PCNE Implementing VPC Instances Practice Test 5 — 15 Questions

Question 1

A Compute Engine instance has multiple network interfaces. Which interface is considered the primary (NIC0)?

Accepted Answer

The interface with the lowest index number (nic0).. By default, the first interface attached (nic0) is the primary interface and used for default routes and internal DNS.

Answer

The interface configured first in the instance creation.

Answer

The interface with the highest index number.

Answer

All interfaces are primary.

Question 2

An organization has a VPC with multiple subnets. They want to log all outbound connections from instances to the internet for compliance. They also want to use a cost-effective solution that doesn't require a proxy. Which three components are needed? (Choose three.)

Accepted Answer

Cloud NAT. Option A (Cloud NAT) is correct because Cloud NAT provides outbound internet connectivity for instances in private subnets without requiring an external IP or a proxy, and it is a managed, cost-effective service. Option B (Cloud Logging) is correct because Cloud NAT logs (sent to Cloud Logging) capture details of outbound connections, such as source/destination IPs and ports, which satisfies the compliance logging requirement. Option D (Cloud Router) is correct because Cloud NAT is configured on a Cloud Router, which is a required component to enable NAT and its logging. Option C (Cloud VPN) is not needed because it provides encrypted tunnels to on-premises or other networks, not outbound internet access for logging. Option E (VPC Flow Logs) is not required because it logs traffic at the subnet/VM level and does not provide the NAT translation details needed for outbound connection logging in this scenario.

Answer

Cloud VPN

Answer

VPC Flow Logs

Question 3

An engineer needs to allow HTTP health checks from the Google Cloud health checker IP ranges to a set of instances. Which two methods can be used to target the firewall rule correctly? (Choose two.)

Accepted Answer

Use target service accounts on the instances.. Options C and D are correct because VPC firewall rules match traffic by target, and the two supported target constructs are target service accounts (C) and target tags (D). Target service accounts apply the rule to instances that run as that service account, while target tags apply it to instances carrying the specified network tag, so both correctly scope the rule to the set of instances receiving the health checks. Options A and B are incorrect because source service accounts and source tags apply to the sender of the traffic, and the Google Cloud health checker IP ranges are not represented by customer-owned service accounts or network tags. Option E is incorrect because firewall rules cannot target instances by their instance names; targets must be service accounts or network tags.

Answer

Use source service accounts on the health checkers.

Answer

Use source tags on the health checkers.

Answer

Use instance names in the firewall rule.

Question 4

A company wants to protect its HTTP(S) Load Balancer against DDoS attacks and common web exploits like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it is the only Google Cloud service in the list that provides both DDoS protection at the edge and WAF capabilities (SQLi, XSS) for HTTP(S) Load Balancers. It integrates directly with external HTTP(S) Load Balancers and inspects Layer 7 traffic before it reaches backends. The preconfigured OWASP rules and adaptive protection make it purpose-built for this scenario.

Answer

VPC Service Controls

Answer

Firewall Rules

Answer

Cloud NAT

Question 5

An organization has multiple VPCs in different projects that need to consume a common internal service hosted in a central project. The service runs on a set of Compute Engine instances with internal IPs. Which architecture allows the consumers to access the service using private IPs without VPC peering?

Accepted Answer

Create a Private Service Connect endpoint in each consumer VPC and publish the service as a Private Service Connect service from the central project.. Private Service Connect allows you to publish internal services via Private Service Connect endpoints in consumer VPCs. Consumers access the service using internal IPs without needing VPC peering or VPNs. This is the recommended architecture for publishing and consuming internal services across projects.

Answer

Use Cloud VPN to connect each consumer VPC to the central VPC.

Answer

Expose the service through an external IP and use IAM to restrict access.

Answer

Set up VPC peering between each consumer VPC and the central VPC.

Question 6

A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?

