PCNE Implementing network security — 20 Questions

Question 1

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

Accepted Answer

The VM has a custom route that does not use the default route through Cloud NAT. Option D is correct because Cloud NAT relies on the default route (0.0.0.0/0) pointing to the Cloud Router to direct traffic through the NAT gateway. If a VM has a custom route that overrides the default route (e.g., a more specific route to an external IP or a route to a different next hop), the VM's outbound traffic will bypass Cloud NAT entirely, resulting in the source IP being the VM's private IP instead of the Cloud NAT IP. This causes external firewalls to block the traffic as the source IP is not the expected NAT IP.

Answer

The VM is in a different zone than the Cloud NAT gateway

Answer

The VPC firewall rules are blocking outbound traffic from the VM to the Cloud NAT IP

Answer

Cloud Router is misconfigured and not advertising the Cloud NAT IP

Question 2

An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?

Accepted Answer

Enable Private Google Access on the subnet and create a VPC Service Controls perimeter that includes the bucket project. D is correct because VPC Service Controls create a security perimeter around the Cloud Storage bucket's project, preventing data exfiltration even if the bucket is publicly accessible. Private Google Access on the subnet allows VMs to reach Google APIs (including storage.googleapis.com) via internal IPs, avoiding the public internet. Together, they ensure only VMs within the specified VPC network can download objects, as the perimeter restricts access to authorized networks and Private Google Access provides the private connectivity path.

Answer

Enable Cloud NAT and configure a firewall rule to allow egress to 0.0.0.0/0

Answer

Configure a Service Directory endpoint and attach an IAM policy to the bucket allowing access only from that endpoint

Answer

Create a firewall rule allowing egress to the storage.googleapis.com service IP range and enable VPC flow logs

Question 3

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

Accepted Answer

Check VPC firewall rules to ensure ingress traffic from the on-premises subnet is allowed to the VM. Option A is correct because VPC firewall rules are the first line of defense for controlling traffic to GCE VMs. Even though the VPN tunnel is established, the default-deny ingress posture of GCP means that traffic from the on-premises subnet must be explicitly allowed by a VPC firewall rule. Without this rule, packets arriving via the tunnel are dropped before they ever reach the VM's network interface.

Answer

Check the VM's OS firewall to see if it is blocking incoming traffic

Answer

Verify that the VPN tunnel is using the correct pre-shared key

Answer

Review Cloud Armor security policies that may be blocking the traffic

Question 4

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

Accepted Answer

Use Private Service Connect to publish the database as a managed service and create a Private Service Connect endpoint in the spoke VPC with IAM permissions for the specific VM service accounts. Option C is correct because Private Service Connect (PSC) allows you to publish a managed service (like Cloud SQL) and create a PSC endpoint in the spoke VPC. By combining the PSC endpoint with IAM permissions on the VM service accounts, you ensure that only specific VMs can connect to the database, providing fine-grained, identity-aware access control without exposing the database to the entire network.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and configure IAM permissions for each VM's service account

Answer

Use Shared VPC and assign the specific VMs to a subnet with a dedicated secondary IP range, then restrict database access to that range

Answer

Configure firewall rules in the hub project to allow traffic only from the specific VM internal IPs

Question 5

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

Accepted Answer

Add a new allow rule for that region with a lower priority number than the deny rule. Cloud Armor security rules are evaluated in order of priority, where a lower priority number means higher precedence. To allow traffic from a specific region that is currently blocked by a deny rule, you must add an allow rule with a lower priority number (e.g., 100) than the deny rule (e.g., 1000). This ensures the allow rule is evaluated first, permitting the legitimate traffic before the deny rule can block it, while the deny rule still protects against attacks from other regions.

Answer

Remove the deny rule for that region and rely on other security measures

Answer

Remove all rules and add a single allow rule for the legitimate region

Answer

Reorder the rules so that the deny rule is at the bottom of the list

Question 6

A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)

Accepted Answer

Add the project containing the service account to the VPC Service Controls perimeter. Option A is correct because VPC Service Controls use a perimeter to restrict access to managed services like BigQuery. Adding the project containing the service account to the perimeter allows that service account to access the protected BigQuery datasets, as the perimeter explicitly includes the project as an allowed member.

Answer

Create a firewall rule in the client VPC allowing egress to the BigQuery API

Answer

Configure an IAM condition on the service account's roles to restrict access to the perimeter

Answer

Enable Private Google Access on the subnet where the service account's VMs are located

Question 7

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Accepted Answer

Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet. Option A is correct because for Cloud NAT to function, the VM must have a default route (0.0.0.0/0) that points to the Cloud NAT gateway's subnet as the next hop. Without this route, the VM's outbound traffic will not be directed to the NAT gateway, and the NAT IPs will not be used. This ensures that traffic from the VM is routed through the NAT gateway, allowing the specific set of NAT IPs to be applied for auditing.

