PCNE Implementing VPC Instances — Timed 20 Questions

Question 1

An organization has multiple projects under an organization node. They need to enforce a security policy that denies all inbound SSH traffic (tcp:22) to all VMs across all projects, but must allow certain projects to override this. Which approach should be used?

20 minute time limit — choose an answer to begin.

Accepted Answer

Create a network firewall policy for each VPC with a deny rule for SSH. Use service accounts for exceptions.. Network firewall policies are applied at the VPC level and can be used to enforce a deny rule for SSH traffic. By using service accounts to identify VMs that should be exempt, you can allow certain projects (by assigning the appropriate service accounts) to override the deny. This approach allows per-project customization while maintaining a baseline deny. Option B is incorrect because hierarchical firewall policies do not support targeting entire projects directly; they rely on VM-level tags or service accounts, which would require manual tagging of every VM. Additionally, a hierarchical allow rule with a lower priority would apply to all VMs matching the target, not just the intended projects, potentially causing security gaps. Option A is incorrect because VPC Service Controls is designed for data exfiltration prevention, not traffic filtering. Option D is incorrect because a hierarchical deny rule cannot be overridden by a VPC-level allow rule.

Answer

Use VPC Service Controls to create a service perimeter that blocks SSH traffic to all projects.

Answer

Create a hierarchical firewall policy at the organization level with a rule that allows SSH for specific projects (using target service accounts or tags) at priority 1000, and a deny rule for all SSH at priority 2000.

Answer

Create a hierarchical firewall policy at the organization level denying SSH (tcp:22). Then create a network firewall policy at each VPC allowing SSH for exempted projects.

Question 2

An engineer is troubleshooting a firewall rule issue. A VM with network tag 'web' is unable to receive HTTP traffic from the internet. The VPC has an ingress firewall rule allowing tcp:80 from 0.0.0.0/0 to targets with tag 'web' at priority 1000. Another ingress rule denies all ingress traffic at priority 65535. What is the likely cause?

Accepted Answer

The VM does not have the network tag 'web' assigned. The allow rule targets VMs with network tag 'web'. If the VM does not have this tag, the rule does not apply, and the default deny ingress rule (priority 65535) blocks the HTTP traffic. The priority ordering is correct (allow at 1000 is higher than deny at 65535), but the tag mismatch prevents the allow rule from being effective.

Answer

The firewall rule is an egress rule instead of ingress

Answer

The priority of the allow rule is lower (higher number) than the deny rule

Answer

The VM has an external IP but the firewall rule only applies to internal IPs

Question 3

An engineer needs to provide outbound internet access to a set of Compute Engine instances that have only internal IP addresses. The instances must use a static IP address for outbound traffic. Which solution should they implement?

Accepted Answer

Create a Cloud NAT gateway with static IP address and configure it on the VPC network.. Cloud NAT with manual port allocation allows a static IP to be assigned to the NAT gateway, providing outbound internet access to instances without external IPs.

Answer

Assign a static external IP to each instance and configure a firewall rule to allow egress.

Answer

Configure Private Google Access on the subnet to route traffic to Google APIs.

Answer

Deploy a Compute Engine instance as a NAT instance with IP forwarding enabled.

Question 4

A security team wants to enforce a policy that blocks all egress traffic to the internet from a specific set of VMs across multiple projects in an organization. The policy should be centrally managed and override VPC-level firewall rules. Which approach should they use?

Accepted Answer

Deploy a hierarchical firewall policy at the organization level with a deny egress rule targeting the VMs.. Hierarchical firewall policies at the organization level can enforce rules that apply to all VPCs and override VPC-level rules with lower priority.

Answer

Create VPC firewall rules with deny egress for the specific VMs in each VPC.

Answer

Use a network firewall policy attached to each VPC network.

Answer

Configure Cloud Armor security policies on the load balancer to block egress.

Question 5

An organization needs to restrict access to Google Cloud APIs such that only traffic from a specific set of VMs inside a VPC can reach the APIs, and all other traffic (including from other VPCs) must be denied. The VMs do not have external IPs. Which combination of services should they use?

