PCNE Practice Test 24 — 15 Questions

Question 1

An organization uses a hierarchical firewall policy at the organization level with a deny-all egress rule (priority 100). They also have a VPC-level firewall rule allowing egress to a specific external IP (priority 1000). Will traffic to that external IP be allowed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No, because hierarchical firewall policies take precedence over VPC firewall rules.. Hierarchical firewall policies are evaluated before VPC firewall rules and have higher precedence. A deny rule at the org level with priority 100 will override a VPC allow rule with lower priority (higher number).

Answer

Yes, because VPC firewall rules override hierarchical policies for the same traffic.

Answer

Yes, because the VPC rule has a higher priority number and is more specific.

Answer

No, because both rules deny and allow cancel out, resulting in default deny.

Question 2

An organization is designing a hybrid connectivity architecture using Cloud Router and BGP. They need to advertise a specific prefix from an on-premises network to GCP, and they want to control the route priority. Which two BGP features should they configure? (Choose TWO.)

Accepted Answer

Custom route exchange. Cloud Router can advertise custom routes, and BGP allows setting MED values to influence route priority.

Answer

Global dynamic routing mode

Answer

Custom learned routes

Answer

BGP route aggregation

Question 3

A company wants to protect its HTTP(S) Load Balancer against DDoS attacks and common web exploits like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google's web application firewall (WAF) and DDoS protection service. It integrates with Cloud Load Balancing to provide security policies that inspect traffic and block attacks like SQLi and XSS using pre-configured WAF rules.

Answer

VPC Service Controls

Answer

Firewall Rules

Answer

Cloud NAT

Question 4

A company wants to restrict access to Google Cloud Storage so that only traffic originating from a specific VPC network is allowed. They also need to prevent data exfiltration to other VPCs. Which two services should they use? (Choose two.)

Accepted Answer

VPC Service Controls. VPC Service Controls creates a service perimeter around the Storage API, and Private Google Access enables VMs without external IPs to access Google APIs from within the VPC.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Firewall rules

Question 5

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

Accepted Answer

Cloud Armor. Cloud Armor provides Web Application Firewall (WAF) capabilities, including preconfigured rules to detect and block SQLi and XSS attacks. It attaches to HTTPS Load Balancers.

Answer

Firewall Rules

Answer

Cloud IDS

Answer

VPC Service Controls

Question 6

A company has a VPC with a subnet in us-central1. Compute Engine instances in that subnet have no external IPs but need to reach the internet for software updates. The engineer configured Cloud NAT with the default settings. However, instances fail to reach the internet. What is the most likely cause?

Accepted Answer

An egress firewall rule is missing that allows traffic from the instances to the internet via NAT.. Cloud NAT requires that the instances are allowed egress traffic to the internet. Without a suitable egress firewall rule, NAT traffic is blocked. The default firewall rules only allow egress to Google APIs (private.googleapis.com) but not to general internet destinations. A firewall rule allowing egress to 0.0.0.0/0 on the appropriate ports is required.

Answer

Cloud NAT is not configured in the correct region.

Answer

Private Google Access is enabled on the subnet, which overrides Cloud NAT.

Answer

The Cloud NAT router is not attached to the correct VPC network.

Question 7

A security team wants to enforce a policy that blocks all egress traffic to the internet from a specific set of VMs across multiple projects in an organization. The policy should be centrally managed and override VPC-level firewall rules. Which approach should they use?

Accepted Answer

Deploy a hierarchical firewall policy at the organization level with a deny egress rule targeting the VMs.. Hierarchical firewall policies at the organization level can enforce rules that apply to all VPCs and override VPC-level rules with lower priority.

Answer

Create VPC firewall rules with deny egress for the specific VMs in each VPC.

Answer

Use a network firewall policy attached to each VPC network.

Answer

Configure Cloud Armor security policies on the load balancer to block egress.

Question 8

A company is planning IP address ranges for a new VPC that will be peered with an existing VPC (10.1.0.0/16) and connected to an on-premises network (172.16.0.0/12). Which three considerations should they follow to avoid IP overlap? (Choose THREE.)

