PCNE Implementing VPC Instances Practice Test 5 — 15 Questions

Question 1

A network engineer needs to ensure that Compute Engine instances without external IP addresses can access Google APIs such as BigQuery and Cloud Storage. Which feature should be enabled on the subnet where the instances reside?

Accepted Answer

Private Google Access. Private Google Access allows instances without external IPs to reach Google APIs using private IP addresses. It is enabled per subnet.

Answer

Private Service Connect

Answer

VPC Service Controls

Answer

Cloud NAT

Question 2

An engineer is configuring a Compute Engine instance with multiple network interfaces for use as a network appliance. Which interface is considered the primary interface for default routes and instance metadata?

Accepted Answer

NIC0. NIC0 is the primary interface; default routes and instance metadata are tied to it. Adding extra interfaces (NIC1, NIC2, etc.) is for specific networking scenarios like network appliances.

Answer

Any interface with an external IP

Answer

The interface with the lowest subnet CIDR

Answer

The interface attached to the default VPC

Question 3

A company wants to protect its HTTPS Load Balancer from DDoS attacks and common web application attacks like SQL injection and cross-site scripting (XSS). Which Google Cloud service should be used?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and WAF capabilities including preconfigured rules for OWASP, XSS, and SQLi. It attaches to HTTPS Load Balancers.

Answer

Cloud IDS

Answer

VPC Service Controls

Answer

Firewall Rules

Question 4

An organization has multiple VPCs in the same project. They want to apply consistent firewall rules to all VPCs at the project level. What is the most efficient way to achieve this?

Accepted Answer

Use hierarchical firewall policies at the project level. Hierarchical firewall policies can be applied at the organization, folder, or project level and apply to all VPCs in the resource hierarchy. VPC-level firewall rules are per VPC and require duplication.

Answer

Create a network firewall policy and attach it to each VPC

Answer

Create a firewall rules template using Deployment Manager

Answer

Use VPC Service Controls to enforce rules

Question 5

An engineer is troubleshooting outbound connectivity from a Compute Engine instance that has no external IP. The instance needs to reach an external service on the internet. Cloud NAT is configured on the VPC network. However, the instance cannot connect. What is the most likely cause?

Accepted Answer

Egress firewall rules are blocking the traffic. For Cloud NAT to work, the instance must be in a subnet for which a Cloud NAT gateway is configured, and the instance should not have an external IP. Additionally, firewall rules must allow egress traffic. The most common issue is missing egress firewall rules or incorrect NAT configuration.

Answer

Private Google Access is not enabled

Answer

The instance has an external IP assigned

Answer

The Cloud NAT gateway is in a different region than the instance

Question 6

A company wants to publish a custom internal service running in their VPC so that consumers in other VPCs can access it using private IP addresses. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows publishing internal services via private endpoints in your VPC and enabling consumption from other VPCs using private IPs.

Answer

Cloud Load Balancing

Answer

VPC Peering

Answer

Cloud VPN

Question 7

An organization wants to restrict which Google APIs can be accessed by resources in a specific VPC. They also want to prevent data exfiltration to unauthorized projects. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that restrict API access and prevent data exfiltration based on projects and VPCs.

Answer

Cloud Armor

Answer

Private Google Access

Answer

Firewall Rules

Question 8

An engineer has configured a firewall rule with priority 1000 that allows ingress traffic on TCP port 443 from source IP range 10.0.0.0/8. Another rule with priority 500 denies ingress on TCP port 443 from source IP 10.0.1.0/24. What will happen to traffic from 10.0.1.5 destined to the instance on port 443?

Accepted Answer

The traffic is denied because the deny rule has higher priority. Firewall rules are evaluated by priority (lower number = higher priority). Rule with priority 500 (deny) takes precedence over priority 1000 (allow). So traffic from 10.0.1.5 is denied.

Answer

The traffic is allowed because allow rules override deny rules

Answer

The traffic is allowed because the allow rule covers a broader range

Answer

The traffic is denied only if the instance has a tag matching the deny rule

Question 9

A company wants to provide outbound internet access to Compute Engine instances without external IPs, while minimizing IP address consumption. Which Cloud NAT feature should be used to achieve minimal static IP usage?

