PCNE Implementing network security Practice Test 4 — 15 Questions

Question 1

Which THREE of the following are required to use Private Google Access for on-premises hosts through a Cloud VPN or Interconnect? (Choose THREE)

Accepted Answer

Firewall rules allowing traffic from on-premises to the restricted VIP IP range.. Private Google Access for on-premises hosts requires firewall rules that allow traffic from on-premises to the restricted VIP IP range (199.36.153.4/30). This is necessary because on-premises hosts must be able to reach the restricted Google APIs VIP over the VPN or Interconnect, and firewall rules control which source IPs can access that VIP. Without these rules, traffic from on-premises would be blocked at the Google Cloud perimeter.

Answer

VPC Flow Logs enabled on the VPC.

Answer

Cloud NAT configured for the on-premises subnet.

Question 2

Refer to the exhibit. A VM in the default VPC with an internal IP 10.0.1.2 tries to SSH (tcp:22) from a host at 10.0.2.5. What is the result?

Accepted Answer

The traffic is allowed because it matches the allow-internal rule.. In Google Cloud VPC, firewall rules are stateful and evaluated based on priority (lower priority number = higher priority). The default VPC includes an 'allow-internal' rule (priority 65534) that allows all TCP traffic from any source in the 10.0.0.0/8 range. Since the source IP (10.0.2.5) is within 10.0.0.0/8 and the destination VM (10.0.1.2) is also in that range, the SSH traffic matches this allow rule. If a deny-ssh rule were present with a lower priority number (e.g., 1000), it would take precedence over the allow-internal rule. However, no such deny rule is specified in the question, so the traffic is allowed because it matches the allow-internal rule.

Answer

The traffic is denied because the source IP is not in the same subnet as the VM.

Answer

The traffic is denied because the deny-ssh rule has a lower priority number and blocks all SSH traffic.

Answer

The traffic is denied due to the implicit deny rule at the end.

Question 3

Refer to the exhibit. A request arrives with User-Agent 'GoodBot' and path '/admin'. What action does Cloud Armor take?

Accepted Answer

Allow the request because the rule with priority 200 matches and allows it.. Cloud Armor evaluates rules in order of priority (lowest number = highest priority). The rule with priority 200 matches the request (User-Agent 'GoodBot' and path '/admin') and explicitly allows it. Once a matching allow rule is found, evaluation stops, and the request is allowed, overriding any lower-priority rules.

Answer

Deny the request because the rule with priority 300 has a higher priority number but matches path.

Answer

Allow the request because of the default rule at priority 1000.

Answer

Deny the request because both rules match and deny takes precedence.

Question 4

Refer to the exhibit. A user within the perimeter project '111111111111' tries to access BigQuery from a VM that has an external IP address. The request is denied. What is the most likely reason?

Accepted Answer

The VPC Accessible Services restriction requires that the request originate from an internal IP address or through VPC-controlled access.. The VPC Accessible Services restriction, when enabled, forces all traffic to Google APIs to use internal IP addresses or VPC-controlled access (such as Private Google Access or Private Service Connect). Since the VM has an external IP address and the request is denied, the most likely reason is that this restriction is in place, requiring the request to originate from an internal IP or through a VPC endpoint, not from a public external IP.

Answer

BigQuery is not listed in the restricted services, so it is blocked.

Answer

The user does not meet the access level conditions defined in 'trusted_ips'.

Answer

The VM's project is not in the resources list.

Question 5

A company has two VPCs in the same project: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). They want to allow SSH from VPC-A to instances in VPC-B. The network admin creates a firewall rule with source range 10.0.0.0/16 and protocol tcp:22, but connectivity fails. What is the most likely cause?

Accepted Answer

The rule is created in VPC-A instead of VPC-B.. Firewall rules in Google Cloud are applied at the network level, not the instance level. To allow inbound SSH traffic from VPC-A to instances in VPC-B, the firewall rule must be created in VPC-B (the destination network) with the source range set to 10.0.0.0/16. Creating the rule in VPC-A would only affect traffic destined for instances in VPC-A, not VPC-B.

Answer

The source range should be 10.0.0.0/8.

Answer

The target tag is not specified.

