PCNE Configuring Network Services Practice Test 7 — 15 Questions

Question 1

A company wants to expose a web application running on Compute Engine behind a global HTTPS load balancer with Cloud CDN enabled. They need to ensure that only authenticated users can access certain content. Which approach should they use?

Accepted Answer

Generate signed URLs or signed cookies for Cloud CDN.. Cloud CDN supports signed URLs and signed cookies to restrict access to content. Signed URLs are used for individual files, while signed cookies work for multiple files. IAP is for access control at the load balancer level but not specifically for CDN content.

Answer

Use Cloud Armor to restrict access by IP address.

Answer

Use Cloud IAP to authenticate users at the load balancer.

Answer

Configure the backend bucket with a custom header for authentication.

Question 2

An organization wants to direct traffic from a global load balancer to an on-premises data center using a hybrid connectivity NEG. Which connectivity option must be in place for this to work?

Accepted Answer

Cloud VPN or Cloud Interconnect. Hybrid connectivity NEGs require a Cloud VPN tunnel or Cloud Interconnect VLAN attachment to connect GCP to on-premises. The NEG points to endpoints reachable over that connection.

Answer

Dedicated Interconnect without VLAN attachments

Answer

Direct peering with Google

Answer

VPC Network Peering

Question 3

A company runs a microservices application on Google Kubernetes Engine (GKE) with an Envoy sidecar proxy for each service. They want to use Traffic Director to apply traffic policies such as traffic splitting between versions and fault injection. Which API does Traffic Director use to configure Envoy proxies?

Accepted Answer

Traffic Director xDS API. Traffic Director implements the Envoy xDS (Discovery Service) APIs to dynamically configure Envoy sidecar proxies with routing, load balancing, and health checking policies.

Answer

gRPC API

Answer

Kubernetes Ingress API

Answer

Cloud Endpoints API

Question 4

A global HTTPS load balancer is configured with a backend service that points to a serverless NEG for Cloud Run services. Some requests are failing with 502 errors. What is a likely cause?

Accepted Answer

The serverless NEG is in a different region than the load balancer's forwarding rule.. Serverless NEGs require the load balancer to be in the same region as the Cloud Run service, or use a global external load balancer with serverless NEGs in multiple regions. A 502 error often indicates connectivity issues, such as the load balancer not being able to reach the backend due to missing network endpoint group or incorrect region.

Answer

The SSL certificate is expired.

Answer

The Cloud Run service requires IAP authentication.

Answer

The health check is misconfigured for serverless NEGs.

Question 5

A company wants to use Cloud CDN to cache content from a backend bucket. They need to cache all objects, including those with cookies, to maximize performance. Which cache mode should they select?

Accepted Answer

FORCE_CACHE_ALL. Cloud CDN cache modes: CACHE_ALL_STATIC caches static content based on cache directives, USE_ORIGIN_HEADERS respects origin headers, FORCE_CACHE_ALL forces caching for all responses regardless of headers. FORCE_CACHE_ALL is used to override origin headers and cache everything.

Answer

CACHE_ALL_STATIC

Answer

USE_ORIGIN_HEADERS

Answer

CACHE_ALL

Question 6

An organization needs to set up a Regional Internal HTTPS Load Balancer for internal microservices. They want to use Envoy-based load balancing. Which backend type must the backend service use?

Accepted Answer

Zonal NEG. A Regional Internal HTTP(S) Load Balancer uses Envoy-based load balancing and requires a backend service that is either a zonal NEG (with GCE VMs or containers) or a serverless NEG. For internal microservices, typically a zonal NEG of Compute Engine instances is used.

Answer

Instance group

Answer

Internet NEG

Answer

Hybrid connectivity NEG

Question 7

Your company uses Cloud DNS with a managed zone for example.com. You need to override DNS responses for a specific domain (e.g., internal.example.com) to point to an internal IP address. Which Cloud DNS feature should you use?

Accepted Answer

Response policies (RPZ). Cloud DNS response policies (RPZ) allow you to override DNS responses for domains within a VPC. You can create a response policy with rules that modify DNS responses for specified domains.

Answer

DNS forwarding zones

Answer

Peering zones

Answer

Managed zones with private visibility

Question 8

A company wants to distribute traffic across multiple backend services based on the geographic location of the user. They are using an external HTTPS load balancer. Which routing configuration should they use?

Accepted Answer

Use a URL map with route rules that use a header matching condition based on Cloud Armor geo headers. The URL map of a load balancer supports route rules. To route based on geographic location, you can use advanced traffic management with weighted routing based on origin region. However, the simplest approach is to use a multicloud or global load balancer with policies, but for a single load balancer, you can use a URL map with route rules that match based on request headers (like Cloud Armor geo headers) or use a backend bucket with CDN. The most common method is to use a global load balancer with a URL map and route rules that include conditions based on geographic location using a pre-defined variable like {client_region}.

