PCSE Practice Test 36 — 15 Questions

Question 1

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (172.16.0.0/16). They have established VPC peering between them. An instance in VPC-A needs to communicate with an instance in VPC-B on TCP port 443. What is the minimal firewall configuration needed?

Accepted Answer

Add an ingress firewall rule in VPC-B allowing traffic from 10.0.0.0/16 on port 443.. Option A is correct because VPC peering does not automatically allow traffic; firewall rules must explicitly permit the desired communication. Since the instance in VPC-A initiates the connection to VPC-B, VPC-B's firewall must have an ingress rule allowing traffic from VPC-A's CIDR (10.0.0.0/16) on TCP port 443. This is the minimal configuration because egress rules in VPC-A are implicitly permissive by default in Google Cloud, and only the destination VPC's ingress needs to be opened.

Answer

Add an ingress firewall rule in VPC-A allowing traffic from 172.16.0.0/16 on port 443.

Answer

Add a single firewall rule in the project with source 10.0.0.0/16 and destination 172.16.0.0/16 on port 443.

Answer

Add an egress firewall rule in VPC-A allowing traffic to 172.16.0.0/16 on port 443.

Question 2

Your organization has a security requirement that all traffic to and from Compute Engine instances must be logged and analyzed. You have enabled VPC Flow Logs for all subnets. However, you notice that flow logs are not capturing all traffic between instances in the same subnet. What is the most likely reason?

Accepted Answer

Traffic to the metadata server (169.254.169.254) is not captured by VPC Flow Logs.. VPC Flow Logs do not capture traffic to the metadata server (169.254.169.254) because that traffic is considered internal infrastructure communication and is excluded from flow log collection by design. This is a documented limitation in Google Cloud, and it explains why some traffic between instances in the same subnet—such as metadata queries—is missing from the logs.

Answer

VPC Flow Logs must be enabled on each individual instance, not on subnets.

Answer

VPC Flow Logs only capture traffic that crosses subnet boundaries.

Answer

VPC Flow Logs sample only 1 out of 10 packets by default.

Question 3

A company has a VPC with a subnet (10.1.0.0/24) in us-central1. They have a Cloud NAT configured for outbound traffic to the internet. They want instances in this subnet to access a third-party API that is only accessible over the internet and requires a specific static source IP for whitelisting. What is the recommended approach?

Accepted Answer

Reserve a static NAT IP in Cloud NAT and whitelist that IP with the third party.. Cloud NAT allows instances without external IPs to initiate outbound connections to the internet. By reserving a static NAT IP address in Cloud NAT, you ensure all outbound traffic from the subnet uses a consistent source IP, which can be whitelisted by the third-party API. This meets the requirement for a static source IP without assigning external IPs to individual instances.

Answer

Assign external IPs to the instances and use network-level access controls.

Answer

Use Private Google Access to route traffic through Google's network.

Answer

Configure a VPC Service Controls perimeter to restrict egress.

Question 4

An organization uses Shared VPC with a host project and several service projects. A network administrator in a service project wants to create a firewall rule that allows traffic from a specific source CIDR to a Compute Engine instance in the service project. What is the correct way to achieve this?

Accepted Answer

Request the host project administrator to create the firewall rule in the host project.. In a Shared VPC architecture, firewall rules are a host-project-level resource. Service project administrators cannot create or manage firewall rules that apply to resources in the shared VPC network; only the host project administrator has the necessary permissions. Therefore, to allow traffic from a specific source CIDR to a Compute Engine instance in a service project, the host project administrator must create the firewall rule in the host project, targeting the instance's tags or service account.

Answer

Create the firewall rule in the service project targeting the instance's tags.

Answer

Create a firewall rule in the service project using the instance's service account.

Answer

Use VPC Flow Logs to generate a recommendation and apply it in the service project.

Question 5

Which TWO of the following are benefits of using Cloud NAT? (Choose TWO.)

Accepted Answer

Instances without external IP addresses can connect to the internet.. Cloud NAT allows instances without external IP addresses to initiate outbound connections to the internet, translating their private IPs to a single public IP or a range. This is a core benefit because it enables secure outbound internet access without exposing instances to inbound traffic.

