PCSE Practice Test 21 — 15 Questions

Question 1

A company wants to protect a web application hosted on Google Cloud from common web attacks like SQL injection and cross-site scripting (XSS). They have deployed a global external HTTPS load balancer. Which TWO services or configurations should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Armor security policy with OWASP ModSecurity CRS rule set. Cloud Armor provides WAF capabilities with preconfigured rules for OWASP Top 10 threats, including SQLi and XSS. Additionally, using an HTTPS load balancer ensures encrypted traffic. For this question, the correct answers are Cloud Armor and enabling HTTPS (which is already done). But since the load balancer is already HTTPS, the focus is on Cloud Armor. The other options: Cloud IDS is for network threat detection, not WAF; VPC Service Controls is for API access control; SSL policy is for TLS settings.

Answer

SSL policy with RESTRICTED profile

Answer

VPC Service Controls

Answer

Cloud IDS

Question 2

An organization wants to provide private, on-premises access to Google Cloud APIs (e.g., Cloud Storage, BigQuery) without traversing the public internet. They have a Direct Connect link to Google Cloud. Which solution should they implement?

Accepted Answer

Private Service Connect. Private Service Connect allows you to create private endpoints to access Google APIs (like googleapis.com) using internal IP addresses, without going over the internet. It works with Direct Connect or VPN. VPC Service Controls restrict access but do not provide private connectivity. Cloud NAT provides outbound internet access, not private API access. Private Google Access enables on-premises access to Google APIs via on-premises DNS, but it still uses public IPs unless combined with Private Service Connect.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Private Google Access

Question 3

A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?

Accepted Answer

Add the external IP to an access level and configure an ingress rule in the service perimeter.. VPC Service Controls access levels can define IP-based conditions. By creating an ingress rule that allows traffic from the specified IP address to access the BigQuery API, the external application can be authorized.

Answer

Whitelist the external IP in the BigQuery dataset's IAM policy.

Answer

Create a Cloud VPN tunnel between the on-premises network and the VPC, and add the tunnel to the service perimeter.

Answer

Use Private Google Access on the VPC to allow on-premises traffic.

Question 4

An organization has a security policy that requires TLS 1.2 or higher for all HTTPS traffic to their external HTTP(S) load balancer. They also need to disable weak cipher suites. Which configuration should be applied?

Accepted Answer

Set the SSL policy on the target HTTPS proxy with minimum TLS version 1.2 and a MODERN or RESTRICTED cipher profile.. SSL policies on the target HTTPS proxy allow setting minimum TLS version and cipher profile. Set the minimum TLS version to 1.2 and choose the MODERN or RESTRICTED profile to disable weak ciphers.

Answer

Configure the SSL policy on the load balancer's backend bucket.

Answer

Use Cloud Armor WAF rules to block TLS 1.0/1.1 traffic.

Answer

Set the SSL policy on the target HTTPS proxy with minimum TLS version 1.2 and a compatible profile.

Question 5

An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?

Accepted Answer

The DNS CNAME record for domain validation is misconfigured or missing. Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.

Answer

The load balancer's frontend IP address has changed

Answer

The certificate has reached its maximum validity period

Answer

The load balancer's SSL policy requires a minimum TLS version that the managed certificate does not support

Question 6

A security engineer is designing a network security architecture for a multi-project environment. They need to enforce a baseline set of firewall rules across all projects in the organization, but allow individual project teams to add their own specific rules. Which TWO components should they use?

Accepted Answer

Project-level VPC firewall rules. Hierarchical firewall policies can be applied at the organization level to enforce baseline rules. These policies are inherited by all projects. Individual project teams can then create their own VPC firewall rules (or project-level hierarchical policies) that are evaluated after the org-level policies, allowing them to add specific rules without overriding the baseline.

Answer

Network firewall policy

Answer

Shared VPC

Answer

Cloud Armor security policy

Question 7

An organization has multiple VPC networks in different projects. They need to centrally manage firewall rules that apply to all VPCs in the organization and ensure that project owners cannot override them. Which solution should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks. They cannot be overridden by lower-level firewall rules. This is the correct solution for centralized, unoverrideable rules. Network firewall policies are scoped to a single VPC network.

