDN but restrict access to only authorized users. They need to generate time-limited URLs that do not require users to log in. Which approach should they use?

Accepted Answer

Use Cloud CDN signed URLs. Signed URLs allow generating time-limited URLs for private content without requiring user login. Signed cookies are for multiple URLs. Public buckets or IAM are not suitable.

Answer

Use IAM permissions on the bucket

Answer

Use Cloud CDN signed cookies

Answer

Enable Cloud CDN and set the bucket to public

Question 3

A company needs to map multiple domain names to different backend services on a single Global HTTPS Load Balancer. Which resource should they configure to direct traffic based on the requested hostname?

Accepted Answer

URL map. The URL map defines rules for routing based on hostnames and paths. SSL certificates are for termination, target proxies forward traffic, and backend services are the destination.

Answer

Backend service

Answer

Target proxy

Answer

SSL certificate

Question 4

An engineer is deploying a Regional External HTTP(S) Load Balancer to serve a web application on Compute Engine. They want to maintain the highest availability by automatically rerouting traffic away from unhealthy instances. Which additional configuration is required?

Accepted Answer

Configure a health check on the backend service. Health checks are required to detect unhealthy instances. Without them, the load balancer will route traffic to any instance in the backend service. Autoscaling and managed instance groups are not mandatory for basic health checking but are recommended.

Answer

Enable connection draining on the backend service

Answer

Use a global load balancer instead

Answer

Set up a managed instance group with autoscaling

Question 5

An organization uses Cloud DNS with a managed zone for example.com. They want to block or override DNS queries for a specific malicious domain (malware.com) to return a sinkhole IP address. Which Cloud DNS feature should they use?

Accepted Answer

Response Policy Zone (RPZ). Response Policy Zones (RPZ) allow DNS administrators to override DNS responses for specific domains, such as redirecting malicious domains to a sinkhole.

Answer

DNS forwarding

Answer

DNS peering

Answer

Managed zone with DNSSEC

Question 6

A company wants to expose an on-premises HTTP server to internet clients through a Global HTTPS Load Balancer using a hybrid connectivity NEG. The on-prem server is reachable via a Cloud VPN tunnel. What must the engineer configure to ensure the load balancer can reach the on-prem endpoint?

Accepted Answer

Create a static route in VPC pointing to the VPN tunnel for the on-prem IP. Hybrid connectivity NEGs require a custom route that directs traffic to the on-prem network via the VPN tunnel. The load balancer's health check source ranges also need routes back. Firewall rules are necessary but not the primary routing requirement.

Answer

Use a global TCP proxy load balancer instead

Answer

Configure a firewall rule allowing health check ranges to the on-prem server

Answer

Deploy a proxy VM in the VPC to forward traffic to on-prem

Question 7

An engineer is configuring a Global SSL Proxy Load Balancer to terminate SSL for a non-HTTP TCP application. They want to minimize latency by allowing the load balancer to reuse connections to backends. Which setting should they adjust?

Accepted Answer

Increase the backend service timeout. Connection timeouts and idle timeouts allow reuse of connections. SSL policies are for versions and ciphers. Proxy protocol adds header but does not affect connection reuse.

Answer

Use a regional TCP proxy load balancer instead

Answer

Enable proxy protocol

Answer

Set the SSL policy to use modern ciphers

Question 8

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between all services. Which component is responsible for issuing and distributing certificates to the Envoy proxies?

Accepted Answer

Google Cloud Certificate Authority Service. Traffic Director integrates with Certificate Authority Service (CAS) or uses its own CA to issue certificates for mTLS. Envoy's SDS (Secret Discovery Service) can also be used, but Traffic Director manages the CA.

Answer

Envoy's built-in certificate management

Answer

Secret Manager

Answer

Cloud KMS

Question 9

A company is designing a global web application that must serve users worldwide with low latency. They plan to use a Global HTTPS Load Balancer with Cloud CDN. Which TWO features should they enable to further reduce latency for users connecting from various regions? (Choose two.)

