PCNE Implementing VPC Instances Practice Test 6 — 15 Questions

Question 1

You need to protect an HTTPS load-balanced application from SQL injection and cross-site scripting attacks. Which Google Cloud service should you use?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's edge security service that attaches to HTTP(S) Load Balancers and provides WAF capabilities via preconfigured rules such as the OWASP ModSecurity Core Rule Set, which specifically detects and blocks SQL injection (SQLi) and cross-site scripting (XSS). Because it operates at the load balancer layer (Layer 7), it can inspect HTTP request headers, URLs, and bodies where these web exploits live. Firewall rules and Cloud IDS operate at different layers and cannot perform application-layer payload inspection for these attack types.

Answer

Firewall Rules

Answer

Cloud IDS

Answer

VPC Service Controls

Question 2

An organization wants to prevent data exfiltration from a project that uses Google Cloud Storage and BigQuery. They need to restrict access to these services from only the authorized VPC networks. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls let you define a service perimeter around Google Cloud services such as Cloud Storage and BigQuery, restricting access so that only resources inside authorized VPC networks (or authorized identities) can reach those services. This directly addresses data exfiltration prevention by blocking access from outside the perimeter, even if IAM permissions would otherwise allow it.

Answer

Cloud NAT

Answer

Private Google Access

Answer

Cloud Armor

Question 3

An engineer is troubleshooting connectivity from a Compute Engine instance (internal IP: 10.0.0.2) to an on-premises server (IP: 203.0.113.5) over a Cloud VPN tunnel. The traffic reaches the on-premises network, but the return traffic is dropped. What is the most likely cause?

Accepted Answer

The on-premises router is not advertising the return route via BGP, causing asymmetric routing.. The symptom — traffic reaches on-premises but return traffic is dropped — is the classic signature of asymmetric routing. If the on-premises router doesn't advertise the 10.0.0.0/… prefix back through BGP over the Cloud VPN, it has no route for the return path and either drops the packet or sends it out a different interface. The Cloud VPN tunnel itself is up (traffic is flowing one way), so the issue is route propagation, not tunnel state.

Answer

The Cloud VPN tunnel is down.

Answer

The MTU is set to 1500 on the VPN tunnel.

Answer

The instance's firewall is blocking ICMP.

Question 4

A company wants to publish an internal service (e.g., a database) in their VPC so that consumers in other VPCs can connect to it privately via Private Service Connect (PSC). What must be created on the producer side?

Accepted Answer

A Service Attachment that exposes the service.. Private Service Connect allows producers to publish services via a Service Attachment. The service attachment is created on a Network Endpoint Group (NEG) that points to the internal service (e.g., a backend service). Consumers then create PSC endpoints to connect.

Answer

A Cloud VPN tunnel to the consumer VPC.

Answer

A VPC peering connection.

Answer

A Private Service Connect endpoint in the producer VPC.

Question 5

Which statement about Cloud Armor security policies is true?

Accepted Answer

They support both allow and deny actions for incoming requests.. Cloud Armor security policies are applied at the HTTP(S) Load Balancer layer and support both allow and deny rules for incoming requests, enabling granular control over traffic based on IP ranges, geographic regions, and other attributes. The deny action is essential for blocking malicious traffic, while allow rules permit legitimate requests. This dual-action capability distinguishes Cloud Armor from simple firewall rules that primarily allow or deny based on network-level criteria.

Answer

They can be attached to any GCP resource, including Compute Engine instances.

Answer

They are evaluated after the firewall rules.

Answer

They cannot be used with internal load balancers.

Question 6

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Accepted Answer

Service perimeter. Option C, the service perimeter, is the core VPC Service Controls resource that defines the security boundary around the project's BigQuery datasets and enforces restrictions on data exfiltration. Option D, the VPC accessible services configuration, is required to specify which services (such as BigQuery) inside the perimeter are reachable from the designated VPC network, allowing that network's traffic to reach the protected resources. Option E, the access level, is needed to define the conditions (for example, based on user identity or context) that grant the specified users access to the perimeter's services. Options A and B are not required: a Cloud NAT gateway only provides outbound internet access for private instances and is unrelated to perimeter access control, while Private Google Access only lets VM instances without external IPs reach Google APIs and does not itself define perimeter membership or access conditions.

