PCNE Configuring Network Services Practice Test 9 — 15 Questions

Question 1

An engineer is configuring a Global HTTPS Load Balancer with a serverless NEG pointing to Cloud Run. The deployment fails with a health check error. What is the most likely cause?

Accepted Answer

The serverless NEG does not support health checks. Serverless NEGs do not require health checks; the health check configuration is ignored. The error may be due to incorrect IAM permissions or service account.

Answer

The Cloud Run service is not deployed

Answer

The health check interval is too short

Answer

The SSL certificate is misconfigured

Question 2

A company wants to use Cloud CDN to serve private content to authenticated users only. Which feature should they use?

Accepted Answer

Signed URLs. Signed URLs or signed cookies allow Cloud CDN to serve private content by requiring a valid signature for access.

Answer

Cache invalidation

Answer

IAM roles on the backend bucket

Answer

Cloud Armor

Question 3

A company has a Global SSL Proxy Load Balancer handling HTTPS traffic. They want to offload SSL decryption to the load balancer and forward encrypted traffic to backends. Which backend protocol should they use?

Accepted Answer

SSL. Global SSL Proxy LB terminates SSL and forwards traffic using SSL (TCP with SSL) to backends, allowing end-to-end encryption.

Answer

HTTPS

Answer

TCP

Answer

HTTP

Question 4

A company wants to route traffic to different backend services based on the geographic location of the client. Which Cloud DNS routing policy should they use?

Accepted Answer

Geolocation. Geolocation routing policy directs traffic to different backends based on the geographic location of the DNS resolver.

Answer

Weighted round robin

Answer

Failover

Answer

Cloud CDN

Question 5

An organization needs to serve a TCP-based application globally with low latency but without SSL termination. Which load balancer should they use?

Accepted Answer

Global TCP Proxy Load Balancer. Global TCP Proxy Load Balancer is designed for non-SSL TCP traffic and provides global anycast IP.

Answer

Global HTTPS Load Balancer

Answer

Global SSL Proxy Load Balancer

Answer

Regional External TCP/UDP Network Load Balancer

Question 6

A company is using Traffic Director with Envoy sidecars to manage traffic between microservices. They want to inject faults to test service resilience. Which Traffic Director feature should they use?

Accepted Answer

Fault injection. Fault injection is a feature of Traffic Director that allows injecting delays or abort errors into requests for testing.

Answer

Traffic splitting

Answer

Circuit breakers

Answer

mTLS

Question 7

An engineer wants to use Cloud DNS to override DNS responses for a specific domain within their VPC. Which feature should they use?

Accepted Answer

Response policy zone (RPZ). Response policy zones (RPZ) allow overriding DNS responses for specified domains within a VPC.

Answer

Private zone

Answer

DNSSEC

Answer

Routing policy

Question 8

A company uses a Global HTTPS Load Balancer with Cloud CDN. They need to purge specific cached objects for all users immediately after a content update. Which method should they use?

Accepted Answer

Cache invalidation. Cache invalidation allows purging specific URLs or URL prefixes from Cloud CDN caches.

Answer

Delete the objects from the backend bucket

Answer

Use signed URLs

Answer

Reduce TTL on the origin

Question 9

A company wants to set up a Regional Internal HTTP(S) Load Balancer to serve an internal web application. Which two components are required? (Choose two.)

Accepted Answer

An Envoy-based proxy. Regional Internal HTTP(S) LB requires an Envoy-based proxy and a backend service with a NEG of type GCE_VM_IP_PORT or GCE_VM_IP.

Answer

Cloud CDN

Answer

An SSL certificate

Answer

A global forwarding rule

Question 10

A company is using Traffic Director with Envoy sidecars. They want to enable mutual TLS (mTLS) between services. Which two steps are required? (Choose two.)

Accepted Answer

Enable mTLS in Traffic Director configuration. To enable mTLS, you need to enable mTLS in Traffic Director and configure Envoy sidecars with certificates.

