PCNE Implementing VPC Instances Practice Test 3 — 15 Questions

Question 1

What is the internal DNS name format for a Compute Engine instance named 'web-server' in the 'us-central1-a' zone within the project 'my-project'?

Accepted Answer

web-server.us-central1-a.c.my-project.internal. Compute Engine instances get an internal DNS name in the format: [instance_name].[zone].c.[project_id].internal. For example, web-server.us-central1-a.c.my-project.internal.

Answer

web-server.c.my-project.internal

Answer

web-server.us-central1.internal

Answer

web-server.my-project.internal

Question 2

A company wants to restrict access to Google Cloud Storage from a specific VPC only, using VPC Service Controls. Which TWO components are required to create a service perimeter? (Choose two.)

Accepted Answer

A VPC accessible service configuration. Option A is correct because a VPC Service Controls service perimeter must be built around at least one VPC accessible service configuration, which defines the Google Cloud services (such as Cloud Storage) that the perimeter will restrict. Option E is correct because a perimeter must include the set of projects whose resources are protected by the perimeter; without specifying protected projects, the perimeter has no scope to enforce. Option B is not required: Private Google Access affects how VM instances reach Google APIs internally, but it is not a component of a service perimeter. Option C is not required to create the perimeter itself; access levels are optional and only used when granting controlled access from outside the perimeter. Option D is not a separate required component, since restricted services are already captured by the VPC accessible service configuration in option A.

Answer

A VPC network with Private Google Access enabled

Answer

An access level

Answer

A list of allowed APIs (restricted services)

Question 3

A company uses Cloud NAT for outbound internet access. They want to ensure that all connections from their VMs use a predictable public IP address for whitelisting with third-party services. Which TWO configurations should be applied? (Choose two.)

Accepted Answer

Reserve and assign static external IP addresses to the Cloud NAT gateway. To ensure a predictable public IP address for whitelisting, you must manually reserve static external IP addresses and assign them to the Cloud NAT gateway. This guarantees that all outbound traffic uses those specific IPs. Option C (logging) does not affect the IP address used; it only provides visibility, so it does not help ensure predictability. Therefore, the correct answer is D only.

Answer

Assign external IPs to each VM and disable Cloud NAT

Answer

Use dynamic NAT IP addresses assigned automatically by Cloud NAT

Answer

Enable Cloud NAT logging to monitor traffic

Answer

Use Private Google Access instead of Cloud NAT

Question 4

An engineer needs to provide outbound internet access to a set of Compute Engine instances that do not have external IP addresses. The instances are in a VPC subnet with a Cloud NAT configured. However, the instances still cannot reach the internet. The engineer verified that Cloud NAT is configured on the same region and VPC as the instances. What is the most likely cause?

Accepted Answer

The instances are not tagged with the correct network tag used in the Cloud NAT configuration. Cloud NAT requires the instances to have the 'allow NAT' network tag or service account configured in the NAT gateway rules. If the instances are not tagged or the service account is not specified, traffic is not forwarded.

Answer

The firewall rules block all outbound traffic from the subnet

Answer

The instances are using a custom network that does not support Cloud NAT

Answer

The Cloud NAT gateway uses dynamic port allocation, which is disabled

Question 5

A network engineer configured a hierarchical firewall policy at the organization level with a priority 100 rule that denies all ingress traffic. At the folder level, a policy with priority 110 allows ingress from a specific IP range. At the VPC level, a network firewall policy with priority 90 allows ingress from a different IP range. Which traffic will be allowed?

Accepted Answer

Only traffic matching the VPC-level allow rule. Hierarchical firewall policies are evaluated in order of priority (lower number = higher priority) and then network firewall policies. The org-level rule with priority 100 denies all ingress. The folder-level rule with priority 110 allows specific IPs, but since the org rule has higher priority, it overrides the folder rule. The VPC-level network firewall policy is evaluated after hierarchical policies and has priority 90, which is lower than 100, so it would override the org rule. However, hierarchical policies are evaluated before network firewall policies only if they have higher priority. Here, the VPC policy has priority 90, which is lower than 100, so it takes precedence over the org-level deny. Thus, traffic matching the VPC policy's allowed IP range is allowed.

