PCSE Configuring Network Security — 20 Questions

Question 1

A DevOps team wants to automatically provision and renew SSL certificates for a global HTTPS load balancer. Which certificate management option should be used?

Accepted Answer

Use Certificate Manager with a DNS authorization to create a Google-managed certificate.. Google-managed SSL certificates automatically provision and renew certificates for domains hosted on Google Cloud, ideal for load balancers without manual intervention.

Answer

Create a Google-managed certificate directly on the load balancer and configure a cron job to check renewal.

Answer

Use a third-party CA and upload the certificate with a longer validity.

Answer

Upload a self-managed certificate and configure a cron job to renew it.

Question 2

A security engineer wants to apply a baseline set of firewall rules that apply to all new and existing VMs in an organization, and these rules must not be overridden by project-level rules. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level.. Hierarchical firewall policies are enforced at the organization or folder level and cannot be overridden at lower levels, ensuring baseline rules are always applied.

Answer

Create a VPC firewall rule with priority 0.

Answer

Use Cloud IDS to monitor and block traffic.

Answer

Create a firewall rule in each project and enforce via policy library.

Question 3

An organization uses SSL policies for their HTTPS load balancer. They need to allow TLS 1.2 and 1.3 only, and use the most secure cipher profile available. Which SSL policy configuration should they choose?

Accepted Answer

minTlsVersion: 1.2, profile: RESTRICTED. The RESTRICTED profile is the most secure SSL policy profile, allowing only strong ciphers and modern TLS versions. Setting minTlsVersion to 1.2 with RESTRICTED allows TLS 1.2 and 1.3 while enforcing the strictest cipher suite, matching the requirement. MODERN and COMPATIBLE are less restrictive, and a custom profile with minTlsVersion 1.3 would exclude TLS 1.2, which the requirement says to allow.

Answer

minTlsVersion: 1.2, profile: MODERN

Answer

minTlsVersion: 1.2, profile: COMPATIBLE

Answer

minTlsVersion: 1.3, profile: CUSTOM

Question 4

Which VPC firewall rule target type is recommended for security because it can be dynamically applied to instances based on their service account?

Accepted Answer

Service accounts. Service account targets allow rules to be applied based on the instance's service account, enabling dynamic and scalable security policies compared to static network tags.

Answer

Instance names

Answer

Subnets

Answer

Tags

Question 5

A company wants to detect and block SQL injection attacks targeting their web application hosted on Compute Engine behind a Cloud Load Balancer. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Enable Cloud Armor adaptive protection to detect and block suspicious patterns.. Cloud Armor preconfigured rules (like OWASP ModSecurity CRS) can detect SQLi, and enabling adaptive protection provides ML-based anomaly detection. Cloud IDS is for network-level threats, not WAF; VPC firewall rules don't inspect application payloads.

Answer

Deploy Cloud IDS in the VPC to inspect packets for SQLi patterns.

Answer

Configure VPC firewall rules to deny traffic on port 443.

Answer

Use VPC Service Controls to restrict access to the backend instances.

Question 6

A financial services company must ensure that all data in Cloud Storage remains within a specific region and that no data can be accessed from outside the corporate network. They also need to allow a partner organization to access a specific bucket. Which THREE Google Cloud services or features should be combined to meet these requirements? (Choose THREE.)

Accepted Answer

Private Service Connect. VPC Service Controls (E) is correct because it creates a service perimeter around Cloud Storage that restricts data access to authorized networks and prevents data exfiltration, keeping data within the specified region and inaccessible from outside the corporate network. Access levels (IP-based) (C) is correct because access levels define the conditions (such as corporate IP ranges) under which requests are allowed into the VPC Service Controls perimeter, enforcing the requirement that no data be accessed from outside the corporate network. Private Service Connect (B) is correct because it enables the partner organization to privately and securely reach the specific bucket through an endpoint without exposing it to the public internet, satisfying the partner access requirement. Cloud IDS (A) is not correct because it is a network intrusion detection service for threat monitoring, not an access-control or data-residency mechanism. Cloud Armor security policies (D) are not correct because Cloud Armor protects HTTP(S) load-balanced applications against web attacks and does not govern Cloud Storage access or regional data boundaries.

