PCNE Configuring Network Services Practice Test 14 — 15 Questions

Question 1

A company wants to use Cloud CDN to cache content from a backend bucket. They need to cache all objects, including those with cookies, to maximize performance. Which cache mode should they select?

Accepted Answer

FORCE_CACHE_ALL. Cloud CDN cache modes: CACHE_ALL_STATIC caches static content based on cache directives, USE_ORIGIN_HEADERS respects origin headers, FORCE_CACHE_ALL forces caching for all responses regardless of headers. FORCE_CACHE_ALL is used to override origin headers and cache everything.

Answer

CACHE_ALL_STATIC

Answer

USE_ORIGIN_HEADERS

Answer

CACHE_ALL

Question 2

An organization needs to set up a Regional Internal HTTPS Load Balancer for internal microservices. They want to use Envoy-based load balancing. Which backend type must the backend service use?

Accepted Answer

Zonal NEG. A Regional Internal HTTP(S) Load Balancer uses Envoy-based load balancing and requires a backend service that is either a zonal NEG (with GCE VMs or containers) or a serverless NEG. For internal microservices, typically a zonal NEG of Compute Engine instances is used.

Answer

Instance group

Answer

Internet NEG

Answer

Hybrid connectivity NEG

Question 3

Your company uses Cloud DNS with a managed zone for example.com. You need to override DNS responses for a specific domain (e.g., internal.example.com) to point to an internal IP address. Which Cloud DNS feature should you use?

Accepted Answer

Response policies (RPZ). Cloud DNS response policies (RPZ) allow you to override DNS responses for domains within a VPC. You can create a response policy with rules that modify DNS responses for specified domains.

Answer

DNS forwarding zones

Answer

Peering zones

Answer

Managed zones with private visibility

Question 4

A company wants to distribute traffic across multiple backend services based on the geographic location of the user. They are using an external HTTPS load balancer. Which routing configuration should they use?

Accepted Answer

Use a URL map with route rules that use a header matching condition based on Cloud Armor geo headers. The URL map of a load balancer supports route rules. To route based on geographic location, you can use advanced traffic management with weighted routing based on origin region. However, the simplest approach is to use a multicloud or global load balancer with policies, but for a single load balancer, you can use a URL map with route rules that match based on request headers (like Cloud Armor geo headers) or use a backend bucket with CDN. The most common method is to use a global load balancer with a URL map and route rules that include conditions based on geographic location using a pre-defined variable like {client_region}.

Answer

Use a URL map with route rules that match on the Host header

Answer

Configure the load balancer with a weighted round-robin routing policy

Answer

Use Cloud DNS with geolocation routing policy to direct users to different load balancers

Question 5

A company is using a Global SSL Proxy Load Balancer to terminate SSL and forward traffic to a backend service on Compute Engine. They need to preserve the client IP address in the backend logs. What should they do?

Accepted Answer

Enable Proxy Protocol on the SSL proxy load balancer and configure the backend to parse it.. SSL Proxy Load Balancer terminates SSL and forwards traffic using TCP. It does not preserve the original client IP by default. To preserve the client IP, you must enable Proxy Protocol on the load balancer and configure the backend to accept Proxy Protocol headers.

Answer

Enable Cloud CDN with origin header forwarding.

Answer

Use a TCP Proxy Load Balancer with the proxy protocol enabled.

Answer

Configure the backend service to use the X-Forwarded-For header.

Question 6

An organization has deployed an internal TCP/UDP load balancer in their VPC. They need to ensure that the load balancer preserves the client IP address when forwarding traffic to backend instances. Which configuration is required?

Accepted Answer

No configuration is needed; client IP is preserved by default.. Internal TCP/UDP Load Balancers are pass-through load balancers (Layer 4). They preserve the client IP address by default because they forward packets directly without NAT. No special configuration is needed; the backend instances see the original source IP.

Answer

Configure the health check to use the client IP as source.

Answer

Enable Proxy Protocol on the load balancer.

Answer

Use a backend service with session affinity.

Question 7

A company wants to use Cloud CDN to serve content from a custom origin that is not hosted on Google Cloud. They have enabled Cloud CDN with a backend bucket pointing to an external origin URL. However, content is not being cached. What is a likely reason?

Accepted Answer

The origin does not return Cache-Control or Expires headers.. Cloud CDN with an external origin requires the origin to return explicit cache headers (Cache-Control or Expires) to enable caching. If the origin does not return caching headers, Cloud CDN will not cache the content. Force cache all mode can override this, but if not set, caching may not occur.

Answer

The custom origin does not support HTTPS.

Answer

The origin is not configured in the backend bucket as an internet NEG.

