PCNE Implementing network security — 40 Questions

Question 1

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Private Service Connect to publish the database as a managed service and create a Private Service Connect endpoint in the spoke VPC with IAM permissions for the specific VM service accounts. Private Service Connect (PSC) allows you to publish a managed service (like Cloud SQL) and create a PSC endpoint in the spoke VPC. By combining the PSC endpoint with IAM permissions on the VM service accounts, you ensure that only specific VMs can connect to the database, providing fine-grained, identity-aware access control without exposing the database to the entire network.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and configure IAM permissions for each VM's service account

Answer

Use Shared VPC and assign the specific VMs to a subnet with a dedicated secondary IP range, then restrict database access to that range

Answer

Configure firewall rules in the hub project to allow traffic only from the specific VM internal IPs

Question 2

A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)

Accepted Answer

Add the project containing the service account to the VPC Service Controls perimeter. VPC Service Controls use a perimeter to restrict access to managed services like BigQuery. Adding the project containing the service account to the perimeter allows that service account to access the protected BigQuery datasets, as the perimeter explicitly includes the project as an allowed member.

Answer

Create a firewall rule in the client VPC allowing egress to the BigQuery API

Answer

Configure an IAM condition on the service account's roles to restrict access to the perimeter

Answer

Enable Private Google Access on the subnet where the service account's VMs are located

Question 3

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Accepted Answer

Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used. To ensure specific VMs use a designated set of NAT IPs for auditing, you must first create a separate Cloud NAT gateway with the desired IPs and associate it with the VMs via subnet or tags (option D). This isolates traffic from those VMs. Next, configure VPC firewall rules to allow egress from the VMs to the internet (option E); otherwise, outbound traffic may be blocked. Finally, enable VPC Flow Logs on the subnet (option C) to capture which NAT IPs are used, providing auditability. Option A is not necessary because the default route's next hop is the internet gateway, not the NAT gateway's subnet, and Cloud NAT does not require a route pointing to its subnet. Option B is misleading: Cloud NAT uses subnet or tag associations, not IAM conditions, to control which VMs use it.

Answer

Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet

Answer

Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it

Question 4

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

Accepted Answer

The firewall rule allow-ssh is missing a source IP range or has a source IP range that does not include the user's IP. The most likely cause is that the firewall rule 'allow-ssh' is missing a source IP range or has a source IP range that does not include the user's public IP (203.0.113.5). In Google Cloud, firewall rules are stateful and by default deny all ingress traffic unless explicitly allowed; without a source IP range (or with an incorrect one), the SSH traffic from the user's workstation is dropped at the VPC firewall level, preventing access to the VM's external IP (34.67.89.10).

Answer

The firewall rule allow-ssh is for the wrong network

Answer

The firewall rule allow-ssh is disabled

Answer

The VM's external IP (34.67.89.10) is blocked by Cloud NAT

Question 5

Refer to the exhibit. A project has the IAM policy shown. Alice is trying to delete a VPC firewall rule but receives a permission error. What is the most likely reason?

Accepted Answer

Alice has the role roles/compute.securityAdmin, which should allow deletion; perhaps the rule is managed by another service. Alice has the role roles/compute.securityAdmin, which includes the compute.firewalls.delete permission. However, if the VPC firewall rule is managed by another service (e.g., Firewall Rules Manager, Google Cloud Armor, or a managed service like GKE), the rule may have a 'managed' label or be part of a service-managed resource hierarchy that prevents direct deletion via the compute.firewalls.delete API. In such cases, the rule must be deleted through the managing service, not directly via the firewall rules API, leading to a permission error despite having the correct role.

Answer

The IAM policy has a condition that denies deletion after business hours

Answer

An organization policy prevents deletion of firewall rules in this project

Answer

Bob has the role roles/compute.networkAdmin, which does not include permissions to delete firewall rules

Question 6

A company is designing a hub-and-spoke VPC architecture in Google Cloud. The hub VPC hosts a set of shared services, including a third-party firewall appliance (NGFW) in a managed instance group behind a TCP load balancer. Spoke VPCs need to send traffic to the hub's internal TCP load balancer IP (10.0.0.10) for inspection. The firewall appliance inspects traffic and forwards it to the final destination. The network team notices that traffic from one spoke to the load balancer is being dropped. They have verified that VPC peering is established, routes are propagated, and firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Accepted Answer

The internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target.. The most likely cause is that the internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target (e.g., an incorrect backend instance group or port). Even though VPC peering, routes, and firewall rules are verified as correctly set up, if the load balancer does not forward traffic to the NGFW appliance, the traffic will be dropped. Misconfiguration of the forwarding rule is a common issue that can occur independently of network layer setup.

Answer

The spoke VPC's subnet routes are not advertised to the hub VPC via VPC peering.

