PCNE Implementing VPC Instances Practice Test 4 — 15 Questions

Question 1

An engineer is configuring a Google Compute Engine instance that needs to send traffic to the internet. The instance has no external IP address. Which service must be configured to allow this outbound connectivity?

Accepted Answer

Cloud NAT. Cloud NAT provides outbound internet connectivity for instances without external IPs. It translates private IPs to a public IP and allows instances to reach the internet.

Answer

Cloud VPN

Answer

VPC peering

Answer

Private Google Access

Question 2

A company wants to restrict access to Google Cloud APIs from a specific set of VMs based on the VM's service account. Which type of firewall rule target should be used?

Accepted Answer

Target service accounts. Firewall rules can target instances by service account, allowing fine-grained control based on identity rather than network tags.

Answer

Target tags

Answer

All instances

Answer

Source service accounts

Question 3

A network engineer needs to create a firewall rule that denies all inbound traffic to instances with the tag 'web-server' from source IP range 10.0.0.0/8. They also have an existing allow rule with priority 1000 that permits traffic from 10.0.0.0/8 to those instances. To ensure the deny rule takes precedence, what priority should the new rule have?

Accepted Answer

500. In GCP firewall rules, lower priority numbers have higher precedence. To override an allow rule with priority 1000, the deny rule must have a priority lower than 1000.

Answer

1000

Answer

0

Answer

2000

Question 4

An organization has multiple projects and wants to apply a consistent set of firewall rules across all VPC networks in the organization. Which approach should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization level and are inherited by all folders and projects, ensuring consistent rules across the entire hierarchy.

Answer

Create a network firewall policy and attach it to each VPC

Answer

Use VPC peering to share rules

Answer

Apply firewall rules using tags in each project

Question 5

What is the default Maximum Transmission Unit (MTU) for Compute Engine virtual machines?

Accepted Answer

1460. GCP uses an MTU of 1460 for both VMs and the underlying network infrastructure.

Answer

1500

Answer

9001

Answer

1400

Question 6

A company wants to protect its external HTTPS load balancer from SQL injection and cross-site scripting attacks. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities including preconfigured rules for OWASP Top 10 threats like SQLi and XSS, and can be attached to HTTPS load balancers.

Answer

VPC Service Controls

Answer

Cloud Firewall

Answer

Cloud IDS

Question 7

A Compute Engine instance is running a network appliance that requires multiple network interfaces. What is the primary purpose of attaching additional NICs (e.g., NIC1, NIC2) to the instance?

Accepted Answer

To separate traffic between different subnets or networks. Multiple NICs are used to separate traffic planes such as management, data, and control, and to route traffic through different subnets without relying on internal routing.

Answer

To provide failover if one NIC fails

Answer

To enable load balancing across interfaces

Answer

To increase network throughput

Question 8

An organization wants to allow on-premises hosts to connect to a Cloud SQL instance privately without traversing the public internet. They have a Cloud VPN tunnel set up. What additional step is required?

Accepted Answer

Enable Private Service Connect on the Cloud SQL instance. Private Service Connect enables private connectivity to Google-managed services from on-premises via VPC and VPN.

Answer

Create a VPC peering connection

Answer

Add a route with next hop set to the VPN gateway

Answer

Configure Cloud NAT

Question 9

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to create service perimeters that restrict access to Google Cloud APIs and prevent data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

IAM Conditions

Question 10

A company uses Cloud NAT with a static NAT IP address. They notice that connections from their instances are failing after a few minutes. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway is using dynamic port allocation and running out of ports. Cloud NAT by default uses dynamic port allocation and releases ports after a timeout. With static NAT IP, if port exhaustion occurs or if the connection idle timeout is too low, connections may drop.

Answer

The instance's external IP is conflicting with the NAT IP

Answer

The NAT IP address is not whitelisted on the target

Answer

The VPC network has a firewall rule blocking egress

Question 11

What is the internal DNS name format for a Compute Engine instance named 'web-server' in zone 'us-central1-a' within project 'my-project'?

Accepted Answer

web-server.us-central1-a.c.my-project.internal. GCP internal DNS uses the format vm-name.zone.c.project-id.internal. For the given example, it is web-server.us-central1-a.c.my-project.internal.

Answer

web-server.us-central1-a.my-project.internal

Answer

web-server.my-project.c.us-central1-a.internal

Answer

web-server.internal

Question 12

An organization wants to allow only certain users to access a service published via Private Service Connect. They need to restrict access based on the source VPC network. What should they use?

Accepted Answer

Consumer allow lists in the service attachment. Private Service Connect allows publishing services with access control using service attachment with consumer allow lists that specify which projects or VPCs can connect.

Answer

Firewall rules in the consumer VPC

Answer

IAM permissions on the service attachment

Answer

VPC Service Controls

Question 13

Which TWO of the following are valid ways to target firewall rules in Google Cloud? (Select 2)

Accepted Answer

Target by service account. Firewall rules can target instances by network tags or by service accounts. Tags are key-value pairs, and service accounts provide identity-based targeting.

Answer

Target by zone

Answer

Target by instance name

Answer

Target by machine type

Question 14

Which THREE of the following are benefits of using hierarchical firewall policies? (Select 3)

Accepted Answer

They can be applied at the organization, folder, or project level. Hierarchical firewall policies provide centralized management, inherit down the resource hierarchy, and can apply at the organization level. They support both allow and deny rules, and can be used to enforce baseline security.

Answer

They can be used to restrict access to specific Google APIs

Answer

They override network firewall rules with the same priority

Question 15

A company wants to use Cloud Armor to block traffic from a specific IP range (198.51.100.0/24) and also apply rate limiting. Which TWO components are needed? (Select 2)

Accepted Answer

A Cloud Armor security policy with two rules: one for IP deny and one for rate limiting. Cloud Armor security policies contain rules with conditions like IP ranges and rate limiting. The policy is attached to a backend service of an HTTPS load balancer.

Answer

A Cloud CDN cache rule

Answer

A Cloud Armor security policy with one rule that combines IP deny and rate limiting

Answer

A network firewall rule to block the IP range