Accepted Answer

Dynamic port allocation. Cloud NAT supports dynamic port allocation, which uses ephemeral IP addresses from the NAT IP pool. Static port allocation reserves ports per VM and may require more IPs. The question asks to minimize IP consumption, so using dynamic allocation with a small number of NAT IPs is optimal.

Answer

Using a single NAT IP for all VMs

Answer

Enabling Cloud NAT logging

Answer

Static port allocation

Question 10

An engineer needs to create a firewall rule that applies only to instances with the tag 'web-server' in a specific VPC network. The rule should allow ingress from any source on TCP port 80. Which combination of fields must be set in the gcloud command?

Accepted Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-tags=web-server --source-ranges=0.0.0.0/0. To target instances by tag, use --target-tags. For source, --source-ranges (any source: 0.0.0.0/0). For protocol/port, --allow tcp:80. Network is specified with --network. Direction is implied by 'ingress'.

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-tags=web-server --source-tags=0.0.0.0/0

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --target-service-accounts=web-server@project.iam.gserviceaccount.com

Answer

--direction=INGRESS --priority=1000 --network=default --allow=tcp:80 --source-tags=web-server

Question 11

A company uses VPC Service Controls with a service perimeter that includes Project A. They want to allow an external identity from Project B (outside the perimeter) to access a Cloud Storage bucket in Project A, but only during business hours. Which VPC Service Controls feature should they use?

Accepted Answer

Access levels with time constraint and an ingress rule. VPC Service Controls use access levels (e.g., based on IP, time) and ingress rules to allow traffic from outside the perimeter. Ingress rules define which identities and resources can access perimeters.

Answer

Egress rules with IP whitelisting

Answer

Cloud Armor geoblocking

Answer

Private Google Access

Question 12

An engineer needs to configure Cloud Armor to block requests from a specific IP address (10.1.2.3) while allowing all other traffic. They create a security policy with a deny rule for that IP and an allow rule for all traffic. What priority should the deny rule have relative to the allow rule?

Accepted Answer

The deny rule must have a lower priority number than the allow rule. In Cloud Armor, rules are evaluated from lowest to highest priority (lower number = higher priority). The deny rule must have a lower priority number than the allow rule to be evaluated first and block the IP before the allow rule applies. Typically, the allow-all rule has highest priority (e.g., 2147483647).

Answer

Both rules must have the same priority

Answer

Priority does not matter for deny rules

Answer

The deny rule must have a higher priority number than the allow rule

Question 13

A company runs a web application on Compute Engine instances without external IPs. They need to ensure the instances can access Google APIs (e.g., Cloud Storage) and also provide outbound internet access for software updates. Which two features should be configured? (Choose two.)

Accepted Answer

Cloud NAT. Private Google Access enables access to Google APIs without external IPs. Cloud NAT provides outbound internet access for instances without external IPs.

Answer

VPC Service Controls

Answer

Private Service Connect

Answer

Cloud VPN

Question 14

An organization wants to enforce that only instances with specific service accounts can be accessed via SSH (TCP 22) from the internet. Which two attributes should be used in the firewall rule to achieve this? (Choose two.)

Accepted Answer

--source-ranges 0.0.0.0/0. To target instances based on service account, use --target-service-accounts. To specify the source from internet, use --source-ranges with 0.0.0.0/0.

Answer

--source-service-accounts

Answer

--target-tags

Answer

--destination-ranges

Question 15

A company wants to deploy a network appliance (e.g., firewall) on a Compute Engine instance that requires inspecting traffic between two VPCs. The instance must have interfaces in both VPCs. Which three configurations are required? (Choose three.)

Accepted Answer

Attach at least two network interfaces (NIC0 and NIC1). For a multi-NIC network appliance, you need at least two network interfaces (NIC0, NIC1) attached to different VPCs. Each interface must be in a different subnet. Also, IP forwarding must be enabled on the instance to allow it to forward traffic between interfaces.

Answer

Assign an external IP to each interface

Answer

Use the same subnet for both interfaces