PCNE Configuring Network Services Practice Test 13 — 15 Questions

Question 1

You need to route traffic to different backend services based on the URL path: /api/* goes to a Cloud Run service, /static/* goes to a Cloud Storage bucket, and /* goes to a Compute Engine instance group. Which component of the Global HTTPS Load Balancer should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

URL map. The URL map defines how requests are routed to backend services based on host and path rules.

Answer

Backend service

Answer

Target HTTP proxy

Answer

Health check

Question 2

Which Google Cloud service provides a managed Envoy proxy control plane for traffic management, including traffic splitting and fault injection, in a service mesh?

Accepted Answer

Traffic Director. Traffic Director is the managed control plane for Envoy-based service mesh, providing traffic management features.

Answer

Cloud Endpoints

Answer

Cloud Load Balancing

Answer

Anthos Service Mesh

Question 3

A company wants to use Cloud DNS with a failover routing policy. They have two IP addresses serving the same application: primary in us-east1 and secondary in us-west1. They want traffic to go to primary unless health check fails, then fail over to secondary. Which configuration is required?

Accepted Answer

Create a failover routing policy with primary and secondary targets, each associated with a health check. Cloud DNS failover routing policy requires health checks to be attached to the routing policy. The primary and secondary targets are defined under the policy.

Answer

Create a geo routing policy with us-east1 as primary and us-west1 as secondary

Answer

Use a response policy to override the DNS response

Answer

Create two A records with weighting 100 and 0

Question 4

You are configuring a Regional Internal HTTP(S) Load Balancer for a service that must only be accessible from within a VPC. The backend is a zonal NEG of Compute Engine instances. The load balancer is not receiving traffic. What is a likely cause?

Accepted Answer

The backend service is in a different region than the forwarding rule. Internal HTTP(S) LB requires an internal forwarding rule in the same region as the backend. The forwarding rule must use an internal IP address, and the backend service must be in the same region.

Answer

The zonal NEG is in a different zone than the forwarding rule

Answer

The health check is using TCP but the instances expect HTTP

Answer

The forwarding rule uses an external IP address

Question 5

You need to distribute incoming TCP traffic to a set of Compute Engine instances in the same region while preserving the client IP address. The load balancer must be used for non-HTTP(S) workloads. Which load balancer should you choose?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and works for TCP/UDP traffic.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 6

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

Accepted Answer

USE_ORIGIN_HEADERS. USE_ORIGIN_HEADERS mode respects the origin's Cache-Control headers. Only objects with Cache-Control: public or similar will be cached.

Answer

CACHE_ALL_STATIC

Answer

None of the above

Answer

FORCE_CACHE_ALL

Question 7

You are using Traffic Director with Envoy sidecars for a microservices application. You want to inject artificial delays into requests from service A to service B for testing purposes. Which Traffic Director feature should you use?

Accepted Answer

Fault injection. Traffic Director supports fault injection, which allows you to inject delays and abort requests into the traffic between services.

Answer

Traffic splitting

Answer

Circuit breakers

Answer

Outlier detection

Question 8

To enable DNSSEC for a Cloud DNS managed zone, what must be configured?

Accepted Answer

Set the DNSSEC state to 'on' for the zone. DNSSEC is enabled at the zone level by setting the DNSSEC state to 'on'. This can be done via the console or gcloud with '--dnssec-state=on'.

Answer

Create a response policy

Answer

Add DS records to the parent zone

Answer

Set the zone type to private

Question 9

A company wants to use Cloud CDN to accelerate content delivery globally. Which TWO of the following are valid cache key components that can be configured in Cloud CDN? (Choose 2)

Accepted Answer

Query string parameters. Cloud CDN allows you to configure cache keys based on protocol, host, query string parameters, and headers. IP address and client port are not configurable cache key components.

Answer

Client IP address

Answer

Request headers (e.g., Accept-Language)

Answer

Client port

Question 10

You are migrating an on-premises application to Google Cloud and need to connect it to Cloud Run services via a load balancer. The on-premises network uses a VPN to GCP. Which TWO components are required to route traffic from on-premises to a serverless NEG? (Choose 2)

Accepted Answer

Regional Internal HTTP(S) Load Balancer. A hybrid connectivity NEG is used to route traffic to on-premises backends. For traffic from on-premises to serverless, you need a serverless NEG and an internal load balancer that can route to it. The hybrid NEG is for the reverse direction.

Answer

Cloud Router

Answer

Hybrid connectivity NEG

Answer

Cloud VPN tunnel

Question 11

You need to create a DNS routing policy that routes users in Europe to one IP and users in Asia to a different IP, with a fallback to a default IP if no match. Which THREE elements are required? (Choose 3)

Accepted Answer

A geo location (e.g., europe-west1). A geo routing policy requires a geo location, an IP address (rrdata) for each geo, and a default target for unmatched locations.

Answer

A health check

Answer

A response policy

Question 12

A company wants to expose a web application running on Compute Engine behind a global HTTPS load balancer with Cloud CDN enabled. They need to ensure that only authenticated users can access certain content. Which approach should they use?

Accepted Answer

Generate signed URLs or signed cookies for Cloud CDN.. Cloud CDN supports signed URLs and signed cookies to restrict access to content. Signed URLs are used for individual files, while signed cookies work for multiple files. IAP is for access control at the load balancer level but not specifically for CDN content.

Answer

Use Cloud Armor to restrict access by IP address.

Answer

Use Cloud IAP to authenticate users at the load balancer.

Answer

Configure the backend bucket with a custom header for authentication.

Question 13

An organization wants to direct traffic from a global load balancer to an on-premises data center using a hybrid connectivity NEG. Which connectivity option must be in place for this to work?

Accepted Answer

Cloud VPN or Cloud Interconnect. Hybrid connectivity NEGs require a Cloud VPN tunnel or Cloud Interconnect VLAN attachment to connect GCP to on-premises. The NEG points to endpoints reachable over that connection.

Answer

Dedicated Interconnect without VLAN attachments

Answer

Direct peering with Google

Answer

VPC Network Peering

Question 14

A company runs a microservices application on Google Kubernetes Engine (GKE) with an Envoy sidecar proxy for each service. They want to use Traffic Director to apply traffic policies such as traffic splitting between versions and fault injection. Which API does Traffic Director use to configure Envoy proxies?

Accepted Answer

Traffic Director xDS API. Traffic Director implements the Envoy xDS (Discovery Service) APIs to dynamically configure Envoy sidecar proxies with routing, load balancing, and health checking policies.

Answer

gRPC API

Answer

Kubernetes Ingress API

Answer

Cloud Endpoints API

Question 15

A global HTTPS load balancer is configured with a backend service that points to a serverless NEG for Cloud Run services. Some requests are failing with 502 errors. What is a likely cause?

Accepted Answer

The serverless NEG is in a different region than the load balancer's forwarding rule.. Serverless NEGs require the load balancer to be in the same region as the Cloud Run service, or use a global external load balancer with serverless NEGs in multiple regions. A 502 error often indicates connectivity issues, such as the load balancer not being able to reach the backend due to missing network endpoint group or incorrect region.

Answer

The SSL certificate is expired.

Answer

The Cloud Run service requires IAP authentication.

Answer

The health check is misconfigured for serverless NEGs.