PCNE Implementing VPC Instances — 10 Questions

Question 1

A company has a VPC with a subnet in us-central1. They launched a Compute Engine instance named "app-server" in that subnet without an external IP. They need the instance to be able to download updates from the internet. Which two steps must be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud NAT gateway and a Cloud Router in us-central1.. The instance needs outbound internet access via Cloud NAT, which requires a Cloud Router in the region.

Answer

Configure Private Google Access on the subnet.

Answer

Create a VPC firewall rule to allow egress to 0.0.0.0/0.

Answer

Assign a static external IP to the instance.

Question 2

What is the default MTU for Compute Engine instances on Google Cloud?

Accepted Answer

1460. Google Compute Engine instances use a default MTU of 1460 bytes on their network interfaces, not the standard Ethernet 1500. This reduced value accounts for the VXLAN encapsulation overhead (50 bytes) that Google's Andromeda SDN uses to carry traffic between VMs. The 1460 value ensures that guest VM packets, once encapsulated, fit within the underlying physical network's 1500-byte MTU without fragmentation.

Answer

9000

Answer

1400

Answer

1500

Question 3

A company wants to restrict access to Google Cloud Storage so that only traffic originating from a specific VPC network is allowed. They also need to prevent data exfiltration to other VPCs. Which two services should they use? (Choose two.)

Accepted Answer

VPC Service Controls. VPC Service Controls (option A) is correct because it creates a service perimeter around Cloud Storage that blocks access from outside the authorized VPC network and prevents data exfiltration to other VPCs or projects, which directly satisfies both requirements. Private Google Access (option E) is correct because it lets VM instances in a subnet without external IP addresses reach Google APIs and services such as Cloud Storage through internal IP addresses, ensuring traffic originates from the specified VPC network. Cloud VPN (option B) only provides encrypted tunnels between networks and does not restrict Cloud Storage access or prevent exfiltration. Cloud NAT (option C) merely allows outbound internet access for instances without public IPs and offers no access control over Cloud Storage. Firewall rules (option D) control traffic to and from VM instances but cannot govern access to Google Cloud Storage or stop data exfiltration to other VPCs.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Firewall rules

Question 4

A company has Compute Engine instances without external IPs in a VPC. They need to reach Google APIs such as Cloud Storage and BigQuery. Which configuration will meet this requirement with minimal cost and operational overhead?

Accepted Answer

Configure the subnet to have Private Google Access enabled. Ensure the instances have the appropriate DNS resolution for private.googleapis.com.. Private Google Access allows VM instances with only internal IP addresses to reach Google APIs and services (such as Cloud Storage and BigQuery) using the default or private.googleapis.com DNS names, without requiring external IPs or Cloud NAT. It is enabled per subnet, costs nothing extra, and requires no additional infrastructure, making it the lowest-cost, lowest-overhead solution. The instances must resolve the Google API hostnames to the restricted VIP ranges (199.36.153.8/30 for private.googleapis.com or 199.36.153.4/30 for restricted.googleapis.com).

Answer

Set up a Squid proxy on a bastion host with an external IP and route all API traffic through it.

Answer

Create a Cloud NAT gateway in the same region and attach it to the VPC.

Answer

Assign external IPs to the instances and create firewall rules to allow traffic to Google APIs.

Question 5

A network engineer wants to restrict access to a Cloud Storage bucket from only a specific set of Compute Engine instances in a VPC. The instances have no external IPs. What is the most effective way to enforce this restriction?

Accepted Answer

Enable Private Google Access on the subnet and use VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. Using Private Google Access with Private Service Connect allows instances to reach Google APIs via internal IPs. By using VPC Service Controls, you can create a service perimeter that restricts access to the Cloud Storage bucket from the specific VPC and projects. This provides a defense-in-depth approach.

Answer

Assign a unique service account to the instances and use IAM conditions to allow the service account access to the bucket only when connecting from the VPC network.

Answer

Configure a firewall rule that allows egress traffic to the Cloud Storage API only from the instances' subnet.

Answer

Create an IAM condition that restricts access based on the instance's internal IP address range.