Accepted Answer

Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.. Firewall rules are evaluated in order of priority (lower number = higher priority). The deny rule at priority 1000 will deny all IPs. To allow the VPN IP, a higher priority (lower number) allow rule must be created for that specific IP, before the deny rule is evaluated. The correct approach is to create an allow rule with priority 100 (or any lower number) for source IP 203.0.0.0/8 (or the specific IP) targeting web-server.

Answer

Modify the existing deny rule to include an exception for the VPN IP in the source IP field.

Answer

Delete the deny rule and create a single rule that denies all IPs except the VPN IP using the 'except' option.

Answer

Change the priority of the existing deny rule to 1 and create an allow rule with priority 2 for the VPN IP.

Question 7

A company has deployed a network appliance (e.g., firewall) as a Compute Engine instance with two NICs: NIC0 for management and NIC1 for data traffic. The appliance must forward traffic from instances in subnet A to subnet B. The engineer has enabled IP forwarding on the appliance. What additional configuration is required on the VPC for the appliance to route traffic between subnets?

Accepted Answer

Create a route in the VPC with destination subnet B and next hop set to the appliance's internal IP address.. In Google Cloud VPC, even with IP forwarding enabled on the appliance instance, the VPC network needs a custom static route that directs traffic destined for subnet B to the appliance's internal IP address as the next hop. This route ensures that packets from subnet A are sent to the appliance for forwarding. Without this route, the VPC would not know to use the appliance as a gateway.

Answer

Configure the appliance's guest OS to enable packet forwarding by setting net.ipv4.ip_forward=1.

Answer

Create a firewall rule allowing egress from the appliance to both subnets.

Answer

Attach the appliance to a Cloud Router and configure BGP sessions.

Question 8

A company wants to apply consistent firewall rules across all projects in an organization. They need to block all traffic to ports 22 and 3389 from the internet to any VMs in any project. Which approach is most scalable and maintainable?

Accepted Answer

Use a hierarchical firewall policy at the organization level with deny rules for ports 22 and 3389 from 0.0.0.0/0.. Hierarchical firewall policies in Google Cloud are applied at the organization or folder level and are inherited by all projects and VPCs beneath them, so a single policy with deny rules for tcp:22 and tcp:3389 from 0.0.0.0/0 enforces the requirement everywhere without per-project configuration. This is the most scalable and maintainable approach because new projects automatically inherit the rules.

Answer

Configure OS-level firewall on each VM using startup scripts.

Answer

Use Cloud Armor security policies attached to load balancers.

Answer

Create a VPC firewall rule in each project's VPC.

Question 9

A developer is configuring a Compute Engine VM to host a web server. They want to ensure that only HTTP (port 80) and HTTPS (port 443) traffic from the internet is allowed. Which firewall rule should they create?

Accepted Answer

Ingress allow rule for TCP ports 80 and 443 from 0.0.0.0/0.. To allow HTTP and HTTPS traffic from the internet to a Compute Engine VM, you need an ingress allow rule for TCP ports 80 and 443 from 0.0.0.0/0. This permits inbound traffic on those ports from any source, which is necessary for a public web server.

Answer

Egress allow rule for TCP ports 80 and 443 to 0.0.0.0/0.

Answer

Ingress deny rule for all ports except 80 and 443.

Answer

Egress deny rule for all ports.

Question 10

A company is using Cloud NAT to provide outbound internet access for instances without external IPs. They notice that the NAT gateway is running out of ports for connections to a single external IP address. To minimize port exhaustion, what should the engineer configure?

Accepted Answer

Increase the number of NAT IP addresses assigned to the Cloud NAT gateway.. Cloud NAT uses NAT IP addresses and ports. To increase capacity for connections to a single destination IP, you can either allocate more NAT IP addresses (which increases the number of ports) or use dynamic port allocation. Static port allocation is used for endpoints that require predictable source ports. For minimizing exhaustion, adding more NAT IPs is the direct solution.

Answer

Change the NAT port allocation to static.

Answer

Reduce the endpoint-independent mapping timeout.

Answer

Enable Cloud NAT logging to diagnose the issue.