Accepted Answer

Private Google Access and VPC Service Controls. Private Google Access allows VMs without external IPs to reach Google APIs. VPC Service Controls can create a service perimeter that restricts access to APIs from only authorized VPCs.

Answer

Private Service Connect and VPC Service Controls

Answer

Cloud NAT and VPC Service Controls

Answer

Cloud NAT and Private Google Access

Question 6

A developer wants to allow HTTP (port 80) traffic from the internet to a set of Compute Engine instances that have a tag "web-server". Which firewall rule should they create?

Accepted Answer

Ingress rule: source 0.0.0.0/0, target tag "web-server", tcp:80. An ingress firewall rule with source range 0.0.0.0/0, target tag "web-server", and protocol/port tcp:80 allows HTTP traffic from the internet to the tagged instances.

Answer

Egress rule: source 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Egress rule: destination 0.0.0.0/0, target tag "web-server", tcp:80

Answer

Ingress rule: source 0.0.0.0/0, target service account "web-server", tcp:80

Question 7

A company has a VPC with a subnet in us-central1. They launched a Compute Engine instance named "app-server" in that subnet without an external IP. They need the instance to be able to download updates from the internet. Which two steps must be taken?

Accepted Answer

Create a Cloud NAT gateway and a Cloud Router in us-central1.. The instance needs outbound internet access via Cloud NAT, which requires a Cloud Router in the region.

Answer

Configure Private Google Access on the subnet.

Answer

Create a VPC firewall rule to allow egress to 0.0.0.0/0.

Answer

Assign a static external IP to the instance.

Question 8

An organization uses a hierarchical firewall policy at the organization level with a deny-all egress rule (priority 100). They also have a VPC-level firewall rule allowing egress to a specific external IP (priority 1000). Will traffic to that external IP be allowed?

Accepted Answer

No, because hierarchical firewall policies take precedence over VPC firewall rules.. Hierarchical firewall policies are evaluated before VPC firewall rules and have higher precedence. A deny rule at the org level with priority 100 will override a VPC allow rule with lower priority (higher number).

Answer

Yes, because VPC firewall rules override hierarchical policies for the same traffic.

Answer

Yes, because the VPC rule has a higher priority number and is more specific.

Answer

No, because both rules deny and allow cancel out, resulting in default deny.

Question 9

An engineer wants to allow traffic from a specific service account to a Compute Engine instance. Which firewall rule option should they use for the source?

Accepted Answer

Source service accounts. Firewall rules can use service accounts as source or target. For source, you specify the source service account using the --source-service-accounts flag.

Answer

Target service accounts

Answer

Source IP ranges

Answer

Source tags

Question 10

What is the default MTU for Compute Engine instances on Google Cloud?

Accepted Answer

1460. The default MTU for Google Cloud VMs is 1460 bytes to accommodate encapsulation overhead.

Answer

9000

Answer

1400

Answer

1500

Question 11

A company wants to publish a service running on Compute Engine instances in their VPC so that consumers in other VPCs can access it via private IPs without needing VPC peering. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows a producer to publish a service via a private endpoint that consumers can access from their own VPCs without peering.

Answer

VPC peering

Answer

Cloud VPN

Answer

Cloud NAT

Question 12

An organization needs to protect a web application behind an HTTPS Load Balancer from SQL injection attacks. They want to use a managed WAF solution. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities including preconfigured rules for SQL injection (OWASP) and custom rules.

Answer

VPC Service Controls

Answer

Cloud Firewall Rules

Answer

Cloud CDN

Question 13

An engineer needs to configure DNS resolution for a Compute Engine instance named "web-1" in zone us-central1-a of project my-project. What is the internal DNS name for this instance?

