PCSE Configuring network security Practice Test 4 — 15 Questions

Question 1

A company uses hierarchical firewall policies to enforce security across all VPC networks in an organization. They have an organization policy that denies egress traffic to the internet. However, a team needs to allow outbound HTTPS traffic to a specific external API (api.example.com) for a project. What is the best way to achieve this?

Accepted Answer

Create a new hierarchical firewall policy rule that allows egress to the IP range of api.example.com with a higher priority than the deny rule.. Hierarchical firewall policies allow you to enforce organization-wide rules while still permitting exceptions via higher-priority rules. By creating a new rule that allows egress to the IP range of api.example.com with a priority higher than the deny rule, you override the deny for that specific traffic. This approach maintains the organization's security posture while enabling the required outbound HTTPS access.

Answer

Configure Cloud NAT with a static IP and allow that IP in the org policy.

Answer

Remove the organization policy and rely on VPC firewall rules.

Answer

Use VPC Service Controls to allow access to the API.

Question 2

You are designing VPC firewall rules for a multi-tier application. Which TWO considerations are important when creating firewall rules in terms of security and manageability? (Choose TWO.)

Accepted Answer

Use hierarchical firewall policies to enforce baseline rules across all VPCs in the organization.. Options A and C are correct. Using service accounts and tags allows dynamic rule targeting, and hierarchical rules centralize management. Option B is wrong because network tags are effective for large deployments. Option D is wrong because global rules apply across regions, which is often desired. Option E is wrong because logging all rules may create excessive logs; only log important rules.

Answer

Network tags are not recommended for large deployments because they require managing many tags.

Answer

Enable firewall rules logging for all rules to ensure full auditability.

Answer

Always specify the target region for firewall rules to limit the scope.

Question 3

A company is setting up Cloud NAT for a subnet that hosts compute instances. They want to ensure high availability and efficient use of IPs. Which TWO configurations should they apply? (Choose TWO.)

Accepted Answer

Specify at least two NAT IPs, each from different zones for redundancy.. Options B and D are correct. Using multiple NAT IPs in different zones provides HA, and manual NAT IP with static reservations ensures IPs are not lost. Option A is wrong because dynamic NAT IPs may change. Option C is wrong because one NAT gateway is sufficient per region; zone-level is not needed. Option E is wrong because Cloud NAT already handles port exhaustion.

Answer

Create a separate Cloud NAT gateway for each zone in the region.

Answer

Disable IP masquerading to preserve source IPs.

Answer

Use dynamic NAT IPs so that Google-managed allocation is used.

Question 4

A company wants to restrict access to a Cloud SQL instance so that only Compute Engine instances in a specific VPC subnet can connect. Which THREE methods can be used to achieve this? (Choose THREE.)

Accepted Answer

Configure authorized networks with the subnet's CIDR range (if using public IP).. Option A is correct because authorized networks allow you to restrict access to a Cloud SQL instance with a public IP by specifying the CIDR range of the subnet. Only traffic originating from IP addresses within that range can connect to the instance, effectively limiting access to Compute Engine instances in that subnet.

Answer

Create a VPC firewall rule that blocks all traffic to the Cloud SQL instance's IP.

Answer

Use VPC Service Controls to limit access to the Cloud SQL instance.

Question 5

A company has deployed a web application on Compute Engine instances in a managed instance group behind an internal HTTP(S) load balancer. The application needs to be accessible only from the corporate office, which has a static public IP range of 203.0.113.0/24. The load balancer is in us-central1. What is the most secure way to restrict access?

Accepted Answer

Configure a Cloud VPN tunnel between on-premises and VPC, then create a firewall rule allowing the corporate IP range to the internal load balancer's backend instances.. Option C is correct because an internal HTTP(S) load balancer has a private IP address that is only reachable from within the same VPC or via Cloud VPN / Cloud Interconnect. To allow access from a corporate office with a static public IP range, you must establish a Cloud VPN tunnel to extend the VPC network to the on-premises network, then create a firewall rule that permits traffic from the corporate IP range to the internal load balancer's backend instances. This ensures traffic traverses an encrypted tunnel and is subject to VPC firewall controls, providing the most secure and architecturally correct solution.

Answer

Create a VPC firewall rule that allows traffic from 203.0.113.0/24 to the load balancer's forwarding rule IP.

