PCNE Implementing VPC Instances Practice Test 3 — 15 Questions

Question 1

A company has an HTTP Load Balancer that distributes traffic to a backend service consisting of Compute Engine instance groups. They need to block traffic from specific geographic regions and also rate-limit requests from any IP. Which THREE Cloud Armor features should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rate limiting rules. Cloud Armor security policies allow you to create rules with conditions. To block regions, use geoblocking by specifying source regions. To rate-limit, use rate limiting rules. Custom rules can also be used to combine conditions. Pre-configured WAF rules (like XSS, SQLi) are for web application attacks, not region blocking or rate limiting.

Answer

Cloud Armor logging

Answer

Pre-configured WAF rules (e.g., OWASP Top 10)

Question 2

An organization wants to publish an internal web service running on Compute Engine to consumers in different VPCs. The service must be accessible via private IPs without VPC peering. Which THREE components are required to set this up using Private Service Connect?

Accepted Answer

A service attachment in the producer VPC that points to a load balancer. Private Service Connect requires a service producer to create a service attachment (which uses a load balancer as the backend), and consumers to create Private Service Connect endpoints. The producer must also enable Private Service Connect on the subnet where the load balancer resides.

Answer

VPC peering between producer and consumer VPCs

Answer

A Cloud NAT gateway in the producer VPC

Question 3

An engineer needs to provide outbound internet access to Compute Engine instances that do not have external IP addresses. The solution must allow instances to access a specific set of external IPs only. What should the engineer configure?

Accepted Answer

Create a Cloud NAT gateway and configure firewall egress rules to allow traffic only to the specific IPs.. Cloud NAT with firewall rules can restrict outbound traffic to specific destinations. By default, Cloud NAT uses the instance's network tags and firewall egress rules to control traffic. The engineer can create an egress deny rule with higher priority for all destinations, then an egress allow rule for the specific IPs.

Answer

Use Private Google Access only, which provides access to Google APIs and services.

Answer

Assign external IPs to instances and use firewall rules to restrict outbound traffic.

Answer

Deploy a NAT instance with iptables rules to restrict destination IPs.

Question 4

You need to configure firewall rules to allow HTTP (TCP 80) traffic from the internet to instances in a VPC. The instances are in different subnets and have a network tag 'web-server'. You want to minimize the number of rules. Which rule configuration is correct?

Accepted Answer

Create an ingress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.. Firewall rules are global, so one ingress rule can apply to all instances with the tag 'web-server' regardless of subnet. The direction must be ingress, source 0.0.0.0/0, protocol tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule with source 0.0.0.0/0, protocol tcp:0-65535, and target tags 'web-server'.

Answer

Create an egress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule for each subnet with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Question 5

An organization has two VPCs in the same project: VPC-A and VPC-B. They want instances in VPC-A to reach Cloud Storage buckets without external IPs. What is the simplest solution?

Accepted Answer

Enable Private Google Access on the subnets in VPC-A.. Private Google Access enables instances without external IPs to reach Google API endpoints (including Cloud Storage) via the private IP range. The feature is enabled per subnet, so enabling it on subnets in VPC-A allows those instances to access Cloud Storage.

Answer

Create a Cloud NAT gateway in VPC-A and configure firewall rules to allow traffic to Cloud Storage.

Answer

Peer VPC-A with VPC-B and enable Private Google Access on VPC-B.

Answer

Assign external IPs to the instances in VPC-A.

Question 6

A company uses hierarchical firewall policies at the organization level. They need to allow SSH (TCP 22) access from a specific range 10.0.0.0/8 to all VMs, but a child folder has a policy that denies all ingress traffic. Which rule priority ordering ensures SSH access is allowed?

Accepted Answer

Organization allow rule priority 100, folder deny rule priority 200.. Hierarchical firewall rules have priorities; higher priority (lower number) wins. To override a deny-all, the allow rule must have a lower priority number than the deny rule. The organization policy can have a lower priority than the folder policy, but the folder's deny-all would block. The organization's allow rule must have higher priority (lower number) than the folder's deny rule.

Answer

Folder allow rule priority 100, folder deny rule priority 200.

Answer

Remove the folder deny rule and use network firewall rules.

Answer

Organization allow rule priority 200, folder deny rule priority 100.

Question 7

Your VPC has instances with internal DNS names like 'instance1.us-central1-a.c.myproject.internal'. You need to ensure that DNS resolution works for instances in the same zone using short names (e.g., 'instance1'). Which condition must be met?

Accepted Answer

The instances must be in the same zone and VPC network.. Google Cloud internal DNS automatically resolves short names for instances within the same zone and network. The instance must be in the same zone and VPC network. No additional configuration is needed as long as instances are in the same zone.

Answer

Custom DNS must be configured via Cloud DNS.

