PCNE Configuring Network Services Practice Test 8 — 15 Questions

Question 1

You are configuring a health check for a backend service that expects gRPC health probing. Which protocol should the health check use to verify gRPC service health?

Accepted Answer

gRPC. gRPC health checks use the gRPC protocol to query the standard gRPC health check endpoint.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 2

A company uses Cloud DNS. They want to override DNS resolution for a specific domain (e.g., mycompany.com) to point to an internal IP for all queries originating from their VPC, while leaving all other domains unaffected. Which Cloud DNS feature should they use?

Accepted Answer

A response policy zone (RPZ). Response Policy Zones (RPZ) allow you to create a local override zone that takes precedence over public DNS for specified domains within a VPC.

Answer

DNSSEC

Answer

A routing policy with a geo location rule

Answer

A managed private zone

Question 3

Which load balancer type preserves the client source IP address and can be used for TCP/UDP traffic on a specific port, passing traffic through to backend instances without proxy overhead?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. The Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and handles TCP/UDP traffic.

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global External TCP Proxy Load Balancer

Answer

Global External HTTPS Load Balancer

Question 4

You want to distribute traffic across multiple GKE clusters in different regions with automatic failover if a region becomes unhealthy. Which Cloud DNS routing policy should you use?

Accepted Answer

Failover. Failover routing policy allows you to set primary and secondary targets; DNS automatically responds with the secondary if the primary is unhealthy.

Answer

Simple (no policy)

Answer

Weighted round robin

Answer

Geolocation

Question 5

A company uses Cloud CDN to serve content. They need to generate signed URLs to allow temporary access to premium content. They have set up a signing key. Which command correctly generates a signed URL for the object /video.mp4 in a bucket served by a load balancer?

Accepted Answer

gcloud compute sign-url --key-name mykey --expires 2024-12-31T23:59:59Z https://example.com/video.mp4. The gcloud compute sign-url command is used to sign URLs for Cloud CDN. It requires the --key-name and --expires flags.

Answer

gcloud compute url-maps sign-url --key-name mykey https://example.com/video.mp4

Answer

gsutil signurl --key-name mykey https://example.com/video.mp4

Answer

gcloud storage sign-url --key-name mykey --expires 2024-12-31T23:59:59Z https://example.com/video.mp4

Question 6

You are designing a multi-tier application where an internal HTTP(S) load balancer should route requests to a backend service based on the URL path (e.g., /api/* to one service, /web/* to another). Which component is essential for this routing?

Accepted Answer

URL map. The Internal HTTP(S) Load Balancer uses a URL map to define path-based routing rules to backend services.

Answer

Cloud NAT

Answer

VPC peering

Answer

Firewall rules

Question 7

You need to configure SSL certificates for a Global HTTPS Load Balancer. The certificate should be automatically provisioned and managed by Google. Which type of certificate should you use?

Accepted Answer

Google-managed certificate. Google-managed certificates are automatically provisioned and renewed for load balancers.

Answer

Compute Engine instance certificate

Answer

Certificate Authority Service certificate

Answer

Self-managed certificate

Question 8

A company wants to enable mTLS between microservices in a service mesh managed by Traffic Director. They have deployed Envoy sidecars. What must be configured to enforce mTLS?

Accepted Answer

The mTLS mode in Traffic Director's mesh configuration. Traffic Director uses the mTLS mode in the Envoy configuration. The correct way is to set the tls_mode to STRICT in the TrafficDirector's mesh configuration.

Answer

An SSL policy on the load balancer

Answer

A VPC Service Controls perimeter

Answer

A Cloud Armor security policy

Question 9

You are configuring a Global External HTTPS Load Balancer. Which TWO components are required to route traffic to a Cloud Run service via a serverless NEG? (Select two.)

Accepted Answer

Serverless NEG. A serverless NEG is a backend that points to a Cloud Run service, and a backend service is needed to define health checks and other settings.

Answer

Health check

Answer

Target proxy

Answer

URL map

Question 10

A company uses Traffic Director with Envoy sidecars. They want to implement traffic splitting to gradually migrate traffic from version v1 to v2 of a service. Which TWO resources must be configured? (Select two.)

Accepted Answer

TrafficDirectorRoute with traffic splitting rules. Traffic splitting in Traffic Director is configured via routing rules (TrafficDirectorRoute) and backend services (or weighted backends).

Answer

Health check

Answer

Firewall rule

Answer

Cloud CDN cache key

Question 11

You need to configure a health check for a backend service that uses HTTP2. Which THREE settings must be configured correctly for the health check to work? (Select three.)

Accepted Answer

Request path. For an HTTP2 health check, you need to specify the protocol (HTTP2), a port, and a request path.

Answer

Proxy protocol

Answer

SSL certificate

Question 12

A company wants to expose a web application running on Cloud Run globally with the lowest latency and automatic SSL termination. Which load balancer should they use?

Accepted Answer

Global HTTPS Load Balancer. Global HTTPS Load Balancer supports serverless NEGs for Cloud Run and provides global anycast IP, automatic SSL, and integration with Cloud CDN.

Answer

Regional Internal HTTP(S) Load Balancer

Answer

Regional External HTTP(S) Load Balancer

Answer

Global SSL Proxy Load Balancer

Question 13

An organization needs to distribute incoming traffic across multiple GCE instances in the same region while preserving the client IP address. Which load balancer should they use?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves the client IP.

Answer

Global TCP Proxy Load Balancer

Answer

Global HTTPS Load Balancer

Answer

Regional Internal TCP/UDP Load Balancer

Question 14

A company wants to serve static content from a Cloud Storage bucket and dynamic content from Compute Engine VMs behind a single external URL. Which GCP feature allows this configuration?

Accepted Answer

URL map. URL map in the Global HTTPS Load Balancer can route requests to different backends (backend bucket for static, backend service for dynamic) based on URL path.

Answer

Traffic Director

Answer

Cloud CDN

Answer

Cloud DNS

Question 15

A company wants to cache static content globally to reduce latency for their users. They are using a Global HTTPS Load Balancer with a backend bucket. Which Cloud CDN cache mode should they use?

Accepted Answer

CACHE_ALL_STATIC. CACHE_ALL_STATIC caches static content based on file extension and response headers, which is suitable for a backend bucket serving static files.

Answer

None: Cloud CDN cannot be used with backend buckets

Answer

USE_ORIGIN_HEADERS

Answer

FORCE_CACHE_ALL