PCNE Configuring Network Services Practice Test 8 — 15 Questions

Question 1

A company wants to expose a web application running on Cloud Run globally with a single anycast IP address, using HTTP(S) load balancing and Cloud CDN for static content. The application should be accessible at https://app.example.com. What is the correct configuration?

Accepted Answer

Create a global external HTTP(S) load balancer with a serverless NEG that points to the Cloud Run service.. Global HTTPS LB with serverless NEG targeting Cloud Run is the best practice for globally exposing serverless workloads with CDN. The other options either lack CDN (SSL Proxy), are regional (regional LB), or use incorrect NEG type (hybrid NEG for on-prem).

Answer

Create a global SSL Proxy load balancer with a Cloud Run backend bucket.

Answer

Create a global TCP Proxy load balancer with a hybrid connectivity NEG.

Answer

Create a regional external HTTP(S) load balancer with a serverless NEG.

Question 2

An organization needs to route traffic to a group of Compute Engine VM instances in the same zone for a high-throughput TCP application. The solution must preserve the client source IP address and support connection draining. Which load balancer type meets these requirements?

Accepted Answer

Regional external TCP/UDP Network Load Balancer. Regional external TCP/UDP Network Load Balancer (NLB) is pass-through and preserves client IP. Connection draining is supported for NLB backends. Global Proxy LBs rewrite source IP.

Answer

Regional external HTTP(S) load balancer

Answer

Global TCP Proxy load balancer

Answer

Global external HTTP(S) load balancer

Question 3

A company's application requires TLS termination at the load balancer, with backend instances in multiple regions running on Compute Engine. The backend instances must see the original client IP address. Which load balancer should be used?

Accepted Answer

Global SSL Proxy load balancer. Global SSL Proxy LB terminates TLS (SSL offload) and adds the Proxy Protocol header to preserve client IP. Global HTTPS LB does not support Proxy Protocol. NLB does not terminate TLS. Internal LB is not external.

Answer

Global external HTTPS load balancer

Answer

Regional external TCP/UDP Network Load Balancer

Answer

Regional internal HTTP(S) load balancer

Question 4

A developer wants to use Cloud CDN to cache static assets from an external origin (not a GCP bucket). Which backend type supports this?

Accepted Answer

Internet NEG. Internet NEG allows specifying an external FQDN as a backend, enabling Cloud CDN to cache content from external origins. Backend buckets are for GCS. Serverless NEG is for Cloud Run/Functions/App Engine. Zonal NEG is for GCP VMs/containers.

Answer

Backend bucket

Answer

Serverless NEG

Answer

Zonal NEG

Question 5

You need to configure a health check for a gRPC-based backend service. Which protocol should you use for the health check?

Accepted Answer

gRPC. Health checks support HTTP, HTTPS, HTTP2, TCP, SSL, and gRPC. For gRPC backends, a gRPC health check is the most appropriate as it reflects the application health. The other protocols may not accurately indicate gRPC service health.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 6

A company wants to serve private content from Cloud CDN using signed URLs that expire after 1 hour. Which steps are required to enable this?

Accepted Answer

Create a signing key in Cloud CDN, then generate signed URLs with expiration using that key.. Signed URLs require a signing key (created via Cloud CDN backend bucket configuration) and generating URLs programmatically with expiration. Enabling IAP is not required. The key is not passed in the header but as query parameters. Just setting cache mode does not enable signed URLs.

Answer

Set the cache mode to FORCE_CACHE_ALL and enable private access.

Answer

Pass the signing key in the X-Goog-Signed-URL header on each request.

Answer

Enable IAP on the backend and generate signed URLs using the IAP client ID.

Question 7

You are using Cloud CDN with a backend bucket and want to cache all responses regardless of Cache-Control headers. Which cache mode should you set?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL overrides origin Cache-Control headers and caches all responses. CACHE_ALL_STATIC attempts to cache static content but respects Cache-Control. USE_ORIGIN_HEADERS respects origin headers.

Answer

CACHE_ALL_STATIC

Answer

USE_ORIGIN_HEADERS

Answer

DISABLED

Question 8

You need to invalidate Cloud CDN cached content for specific URLs after updating files in Cloud Storage. Which command should you use?

