PCNE Implementing network security — 20 Questions

Question 1

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used. To ensure specific VMs use a designated set of NAT IPs for auditing, you must first create a separate Cloud NAT gateway with the desired IPs and associate it with the VMs via subnet or tags (option D). This isolates traffic from those VMs. Next, configure VPC firewall rules to allow egress from the VMs to the internet (option E); otherwise, outbound traffic may be blocked. Finally, enable VPC Flow Logs on the subnet (option C) to capture which NAT IPs are used, providing auditability. Option A is not necessary because the default route's next hop is the internet gateway, not the NAT gateway's subnet, and Cloud NAT does not require a route pointing to its subnet. Option B is misleading: Cloud NAT uses subnet or tag associations, not IAM conditions, to control which VMs use it.

Answer

Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet

Answer

Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it

Question 2

An organization uses VPC Service Controls to protect Google Cloud APIs. They need to allow a specific service account in a peripheral project to access a managed service in a protected service perimeter. What should they configure?

Accepted Answer

Ingress and egress rules in the perimeter.. VPC Service Controls uses ingress and egress rules to control data exchange between a protected service perimeter and resources outside it. To allow a specific service account in a peripheral project to access a managed service inside the perimeter, you configure an ingress rule that permits traffic from that service account to the protected service. Ingress rules define which identities and sources from outside the perimeter are allowed to access protected services. Egress rules would be used for the opposite direction (from inside to outside).

Answer

IAM conditions on the service account.

Answer

Access levels in VPC Service Controls.

Answer

Private Google Access.

Question 3

Which TWO of the following are benefits of using Cloud NAT?

Accepted Answer

Enables instances without public IPs to access the internet.. Cloud NAT provides two key benefits: it enables instances without public IPs to access the internet for outbound connections, and it automatically scales with the number of instances in a region without requiring manual provisioning or resizing. These features make it a managed and scalable solution for outbound internet access.

Answer

Allows instances to receive incoming connections from the internet.

Answer

Provides static external IP for outbound traffic.

Answer

Integrates with IAP for SSH access.

Question 4

A company wants to restrict SSH access to a VM instance to only a specific subnet (10.0.1.0/24) and allow all traffic from the health check ranges (130.211.0.0/22 and 35.191.0.0/16) for load balancing. Which firewall rule configuration should be used for the SSH rule?

Accepted Answer

Create a rule with source ranges 10.0.1.0/24, 130.211.0.0/22, 35.191.0.0/16, protocol tcp:22, and target tag 'ssh-allowed'.. A single firewall rule can include multiple source ranges (10.0.1.0/24, 130.211.0.0/22, 35.191.0.0/16) and apply to a target tag (ssh-allowed), allowing SSH from both the specific subnet and health check ranges. Option A is wrong because allowing SSH from 0.0.0.0/0 is too permissive. Option B is wrong because separate rules for the subnet and health check ranges would work but are not the most efficient configuration; the question asks which should be used, and a single rule is preferred. Option D is wrong because it only allows health check ranges, not the subnet.

Answer

Create a rule allowing SSH from 0.0.0.0/0 and apply a tag to the VM.

Answer

Create a rule allowing SSH from 10.0.1.0/24 and another rule allowing SSH from health check ranges.

Answer

Create a rule allowing SSH only from health check ranges and deny all other traffic.

Question 5

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

Accepted Answer

The VM has a custom route that does not use the default route through Cloud NAT. Cloud NAT relies on the default route (0.0.0.0/0) pointing to the Cloud Router to direct traffic through the NAT gateway. If a VM has a custom route that overrides the default route (e.g., a more specific route to an external IP or a route to a different next hop), the VM's outbound traffic will bypass Cloud NAT entirely, resulting in the source IP being the VM's private IP instead of the Cloud NAT IP. This causes external firewalls to block the traffic as the source IP is not the expected NAT IP.

Answer

The VM is in a different zone than the Cloud NAT gateway

Answer

The VPC firewall rules are blocking outbound traffic from the VM to the Cloud NAT IP

Answer

Cloud Router is misconfigured and not advertising the Cloud NAT IP

Question 6

An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?

Accepted Answer

Enable Private Google Access on the subnet and create a VPC Service Controls perimeter that includes the bucket project. D is correct because VPC Service Controls create a security perimeter around the Cloud Storage bucket's project, preventing data exfiltration even if the bucket is publicly accessible. Private Google Access on the subnet allows VMs to reach Google APIs (including storage.googleapis.com) via internal IPs, avoiding the public internet. Together, they ensure only VMs within the specified VPC network can download objects, as the perimeter restricts access to authorized networks and Private Google Access provides the private connectivity path.

