PCNE Implementing network security — 10 Questions

Question 1

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used. To ensure specific VMs use a designated set of NAT IPs for auditing, you must first create a separate Cloud NAT gateway with the desired IPs and associate it with the VMs via subnet or tags (option D). This isolates traffic from those VMs. Next, configure VPC firewall rules to allow egress from the VMs to the internet (option E); otherwise, outbound traffic may be blocked. Finally, enable VPC Flow Logs on the subnet (option C) to capture which NAT IPs are used, providing auditability. Option A is not necessary because the default route's next hop is the internet gateway, not the NAT gateway's subnet, and Cloud NAT does not require a route pointing to its subnet. Option B is misleading: Cloud NAT uses subnet or tag associations, not IAM conditions, to control which VMs use it.

Answer

Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet

Answer

Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it

Question 2

An organization uses VPC Service Controls to protect Google Cloud APIs. They need to allow a specific service account in a peripheral project to access a managed service in a protected service perimeter. What should they configure?

Accepted Answer

Ingress and egress rules in the perimeter.. VPC Service Controls uses ingress and egress rules to control data exchange between a protected service perimeter and resources outside it. To allow a specific service account in a peripheral project to access a managed service inside the perimeter, you configure an ingress rule that permits traffic from that service account to the protected service. Ingress rules define which identities and sources from outside the perimeter are allowed to access protected services. Egress rules would be used for the opposite direction (from inside to outside).

Answer

IAM conditions on the service account.

Answer

Access levels in VPC Service Controls.

Answer

Private Google Access.

Question 3

Which TWO of the following are benefits of using Cloud NAT?

Accepted Answer

Enables instances without public IPs to access the internet.. Cloud NAT provides two key benefits: it enables instances without public IPs to access the internet for outbound connections, and it automatically scales with the number of instances in a region without requiring manual provisioning or resizing. These features make it a managed and scalable solution for outbound internet access.

Answer

Allows instances to receive incoming connections from the internet.

Answer

Provides static external IP for outbound traffic.

Answer

Integrates with IAP for SSH access.

Question 4

A company wants to restrict SSH access to a VM instance to only a specific subnet (10.0.1.0/24) and allow all traffic from the health check ranges (130.211.0.0/22 and 35.191.0.0/16) for load balancing. Which firewall rule configuration should be used for the SSH rule?

Accepted Answer

Create a rule with source ranges 10.0.1.0/24, 130.211.0.0/22, 35.191.0.0/16, protocol tcp:22, and target tag 'ssh-allowed'.. A single firewall rule can include multiple source ranges (10.0.1.0/24, 130.211.0.0/22, 35.191.0.0/16) and apply to a target tag (ssh-allowed), allowing SSH from both the specific subnet and health check ranges. Option A is wrong because allowing SSH from 0.0.0.0/0 is too permissive. Option B is wrong because separate rules for the subnet and health check ranges would work but are not the most efficient configuration; the question asks which should be used, and a single rule is preferred. Option D is wrong because it only allows health check ranges, not the subnet.

Answer

Create a rule allowing SSH from 0.0.0.0/0 and apply a tag to the VM.

Answer

Create a rule allowing SSH from 10.0.1.0/24 and another rule allowing SSH from health check ranges.

Answer

Create a rule allowing SSH only from health check ranges and deny all other traffic.

Question 5

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

Accepted Answer

The VM has a custom route that does not use the default route through Cloud NAT. Cloud NAT relies on the default route (0.0.0.0/0) pointing to the Cloud Router to direct traffic through the NAT gateway. If a VM has a custom route that overrides the default route (e.g., a more specific route to an external IP or a route to a different next hop), the VM's outbound traffic will bypass Cloud NAT entirely, resulting in the source IP being the VM's private IP instead of the Cloud NAT IP. This causes external firewalls to block the traffic as the source IP is not the expected NAT IP.

Answer

The VM is in a different zone than the Cloud NAT gateway

Answer

The VPC firewall rules are blocking outbound traffic from the VM to the Cloud NAT IP

Answer

Cloud Router is misconfigured and not advertising the Cloud NAT IP

Question 6

An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?

Accepted Answer

Enable Private Google Access on the subnet and create a VPC Service Controls perimeter that includes the bucket project. D is correct because VPC Service Controls create a security perimeter around the Cloud Storage bucket's project, preventing data exfiltration even if the bucket is publicly accessible. Private Google Access on the subnet allows VMs to reach Google APIs (including storage.googleapis.com) via internal IPs, avoiding the public internet. Together, they ensure only VMs within the specified VPC network can download objects, as the perimeter restricts access to authorized networks and Private Google Access provides the private connectivity path.

Answer

Enable Cloud NAT and configure a firewall rule to allow egress to 0.0.0.0/0

Answer

Configure a Service Directory endpoint and attach an IAM policy to the bucket allowing access only from that endpoint

Answer

Create a firewall rule allowing egress to the storage.googleapis.com service IP range and enable VPC flow logs

Question 7

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

Accepted Answer

Check VPC firewall rules to ensure ingress traffic from the on-premises subnet is allowed to the VM. VPC firewall rules are the first line of defense for controlling traffic to GCE VMs. Even though the VPN tunnel is established, the default-deny ingress posture of GCP means that traffic from the on-premises subnet must be explicitly allowed by a VPC firewall rule. Without this rule, packets arriving via the tunnel are dropped before they ever reach the VM's network interface.

Answer

Check the VM's OS firewall to see if it is blocking incoming traffic

Answer

Verify that the VPN tunnel is using the correct pre-shared key

Answer

Review Cloud Armor security policies that may be blocking the traffic

Question 8

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

Accepted Answer

Use Private Service Connect to publish the database as a managed service and create a Private Service Connect endpoint in the spoke VPC with IAM permissions for the specific VM service accounts. Private Service Connect (PSC) allows you to publish a managed service (like Cloud SQL) and create a PSC endpoint in the spoke VPC. By combining the PSC endpoint with IAM permissions on the VM service accounts, you ensure that only specific VMs can connect to the database, providing fine-grained, identity-aware access control without exposing the database to the entire network.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and configure IAM permissions for each VM's service account

Answer

Use Shared VPC and assign the specific VMs to a subnet with a dedicated secondary IP range, then restrict database access to that range

Answer

Configure firewall rules in the hub project to allow traffic only from the specific VM internal IPs

Question 9

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

Accepted Answer

Add a new allow rule for that region with a lower priority number than the deny rule. Cloud Armor security rules are evaluated in order of priority, where a lower priority number means higher precedence. To allow traffic from a specific region that is currently blocked by a deny rule, you must add an allow rule with a lower priority number (e.g., 100) than the deny rule (e.g., 1000). This ensures the allow rule is evaluated first, permitting the legitimate traffic before the deny rule can block it, while the deny rule still protects against attacks from other regions.

Answer

Remove the deny rule for that region and rely on other security measures

Answer

Remove all rules and add a single allow rule for the legitimate region

Answer

Reorder the rules so that the deny rule is at the bottom of the list

Question 10

A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)

Accepted Answer

Add the project containing the service account to the VPC Service Controls perimeter. VPC Service Controls use a perimeter to restrict access to managed services like BigQuery. Adding the project containing the service account to the perimeter allows that service account to access the protected BigQuery datasets, as the perimeter explicitly includes the project as an allowed member.

Answer

Create a firewall rule in the client VPC allowing egress to the BigQuery API

Answer

Configure an IAM condition on the service account's roles to restrict access to the perimeter

Answer

Enable Private Google Access on the subnet where the service account's VMs are located