Accepted Answer

gcloud compute url-maps invalidate-cdn-cache. gcloud compute url-maps invalidate-cdn-cache invalidates CDN cache for a specific URL map. gcloud compute ssl-certificates is for certificates. gcloud compute backend-buckets update is for updating backend bucket configuration. gcloud compute cdn-cache invalidate does not exist.

Answer

gcloud compute cdn-cache invalidate

Answer

gcloud compute backend-buckets update

Answer

gcloud compute ssl-certificates update

Question 9

What is the purpose of a Response Policy Zone (RPZ) in Cloud DNS?

Accepted Answer

To override DNS responses for specified domains (e.g., block or redirect). RPZ allows you to override DNS responses for specific domains, often used for security (malware filtering) or policy enforcement. It is not for routing traffic, private zones, or load balancing.

Answer

To route traffic based on geographic location of the requester

Answer

To enable weighted round-robin load balancing for multiple IPs

Answer

To create private DNS zones within a VPC

Question 10

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

Accepted Answer

Configure a route rule with a fault injection policy specifying a percentage and abort/fixed delay.. Traffic Director uses Envoy's fault injection filter, configured via the Envoy xDS API or through GKE configuration. The correct approach is to apply a traffic policy with fault injection percentage. The other options are not valid Traffic Director features or do not achieve fault injection.

Answer

Use the gcloud compute backend-services update command with the --fault-injection flag.

Answer

Set a circuit breaker with a max pending requests threshold.

Answer

Create a backend service with connection draining and set the drain timeout.

Question 11

You need to migrate traffic gradually from an old version of a microservice to a new version using Traffic Director. You want to send 10% of traffic to the new version and 90% to the old version. Which configuration should you use?

Accepted Answer

Configure a weighted destination rule in the Envoy route with weights 9:1.. Traffic Director supports traffic splitting via weighted destination rules in the Envoy configuration. The correct approach is to specify weights for each service version in the route rule. Setting circuit breaker thresholds or using connection draining does not achieve traffic splitting.

Answer

Create two separate backend services and use a URL map to distribute traffic.

Answer

Set circuit breaker thresholds to limit connections to the new version.

Answer

Use a health check to gradually remove the old version instances.

Question 12

Which Traffic Director feature ensures that a service does not receive more requests than it can handle by setting a maximum number of concurrent requests or connections?

Accepted Answer

Circuit breakers. Circuit breakers are used to limit the number of concurrent connections or requests to a service to prevent overload. Fault injection is for testing. Traffic splitting is for gradual rollouts. mTLS is for mutual TLS authentication.

Answer

Traffic splitting

Answer

mTLS

Answer

Fault injection

Question 13

A company wants to use Cloud DNS to route traffic to multiple IP addresses for a domain, with the ability to direct users based on their geographic location and also failover to a backup region if the primary is unhealthy. Which DNS routing policies should be combined? (Choose two.)

Accepted Answer

Geo routing policy. Geo routing policy directs traffic based on user location, and failover policy provides automatic failover to a backup if health check fails. Weighted round-robin distributes by weight, not location. DNSSEC is a security extension.

Answer

Weighted round-robin

Answer

DNSSEC

Answer

Response policy zone

Question 14

You are designing a global web application that uses Cloud Run for the backend and Cloud Storage for static assets. You need to serve content securely over HTTPS with a custom domain, using Cloud CDN for caching. Which resources must be created or configured? (Choose three.)

Accepted Answer

SSL certificate resource. Global HTTPS LB with backend bucket (for GCS) and serverless NEG (for Cloud Run) is the architecture. SSL certificate is needed for HTTPS. IAP is for authentication, not required. URL map is required for routing. Zonal NEG is not needed for Cloud Run.

Answer

Zonal NEG for Cloud Run

Answer

Identity-Aware Proxy (IAP)

Question 15

You are deploying a new internal HTTP(S) load balancer for a microservice that runs on Compute Engine instances within the same region. The load balancer must be accessible only from within the VPC network. Which components are required? (Choose two.)

Accepted Answer

Regional internal HTTP(S) load balancer. Regional internal HTTP(S) LB uses an internal IP address and forwards traffic to a backend service. Backend service requires a health check. An SSL certificate is optional if HTTP is used. Global external LB is for external access.

Answer

Global external HTTP(S) load balancer

Answer

Cloud CDN enabled

Answer

SSL certificate