PCNE Configuring Network Services Practice Test 6 — 15 Questions

Question 1

A company is deploying a global web application on Google Cloud. They need to serve traffic from the closest region to users, support both HTTP and HTTPS, and offload SSL/TLS termination at the load balancer. Which load balancing solution should they use?

Accepted Answer

Global HTTPS Load Balancer. The Global HTTPS Load Balancer is a layer 7 proxy that can terminate SSL/TLS, route traffic based on URL maps, and serve users from the closest region via anycast IP. It supports both HTTP and HTTPS.

Answer

Global SSL Proxy Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global TCP Proxy Load Balancer

Question 2

You need to create a serverless Network Endpoint Group (NEG) to attach to a Global HTTPS Load Balancer backend for a Cloud Run service. Which command should you use?

Accepted Answer

gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=serverless --cloud-run-service=my-service --region=us-central1. The correct command uses 'gcloud compute network-endpoint-groups create' with the '--network-endpoint-type=serverless' option and specifies the Cloud Run service via '--cloud-run-service'.

Answer

gcloud compute backend-services create backend-name --load-balancing-scheme=EXTERNAL --protocol=HTTP --global

Answer

gcloud compute instance-groups unmanaged create neg-name --zone=us-central1-a

Answer

gcloud compute network-endpoint-groups create neg-name --network-endpoint-type=gce-vm-ip-port --zone=us-central1-a

Question 3

A company has a global e-commerce platform using a Global HTTPS Load Balancer with Cloud CDN. They want to serve private content, such as user-specific PDFs, with CDN caching while ensuring only authorized users can access it. Which method should they use?

Accepted Answer

Use Cloud CDN signed URLs or signed cookies. Signed URLs or signed cookies allow you to grant time-limited access to private content cached on Cloud CDN. They are the recommended way to serve private content via CDN.

Answer

Use Cloud Armor to restrict access by IP address

Answer

Enable IAM permissions on the backend bucket and restrict access to only authenticated users

Answer

Set the cache mode to FORCE_CACHE_ALL and use a token in the URL

Question 4

An engineer configures a Global HTTPS Load Balancer with a backend service pointing to an instance group. The health check is set to HTTP on port 80, check interval 5s, timeout 5s, healthy threshold 1, unhealthy threshold 1. After deployment, instances are marked unhealthy despite the application responding correctly on port 80. What is the most likely cause?

Accepted Answer

The health check timeout is equal to the check interval. With timeout equal to check interval, the health check may not have enough time to complete before the next check starts, causing failures. The timeout should be less than the interval.

Answer

The health check is using HTTPS but the instance expects HTTP

Answer

The unhealthy threshold is set too high

Answer

The health check is not configured with a host header

Question 5

You need to route traffic to different backend services based on the URL path: /api/* goes to a Cloud Run service, /static/* goes to a Cloud Storage bucket, and /* goes to a Compute Engine instance group. Which component of the Global HTTPS Load Balancer should you configure?

Accepted Answer

URL map. The URL map defines how requests are routed to backend services based on host and path rules.

Answer

Backend service

Answer

Target HTTP proxy

Answer

Health check

Question 6

Which Google Cloud service provides a managed Envoy proxy control plane for traffic management, including traffic splitting and fault injection, in a service mesh?

Accepted Answer

Traffic Director. Traffic Director is the managed control plane for Envoy-based service mesh, providing traffic management features.

Answer

Cloud Endpoints

Answer

Cloud Load Balancing

Answer

Anthos Service Mesh

Question 7

A company wants to use Cloud DNS with a failover routing policy. They have two IP addresses serving the same application: primary in us-east1 and secondary in us-west1. They want traffic to go to primary unless health check fails, then fail over to secondary. Which configuration is required?

Accepted Answer

Create a failover routing policy with primary and secondary targets, each associated with a health check. Cloud DNS failover routing policy requires health checks to be attached to the routing policy. The primary and secondary targets are defined under the policy.

Answer

Create a geo routing policy with us-east1 as primary and us-west1 as secondary

Answer

Use a response policy to override the DNS response

Answer

Create two A records with weighting 100 and 0

Question 8

You are configuring a Regional Internal HTTP(S) Load Balancer for a service that must only be accessible from within a VPC. The backend is a zonal NEG of Compute Engine instances. The load balancer is not receiving traffic. What is a likely cause?

Accepted Answer

The backend service is in a different region than the forwarding rule. Internal HTTP(S) LB requires an internal forwarding rule in the same region as the backend. The forwarding rule must use an internal IP address, and the backend service must be in the same region.

Answer

The zonal NEG is in a different zone than the forwarding rule

Answer

The health check is using TCP but the instances expect HTTP

Answer

The forwarding rule uses an external IP address

Question 9

You need to distribute incoming TCP traffic to a set of Compute Engine instances in the same region while preserving the client IP address. The load balancer must be used for non-HTTP(S) workloads. Which load balancer should you choose?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and works for TCP/UDP traffic.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 10

A company uses Cloud CDN to cache content from a backend bucket. They want to ensure that only objects with a Cache-Control header indicating public cacheability are cached. Which cache mode should they select?

Accepted Answer

USE_ORIGIN_HEADERS. USE_ORIGIN_HEADERS mode respects the origin's Cache-Control headers. Only objects with Cache-Control: public or similar will be cached.

Answer

CACHE_ALL_STATIC

Answer

None of the above

Answer

FORCE_CACHE_ALL

Question 11

You are using Traffic Director with Envoy sidecars for a microservices application. You want to inject artificial delays into requests from service A to service B for testing purposes. Which Traffic Director feature should you use?

Accepted Answer

Fault injection. Traffic Director supports fault injection, which allows you to inject delays and abort requests into the traffic between services.

Answer

Traffic splitting

Answer

Circuit breakers

Answer

Outlier detection

Question 12

To enable DNSSEC for a Cloud DNS managed zone, what must be configured?

Accepted Answer

Set the DNSSEC state to 'on' for the zone. DNSSEC is enabled at the zone level by setting the DNSSEC state to 'on'. This can be done via the console or gcloud with '--dnssec-state=on'.

Answer

Create a response policy

Answer

Add DS records to the parent zone

Answer

Set the zone type to private

Question 13

A company wants to use Cloud CDN to accelerate content delivery globally. Which TWO of the following are valid cache key components that can be configured in Cloud CDN? (Choose 2)

Accepted Answer

Query string parameters. Cloud CDN allows you to configure cache keys based on protocol, host, query string parameters, and headers. IP address and client port are not configurable cache key components.

Answer

Client IP address

Answer

Request headers (e.g., Accept-Language)

Answer

Client port

Question 14

You are migrating an on-premises application to Google Cloud and need to connect it to Cloud Run services via a load balancer. The on-premises network uses a VPN to GCP. Which TWO components are required to route traffic from on-premises to a serverless NEG? (Choose 2)

Accepted Answer

Regional Internal HTTP(S) Load Balancer. A hybrid connectivity NEG is used to route traffic to on-premises backends. For traffic from on-premises to serverless, you need a serverless NEG and an internal load balancer that can route to it. The hybrid NEG is for the reverse direction.

Answer

Cloud Router

Answer

Hybrid connectivity NEG

Answer

Cloud VPN tunnel

Question 15

You need to create a DNS routing policy that routes users in Europe to one IP and users in Asia to a different IP, with a fallback to a default IP if no match. Which THREE elements are required? (Choose 3)

Accepted Answer

A geo location (e.g., europe-west1). A geo routing policy requires a geo location, an IP address (rrdata) for each geo, and a default target for unmatched locations.

Answer

A health check

Answer

A response policy