PCNE Implementing VPC Instances Practice Test 4 — 15 Questions

Question 1

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service perimeter. VPC Service Controls perimeters require: 1) A service perimeter that includes the project and services, 2) Access levels that define allowed client attributes (e.g., IP addresses, device policy), and 3) VPC accessible services configuration to restrict access to only requests originating from specified VPC networks. Ingress rules are optional for allowing access from outside the perimeter.

Answer

Cloud NAT gateway

Answer

Private Google Access

Question 2

An engineer needs to deploy a VM that acts as a internet gateway for other instances in the same VPC. The VM must have IP forwarding enabled and must be able to accept traffic on multiple NICs. Which TWO actions are required? (Choose 2)

Accepted Answer

Create firewall rules to allow traffic to the VM's NICs.. To use a VM as a gateway, IP forwarding must be enabled on the VM. Additionally, firewall rules must allow ingress traffic to the VM's NICs that will forward traffic. The VM itself must have routes pointing to it as next hop.

Answer

Disable the VM's source/destination check.

Answer

Create a Cloud NAT gateway.

Answer

Assign an external IP to each NIC.

Question 3

An engineer is configuring a Google Compute Engine instance that needs to send traffic to the internet. The instance has no external IP address. Which service must be configured to allow this outbound connectivity?

Accepted Answer

Cloud NAT. Cloud NAT provides outbound internet connectivity for instances without external IPs. It translates private IPs to a public IP and allows instances to reach the internet.

Answer

Cloud VPN

Answer

VPC peering

Answer

Private Google Access

Question 4

A company wants to restrict access to Google Cloud APIs from a specific set of VMs based on the VM's service account. Which type of firewall rule target should be used?

Accepted Answer

Target service accounts. Firewall rules can target instances by service account, allowing fine-grained control based on identity rather than network tags.

Answer

Target tags

Answer

All instances

Answer

Source service accounts

Question 5

A network engineer needs to create a firewall rule that denies all inbound traffic to instances with the tag 'web-server' from source IP range 10.0.0.0/8. They also have an existing allow rule with priority 1000 that permits traffic from 10.0.0.0/8 to those instances. To ensure the deny rule takes precedence, what priority should the new rule have?

Accepted Answer

500. In GCP firewall rules, lower priority numbers have higher precedence. To override an allow rule with priority 1000, the deny rule must have a priority lower than 1000.

Answer

1000

Answer

0

Answer

2000

Question 6

An organization has multiple projects and wants to apply a consistent set of firewall rules across all VPC networks in the organization. Which approach should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization level and are inherited by all folders and projects, ensuring consistent rules across the entire hierarchy.

Answer

Create a network firewall policy and attach it to each VPC

Answer

Use VPC peering to share rules

Answer

Apply firewall rules using tags in each project

Question 7

What is the default Maximum Transmission Unit (MTU) for Compute Engine virtual machines?

Accepted Answer

1460. GCP uses an MTU of 1460 for both VMs and the underlying network infrastructure.

Answer

1500

Answer

9001

Answer

1400

Question 8

A company wants to protect its external HTTPS load balancer from SQL injection and cross-site scripting attacks. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities including preconfigured rules for OWASP Top 10 threats like SQLi and XSS, and can be attached to HTTPS load balancers.

Answer

VPC Service Controls

Answer

Cloud Firewall

Answer

Cloud IDS

Question 9

A Compute Engine instance is running a network appliance that requires multiple network interfaces. What is the primary purpose of attaching additional NICs (e.g., NIC1, NIC2) to the instance?

Accepted Answer

To separate traffic between different subnets or networks. Multiple NICs are used to separate traffic planes such as management, data, and control, and to route traffic through different subnets without relying on internal routing.

Answer

To provide failover if one NIC fails

Answer

To enable load balancing across interfaces

Answer

To increase network throughput

Question 10

An organization wants to allow on-premises hosts to connect to a Cloud SQL instance privately without traversing the public internet. They have a Cloud VPN tunnel set up. What additional step is required?

Accepted Answer

Enable Private Service Connect on the Cloud SQL instance. Private Service Connect enables private connectivity to Google-managed services from on-premises via VPC and VPN.

Answer

Create a VPC peering connection

Answer

Add a route with next hop set to the VPN gateway

Answer

Configure Cloud NAT

Question 11

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to create service perimeters that restrict access to Google Cloud APIs and prevent data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

IAM Conditions

Question 12

A company uses Cloud NAT with a static NAT IP address. They notice that connections from their instances are failing after a few minutes. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway is using dynamic port allocation and running out of ports. Cloud NAT by default uses dynamic port allocation and releases ports after a timeout. With static NAT IP, if port exhaustion occurs or if the connection idle timeout is too low, connections may drop.

Answer

The instance's external IP is conflicting with the NAT IP

Answer

The NAT IP address is not whitelisted on the target

Answer

The VPC network has a firewall rule blocking egress

Question 13

What is the internal DNS name format for a Compute Engine instance named 'web-server' in zone 'us-central1-a' within project 'my-project'?

Accepted Answer

web-server.us-central1-a.c.my-project.internal. GCP internal DNS uses the format vm-name.zone.c.project-id.internal. For the given example, it is web-server.us-central1-a.c.my-project.internal.

Answer

web-server.us-central1-a.my-project.internal

Answer

web-server.my-project.c.us-central1-a.internal

Answer

web-server.internal

Question 14

An organization wants to allow only certain users to access a service published via Private Service Connect. They need to restrict access based on the source VPC network. What should they use?

Accepted Answer

Consumer allow lists in the service attachment. Private Service Connect allows publishing services with access control using service attachment with consumer allow lists that specify which projects or VPCs can connect.

Answer

Firewall rules in the consumer VPC

Answer

IAM permissions on the service attachment

Answer

VPC Service Controls

Question 15

Which TWO of the following are valid ways to target firewall rules in Google Cloud? (Select 2)

Accepted Answer

Target by service account. Firewall rules can target instances by network tags or by service accounts. Tags are key-value pairs, and service accounts provide identity-based targeting.

Answer

Target by zone

Answer

Target by instance name

Answer

Target by machine type