Question 11

An organization needs to prevent exfiltration of data from a Cloud Storage bucket to external IPs. The bucket is accessed by Compute Engine instances in a VPC. The instances need to read and write data to the bucket but should not be able to copy data to external networks. Which combination of controls meets this requirement?

Accepted Answer

Configure VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. VPC Service Controls with a service perimeter that includes both the VPC network and the Cloud Storage bucket creates a security boundary that prevents data exfiltration to external IPs. It enforces that access to the bucket is only allowed from within the perimeter, and any attempt to copy data outside the perimeter is blocked. This directly addresses the requirement to prevent exfiltration while allowing internal instances to read and write.

Answer

Use Cloud Armor with a WAF rule to block outbound traffic.

Answer

Set up Private Google Access and restrict IAM permissions to the bucket.

Answer

Use Cloud NAT with a firewall rule that denies all egress except to Google APIs.

Question 12

A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?

Accepted Answer

IAM conditions on the bucket. VPC Service Controls can restrict access to Google APIs to only specified VPCs and projects, creating a service perimeter. IAM conditions can further restrict access based on the caller's service account. This combination ensures that only instances with the correct service account in the correct VPC can access the bucket.

Answer

Hierarchical firewall policy

Answer

Cloud Armor

Answer

Cloud NAT

Question 13

An organization wants to publish an internal web service running on Compute Engine to consumers in different VPCs. The service must be accessible via private IPs without VPC peering. Which THREE components are required to set this up using Private Service Connect?

Accepted Answer

A service attachment in the producer VPC that points to a load balancer. Private Service Connect requires a service attachment in the producer VPC (option C), which references a supported load balancer and exposes the service to consumers via a private IP; this is the producer-side resource that publishes the service. The referenced load balancer must be an internal TCP/UDP load balancer (option D), since PSC service attachments only support internal passthrough Network Load Balancers (and internal HTTP(S) LBs in newer configurations) as the backing target for the service. On the consumer side, a Private Service Connect endpoint (option E) is created in the consumer VPC, giving consumers a private IP that forwards traffic to the service attachment without requiring VPC peering. Option A is incorrect because PSC is specifically designed to avoid VPC peering between producer and consumer VPCs. Option B is incorrect because Cloud NAT provides outbound internet access for private instances and plays no role in publishing or consuming a service through Private Service Connect.

Answer

VPC peering between producer and consumer VPCs

Answer

A Cloud NAT gateway in the producer VPC

Question 14

You need to configure firewall rules to allow HTTP (TCP 80) traffic from the internet to instances in a VPC. The instances are in different subnets and have a network tag 'web-server'. You want to minimize the number of rules. Which rule configuration is correct?

Accepted Answer

Create an ingress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.. Firewall rules are global, so one ingress rule can apply to all instances with the tag 'web-server' regardless of subnet. The direction must be ingress, source 0.0.0.0/0, protocol tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule with source 0.0.0.0/0, protocol tcp:0-65535, and target tags 'web-server'.

Answer

Create an egress rule with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Answer

Create an ingress rule for each subnet with source 0.0.0.0/0, tcp:80, and target tags 'web-server'.

Question 15

An organization has two VPCs in the same project: VPC-A and VPC-B. They want instances in VPC-A to reach Cloud Storage buckets without external IPs. What is the simplest solution?

Accepted Answer

Enable Private Google Access on the subnets in VPC-A.. Private Google Access, when enabled on a subnet, allows instances in that subnet that have only internal IP addresses to reach Google APIs and services such as Cloud Storage using Google's internal network. Enabling it on the subnets in VPC-A is the simplest solution because it requires no additional gateways, peering, or external IPs — just a subnet-level setting.

Answer

Create a Cloud NAT gateway in VPC-A and configure firewall rules to allow traffic to Cloud Storage.

Answer

Peer VPC-A with VPC-B and enable Private Google Access on VPC-B.

Answer

Assign external IPs to the instances in VPC-A.