Answer

Assign a public IP to the internal load balancer and restrict access using Google Cloud Armor.

Answer

Use Google Cloud Armor with IP allowlisting on the internal load balancer.

Question 6

You are configuring a new VPC network with a private subnet for Compute Engine instances that need to access the internet for updates. Which configuration is the simplest and most secure?

Accepted Answer

Configure Cloud NAT to provide outbound internet access for the instances and create a firewall rule that blocks inbound traffic from the internet.. Cloud NAT allows instances without external IPs to access the internet for outbound connections, while preventing inbound traffic. Option B is correct. Option A is incorrect because assigning external IPs to each instance increases attack surface and is less secure. Option C is incorrect because firewall rules allowing all egress are less secure than NAT. Option D is incorrect because redirecting through a proxy instance adds complexity and single point of failure.

Answer

Create a default VPC firewall rule that allows all egress traffic and assign only internal IPs to instances.

Answer

Use a managed instance group with a proxy instance that has an external IP, and route traffic through the proxy.

Answer

Assign static external IP addresses to each instance and configure firewall rules to allow egress.

Question 7

A company uses Shared VPC in a host project with multiple service projects. The security team wants to ensure that all traffic between service projects is inspected by a third-party firewall appliance deployed in the host project. Which configuration should be implemented?

Accepted Answer

Create a policy-based route in the host project that matches traffic between service project subnets and has a next hop to the firewall appliance's internal IP.. Option C is correct because a policy-based route in the host project can match traffic based on source and destination subnets from different service projects and force that traffic to be forwarded to the next-hop IP of the third-party firewall appliance. This ensures all inter-service-project traffic is inspected by the firewall, as the route overrides the default VPC routing behavior within the Shared VPC environment.

Answer

Enable Cloud NAT on each service project and configure a default route to the firewall appliance.

Answer

Set up VPC network peering between service projects and route traffic through the host project via a VPN tunnel.

Answer

Create a firewall rule in the host project that allows traffic between service projects only if the source is the firewall appliance.

Question 8

Your organization has a VPC with several subnets and wants to enable Private Google Access for Compute Engine instances in a specific subnet to access Google APIs and services without external IP addresses. What must be configured?

Accepted Answer

Enable Private Google Access on the subnet and ensure that instances have a default route (0.0.0.0/0) with next hop to the default internet gateway.. Option C is correct because Private Google Access requires two components: enabling it on the subnet and having a default route (0.0.0.0/0) pointing to the internet gateway. This route allows instances without external IPs to use the VPC's default internet gateway to reach Google APIs via the 199.36.153.4/30 address range, which is advertised by Google's private IP space. Without the default route, traffic from the subnet cannot reach the internet gateway, even with Private Google Access enabled.

Answer

Assign external IPs to the instances and create a firewall rule allowing egress to Google APIs.

Answer

Create a Cloud NAT gateway and enable Private Google Access on the subnet.

Answer

Enable Private Google Access on the subnet only.

Question 9

A company uses Cloud Armor to protect an external HTTPS load balancer. They want to block requests from a specific IP address range 198.51.100.0/24, but allow all other traffic. After creating a deny rule with the source IP condition, they notice that requests from that range are still reaching the backend. What is the most likely cause?

Accepted Answer

Another rule with a lower priority number that allows all traffic is overriding the deny rule.. In Cloud Armor, rules are evaluated in order of priority, where lower priority numbers indicate higher precedence. If a rule with a lower priority number (e.g., 1000) allows all traffic, it will be evaluated before a deny rule with a higher priority number (e.g., 2000), causing the deny rule to be overridden. This is the most likely reason the specific IP range is still reaching the backend despite the deny rule being created.

Answer

The rule action is set to 'allow' instead of 'deny'.

Answer

Cloud Armor cannot block traffic based on source IP; it only supports geographic and header-based conditions.

Answer

The rule uses the wrong match syntax, such as 'sourceIpRange' instead of 'inIpRange'.

Question 10

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They have a firewall appliance (internal IP 10.0.1.100) that inspects all traffic between subnets. They configure a policy-based route to redirect traffic from subnet-a to subnet-b to the appliance. However, traffic from subnet-a to subnet-b still goes directly. What is missing?

