PCSE Configuring network security Practice Test 3 — 15 Questions

Question 1

A company is deploying a firewall appliance in a VPC to inspect traffic. They create custom routes to direct traffic to the appliance. Which step is necessary to ensure the appliance can forward traffic back?

Accepted Answer

Enable IP forwarding on the appliance instance. Option A is correct because the firewall appliance instance must have IP forwarding enabled at the OS level (e.g., net.ipv4.ip_forward=1 on Linux) to forward packets between its network interfaces. Without this, the instance will drop any traffic not destined for its own IP address, even if VPC routes direct packets to it. This is a prerequisite for the appliance to act as a transparent or routed next-hop in the VPC routing table.

Answer

Use a load balancer

Answer

Configure the appliance as a next hop in a route

Answer

Assign a public IP to the appliance

Question 2

A company is designing a network architecture for a multi-region application. They want to minimize latency and maximize availability. Which two features should they consider? (Choose two.)

Accepted Answer

Cloud CDN. Cloud CDN (Option B) caches content at Google's globally distributed edge points of presence (PoPs), reducing latency by serving users from the nearest cache instead of the origin. The Global Cloud Load Balancer (Option D) provides a single anycast IP address that routes traffic to the closest healthy backend across multiple regions, maximizing availability through automatic failover and global traffic distribution.

Answer

Cloud NAT

Answer

Cloud Interconnect

Answer

VPC Network Peering

Question 3

A security engineer needs to restrict outbound traffic from a VPC to only allow specific external IP ranges. Which three components must be configured? (Choose three.)

Accepted Answer

Cloud NAT. To restrict outbound traffic, you need egress firewall rules (B). If instances have no public IP, they need Cloud NAT for internet access (A). To enforce granular filtering, traffic must be routed through a firewall appliance (D).

Answer

Private Google Access

Answer

Firewall rules on the instance OS

Question 4

A company is migrating workloads to Google Cloud and wants to ensure that their VPC network is secure by default. Which two best practices should they follow? (Choose two.)

Accepted Answer

Remove the default firewall rules that allow all egress. Option A is correct because the default VPC firewall rules include an egress rule that allows all outbound traffic (target: all instances, action: allow, protocol: all, destination: 0.0.0.0/0). Removing this default egress rule and replacing it with more restrictive outbound rules is a security best practice to prevent unauthorized data exfiltration and limit outbound connections to only necessary destinations. This aligns with the principle of least privilege for network traffic.

Answer

Use Shared VPC for all projects

Answer

Create a firewall rule to deny all ingress except specific ports

Answer

Enable VPC Flow Logs

Question 5

A user is unable to SSH into an instance that has the tag 'ssh-access' and an internal IP 10.0.0.2. The user's IP is 198.51.100.1. What is the most likely reason?

Accepted Answer

The user's IP is not in the allowed source range. The firewall rule only allows SSH from the source range 203.0.113.0/24. The user's IP (198.51.100.1) is not in that range, so the connection is denied.

Answer

The instance is not using the correct service account

Answer

The instance does not have an external IP

Answer

The firewall rule is disabled

Question 6

An engineer has enabled Private Google Access on the subnet. However, instances in the subnet cannot access Google APIs (e.g., storage.googleapis.com) using their internal IPs. What is the most likely issue?

Accepted Answer

The domain needs to be added to a DNS zone. Private Google Access allows instances without public IPs to reach Google APIs and services using their internal IPs, but it requires that the DNS resolution for the API domain (e.g., storage.googleapis.com) resolves to the private IP range used by Google's Private Access (199.36.153.8/30). If the domain is not added to a private DNS zone (e.g., googleapis.com) in the VPC, DNS will resolve to public IPs, causing connectivity failure. Option B correctly identifies this missing DNS configuration as the most likely issue.

Answer

The instances need a public IP

Answer

Private Google Access requires a VPC connector

Answer

The instances have no route to the default internet gateway

Question 7

A company has a VPC network with a default route to the internet gateway. They want all egress traffic to go through a firewall appliance instead. They create a new route with a next hop to the appliance and a priority of 500. However, traffic is still going through the internet gateway. What is the most likely reason?

Accepted Answer

The new route's destination range is not 0.0.0.0/0. The default route to the internet gateway has a destination of 0.0.0.0/0. For the new route to override it, the new route must also have a destination of 0.0.0.0/0 (or a more specific prefix). If the new route's destination range is not 0.0.0.0/0, it will not match all egress traffic, and the existing default route with a lower priority (higher numerical value) will still be used for traffic that does not match the new route's destination.

Answer

The new route has a higher tag specification that overrides

Answer

The appliance does not have IP forwarding enabled

Answer

The firewall appliance is in a different network

Question 8

A company runs a GKE cluster with multiple node pools, including one pool of confidential VMs. The security team wants to ensure that only traffic from the internal VPC (10.0.0.0/8) can reach the nodes' metadata server. Which configuration should be applied?

Accepted Answer

Create a firewall rule that allows outbound traffic from nodes to 169.254.169.254 only from the internal VPC range, and deny all other outbound to that IP.. The metadata server for GKE nodes is accessible at the link-local IP 169.254.169.254. To restrict access to this server to traffic originating only from the internal VPC range (10.0.0.0/8), you must create a firewall rule that allows outbound traffic from the nodes to 169.254.169.254 only from that range, and then deny all other outbound traffic to that IP. This ensures that only workloads within the internal VPC can query instance metadata, preventing external or unauthorized pods from accessing sensitive metadata.

