PCSE Configuring network security — Timed 10 Questions

Question 1

Your organization has a VPC with several subnets hosting Compute Engine instances. You need to allow SSH access (port 22) to instances in the 'management' subnet from the internet, but only from the office's static IP range (203.0.113.0/24). All other ingress traffic to that subnet should be blocked. Which firewall rule configuration should you create?

Accepted Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action allow. Option C is correct because it creates an ingress firewall rule that explicitly allows TCP port 22 traffic from the office's static IP range (203.0.113.0/24) to instances tagged 'management'. In Google Cloud VPC firewall rules, the default action is to deny all ingress traffic unless an allow rule matches, so this single allow rule satisfies the requirement: only SSH from the office IP range is permitted, and all other ingress is implicitly blocked.

Answer

Create an ingress rule with target tag 'management', source IP range 0.0.0.0/0, protocol tcp:22, action allow

Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action deny

Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol all, action allow

Question 2

Your company is deploying a web application on Google Kubernetes Engine (GKE) with an Internal Load Balancer (ILB) as the ingress. The application must only be accessible from within the same VPC and from an on-premises network connected via Cloud VPN. The on-premises network uses IP range 10.0.0.0/8. You have already created the ILB with a backend service. What is the most secure way to restrict access to the ILB?

Accepted Answer

Configure the backend service's firewall rules to only allow traffic from the ILB's health check ranges and from the VPC and on-premises source ranges. Option B is correct because the most secure way to restrict access to an Internal Load Balancer (ILB) is to apply firewall rules directly on the backend service (the instance group or NEG). This ensures that only traffic from the ILB's health check probe ranges (130.211.0.0/22 and 35.191.0.0/16 for GKE) and the allowed source ranges (VPC and on-premises) can reach the backend instances. This approach prevents any traffic from reaching the backend except through the ILB, which is the intended secure design for an internal-only application.

Answer

Configure a VPC firewall rule to deny all ingress traffic to the ILB's forwarding rule IP address, and then create a higher-priority allow rule for the VPC and on-premises ranges

Answer

Use GKE Network Policy to restrict ingress traffic to the application pods from the VPC and on-premises ranges

Answer

Use Cloud Armor to create a security policy that allows traffic only from the VPC and on-premises ranges, and attach it to the ILB

Question 3

You have a Compute Engine VM that hosts a custom application. The VM has a tag 'app-server' and is in a VPC network with the following firewall rules (priority order from lowest to highest):

Rule 1: Priority 1000, direction INGRESS, source 0.0.0.0/0, target tag 'app-server', protocol tcp:80, action allow
Rule 2: Priority 500, direction INGRESS, source 10.0.0.0/8, target tag 'app-server', protocol tcp:80, action deny
Rule 3: Priority 2000, direction INGRESS, source 192.168.0.0/16, target tag 'app-server', protocol tcp:80, action allow

A user from IP 10.0.0.5 tries to access the application on port 80. Will the request be allowed or denied?

Accepted Answer

Denied, because Rule 2 has a lower priority number and explicitly denies traffic from 10.0.0.0/8. Rule 2 has a priority of 500, which is lower (higher priority) than Rule 1 (priority 1000) and Rule 3 (priority 2000). Since the source IP 10.0.0.5 falls within the 10.0.0.0/8 range, Rule 2 matches first and explicitly denies the traffic. In Google Cloud VPC firewall rules, lower priority numbers are evaluated first, and the first matching rule determines the action.

Answer

Denied, because Rule 3 has a higher priority number and denies traffic from 192.168.0.0/16

Answer

Allowed, because Rule 1 has a lower priority number and allows all traffic

Answer

Allowed, because Rule 3 has a higher priority number and allows traffic from 192.168.0.0/16

Question 4

Your organization uses Shared VPC with a host project and several service projects. You need to ensure that all egress traffic from Compute Engine instances in a service project is routed through a centralized Cloud NAT in the host project. What is the required configuration?

Accepted Answer

Configure a Cloud NAT on the Cloud Router in the host project for the subnet that is shared with the service project. Option C is correct because a Cloud NAT configured on the Cloud Router in the host project for the shared subnet allows all Compute Engine instances in service projects attached to that subnet to use the host project's NAT IP for outbound traffic. This is the only way to centralize egress traffic through the host project's Cloud NAT while respecting Shared VPC architecture, as the NAT is tied to the subnet and Cloud Router in the host project.

Answer

Create a firewall rule in the host project that denies all egress traffic except to the Cloud NAT IP

Answer

Set the instances to use a custom route with next-hop as the Cloud NAT IP address

Answer

Configure a Cloud NAT in each service project and associate it with the subnet that the instances use

Question 5

You are designing a multi-tier application with a frontend and backend. The frontend instances are in subnet A (10.0.1.0/24), and the backend instances are in subnet B (10.0.2.0/24). Both subnets are in the same VPC. You want to allow the frontend to communicate with the backend on TCP port 8080, but the backend must not be able to initiate connections to the frontend. Additionally, the backend must be able to send patches to the internet. Which set of firewall rules should you implement?