Accepted Answer

A VPC route with priority 1000 (direct routing between subnets) is overriding the policy-based route with a lower priority.. B is correct because VPCs have an implicit default route for subnet-to-subnet traffic with a priority of 1000, which is higher than the priority of a policy-based route (typically 2000). Since the policy-based route has a lower priority (higher numerical value), the default route takes precedence, causing traffic to bypass the firewall appliance. To override this, the policy-based route must have a priority lower than 1000 (e.g., 500) to be preferred.

Answer

Compute Engine instances must have a custom route table to use policy-based routes.

Answer

A firewall rule is required to allow traffic to be redirected to the appliance.

Answer

The policy-based route must have the next hop IP set to the appliance's external IP.

Question 11

You are designing a network for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier should only be accessible from the application tier. All tiers are in the same VPC. Which combination of firewall rules meets these requirements?

Accepted Answer

Create an ingress rule allowing traffic from 0.0.0.0/0 to instances with tag 'web', an ingress rule allowing traffic from instances with tag 'web' to instances with tag 'app', and an ingress rule allowing traffic from instances with tag 'app' to instances with tag 'db'.. Option C is correct because it uses VPC firewall tags to enforce least-privilege network segmentation: the web tier is exposed to the internet (0.0.0.0/0), the app tier only accepts traffic from web-tagged instances, and the database tier only accepts traffic from app-tagged instances. This matches the multi-tier access requirements without exposing internal tiers to the internet or to each other unnecessarily.

Answer

Create an ingress rule allowing traffic from the web tier subnet to the application tier subnet, and an ingress rule allowing traffic from the application tier subnet to database tier subnet.

Answer

Assign each tier a unique service account and create ingress rules allowing traffic from the appropriate service accounts.

Answer

Create a single ingress rule that allows all traffic within the VPC network and a separate rule to allow internet traffic to web tier.

Question 12

A company needs to securely connect two VPC networks from different projects in the same organization. Each VPC has overlapping IP ranges (10.0.0.0/16). They require high throughput and low latency. What is the recommended approach?

Accepted Answer

Re-IP one of the VPC networks to a non-conflicting range and then use VPC Network Peering.. Option A is correct because VPC Network Peering requires non-overlapping IP ranges to establish direct connectivity. By re-IPing one VPC to a non-conflicting range (e.g., 10.1.0.0/16), you eliminate the routing conflict, allowing peering to provide high throughput and low latency via Google's internal backbone, with no bandwidth limits or single points of failure.

Answer

Use Dedicated Interconnect to directly connect the two VPCs.

Answer

Use VPC Network Peering.

Answer

Use HA VPN with dynamic routing.

Question 13

Your organization has a security requirement that all traffic to and from Compute Engine instances must be logged and analyzed. You have enabled VPC Flow Logs for all subnets. However, you notice that flow logs are not capturing all traffic between instances in the same subnet. What is the most likely reason?

Accepted Answer

Traffic to the metadata server (169.254.169.254) is not captured by VPC Flow Logs.. VPC Flow Logs do not capture traffic to the metadata server (169.254.169.254) because that traffic is considered internal infrastructure communication and is excluded from flow log collection by design. This is a documented limitation in Google Cloud, and it explains why some traffic between instances in the same subnet—such as metadata queries—is missing from the logs.

Answer

VPC Flow Logs must be enabled on each individual instance, not on subnets.

Answer

VPC Flow Logs only capture traffic that crosses subnet boundaries.

Answer

VPC Flow Logs sample only 1 out of 10 packets by default.

Question 14

Which TWO of the following are valid Google Cloud firewall rule components? (Choose TWO.)

Accepted Answer

Priority. A is correct because firewall rules in Google Cloud require a priority value (0–65535) to determine evaluation order. Lower numbers are evaluated first, and the first matching rule is applied. This is a mandatory component of every firewall rule.

Answer

Protocol signature

Answer

Next hop

Answer

Network tier

Question 15

Which THREE of the following are required to enable VPC Flow Logs for a subnet? (Choose THREE.)

Accepted Answer

A subnet in the VPC. A subnet in the VPC is required because VPC Flow Logs capture IP traffic metadata at the subnet level. Without a subnet, there is no network segment to monitor, as flow logs are associated with a specific subnet within a VPC.

Answer

A sample rate

Answer

An aggregation interval