PCNE Implementing VPC Instances Practice Test 1 — 15 Questions

Question 1

An organization has multiple projects under an organization node. They need to enforce a security policy that denies all inbound SSH traffic (tcp:22) to all VMs across all projects, but must allow certain projects to override this. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a network firewall policy for each VPC with a deny rule for SSH. Use service accounts for exceptions.. Network firewall policies are applied at the VPC level and can be used to enforce a deny rule for SSH traffic. By using service accounts to identify VMs that should be exempt, you can allow certain projects (by assigning the appropriate service accounts) to override the deny. This approach allows per-project customization while maintaining a baseline deny. Option B is incorrect because hierarchical firewall policies do not support targeting entire projects directly; they rely on VM-level tags or service accounts, which would require manual tagging of every VM. Additionally, a hierarchical allow rule with a lower priority would apply to all VMs matching the target, not just the intended projects, potentially causing security gaps. Option A is incorrect because VPC Service Controls is designed for data exfiltration prevention, not traffic filtering. Option D is incorrect because a hierarchical deny rule cannot be overridden by a VPC-level allow rule.

Answer

Use VPC Service Controls to create a service perimeter that blocks SSH traffic to all projects.

Answer

Create a hierarchical firewall policy at the organization level with a rule that allows SSH for specific projects (using target service accounts or tags) at priority 1000, and a deny rule for all SSH at priority 2000.

Answer

Create a hierarchical firewall policy at the organization level denying SSH (tcp:22). Then create a network firewall policy at each VPC allowing SSH for exempted projects.

Question 2

An engineer is troubleshooting a firewall rule issue. A VM with network tag 'web' is unable to receive HTTP traffic from the internet. The VPC has an ingress firewall rule allowing tcp:80 from 0.0.0.0/0 to targets with tag 'web' at priority 1000. Another ingress rule denies all ingress traffic at priority 65535. What is the likely cause?

Accepted Answer

The VM does not have the network tag 'web' assigned. The allow rule targets VMs with network tag 'web'. If the VM does not have this tag, the rule does not apply, and the default deny ingress rule (priority 65535) blocks the HTTP traffic. The priority ordering is correct (allow at 1000 is higher than deny at 65535), but the tag mismatch prevents the allow rule from being effective.

Answer

The firewall rule is an egress rule instead of ingress

Answer

The priority of the allow rule is lower (higher number) than the deny rule

Answer

The VM has an external IP but the firewall rule only applies to internal IPs

Question 3

An engineer needs to provide outbound internet access to a set of Compute Engine instances that have only internal IP addresses. The instances must use a static IP address for outbound traffic. Which solution should they implement?

Accepted Answer

Create a Cloud NAT gateway with static IP address and configure it on the VPC network.. Cloud NAT with manual port allocation allows a static IP to be assigned to the NAT gateway, providing outbound internet access to instances without external IPs.

Answer

Assign a static external IP to each instance and configure a firewall rule to allow egress.

Answer

Configure Private Google Access on the subnet to route traffic to Google APIs.

Answer

Deploy a Compute Engine instance as a NAT instance with IP forwarding enabled.

Question 4

A security team wants to enforce a policy that blocks all egress traffic to the internet from a specific set of VMs across multiple projects in an organization. The policy should be centrally managed and override VPC-level firewall rules. Which approach should they use?

Accepted Answer

Deploy a hierarchical firewall policy at the organization level with a deny egress rule targeting the VMs.. Hierarchical firewall policies at the organization level can enforce rules that apply to all VPCs and override VPC-level rules with lower priority.

Answer

Create VPC firewall rules with deny egress for the specific VMs in each VPC.

Answer

Use a network firewall policy attached to each VPC network.

Answer

Configure Cloud Armor security policies on the load balancer to block egress.

Question 5

An organization needs to restrict access to Google Cloud APIs such that only traffic from a specific set of VMs inside a VPC can reach the APIs, and all other traffic (including from other VPCs) must be denied. The VMs do not have external IPs. Which combination of services should they use?

Accepted Answer

Private Google Access and VPC Service Controls. Private Google Access allows VMs without external IPs to reach Google APIs. VPC Service Controls can create a service perimeter that restricts access to APIs from only authorized VPCs.