Answer

Use a URL map with route rules that match on the Host header

Answer

Configure the load balancer with a weighted round-robin routing policy

Answer

Use Cloud DNS with geolocation routing policy to direct users to different load balancers

Question 9

A company is using a Global SSL Proxy Load Balancer to terminate SSL and forward traffic to a backend service on Compute Engine. They need to preserve the client IP address in the backend logs. What should they do?

Accepted Answer

Enable Proxy Protocol on the SSL proxy load balancer and configure the backend to parse it.. SSL Proxy Load Balancer terminates SSL and forwards traffic using TCP. It does not preserve the original client IP by default. To preserve the client IP, you must enable Proxy Protocol on the load balancer and configure the backend to accept Proxy Protocol headers.

Answer

Enable Cloud CDN with origin header forwarding.

Answer

Use a TCP Proxy Load Balancer with the proxy protocol enabled.

Answer

Configure the backend service to use the X-Forwarded-For header.

Question 10

An organization has deployed an internal TCP/UDP load balancer in their VPC. They need to ensure that the load balancer preserves the client IP address when forwarding traffic to backend instances. Which configuration is required?

Accepted Answer

No configuration is needed; client IP is preserved by default.. Internal TCP/UDP Load Balancers are pass-through load balancers (Layer 4). They preserve the client IP address by default because they forward packets directly without NAT. No special configuration is needed; the backend instances see the original source IP.

Answer

Configure the health check to use the client IP as source.

Answer

Enable Proxy Protocol on the load balancer.

Answer

Use a backend service with session affinity.

Question 11

A company wants to use Cloud CDN to serve content from a custom origin that is not hosted on Google Cloud. They have enabled Cloud CDN with a backend bucket pointing to an external origin URL. However, content is not being cached. What is a likely reason?

Accepted Answer

The origin does not return Cache-Control or Expires headers.. Cloud CDN with an external origin requires the origin to return explicit cache headers (Cache-Control or Expires) to enable caching. If the origin does not return caching headers, Cloud CDN will not cache the content. Force cache all mode can override this, but if not set, caching may not occur.

Answer

The custom origin does not support HTTPS.

Answer

The origin is not configured in the backend bucket as an internet NEG.

Answer

The load balancer is a Global TCP Proxy, not HTTP.

Question 12

A team needs to perform a health check for a gRPC backend service. Which health check type should they use?

Accepted Answer

gRPC health check. Cloud Load Balancing supports HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC health checks. For gRPC backends, the gRPC health check is the most appropriate.

Answer

HTTP health check

Answer

TCP health check

Answer

SSL health check

Question 13

A company wants to use Traffic Director to implement circuit breaking for their microservices. Which two resources must be configured to enable circuit breaking? (Choose TWO.)

Accepted Answer

Traffic Director cluster. Traffic Director uses Envoy configurations. Circuit breaking is configured via the Envoy cluster configuration. In Traffic Director, this is done through the Traffic Director API by setting circuit breakers in the cluster resource. The service is the logical entity, and the backend service is a load balancing concept.

Answer

Traffic Director service

Answer

Traffic Director route

Answer

Envoy filter

Answer

Health check configuration

Question 14

An organization is deploying a Global HTTPS Load Balancer with Cloud Armor and Cloud CDN. They want to ensure that only requests with a valid signed cookie can access private content. Which three steps are required? (Choose THREE.)

Accepted Answer

Create the signed cookie using the key and set it in the client.. To use signed cookies with Cloud CDN, you must: 1) Enable Cloud CDN on the backend service or bucket, 2) Create a Cloud CDN signed request key (key name and secret), 3) Create the signed cookie with the key and set it on the client. The load balancer will then validate the cookie. There is no need to configure a separate IAM policy for the cookie.

Answer

Configure a Cloud Armor security policy to validate the cookie.

Answer

Set a Cache-Control header to private.

Question 15

A company needs to load balance TCP traffic without SSL termination for a gaming application where client IP preservation is critical. The backend is a group of Compute Engine instances. Which load balancer types meet these requirements? (Choose TWO.)

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Global TCP Proxy Load Balancer terminates SSL? Actually, TCP Proxy LB does not terminate SSL; it forwards TCP traffic but does not preserve client IP by default (uses Proxy Protocol). Regional External TCP/UDP Network Load Balancer is pass-through and preserves client IP. The Internal TCP/UDP LB is pass-through but internal. For external TCP without SSL termination and client IP preservation, the best options are the Regional External TCP/UDP NLB (pass-through) and a Global TCP Proxy with Proxy Protocol enabled (which can preserve IP via Proxy Protocol).

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global SSL Proxy Load Balancer

Answer

Global HTTPS Load Balancer