PCNE Implementing network security Practice Test 2 — 15 Questions

Question 1

A financial services company is deploying a new payment processing application in Google Cloud. The architecture consists of: a VPC named 'payment-vpc' with subnet 'payment-subnet' (10.1.0.0/16), a managed instance group (MIG) of backend servers in payment-subnet, an internal TCP load balancer (ILB) with IP 10.1.0.10 distributing traffic to the MIG, and a Cloud NAT for outbound internet access. The application must communicate with an external payment gateway over TLS. The security policy requires that all outbound traffic from the backend servers to the internet must egress through a single, centralized Cloud NAT instance to allow traffic inspection. To meet this requirement, the network team has configured: a Cloud Router, a Cloud NAT gateway named 'payment-nat' in payment-vpc, and a default route (0.0.0.0/0, next hop: default internet gateway) in payment-vpc. They have also configured VPC firewall rules to allow outbound HTTPS traffic. During testing, the backend servers cannot connect to the external payment gateway. The team has verified that the Cloud NAT is properly configured and that the VPC firewall rules allow egress traffic. What is the most likely cause of the connectivity failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The default route (0.0.0.0/0) with next hop 'default internet gateway' preempts the Cloud NAT route.. The default route (0.0.0.0/0) with next hop 'default internet gateway' directs all outbound internet traffic directly to the internet gateway, bypassing the Cloud NAT gateway. Cloud NAT only applies when the next hop for 0.0.0.0/0 is the Cloud Router (or when no default route to the internet gateway exists), because NAT is performed on packets that are routed through the Cloud Router. Since the default route with next hop 'default internet gateway' has a higher priority (lower numeric value) than any dynamically learned route, it preempts the Cloud NAT path, causing outbound traffic to egress without NAT and thus fail to reach the external payment gateway if the backend servers have only private IPs.

Answer

The VPC firewall rules are blocking outbound HTTPS traffic from the backend servers.

Answer

The Cloud NAT gateway is not in the same region as the backend servers.

Answer

The Cloud Router's BGP ASN is not properly configured.

Question 2

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

Accepted Answer

Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).. It uses a service account filter to allow traffic from the cloud-services service account, which is the identity used by Cloud Load Balancing to forward traffic to backend instances. This ensures that only traffic originating from the load balancer (including health check probes) is permitted, while also automatically covering the health check ranges (35.191.0.0/16, 130.211.0.0/22) without needing to hardcode IP ranges. This approach is more secure and scalable than IP-based rules, as it avoids the risk of IP range changes and provides identity-based access control.

Answer

Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.

Answer

Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.

Answer

Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.

Question 3

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

Accepted Answer

Enable Private Google Access on subnets that host instances without external IP addresses.. Private Google Access allows VM instances that have only internal IP addresses (no external IPs) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through the Google Cloud network. This eliminates the need for an external IP address, reducing the attack surface and supporting a defense-in-depth strategy by keeping traffic within Google's internal infrastructure.

Answer

Configure firewall rules with stateful packet inspection disabled to maximize throughput.

Answer

Use VPC Network Peering to isolate the sensitive workloads from other projects.

Answer

Create a Cloud NAT gateway to filter inbound traffic from the internet.

Question 4

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

Accepted Answer

Create host project and enable Shared VPC, attach service projects to host project, grant IAM permissions to service project admins, service project admins create resources using shared subnets.. Shared VPC requires a host project with VPC, then granting access to service projects. Service projects then use the shared subnets.

Answer

Grant IAM permissions to service project admins, create host project and enable Shared VPC, attach service projects to host project, service project admins create resources.

Answer

Attach service projects to host project, create host project and enable Shared VPC, grant IAM permissions, service project admins create resources.

Answer

Create service projects first, then create host project and enable Shared VPC, attach service projects, grant IAM permissions.

Question 5

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Accepted Answer

Create a new VPC in Google Cloud, then establish a VPN connection between on-premises and the new VPC, then configure BGP for dynamic routing, then set up VPC peering (if needed), and finally migrate workloads to the new VPC.. In a typical migration using VPN and VPC peering, you first create a VPC in Google Cloud as the target environment. Then, you set up a VPN connection between the on-premises network and this new VPC. After establishing VPN connectivity, configure BGP for dynamic routing to exchange routes. If needed, set up VPC peering to connect the new VPC to other VPCs in Google Cloud. Finally, migrate workloads from on-premises to the new VPC. The given common mistake sequence (VPN, BGP, new VPC) is incorrect because a VPC must exist before VPN can be created.

Answer

Establish a VPN connection first, then configure BGP, then create a new VPC, then set up VPC peering, then migrate workloads.

Answer

Configure BGP first, then create a new VPC, then establish VPN, then set up VPC peering, then migrate workloads.

Answer

Create a new VPC, then set up VPC peering, then establish VPN, then configure BGP, then migrate workloads.

Question 6

Match each Google Cloud interconnect or peering type to its description.

Accepted Answer

Dedicated Interconnect: Direct physical connection between your on-premises network and Google's network, providing high bandwidth and a SLA.. Dedicated Interconnect offers a direct physical link with SLA. Partner Interconnect uses a service provider. Direct Peering is a direct BGP session, while Carrier Peering uses a carrier partner. Common confusion occurs between Dedicated and Partner Interconnect.

Answer

Dedicated Interconnect: Connectivity through a service provider with flexible bandwidth and no SLA.

Answer

Partner Interconnect: Direct physical connection between on-premises and Google with high bandwidth and SLA.

Question 7

Match each Cloud DNS record type to its use.

