PCNE Implementing network security Practice Test 3 — 15 Questions

Question 1

Which TWO of the following methods can be used to encrypt traffic between VPC networks?

Accepted Answer

Use of SSL/TLS at the application layer.. SSL/TLS operates at the application layer (Layer 7) of the OSI model, providing end-to-end encryption for traffic between VPC networks. When applications use HTTPS (HTTP over TLS), the payload is encrypted before leaving the source, ensuring confidentiality even if the underlying network path is untrusted. This method is independent of the underlying network connectivity, making it suitable for encrypting traffic across VPCs connected via any means, including the public internet.

Answer

VPC peering.

Answer

Cloud Interconnect with VLAN attachments.

Answer

Cloud NAT.

Question 2

Which THREE of the following are valid use cases for VPC Service Controls?

Accepted Answer

Controlling access to a Cloud SQL database from a specific VPC.. VPC Service Controls allow you to define a service perimeter that restricts access to a Cloud SQL database (or other Google Cloud services) to requests originating from a specific VPC network. This is achieved by configuring an access level that references the VPC network, ensuring that only traffic from that VPC can reach the database, even if the database is exposed via private IP.

Answer

Allowing access to a managed instance group from the internet.

Answer

Enabling private access to Cloud APIs from on-premises.

Question 3

Refer to the exhibit. Users report that HTTP (port 80) traffic is still reaching instances in my-vpc despite the deny-all rule. What is the most likely reason?

Accepted Answer

A default firewall rule allowing HTTP exists with a higher priority.. In Google Cloud Platform (GCP), firewall rules are evaluated in order of priority, with lower numbers having higher priority. The default-allow-http rule has a priority of 1000, which is higher (lower number) than the deny-all rule's priority of 2000. Therefore, HTTP traffic is allowed by the default rule before the deny rule is evaluated, causing HTTP traffic to still reach instances.

Answer

The allow-ssh rule has priority 1000 and is evaluated before the deny rule.

Answer

The deny-all rule does not specify target tags.

Answer

The deny-all rule has priority 2000, which is higher than the allow rule.

Question 4

Refer to the exhibit. A Cloud Armor security policy with the shown rules is applied to an HTTPS load balancer. Users from IP 10.0.1.1 are reporting they cannot access the website. What is the issue?

Accepted Answer

The deny rule has higher priority and blocks traffic from 10.0.0.0/8.. Cloud Armor security policies evaluate rules in priority order, with lower numbers having higher priority. The deny rule at priority 1000 matches the source IP range 10.0.0.0/8, which includes the user's IP 10.0.1.1, and is evaluated before the allow rule at priority 2000. Since the deny rule is matched first, the request is blocked, preventing access to the HTTPS load balancer.

Answer

The load balancer is not configured to use the security policy.

Answer

The allow rule with priority 2000 does not apply because the deny rule is evaluated first.

Answer

The IP range in the deny rule is too broad.

Question 5

Refer to the exhibit. A network engineer is unable to SSH to instance-1 using IAP TCP forwarding. What is the most likely reason?

Accepted Answer

The instance does not have the 'ssh-iap' tag that the firewall rule applies to.. The exhibit shows a firewall rule that allows IAP TCP forwarding traffic from the IAP source range (35.235.240.0/20) to instances with the network tag 'ssh-iap'. Since instance-1 lacks this tag, the firewall rule does not apply, and SSH traffic from IAP is blocked. Without the tag, the instance's firewall policy drops the forwarded TCP connections, preventing SSH access.

Answer

IAP TCP forwarding is not enabled for the project.

Answer

The instance's service account does not have the necessary IAP permissions.

Answer

SSH keys are not configured on the instance.

Question 6

A company uses VPC Service Controls to protect a managed service (e.g., BigQuery) within a service perimeter. Developers need to access the service from an on-premises network via a Cloud VPN tunnel with a specific IP address. However, access is being denied. What is the most likely cause?