Answer

Private Service Connect and VPC Service Controls

Answer

Cloud NAT and VPC Service Controls

Answer

Cloud NAT and Private Google Access

Question 6

A developer wants to allow HTTP (port 80) traffic from the internet to a set of Compute Engine instances that have a tag "web-server". Which firewall rule should they create?

Accepted Answer

Ingress rule: source 0.0.0.0/0, target tag "web-server", tcp:80. An ingress firewall rule with source range 0.0.0.0/0, target tag "web-server", and protocol/port tcp:80 allows HTTP traffic from the internet to the tagged instances.

Answer

Egress rule: source 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Egress rule: destination 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Ingress rule: source 0.0.0.0/0, target service account "web-server", tcp:80

Question 7

A company has a VPC with a subnet in us-central1. They launched a Compute Engine instance named "app-server" in that subnet without an external IP. They need the instance to be able to download updates from the internet. Which two steps must be taken?

Accepted Answer

Create a Cloud NAT gateway and a Cloud Router in us-central1.. The instance needs outbound internet access via Cloud NAT, which requires a Cloud Router in the region.

Answer

Configure Private Google Access on the subnet.

Answer

Create a VPC firewall rule to allow egress to 0.0.0.0/0.

Answer

Assign a static external IP to the instance.

Question 8

An organization uses a hierarchical firewall policy at the organization level with a deny-all egress rule (priority 100). They also have a VPC-level firewall rule allowing egress to a specific external IP (priority 1000). Will traffic to that external IP be allowed?

Accepted Answer

No, because hierarchical firewall policies take precedence over VPC firewall rules.. Hierarchical firewall policies are evaluated before VPC firewall rules and have higher precedence. A deny rule at the org level with priority 100 will override a VPC allow rule with lower priority (higher number).

Answer

Yes, because VPC firewall rules override hierarchical policies for the same traffic.

Answer

Yes, because the VPC rule has a higher priority number and is more specific.

Answer

No, because both rules deny and allow cancel out, resulting in default deny.

Question 9

An engineer wants to allow traffic from a specific service account to a Compute Engine instance. Which firewall rule option should they use for the source?

Accepted Answer

Source service accounts. Firewall rules can use service accounts as source or target. For source, you specify the source service account using the --source-service-accounts flag.

Answer

Target service accounts

Answer

Source IP ranges

Answer

Source tags

Question 10

What is the default MTU for Compute Engine instances on Google Cloud?

Accepted Answer

1460. The default MTU for Google Cloud VMs is 1460 bytes to accommodate encapsulation overhead.

Answer

9000

Answer

1400

Answer

1500

Question 11

A company wants to publish a service running on Compute Engine instances in their VPC so that consumers in other VPCs can access it via private IPs without needing VPC peering. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows a producer to publish a service via a private endpoint that consumers can access from their own VPCs without peering.

Answer

VPC peering

Answer

Cloud VPN

Answer

Cloud NAT

Question 12

An organization needs to protect a web application behind an HTTPS Load Balancer from SQL injection attacks. They want to use a managed WAF solution. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities including preconfigured rules for SQL injection (OWASP) and custom rules.

Answer

VPC Service Controls

Answer

Cloud Firewall Rules

Answer

Cloud CDN

Question 13

An engineer needs to configure DNS resolution for a Compute Engine instance named "web-1" in zone us-central1-a of project my-project. What is the internal DNS name for this instance?

Accepted Answer

web-1.us-central1-a.c.my-project.internal. GCP internal DNS uses the format: [instance name].[zone].c.[project id].internal

Answer

web-1.us-central1.c.my-project.internal

Answer

web-1.c.my-project.us-central1-a.internal

Answer

web-1.us-central1-a.my-project.internal

Question 14

A Compute Engine instance has multiple network interfaces. Which interface is considered the primary (NIC0)?

Accepted Answer

The interface with the lowest index number (nic0).. By default, the first interface attached (nic0) is the primary interface and used for default routes and internal DNS.

Answer

The interface configured first in the instance creation.

Answer

The interface with the highest index number.

Answer

All interfaces are primary.

Question 15

A company wants to restrict access to Google Cloud Storage so that only traffic originating from a specific VPC network is allowed. They also need to prevent data exfiltration to other VPCs. Which two services should they use? (Choose two.)

Accepted Answer

VPC Service Controls. VPC Service Controls creates a service perimeter around the Storage API, and Private Google Access enables VMs without external IPs to access Google APIs from within the VPC.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Firewall rules