GCP PCNE · Domain 3 of 6

GCP PCNE Domain 3: Configuring managed network services

Section 3 covers the managed services that deliver applications: picking and building the right load balancer, tuning backends, caching with Cloud CDN, and running public, private and hybrid DNS with Cloud DNS.

Exam weight
~16%
Official objectives
3
Estimated questions estimate
8–9
Suggested study time estimate
12–15 hrs

About 12 min read Reviewed October 2026

Overview

Three managed services make up this section. Load balancing comes first: choosing internal or external, regional or global, proxy or passthrough, then building backend services on managed instance groups or network endpoint groups with autoscaling, health checks, session affinity and global access. You also need GKE load balancing through the Gateway and Ingress controllers and Application Load Balancer traffic management such as weighted splitting, request mirroring and URL rewrites.

Cloud CDN questions cover enabling caching for instance groups, Cloud Storage buckets and Cloud Run, adding external origins through internet NEGs, and invalidating content. Cloud DNS work includes public and private zones, migration by zone import, geolocation and failover routing policies, DNSSEC, forwarding and server policies, split-horizon DNS, DNS peering with cross-project binding and the external-dns operator for GKE.

How it's tested

Most questions here give a traffic description, such as protocol, client location, need for client IP preservation or path-based routing, and ask for the matching load balancer or backend setting. DNS items describe where names live and who must resolve them, then ask for the zone type or policy.

  • Name the load balancer

    You map protocol, internal or external clients, regional or global scope, and proxy or passthrough needs to one load balancer type.

  • Tune the backend

    You adjust balancing mode, capacity, health checks, session affinity or autoscaling to fix uneven or failed traffic.

  • Resolve the name

    You choose private zones, forwarding zones, inbound server policies, peering zones or routing policies for a resolution path.

Reasoning it through

An internal TCP service in us-central1 must be reachable by VMs in europe-west1 over private IPs, and the backends must see the client's real source address. A passthrough load balancer preserves the source IP, and internal clients rule out external types. So the answer is an internal passthrough Network Load Balancer with global access enabled.

Objectives 3

Official objectives from the Google Cloud outline, in outline order.

3.1 Configuring load balancingLoad balancer selection, backend services, backend tuning, GKE load balancing and traffic management.
What it means
This objective covers picking the correct Cloud Load Balancing product and building it: backend services with managed instance groups or NEGs and autoscaling, session affinity, health checks and global access, load balancing for GKE with Gateway and Ingress controllers, and Application Load Balancer traffic management features.
What to understand
Application Load Balancers are Layer 7 proxies offered as global external, regional external, regional internal and cross-region internal. Network Load Balancers come as proxy (TCP with optional SSL offload) or passthrough (TCP, UDP and other protocols, preserving client IP), external or internal. Health checks need firewall rules allowing 35.191.0.0/16 and 130.211.0.0/22 for most types. Balancing modes include utilization, rate and connection. URL maps support weighted traffic splitting, request mirroring and URL rewrites. Container-native load balancing sends traffic straight to Pod IPs through zonal NEGs.
How it shows up
Expect several almost identical load balancer names where protocol, scope or client IP preservation decides.
Common confusion
Proxy load balancers terminate the connection; passthrough load balancers keep the client's source IP.
3.2 Configuring Cloud CDNSupported origins, external and third-party origins, and cache invalidation.
What it means
This objective covers turning on Cloud CDN for origins behind an external Application Load Balancer, including instance groups, Cloud Storage backend buckets and Cloud Run, connecting external or other-cloud object storage through internet NEGs, and removing stale content with invalidation.
What to understand
Cloud CDN is enabled on a backend service or backend bucket of a global external Application Load Balancer. Cache modes control what is stored: static content only by default, origin headers, or everything. Cache keys decide whether query strings, protocol or host form part of the key. Internet NEGs point to an origin outside Google Cloud by FQDN or IP. Invalidation removes cached objects by path or prefix and takes time to propagate, so versioned file names are the faster way to publish frequent updates. Signed URLs and signed cookies limit access to cached private content.
How it shows up
Look for stale content, low cache hit ratios or origins hosted outside Google Cloud.
Common confusion
Invalidation is not instant and is rate limited; versioned URLs avoid repeated invalidations.
3.3 Configuring Cloud DNSZones and records, migration, routing policies, DNSSEC, forwarding, split-horizon, peering and GKE integration.
What it means
This objective covers creating and running Cloud DNS: public and private managed zones and records, moving zones from another provider, geolocation and failover routing policies, DNSSEC signing, hybrid resolution with forwarding zones and server policies, split-horizon designs, DNS peering and cross-project binding, and the external-dns operator for GKE.
What to understand
Private zones answer only for authorized VPC networks. Forwarding zones send queries for a domain to on-premises name servers; Cloud DNS uses source range 35.199.192.0/19, which on-premises must route back through Cloud VPN or Interconnect. Inbound server policies create entry-point addresses in each subnet so on-premises resolvers can query Cloud DNS. DNS peering lets one VPC use another VPC's resolution order. Split-horizon uses a public and a private zone with the same name. DNSSEC for public zones needs a DS record added at the registrar.
How it shows up
Expect a hybrid name resolution flow where you choose the zone type or policy for each direction.
Common confusion
Forwarding zones send queries out to on-premises; inbound server policies let on-premises query in.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Global external Application Load Balancer

    Layer 7 proxy with one anycast IP.

