PCNE Implementing VPC Instances Practice Test 3 — 15 Questions

Question 1

An engineer needs to provide outbound internet access to Compute Engine instances that do not have external IP addresses. The solution must allow instances to access a specific set of external IPs only. What should the engineer configure?

Accepted Answer

Create a Cloud NAT gateway and configure firewall egress rules to allow traffic only to the specific IPs.. Cloud NAT with firewall rules can restrict outbound traffic to specific destinations. By default, Cloud NAT uses the instance's network tags and firewall egress rules to control traffic. The engineer can create an egress deny rule with higher priority for all destinations, then an egress allow rule for the specific IPs.

Answer

Use Private Google Access only, which provides access to Google APIs and services.

Answer

Assign external IPs to instances and use firewall rules to restrict outbound traffic.

Answer

Deploy a NAT instance with iptables rules to restrict destination IPs.

Question 2

You need to configure firewall rules to allow HTTP (TCP 80) traffic from the internet to instances in a VPC. The instances are in different subnets and have a network tag 'web-server'. You want to minimize the number of rules. Which rule configuration is correct?

Accepted Answer

Create an ingress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.. Firewall rules are global, so one ingress rule can apply to all instances with the tag 'web-server' regardless of subnet. The direction must be ingress, source 0.0.0.0/0, protocol tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule with source 0.0.0.0/0, protocol tcp:0-65535, and target tags 'web-server'.

Answer

Create an egress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule for each subnet with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Question 3

An organization has two VPCs in the same project: VPC-A and VPC-B. They want instances in VPC-A to reach Cloud Storage buckets without external IPs. What is the simplest solution?

Accepted Answer

Enable Private Google Access on the subnets in VPC-A.. Private Google Access enables instances without external IPs to reach Google API endpoints (including Cloud Storage) via the private IP range. The feature is enabled per subnet, so enabling it on subnets in VPC-A allows those instances to access Cloud Storage.

Answer

Create a Cloud NAT gateway in VPC-A and configure firewall rules to allow traffic to Cloud Storage.

Answer

Peer VPC-A with VPC-B and enable Private Google Access on VPC-B.

Answer

Assign external IPs to the instances in VPC-A.

Question 4

A company uses hierarchical firewall policies at the organization level. They need to allow SSH (TCP 22) access from a specific range 10.0.0.0/8 to all VMs, but a child folder has a policy that denies all ingress traffic. Which rule priority ordering ensures SSH access is allowed?

Accepted Answer

Organization allow rule priority 100, folder deny rule priority 200.. Hierarchical firewall rules have priorities; higher priority (lower number) wins. To override a deny-all, the allow rule must have a lower priority number than the deny rule. The organization policy can have a lower priority than the folder policy, but the folder's deny-all would block. The organization's allow rule must have higher priority (lower number) than the folder's deny rule.

Answer

Folder allow rule priority 100, folder deny rule priority 200.

Answer

Remove the folder deny rule and use network firewall rules.

Answer

Organization allow rule priority 200, folder deny rule priority 100.

Question 5

Your VPC has instances with internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. You need to ensure that DNS resolution works for instances in the same zone using short names (e.g., 'instance1'). Which condition must be met?

Accepted Answer

The instances must be in the same zone and VPC network.. Google Cloud internal DNS automatically resolves short names for instances within the same zone and network. The instance must be in the same zone and VPC network. No additional configuration is needed as long as instances are in the same zone.

Answer

Custom DNS must be configured via Cloud DNS.

Answer

The VPC must have Private Google Access enabled.

Answer

The instance must have a network tag 'dns-enabled'.

Question 6

You are deploying a third-party network appliance (e.g., firewall) in a GCP VPC. The appliance requires multiple network interfaces for traffic isolation. You create a VM with three NICs in different subnets. What is a key consideration for routing traffic through the appliance?

Accepted Answer

Custom routes must be created to direct traffic to a specific NIC using the VM's IP as next hop.. Each NIC in a multi-NIC VM is assigned to a different subnet. By default, the VM only sends traffic out of the NIC that matches the destination subnet's route. To route traffic through a specific NIC, custom routes with next hop set to the VM's IP on that NIC are required.

Answer

The VM must have an external IP on each NIC.

Answer

The VM must have IP forwarding disabled.

Answer

All NICs must be in the same subnet.

Question 7

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

Accepted Answer

Cloud Armor. Cloud Armor provides Web Application Firewall (WAF) capabilities, including preconfigured rules to detect and block SQLi and XSS attacks. It attaches to HTTPS Load Balancers.