Accepted Answer

The on-premises source IP is not included in the allowed external IP addresses list in the perimeter.. VPC Service Controls enforce access to managed services like BigQuery by restricting which source IPs can reach the service. When accessing from on-premises via Cloud VPN, the source IP seen by the service is the on-premises client's IP, not the VPN gateway's IP. If that on-premises source IP is not explicitly added to the allowed external IP addresses list in the service perimeter, access is denied, even though the VPN tunnel is established.

Answer

The project containing the VPN tunnel is not in the same perimeter.

Answer

The VM instances in the perimeter do not have public IP addresses.

Answer

The Cloud VPN tunnel is not using IKEv2.

Question 7

A company has a hybrid network with on-premises data center connected to Google Cloud via Dedicated Interconnect. They use Private Google Access for on-premises (on-premises hosts use the external IP addresses of Google APIs via the interconnect). However, they notice that traffic to certain Google APIs is being routed via the internet instead of the interconnect. What is a likely cause?

Accepted Answer

On-premises DNS is not configured to resolve Google API hostnames to the Private Google Access IP address range (199.36.153.4/30).. Private Google Access for on-premises requires on-premises DNS to resolve Google API hostnames to the specific IP range 199.36.153.4/30. If DNS resolution returns the public IP addresses instead, traffic will be routed over the internet rather than through the Dedicated Interconnect, even though the interconnect is available. This is because the on-premises hosts will use the public IPs and follow their default route to the internet.

Answer

Firewall rules in the VPC are blocking the private API traffic.

Answer

Cloud NAT is not configured for the on-premises subnet.

Answer

VPC Flow Logs are not enabled, causing routing misconfiguration.

Question 8

A company deploys a web application behind a global external HTTP(S) load balancer and wants to protect against SQL injection attacks. Which Google Cloud security product should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities, including pre-configured rules to filter SQL injection (SQLi) attacks at the edge of Google's network, before traffic reaches the backend. It integrates directly with the global external HTTP(S) load balancer to inspect HTTP/HTTPS requests and block malicious payloads based on OWASP Top 10 signatures.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Answer

Cloud IDS

Question 9

A company uses Identity-Aware Proxy (IAP) to secure access to Compute Engine VMs. Users report that they can SSH into some VMs but not others, even though they have the IAP-secured Tunnel User role. Both VMs are in the same project and have the same network tags. What is the most likely reason?

Accepted Answer

Firewall rules allow ingress from IAP's IP ranges only for some VMs.. IAP TCP forwarding relies on firewall rules that allow ingress from the IAP proxy's IP ranges (35.235.240.0/20) to the VM. If these rules are applied inconsistently across VMs (e.g., missing on some subnets or instances), users will be unable to SSH into those VMs. The fact that both VMs share the same network tags does not guarantee identical firewall configurations if rules are applied based on other criteria like target tags or service accounts. Options B and D are incorrect as DNS resolution and OS Login are not prerequisites for IAP TCP forwarding. Option C is wrong because IAP TCP forwarding works with internal IPs; external IPs are not required.

Answer

The VMs are in different zones with different DNS resolution.

Answer

The VMs that can be accessed have external IP addresses; the others only have internal IP addresses.

Answer

The VMs do not have OS Login enabled.

Question 10

A company has multiple VPC networks in the same project, each with its own Cloud NAT configuration. They notice that traffic from a VM in VPC-A that has an external IP address is being NATed through the Cloud NAT gateway, but they only want Cloud NAT to be used for VMs without external IPs. What configuration ensures this?

Accepted Answer

Remove any NAT rules that match the source subnet and include external IP addresses; Cloud NAT automatically applies only to VMs without external IPs if not explicitly configured otherwise.. Cloud NAT only performs source network address translation for VMs that do not have external IP addresses, unless you explicitly configure NAT rules that match traffic from VMs with external IPs. By removing any such custom NAT rules, the default behavior ensures that only VMs without external IPs are NATed through the Cloud NAT gateway, leaving VMs with external IPs to use their own public addresses directly.

Answer

Disable the 'send-tosource-ip' flag on the Cloud NAT gateway.

