PCNE Implementing network security Practice Test 5 — 15 Questions

Question 1

A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC flow logs show traffic being dropped. Firewall rules are correctly configured. Which TWO actions should the engineer take to identify the cause?

Accepted Answer

Use Packet Mirroring to capture traffic on both sides and compare.. Packet Mirroring allows you to capture and inspect actual traffic at the packet level on both sides of the VPC peering connection. Since firewall rules are correctly configured but flow logs still show drops, the issue is likely at a lower layer (e.g., routing, MTU, or asymmetric traffic). By comparing mirrored packets, you can see if traffic is actually reaching the destination interface and whether responses are being sent back, which flow logs alone cannot reveal.

Answer

Ensure that the subnets in both VPCs don't overlap.

Answer

Disable the firewall rules to see if traffic flows.

Answer

Verify that the VPCs are in the same project.

Question 2

A company wants to allow HTTP traffic from the internet to a web server running on a Compute Engine VM in a VPC. The web server should only be accessible on port 80. Which firewall rule should be created?

Accepted Answer

Ingress rule: allow tcp:80 from 0.0.0.0/0 (target tags: web-server). Option B is correct because HTTP traffic from the internet (source 0.0.0.0/0) must be allowed by an ingress firewall rule targeting the web server VM. The rule specifies TCP port 80, which is the standard HTTP port, and uses target tags 'web-server' to apply the rule only to VMs with that tag, ensuring the web server is accessible on port 80 from any source.

Answer

Egress rule: allow tcp:80 from 0.0.0.0/0 (target tags: web-server)

Answer

Ingress rule: allow tcp:443 from 0.0.0.0/0 (target tags: web-server)

Answer

Ingress rule: allow tcp:80 from 0.0.0.0/0 (target tags: default)

Question 3

A company uses Shared VPC with multiple service projects. The network admin wants to restrict access to certain Compute Engine instances so that only specific service accounts can SSH into them. What is the best practice to achieve this?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding with IAM conditions restricting which service accounts can use IAP.. Option B is correct because Identity-Aware Proxy (IAP) TCP forwarding allows SSH access to Compute Engine instances without exposing them to the public internet. By combining IAP with IAM conditions, the network admin can restrict which service accounts are permitted to use IAP, thereby controlling SSH access at the identity level rather than relying on source IP addresses. This approach aligns with Google Cloud's best practice for zero-trust network security.

Answer

Configure firewall rules that allow SSH only from source IP ranges of the allowed service accounts.

Answer

Use Organization Policies to restrict SSH access.

Answer

Use VPC Service Controls with a service perimeter.

Question 4

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

Accepted Answer

Configure Cloud NAT with a static NAT IP address and ensure all traffic uses that IP.. Cloud NAT with a static NAT IP address ensures that all outbound traffic from private instances uses a consistent, predictable source IP. This satisfies the external API's requirement for a static source IP without needing to assign public IPs directly to instances. Option C correctly configures Cloud NAT to use a static IP, which is the intended solution for this scenario.

Answer

Use Private Google Access instead of Cloud NAT.

Answer

Assign a static external IP to the instances and use Cloud NAT with static IPs.

Answer

Use a VPN tunnel to the API provider's network.

Question 5

A company deploys a web application on Google Kubernetes Engine (GKE) with an Ingress resource handled by an external HTTPS load balancer. They want to enforce mutual TLS (mTLS) authentication where the load balancer verifies the client certificate and then passes the client's identity to the backend using a header. Which configuration should be used?

Accepted Answer

Enable Client Certificate Validation on the HTTPS backend service and configure the backend to read the X-Forwarded-Client-Cert header.. Option A is correct because Google Cloud's external HTTPS load balancer supports mTLS by enabling Client Certificate Validation on the backend service. When enabled, the load balancer terminates TLS, validates the client certificate, and injects the client certificate details into the X-Forwarded-Client-Cert (XFCC) header, which the backend application can read to identify the client. This approach offloads certificate validation to the load balancer and passes identity via a standard header, meeting the requirement without modifying the GKE Ingress or backend application logic.