Accepted Answer

web-1.us-central1-a.c.my-project.internal. GCP internal DNS uses the format: [instance name].[zone].c.[project id].internal

Answer

web-1.us-central1.c.my-project.internal

Answer

web-1.c.my-project.us-central1-a.internal

Answer

web-1.us-central1-a.my-project.internal

Question 14

A Compute Engine instance has multiple network interfaces. Which interface is considered the primary (NIC0)?

Accepted Answer

The interface with the lowest index number (nic0).. By default, the first interface attached (nic0) is the primary interface and used for default routes and internal DNS.

Answer

The interface configured first in the instance creation.

Answer

The interface with the highest index number.

Answer

All interfaces are primary.

Question 15

A company wants to restrict access to Google Cloud Storage so that only traffic originating from a specific VPC network is allowed. They also need to prevent data exfiltration to other VPCs. Which two services should they use? (Choose two.)

Accepted Answer

VPC Service Controls. VPC Service Controls creates a service perimeter around the Storage API, and Private Google Access enables VMs without external IPs to access Google APIs from within the VPC.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Firewall rules

Question 16

An organization has a VPC with multiple subnets. They want to log all outbound connections from instances to the internet for compliance. They also want to use a cost-effective solution that doesn't require a proxy. Which three components are needed? (Choose three.)

Accepted Answer

Cloud NAT. Cloud NAT with logging enabled provides logs of outbound connections. Cloud Router is required to set up Cloud NAT. Firewall rules allow the traffic but are not specifically needed for logging; the NAT logs capture the connections.

Answer

Cloud VPN

Answer

VPC Flow Logs

Question 17

An engineer needs to allow HTTP health checks from the Google Cloud health checker IP ranges to a set of instances. Which two methods can be used to target the firewall rule correctly? (Choose two.)

Accepted Answer

Use target service accounts on the instances.. Firewall rules can target instances using tags or service accounts. The health checker IP ranges are well-known and can be used as source.

Answer

Use source service accounts on the health checkers.

Answer

Use source tags on the health checkers.

Answer

Use instance names in the firewall rule.

Question 18

A company has Compute Engine instances without external IPs in a VPC. They need to reach Google APIs such as Cloud Storage and BigQuery. Which configuration will meet this requirement with minimal cost and operational overhead?

Accepted Answer

Configure the subnet to have Private Google Access enabled. Ensure the instances have the appropriate DNS resolution for private.googleapis.com.. Private Google Access enables instances without external IPs to reach Google APIs using internal IPs via the default internet gateway or VPC peering. Configuring a Private Google Access enabled subnet is the simplest and cheapest option, as it does not require NAT or additional instances.

Answer

Set up a Squid proxy on a bastion host with an external IP and route all API traffic through it.

Answer

Create a Cloud NAT gateway in the same region and attach it to the VPC.

Answer

Assign external IPs to the instances and create firewall rules to allow traffic to Google APIs.

Question 19

A network engineer wants to restrict access to a Cloud Storage bucket from only a specific set of Compute Engine instances in a VPC. The instances have no external IPs. What is the most effective way to enforce this restriction?

Accepted Answer

Enable Private Google Access on the subnet and use VPC Service Controls with a service perimeter that includes the VPC and the Cloud Storage bucket.. Using Private Google Access with Private Service Connect allows instances to reach Google APIs via internal IPs. By using VPC Service Controls, you can create a service perimeter that restricts access to the Cloud Storage bucket from the specific VPC and projects. This provides a defense-in-depth approach.

Answer

Assign a unique service account to the instances and use IAM conditions to allow the service account access to the bucket only when connecting from the VPC network.

Answer

Configure a firewall rule that allows egress traffic to the Cloud Storage API only from the instances' subnet.

Answer

Create an IAM condition that restricts access based on the instance's internal IP address range.

Question 20

A company wants to protect its HTTP(S) Load Balancer against DDoS attacks and common web exploits like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google's web application firewall (WAF) and DDoS protection service. It integrates with Cloud Load Balancing to provide security policies that inspect traffic and block attacks like SQLi and XSS using pre-configured WAF rules.

Answer

VPC Service Controls

Answer

Firewall Rules

Answer

Cloud NAT