    Remember
    Supports Cloud CDN, Cloud Armor and URL maps.
    Tested as
    Worldwide HTTP(S) apps.
    Trap
    Picking it for UDP traffic.

  • Internal passthrough Network Load Balancer

    Regional Layer 4 load balancer for internal clients.

    Remember
    Preserves source IP and can be a route next hop.
    Tested as
    Internal TCP and UDP services.
    Trap
    Expecting URL-based routing.

  • Global access

    Setting that lets clients in any region reach a regional internal load balancer.

    Remember
    Off by default.
    Tested as
    Cross-region internal clients.
    Trap
    Building a second load balancer instead.

  • Health check ranges

    Probes come from 35.191.0.0/16 and 130.211.0.0/22.

    Remember
    Firewall must allow them.
    Tested as
    Unhealthy backend scenarios.
    Trap
    Blaming the application first.

  • Network endpoint groups

    Backends defined by endpoints, such as Pods, serverless services or external origins.

    Remember
    Zonal, serverless, internet and hybrid types exist.
    Tested as
    GKE and Cloud Run backends.
    Trap
    Using instance groups for Pod-level balancing.

  • URL map traffic management

    Routing rules on Application Load Balancers.

    Remember
    Weighted splits, mirroring, rewrites and redirects.
    Tested as
    Canary releases.
    Trap
    Using DNS weights for HTTP canaries.

  • GKE Gateway controller

    Kubernetes Gateway API implementation that creates Google load balancers.

    Remember
    Supports multi-team and multi-cluster setups.
    Tested as
    Modern GKE ingress.
    Trap
    Assuming Ingress is the only option.

  • Cloud CDN cache modes

    Rules for what content is cached.

    Remember
    CACHE_ALL_STATIC, USE_ORIGIN_HEADERS, FORCE_CACHE_ALL.
    Tested as
    Low hit ratio questions.
    Trap
    Forcing cache on personalized pages.

  • Cache invalidation

    Removing cached objects by path.

    Remember
    Not instant; rate limited.
    Tested as
    Stale content.
    Trap
    Invalidating instead of versioning frequent releases.

  • Inbound server policy

    Gives on-premises resolvers addresses to query Cloud DNS.

    Remember
    Entry points are taken from VPC subnets.
    Tested as
    Hybrid DNS.
    Trap
    Using a forwarding zone for inbound queries.

  • 35.199.192.0/19

    Source range of Cloud DNS forwarding queries.

    Remember
    On-premises must route replies back over hybrid links.
    Tested as
    Forwarding failures.
    Trap
    Allowing it in firewalls but not routing it.

  • DNSSEC

    Signs public zone records to prevent spoofing.

    Remember
    Add the DS record at the registrar.
    Tested as
    Public zone integrity.
    Trap
    Enabling it on private zones.

  • DNS routing policies

    Weighted round robin, geolocation and failover answers.

    Remember
    Failover policies can use health checks for internal load balancers.
    Tested as
    Regional failover by DNS.
    Trap
    Expecting instant client failover despite TTLs.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Cloud Load Balancing families

ConceptMeaningKey differenceCommon trap
Application Load Balancer (external) Layer 7 HTTP(S) proxy for internet clients. URL maps, CDN and Cloud Armor. Not for non-HTTP protocols.
Application Load Balancer (internal) Layer 7 proxy for private clients. Regional or cross-region, uses a proxy-only subnet. Forgetting the proxy-only subnet.
Proxy Network Load Balancer Layer 4 TCP proxy with optional SSL offload. Terminates connections at the proxy. Client IP not seen without PROXY protocol.
Passthrough Network Load Balancer Layer 4 packet forwarding to backends. Keeps client IP; supports UDP and more. No TLS offload or URL routing.

Cloud DNS zone and policy types

ConceptMeaningKey differenceCommon trap
Private zone Records visible only to authorized VPCs. Internal names. Not resolvable from the internet.
Forwarding zone Sends queries for a domain to target name servers. Outbound to on-premises. Return route for 35.199.192.0/19 is needed.
Peering zone Uses another VPC's resolution order. Shares names across VPCs without copying records. Only one hop; not transitive.
Inbound server policy Exposes Cloud DNS to hybrid clients. Inbound from on-premises. Confusing it with an outbound policy.

Refreshing content served by Cloud CDN

ConceptMeaningKey differenceCommon trap
Cache invalidation Purges objects by path or prefix. Works for urgent fixes. Slow and limited if used for every release.
Versioned URLs New file names for new content. Old and new objects coexist. Requires the application to change references.
Lower TTL Content expires sooner. More origin requests. Raising origin load and cost.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. External load balancer for internal clients

    What candidates pick
    Use a global external Application Load Balancer for a private API.
    Why it looks right
    It has the most features.
    Why it's wrong
    Internal clients and private addressing call for an internal Application or passthrough Network Load Balancer.