Accepted Answer

Use an RFC 1918 private IP range (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16).. IP addresses must be unique across connected networks; using RFC 1918 private ranges is standard; avoiding overlapping with on-premises and peered VPC ranges is critical.

Answer

Use a subnet size of /16 or larger to provide ample IP addresses.

Answer

Allocate public IP addresses for private use to ensure uniqueness.

Question 9

An engineer wants to allow traffic from a specific service account to a Compute Engine instance. Which firewall rule option should they use for the source?

Accepted Answer

Source service accounts. Firewall rules can use service accounts as source or target. For source, you specify the source service account using the --source-service-accounts flag.

Answer

Target service accounts

Answer

Source IP ranges

Answer

Source tags

Question 10

Drag and drop the steps to set up a Google Cloud Armor security policy for a backend service into the correct order.

Accepted Answer

Step 1: Create a Cloud Armor security policy. Step 2: Set the default action. Step 3: Add security rules. Step 4: Attach the policy to a backend service.. Security policy creation involves defining rules, setting default action, and attaching to a backend service. Testing ensures correct enforcement.

Answer

Step 1: Create a Cloud Armor security policy. Step 2: Add security rules. Step 3: Set the default action. Step 4: Attach the policy to a backend service.

Answer

Step 1: Add security rules. Step 2: Create a Cloud Armor security policy. Step 3: Set the default action. Step 4: Attach the policy to a backend service.

Answer

Step 1: Create a Cloud Armor security policy. Step 2: Set the default action. Step 3: Attach the policy to a backend service. Step 4: Add security rules.

Question 11

Which TWO of the following load balancer types can distribute traffic to backends in multiple regions?

Accepted Answer

External HTTP(S) Load Balancer. The External HTTP(S) Load Balancer is a global load balancer that can distribute traffic to backends in multiple regions using anycast IP addresses and Google's global network. It supports cross-regional backend services, making it suitable for global applications.

Answer

Internal HTTP(S) Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP/UDP Load Balancer

Question 12

A company is using Traffic Director with Envoy sidecar proxies to manage traffic between microservices. They want to gradually shift 5% of traffic from version v1 to v2 of a service for testing. Which Traffic Director resource should they configure?

Accepted Answer

Define a weighted traffic split in the HTTP route rule of the Traffic Director route configuration. Traffic Director supports traffic splitting via weighted routing in the HTTP route configuration, not in the backend service. The traffic splitting is done at the routing level.

Answer

Use the Envoy runtime to dynamically adjust traffic percentages

Answer

Create a new backend service for v2 and set the traffic split in the backend service

Answer

Configure a weighted round-robin routing policy in Cloud DNS

Question 13

You need to configure Cloud CDN to cache all content from a backend bucket, ignoring any Cache-Control headers sent by the origin. Which cache mode should you use?

Accepted Answer

FORCE_CACHE_ALL. FORCE_CACHE_ALL ignores origin headers and caches all responses for the specified TTL.

Answer

USE_ORIGIN_HEADERS

Answer

CACHE_ALL_STATIC

Answer

DYNAMIC_MODE

Question 14

You need to configure SSL certificates for a Global HTTPS Load Balancer. The certificate should be automatically provisioned and managed by Google. Which type of certificate should you use?

Accepted Answer

Google-managed certificate. Google-managed certificates are automatically provisioned and renewed for load balancers.

Answer

Compute Engine instance certificate

Answer

Certificate Authority Service certificate

Answer

Self-managed certificate

Question 15

Which load balancer type preserves the client source IP address and can be used for TCP/UDP traffic on a specific port, passing traffic through to backend instances without proxy overhead?

Accepted Answer

Regional External TCP/UDP Network Load Balancer. The Regional External TCP/UDP Network Load Balancer is a pass-through load balancer that preserves client IP and handles TCP/UDP traffic.

Answer

Regional Internal TCP/UDP Load Balancer

Answer

Global External TCP Proxy Load Balancer

Answer

Global External HTTPS Load Balancer