Answer

Deploy a service mesh with Istio

Answer

Use a Global HTTPS Load Balancer

Answer

Set up Cloud DNS

Question 11

A company needs to cache API responses that are dynamic but cacheable for short periods. They want to use Cloud CDN with a Global HTTPS Load Balancer. Which three settings should they configure?

Accepted Answer

Set a short TTL (e.g., 60 seconds). To cache dynamic but cacheable API responses with Cloud CDN and a Global HTTPS Load Balancer, three settings are required: Set a short TTL (e.g., 60 seconds) to control how long responses are cached. Set cache mode to FORCE_CACHE_ALL to override origin cache headers and allow caching of all responses. Configure cache keys to include query parameters to distinguish different API calls. These three settings ensure dynamic content is cached appropriately.

Answer

Disable Cloud CDN for the backend service

Answer

Set cache mode to USE_ORIGIN_HEADERS

Question 12

A company wants to expose a global web application with HTTP/HTTPS load balancing, SSL termination, and Cloud CDN. They need to route requests to different backend services based on the URL path (e.g., /api/* to a Cloud Run service, /static/* to a Cloud Storage bucket, and /* to a managed instance group). Which GCP load balancing product should they use?

Accepted Answer

Global external HTTP(S) Load Balancer. Global external HTTPS Load Balancer supports URL-based routing via URL maps, can terminate SSL, integrate with Cloud CDN, and route to different backends (including serverless NEG for Cloud Run and backend buckets for Cloud Storage).

Answer

SSL Proxy Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP/UDP Network Load Balancer

Question 13

An organization runs a stateful TCP application on a group of Compute Engine instances in us-central1. Clients must connect to the service using a single anycast IP address, and the load balancer must preserve the client source IP address. Which load balancing option meets these requirements?

Accepted Answer

Global external TCP Proxy Load Balancer. The Global external TCP Proxy Load Balancer provides a single anycast IP address that clients can connect to from anywhere. While it terminates the TCP connection, it can be configured to forward the client's IP address to the backend using Proxy Protocol (e.g., HAProxy protocol). This allows the backend to see the original client source IP, meeting the requirement for a stateful TCP application. The other options either do not provide anycast IP or cannot preserve the source IP.

Answer

External TCP/UDP Network Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

Global external HTTP(S) Load Balancer

Question 14

A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking health check probes from Google Cloud. Hybrid connectivity NEGs require that the on-premises endpoint is reachable via a Cloud VPN or Interconnect. If Traffic Director cannot reach the endpoint, it might be due to missing firewall rules allowing health check probes or the NEG endpoint being misconfigured. The most common cause is that health checks are failing because the firewall rules on-premises are not allowing the health check source ranges.

Answer

The hybrid connectivity NEG is not supported with Traffic Director

Answer

The Cloud VPN tunnel is not established

Answer

Traffic Director requires mTLS for all hybrid endpoints

Question 15

A developer wants to use Cloud CDN to cache content from a backend bucket. They want to cache all objects regardless of cache-control headers, but need to exclude certain URL patterns (e.g., /private/*) from caching. Which cache mode should they choose?

Accepted Answer

FORCE_CACHE_ALL. Cloud CDN cache modes: FORCE_CACHE_ALL caches all content irrespective of origin headers; USE_ORIGIN_HEADERS respects cache-control; CACHE_ALL_STATIC is similar to FORCE_CACHE_ALL but for static content. To exclude certain paths, you need to set up cache key or use URL map routing to different backends. The question asks for cache mode; FORCE_CACHE_ALL will cache everything by default, but to exclude patterns, you need to configure cache key rules or separate backends. However, the best answer among the options is FORCE_CACHE_ALL because it caches all objects, but the exclusion would require additional configuration. There is no "CACHE_ALL_EXCEPT" mode. Actually, the correct approach is to use a URL map with two backend buckets: one for public content with FORCE_CACHE_ALL, and one for private content with no CDN. But among the cache modes, FORCE_CACHE_ALL is the one that ignores cache-control.

Answer

CACHE_ALL_STATIC

Answer

DISABLED

Answer

USE_ORIGIN_HEADERS