Answer

The load balancer is a Global TCP Proxy, not HTTP.

Question 8

A team needs to perform a health check for a gRPC backend service. Which health check type should they use?

Accepted Answer

gRPC health check. Cloud Load Balancing supports HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC health checks. For gRPC backends, the gRPC health check is the most appropriate.

Answer

HTTP health check

Answer

TCP health check

Answer

SSL health check

Question 9

An organization is deploying a Global HTTPS Load Balancer with Cloud Armor and Cloud CDN. They want to ensure that only requests with a valid signed cookie can access private content. Which three steps are required? (Choose THREE.)

Accepted Answer

Create the signed cookie using the key and set it in the client.. To use signed cookies with Cloud CDN, you must: 1) Enable Cloud CDN on the backend service or bucket, 2) Create a Cloud CDN signed request key (key name and secret), 3) Create the signed cookie with the key and set it on the client. The load balancer will then validate the cookie. There is no need to configure a separate IAM policy for the cookie.

Answer

Configure a Cloud Armor security policy to validate the cookie.

Answer

Set a Cache-Control header to private.

Question 10

A company needs to load balance TCP traffic without SSL termination for a gaming application where client IP preservation is critical. The backend is a group of Compute Engine instances. Which load balancer types meet these requirements? (Choose TWO.)

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Global TCP Proxy Load Balancer terminates SSL? Actually, TCP Proxy LB does not terminate SSL; it forwards TCP traffic but does not preserve client IP by default (uses Proxy Protocol). Regional External TCP/UDP Network Load Balancer is pass-through and preserves client IP. The Internal TCP/UDP LB is pass-through but internal. For external TCP without SSL termination and client IP preservation, the best options are the Regional External TCP/UDP NLB (pass-through) and a Global TCP Proxy with Proxy Protocol enabled (which can preserve IP via Proxy Protocol).

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global SSL Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Question 11

A company wants to expose a web application running on Cloud Run globally with a single anycast IP address, using HTTP(S) load balancing and Cloud CDN for static content. The application should be accessible at https://app.example.com. What is the correct configuration?

Accepted Answer

Create a global external HTTP(S) load balancer with a serverless NEG that points to the Cloud Run service.. Global HTTPS LB with serverless NEG targeting Cloud Run is the best practice for globally exposing serverless workloads with CDN. The other options either lack CDN (SSL Proxy), are regional (regional LB), or use incorrect NEG type (hybrid NEG for on-prem).

Answer

Create a global SSL Proxy load balancer with a Cloud Run backend bucket.

Answer

Create a global TCP Proxy load balancer with a hybrid connectivity NEG.

Answer

Create a regional external HTTP(S) load balancer with a serverless NEG.

Question 12

An organization needs to route traffic to a group of Compute Engine VM instances in the same zone for a high-throughput TCP application. The solution must preserve the client source IP address and support connection draining. Which load balancer type meets these requirements?

Accepted Answer

Regional external TCP/UDP Network Load Balancer. Regional external TCP/UDP Network Load Balancer (NLB) is pass-through and preserves client IP. Connection draining is supported for NLB backends. Global Proxy LBs rewrite source IP.

Answer

Regional external HTTP(S) load balancer

Answer

Global TCP Proxy load balancer

Answer

Global external HTTP(S) load balancer

Question 13

A company's application requires TLS termination at the load balancer, with backend instances in multiple regions running on Compute Engine. The backend instances must see the original client IP address. Which load balancer should be used?

Accepted Answer

Global SSL Proxy load balancer. Global SSL Proxy LB terminates TLS (SSL offload) and adds the Proxy Protocol header to preserve client IP. Global HTTPS LB does not support Proxy Protocol. NLB does not terminate TLS. Internal LB is not external.

Answer

Global external HTTPS load balancer

Answer

Regional external TCP/UDP Network Load Balancer

Answer

Regional internal HTTP(S) load balancer

Question 14

A developer wants to use Cloud CDN to cache static assets from an external origin (not a GCP bucket). Which backend type supports this?

Accepted Answer

Internet NEG. Internet NEG allows specifying an external FQDN as a backend, enabling Cloud CDN to cache content from external origins. Backend buckets are for GCS. Serverless NEG is for Cloud Run/Functions/App Engine. Zonal NEG is for GCP VMs/containers.

Answer

Backend bucket

Answer

Serverless NEG

Answer

Zonal NEG

Question 15

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

Accepted Answer

gRPC. Health checks support HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC. For gRPC backends, a gRPC health check is the most appropriate as it reflects the application health. The other protocols may not accurately indicate gRPC service health.

Answer

HTTPS

Answer

TCP

Answer

HTTP