Answer

Enable Cloud NAT and configure a firewall rule to allow egress to 0.0.0.0/0

Answer

Configure a Service Directory endpoint and attach an IAM policy to the bucket allowing access only from that endpoint

Answer

Create a firewall rule allowing egress to the storage.googleapis.com service IP range and enable VPC flow logs

Question 7

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

Accepted Answer

Check VPC firewall rules to ensure ingress traffic from the on-premises subnet is allowed to the VM. VPC firewall rules are the first line of defense for controlling traffic to GCE VMs. Even though the VPN tunnel is established, the default-deny ingress posture of GCP means that traffic from the on-premises subnet must be explicitly allowed by a VPC firewall rule. Without this rule, packets arriving via the tunnel are dropped before they ever reach the VM's network interface.

Answer

Check the VM's OS firewall to see if it is blocking incoming traffic

Answer

Verify that the VPN tunnel is using the correct pre-shared key

Answer

Review Cloud Armor security policies that may be blocking the traffic

Question 8

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

Accepted Answer

Use Private Service Connect to publish the database as a managed service and create a Private Service Connect endpoint in the spoke VPC with IAM permissions for the specific VM service accounts. Private Service Connect (PSC) allows you to publish a managed service (like Cloud SQL) and create a PSC endpoint in the spoke VPC. By combining the PSC endpoint with IAM permissions on the VM service accounts, you ensure that only specific VMs can connect to the database, providing fine-grained, identity-aware access control without exposing the database to the entire network.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and configure IAM permissions for each VM's service account

Answer

Use Shared VPC and assign the specific VMs to a subnet with a dedicated secondary IP range, then restrict database access to that range

Answer

Configure firewall rules in the hub project to allow traffic only from the specific VM internal IPs

Question 9

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

Accepted Answer

Add a new allow rule for that region with a lower priority number than the deny rule. Cloud Armor security rules are evaluated in order of priority, where a lower priority number means higher precedence. To allow traffic from a specific region that is currently blocked by a deny rule, you must add an allow rule with a lower priority number (e.g., 100) than the deny rule (e.g., 1000). This ensures the allow rule is evaluated first, permitting the legitimate traffic before the deny rule can block it, while the deny rule still protects against attacks from other regions.

Answer

Remove the deny rule for that region and rely on other security measures

Answer

Remove all rules and add a single allow rule for the legitimate region

Answer

Reorder the rules so that the deny rule is at the bottom of the list

Question 10

A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)

Accepted Answer

Add the project containing the service account to the VPC Service Controls perimeter. VPC Service Controls use a perimeter to restrict access to managed services like BigQuery. Adding the project containing the service account to the perimeter allows that service account to access the protected BigQuery datasets, as the perimeter explicitly includes the project as an allowed member.

Answer

Create a firewall rule in the client VPC allowing egress to the BigQuery API

Answer

Configure an IAM condition on the service account's roles to restrict access to the perimeter

Answer

Enable Private Google Access on the subnet where the service account's VMs are located

Question 11

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

Accepted Answer

The firewall rule allow-ssh is missing a source IP range or has a source IP range that does not include the user's IP. The most likely cause is that the firewall rule 'allow-ssh' is missing a source IP range or has a source IP range that does not include the user's public IP (203.0.113.5). In Google Cloud, firewall rules are stateful and by default deny all ingress traffic unless explicitly allowed; without a source IP range (or with an incorrect one), the SSH traffic from the user's workstation is dropped at the VPC firewall level, preventing access to the VM's external IP (34.67.89.10).

Answer

The firewall rule allow-ssh is for the wrong network

Answer

The firewall rule allow-ssh is disabled

Answer

The VM's external IP (34.67.89.10) is blocked by Cloud NAT

Question 12

Refer to the exhibit. A project has the IAM policy shown. Alice is trying to delete a VPC firewall rule but receives a permission error. What is the most likely reason?

Accepted Answer

Alice has the role roles/compute.securityAdmin, which should allow deletion; perhaps the rule is managed by another service. Alice has the role roles/compute.securityAdmin, which includes the compute.firewalls.delete permission. However, if the VPC firewall rule is managed by another service (e.g., Firewall Rules Manager, Google Cloud Armor, or a managed service like GKE), the rule may have a 'managed' label or be part of a service-managed resource hierarchy that prevents direct deletion via the compute.firewalls.delete API. In such cases, the rule must be deleted through the managing service, not directly via the firewall rules API, leading to a permission error despite having the correct role.