Answer

Cloud IDS

Answer

Cloud Armor security policies

Question 7

An organization wants to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can reach it, without using public IP addresses. Which solution should they implement?

Accepted Answer

Private Google Access. Private Google Access allows on-premises hosts or VM instances using internal IPs to reach Google APIs and services (like Cloud Storage) by routing traffic through the VPC network, without requiring public IPs.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud VPN

Question 8

A security engineer needs to allow HTTP (port 80) traffic from all VMs in the production environment to a specific set of VMs running a web server. The web server VMs are identified by a service account 'web-sa@...'. Which firewall rule configuration should the engineer create?

Accepted Answer

Ingress rule: source = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80. Using a service account as the target (serviceAccount = web-sa@...) is the recommended approach for security, as it is more dynamic and less error-prone than using network tags. The rule allows ingress traffic from any source (0.0.0.0/0) on TCP port 80 to VMs with that service account.

Answer

Egress rule: destination = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], deny tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], allow tcp:80

Question 9

A company wants to enforce that all VPC firewall rules in an organization must be centrally managed and cannot be overridden by lower-level projects. Which approach should they use?

Accepted Answer

Use a hierarchical firewall policy at the organization node. Hierarchical firewall policies are applied at the organization, folder, or project level and are inherited downward. They can be set to have higher priority than network firewall rules, and lower-level rules cannot override them if the policy is set accordingly.

Answer

Create network firewall rules at the organization level

Answer

Configure VPC Service Controls with a perimeter

Answer

Enable Organizational Policy constraints

Question 10

A company wants to provide private connectivity from its VPC to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs or NAT. The solution must also support on-premises connectivity via Cloud VPN. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect (PSC) lets you create private endpoints inside your VPC that map to Google APIs and services, so traffic never traverses the public internet or requires a NAT. It also supports hybrid connectivity because on-premises networks reach the PSC endpoint through Cloud VPN or Interconnect, satisfying both requirements. PSC is the modern, recommended replacement for Private Google Access in scenarios requiring private, hybrid-reachable API access.

Answer

Private Google Access

Answer

Cloud NAT

Answer

Cloud VPN

Question 11

An organization needs to restrict access to Cloud Storage buckets so that only requests from a specific range of IP addresses (e.g., corporate VPN) are allowed. They also want to block all other IPs. Which combination of services should they use?

Accepted Answer

VPC Service Controls with an IP-based access level. VPC Service Controls with an IP-based access level is the correct combination because VPC Service Controls provide a security perimeter around Google Cloud services like Cloud Storage, and access levels can define conditions based on source IP addresses (CIDR ranges). This allows granular control to permit only requests from the corporate VPN IP range while blocking all others, directly meeting the requirement. IAM conditions with source IP can restrict access but are evaluated per identity and do not create a service perimeter; they are less comprehensive for blocking all other IPs at the service level. Firewall rules apply to VPC networks and not to Cloud Storage's public endpoints, and Cloud Armor protects HTTP(S) load balancers, not direct bucket access.

Answer

IAM conditions with source IP

Answer

Firewall rules with source IP

Answer

Cloud Armor with IP allow list

Question 12

A company wants to enable private connectivity from its on-premises network to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs. They have a Cloud VPN connection to a VPC. Which TWO services or configurations are required? (Choose two.)