Answer

The VPC must have Private Google Access enabled.

Answer

The instance must have a network tag 'dns-enabled'.

Question 8

You are deploying a third-party network appliance (e.g., firewall) in a GCP VPC. The appliance requires multiple network interfaces for traffic isolation. You create a VM with three NICs in different subnets. What is a key consideration for routing traffic through the appliance?

Accepted Answer

Custom routes must be created to direct traffic to a specific NIC using the VM's IP as next hop.. Each NIC in a multi-NIC VM is assigned to a different subnet. By default, the VM only sends traffic out of the NIC that matches the destination subnet's route. To route traffic through a specific NIC, custom routes with next hop set to the VM's IP on that NIC are required.

Answer

The VM must have an external IP on each NIC.

Answer

The VM must have IP forwarding disabled.

Answer

All NICs must be in the same subnet.

Question 9

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

Accepted Answer

Cloud Armor. Cloud Armor provides Web Application Firewall (WAF) capabilities, including preconfigured rules to detect and block SQLi and XSS attacks. It attaches to HTTPS Load Balancers.

Answer

Firewall Rules

Answer

Cloud IDS

Answer

VPC Service Controls

Question 10

An organization wants to prevent data exfiltration from a project that uses Google Cloud Storage and BigQuery. They need to restrict access to these services from only the authorized VPC networks. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow creating a service perimeter around GCP services (like Cloud Storage and BigQuery) to restrict data access to only authorized VPCs and projects. This prevents data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

Cloud Armor

Question 11

You have a Cloud NAT gateway configured in a region with 256 available ports. You allocate static NAT ports to a specific VM for outbound connections. What is the minimum number of ports you should allocate to ensure the VM can handle 500 concurrent connections?

Accepted Answer

512. Cloud NAT uses ports for source NAT. A single connection uses one port. To support 500 concurrent connections, you need at least 500 ports. However, Cloud NAT allows port sharing for the same destination IP and port, but static port allocation per VM typically reserves ports exclusively. To be safe, allocate at least 500 ports.

Answer

128

Answer

256

Answer

64

Question 12

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the return route via BGP, causing asymmetric routing.. For asymmetric routing, GCP may drop return traffic if it does not match the forwarding route. Cloud VPN supports dynamic routing (BGP) which advertises the on-premises prefix. However, if the on-premises router forwards return traffic through a different path (e.g., internet), GCP's firewall drops it because the return packet does not come via the VPN tunnel (asymmetric).

Answer

The Cloud VPN tunnel is down.

Answer

The MTU is set to 1500 on the VPN tunnel.

Answer

The instance's firewall is blocking ICMP.

Question 13

A company wants to publish an internal service (e.g., a database) in their VPC so that consumers in other VPCs can connect to it privately via Private Service Connect (PSC). What must be created on the producer side?

Accepted Answer

A Service Attachment that exposes the service.. Private Service Connect allows producers to publish services via a Service Attachment. The service attachment is created on a Network Endpoint Group (NEG) that points to the internal service (e.g., a backend service). Consumers then create PSC endpoints to connect.

Answer

A Cloud VPN tunnel to the consumer VPC.

Answer

A VPC peering connection.

Answer

A Private Service Connect endpoint in the producer VPC.

Question 14

Which statement about Cloud Armor security policies is true?

Accepted Answer

They support both allow and deny actions for incoming requests.. Cloud Armor security policies can be attached to HTTPS Load Balancers. They support rules with conditions like IP addresses, geographic regions, and preconfigured WAF rules. They also support rate limiting.

Answer

They can be attached to any GCP resource, including Compute Engine instances.

Answer

They are evaluated after the firewall rules.

Answer

They cannot be used with internal load balancers.

Question 15

You need to allow instances with network tag 'db' in subnet-a to only accept connections on TCP port 3306 from instances with network tag 'app' in subnet-b. Which TWO firewall rules should you create? (Choose 2)

Accepted Answer

Ingress rule: target tag 'db', source tag 'app', allow tcp:3306, priority 1000.. To allow only instances with tag 'app' in subnet-b to connect to instances with tag 'db' in subnet-a on TCP port 3306, you need two ingress firewall rules on the db instances: one to allow traffic from the app source tag, and one to deny traffic from all other sources. The allow rule must have a higher priority (lower number) than the deny rule to take effect. Thus, option A (allow from app, priority 1000) and option C (deny from all, priority 2000) together achieve the goal.

Answer

Egress rule: target tag 'app', destination tag 'db', allow tcp:3306, priority 1000.

Answer

Ingress rule: target tag 'db', source tag 'app', deny tcp:3306, priority 1000.

Answer

Ingress rule: target tag 'db', source 0.0.0.0/0, deny all ports, priority 500.