Answer

Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it

Answer

Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used

Question 8

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

Accepted Answer

The firewall rule allow-ssh is missing a source IP range or has a source IP range that does not include the user's IP. The most likely cause is that the firewall rule 'allow-ssh' is missing a source IP range or has a source IP range that does not include the user's public IP (203.0.113.5). In Google Cloud, firewall rules are stateful and by default deny all ingress traffic unless explicitly allowed; without a source IP range (or with an incorrect one), the SSH traffic from the user's workstation is dropped at the VPC firewall level, preventing access to the VM's external IP (34.67.89.10).

Answer

The firewall rule allow-ssh is for the wrong network

Answer

The firewall rule allow-ssh is disabled

Answer

The VM's external IP (34.67.89.10) is blocked by Cloud NAT

Question 9

Refer to the exhibit. A project has the IAM policy shown. Alice is trying to delete a VPC firewall rule but receives a permission error. What is the most likely reason?

Accepted Answer

Alice has the role roles/compute.securityAdmin, which should allow deletion; perhaps the rule is managed by another service. Alice has the role roles/compute.securityAdmin, which includes the compute.firewalls.delete permission. However, if the VPC firewall rule is managed by another service (e.g., Firewall Rules Manager, Google Cloud Armor, or a managed service like GKE), the rule may have a 'managed' label or be part of a service-managed resource hierarchy that prevents direct deletion via the compute.firewalls.delete API. In such cases, the rule must be deleted through the managing service, not directly via the firewall rules API, leading to a permission error despite having the correct role.

Answer

The IAM policy has a condition that denies deletion after business hours

Answer

An organization policy prevents deletion of firewall rules in this project

Answer

Bob has the role roles/compute.networkAdmin, which does not include permissions to delete firewall rules

Question 10

A company is designing a hub-and-spoke VPC architecture in Google Cloud. The hub VPC hosts a set of shared services, including a third-party firewall appliance (NGFW) in a managed instance group behind a TCP load balancer. Spoke VPCs need to send traffic to the hub's internal TCP load balancer IP (10.0.0.10) for inspection. The firewall appliance inspects traffic and forwards it to the final destination. The network team notices that traffic from one spoke to the load balancer is being dropped. They have verified that VPC peering is established, routes are propagated, and firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Accepted Answer

The spoke VPC's subnet routes are not advertised to the hub VPC via VPC peering.. The most likely cause is that the spoke VPC's subnet routes are not advertised to the hub VPC via VPC peering. For traffic from a spoke to reach the hub's internal TCP load balancer (10.0.0.10), the hub must have a route back to the spoke's source IP range. Without the spoke advertising its subnet routes, the hub's firewall appliance cannot return traffic to the spoke, causing asymmetric routing and dropped packets.

Answer

The spoke VPC does not have a route to the hub's internal load balancer IP via the peering connection.

Answer

The internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target.

Answer

The hub VPC uses Cloud NAT, which is not compatible with VPC peering.

Question 11

A company uses Identity-Aware Proxy (IAP) to secure access to a group of Compute Engine instances running a web application. The instances have no external IP addresses and are accessed via IAP TCP forwarding. Recently, the security team discovered that some users can access the instances directly via SSH from other instances within the same VPC, bypassing IAP. What is the most effective way to ensure all SSH access goes through IAP?

Accepted Answer

Modify the VPC firewall rule to deny ingress traffic on TCP port 22 from all sources except the IAP IP range (35.235.240.0/20).. Option A is correct because the IAP TCP forwarding source IP range (35.235.240.0/20) is the only range that should be allowed to initiate SSH connections to the instances. By modifying the VPC firewall rule to deny all other sources on TCP port 22, you ensure that any SSH traffic not originating from the IAP IP range is blocked, even from other instances within the same VPC. This directly addresses the bypass scenario where users SSH from other internal instances.

Answer

Assign a service account to each instance with the IAP-secured Tunnel User role.

Answer

Remove SSH keys from the instances and use OS Login.

Answer

Create a new firewall rule that allows SSH only from the IAP IP range and delete the existing SSH rule.

Question 12

A company is designing a secure multi-VPC architecture in Google Cloud. They have three VPCs: Production, Staging, and Shared Services. The Shared Services VPC hosts a Cloud NAT for outbound internet access and a set of managed instance groups. The Production and Staging VPCs are peered to the Shared Services VPC. The company wants to ensure that: (1) instances in Staging cannot initiate connections to instances in Production, (2) instances in Production cannot initiate connections to instances in Staging, (3) all VPCs can communicate with Shared Services, and (4) traffic between VPCs must be inspected by a firewall appliance in Shared Services. Which TWO actions should the company take?