Answer

Cloud NAT provides inbound port forwarding to instances.

Answer

Cloud NAT can be used to enable connectivity between VPC networks via VPN.

Answer

Cloud NAT automatically provides high availability across zones.

Question 6

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect. They want to allow instances in a VPC (10.0.0.0/8) to access Google APIs (e.g., Cloud Storage) without traversing the public internet. They also want to ensure that traffic from on-premises to Google APIs uses the same private path. Which configuration is required?

Accepted Answer

Enable Private Google Access on the VPC subnet and advertise the default route (0.0.0.0/0) from on-premises with a specific route for Google APIs (199.36.153.4/30) pointing to the interconnect.. Option D is correct because it enables Private Google Access on the VPC subnet, which allows instances with private IPs to reach Google APIs without public internet. Additionally, advertising a default route (0.0.0.0/0) from on-premises via the Dedicated Interconnect ensures that on-premises traffic to Google APIs also uses the private path, while the specific route for Google APIs (199.36.153.4/30) overrides the default to direct API traffic through the interconnect, avoiding asymmetric routing.

Answer

Set up Cloud VPN and use Private Google Access on the VPC.

Answer

Apply VPC Service Controls and enable Private Google Access on the subnet.

Answer

Configure Cloud NAT on the VPC and on-premises route via the interconnect.

Question 7

A company uses Cloud Armor to protect an external HTTPS load balancer. They want to block requests from a specific IP address range 198.51.100.0/24, but allow all other traffic. After creating a deny rule with the source IP condition, they notice that requests from that range are still reaching the backend. What is the most likely cause?

Accepted Answer

Another rule with a lower priority number that allows all traffic is overriding the deny rule.. In Cloud Armor, rules are evaluated in order of priority, where lower priority numbers indicate higher precedence. If a rule with a lower priority number (e.g., 1000) allows all traffic, it will be evaluated before a deny rule with a higher priority number (e.g., 2000), causing the deny rule to be overridden. This is the most likely reason the specific IP range is still reaching the backend despite the deny rule being created.

Answer

The rule action is set to 'allow' instead of 'deny'.

Answer

Cloud Armor cannot block traffic based on source IP; it only supports geographic and header-based conditions.

Answer

The rule uses the wrong match syntax, such as 'sourceIpRange' instead of 'inIpRange'.

Question 8

A company has a VPC with several subnets. They want to allow HTTP traffic from the internet to a web server in subnet-a, but block all other inbound traffic. What is the simplest firewall rule configuration?

Accepted Answer

Create an ingress rule allowing tcp:80 from 0.0.0.0/0 to instances with the 'web-server' tag. The implied deny all ingress rule blocks other traffic.. Option C is correct because it creates an ingress rule that explicitly allows TCP port 80 traffic from any source (0.0.0.0/0) to instances tagged as 'web-server'. In cloud VPC firewalls (e.g., AWS Security Groups or GCP Firewall Rules), the default behavior is an implied deny all ingress traffic; only explicitly allowed traffic is permitted. This configuration satisfies the requirement to allow HTTP from the internet while blocking all other inbound traffic without needing additional rules.

Answer

Create an ingress rule allowing all tcp and udp traffic from 0.0.0.0/0.

Answer

Create an egress rule allowing tcp:80 from the internet to the web server.

Answer

Create an ingress rule allowing tcp:80 from the web server's internal IP range. The implied deny all ingress rule blocks other traffic.

Question 9

Which TWO of the following are valid reasons to enable VPC Flow Logs? (Choose two.)

Accepted Answer

To perform network forensics after a security incident. Option D is correct because VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet/byte counts. This historical data is essential for post-incident network forensics, allowing you to trace the path of malicious traffic, identify compromised hosts, and reconstruct the timeline of an attack. Without flow logs, you would lack the granular traffic records needed for such analysis.