Question 6

A company has a VPC with a subnet in us-central1. They launched a Compute Engine instance named "app-server" in that subnet without an external IP. They need the instance to be able to download updates from the internet. Which two steps must be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An egress firewall rule is missing that allows traffic from the instances to the internet via NAT.. Cloud NAT requires that the instances are allowed egress traffic to the internet. Without a suitable egress firewall rule, NAT traffic is blocked. The default firewall rules only allow egress to Google APIs (private.googleapis.com) but not to general internet destinations. A firewall rule allowing egress to 0.0.0.0/0 on the appropriate ports is required.

Answer

Cloud NAT is not configured in the correct region.

Answer

Private Google Access is enabled on the subnet, which overrides Cloud NAT.

Answer

The Cloud NAT router is not attached to the correct VPC network.

Question 7

A company wants to ensure that Compute Engine instances in a VPC can resolve internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. What is required for this to work?

Accepted Answer

No additional configuration is required; internal DNS resolution works by default.. Google Cloud provides internal DNS resolution for instances within the same VPC network. By default, instances can resolve DNS names for other instances in the same VPC if they are in the same network. There is no additional setup needed; it works out of the box. The DNS name format is [vm-name].[zone].c.[project-id].internal.

Answer

Assign a custom DNS server to the VPC using Cloud DNS inbound server policy.

Answer

Configure a DNS managed zone in Cloud DNS.

Answer

Enable Private Google Access on the subnet.

Question 8

A company has an HTTP Load Balancer that distributes traffic to a backend service consisting of Compute Engine instance groups. They need to block traffic from specific geographic regions and also rate-limit requests from any IP. Which THREE Cloud Armor features should they configure?

Accepted Answer

Rate limiting rules. The scenario requires blocking traffic from specific geographic regions, which is exactly what D (Geo-based access control / geoblocking) provides: Cloud Armor security policies support geo-based rules that match on the source country/region derived from the client IP, allowing you to deny or allow traffic by location. The scenario also requires rate-limiting requests from any IP, which is precisely B (Rate limiting rules): Cloud Armor's rate-based rules count requests per client (keyed on IP, and optionally on other inputs) over a configured interval and take an action such as deny or throttle once a threshold is exceeded. E (Custom rules with IP allow/deny) is also correct because Cloud Armor security policies are built from custom rules that match on IP addresses/CIDR ranges and take allow or deny actions, which is the mechanism used to enforce granular IP-based blocking alongside the geo and rate rules. A (Cloud Armor logging) is not a blocking or rate-limiting feature; it only records requests and rule matches for visibility and troubleshooting, so it does not fulfill either requirement. C (Pre-configured WAF rules such as OWASP Top 10) protects against web application attacks like SQL injection and XSS, but it does not perform geographic blocking or request rate limiting, so it is not needed here.

Answer

Cloud Armor logging

Answer

Pre-configured WAF rules (e.g., OWASP Top 10)

Question 9

An engineer needs to provide outbound internet access to Compute Engine instances that do not have external IP addresses. The solution must allow instances to access a specific set of external IPs only. What should the engineer configure?

Accepted Answer

Create a Cloud NAT gateway and configure firewall egress rules to allow traffic only to the specific IPs.. Cloud NAT lets instances without external IPs initiate outbound connections to the internet while remaining unreachable inbound. Firewall egress rules can then restrict which destination IP ranges the instances are permitted to reach, satisfying the requirement to allow only a specific set of external IPs. This combination provides outbound-only internet access with destination filtering.

Answer

Use Private Google Access only, which provides access to Google APIs and services.

Answer

Assign external IPs to instances and use firewall rules to restrict outbound traffic.

Answer

Deploy a NAT instance with iptables rules to restrict destination IPs.

Question 10

A company uses hierarchical firewall policies at the organization level. They need to allow SSH (TCP 22) access from a specific range 10.0.0.0/8 to all VMs, but a child folder has a policy that denies all ingress traffic. Which rule priority ordering ensures SSH access is allowed?

Accepted Answer

Organization allow rule priority 100, folder deny rule priority 200.. In hierarchical firewall policies, rules are evaluated by priority, with lower numbers taking precedence. An organization-level allow rule with priority 100 will be evaluated before a folder-level deny rule with priority 200, so SSH traffic from 10.0.0.0/8 will be allowed. This ordering ensures the allow rule takes effect despite the child folder's deny rule.

Answer

Folder allow rule priority 100, folder deny rule priority 200.

Answer

Remove the folder deny rule and use network firewall rules.

Answer

Organization allow rule priority 200, folder deny rule priority 100.