PCNE Implementing VPC Instances Practice Test 2 — 15 Questions

Question 1

A company has Compute Engine instances without external IPs in a VPC. They need to reach Google APIs such as Cloud Storage and BigQuery. Which configuration will meet this requirement with minimal cost and operational overhead?

Accepted Answer

Configure the subnet to have Private Google Access enabled. Ensure the instances have the appropriate DNS resolution for private.googleapis.com.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs via the default internet gateway or VPC peering. Configuring a Private Google Access enabled subnet is the simplest and cheapest option, as it does not require NAT or additional instances.

Answer

Set up a Squid proxy on a bastion host with an external IP and route all API traffic through it.

Answer

Create a Cloud NAT gateway in the same region and attach it to the VPC.

Answer

Assign external IPs to the instances and create firewall rules to allow traffic to Google APIs.

Question 2

A network engineer wants to restrict access to a Cloud Storage bucket from only a specific set of Compute Engine instances in a VPC. The instances have no external IPs. What is the most effective way to enforce this restriction?

Accepted Answer

Enable Private Google Access on the subnet and use VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. Using Private Google Access with Private Service Connect allows instances to reach Google APIs via internal IPs. By using VPC Service Controls, you can create a service perimeter that restricts access to the Cloud Storage bucket from the specific VPC and projects. This provides a defense-in-depth approach.

Answer

Assign a unique service account to the instances and use IAM conditions to allow the service account access to the bucket only when connecting from the VPC network.

Answer

Configure a firewall rule that allows egress traffic to the Cloud Storage API only from the instances' subnet.

Answer

Create an IAM condition that restricts access based on the instance's internal IP address range.

Question 3

A company wants to protect its HTTP(S) Load Balancer against DDoS attacks and common web exploits like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google's web application firewall (WAF) and DDoS protection service. It integrates with Cloud Load Balancing to provide security policies that inspect traffic and block attacks like SQLi and XSS using pre-configured WAF rules.

Answer

VPC Service Controls

Answer

Firewall Rules

Answer

Cloud NAT

Question 4

An organization has multiple VPCs in different projects that need to consume a common internal service hosted in a central project. The service runs on a set of Compute Engine instances with internal IPs. Which architecture allows the consumers to access the service using private IPs without VPC peering?

Accepted Answer

Create a Private Service Connect endpoint in each consumer VPC and publish the service as a Private Service Connect service from the central project.. Private Service Connect allows you to publish internal services via Private Service Connect endpoints in consumer VPCs. Consumers access the service using internal IPs without needing VPC peering or VPNs. This is the recommended architecture for publishing and consuming internal services across projects.

Answer

Use Cloud VPN to connect each consumer VPC to the central VPC.

Answer

Expose the service through an external IP and use IAM to restrict access.

Answer

Set up VPC peering between each consumer VPC and the central VPC.

Question 5

A company has a VPC with a subnet in us-central1. Compute Engine instances in that subnet have no external IPs but need to reach the internet for software updates. The engineer configured Cloud NAT with the default settings. However, instances fail to reach the internet. What is the most likely cause?

Accepted Answer

An egress firewall rule is missing that allows traffic from the instances to the internet via NAT.. Cloud NAT requires that the instances are allowed egress traffic to the internet. Without a suitable egress firewall rule, NAT traffic is blocked. The default firewall rules only allow egress to Google APIs (private.googleapis.com) but not to general internet destinations. A firewall rule allowing egress to 0.0.0.0/0 on the appropriate ports is required.

Answer

Cloud NAT is not configured in the correct region.

Answer

Private Google Access is enabled on the subnet, which overrides Cloud NAT.

Answer

The Cloud NAT router is not attached to the correct VPC network.

Question 6

A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?

Accepted Answer

Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.. Firewall rules are evaluated in order of priority (lower number = higher priority). The deny rule at priority 1000 will deny all IPs. To allow the VPN IP, a higher priority (lower number) allow rule must be created for that specific IP, before the deny rule is evaluated. The correct approach is to create an allow rule with priority 100 (or any lower number) for source IP 203.0.0.0/8 (or the specific IP) targeting web-server.

Answer

Modify the existing deny rule to include an exception for the VPN IP in the source IP field.

Answer

Delete the deny rule and create a single rule that denies all IPs except the VPN IP using the 'except' option.

Answer

Change the priority of the existing deny rule to 1 and create an allow rule with priority 2 for the VPN IP.

Question 7

A company wants to ensure that Compute Engine instances in a VPC can resolve internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. What is required for this to work?

Accepted Answer

No additional configuration is required; internal DNS resolution works by default.. Google Cloud provides internal DNS resolution for instances within the same VPC network. By default, instances can resolve DNS names for other instances in the same VPC if they are in the same network. There is no additional setup needed; it works out of the box. The DNS name format is [vm-name].[zone].c.[project-id].internal.

Answer

Assign a custom DNS server to the VPC using Cloud DNS inbound server policy.

Answer

Configure a DNS managed zone in Cloud DNS.

Answer

Enable Private Google Access on the subnet.

Question 8

A company has deployed a network appliance (e.g., firewall) as a Compute Engine instance with two NICs: NIC0 for management and NIC1 for data traffic. The appliance must forward traffic from instances in subnet A to subnet B. The engineer has enabled IP forwarding on the appliance. What additional configuration is required on the VPC for the appliance to route traffic between subnets?

