Configuring managed network services — PCNE Practice Quiz

Question 1

A media company serves images through a global external Application Load Balancer with Cloud CDN enabled and cache mode set to CACHE_ALL_STATIC. An editor replaces the file at /assets/hero.jpg with corrected artwork, but users worldwide continue to receive the old image because it is still cached at Google's edge locations with a long TTL. The team needs the corrected image served immediately without waiting for the TTL to expire, and they want to minimize disruption to other cached content. What should they do?

Accepted Answer

Issue a Cloud CDN cache invalidation for the path /assets/hero.jpg on the backend service.

Answer

Disable Cloud CDN on the backend service and re-enable it to clear all cached objects.

Answer

Change the cache mode to USE_ORIGIN_HEADERS so the edge caches respect the origin's freshness.

Answer

Lower the default TTL on the backend service so the object expires from cache sooner.

Question 2

A media company hosts static images and CSS/JS bundles on a Cloud Storage bucket fronted by a global external Application Load Balancer with Cloud CDN enabled. The origin responses do NOT include any Cache-Control headers. The team wants Cloud CDN to cache as much of this static content as possible without requiring the developers to modify origin headers, while still respecting any explicit no-cache directives if they are added later. Which Cloud CDN cache mode should they configure?

Accepted Answer

CACHE_ALL_STATIC, which caches successful responses for common static content types even without cache headers, but honors explicit no-cache directives

Answer

USE_ORIGIN_HEADERS, so caching only occurs when the origin explicitly sets caching headers

Answer

FORCE_CACHE_ALL, which caches all successful responses and ignores any origin cache directives

Answer

BYPASS_CACHE, which forwards all requests to the origin without caching

Question 3

Your company hosts a large library of static marketing assets (images, PDFs, videos) in a Cloud Storage bucket. You want to serve these assets globally with low latency and caching, using a global external Application Load Balancer with Cloud CDN enabled. The team wants the simplest configuration that requires no compute instances and lets Cloud CDN cache directly from the bucket. Which backend configuration should you use?

Accepted Answer

Create a backend bucket that references the Cloud Storage bucket and enable Cloud CDN on the backend bucket.

Answer

Create a backend service with a managed instance group of NGINX proxies that read from the bucket, then enable Cloud CDN on the backend service.

Answer

Create an internet network endpoint group (NEG) pointing to storage.googleapis.com and attach it to a backend service with Cloud CDN.

Answer

Create a serverless NEG backed by a Cloud Run service that streams objects from the bucket, then enable Cloud CDN.

Question 4

Your team runs a global external Application Load Balancer with Cloud CDN enabled in CACHE_ALL_STATIC mode fronting a backend service. During a recent origin outage, clients received many HTTP 404 and 5xx responses. You notice these error responses are being cached at the edge with default TTLs, and stale 404s continued to be served to users even after the objects were restored on the origin. You want to keep error responses out of the cache (or minimize how long they are cached) while retaining normal caching for successful static content. What should you configure?

Accepted Answer

Enable negative caching on the backend service and set a negative caching policy that assigns a TTL of 0 to the specific supported negative-caching status codes (such as 404 and 410) rather than general 5xx status codes.

Answer

Switch the cache mode to USE_ORIGIN_HEADERS so that only responses with explicit Cache-Control headers are cached.

Answer

Issue a cache invalidation with the path /* every time the origin returns an error response.

Answer

Set the default TTL and max TTL on the backend service to 0 to prevent any responses from being cached.

Question 5

A media streaming company uses an external Application Load Balancer with Cloud CDN enabled to deliver video content stored in a Cloud Storage backend bucket. Each video is segmented into hundreds of individual files (manifests and chunks) that must all be protected so only paying subscribers can access them. The company wants to authorize access to an entire set of files with a single authorization step per user session, rather than issuing a separate token for every file. Which Cloud CDN access-control mechanism should they use?