Answer

Use an SSL policy with mTLS and set the backend service to require client certificates.

Answer

Use Cloud Armor with mTLS and configure a custom request header to include the client certificate.

Answer

Configure the GKE Ingress to use an SSL certificate and set the annotation for client certificate validation.

Question 6

A company wants to prevent data exfiltration from a Google Cloud Storage bucket that contains sensitive data. They plan to use VPC Service Controls. Which two steps are necessary to implement this? (Choose two.)

Accepted Answer

Add the storage bucket to a VPC Service Controls perimeter and restrict access to only trusted VPC networks.. Option A is correct because VPC Service Controls allows you to define a service perimeter that includes a Cloud Storage bucket, and within that perimeter you can restrict access to only trusted VPC networks. This prevents data exfiltration by ensuring that only resources within the specified VPC networks can access the bucket, blocking any access from outside the perimeter, including the public internet or other networks.

Answer

Set up an Organization Policy to deny all public access to storage buckets.

Answer

Configure the service perimeter to allow access only from authorized IP ranges.

Answer

Create a service perimeter that includes the storage bucket and the VPC network.

Question 7

A network engineer needs to configure firewall rules to allow health checks from Google Cloud's health check systems to a backend service. Which two source IP ranges should they allow? (Choose two.)

Accepted Answer

130.211.0.0/22. Google Cloud health check probes originate from the specific IP ranges 130.211.0.0/22 and 35.191.0.0/16. Allowing these source ranges in firewall rules is necessary to permit health check traffic to reach backend instances, ensuring load balancers can determine instance health.

Answer

169.254.0.0/16

Answer

10.0.0.0/8

Answer

0.0.0.0/0

Question 8

A company is designing a network architecture with multiple VPCs and on-premises connectivity via Cloud VPN. They want to avoid IP address conflicts and ensure secure communication. Which three best practices should they follow? (Choose three.)

Accepted Answer

Use unique RFC 1918 IP address ranges for each VPC.. Option B is correct because using unique RFC 1918 IP address ranges for each VPC prevents overlapping IP spaces, which is critical when connecting multiple VPCs and on-premises networks via Cloud VPN. Overlapping ranges would cause routing conflicts and make it impossible for Cloud Router and BGP to establish proper path selection, leading to dropped or misrouted traffic.

Answer

Use Cloud NAT for all outbound internet traffic from private VMs.

Answer

Enable VPC Network Peering between all VPCs to enable direct communication.

Question 9

A company has a single VPC with subnets in us-central1 and europe-west1. They have Compute Engine instances in both subnets that need to communicate with each other. The security team wants to ensure that only specific instances in us-central1 can connect to a database instance in europe-west1 on port 3306. Currently, the default firewall rules allow all internal traffic (priority 65535). The network engineer first creates a new ingress firewall rule to allow TCP traffic on port 3306 from instances with the network tag 'app' to instances with the tag 'db', with priority 1000. Then, to enforce the restriction, they delete the default allow internal rule (priority 65535). However, after applying the changes, the app instances (tagged 'app') in us-central1 cannot connect to the database instance (tagged 'db') in europe-west1. The engineer verifies that the tags are correctly applied to the instances. What is the most likely cause of the connectivity failure?

Accepted Answer

The app instances need a firewall rule to allow egress traffic to the database on port 3306.. B is correct because in Google Cloud VPC, firewall rules are stateful for ingress but not for egress. The ingress rule allowing traffic from 'app' to 'db' on port 3306 only controls incoming packets to the database instance. The app instance still needs an egress firewall rule to allow outbound traffic on port 3306, otherwise the outbound SYN packet is dropped before it reaches the database. Deleting the default allow internal rule (priority 65535) removed the implicit egress permission, so a specific egress rule is required.

Answer

The firewall rule only allows ingress from instances with tag 'app' but the egress traffic from app instances is blocked.

Answer

The firewall rule is applied to the wrong VPC network.

Answer

The database instance's network tag 'db' was not applied to the database instance.