Accepted Answer

Anycast IP address. CDN Interconnect provides dedicated connectivity to CDN caches, reducing latency. Anycast IP ensures users connect to the nearest edge location. Cloud Armor is security, not performance.

Answer

Reserve a static IP address

Answer

Enable IAP for backend services

Answer

Cloud Armor with rate limiting

Question 10

An organization uses Cloud DNS with a managed zone for internal resolution. They want to implement a failover routing policy so that if the primary health-checked endpoint is unhealthy, traffic is directed to a secondary endpoint. Which THREE steps are required? (Choose three.)

Accepted Answer

Create a health check for the secondary endpoint. Failover routing policy requires a primary and secondary target, each with an associated health check to determine health.

Answer

Create a routing policy of type WEIGHTED

Answer

Create a response policy zone

Question 11

A company is migrating from an on-premises data center to Google Cloud. They have a legacy TCP application that must preserve client IP addresses when load balanced. They also need SSL termination for a different web application. Which TWO load balancers should they consider? (Choose two.)

Accepted Answer

Global SSL Proxy Load Balancer. Regional External TCP/UDP Network Load Balancer preserves client IP (pass-through). Global SSL Proxy Load Balancer provides SSL termination for TCP applications (non-HTTP).

Answer

Global TCP Proxy Load Balancer

Answer

Regional Internal HTTP(S) Load Balancer

Answer

Global HTTPS Load Balancer

Question 12

A company is deploying a global web application on Google Cloud. They need to serve traffic from the closest region to users, support both HTTP and HTTPS, and offload SSL/TLS termination at the load balancer. Which load balancing solution should they use?

Accepted Answer

Global HTTPS Load Balancer. The Global HTTPS Load Balancer is a layer 7 proxy that can terminate SSL/TLS, route traffic based on URL maps, and serve users from the closest region via anycast IP. It supports both HTTP and HTTPS.

Answer

Global SSL Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global TCP Proxy Load Balancer

Question 13

You need to create a serverless Network Endpoint Group (NEG) to attach to a Global HTTPS Load Balancer backend for a Cloud Run service. Which command should you use?

Accepted Answer

gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=serverless --cloud-run-service=my-service --region=us-central1. The correct command uses 'gcloud compute network-endpoint-groups create' with the '--network-endpoint-type=serverless' option and specifies the Cloud Run service via '--cloud-run-service'.

Answer

gcloud compute backend-services create backend-name --load-balancing-scheme=EXTERNAL --protocol=HTTP --global

Answer

gcloud compute instance-groups unmanaged create neg-name --zone=us-central1-a

Answer

gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=gce-vm-ip-port --zone=us-central1-a

Question 14

A company has a global e-commerce platform using a Global HTTPS Load Balancer with Cloud CDN. They want to serve private content, such as user-specific PDFs, with CDN caching while ensuring only authorized users can access it. Which method should they use?

Accepted Answer

Use Cloud CDN signed URLs or signed cookies. Signed URLs or signed cookies allow you to grant time-limited access to private content cached on Cloud CDN. They are the recommended way to serve private content via CDN.

Answer

Use Cloud Armor to restrict access by IP address

Answer

Enable IAM permissions on the backend bucket and restrict access to only authenticated users

Answer

Set the cache mode to FORCE_CACHE_ALL and use a token in the URL

Question 15

An engineer configures a Global HTTPS Load Balancer with a backend service pointing to an instance group. The health check is set to HTTP on port 80, check interval 5s, timeout 5s, healthy threshold 1, unhealthy threshold 1. After deployment, instances are marked unhealthy despite the application responding correctly on port 80. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the check interval. With timeout equal to check interval, the health check may not have enough time to complete before the next check starts, causing failures. The timeout should be less than the interval.

Answer

The health check is using HTTPS but the instance expects HTTP

Answer

The unhealthy threshold is set too high

Answer

The health check is not configured with a host header