Accepted Answer

Signed cookies, scoped to a URL prefix covering all the video's files

Answer

Signed URLs, generating one signed URL per video segment file

Answer

IAM policies on the backend bucket granting subscribers the objectViewer role

Answer

A Google-managed SSL certificate attached to the load balancer's target proxy

Question 6

A media company serves premium video files from a Cloud Storage bucket that is configured as a backend bucket behind a global external Application Load Balancer with Cloud CDN enabled. The company wants to ensure that only paying subscribers can download individual video files, and each access grant must automatically expire after a short time window. They do not want to modify the client application to send custom authentication headers, and access should be enforced at the CDN edge before the origin is contacted. Which approach should they implement?

Accepted Answer

Configure Cloud CDN signed URLs by adding a signed URL key to the backend bucket and generating time-limited signed URLs for each authorized request.

Answer

Set the Cloud CDN cache mode to USE_ORIGIN_HEADERS and rely on the bucket's IAM policy to grant temporary access to subscribers.

Answer

Enable Identity-Aware Proxy (IAP) on the backend bucket so that users must authenticate with Google credentials before downloading files.

Answer

Create a Cloud Armor security policy that allows requests only from subscriber IP ranges and attach it to the backend bucket.

Question 7

A financial services company hosts its public domain 'example-bank.com' in a Cloud DNS public managed zone. Security auditors require protection against DNS cache poisoning and spoofing so that resolvers can cryptographically validate the authenticity of DNS responses. What should the network engineer do?

Accepted Answer

Enable DNSSEC on the public managed zone and add the DS record to the domain registrar

Answer

Configure a DNS forwarding zone that routes queries through Google Public DNS at 8.8.8.8

Answer

Enable DNSSEC on a private managed zone and configure split-horizon DNS for the domain

Answer

Create signed URLs for the DNS records and distribute the signing keys to trusted resolvers

Question 8

Your company runs an internal application in a Google Cloud VPC. Applications on Compute Engine instances must resolve hostnames in the internal domain 'corp.example.internal', which is managed by DNS servers running in your on-premises data center reachable over an existing HA VPN connection (private IP 10.20.0.53). Google Cloud must send queries for this domain to the on-premises resolver, but all other queries should continue to use Google's default resolution. What should you configure in Cloud DNS?

Accepted Answer

Create a Cloud DNS forwarding zone for 'corp.example.internal' with forwarding targets set to the on-premises resolver IP 10.20.0.53.

Answer

Create a private managed zone for 'corp.example.internal' with DNSSEC enabled and add A records manually for each on-premises host.

Answer

Create a DNS peering zone for 'corp.example.internal' that peers with the on-premises DNS servers over the HA VPN.

Answer

Enable inbound DNS forwarding by creating an inbound server policy so on-premises servers can query Cloud DNS for 'corp.example.internal'.

Question 9

You manage a global external Application Load Balancer serving a stateless web application backed by two managed instance groups (MIGs) in different regions. During a regional traffic spike, one MIG becomes overloaded and returns high latency, even though the second MIG has spare capacity. You want the load balancer to distribute new connections based on backend CPU load and to stop sending new requests to backends that are already near their capacity limit. Which backend service configuration should you apply?

Accepted Answer

Set the backend service balancing mode to UTILIZATION with a target maximum CPU utilization, and configure capacity scaler values per backend.

Answer

Set the balancing mode to RATE with a maximum requests-per-second value and disable the capacity scaler.

Answer

Enable session affinity based on CLIENT_IP so connections are pinned to the least-loaded backend.

Answer

Switch the backends to a target pool with an equal-weight distribution across both regions.

Question 10

A media company runs a global external Application Load Balancer to serve its website. Static assets (images, CSS, JS) are stored in a Cloud Storage bucket, while dynamic API traffic must be routed to VM-based backends running in a managed instance group in us-central1 and europe-west1. The team wants a single anycast IP and URL map that directs '/static/*' requests to the bucket and all other requests to the VMs, with static assets cached at Google's edge. Which configuration meets these requirements?

Accepted Answer

Create a backend bucket (with Cloud CDN enabled) for the storage bucket and a backend service with the two instance groups as backends, then use a URL map with a path matcher sending '/static/*' to the backend bucket and the default route to the backend service.

Answer

Create two separate load balancers—one pointing at the bucket with Cloud CDN and one pointing at the instance groups—and use DNS weighting to split traffic between them.

Answer

Create a single backend service that includes both the Cloud Storage bucket and the instance groups as backends, enabling Cloud CDN on the backend service.