Question 10

A company has deployed a web application behind an External HTTP(S) Load Balancer with Cloud Armor. They want to restrict access to a specific URL path /admin to only users from a specific IP range (198.51.100.0/24). The engineer creates a Cloud Armor security policy with two rules: Rule 1 (priority 1000) with match expression "request.path == '/admin' && inIpRange(source.ip, '198.51.100.0/24')" and action "allow". Rule 2 (priority 2147483647) with match "request.path == '/admin'" and action "deny". After testing, users from the allowed IP range receive a 403 error when accessing /admin. The Cloud Armor logs show that the request was denied. The engineer confirms that the policy is attached to the backend service and that the source IP in the logs matches the allowed range. What is the most likely cause of the denial?

Accepted Answer

The user's source IP is being translated by a NAT or proxy, so it doesn't match the allowed range.. Option C is correct because the most likely cause is that the user's source IP is being translated by a NAT or proxy before reaching the load balancer. Cloud Armor evaluates the source IP as seen by the load balancer, which may differ from the original client IP if traffic passes through an intermediate device. The logs confirm the source IP matches the allowed range, but if the request arrives via a proxy, the actual source IP in the packet could be the proxy's IP, not the user's, causing the deny rule to match.

Answer

The allow rule is missing a condition to also check the request path because the path condition is not supported in Cloud Armor.

Answer

The allow rule's condition is incorrect because it should use "origin.ip" instead of "source.ip".

Answer

The allow rule's priority is 1000, which is lower than the deny rule, but the deny rule still overrides.

Question 11

A large organization uses Shared VPC with hundreds of projects. They want to implement fine-grained access control for SSH access to Compute Engine instances using IAP TCP forwarding. They have created a custom IAM role with the necessary permissions (iap.tunnel.dest, iap.tunnel.getIamPolicy, compute.instances.use) and granted it to a group of developers. The developers have also been granted the iap.tunnelUser role on the project. However, when they try to use `gcloud compute ssh --tunnel-through-iap instance-name`, they get a permission error: "Permission 'iap.tunnel.dest' denied on resource 'projects/project/zones/zone/instances/instance'". The network admin has verified that the custom role includes the required permissions and that the developers are members of the group with the role. What is the most likely missing configuration?

Accepted Answer

IAP TCP forwarding is not enabled for the project or VPC.. IAP TCP forwarding requires the IAP API to be enabled on the project and the service to be activated for the VPC. Without this, the IAP proxy cannot intercept and forward TCP traffic to the instance, even if the IAM permissions are correctly assigned. The error 'Permission 'iap.tunnel.dest' denied' typically occurs when the IAP TCP forwarding service itself is not enabled, as the permission check fails at the service level before evaluating the IAM role.

Answer

The developers need the `iap.tunnel` resource-level permission on the IAP TCP forwarding resource.

Answer

The instances do not have the required network tags for IAP.

Answer

The developers need the `compute.instances.osLogin` permission.

Question 12

A company has a VPC with a subnet in us-central1. They have several private Compute Engine instances (no external IP) that need to download updates from a public repository on the internet. The network engineer has created a Cloud NAT gateway in the same region and attached it to the subnet. However, the instances still cannot reach the internet. The engineer has confirmed that the Cloud NAT gateway is correctly configured and that the subnet's Private Google Access is not relevant for this traffic. What should the engineer check first to resolve the issue?

Accepted Answer

Verify that the default route (0.0.0.0/0) is present in the VPC route table pointing to the internet gateway.. Option A is correct because even with a properly configured Cloud NAT, instances require a default route (0.0.0.0/0) in the VPC route table that points to the internet gateway (IGW) to direct outbound traffic to the internet. Cloud NAT translates private IPs to public IPs, but it does not create the route; the route must exist for packets to leave the VPC. Without this route, traffic from the instances to 0.0.0.0/0 will be dropped, as there is no next-hop to forward packets to the internet.

Answer

Confirm that the Cloud NAT router is configured with the correct network and subnet.

Answer

Ensure that the Cloud NAT gateway has a static external IP.

Answer

Check that the firewall rules allow egress traffic for the instances to the internet.