Answer

Traffic matching either the folder-level or VPC-level allow rules

Answer

Only traffic matching the folder-level allow rule

Answer

No traffic is allowed because the org-level deny is evaluated last

Question 6

A company wants to protect its HTTP(S) Load Balancer from layer 7 attacks, including SQL injection and cross-site scripting (XSS). Which TWO Google Cloud services or features should be used together? (Choose TWO.)

Accepted Answer

HTTPS Load Balancer. Option A, HTTPS Load Balancer, is correct because it is the external Application Load Balancer that terminates HTTP(S) traffic and provides the layer 7 entry point where security policies can be attached; Cloud Armor security policies are enforced on backend services of this load balancer. Option D, Cloud Armor, is correct because it provides WAF capabilities at layer 7, including preconfigured rules for SQL injection (sqli-v33-stable) and cross-site scripting (xss-v33-stable) that inspect and block malicious HTTP requests. Together, the HTTPS Load Balancer routes traffic and Cloud Armor filters it, forming the standard Google Cloud solution for protecting web applications from OWASP-style layer 7 attacks. Option B, Cloud CDN, is not correct because it caches content at the edge to improve performance and does not itself provide SQLi/XSS attack mitigation. Option C, VPC Service Controls, is not correct because it creates security perimeters around Google Cloud APIs and services to prevent data exfiltration, not to inspect HTTP application payloads. Option E, Identity-Aware Proxy (IAP), is not correct because it enforces user authentication and authorization for access to applications, not signature-based detection of SQL injection or XSS.

Answer

Cloud CDN

Answer

VPC Service Controls

Answer

Identity-Aware Proxy (IAP)

Question 7

A security team needs to block traffic from a specific geographic region (country) from reaching their HTTP Load Balancer. Additionally, they need to allow traffic from specific IP ranges that are known to be legitimate, even if they originate from that blocked region. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Attach the security policy to the backend service of the HTTPS Load Balancer. Option B is correct because Cloud Armor security policies are the Google Cloud mechanism for filtering HTTP(S) Load Balancer traffic by geographic origin, using a rule with the expression origin.region_code == 'XX' and a deny action. Option D is correct because Cloud Armor evaluates rules by priority (lowest number = highest priority), so an allow rule with a lower priority number than the country-deny rule ensures the legitimate IP ranges are permitted even though they originate in the blocked region. Option A is correct because a Cloud Armor security policy must be attached to the backend service of the HTTPS Load Balancer for the rules to take effect on that traffic. Option C is not correct because VPC firewall rules operate at the network level and cannot match on a client's country/geographic region. Option E is not correct because VPC Service Controls define a service perimeter around Google Cloud APIs and resources to prevent data exfiltration, not to block geographic client traffic to a load balancer.

Answer

Add a firewall rule in the VPC to deny traffic from the country

Answer

Use VPC Service Controls to restrict access from the country

Question 8

A company has a VPC with subnets in us-central1 and europe-west1. They need to allow Compute Engine instances in us-central1 (without external IPs) to access Google Cloud Storage buckets in the US multi-region. They also need to ensure the traffic does not traverse the public internet. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Ensure the instances have a service account with permissions to access Cloud Storage. Option E is correct because Private Google Access must be enabled on the subnet in us-central1 so that instances without external IP addresses can reach Google APIs and services such as Cloud Storage using internal routing rather than the public internet. Option C is correct because the instances still need a service account with appropriate IAM permissions (for example, roles/storage.objectViewer or roles/storage.admin) to authenticate and be authorized to access the Cloud Storage buckets. Option A is not required here because private.googleapis.com or restricted.googleapis.com DNS configurations are used for Private Service Connect or VPC Service Controls scenarios, not for basic Private Google Access to Cloud Storage. Option B is incorrect because a firewall rule allowing egress to 0.0.0.0/0 would permit public internet egress and does not ensure private-only access. Option D is incorrect because Cloud NAT provides outbound internet access for instances without external IPs, which is the opposite of the requirement that traffic not traverse the public internet.