Answer

The spoke VPC does not have a route to the hub's internal load balancer IP via the peering connection.

Answer

The hub VPC uses Cloud NAT, which is not compatible with VPC peering.

Question 7

A company uses Identity-Aware Proxy (IAP) to secure access to a group of Compute Engine instances running a web application. The instances have no external IP addresses and are accessed via IAP TCP forwarding. Recently, the security team discovered that some users can access the instances directly via SSH from other instances within the same VPC, bypassing IAP. What is the most effective way to ensure all SSH access goes through IAP?

Accepted Answer

Modify the VPC firewall rule to deny ingress traffic on TCP port 22 from all sources except the IAP IP range (35.235.240.0/20).. The IAP TCP forwarding source IP range (35.235.240.0/20) is the only range that should be allowed to initiate SSH connections to the instances. By modifying the VPC firewall rule to deny all other sources on TCP port 22, you ensure that any SSH traffic not originating from the IAP IP range is blocked, even from other instances within the same VPC. This directly addresses the bypass scenario where users SSH from other internal instances.

Answer

Assign a service account to each instance with the IAP-secured Tunnel User role.

Answer

Remove SSH keys from the instances and use OS Login.

Answer

Create a new firewall rule that allows SSH only from the IAP IP range and delete the existing SSH rule.

Question 8

A company is designing a secure multi-VPC architecture in Google Cloud. They have three VPCs: Production, Staging, and Shared Services. The Shared Services VPC hosts a Cloud NAT for outbound internet access and a set of managed instance groups. The Production and Staging VPCs are peered to the Shared Services VPC. The company wants to ensure that: (1) instances in Staging cannot initiate connections to instances in Production, (2) instances in Production cannot initiate connections to instances in Staging, (3) all VPCs can communicate with Shared Services, and (4) traffic between VPCs must be inspected by a firewall appliance in Shared Services. Which TWO actions should the company take?

Accepted Answer

Set up a Cloud VPN between each spoke VPC and the Shared Services VPC to enable transitive routing.. To achieve transitive routing between the spoke VPCs through the hub Shared Services VPC, Cloud VPN is required because VPC peering is non-transitive. Option B correctly establishes VPN connections between each spoke and the hub to enable transit. Option C is incorrect because a static route in a spoke VPC cannot use the firewall appliance's internal IP (which is in the hub VPC) as a next hop; the next hop must be a resource in the same VPC, such as a VPN tunnel. Therefore, the only correct action from the given options is B. (Note: The question asks for two actions, but only one option is technically valid; this may indicate an issue with the question design.)

Answer

Delete the VPC peering connection between the Staging and Production VPCs.

Answer

Configure static routes in each spoke VPC with a next hop to the firewall appliance's internal IP for the destination VPC's subnet ranges.

Answer

Remove the default route (0.0.0.0/0) from the spoke VPCs to prevent direct internet access.

Answer

Enable the export of custom routes from the Shared Services VPC to the peered VPCs.

Question 9

A financial services company is deploying a new payment processing application in Google Cloud. The architecture consists of: a VPC named 'payment-vpc' with subnet 'payment-subnet' (10.1.0.0/16), a managed instance group (MIG) of backend servers in payment-subnet, an internal TCP load balancer (ILB) with IP 10.1.0.10 distributing traffic to the MIG, and a Cloud NAT for outbound internet access. The application must communicate with an external payment gateway over TLS. The security policy requires that all outbound traffic from the backend servers to the internet must egress through a single, centralized Cloud NAT instance to allow traffic inspection. To meet this requirement, the network team has configured: a Cloud Router, a Cloud NAT gateway named 'payment-nat' in payment-vpc, and a default route (0.0.0.0/0, next hop: default internet gateway) in payment-vpc. They have also configured VPC firewall rules to allow outbound HTTPS traffic. During testing, the backend servers cannot connect to the external payment gateway. The team has verified that the Cloud NAT is properly configured and that the VPC firewall rules allow egress traffic. What is the most likely cause of the connectivity failure?

Accepted Answer

The default route (0.0.0.0/0) with next hop 'default internet gateway' preempts the Cloud NAT route.. The default route (0.0.0.0/0) with next hop 'default internet gateway' directs all outbound internet traffic directly to the internet gateway, bypassing the Cloud NAT gateway. Cloud NAT only applies when the next hop for 0.0.0.0/0 is the Cloud Router (or when no default route to the internet gateway exists), because NAT is performed on packets that are routed through the Cloud Router. Since the default route with next hop 'default internet gateway' has a higher priority (lower numeric value) than any dynamically learned route, it preempts the Cloud NAT path, causing outbound traffic to egress without NAT and thus fail to reach the external payment gateway if the backend servers have only private IPs.

Answer

The VPC firewall rules are blocking outbound HTTPS traffic from the backend servers.

Answer

The Cloud NAT gateway is not in the same region as the backend servers.