Accepted Answer

Private Google Access. Private Google Access (C) is required because it allows VM instances in a subnet without external IP addresses to reach Google APIs and services using internal IP addresses, which is essential for private connectivity from the on-premises network through the Cloud VPN to Google APIs. Private Service Connect (D) is also required because it enables private connectivity to Google APIs by creating a private endpoint (a forwarding rule with an internal IP address) in the VPC, allowing on-premises hosts to reach Google APIs via the VPN without public IPs. Cloud Armor (A) is a WAF/security service for protecting HTTP(S) load balancers, not for private API connectivity. Cloud NAT (B) provides outbound internet access for instances without external IPs but uses public IPs and does not provide private connectivity to Google APIs. VPC Service Controls (E) is a security perimeter service for mitigating data exfiltration, not a connectivity mechanism.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

VPC Service Controls

Question 13

A security engineer is designing a VPC Service Controls perimeter to protect sensitive BigQuery data. They need to allow a specific on-premises application (source IP range 203.0.113.0/24) to query BigQuery, and also allow a managed instance group in another project (project 'analytics') to export data from BigQuery to Cloud Storage. Which THREE configurations are required? (Choose three.)

Accepted Answer

Add the analytics project to the service perimeter. Option A is correct because the managed instance group in project 'analytics' must be inside the VPC Service Controls perimeter for its BigQuery-to-Cloud-Storage operations to be governed and permitted; projects containing resources that access protected services must be added to the perimeter. Option C is correct because exporting data from BigQuery to Cloud Storage crosses the perimeter boundary to a service outside it, so an egress rule allowing access to Cloud Storage is required to permit that data flow. Option E is correct because on-premises clients are outside Google Cloud and are identified by access levels based on source IP ranges (203.0.113.0/24); an ingress rule referencing that access level is needed to allow the on-premises application to reach BigQuery. Option B is incorrect because Cloud Armor protects HTTP(S) load-balanced applications at the edge and does not govern VPC Service Controls access to BigQuery. Option D is incorrect because the managed instance group is inside the perimeter once project 'analytics' is added, so an ingress rule for its service account is unnecessary; ingress rules are for identities outside the perimeter.

Answer

Configure Cloud Armor to allow the on-premises IP

Answer

Create an ingress rule to allow the service account of the managed instance group

Question 14

A company uses VPC Service Controls to protect a project containing BigQuery datasets. They have an ingress rule that allows traffic from an on-premises network via a Cloud VPN tunnel. The on-premises IP range is 10.0.0.0/8. However, users on-premises are still getting access denied errors when querying BigQuery. The VPC Service Controls perimeter is in dry-run mode. What is the most likely cause?

Accepted Answer

Cloud VPN is not a supported access method for VPC Service Controls.. VPC Service Controls ingress rules can only be configured for supported access sources, and Cloud VPN is not one of them. The supported sources are: an access level (based on IP/device/identity), a VPC network in another perimeter, or a Google Cloud project. A Cloud VPN tunnel from on-premises does not qualify as any of these, so the ingress rule cannot actually authorize the on-premises traffic. The correct fix is to create an access level that includes the on-premises IP range (10.0.0.0/8) and reference that access level in the ingress rule, rather than trying to use the VPN itself as the source.

Answer

The perimeter is in dry-run mode, which blocks all traffic until the rule is finalized.

Answer

The ingress rule does not include the on-premises user identities or service accounts.

Answer

The dry-run mode only applies to egress rules, not ingress.

Question 15

A company uses Cloud Armor security policies to protect their HTTP load balancer. They need to block requests from a specific geographic region (country X) and also limit requests from any IP to 1000 requests per second. They also want to use preconfigured rules for SQL injection prevention. What is the correct way to combine these requirements in a single security policy?

Accepted Answer

Create separate rules: one for geo-blocking with priority 500, one for rate limiting with priority 600, and enable preconfigured SQLi rules at priority 1000. Order them appropriately.. Cloud Armor security policies allow multiple rules with different priorities. Each rule can have a single action and match condition. To combine geo-blocking, rate limiting, and preconfigured SQLi rules, you create separate rules with appropriate priorities. The geo-blocking rule (priority 500) denies traffic from country X, the rate limiting rule (priority 600) throttles requests, and the preconfigured SQLi rule (priority 1000) blocks SQL injection attempts. Lower priority numbers are evaluated first, so ordering matters.

Answer

Create a single custom rule with both geo-blocking and rate limiting conditions using CEL expressions, and enable preconfigured SQLi rules.