Answer

The source tag is missing.

Question 6

A company uses Cloud Armor to protect its HTTP(S) load balancer. They need to block requests from a specific geographic region and also apply a rate limiting rule. What is the correct order of evaluation for Cloud Armor security policies?

Accepted Answer

Evaluate rules in priority order; the first matching rule determines the action.. Cloud Armor security policies evaluate rules in priority order, and the first rule that matches the request determines the action (allow or deny). This means that if a rate limiting rule matches first, it will be applied, and subsequent rules are not evaluated. Option C correctly describes this behavior.

Answer

Rate limiting rules are evaluated separately from other rules.

Answer

Evaluate rules in priority order and apply all matching rules.

Answer

Evaluate all rules and apply the most restrictive action.

Question 7

A GCP environment has a VPC with a subnet that enables Private Google Access. Instances in that subnet can access Google APIs without external IPs. However, an instance cannot reach storage.googleapis.com from a private IP. Cloud NAT is configured for the subnet. What is the most likely reason for the failure?

Accepted Answer

The subnet's Private Google Access is enabled, but Cloud NAT is also routing traffic to Google APIs via NAT, bypassing the internal access.. Private Google Access uses the default routes for Google APIs. If Cloud NAT is configured, it may override Private Google Access because traffic to Google APIs can be matched by a default route with a next hop of NAT. To fix, ensure the subnet has a Private Google Access route with a next hop 'default internet gateway' for the restricted VIPs. Option B correctly identifies that Cloud NAT is incorrectly routing traffic.

Answer

The instance does not have a DNS resolution for storage.googleapis.com.

Answer

The VPC does not have a default route to the internet.

Answer

The instance does not have a firewall rule allowing egress to 199.36.153.4/30.

Question 8

A security engineer wants to allow SSH access to a VM that has no external IP. The VM is in a VPC with IAP configured. What is the simplest way to enable secure SSH without a bastion host?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding with the gcloud compute start-iap-tunnel command.. Identity-Aware Proxy (IAP) TCP forwarding allows secure SSH access to a VM without an external IP by tunneling traffic through the IAP service. The `gcloud compute start-iap-tunnel` command establishes an encrypted tunnel from your local machine to the VM via the IAP proxy, using the VM's internal IP and port 22. This eliminates the need for a bastion host or public IP while leveraging IAP's identity-based access controls.

Answer

Create a VPN tunnel to the VPC and SSH over the VPN.

Answer

Configure a SOCKS proxy on a bastion host.

Answer

Assign an external IP to the VM and use a firewall rule to restrict access.

Question 9

An organization wants to restrict data exfiltration from a GCP project. They need to prevent users from copying data to external cloud storage services like AWS S3, but allow access to Google Cloud Storage. Which VPC Service Controls (VPC-SC) configuration should they use?

Accepted Answer

Combine VPC Service Controls with a Cloud Firewall that denies egress to non-Google IPs.. VPC Service Controls (VPC-SC) can create a perimeter that restricts data movement to only Google Cloud Storage, while Cloud Firewall egress rules can deny traffic to non-Google IP ranges (including AWS S3 endpoints). This combination ensures that even if a user attempts to copy data to an external cloud storage service, the firewall blocks the egress traffic, and VPC-SC prevents access to Google Cloud Storage from outside the perimeter.

Answer

Use Cloud Firewall rules to block egress to AWS IP ranges.

Answer

Enable Data Loss Prevention (DLP) API to inspect outgoing data.

Answer

Create a VPC Service Controls perimeter that includes the project and set access levels to allow only Google Cloud Storage.

Question 10

A large enterprise uses hierarchical firewall policies across multiple VPCs. They have an organization policy that requires all VPCs to block SSH from the internet. However, a development team needs SSH from a specific external IP range for a building. How can they create a firewall rule that allows that range without violating the organization policy?

Accepted Answer

Create a project-level firewall policy with a priority higher than the organization policy's deny rule, allowing the specific source range.. In Google Cloud, hierarchical firewall policies are evaluated before VPC firewall rules, and the effective rule is the one with the highest priority (lowest numeric value). By creating a project-level firewall policy rule with a higher priority (e.g., priority 100) than the organization policy's deny rule (e.g., priority 1000), the allow rule for the specific external IP range will take precedence, effectively overriding the deny for that traffic while keeping the organization policy intact.