Answer

The IAM policy has a condition that denies deletion after business hours

Answer

An organization policy prevents deletion of firewall rules in this project

Answer

Bob has the role roles/compute.networkAdmin, which does not include permissions to delete firewall rules

Question 13

A company is designing a hub-and-spoke VPC architecture in Google Cloud. The hub VPC hosts a set of shared services, including a third-party firewall appliance (NGFW) in a managed instance group behind a TCP load balancer. Spoke VPCs need to send traffic to the hub's internal TCP load balancer IP (10.0.0.10) for inspection. The firewall appliance inspects traffic and forwards it to the final destination. The network team notices that traffic from one spoke to the load balancer is being dropped. They have verified that VPC peering is established, routes are propagated, and firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Accepted Answer

The internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target.. The most likely cause is that the internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target (e.g., an incorrect backend instance group or port). Even though VPC peering, routes, and firewall rules are verified as correctly set up, if the load balancer does not forward traffic to the NGFW appliance, the traffic will be dropped. Misconfiguration of the forwarding rule is a common issue that can occur independently of network layer setup.

Answer

The spoke VPC's subnet routes are not advertised to the hub VPC via VPC peering.

Answer

The spoke VPC does not have a route to the hub's internal load balancer IP via the peering connection.

Answer

The hub VPC uses Cloud NAT, which is not compatible with VPC peering.

Question 14

A company uses Identity-Aware Proxy (IAP) to secure access to a group of Compute Engine instances running a web application. The instances have no external IP addresses and are accessed via IAP TCP forwarding. Recently, the security team discovered that some users can access the instances directly via SSH from other instances within the same VPC, bypassing IAP. What is the most effective way to ensure all SSH access goes through IAP?

Accepted Answer

Modify the VPC firewall rule to deny ingress traffic on TCP port 22 from all sources except the IAP IP range (35.235.240.0/20).. The IAP TCP forwarding source IP range (35.235.240.0/20) is the only range that should be allowed to initiate SSH connections to the instances. By modifying the VPC firewall rule to deny all other sources on TCP port 22, you ensure that any SSH traffic not originating from the IAP IP range is blocked, even from other instances within the same VPC. This directly addresses the bypass scenario where users SSH from other internal instances.

Answer

Assign a service account to each instance with the IAP-secured Tunnel User role.

Answer

Remove SSH keys from the instances and use OS Login.

Answer

Create a new firewall rule that allows SSH only from the IAP IP range and delete the existing SSH rule.

Question 15

A company is designing a secure multi-VPC architecture in Google Cloud. They have three VPCs: Production, Staging, and Shared Services. The Shared Services VPC hosts a Cloud NAT for outbound internet access and a set of managed instance groups. The Production and Staging VPCs are peered to the Shared Services VPC. The company wants to ensure that: (1) instances in Staging cannot initiate connections to instances in Production, (2) instances in Production cannot initiate connections to instances in Staging, (3) all VPCs can communicate with Shared Services, and (4) traffic between VPCs must be inspected by a firewall appliance in Shared Services. Which TWO actions should the company take?

Accepted Answer

Set up a Cloud VPN between each spoke VPC and the Shared Services VPC to enable transitive routing.. To achieve transitive routing between the spoke VPCs through the hub Shared Services VPC, Cloud VPN is required because VPC peering is non-transitive. Option B correctly establishes VPN connections between each spoke and the hub to enable transit. Option C is incorrect because a static route in a spoke VPC cannot use the firewall appliance's internal IP (which is in the hub VPC) as a next hop; the next hop must be a resource in the same VPC, such as a VPN tunnel. Therefore, the only correct action from the given options is B. (Note: The question asks for two actions, but only one option is technically valid; this may indicate an issue with the question design.)

Answer

Delete the VPC peering connection between the Staging and Production VPCs.

Answer

Configure static routes in each spoke VPC with a next hop to the firewall appliance's internal IP for the destination VPC's subnet ranges.

Answer

Remove the default route (0.0.0.0/0) from the spoke VPCs to prevent direct internet access.

Answer

Enable the export of custom routes from the Shared Services VPC to the peered VPCs.