Answer

Configure Private Google Access on the subnets.

Answer

Enable IAP TCP forwarding on the cluster.

Answer

Apply a VPC Service Controls perimeter to the GKE cluster.

Question 9

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (172.16.0.0/16). They have established VPC peering between them. An instance in VPC-A needs to communicate with an instance in VPC-B on TCP port 443. What is the minimal firewall configuration needed?

Accepted Answer

Add an ingress firewall rule in VPC-B allowing traffic from 10.0.0.0/16 on port 443.. Option A is correct because VPC peering does not automatically allow traffic; firewall rules must explicitly permit the desired communication. Since the instance in VPC-A initiates the connection to VPC-B, VPC-B's firewall must have an ingress rule allowing traffic from VPC-A's CIDR (10.0.0.0/16) on TCP port 443. This is the minimal configuration because egress rules in VPC-A are implicitly permissive by default in Google Cloud, and only the destination VPC's ingress needs to be opened.

Answer

Add an ingress firewall rule in VPC-A allowing traffic from 172.16.0.0/16 on port 443.

Answer

Add a single firewall rule in the project with source 10.0.0.0/16 and destination 172.16.0.0/16 on port 443.

Answer

Add an egress firewall rule in VPC-A allowing traffic to 172.16.0.0/16 on port 443.

Question 10

A company has a VPC with a subnet (10.1.0.0/24) in us-central1. They have a Cloud NAT configured for outbound traffic to the internet. They want instances in this subnet to access a third-party API that is only accessible over the internet and requires a specific static source IP for whitelisting. What is the recommended approach?

Accepted Answer

Reserve a static NAT IP in Cloud NAT and whitelist that IP with the third party.. Cloud NAT allows instances without external IPs to initiate outbound connections to the internet. By reserving a static NAT IP address in Cloud NAT, you ensure all outbound traffic from the subnet uses a consistent source IP, which can be whitelisted by the third-party API. This meets the requirement for a static source IP without assigning external IPs to individual instances.

Answer

Assign external IPs to the instances and use network-level access controls.

Answer

Use Private Google Access to route traffic through Google's network.

Answer

Configure a VPC Service Controls perimeter to restrict egress.

Question 11

An organization uses Shared VPC with a host project and several service projects. A network administrator in a service project wants to create a firewall rule that allows traffic from a specific source CIDR to a Compute Engine instance in the service project. What is the correct way to achieve this?

Accepted Answer

Request the host project administrator to create the firewall rule in the host project.. In a Shared VPC architecture, firewall rules are a host-project-level resource. Service project administrators cannot create or manage firewall rules that apply to resources in the shared VPC network; only the host project administrator has the necessary permissions. Therefore, to allow traffic from a specific source CIDR to a Compute Engine instance in a service project, the host project administrator must create the firewall rule in the host project, targeting the instance's tags or service account.

Answer

Create the firewall rule in the service project targeting the instance's tags.

Answer

Create a firewall rule in the service project using the instance's service account.

Answer

Use VPC Flow Logs to generate a recommendation and apply it in the service project.

Question 12

A company wants to protect its HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP(S) traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with HTTP(S) Load Balancers to enforce security policies at the edge, blocking malicious requests before they reach backend instances.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC Service Controls

Answer

Cloud CDN

Question 13

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect. They want to allow instances in a VPC (10.0.0.0/8) to access Google APIs (e.g., Cloud Storage) without traversing the public internet. They also want to ensure that traffic from on-premises to Google APIs uses the same private path. Which configuration is required?

Accepted Answer

Enable Private Google Access on the VPC subnet and advertise the default route (0.0.0.0/0) from on-premises with a specific route for Google APIs (199.36.153.4/30) pointing to the interconnect.. Option D is correct because it enables Private Google Access on the VPC subnet, which allows instances with private IPs to reach Google APIs without public internet. Additionally, advertising a default route (0.0.0.0/0) from on-premises via the Dedicated Interconnect ensures that on-premises traffic to Google APIs also uses the private path, while the specific route for Google APIs (199.36.153.4/30) overrides the default to direct API traffic through the interconnect, avoiding asymmetric routing.

Answer

Set up Cloud VPN and use Private Google Access on the VPC.

Answer

Apply VPC Service Controls and enable Private Google Access on the subnet.

Answer

Configure Cloud NAT on the VPC and on-premises route via the interconnect.

Question 14

A company notices that some Compute Engine instances are making unexpected outbound connections to suspicious IP addresses. They want to investigate the traffic patterns and identify the source of these connections. Which tool should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic to and from Compute Engine instances, including source/destination IPs, ports, and protocols. By analyzing these logs, the company can identify the specific instances making unexpected outbound connections to suspicious IP addresses, enabling investigation of traffic patterns.

Answer

Cloud Armor

Answer

Cloud IAM

Answer

Firewall Rules Insights

Question 15

A security engineer needs to provide secure SSH access to a Compute Engine instance that has no external IP address. What is the recommended method?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding.. Option B is correct because IAP TCP forwarding allows SSH without external IP. Option A is wrong because Cloud NAT is for outbound internet, not inbound SSH. Option C is wrong because VPC peering is for VPC-to-VPC, not for a single instance. Option D is wrong because firewall rules alone cannot provide access if there is no external IP.

Answer

Set up VPC peering with the instance's VPC.

Answer

Create a Cloud NAT to allow inbound SSH.

Answer

Add a firewall rule allowing SSH from any IP.