Accepted Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on backend: allow all to internet. Option B is correct because the frontend in subnet A initiates connections to the backend on TCP port 8080, so an ingress rule on the backend allowing traffic from subnet A permits this. An egress rule on the backend allowing all traffic to the internet enables patch downloads. This setup prevents the backend from initiating connections to the frontend, as no egress rule on the backend targets the frontend, and no ingress rule on the frontend allows unsolicited traffic from the backend.

Answer

Ingress rule on frontend: allow tcp:8080 from backend's service account; Egress rule on backend: allow all to internet

Answer

Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule on backend: allow all to internet

Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on frontend: deny all to internet

Question 6

You are a security engineer for a company that runs a critical application on Google Cloud. You need to implement defense in depth for network security. Which TWO of the following are effective network security controls that you should implement?

Accepted Answer

VPC firewall rules to restrict traffic between subnets. VPC firewall rules (B) are a fundamental network security control that allow you to restrict traffic between subnets based on source/destination IP ranges, protocols, and ports. This implements network segmentation and micro-segmentation, which is a core principle of defense in depth. Cloud Armor (E) provides Web Application Firewall (WAF) capabilities and DDoS protection at the edge of Google's network, filtering malicious traffic before it reaches your VMs or load balancers.

Answer

OS-level host-based firewalls on each VM

Answer

IAM roles to control who can create Compute Engine instances

Answer

Workload Identity Federation to allow workloads to authenticate to Google APIs

Question 7

Your company has a VPC with multiple subnets. You have deployed a set of Compute Engine instances that must communicate with each other over TCP port 4444. The instances are tagged with 'app-tier'. You need to ensure that only these instances can communicate on this port. Which THREE of the following steps are necessary to achieve this?

Accepted Answer

Create an egress firewall rule that allows TCP 4444 from target tag 'app-tier' to source tag 'app-tier'. Option B is correct because egress firewall rules control outbound traffic from instances. By creating an egress rule allowing TCP 4444 from source tag 'app-tier' to destination tag 'app-tier', you ensure that only instances with the 'app-tier' tag can send traffic on that port to other 'app-tier' instances, while all other outbound traffic is implicitly denied by the default deny egress rule (unless overridden by a higher-priority allow rule). This restricts communication to the intended group.

Answer

Remove the default allow egress rule that allows all outbound traffic

Answer

Create a VPC firewall rule to deny all egress traffic from the VPC

Question 8

You are designing network security for a multi-region GKE cluster with Pods that need to communicate across regions over a private network. The cluster uses VPC-native mode. Which Google Cloud networking feature should you use to ensure low-latency and secure inter-region Pod-to-Pod communication without traversing the public internet?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, high-bandwidth, low-latency connection between your on-premises network and Google Cloud, or between Google Cloud regions, bypassing the public internet. For multi-region GKE clusters using VPC-native mode, Cloud Interconnect enables secure, private inter-region Pod-to-Pod communication by routing traffic through Google's internal backbone, ensuring minimal latency and no exposure to the public internet.

Answer

Cloud VPN with dynamic routing

Answer

Private Service Connect

Answer

VPC Flow Logs

Question 9

Your organization requires that all egress traffic from a VPC network be inspected by a third-party security appliance before leaving the network. The appliance is deployed in a separate VPC. What is the most scalable and maintainable way to route traffic through the appliance?

Accepted Answer

Deploy the appliance in a separate VPC and create a route with next hop as the appliance's internal IP, and tag the VMs that need inspection.. Option C is correct because it uses a route with a next hop of the appliance's internal IP, combined with VM tags to selectively route egress traffic through the appliance. This approach is scalable and maintainable as it avoids complex peering or interconnect setups, and tags allow granular control without modifying routes for every VM.

Answer

Use Cloud Interconnect to connect the two VPCs and configure BGP to advertise a default route from the appliance VPC.

Answer

Use Private Google Access to route traffic through the appliance.

Answer

Deploy the appliance in a separate VPC and use VPC Network Peering with route export/import to redirect traffic.

Question 10

A security engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but in different subnets. Both instances have internal IPs and are in the same region. The firewall rules allow ingress from 10.0.0.0/8. However, traffic is failing. What is the most likely cause?

Accepted Answer

The ingress firewall rule is applied to a network tag that is not assigned to the destination instances.. Option C is correct because firewall rules in Google Cloud VPC are applied to the destination instance based on network tags, not just the subnet or IP range. If the ingress rule allowing traffic from 10.0.0.0/8 is configured with a target tag that is not assigned to the destination Compute Engine instances, the rule will not apply, and traffic will be dropped. This is a common misconfiguration when using tags to selectively apply firewall rules.

Answer

The instances are using external IPs and the source IP is being NATed.

Answer

The VPC has dynamic routing mode set to global, causing routing conflicts.

Answer

There is a firewall rule with a lower priority that denies egress traffic between subnets.