PCNE Configuring Network Services Practice Test 4 — 15 Questions

Question 1

An organization wants to distribute incoming HTTPS traffic across a set of Compute Engine instances in multiple regions, with SSL termination at the Google Cloud edge. They also need to protect against DDoS attacks at the edge. Which load balancing solution should they choose?

Accepted Answer

Global External HTTP(S) Load Balancer. Global HTTPS Load Balancer is an external, global, proxy-based load balancer that terminates SSL at the edge and integrates with Cloud Armor for DDoS protection. It distributes traffic across regions.

Answer

SSL Proxy Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 2

A company hosts a web application on Cloud Run and wants to serve content from a Cloud Storage bucket for static assets. They plan to use a global HTTPS load balancer with a URL map to route requests. Which backend type should they configure for the static content?

Accepted Answer

Backend bucket (Cloud Storage bucket). Backend buckets are used to serve content from Cloud Storage buckets via a load balancer. Serverless NEGs are for Cloud Run/Functions, not Cloud Storage.

Answer

Serverless NEG (Cloud Run)

Answer

Zonal NEG (Compute Engine)

Answer

Internet NEG (external endpoint)

Question 3

A network engineer is configuring a global HTTPS load balancer with Cloud CDN. They want to cache responses based on the request origin, query parameters, and user agent. Which cache key configuration should they use?

Accepted Answer

Enable custom cache keys and include the origin header, query string, and user-agent header. Custom cache keys allow inclusion of specific request headers, query parameters, and other attributes. The other options are either not valid or insufficient.

Answer

Use the default cache key, which includes host, scheme, and URL

Answer

Set cache mode to CACHE_ALL_STATIC and enable query string whitelist

Answer

Create a signed URL to include the required parameters

Question 4

A company wants to expose a set of internal services running on Compute Engine instances in a private VPC to other internal services using HTTP load balancing. They require L7 features like URL-based routing and SSL termination. Which load balancer should they use?

Accepted Answer

Regional Internal HTTP(S) Load Balancer. Regional Internal HTTP(S) Load Balancer is an Envoy-based L7 load balancer for internal traffic, supporting URL maps and SSL termination.

Answer

Global HTTPS Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Question 5

A developer needs to store a TLS certificate for use with a load balancer. Which Google Cloud service is used to create and manage SSL certificates?

Accepted Answer

Certificate Manager. Certificate Manager is the service for managing SSL/TLS certificates for load balancers. Cloud KMS is for encryption keys, Secret Manager for secrets, and Cloud IAM for access control.

Answer

Secret Manager

Answer

Cloud IAM

Answer

Cloud KMS

Question 6

An engineer wants to use Traffic Director to split traffic between two versions of a microservice running on Compute Engine with Envoy sidecars. They want to send 10% of traffic to the new version. Which configuration should they apply?

Accepted Answer

Create a weighted backend service with versionA weight 90 and versionB weight 10. Traffic Director uses traffic splitting rules with weight percentages. The backend service or routing rule allows assigning weights to different versions.

Answer

Use HTTP load balancer URL map to route 10% of requests

Answer

Configure a firewall rule to drop 10% of traffic to versionA

Answer

Deploy versionB in a different region and use geo-routing

Question 7

A company uses Cloud DNS with a managed zone for example.com. They want to override DNS responses for a specific subdomain, mail.example.com, to point to an internal IP address when queried from within the VPC, but external queries should resolve normally. Which feature should they use?

Accepted Answer

Response Policy Zone (RPZ). Response Policy Zones (RPZ) allow you to override DNS responses for specific domains based on the source network. This is used for DNS filtering or overriding.

Answer

DNS Security Extensions (DNSSEC)

Answer

Private DNS zone

Answer

Routing policy (weighted or geo)

Question 8

An organization wants to serve private content via Cloud CDN, ensuring that only authorized users can access cached objects. They need to generate time-limited access for specific URLs. Which method should they use?