Answer

The Cloud Router's BGP ASN is not properly configured.

Question 10

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

Accepted Answer

Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).. It uses a service account filter to allow traffic from the cloud-services service account, which is the identity used by Cloud Load Balancing to forward traffic to backend instances. This ensures that only traffic originating from the load balancer (including health check probes) is permitted, while also automatically covering the health check ranges (35.191.0.0/16, 130.211.0.0/22) without needing to hardcode IP ranges. This approach is more secure and scalable than IP-based rules, as it avoids the risk of IP range changes and provides identity-based access control.

Answer

Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.

Answer

Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.

Answer

Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.

Question 11

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

Accepted Answer

Create host project and enable Shared VPC, attach service projects to host project, grant IAM permissions to service project admins, service project admins create resources using shared subnets.. Shared VPC requires a host project with VPC, then granting access to service projects. Service projects then use the shared subnets.

Answer

Grant IAM permissions to service project admins, create host project and enable Shared VPC, attach service projects to host project, service project admins create resources.

Answer

Attach service projects to host project, create host project and enable Shared VPC, grant IAM permissions, service project admins create resources.

Answer

Create service projects first, then create host project and enable Shared VPC, attach service projects, grant IAM permissions.

Question 12

A team has deployed Compute Engine instances with internal IPs only. They need to allow these instances to download updates from specific external IP ranges. Which action should they take?

Accepted Answer

Create egress firewall rules with target tags and allowed IP ranges.. Egress firewall rules with target tags allow you to control outbound traffic from Compute Engine instances based on destination IP ranges. By specifying the allowed external IP ranges for updates and applying the rule to instances with a specific tag, you enable secure outbound access without exposing the instances to inbound traffic or requiring public IPs.

Answer

Configure Cloud NAT and allow all traffic.

Answer

Attach a public IP to each instance.

Answer

Use Private Google Access.

Question 13

An organization has a Shared VPC with several service projects. They want to restrict which service projects can create firewall rules in the host project. What should they do?

Accepted Answer

Use IAM roles with compute.firewalls.create permission at the host project level.. IAM roles with the `compute.firewalls.create` permission at the host project level allow you to precisely control which service projects can create firewall rules in the Shared VPC host project. By assigning a custom or predefined role (e.g., Compute Security Admin) that includes this permission to specific service project identities, you can restrict firewall rule creation to only authorized service projects while preventing others from doing so.

Answer

Use VPC Service Controls.

Answer

Use hierarchical firewall policies.

Answer

Use organization policies to deny firewall rule creation.

Question 14

A company is deploying a GKE cluster with Dataplane V2 and wants to enforce micro-segmentation using network policies. They also need to monitor policy violations. What should they do?

Accepted Answer

Enable GKE Dataplane V2 and use Kubernetes Network Policies with audit logging.. Dataplane V2 uses eBPF to implement Kubernetes Network Policies directly in the kernel, providing native support for micro-segmentation. Enabling audit logging on the cluster captures denied or allowed policy actions, allowing the company to monitor policy violations without additional infrastructure.

Answer

Enable Packet Mirroring.

Answer

Use Cloud IDS to monitor traffic.

Answer

Use VPC firewall rules with pod IP ranges.

Question 15

Which TWO of the following are benefits of using Cloud NAT?

Accepted Answer

Enables instances without public IPs to access the internet.. Option A is correct because Cloud NAT provides outbound (egress) connectivity to the internet for Compute Engine instances and GKE nodes that have no external IP address, performing source NAT to translate their internal addresses to the NAT gateway's external address. Option B is correct because Cloud NAT is a fully managed, software-defined service that automatically scales its NAT allocation to handle the traffic of however many instances are using it, without requiring you to provision or resize NAT capacity. Option C is incorrect because Cloud NAT is outbound-only; it does not allow unsolicited inbound connections from the internet, which would require an external IP or a load balancer. Option D is incorrect because Cloud NAT does not provide a static external IP for outbound traffic by default; it uses ephemeral external IPs unless you explicitly reserve and assign static IP addresses to the NAT gateway. Option E is incorrect because Identity-Aware Proxy (IAP) is a separate service for securing access to applications and VMs via identity, and it is not integrated with or provided by Cloud NAT.

Answer

Allows instances to receive incoming connections from the internet.

Answer

Provides static external IP for outbound traffic.

Answer

Integrates with IAP for SSH access.

Question 16

Which THREE of the following are valid use cases for VPC Service Controls?