Question 13

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect using VLAN attachments. They have set up a Cloud Router with BGP to exchange routes. The on-premises network advertises a prefix 10.0.0.0/8, and Google Cloud advertises the VPC's subnet ranges (10.0.0.0/24 and 10.0.1.0/24). After configuration, on-premises hosts cannot reach the Google Cloud instances in those subnets. The engineer checks the BGP session status and it is established. The Cloud Router shows that the on-premises prefix is learned, and the on-premises router shows that the specific /24 prefixes are received. However, traffic from on-premises to the Google Cloud subnets is not working. What is the most likely cause?

Accepted Answer

The on-premises router has a local route for 10.0.0.0/8 that overrides the BGP-learned /24 routes.. The most likely cause is that the on-premises router has a local route for the larger prefix 10.0.0.0/8, which is more specific than the BGP-learned /24 routes. Since the local route has a lower administrative distance (typically 0 for directly connected or 1 for static) compared to BGP's administrative distance of 20 for eBGP, the on-premises router prefers the local route and forwards traffic locally instead of sending it over the Dedicated Interconnect to Google Cloud. This results in traffic not reaching the VPC subnets.

Answer

The VPN connection needs to be configured for the Interconnect.

Answer

The Google Cloud VPC has a custom static route that overrides the dynamically learned route.

Answer

The on-premises firewall is blocking the traffic.

Question 14

A company uses Cloud VPN tunnels to connect multiple sites to Google Cloud. They have a primary and a backup tunnel for redundancy, each with a different Cloud Router (both in the same region). BGP sessions are established on both routers. The network team notices that during a failover test, traffic fails over to the backup tunnel but then after 30 seconds, the backup tunnel traffic stops and does not recover until the primary tunnel comes back. The engineer finds that the backup Cloud Router is advertising the same routes as the primary, but the backup tunnel's BGP session shows that the routes are being withdrawn after 30 seconds. Additionally, the BGP session remains established. What is the most likely cause?

Accepted Answer

The backup Cloud Router's BGP session is experiencing a keepalive timeout due to incorrect timers.. The backup Cloud Router's BGP session remains established, but routes are withdrawn after 30 seconds. This is classic behavior of a BGP keepalive or hold timer mismatch: if the backup router expects a keepalive within a shorter interval than the peer sends, the hold timer expires, causing the router to withdraw all routes learned from that peer while keeping the TCP session alive (or re-establishing it). The 30-second interval matches the default BGP hold timer (90 seconds) divided by three, suggesting a timer misconfiguration on the backup router.

Answer

The backup Cloud Router is configured with a lower MED value, causing the routes to be withdrawn.

Answer

The backup tunnel is using a static routing method instead of dynamic BGP.

Answer

The backup tunnel's Cloud Router is in a different region, and the routes are not propagated globally.

Question 15

A company is deploying a new application across three VPCs in the same project, using Shared VPC. The security team wants to restrict traffic such that only the frontend subnet (10.0.1.0/24) can send traffic to the backend subnet (10.0.2.0/24) on TCP port 8080. The backend instances have the service account 'backend-sa@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations achieve this goal?

Accepted Answer

Create an ingress firewall rule on the backend VPC with source service account 'frontend-sa@project.iam.gserviceaccount.com', protocol tcp:8080, and target service account 'backend-sa@project.iam.gserviceaccount.com'.. Option A is correct because it uses service accounts as both source and target in an ingress rule on the backend VPC. This allows only instances with the frontend service account to send traffic to instances with the backend service account on TCP 8080, meeting the security requirement without relying on IP addresses or network tags.

Answer

Create an egress firewall rule on the frontend VPC with source CIDR 10.0.1.0/24, protocol tcp:8080, and target CIDR 10.0.2.0/24.

Answer

Create an ingress firewall rule on the backend VPC with source tag 'frontend-tag', protocol tcp:8080, and target tag 'backend-tag'.

Answer

Create a VPC firewall rule with priority 1000 that denies all traffic from 10.0.1.0/24 to 10.0.2.0/24, and then a higher priority rule allowing tcp:8080.