Answer

Create a backend service with the instance groups and attach the Cloud Storage bucket as a serverless NEG, then enable Cloud CDN on the serverless NEG.

Question 11

You configured an external Application Load Balancer (global) with a backend service pointing to a managed instance group of Compute Engine VMs. The load balancer's HTTP health check is configured correctly to probe port 80 at path /healthz, and the application is confirmed running and responding on the VMs. However, all backends are shown as UNHEALTHY in the console and no traffic is served. Egress rules are set to allow-all. What is the most likely cause?

Accepted Answer

There is no ingress firewall rule allowing traffic from the Google health check probe source ranges 35.191.0.0/16 and 130.211.0.0/22 to the backend VMs.

Answer

The backend service protocol is set to HTTPS but the health check uses HTTP, so the probe cannot complete.

Answer

The instances lack external IP addresses, so the global load balancer cannot reach them for health probing.

Answer

A global external Application Load Balancer requires a regional health check, and the configured health check is global.

Question 12

Your company is migrating a legacy web application to Google Cloud incrementally. During the transition, the application still runs on servers in your on-premises data center, which is reachable via Cloud Interconnect. You need to expose this on-premises application through a global external Application Load Balancer so you can gradually shift traffic to new Compute Engine backends and take advantage of Cloud CDN and Google-managed TLS certificates. Which backend configuration allows the load balancer to route traffic to the on-premises servers?

Accepted Answer

Create a hybrid connectivity network endpoint group (NEG) with endpoints specifying the on-premises IP addresses and ports, and add it to the backend service.

Answer

Create a zonal NEG of type GCE_VM_IP_PORT referencing the on-premises server IP addresses.

Answer

Create an unmanaged instance group containing the on-premises servers and attach it to the backend service.

Answer

Create a serverless NEG pointing to the on-premises application endpoint.

Question 13

Your team runs a public marketing site fronted by a global external Application Load Balancer. A new feature requires exposing an HTTP-triggered Cloud Run functions (formerly Cloud Functions 2nd gen) function under the path /api/subscribe on the same domain and certificate as the existing site. You must route requests to the function through the existing load balancer without provisioning any VMs or managing instance groups. What is the correct way to attach the function as a backend?

Accepted Answer

Create a serverless network endpoint group (NEG) that references the Cloud Functions service, add it as a backend to a backend service, and configure the URL map to route /api/subscribe to that backend service.

Answer

Create a zonal NEG of type GCE_VM_IP_PORT pointing to the function's runtime instances and attach it to a new backend service.

Answer

Create an internet NEG with the function's *.cloudfunctions.net FQDN and add it as a backend so the load balancer treats it as an external origin.

Answer

Create a backend bucket that maps to the Cloud Functions deployment and reference it in the URL map for the /api/subscribe path.

Question 14

Your security team requires that a global external Application Load Balancer serving api.example.com only negotiate TLS 1.2 or higher and disable known-weak cipher suites, while still supporting a broad range of modern clients. The load balancer already has a valid Google-managed certificate attached to its target HTTPS proxy. What is the recommended way to enforce these requirements?

Accepted Answer

Create an SSL policy with profile MODERN and minimum TLS version TLS 1.2, then attach it to the target HTTPS proxy.

Answer

Replace the Google-managed certificate with a self-managed certificate that only lists TLS 1.2 cipher suites in its metadata.

Answer

Add a URL map rewrite rule that rejects requests using TLS versions below 1.2.

Answer

Configure the backend service health check to negotiate TLS 1.2 so only compliant sessions reach the backends.

Question 15

Your company runs a single web property behind a global external Application Load Balancer. The frontend serves under one hostname, www.example.com. Requests to paths starting with /api/ must be routed to a backend service backed by a Kubernetes NEG cluster, requests to /static/ must go to a Cloud Storage backend bucket, and all other requests must go to a default backend service running the main web app. All three backends already exist and pass health checks. What is the correct way to implement this routing on the load balancer?

Accepted Answer

Create a URL map with a host rule for www.example.com and a path matcher containing path rules for /api/* and /static/*, plus a defaultService for all other traffic.