Answer

Create a network firewall policy and attach it to each VPC network

Answer

Use Cloud Armor security policies with the load balancers

Answer

Use VPC firewall rules with tags applied to all VMs across projects

Question 8

A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)

Accepted Answer

Attach the SSL policy to the target HTTPS proxy. To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.

Answer

Enable Cloud Armor WAF rules

Answer

Set the SSL policy to COMPATIBLE profile

Answer

Use a Google-managed SSL certificate

Question 9

Which VPC firewall rule target type is recommended for security because it can be dynamically applied to instances based on their service account?

Accepted Answer

Service accounts. Service account targets allow rules to be applied based on the instance's service account, enabling dynamic and scalable security policies compared to static network tags.

Answer

Instance names

Answer

Subnets

Answer

Tags

Question 10

An organization uses VPC Service Controls in dry-run mode for a project containing Google Cloud Storage. They notice that BigQuery jobs are being logged as violations. How should they interpret this?

Accepted Answer

The perimeters are logging potential violations; no action has been taken yet.. In dry-run mode, VPC Service Controls logs violations without enforcement, allowing administrators to review and adjust perimeters before enabling enforcement.

Answer

The dry-run mode is not supported for Cloud Storage projects.

Answer

The perimeters are not configured correctly because BigQuery should not be affected.

Answer

The perimeters are working correctly and BigQuery access is blocked.

Question 11

Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML-based DDoS detection to automatically learn normal traffic patterns and alert or mitigate attacks.

Answer

Preconfigured WAF rules

Answer

Rate limiting

Answer

Custom rules

Question 12

An organization wants to use Cloud IDS to detect network threats within their VPC. They have enabled the Cloud IDS endpoint and configured packet mirroring. Which of the following is required for the packet mirroring policy to work?

Accepted Answer

VMs must be tagged with 'cloud-ids-packet-mirroring'.. Packet mirroring requires that the source VMs have the cloud-ids-packet-mirroring tag. The mirrored traffic is sent to the IDS endpoint via an internal load balancer.

Answer

The IDS endpoint must be in the same zone as the VMs.

Answer

VPC firewall rules must allow traffic to the IDS endpoint.

Answer

All VMs must have an external IP address.

Question 13

An organization uses VPC Service Controls to protect BigQuery. They want to test a new access level that allows access only from a specific IP range before enforcing it. Which mode should they use?

Accepted Answer

Dry-run mode. Dry-run mode allows testing perimeters without enforcement, logging violations for review.

Answer

Audit mode

Answer

Enforced mode

Answer

Preview mode

Question 14

A company needs to enforce that all incoming traffic to their HTTPS load balancer must use TLS 1.2 or higher. Which SSL policy setting should they configure on the target HTTPS proxy?

Accepted Answer

Set the minimum TLS version to 1.2 and cipher profile to MODERN. SSL policies allow you to set the minimum TLS version. To require TLS 1.2 or higher, set the minimum TLS version to 1.2. The cipher profile can be set to MODERN or RESTRICTED, but the key is the minimum TLS version.

Answer

Set the minimum TLS version to 1.3 only

Answer

Set the minimum TLS version to 1.0 and cipher profile to RESTRICTED

Answer

Use a self-managed certificate with TLS 1.2 enforcement

Question 15

An organization wants to enforce that all Compute Engine instances in a project have a specific tag (e.g., 'env=prod') before they can be created. Which approach should be used?

Accepted Answer

Use an organization policy with a list constraint to require a specific tag on Compute Engine instances.. Use Organization Policy with a constraint that requires tags on resources. The constraint `compute.requireOsLogin` is not related. Resource Manager tags can be enforced via Organization Policy using the `constraints/tags` constraint.

Answer

Create a Cloud Audit Logs sink and trigger a Cloud Function to delete instances without the tag.

Answer

Use a hierarchical firewall policy with a tag condition.

Answer

Create an organization policy with constraint `compute.requireOsLogin` set to true.