Accepted Answer

A: Maps a domain name to an IPv4 address.. Common DNS record types in Cloud DNS include A, AAAA, CNAME, and MX for IP mapping, aliasing, and email routing. Distractors swap definitions between record types.

Answer

A: Maps a domain name to an IPv6 address.

Answer

CNAME: Specifies mail exchange servers for a domain.

Question 8

A team has deployed Compute Engine instances with internal IPs only. They need to allow these instances to download updates from specific external IP ranges. Which action should they take?

Accepted Answer

Create egress firewall rules with target tags and allowed IP ranges.. Egress firewall rules with target tags allow you to control outbound traffic from Compute Engine instances based on destination IP ranges. By specifying the allowed external IP ranges for updates and applying the rule to instances with a specific tag, you enable secure outbound access without exposing the instances to inbound traffic or requiring public IPs.

Answer

Configure Cloud NAT and allow all traffic.

Answer

Attach a public IP to each instance.

Answer

Use Private Google Access.

Question 9

An organization has a Shared VPC with several service projects. They want to restrict which service projects can create firewall rules in the host project. What should they do?

Accepted Answer

Use IAM roles with compute.firewalls.create permission at the host project level.. IAM roles with the `compute.firewalls.create` permission at the host project level allow you to precisely control which service projects can create firewall rules in the Shared VPC host project. By assigning a custom or predefined role (e.g., Compute Security Admin) that includes this permission to specific service project identities, you can restrict firewall rule creation to only authorized service projects while preventing others from doing so.

Answer

Use VPC Service Controls.

Answer

Use hierarchical firewall policies.

Answer

Use organization policies to deny firewall rule creation.

Question 10

A company uses Cloud Armor with WAF rules to protect an HTTPS load balancer. They notice that legitimate traffic from certain IPs is being blocked. How should they troubleshoot?

Accepted Answer

Review Cloud Armor security policy logs.. Cloud Armor security policy logs record the actions taken by WAF rules, including which requests were blocked and why. By reviewing these logs, you can identify the specific rule that is blocking legitimate traffic and adjust its configuration, such as modifying IP allowlists or threshold values.

Answer

Check firewall rule logs.

Answer

Enable Packet Mirroring.

Answer

Use VPC Flow Logs.

Question 11

A developer wants to SSH into a Compute Engine instance that has no public IP. Which service should they use?

Accepted Answer

Identity-Aware Proxy (IAP) TCP forwarding.. Identity-Aware Proxy (IAP) TCP forwarding allows secure, authenticated, and authorized SSH access to Compute Engine instances that have no public IP addresses. It works by establishing a tunnel through the IAP service, which proxies the SSH connection over HTTPS (port 443) to the instance's internal IP, eliminating the need for a public IP or bastion host.

Answer

Direct Peering.

Answer

Cloud NAT.

Answer

Cloud VPN.

Question 12

An organization has multiple VPC networks and wants to allow traffic between them with fine-grained control over which VMs can communicate. Which solution should they implement?

Accepted Answer

VPC peering with firewall rules.. VPC peering with firewall rules is the correct solution because it allows direct, private connectivity between two VPC networks while enabling fine-grained control over which specific VMs can communicate via firewall rules (ingress/egress). Unlike Shared VPC, which centralizes management but does not inherently provide per-VM granularity across separate VPCs, VPC peering combined with firewall rules allows you to restrict traffic based on source and destination tags, service accounts, or CIDR ranges. This meets the requirement for both inter-VPC traffic and granular VM-level control.

Answer

Cloud Interconnect.

Answer

Shared VPC.

Answer

Cloud VPN between VPCs.

Question 13

A company is deploying a GKE cluster with Dataplane V2 and wants to enforce micro-segmentation using network policies. They also need to monitor policy violations. What should they do?

Accepted Answer

Enable GKE Dataplane V2 and use Kubernetes Network Policies with audit logging.. Dataplane V2 uses eBPF to implement Kubernetes Network Policies directly in the kernel, providing native support for micro-segmentation. Enabling audit logging on the cluster captures denied or allowed policy actions, allowing the company to monitor policy violations without additional infrastructure.

Answer

Enable Packet Mirroring.

Answer

Use Cloud IDS to monitor traffic.

Answer

Use VPC firewall rules with pod IP ranges.

Question 14

A company wants to ensure that only traffic from specific source IP ranges can reach a Cloud Load Balancer. How should they enforce this?

Accepted Answer

Configure Cloud Armor with IP allowlist.. Cloud Armor is a web application firewall (WAF) that can be attached to a Cloud Load Balancer to filter incoming traffic based on IP addresses, including allowlisting specific source IP ranges. This directly meets the requirement to restrict access to the load balancer by source IP without affecting backend instance configurations.

Answer

Use IAP.

Answer

Set up Cloud NAT.

Answer

Use VPC firewall rules on the load balancer's backend.

Question 15

A network engineer notices that VPC Flow Logs show connections from a Compute Engine instance to an IP address that should have been blocked by firewall rules. What is the most likely cause?

Accepted Answer

The firewall rule is not applied to the instance's network tag.. If a firewall rule is not applied to the instance's network tag, the rule will not affect that instance. In Google Cloud, firewall rules can target instances by specifying target tags; if the rule's target tag does not match the instance's tag, the rule is not enforced on that instance, allowing traffic that should have been blocked.

Answer

The firewall rule has a lower priority than a deny rule.

Answer

The instance is using an external IP.

Answer

VPC Flow Logs are inaccurate.