Accepted Answer

Controlling access to a Cloud SQL database from a specific VPC.. VPC Service Controls creates a service perimeter that defines a security boundary around Google Cloud resources and APIs, and its core purpose is mitigating data exfiltration. Option A is correct because a perimeter can restrict which VPC networks (and thus which projects/resources) are allowed to reach a Cloud SQL instance's API, effectively controlling access to that database from a specific VPC. Option B is correct because preventing data exfiltration from Cloud Storage is the canonical use case: a perimeter blocks copying data out of a protected project to unauthorized projects or the public internet. Option E is correct because BigQuery is a supported, protected service, and placing it inside a perimeter restricts access to it from outside the perimeter (including from unauthorized projects or the internet). Option C is not a VPC Service Controls use case; exposing a managed instance group to the internet is handled by external load balancing, firewall rules, and public IPs, not by service perimeters. Option D is not a VPC Service Controls use case either; private access to Google Cloud APIs from on-premises is achieved with Cloud VPN/Interconnect plus Private Google Access or Private Service Connect, not with service perimeters.

Answer

Allowing access to a managed instance group from the internet.

Answer

Enabling private access to Cloud APIs from on-premises.

Question 17

Refer to the exhibit. A Cloud Armor security policy with the shown rules is applied to an HTTPS load balancer. Users from IP 10.0.1.1 are reporting they cannot access the website. What is the issue?

Accepted Answer

The deny rule has higher priority and blocks traffic from 10.0.0.0/8.. Cloud Armor security policies evaluate rules in priority order, with lower numbers having higher priority. The deny rule at priority 1000 matches the source IP range 10.0.0.0/8, which includes the user's IP 10.0.1.1, and is evaluated before the allow rule at priority 2000. Since the deny rule is matched first, the request is blocked, preventing access to the HTTPS load balancer.

Answer

The load balancer is not configured to use the security policy.

Answer

The allow rule with priority 2000 does not apply because the deny rule is evaluated first.

Answer

The IP range in the deny rule is too broad.

Question 18

A company wants to restrict SSH access to a VM instance to only a specific subnet (10.0.1.0/24) and allow all traffic from the health check ranges (130.211.0.0/22 and 35.191.0.0/16) for load balancing. Which firewall rule configuration should be used for the SSH rule?

Accepted Answer

Create a rule with source ranges 10.0.1.0/24, 130.211.0.0/22, 35.191.0.0/16, protocol tcp:22, and target tag 'ssh-allowed'.. A single firewall rule can include multiple source ranges (10.0.1.0/24, 130.211.0.0/22, 35.191.0.0/16) and apply to a target tag (ssh-allowed), allowing SSH from both the specific subnet and health check ranges. Option A is wrong because allowing SSH from 0.0.0.0/0 is too permissive. Option B is wrong because separate rules for the subnet and health check ranges would work but are not the most efficient configuration; the question asks which should be used, and a single rule is preferred. Option D is wrong because it only allows health check ranges, not the subnet.

Answer

Create a rule allowing SSH from 0.0.0.0/0 and apply a tag to the VM.

Answer

Create a rule allowing SSH from 10.0.1.0/24 and another rule allowing SSH from health check ranges.

Answer

Create a rule allowing SSH only from health check ranges and deny all other traffic.

Question 19

A company uses VPC Service Controls to protect a managed service (e.g., BigQuery) within a service perimeter. Developers need to access the service from an on-premises network via a Cloud VPN tunnel with a specific IP address. However, access is being denied. What is the most likely cause?

Accepted Answer

The on-premises source IP is not included in the allowed external IP addresses list in the perimeter.. VPC Service Controls enforce access to managed services like BigQuery by restricting which source IPs can reach the service. When accessing from on-premises via Cloud VPN, the source IP seen by the service is the on-premises client's IP, not the VPN gateway's IP. If that on-premises source IP is not explicitly added to the allowed external IP addresses list in the service perimeter, access is denied, even though the VPN tunnel is established.

Answer

The project containing the VPN tunnel is not in the same perimeter.

Answer

The VM instances in the perimeter do not have public IP addresses.

Answer

The Cloud VPN tunnel is not using IKEv2.

Question 20

A company has a hybrid network with on-premises data center connected to Google Cloud via Dedicated Interconnect. They use Private Google Access for on-premises (on-premises hosts use the external IP addresses of Google APIs via the interconnect). However, they notice that traffic to certain Google APIs is being routed via the internet instead of the interconnect. What is a likely cause?

Accepted Answer

On-premises DNS is not configured to resolve Google API hostnames to the Private Google Access IP address range (199.36.153.4/30).. Private Google Access for on-premises requires on-premises DNS to resolve Google API hostnames to the specific IP range 199.36.153.4/30. If DNS resolution returns the public IP addresses instead, traffic will be routed over the internet rather than through the Dedicated Interconnect, even though the interconnect is available. This is because the on-premises hosts will use the public IPs and follow their default route to the internet.

Answer

Firewall rules in the VPC are blocking the private API traffic.

Answer

Cloud NAT is not configured for the on-premises subnet.

Answer

VPC Flow Logs are not enabled, causing routing misconfiguration.