Answer

Create three separate forwarding rules, each with its own target proxy pointing at one of the backends, and use firewall rules to steer traffic by path.

Answer

Configure three backend services on a single backend service group and let the health checks determine which backend receives each path.

Answer

Create three global external Application Load Balancers sharing the same anycast IP, one per backend, and route by DNS.

Question 16

Your company runs a real-time gaming service on Compute Engine instances in a single region. Clients connect over UDP to a public IP. You need a Google Cloud load balancer that preserves client source IP, distributes UDP traffic across a managed instance group, and provides pass-through (non-proxied) delivery so the backends see the original packets unchanged. Which load balancer and health check configuration should you deploy?

Accepted Answer

A regional external passthrough Network Load Balancer with a backend service and a TCP or HTTP health check on a separate serving port

Answer

A global external Application Load Balancer with a serverless NEG and a UDP health check

Answer

An internal passthrough Network Load Balancer with a UDP health check bound to the game port

Answer

A global external proxy Network Load Balancer with a backend service and gRPC health check

Question 17

Your team runs a UDP-based gaming service on Compute Engine instances in us-central1. You need a regional external passthrough Network Load Balancer that supports weighted distribution across backends, connection draining during instance removal, and non-legacy health checks. You are choosing the backend architecture for the load balancer. Which configuration meets these requirements?

Accepted Answer

A backend service-based external passthrough Network Load Balancer using a regional backend service with a managed instance group backend

Answer

A target pool-based external passthrough Network Load Balancer with an HTTP health check attached to the target pool

Answer

A global external Application Load Balancer with a serverless NEG backend

Answer

An internal passthrough Network Load Balancer with a regional backend service and session affinity

Question 18

A gaming company runs a stateful multiplayer backend on a managed instance group behind an external passthrough Network Load Balancer (regional). During autoscaling scale-in events and rolling updates, players frequently report abrupt disconnections mid-session because active TCP connections to backends being removed are terminated immediately. The team wants to allow existing TCP connections to complete gracefully (up to 5 minutes) while preventing new connections from reaching instances being removed. Which configuration should they apply?

Accepted Answer

Enable connection draining on the backend service by setting connectionDraining.drainingTimeoutSec to 300.

Answer

Configure session affinity to CLIENT_IP on the backend service so connections stay pinned to the same instance.

Answer

Increase the health check unhealthyThreshold and timeoutSec so failing instances stay in rotation longer.

Answer

Enable global access on the backend service to redistribute connections across regions during scale-in.

Question 19

Your company runs a global external Application Load Balancer serving traffic for three domains: www.example.com, shop.example.com, and api.example.com. Currently you manage separate self-signed certificates that require manual renewal, causing occasional outages when they expire. You want Google to automatically provision and renew certificates for all three domains with the least operational overhead. What should you do?

Accepted Answer

Create a single Google-managed SSL certificate that lists all three domains as subject alternative names and attach it to the load balancer's target HTTPS proxy.

Answer

Upload a wildcard self-managed certificate for *.example.com and configure a Cloud Scheduler job to rotate it every 60 days.

Answer

Create three separate Google-managed certificates and attach only the www.example.com certificate to the target HTTPS proxy, relying on SNI for the others.

Answer

Enable Cloud CDN with signed URLs so that TLS termination and certificate renewal are handled automatically at the edge.

Question 20

Your company runs an internal microservices platform. A new Cloud Run service must be reachable only from clients inside the VPC and from on-premises networks connected via HA VPN, using a private RFC 1918 IP address and a friendly internal hostname. You need to route requests to the Cloud Run service through a load balancer. Which configuration meets these requirements?

Accepted Answer

Create a regional internal Application Load Balancer with a serverless NEG backend pointing to the Cloud Run service, and enable global access on the forwarding rule if cross-region clients are needed.

Answer

Create a global external Application Load Balancer with a serverless NEG backend and restrict access using Cloud Armor allowlists for the VPC and on-premises ranges.

Answer

Create an internal passthrough Network Load Balancer with a zonal NEG backend that references the Cloud Run revision endpoints.

Answer

Create a regional external Application Load Balancer with a serverless NEG and place it behind Cloud NAT so it only receives internal traffic.

More PCNE practice