Accepted Answer

Use signed URLs with a private key. Signed URLs allow you to grant time-limited access to specific URLs. Signed cookies are for sets of URLs, and Cloud Armor is for WAF, not authorization.

Answer

Set the Cache-Control header to private

Answer

Use Cloud Armor to restrict access by IP

Answer

Use signed cookies to restrict access

Question 9

A company wants to load balance TCP traffic (non-HTTP) across a group of Compute Engine instances in a single region, while preserving the client IP address. They also need to support session affinity based on client IP. Which load balancer should they choose?

Accepted Answer

External TCP/UDP Network Load Balancer. External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and supports session affinity. Other options either terminate connections or are HTTP-specific.

Answer

Global SSL Proxy Load Balancer

Answer

Global TCP Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 10

A team is using Traffic Director with Envoy sidecars. They want to enforce mutual TLS (mTLS) between services. Which configuration must be enabled?

Accepted Answer

Enable mTLS in the Traffic Director mesh configuration. Traffic Director supports mTLS through the Mesh TLS configuration, which enforces TLS mutual authentication between sidecars.

Answer

Configure SSL certificates on each Envoy sidecar manually

Answer

Use Cloud NAT to hide internal IPs

Answer

Enable Cloud Armor on the service

Question 11

While configuring a health check for a backend service, an engineer notices that the health check is failing even though the instances are healthy. The health check is HTTP on port 80 with a request path of /health. The instances respond to curl http://localhost:80/health with 200 OK. What is a likely cause?

Accepted Answer

Firewall rules are blocking traffic from health check ranges. Health checks originate from Google's health check systems, which use source IP ranges. A firewall rule must allow traffic from those ranges. Other options are not as likely.

Answer

The backend service is not using an instance group

Answer

The health check protocol should be HTTPS

Answer

The health check interval is too long

Question 12

A company wants to use Cloud DNS to distribute traffic across multiple regional endpoints with failover: primary in us-central1, secondary in us-west1. If the primary health check fails, traffic should go to secondary. Which routing policy should they use?

Accepted Answer

Failover routing policy. Failover routing policy allows specifying primary and secondary targets with health checks. Geolocation and weighted round robin do not provide failover behavior.

Answer

Geolocation routing policy

Answer

Weighted round robin routing policy

Answer

Simple routing policy (A record)

Question 13

A company runs a microservices application on Google Kubernetes Engine (GKE) and wants to expose an HTTP service to the internet using a global HTTPS load balancer. They need to enable Cloud CDN for static content and use a custom domain with a Google-managed SSL certificate. Which three resources must be created? (Choose three.)

Accepted Answer

URL map. To achieve this, you need a backend service (or backend bucket) for the service, a URL map to route requests, and an SSL certificate for the custom domain. The load balancer itself is the target proxy.

Answer

Cloud NAT gateway

Answer

Target TCP proxy

Question 14

A network engineer is troubleshooting a global HTTPS load balancer that is not serving traffic to some users. The load balancer has a backend service with a zonal NEG in us-central1-a. Users report intermittent 502 errors. Which two checks should the engineer perform? (Choose two.)

Accepted Answer

Verify that the health check for the backend service is passing. Common causes for 502 errors include health check failures and mismatched SSL certificates. Check that the health check passes and that the SSL certificate covers the domain.

Answer

Increase the size of the instance group

Answer

Disable HTTP/2 on the backend

Answer

Ensure Cloud CDN is enabled

Question 15

A company wants to use Traffic Director to implement fault injection for testing service resilience. They want to inject delays and errors into a percentage of requests. Which two configurations are required? (Choose two.)

Accepted Answer

Configure a fault injection policy in Traffic Director. Traffic Director supports fault injection policies, which require a traffic splitting rule to apply the policy to a portion of traffic, and the fault injection filter config in Envoy.

Answer

Enable Cloud Armor on the load balancer

Answer

Create a new backend service with different instance group

Answer

Configure a health check for the fault injection service