Accepted Answer

Configure static routes in each spoke VPC with a next hop to the firewall appliance's internal IP for the destination VPC's subnet ranges.. Option C is correct because configuring static routes in each spoke VPC with a next hop to the firewall appliance's internal IP ensures that traffic between Production and Staging is forced through the firewall in Shared Services for inspection. This satisfies the requirement that all inter-VPC traffic must be inspected, as VPC peering alone does not support transitive routing or traffic inspection.

Answer

Delete the VPC peering connection between the Staging and Production VPCs.

Answer

Set up a Cloud VPN between each spoke VPC and the Shared Services VPC to enable transitive routing.

Answer

Remove the default route (0.0.0.0/0) from the spoke VPCs to prevent direct internet access.

Question 13

A financial services company is deploying a new payment processing application in Google Cloud. The architecture consists of: a VPC named 'payment-vpc' with subnet 'payment-subnet' (10.1.0.0/16), a managed instance group (MIG) of backend servers in payment-subnet, an internal TCP load balancer (ILB) with IP 10.1.0.10 distributing traffic to the MIG, and a Cloud NAT for outbound internet access. The application must communicate with an external payment gateway over TLS. The security policy requires that all outbound traffic from the backend servers to the internet must egress through a single, centralized Cloud NAT instance to allow traffic inspection. To meet this requirement, the network team has configured: a Cloud Router, a Cloud NAT gateway named 'payment-nat' in payment-vpc, and a default route (0.0.0.0/0, next hop: default internet gateway) in payment-vpc. They have also configured VPC firewall rules to allow outbound HTTPS traffic. During testing, the backend servers cannot connect to the external payment gateway. The team has verified that the Cloud NAT is properly configured and that the VPC firewall rules allow egress traffic. What is the most likely cause of the connectivity failure?

Accepted Answer

The default route (0.0.0.0/0) with next hop 'default internet gateway' preempts the Cloud NAT route.. The default route (0.0.0.0/0) with next hop 'default internet gateway' directs all outbound internet traffic directly to the internet gateway, bypassing the Cloud NAT gateway. Cloud NAT only applies when the next hop for 0.0.0.0/0 is the Cloud Router (or when no default route to the internet gateway exists), because NAT is performed on packets that are routed through the Cloud Router. Since the default route with next hop 'default internet gateway' has a higher priority (lower numeric value) than any dynamically learned route, it preempts the Cloud NAT path, causing outbound traffic to egress without NAT and thus fail to reach the external payment gateway if the backend servers have only private IPs.

Answer

The VPC firewall rules are blocking outbound HTTPS traffic from the backend servers.

Answer

The Cloud NAT gateway is not in the same region as the backend servers.

Answer

The Cloud Router's BGP ASN is not properly configured.

Question 14

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

Accepted Answer

Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).. Option A is correct because it uses a service account filter to allow traffic from the cloud-services service account, which is the identity used by Cloud Load Balancing to forward traffic to backend instances. This ensures that only traffic originating from the load balancer (including health check probes) is permitted, while also automatically covering the health check ranges (35.191.0.0/16, 130.211.0.0/22) without needing to hardcode IP ranges. This approach is more secure and scalable than IP-based rules, as it avoids the risk of IP range changes and provides identity-based access control.

Answer

Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.

Answer

Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.

Answer

Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.

Question 15

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

Accepted Answer

Enable Private Google Access on subnets that host instances without external IP addresses.. Option A is correct because Private Google Access allows VM instances that have only internal IP addresses (no external IPs) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through the Google Cloud network. This eliminates the need for an external IP address, reducing the attack surface and supporting a defense-in-depth strategy by keeping traffic within Google's internal infrastructure.

Answer

Configure firewall rules with stateful packet inspection disabled to maximize throughput.

Answer

Use VPC Network Peering to isolate the sensitive workloads from other projects.

Answer

Create a Cloud NAT gateway to filter inbound traffic from the internet.

Question 16

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

Question 17

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Question 18

Match each Google Cloud interconnect or peering type to its description.

Question 19

Match each Cloud DNS record type to its use.

Question 20

A team has deployed Compute Engine instances with internal IPs only. They need to allow these instances to download updates from specific external IP ranges. Which action should they take?

Accepted Answer

Create egress firewall rules with target tags and allowed IP ranges.. Egress firewall rules with target tags allow you to control outbound traffic from Compute Engine instances based on destination IP ranges. By specifying the allowed external IP ranges for updates and applying the rule to instances with a specific tag, you enable secure outbound access without exposing the instances to inbound traffic or requiring public IPs.

Answer

Configure Cloud NAT and allow all traffic.

Answer

Attach a public IP to each instance.

Answer

Use Private Google Access.