Question 16

A financial services company is deploying a new payment processing application in Google Cloud. The architecture consists of: a VPC named 'payment-vpc' with subnet 'payment-subnet' (10.1.0.0/16), a managed instance group (MIG) of backend servers in payment-subnet, an internal TCP load balancer (ILB) with IP 10.1.0.10 distributing traffic to the MIG, and a Cloud NAT for outbound internet access. The application must communicate with an external payment gateway over TLS. The security policy requires that all outbound traffic from the backend servers to the internet must egress through a single, centralized Cloud NAT instance to allow traffic inspection. To meet this requirement, the network team has configured: a Cloud Router, a Cloud NAT gateway named 'payment-nat' in payment-vpc, and a default route (0.0.0.0/0, next hop: default internet gateway) in payment-vpc. They have also configured VPC firewall rules to allow outbound HTTPS traffic. During testing, the backend servers cannot connect to the external payment gateway. The team has verified that the Cloud NAT is properly configured and that the VPC firewall rules allow egress traffic. What is the most likely cause of the connectivity failure?

Accepted Answer

The default route (0.0.0.0/0) with next hop 'default internet gateway' preempts the Cloud NAT route.. The default route (0.0.0.0/0) with next hop 'default internet gateway' directs all outbound internet traffic directly to the internet gateway, bypassing the Cloud NAT gateway. Cloud NAT only applies when the next hop for 0.0.0.0/0 is the Cloud Router (or when no default route to the internet gateway exists), because NAT is performed on packets that are routed through the Cloud Router. Since the default route with next hop 'default internet gateway' has a higher priority (lower numeric value) than any dynamically learned route, it preempts the Cloud NAT path, causing outbound traffic to egress without NAT and thus fail to reach the external payment gateway if the backend servers have only private IPs.

Answer

The VPC firewall rules are blocking outbound HTTPS traffic from the backend servers.

Answer

The Cloud NAT gateway is not in the same region as the backend servers.

Answer

The Cloud Router's BGP ASN is not properly configured.

Question 17

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

Accepted Answer

Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).. It uses a service account filter to allow traffic from the cloud-services service account, which is the identity used by Cloud Load Balancing to forward traffic to backend instances. This ensures that only traffic originating from the load balancer (including health check probes) is permitted, while also automatically covering the health check ranges (35.191.0.0/16, 130.211.0.0/22) without needing to hardcode IP ranges. This approach is more secure and scalable than IP-based rules, as it avoids the risk of IP range changes and provides identity-based access control.

Answer

Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.

Answer

Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.

Answer

Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.

Question 18

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

Accepted Answer

Enable Private Google Access on subnets that host instances without external IP addresses.. Private Google Access allows VM instances that have only internal IP addresses (no external IPs) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through the Google Cloud network. This eliminates the need for an external IP address, reducing the attack surface and supporting a defense-in-depth strategy by keeping traffic within Google's internal infrastructure.

Answer

Configure firewall rules with stateful packet inspection disabled to maximize throughput.

Answer

Use VPC Network Peering to isolate the sensitive workloads from other projects.

Answer

Create a Cloud NAT gateway to filter inbound traffic from the internet.

Question 19

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

Accepted Answer

Create host project and enable Shared VPC, attach service projects to host project, grant IAM permissions to service project admins, service project admins create resources using shared subnets.. Shared VPC requires a host project with VPC, then granting access to service projects. Service projects then use the shared subnets.

Answer

Grant IAM permissions to service project admins, create host project and enable Shared VPC, attach service projects to host project, service project admins create resources.

Answer

Attach service projects to host project, create host project and enable Shared VPC, grant IAM permissions, service project admins create resources.

Answer

Create service projects first, then create host project and enable Shared VPC, attach service projects, grant IAM permissions.

Question 20

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Accepted Answer

Create a new VPC in Google Cloud, then establish a VPN connection between on-premises and the new VPC, then configure BGP for dynamic routing, then set up VPC peering (if needed), and finally migrate workloads to the new VPC.. In a typical migration using VPN and VPC peering, you first create a VPC in Google Cloud as the target environment. Then, you set up a VPN connection between the on-premises network and this new VPC. After establishing VPN connectivity, configure BGP for dynamic routing to exchange routes. If needed, set up VPC peering to connect the new VPC to other VPCs in Google Cloud. Finally, migrate workloads from on-premises to the new VPC. The given common mistake sequence (VPN, BGP, new VPC) is incorrect because a VPC must exist before VPN can be created.

Answer

Establish a VPN connection first, then configure BGP, then create a new VPC, then set up VPC peering, then migrate workloads.

Answer

Configure BGP first, then create a new VPC, then establish VPN, then set up VPC peering, then migrate workloads.

Answer

Create a new VPC, then set up VPC peering, then establish VPN, then configure BGP, then migrate workloads.