PCNE Configuring Network Services Practice Test 15 — 15 Questions

Question 1

A company wants to serve private content from Cloud CDN using signed URLs that expire after 1 hour. Which steps are required to enable this?

Accepted Answer

Create a signing key in Cloud CDN, then generate signed URLs with expiration using that key.. Signed URLs require a signing key (created via Cloud CDN backend bucket configuration) and generating URLs programmatically with expiration. Enabling IAP is not required. The key is not passed in the header but as query parameters. Just setting cache mode does not enable signed URLs.

Answer

Set the cache mode to FORCE_CACHE_ALL and enable private access.

Answer

Pass the signing key in the X-Goog-Signed-URL header on each request.

Answer

Enable IAP on the backend and generate signed URLs using the IAP client ID.

Question 2

You are using Cloud CDN with a backend bucket and want to cache all responses regardless of Cache-Control headers. Which cache mode should you set?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL overrides origin Cache-Control headers and caches all responses. CACHE_ALL_STATIC attempts to cache static content but respects Cache-Control. USE_ORIGIN_HEADERS respects origin headers.

Answer

CACHE_ALL_STATIC

Answer

USE_ORIGIN_HEADERS

Answer

DISABLED

Question 3

You need to invalidate Cloud CDN cached content for specific URLs after updating files in Cloud Storage. Which command should you use?

Accepted Answer

gcloud compute url-maps invalidate-cdn-cache. gcloud compute url-maps invalidate-cdn-cache invalidates CDN cache for a specific URL map. gcloud compute ssl-certificates is for certificates. gcloud compute backend-buckets update is for updating backend bucket configuration. gcloud compute cdn-cache invalidate does not exist.

Answer

gcloud compute cdn-cache invalidate

Answer

gcloud compute backend-buckets update

Answer

gcloud compute ssl-certificates update

Question 4

What is the purpose of a Response Policy Zone (RPZ) in Cloud DNS?

Accepted Answer

To override DNS responses for specified domains (e.g., block or redirect). RPZ allows you to override DNS responses for specific domains, often used for security (malware filtering) or policy enforcement. It is not for routing traffic, private zones, or load balancing.

Answer

To route traffic based on geographic location of the requester

Answer

To enable weighted round-robin load balancing for multiple IPs

Answer

To create private DNS zones within a VPC

Question 5

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

Accepted Answer

Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.. Traffic Director uses Envoy's fault injection filter, configured via the Envoy xDS API or through GKE configuration. The correct approach is to apply a traffic policy with fault injection percentage. The other options are not valid Traffic Director features or do not achieve fault injection.

Answer

Use the gcloud compute backend-services update command with the --fault-injection flag.

Answer

Set a circuit breaker with a max pending requests threshold.

Answer

Create a backend service with connection draining and set the drain timeout.

Question 6

You need to migrate traffic gradually from an old version of a microservice to a new version using Traffic Director. You want to send 10% of traffic to the new version and 90% to the old version. Which configuration should you use?

Accepted Answer

Configure a weighted destination rule in the Envoy route with weights 9:1.. Traffic Director supports traffic splitting via weighted destination rules in the Envoy configuration. The correct approach is to specify weights for each service version in the route rule. Setting circuit breaker thresholds or using connection draining does not achieve traffic splitting.

Answer

Create two separate backend services and use a URL map to distribute traffic.

Answer

Set circuit breaker thresholds to limit connections to the new version.

Answer

Use a health check to gradually remove the old version instances.

Question 7

Which Traffic Director feature ensures that a service does not receive more requests than it can handle by setting a maximum number of concurrent requests or connections?

Accepted Answer

Circuit breakers. Circuit breakers are used to limit the number of concurrent connections or requests to a service to prevent overload. Fault injection is for testing. Traffic splitting is for gradual rollouts. mTLS is for mutual TLS authentication.

Answer

Traffic splitting

Answer

mTLS

Answer

Fault injection

Question 8

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Accepted Answer

Geo routing policy. Geo routing policy directs traffic based on user location, and failover policy provides automatic failover to a backup if health check fails. Weighted round-robin distributes by weight, not location. DNSSEC is a security extension.

Answer

Weighted round-robin

Answer

DNSSEC

Answer

Response policy zone

Question 9

You are designing a global web application that uses Cloud Run for the backend and Cloud Storage for static assets. You need to serve content securely over HTTPS with a custom domain, using Cloud CDN for caching. Which resources must be created or configured? (Choose three.)