    Clue to watch for Callers are VMs or on-premises hosts using private IPs.

  2. Second load balancer per region

    What candidates pick
    Deploy an internal load balancer in each client region.
    Why it looks right
    It seems simpler than learning a flag.
    Why it's wrong
    Enabling global access lets clients in other regions reach the existing regional internal load balancer.

    Clue to watch for Clients in other regions on the same VPC.

  3. DNS weights for a canary

    What candidates pick
    Use weighted DNS records to send 5% of web users to a new version.
    Why it looks right
    Weighted round robin exists in Cloud DNS.
    Why it's wrong
    Client caching makes DNS splits imprecise; URL map weighted backend services split HTTP traffic exactly.

    Clue to watch for Precise percentage of HTTP requests.

  4. Allow the range, skip the route

    What candidates pick
    Add a firewall rule on-premises for 35.199.192.0/19 and stop.
    Why it looks right
    Firewall changes often fix connectivity.
    Why it's wrong
    Replies also need a route back through the VPN or Interconnect, usually by Cloud Router custom advertisement.

    Clue to watch for Forwarded queries time out despite open firewalls.

  5. CDN on an internal load balancer

    What candidates pick
    Enable Cloud CDN on a regional internal Application Load Balancer.
    Why it looks right
    Caching sounds useful everywhere.
    Why it's wrong
    Cloud CDN works with the global external Application Load Balancer, not internal load balancers.

    Clue to watch for Requirement to cache content for internet users.

  6. DNSSEC for private names

    What candidates pick
    Turn on DNSSEC to protect a private zone.
    Why it looks right
    DNSSEC improves DNS security.
    Why it's wrong
    DNSSEC applies to public zones and depends on a DS record in the parent domain.

    Clue to watch for Names used only inside the VPC.

Answer framework

Apply these steps to pick and tune managed network services from a scenario.

  1. Identify client location and protocol: internet or internal callers, HTTP(S) or other TCP and UDP traffic, and any requirement for TLS termination.
  2. Decide scope and mode: global or regional, proxy or passthrough, and whether backends must see the original source IP of each client.
  3. Choose backend type and settings, such as instance groups or NEGs, balancing mode, health checks, affinity and global access.
  4. Add delivery features only where supported, such as Cloud CDN on global external Application Load Balancers and weighted traffic splitting in URL maps.
  5. For names, trace each query direction and pick private, forwarding or peering zones, server policies and routing policies.

Practice question

On-premises applications must resolve records in a Cloud DNS private zone named corp.internal that is authorized for your VPC. Hybrid connectivity uses HA VPN with Cloud Router. On-premises DNS servers are already able to forward queries. What should you configure in Google Cloud?

Want more like this? The GCP PCNE practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with a load balancer decision table. List each Cloud Load Balancing type with its layer, scope, client type, protocol support, source IP behavior and whether it supports Cloud CDN and Cloud Armor. Quiz yourself with short prompts like internal UDP across regions or global HTTPS with caching until you answer in seconds.

In a lab, build a global external Application Load Balancer with an instance group and a Cloud Storage backend bucket, enable Cloud CDN and watch cache hits in the logs. Add a second backend service and split traffic by weight. Create an internal passthrough Network Load Balancer and turn on global access.

For DNS, sketch a hybrid resolution diagram with arrows for both directions, labeling forwarding zones, inbound policies and the 35.199.192.0/19 return route. Then create private, forwarding and peering zones in a test project, then query each one from a VM to confirm the answers. Reserve the last session for mixed practice questions that combine load balancing and DNS.

FAQ

How much of the GCP PCNE exam is Configuring managed network services?

Configuring managed network services is Section 3 at about 16% of the exam, or around 8 to 9 questions by editorial estimate.

Is Cloud Armor still part of this section?

Not in the current guide. Cloud Armor, Cloud NAT and Secure Web Proxy now sit in Section 6 on network security, although Cloud Armor still attaches to the load balancers configured here.

Which load balancer names should I know?

Know external and internal Application Load Balancers in global, regional and cross-region forms, plus proxy and passthrough Network Load Balancers in external and internal forms.

Do I need to know Media CDN?

The current guide names Cloud CDN only. Focus on Cloud CDN origins, cache modes, cache keys and invalidation.

How does DNS peering differ from a forwarding zone?

DNS peering asks another VPC network to resolve names using its own zones and policies. A forwarding zone sends queries to specific name servers, typically on-premises, over the network.

What is the external-dns operator for GKE?

It is a Kubernetes add-on that creates and updates Cloud DNS records automatically from Services and Ingress or Gateway resources, so DNS stays in step with cluster changes.

Other Networking certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

Try scenario questions that ask you to pick a load balancer, fix a cache problem or design a hybrid DNS path.

Take the GCP PCNE practice test Check your GCP PCNE readiness

Keep going