Accepted Answer

Create a route in the VPC with destination subnet B and next hop set to the appliance's internal IP address.. For a Compute Engine instance to forward traffic between subnets, it must act as a router. The VPC needs a custom route that sends traffic destined for subnet B to the appliance's IP (or NIC) as the next hop. Without this route, the VPC's default routing will deliver traffic directly between subnets, bypassing the appliance. Also, the appliance's NIC1 must be in the same VPC and the firewall rules must allow the traffic.

Answer

Configure the appliance's guest OS to enable packet forwarding by setting net.ipv4.ip_forward=1.

Answer

Create a firewall rule allowing egress from the appliance to both subnets.

Answer

Attach the appliance to a Cloud Router and configure BGP sessions.

Question 9

A company wants to apply consistent firewall rules across all projects in an organization. They need to block all traffic to ports 22 and 3389 from the internet to any VMs in any project. Which approach is most scalable and maintainable?

Accepted Answer

Use a hierarchical firewall policy at the organization level with deny rules for ports 22 and 3389 from 0.0.0.0/0.. Hierarchical firewall policies allow you to define firewall rules at the organization or folder level that apply to all VPCs under that node. This ensures consistency and avoids duplication across projects. The policy is evaluated before VPC firewall rules.

Answer

Configure OS-level firewall on each VM using startup scripts.

Answer

Use Cloud Armor security policies attached to load balancers.

Answer

Create a VPC firewall rule in each project's VPC.

Question 10

A developer is configuring a Compute Engine VM to host a web server. They want to ensure that only HTTP (port 80) and HTTPS (port 443) traffic from the internet is allowed. Which firewall rule should they create?

Accepted Answer

Ingress allow rule for TCP ports 80 and 443 from 0.0.0.0/0.. For web server traffic, you need ingress rules that allow TCP on ports 80 and 443 from source 0.0.0.0/0. The target should be the VM (by tag or service account). A single rule can specify multiple ports.

Answer

Egress allow rule for TCP ports 80 and 443 to 0.0.0.0/0.

Answer

Ingress deny rule for all ports except 80 and 443.

Answer

Egress deny rule for all ports.

Question 11

A company is using Cloud NAT to provide outbound internet access for instances without external IPs. They notice that the NAT gateway is running out of ports for connections to a single external IP address. To minimize port exhaustion, what should the engineer configure?

Accepted Answer

Increase the number of NAT IP addresses assigned to the Cloud NAT gateway.. Cloud NAT uses NAT IP addresses and ports. To increase capacity for connections to a single destination IP, you can either allocate more NAT IP addresses (which increases the number of ports) or use dynamic port allocation. Static port allocation is used for endpoints that require predictable source ports. For minimizing exhaustion, adding more NAT IPs is the direct solution.

Answer

Change the NAT port allocation to static.

Answer

Reduce the endpoint-independent mapping timeout.

Answer

Enable Cloud NAT logging to diagnose the issue.

Question 12

An organization needs to prevent exfiltration of data from a Cloud Storage bucket to external IPs. The bucket is accessed by Compute Engine instances in a VPC. The instances need to read and write data to the bucket but should not be able to copy data to external networks. Which combination of controls meets this requirement?

Accepted Answer

Configure VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. VPC Service Controls create a service perimeter that restricts data movement between Google services and external networks. Within the perimeter, data can flow between authorized services. IAM conditions can further restrict access based on context. This is the primary method to prevent data exfiltration from Google Cloud-managed services.

Answer

Use Cloud Armor with a WAF rule to block outbound traffic.

Answer

Set up Private Google Access and restrict IAM permissions to the bucket.

Answer

Use Cloud NAT with a firewall rule that denies all egress except to Google APIs.

Question 13

A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?

Accepted Answer

IAM conditions on the bucket. VPC Service Controls can restrict access to Google APIs to only specified VPCs and projects, creating a service perimeter. IAM conditions can further restrict access based on the caller's service account. This combination ensures that only instances with the correct service account in the correct VPC can access the bucket.

Answer

Hierarchical firewall policy

Answer

Cloud Armor

Answer

Cloud NAT

Question 14

A company has an HTTP Load Balancer that distributes traffic to a backend service consisting of Compute Engine instance groups. They need to block traffic from specific geographic regions and also rate-limit requests from any IP. Which THREE Cloud Armor features should they configure?

Accepted Answer

Rate limiting rules. Cloud Armor security policies allow you to create rules with conditions. To block regions, use geoblocking by specifying source regions. To rate-limit, use rate limiting rules. Custom rules can also be used to combine conditions. Pre-configured WAF rules (like XSS, SQLi) are for web application attacks, not region blocking or rate limiting.

Answer

Cloud Armor logging

Answer

Pre-configured WAF rules (e.g., OWASP Top 10)

Question 15

An organization wants to publish an internal web service running on Compute Engine to consumers in different VPCs. The service must be accessible via private IPs without VPC peering. Which THREE components are required to set this up using Private Service Connect?

Accepted Answer

A service attachment in the producer VPC that points to a load balancer. Private Service Connect requires a service producer to create a service attachment (which uses a load balancer as the backend), and consumers to create Private Service Connect endpoints. The producer must also enable Private Service Connect on the subnet where the load balancer resides.

Answer

VPC peering between producer and consumer VPCs

Answer

A Cloud NAT gateway in the producer VPC