Answer

To log Cloud NAT translations for audit purposes

Answer

To detect and block DDoS attacks at the network layer

Answer

To enforce firewall rules automatically based on traffic patterns

Question 10

Refer to the exhibit. An engineer wants to allow inbound SSH (tcp:22) to a VM with network tag 'ssh-access' in the 'default' VPC. Which firewall rule should they create?

Accepted Answer

Create a new ingress rule allowing tcp:22 from 0.0.0.0/0 to instances with tag 'ssh-access' with priority 1000.. Option B is correct because it creates a new ingress firewall rule that explicitly allows inbound TCP port 22 traffic from any source (0.0.0.0/0) only to VM instances that have the network tag 'ssh-access'. In Google Cloud VPC, firewall rules are stateful and apply at the instance level based on target tags; a priority of 1000 ensures this rule is evaluated appropriately relative to higher-priority (lower number) deny rules. This approach preserves the default-allow-ssh rule for other instances while granting SSH access specifically to tagged VMs.

Answer

Remove the 'default-allow-ssh' rule and create a new rule with no target tags.

Answer

Create a new egress rule allowing tcp:22 from instances with tag 'ssh-access' to 0.0.0.0/0.

Answer

Modify the existing 'default-allow-ssh' rule to add a target tag 'ssh-access'.

Question 11

A company runs a multi-tier application on Compute Engine behind an external HTTP(S) Load Balancer. The backend consists of a managed instance group for the application tier and a Cloud Storage bucket for static assets. During peak traffic, some users receive HTTP 503 errors. The backend instances are healthy and the load balancer shows no connection errors. The company has already enabled Cloud CDN for the backend bucket. What should they do to resolve the 503 errors?

Accepted Answer

Increase the size of the instance group to handle more requests.. The 503 errors likely indicate that the instance group cannot handle the request volume. Increasing the size of the instance group provides more capacity. Option B is incorrect because CDN is already enabled for static content, and the 503 is likely for dynamic content. Option C is incorrect because connection draining affects instance removal, not capacity. Option D is incorrect because forcing caching of dynamic content may serve stale data or not be allowed.

Answer

Enable Cloud CDN on the backend bucket to cache static content.

Answer

Increase the backend bucket's cache mode to force caching of dynamic content.

Answer

Adjust the load balancer's connection draining timeout.

Question 12

A global e-commerce company uses Google Cloud to host its platform. They store customer payment data in Cloud SQL and use Cloud Storage for backups. Currently, they rely on Google-managed encryption keys. A new compliance requirement mandates that all encryption keys must be stored in a hardware security module (HSM) and rotated every 30 days. Additionally, they need to retain backup data for 7 years, during which the keys used to encrypt the backups must be available for decryption. They have created a Cloud HSM key ring and a key with a rotation period of 2592000 seconds (30 days). After configuring Cloud SQL and Cloud Storage to use the Cloud HSM key, they notice that backups older than 30 days cannot be decrypted. The company's security engineer verified that the key versions are still present. What is the most likely cause and how should it be resolved?

Accepted Answer

The automatic backups in Cloud SQL are encrypted with the primary key version at backup time, but the backup restore functionality does not automatically use the latest key version. Update the backup configuration to use the current primary key version for decryption.. Option B is correct because Cloud SQL backups are encrypted with the primary key version at the time of backup creation. When restoring a backup, Cloud SQL does not automatically use the latest key version; it attempts to decrypt using the key version that was primary at backup time. Since the key is rotated every 30 days, backups older than 30 days were encrypted with a previous primary key version. Even though the key versions are still present in Cloud HSM, the backup restore operation fails because it does not automatically reference the correct historical key version. The fix is to explicitly update the backup configuration to point to the current primary key version, which allows Cloud SQL to locate and use the appropriate key version for decryption.

Answer

The key material was imported incorrectly. Delete the key ring and recreate it using an external HSM.

Answer

The rotation period of 30 days is too short for key retention. Disable automatic rotation and use manual key rotation every 30 days while retaining all versions.

Answer

Cloud Storage does not support Cloud HSM keys for object encryption. Switch to customer-supplied encryption keys (CSEK).