Answer

Use the private DNS zone for googleapis.com with the restricted.googleapis.com IP addresses

Answer

Configure a firewall rule allowing egress to 0.0.0.0/0

Answer

Create a Cloud NAT gateway in us-central1

Question 9

An engineer needs to configure Cloud NAT with logging enabled to monitor traffic from a specific subnet. The NAT gateway uses automatic NAT IP allocation. The engineer wants to ensure that if a single VM uses many connections, it does not exhaust the available ports for other VMs. Which THREE settings should be configured? (Choose THREE.)

Accepted Answer

Set the minimum ports per VM to a reasonable value. Option A is correct because setting the minimum ports per VM reserves a baseline number of source ports for each VM, which prevents a single VM from consuming all available ports and starving other VMs. Option E is correct because setting the maximum ports per VM caps how many ports any one VM can consume, directly preventing a single VM with many connections from exhausting the shared port pool. Option B is correct because the scenario requires the NAT gateway to use automatic NAT IP allocation, so the engineer must set NAT IP allocation to manual to control and specify the NAT IP addresses rather than letting Cloud NAT auto-allocate them. Option C is not one of the required settings for port-exhaustion prevention; logging is a monitoring feature and does not control port allocation. Option D is not required because endpoint-independent mapping affects how NAT maps endpoints for inbound consistency, not the per-VM port limits that prevent port exhaustion.

Answer

Enable logging on the NAT gateway

Answer

Enable endpoint-independent mapping

Question 10

A company wants to allow traffic to a specific set of Compute Engine instances only from a single management instance that uses a service account. The management instance has the service account 'sa-mgmt@project.iam.gserviceaccount.com'. Which TWO firewall rule configurations can achieve this? (Choose TWO.)

Accepted Answer

Set the source IP range to the internal IP of the management instance. Option A is correct because a VPC firewall rule can restrict ingress by source IPv4 range, so setting the source range to the management instance's internal IP (/32) allows only traffic originating from that instance to reach the target instances. Option B is correct because Google Cloud firewall rules support a source service account filter; specifying 'sa-mgmt@project.iam.gserviceaccount.com' permits ingress only from instances running as that service account, which matches the management instance's identity. Option C is incorrect because priority 65535 is the lowest priority (evaluated last) and does not by itself restrict traffic to the management instance. Option D is incorrect because target tags identify the destination instances receiving traffic, not the source; tagging the management instance with 'mgmt' would not limit which instances can send traffic. Option E is incorrect because the target of an ingress rule defines the destination instances (via target tags or target service accounts), not the allowed source, so setting the target to the management service account would not filter by source.

Answer

Set the priority to 65535 to ensure it is evaluated last

Answer

Set the target tags to 'mgmt' and assign that tag to the management instance

Answer

Set the target of the rule to the service account 'sa-mgmt@project.iam.gserviceaccount.com'

Question 11

A network engineer is deploying a Compute Engine VM that will act as an inline next-hop appliance between two subnets in the same VPC. The VM has two network interfaces (nic0 and nic1), each in a different subnet. After creating the instance, the engineer notices that traffic arriving on nic1 is never processed by the appliance software. Which setting must be enabled on the instance so the guest OS can receive packets destined to IP addresses other than its own?

Accepted Answer

Configure the guest OS network interface to operate in promiscuous mode.. An inline appliance must accept traffic addressed to other hosts, which requires the guest OS NIC to be in promiscuous mode. Google Cloud forwards the packets to the instance, but the default NIC driver discards frames whose destination MAC or IP is not the instance's own. Enabling promiscuous mode on the secondary interface allows the appliance software to receive and process the transit traffic.

Answer

Add a static route for the peer subnet with the appliance as its next hop.

Answer

Enable IP forwarding (can_ip_forward) on the instance.

Answer

Set the subnet's purpose to PRIVATE and enable Private Google Access.