Answer

Cloud NAT gateway

Answer

Private Google Access

Question 7

An engineer is configuring a Google Compute Engine instance that needs to send traffic to the internet. The instance has no external IP address. Which service must be configured to allow this outbound connectivity?

Accepted Answer

Cloud NAT. Cloud NAT provides outbound internet connectivity for instances without external IP addresses by performing source NAT (IP masquerading) on their behalf. It allows instances in a private subnet to reach the internet for updates, patching, or API calls while remaining unreachable from inbound internet traffic. This is the standard Google-recommended solution for egress-only internet access.

Answer

Cloud VPN

Answer

VPC peering

Answer

Private Google Access

Question 8

A company wants to restrict access to Google Cloud APIs from a specific set of VMs based on the VM's service account. Which type of firewall rule target should be used?

Accepted Answer

Target service accounts. Firewall rules can target instances by service account, allowing fine-grained control based on identity rather than network tags.

Answer

Target tags

Answer

All instances

Answer

Source service accounts

Question 9

A network engineer needs to create a firewall rule that denies all inbound traffic to instances with the tag 'web-server' from source IP range 10.0.0.0/8. They also have an existing allow rule with priority 1000 that permits traffic from 10.0.0.0/8 to those instances. To ensure the deny rule takes precedence, what priority should the new rule have?

Accepted Answer

500. Firewall rules are evaluated in ascending priority order, where lower numbers indicate higher precedence. The existing allow rule has priority 1000, so the new deny rule must have a priority number lower than 1000 to be evaluated first. Priority 500 satisfies this requirement and ensures the deny is matched before the allow.

Answer

1000

Answer

0

Answer

2000

Question 10

An organization has multiple projects and wants to apply a consistent set of firewall rules across all VPC networks in the organization. Which approach should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization level and are inherited by all folders and projects, ensuring consistent rules across the entire hierarchy.

Answer

Create a network firewall policy and attach it to each VPC

Answer

Use VPC peering to share rules

Answer

Apply firewall rules using tags in each project

Question 11

A company wants to protect its external HTTPS load balancer from SQL injection and cross-site scripting attacks. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's managed WAF that attaches to external HTTPS load balancers and provides protection against Layer 7 attacks including SQL injection and cross-site scripting. It uses preconfigured OWASP ModSecurity rules and custom rules to inspect HTTP traffic at the edge. This directly addresses the requirement to protect an external HTTPS load balancer from these application-layer attacks.

Answer

VPC Service Controls

Answer

Cloud Firewall

Answer

Cloud IDS

Question 12

A Compute Engine instance is running a network appliance that requires multiple network interfaces. What is the primary purpose of attaching additional NICs (e.g., NIC1, NIC2) to the instance?

Accepted Answer

To separate traffic between different subnets or networks. Multiple NICs are used to separate traffic planes such as management, data, and control, and to route traffic through different subnets without relying on internal routing.

Answer

To provide failover if one NIC fails

Answer

To enable load balancing across interfaces

Answer

To increase network throughput

Question 13

A company wants to restrict which Google Cloud APIs can be accessed by its VMs in a specific project. They also want to prevent data exfiltration. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to create service perimeters that restrict access to Google Cloud APIs and prevent data exfiltration.

Answer

Cloud NAT

Answer

Private Google Access

Answer

IAM Conditions

Question 14

A company uses Cloud NAT with a static NAT IP address. They notice that connections from their instances are failing after a few minutes. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway is using dynamic port allocation and running out of ports. Cloud NAT with a static NAT IP address uses dynamic port allocation, and if the number of concurrent connections exceeds the available ports, new connections fail. The most likely cause of connections failing after a few minutes is that the Cloud NAT gateway is running out of ports due to dynamic port allocation. This is a common issue when many instances share a single NAT IP and the port range is exhausted.

Answer

The instance's external IP is conflicting with the NAT IP

Answer

The NAT IP address is not whitelisted on the target

Answer

The VPC network has a firewall rule blocking egress

Question 15

An organization wants to allow only certain users to access a service published via Private Service Connect. They need to restrict access based on the source VPC network. What should they use?

Accepted Answer

Consumer allow lists in the service attachment. Private Service Connect allows publishing services with access control using service attachment with consumer allow lists that specify which projects or VPCs can connect.

Answer

Firewall rules in the consumer VPC

Answer

IAM permissions on the service attachment

Answer

VPC Service Controls