Answer

Use Cloud Armor Managed Protection Plus, which automatically includes geo-blocking and rate limiting.

Answer

Enable SQLi preconfigured rules only; geo-blocking and rate limiting are not supported in Cloud Armor.

Question 16

A security engineer needs to detect and alert on network-based threats such as malware and command-and-control traffic within their Google Cloud VPC. They want a managed service that provides deep packet inspection and integrates with their existing security operations. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with VPC packet mirroring and provides threat severity levels. Cloud Armor protects web applications at the edge. VPC Service Controls restrict data access. Cloud NGFW (next-generation firewall) is not a Google Cloud managed service; Google offers Cloud Firewall (which is not NGFW).

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Cloud NGFW

Question 17

An organization uses VPC Service Controls with a service perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises service account to write data to a Cloud Storage bucket inside the perimeter. The on-premises network connects via Cloud VPN. What must be configured in the perimeter?

Accepted Answer

An ingress rule that specifies the on-premises service account and the Cloud VPN network as sources. VPC Service Controls ingress rules explicitly define which identities and networks may enter a perimeter to access protected services. Because the on-premises service account connects through Cloud VPN, the ingress rule must name that service account as the identity source and the Cloud VPN network as the network source, which is precisely what option A describes.

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage bucket

Answer

An egress rule that allows the service account to exit the perimeter

Answer

An access level that includes the on-premises IP range

Question 18

A company needs to enforce that all incoming traffic to their HTTPS load balancer must use TLS 1.2 or higher. Which SSL policy setting should they configure on the target HTTPS proxy?

Accepted Answer

Set the minimum TLS version to 1.2 and cipher profile to MODERN. SSL policies allow you to set the minimum TLS version. To require TLS 1.2 or higher, set the minimum TLS version to 1.2. The cipher profile can be set to MODERN or RESTRICTED, but the key is the minimum TLS version.

Answer

Set the minimum TLS version to 1.3 only

Answer

Set the minimum TLS version to 1.0 and cipher profile to RESTRICTED

Answer

Use a self-managed certificate with TLS 1.2 enforcement

Question 19

A company is implementing VPC Service Controls to protect a project that contains Cloud Storage and BigQuery. They want to allow a specific on-premises service account to read data from Cloud Storage and write to BigQuery. The on-premises network connects via Cloud VPN. Which TWO components must be configured in the service perimeter? (Choose two.)

Accepted Answer

An ingress rule that allows the on-premises service account to access Cloud Storage and BigQuery. To allow external access, you need an ingress rule that specifies the source (on-premises service account and the Cloud VPN network) and the allowed services (Cloud Storage and BigQuery). An access level can be used to define the IP range, but the ingress rule is the primary mechanism. Adding the service to the perimeter is already done; you don't need to add it again. An egress rule is not needed for inbound access.

Answer

Add Cloud Storage and BigQuery to the list of restricted services in the perimeter (they already are)

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage and BigQuery APIs

Answer

An egress rule that allows the on-premises service account to leave the perimeter

Question 20

A company is deploying a new internal application on Google Cloud. They want to ensure that VM instances in a specific subnet can only communicate with each other and with a load balancer that fronts the application. They also want to allow SSH access from a bastion host. Which TWO firewall rules should they create? (Choose two.)

Accepted Answer

An ingress rule that allows all traffic from the subnet to the instances (target tags or service account). To restrict communication to only internal subnet traffic and the load balancer, you need an ingress rule that allows traffic from the subnet (source) to all instances (target). To allow SSH from the bastion, you need an ingress rule allowing TCP port 22 from the bastion host (using its service account or tags). Egress rules are not needed because the default allow egress is not restrictive; but if you want to block other egress, you would need a deny egress rule, but the question asks for rules to allow, not block.

Answer

An egress rule that blocks all traffic except to the load balancer and subnet

Answer

An egress rule that allows all traffic to the load balancer's frontend IP

Answer

An ingress rule that allows HTTP traffic from the load balancer to the instances