Accepted Answer

SSL certificate resource. Global HTTPS LB with backend bucket (for GCS) and serverless NEG (for Cloud Run) is the architecture. SSL certificate is needed for HTTPS. IAP is for authentication, not required. URL map is required for routing. Zonal NEG is not needed for Cloud Run.

Answer

Zonal NEG for Cloud Run

Answer

Identity-Aware Proxy (IAP)

Question 10

You are deploying a new internal HTTP(S) load balancer for a microservice that runs on Compute Engine instances within the same region. The load balancer must be accessible only from within the VPC network. Which components are required? (Choose two.)

Accepted Answer

Regional internal HTTP(S) load balancer. Regional internal HTTP(S) LB uses an internal IP address and forwards traffic to a backend service. Backend service requires a health check. An SSL certificate is optional if HTTP is used. Global external LB is for external access.

Answer

Global external HTTP(S) load balancer

Answer

Cloud CDN enabled

Answer

SSL certificate

Question 11

A company runs a global e-commerce platform with a monolithic application deployed on Compute Engine. They want to modernize by splitting the monolith into microservices running on Cloud Run and Cloud Functions, and expose them externally via a single anycast IP with Google-managed SSL certificates. Which load balancer should they use?

Accepted Answer

Global External HTTPS Load Balancer. The Global External HTTPS Load Balancer supports serverless NEGs for Cloud Run and Cloud Functions, provides an anycast IP, and offers Google-managed SSL certificates. The Regional External HTTPS LB is regional and does not provide global anycast. The Global SSL Proxy LB does not support serverless NEGs. The Global TCP Proxy LB also does not support serverless NEGs.

Answer

Global TCP Proxy Load Balancer

Answer

Regional External HTTPS Load Balancer

Answer

Global SSL Proxy Load Balancer

Question 12

An organization uses Cloud DNS private zones for internal service discovery. They want to override DNS responses for a specific domain (e.g., 'internal.example.com') to block access to malicious domains and redirect certain queries to a different IP for compliance. Which Cloud DNS feature should they use?

Accepted Answer

Response Policies (RPZ). Cloud DNS Response Policies (RPZ) allow overriding DNS responses based on policy rules. They can be used to block domains (by returning NXDOMAIN or redirecting to a sink IP) or to reroute queries to alternative IPs. Routing policies are for authoritative zones to control traffic distribution, not for overriding responses. DNSSEC ensures authenticity but does not override DNS responses. Peering is for querying other zones, not overriding.

Answer

DNSSEC

Answer

Routing policies (weighted round robin, geolocation, failover)

Answer

Cloud DNS peering

Question 13

A developer wants to use Cloud CDN to cache content from an external origin backend. Which TWO configurations are required to set this up? (Choose two.)

Accepted Answer

A backend service or backend bucket with the origin defined. To use Cloud CDN with an external origin, you need a backend service or backend bucket that points to the origin, and enable Cloud CDN on that backend. A Global External HTTPS Load Balancer with Internet NEG is not required; Cloud CDN can be used with external backends via backend service. A custom domain is not required for Cloud CDN to work, though often used.

Answer

A custom domain mapped to the load balancer

Answer

A global static IP address

Answer

A Global External HTTPS Load Balancer with Internet NEG

Question 14

A company uses Traffic Director with Envoy sidecars to manage traffic in their service mesh. They want to perform canary deployments where 10% of traffic goes to the new version and 90% to the stable version. Which TWO Traffic Director resources should they configure? (Choose two.)

Accepted Answer

A TrafficDirectorService with a traffic splitting policy (weighted clusters). Traffic splitting is achieved through TrafficDirectorService with a weighted traffic policy. BackendService defines the service backends. Envoy Route Configuration is used for routing, but Traffic Director configures it automatically. HTTPRoute and gRPC filters are not used for traffic splitting.

Answer

A gRPC filter in the Envoy configuration

Answer

An HTTPRoute resource

Answer

An Envoy Route Configuration with weighted clusters

Question 15

A company wants to serve private content from Cloud CDN using signed URLs that expire after 1 hour. Which steps are required to enable this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud CDN signed cookies with a key defined in the backend bucket. Cloud CDN supports signed URLs and signed cookies to control access to private content. IAM conditions are not supported directly with Cloud CDN. CNAME records are DNS configuration, not access control. Cloud Armor is for security policies but not for generating signed URLs.

Answer

Create a CNAME record pointing to the Cloud CDN IP

Answer

Use IAM conditions on Cloud Storage to restrict access

Answer

Use Cloud Armor with IP allowlists