Answer

Set the network tier of the VM to 'Standard' instead of 'Premium'.

Answer

Enable Cloud NAT logging to track which VMs are NATed.

Question 11

A company wants to enforce that all HTTPS load balancer traffic uses TLS 1.2 or higher. Which Google Cloud resource should they configure?

Accepted Answer

SSL policy attached to the target HTTPS proxy. An SSL policy in Google Cloud can be attached to a target HTTPS proxy to enforce minimum TLS version requirements, such as TLS 1.2 or higher. This policy directly controls the TLS handshake parameters at the load balancer level, ensuring that only clients supporting TLS 1.2 or above can establish HTTPS connections.

Answer

SSL certificate resource

Answer

VPC firewall rule to block TLS 1.0/1.1

Answer

Identity-Aware Proxy (IAP)

Question 12

A company uses Shared VPC with multiple service projects. The security team wants to ensure that only specific service projects can create firewall rules that allow ingress traffic to the Shared VPC network. What is the best practice?

Accepted Answer

Grant the compute.securityAdmin role to a group with a condition that limits access to only the service projects that need it, using the resource.name condition.. The compute.securityAdmin role allows users to create firewall rules, and by applying a condition on the resource.name, you can restrict this permission to only specific service projects. This ensures that only authorized service projects can create ingress firewall rules in the Shared VPC network, aligning with the security team's requirement.

Answer

Disable firewall rule creation by setting an organization policy constraint.

Answer

Grant the compute.securityAdmin role to a group at the organization level.

Answer

Grant the compute.securityAdmin role to the service project owners at the host project level.

Question 13

A company uses Packet Mirroring to monitor traffic from a set of VMs. They want to ensure that mirrored traffic does not interfere with the production traffic. Which statement is correct?

Accepted Answer

Packet Mirroring uses a separate forwarding path and does not impact the performance of the monitored VMs.. Packet Mirroring in Google Cloud (and similar platforms) operates by creating a separate, independent copy of the traffic at the virtual switch level, which is then forwarded to a collector destination without traversing the same network path as the original production traffic. This ensures that the mirrored traffic does not consume bandwidth or processing resources on the monitored VMs, and any issues with the mirroring pipeline (e.g., packet drops) have zero impact on the original traffic flow. The correct answer is A because the separate forwarding path guarantees no interference with production traffic.

Answer

If firewall rules block the mirrored traffic, the original traffic will also be blocked.

Answer

Packet Mirroring cannot capture traffic that is encrypted in transit.

Answer

Mirrored traffic is always sent over the same network path as the original traffic.

Question 14

Which TWO of the following are valid use cases for Cloud IDS? (Choose TWO)

Accepted Answer

Inspecting traffic between an on-premises network and Google Cloud via Cloud VPN.. Cloud IDS (Intrusion Detection System) inspects traffic for threats like malware and policy violations. Option B is correct because Cloud IDS can inspect traffic traversing Cloud VPN, enabling east-west and hybrid traffic inspection between on-premises and Google Cloud networks, which is a key use case for detecting threats in encrypted VPN tunnels.

Answer

Blocking malicious traffic at the network perimeter.

Answer

Replacing VPC firewall rules for access control.

Answer

Only inspecting traffic that is destined for the internet.

Question 15

A network engineer is troubleshooting connectivity issues with VPC Flow Logs. Which TWO statements about VPC Flow Logs are correct? (Choose TWO)

Accepted Answer

VPC Flow Logs can be used to diagnose overly permissive firewall rules.. VPC Flow Logs capture metadata about accepted and rejected traffic, including traffic that is allowed by overly permissive firewall rules. By analyzing the logs, you can identify flows that should have been blocked, revealing rules that are too broad in scope (e.g., allowing all traffic from 0.0.0.0/0). This diagnostic capability directly helps tighten security posture.

Answer

VPC Flow Logs capture only egress traffic.

Answer

VPC Flow Logs only capture traffic that is allowed by firewall rules.

Answer

VPC Flow Logs capture all packets for every flow in the VPC.