Question 12

A retail company runs a three-tier application in a single VPC network. The web tier consists of Compute Engine instances in subnet 'web-subnet' (10.0.1.0/24) and the database tier runs in 'db-subnet' (10.0.2.0/24). Security policy requires that the database instances accept connections on TCP port 3306 only from the web tier, and must never be reachable from any other source, including other subnets in the same VPC. The engineer plans to create an ingress firewall rule. Which configuration should the engineer use?

Accepted Answer

Create an ingress rule with action allow, target tags 'db-server', source IPv4 ranges 10.0.1.0/24, protocol tcp and port 3306.. The rule must be scoped on both axes: the target tag 'db-server' selects which instances the rule applies to, and the source IPv4 range must be exactly the web subnet 10.0.1.0/24. Because VPC firewall rules are stateful and deny by default, only the intended web-to-database flow is allowed on TCP 3306, and all other sources are implicitly blocked.

Answer

Create an ingress rule with action allow, target service accounts 'db-sa', source IPv4 ranges 10.0.1.0/24, protocol tcp and port 3306.

Answer

Create an ingress rule with action allow, target tags 'db-server', source IPv4 ranges 0.0.0.0/0, protocol tcp and port 3306.

Answer

Create an ingress rule with action allow, target tags 'db-server', source IPv4 ranges 10.0.0.0/16, protocol tcp and port 3306.

Question 13

A Compute Engine instance in a VPC network needs to resolve internal DNS names for other instances in the same VPC. The instance has no external IP address. Which of the following must be true to allow internal DNS resolution?

Accepted Answer

The VPC network must have internal DNS enabled, which is the default for new VPCs.. Internal DNS resolution within a VPC relies on the VPC network's internal DNS setting, which is enabled by default. Instances automatically use the metadata server as their DNS resolver, so no manual configuration is needed. Private Google Access and network tags are unrelated to internal DNS resolution for instances within the same VPC.

Answer

The VPC network must have private Google access enabled.

Answer

The instance must have the 'allow-internal-dns' network tag.

Answer

The instance must be configured to use the metadata server for DNS.

Question 14

A Cloud Network Engineer is deploying a managed network appliance on Compute Engine in VPC `prod-vpc`. The appliance must inspect and route traffic between workload subnets in the same VPC, and it must also accept incoming traffic from the internet. The subnet `appliance-subnet` has IP forwarding enabled at the subnet level. Which additional configuration must the engineer apply to the appliance instances themselves for them to forward traffic not addressed to their own IP addresses?

Accepted Answer

Enable IP forwarding on each appliance VM instance (can_ip_forward).. Compute Engine applies two separate IP forwarding controls: a subnet-level flag that permits a VM to send packets with a non-self source address, and an instance-level flag (can_ip_forward) that permits the VM to receive and forward packets not addressed to itself. For a network appliance to route traffic between subnets or from the internet, the instance-level flag must be enabled on each appliance VM.

Answer

Add the appliance instances to a managed instance group with autoscaling enabled.

Answer

Assign a public (external) IP address to each appliance network interface.

Answer

Create a route in prod-vpc that points to the appliance's external IP address as the next hop.

Question 15

A network engineer needs to attach multiple network interfaces to a single Compute Engine VM to build a multi-NIC appliance that inspects traffic between several subnets. The interfaces must reside in the same VPC network. Which TWO considerations are correct when planning this deployment? (Choose two.)

Accepted Answer

The routing and firewall behavior for each interface depends on the VPC network and subnet it belongs to, so policy must be defined per interface.. When building a multi-NIC appliance, each interface must occupy a distinct subnet, and if the interfaces are in the same VPC they must use different subnets within it. Routing and firewall enforcement is per interface, based on the VPC and subnet each vNIC belongs to, so policy must be planned per interface to ensure inspection and forwarding work correctly.

Answer

The VM can have interfaces in different VPC networks without any additional configuration or routing.

Answer

All network interfaces on the VM must share a single IP address to simplify routing.

Answer

Secondary interfaces automatically receive external IP addresses when the primary interface does.