Answer

Remove the organization policy and implement firewall rules at the project level only.

Answer

Use VPC firewall rules instead of hierarchical policies to allow the range, as they are evaluated after hierarchical policies.

Answer

Add the external IP range to an exception list in the organization policy.

Question 11

A company uses an HTTPS load balancer with SSL certificates. They want to ensure only strong cipher suites are accepted. Which Google Cloud service should they use to enforce this?

Accepted Answer

SSL policies on the target HTTPS proxy.. SSL policies on the target HTTPS proxy allow you to define a set of allowed SSL/TLS cipher suites and protocols for the load balancer. By configuring an SSL policy with a 'RESTRICTED' profile or a custom list of strong ciphers, you can enforce that only secure cipher suites (e.g., TLS 1.2+ with ECDHE and AES-GCM) are accepted, rejecting weak or deprecated ciphers like RC4 or 3DES.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud Armor security policy.

Answer

Firewall rules on the backend instances.

Question 12

A network engineer notices unexpected traffic being allowed through a VPC firewall rule. They want to analyze the logs to identify the source and destination. What is the best way to enable detailed logging for firewall rules?

Accepted Answer

Enable firewall rule logging on the specific rule and view logs in Cloud Logging.. Firewall rule logging in VPC is designed specifically to log metadata (source IP, destination IP, action, etc.) for each packet matched by a firewall rule. Enabling it on the specific rule and viewing logs in Cloud Logging provides the granular, per-rule detail needed to identify the source and destination of unexpected traffic. This is the direct and intended method for firewall rule analysis.

Answer

Enable VPC Flow Logs for the subnet.

Answer

Create a custom router with a log export.

Answer

Use Packet Mirroring to capture all traffic.

Question 13

A company has multiple on-premises networks connected to a Cloud VPN hub in GCP. Each on-premises site uses BGP to advertise its prefixes. The security team wants to ensure that only specific prefixes from each site are accepted into the VPC routes. What should they configure?

Accepted Answer

Configure BGP route filtering on the Cloud Router to accept only specific prefixes from each on-premises site.. Cloud Router supports BGP route filtering, allowing you to define inbound route policies that accept only specific prefixes from each on-premises BGP peer. This ensures that only the desired prefixes are installed into the VPC route table, providing granular control over route advertisement acceptance without affecting the VPN tunnel or firewall state.

Answer

Create firewall rules to block traffic from unwanted prefixes.

Answer

Set up a separate VPN tunnel for each prefix.

Answer

Use VPC Service Controls to restrict the prefixes.

Question 14

Which TWO of the following are valid methods to restrict access to a Compute Engine VM that has no external IP?

Accepted Answer

A Cloud VPN tunnel from an on-premises network.. A Cloud VPN tunnel creates an encrypted, RFC-compliant IPsec tunnel between an on-premises network and a VPC, allowing on-premises hosts to reach the VM over its internal IP without requiring an external IP on the VM. Option E is correct because Identity-Aware Proxy (IAP) TCP forwarding uses the IAP service as a proxy to establish an SSH or RDP connection to a VM that has no external IP, by tunneling traffic through the IAP service using the `gcloud compute start-iap-tunnel` command.

Answer

Using a NAT gateway to allow SSH from the internet.

Answer

Configuring a SOCKS proxy on a bastion host.

Answer

Assigning an external IP and using firewall rules.

Question 15

Which THREE components are required to set up Identity-Aware Proxy (IAP) for TCP forwarding to a VM?

Accepted Answer

A firewall rule that allows ingress from 35.235.240.0/20 to the VM on the desired port.. IAP TCP forwarding requires that the VM allows ingress traffic from the IAP health-check and forwarding source IP range (35.235.240.0/20) on the desired TCP port. Without this firewall rule, the IAP proxy cannot establish a connection to the VM, even if the user is authenticated and authorized.

Answer

The VM must have an external IP address.

Answer

A NAT gateway configured for the VPC.