Question 13

A company runs a containerized application on Google Kubernetes Engine (GKE) that reads from a Cloud Storage bucket encrypted with a customer-managed key (CMEK) in Cloud KMS. The application uses a dedicated Google service account with the roles/storage.objectViewer role and a Cloud KMS CryptoKey Decrypter binding on the key. After a scheduled key rotation, the application started receiving '403 Access Denied' errors when accessing objects. The Cloud KMS key has multiple versions. The service account's IAM permissions have not changed. What is the most likely cause and the appropriate fix?

Accepted Answer

Ensure the service account has the 'Cloud KMS CryptoKey Decrypter' role on the key, which applies to all key versions, including the old version used for encryption.. The correct answer is D. In Cloud KMS, IAM permissions are evaluated at the key level, not per key version. When a key is rotated, the new primary version is automatically enabled, but the old version remains active for decrypting data encrypted with it. The service account already has the 'Cloud KMS CryptoKey Decrypter' role on the key, which grants permission to decrypt with any version of that key. The 403 error likely occurred because the application's client library or configuration was explicitly referencing the old key version ID, which may have been disabled or is no longer primary, but the IAM binding on the key itself is sufficient. The fix is to ensure the service account has the role on the key (which it does) and that the application uses the key resource name (not a specific version) to allow automatic use of the correct version.

Answer

In Cloud KMS, enable the new key version and ensure it is set as primary.

Answer

Create a new key ring and migrate the service account to use a new key.

Answer

Disable the old key version and re-encrypt all objects with the new key version.

Question 14

Your company runs a production application on Google Kubernetes Engine (GKE) with a Regional cluster. The application uses a custom domain with TLS certificates that are stored as Kubernetes secrets and mounted into the ingress. The certificates expire every 90 days and are currently renewed manually by a DevOps engineer. Last week, the certificate expired, causing an outage until it was renewed. Management requires an automated solution to renew certificates before expiration. The team wants to minimize changes to the existing architecture and avoid additional costs. What should you do?

Accepted Answer

Deploy cert-manager on the GKE cluster and configure it with an Issuer or ClusterIssuer to automatically obtain and renew certificates from Let's Encrypt.. Option B is correct because cert-manager is a native Kubernetes add-on that automates the lifecycle of TLS certificates from public CAs like Let's Encrypt. It integrates directly with GKE Ingress and can handle ACME HTTP-01 or DNS-01 challenges without altering the existing architecture or incurring additional cloud costs, as it runs within the cluster.

Answer

Configure Cloud Load Balancing with a Google-managed SSL certificate and update the DNS to point to the load balancer IP.

Answer

Set up Cloud DNS to automatically respond to ACME HTTP-01 challenges and configure the ingress to use certificates from a public CA.

Answer

Store the certificate and private key in Cloud Secret Manager and configure the ingress to reference the secrets via the Secret Manager CSI driver.

Question 15

A startup company has a single Google Cloud project with multiple developers. To simplify identity management, they created a service account for each developer and granted them the roles/editor role on the project. However, the security team is concerned about the over-privileged access. They want to implement a more secure approach while maintaining operational efficiency. The developers need to: create Compute Engine instances, manage Cloud Storage buckets, and deploy App Engine apps. The company has a small team and does not require fine-grained access control per developer. What is the recommended approach to reduce privileges while meeting the developers' needs?

Accepted Answer

Remove the editor role, create a custom role with the required permissions, and assign the custom role to a Google Group containing all developers.. Option D is correct because it removes the overly permissive Editor role and replaces it with a custom role containing only the specific permissions needed for Compute Engine, Cloud Storage, and App Engine. Assigning this custom role to a Google Group that contains all developers simplifies identity management and ensures consistent, least-privilege access without per-user assignment overhead.

Answer

Remove the editor role and grant each developer the roles/owner role on the project.

Answer

Remove the editor role and create a custom role with the required permissions, then assign the custom role to each developer individually.

Answer

Remove the editor role and grant each developer the roles/iam.securityReviewer role.