Answer

Firewall Rules

Answer

Cloud IDS

Answer

VPC Service Controls

Question 8

An organization wants to prevent data exfiltration from a project that uses Google Cloud Storage and BigQuery. They need to restrict access to these services from only the authorized VPC networks. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow creating a service perimeter around GCP services (like Cloud Storage and BigQuery) to restrict data access to only authorized VPCs and projects. This prevents data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

Cloud Armor

Question 9

You have a Cloud NAT gateway configured in a region with 256 available ports. You allocate static NAT ports to a specific VM for outbound connections. What is the minimum number of ports you should allocate to ensure the VM can handle 500 concurrent connections?

Accepted Answer

512. Cloud NAT uses ports for source NAT. A single connection uses one port. To support 500 concurrent connections, you need at least 500 ports. However, Cloud NAT allows port sharing for the same destination IP and port, but static port allocation per VM typically reserves ports exclusively. To be safe, allocate at least 500 ports.

Answer

128

Answer

256

Answer

64

Question 10

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the return route via BGP, causing asymmetric routing.. For asymmetric routing, GCP may drop return traffic if it does not match the forwarding route. Cloud VPN supports dynamic routing (BGP) which advertises the on-premises prefix. However, if the on-premises router forwards return traffic through a different path (e.g., internet), GCP's firewall drops it because the return packet does not come via the VPN tunnel (asymmetric).

Answer

The Cloud VPN tunnel is down.

Answer

The MTU is set to 1500 on the VPN tunnel.

Answer

The instance's firewall is blocking ICMP.

Question 11

A company wants to publish an internal service (e.g., a database) in their VPC so that consumers in other VPCs can connect to it privately via Private Service Connect (PSC). What must be created on the producer side?

Accepted Answer

A Service Attachment that exposes the service.. Private Service Connect allows producers to publish services via a Service Attachment. The service attachment is created on a Network Endpoint Group (NEG) that points to the internal service (e.g., a backend service). Consumers then create PSC endpoints to connect.

Answer

A Cloud VPN tunnel to the consumer VPC.

Answer

A VPC peering connection.

Answer

A Private Service Connect endpoint in the producer VPC.

Question 12

Which statement about Cloud Armor security policies is true?

Accepted Answer

They support both allow and deny actions for incoming requests.. Cloud Armor security policies can be attached to HTTPS Load Balancers. They support rules with conditions like IP addresses, geographic regions, and preconfigured WAF rules. They also support rate limiting.

Answer

They can be attached to any GCP resource, including Compute Engine instances.

Answer

They are evaluated after the firewall rules.

Answer

They cannot be used with internal load balancers.

Question 13

You need to allow instances with network tag 'db' in subnet-a to only accept connections on TCP port 3306 from instances with network tag 'app' in subnet-b. Which TWO firewall rules should you create? (Choose 2)

Accepted Answer

Ingress rule: target tag 'db', source tag 'app', allow tcp:3306, priority 1000.. The correct approach is to create an ingress rule on subnet-a targeting 'db' tags, allowing TCP 3306 from source tag 'app' (which implies source instances with that tag). Alternatively, an egress rule on subnet-b could allow traffic to 'db' instances. However, the typical solution is ingress rule on the target. The options require two rules to ensure only 'app' instances can connect to 'db' and also block other sources.

Answer

Egress rule: target tag 'app', destination tag 'db', allow tcp:3306, priority 1000.

Answer

Ingress rule: target tag 'db', source 0.0.0.0/0, deny tcp:3306, priority 2000.

Answer

Ingress rule: target tag 'db', source tag 'app', deny tcp:3306, priority 1000.

Answer

Ingress rule: target tag 'db', source 0.0.0.0/0, deny all ports, priority 500.

Question 14

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Accepted Answer

Service perimeter. VPC Service Controls perimeters require: 1) A service perimeter that includes the project and services, 2) Access levels that define allowed client attributes (e.g., IP addresses, device policy), and 3) VPC accessible services configuration to restrict access to only requests originating from specified VPC networks. Ingress rules are optional for allowing access from outside the perimeter.

Answer

Cloud NAT gateway

Answer

Private Google Access

Question 15

An engineer needs to deploy a VM that acts as a internet gateway for other instances in the same VPC. The VM must have IP forwarding enabled and must be able to accept traffic on multiple NICs. Which TWO actions are required? (Choose 2)

Accepted Answer

Create firewall rules to allow traffic to the VM's NICs.. To use a VM as a gateway, IP forwarding must be enabled on the VM. Additionally, firewall rules must allow ingress traffic to the VM's NICs that will forward traffic. The VM itself must have routes pointing to it as next hop.

Answer

Disable the VM's source/destination check.

Answer

Create a Cloud NAT gateway.

Answer

Assign an external IP to each NIC.