PCSE Configuring Network Security — 40 Questions

Question 1

A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?

Accepted Answer

VPC Service Controls. VPC Service Controls allows you to define a service perimeter that restricts access to Google Cloud APIs (like Cloud Storage) to only resources from authorized VPCs, preventing data exfiltration.

Answer

Firewall Rules

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 2

An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.. Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.

Answer

Create a VPC firewall rule at the organization level to deny all egress, then allow egress for the specific tag.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Configure Cloud Armor with a deny-all egress rule and an exception for the tag.

Question 3

A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?

Accepted Answer

Add the external IP to an access level and configure an ingress rule in the service perimeter.. VPC Service Controls access levels can define IP-based conditions. By creating an ingress rule that allows traffic from the specified IP address to access the BigQuery API, the external application can be authorized.

Answer

Whitelist the external IP in the BigQuery dataset's IAM policy.

Answer

Create a Cloud VPN tunnel between the on-premises network and the VPC, and add the tunnel to the service perimeter.

Answer

Use Private Google Access on the VPC to allow on-premises traffic.

Question 4

A DevOps team wants to automatically provision and renew SSL certificates for a global HTTPS load balancer. Which certificate management option should be used?

Accepted Answer

Use Certificate Manager with a DNS authorization to create a Google-managed certificate.. Google-managed SSL certificates automatically provision and renew certificates for domains hosted on Google Cloud, ideal for load balancers without manual intervention.

Answer

Create a Google-managed certificate directly on the load balancer and configure a cron job to check renewal.

Answer

Use a third-party CA and upload the certificate with a longer validity.

Answer

Upload a self-managed certificate and configure a cron job to renew it.

Question 5

An engineer needs to block a specific IP address from accessing an HTTPS load balancer. Which Cloud Armor rule should be used?

Accepted Answer

A custom rule with a 'deny' action and the IP address in the 'src_ip_ranges' field. Cloud Armor custom rules allow IP allow/deny lists. A deny rule with the specific IP address will block traffic.

Answer

A VPC firewall rule with a deny ingress for that IP

Answer

A Cloud Armor rate limiting rule

Answer

A preconfigured rule from the OWASP ModSecurity CRS

Question 6

A company wants internal VMs to access Google APIs (e.g., Cloud Storage, BigQuery) without traversing the internet. What is the simplest configuration?

Accepted Answer

Enable Private Google Access on the subnet where the VMs reside.. Private Google Access enables VMs with only internal IPs to reach Google APIs via the Google Cloud private network, without needing external IPs or internet access.

Answer

Assign external IPs to all VMs and use VPC firewall rules to restrict egress.

Answer

Use Cloud NAT to route traffic to Google APIs.

Answer

Set up Private Service Connect to googleapis.com.

Question 7

An organization uses VPC Service Controls in dry-run mode for a project containing Google Cloud Storage. They notice that BigQuery jobs are being logged as violations. How should they interpret this?

Accepted Answer

The perimeters are logging potential violations; no action has been taken yet.. In dry-run mode, VPC Service Controls logs violations without enforcement, allowing administrators to review and adjust perimeters before enabling enforcement.

Answer

The dry-run mode is not supported for Cloud Storage projects.

Answer

The perimeters are not configured correctly because BigQuery should not be affected.

Answer

The perimeters are working correctly and BigQuery access is blocked.

Question 8

A security engineer wants to apply a baseline set of firewall rules that apply to all new and existing VMs in an organization, and these rules must not be overridden by project-level rules. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level.. Hierarchical firewall policies are enforced at the organization or folder level and cannot be overridden at lower levels, ensuring baseline rules are always applied.

Answer

Create a VPC firewall rule with priority 0.

Answer

Use Cloud IDS to monitor and block traffic.

Answer

Create a firewall rule in each project and enforce via policy library.

Question 9

Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML-based DDoS detection to automatically learn normal traffic patterns and alert or mitigate attacks.

Answer

Preconfigured WAF rules

Answer

Rate limiting

Answer

Custom rules

Question 10

A service provider wants to expose an internal service to external consumers in a controlled manner, without giving them direct access to the VPC. Which Google Cloud service should be used?

Accepted Answer

Private Service Connect. Private Service Connect allows service providers to publish their services via PSC endpoints, which consumers can access privately from their own VPCs without traversing the internet.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

VPC Peering

Question 11

An organization uses SSL policies for their HTTPS load balancer. They need to allow TLS 1.2 and 1.3 only, and use the most secure cipher profile available. Which SSL policy configuration should they choose?

Accepted Answer

minTlsVersion: 1.2, profile: RESTRICTED. The 'RESTRICTED' cipher profile enforces strong ciphers (TLS 1.2+), while 'MODERN' allows TLS 1.2 and 1.3 with good security. However, 'RESTRICTED' is the most secure profile that supports TLS 1.2 and 1.3.

Answer

minTlsVersion: 1.2, profile: MODERN

Answer

minTlsVersion: 1.2, profile: COMPATIBLE

Answer

minTlsVersion: 1.3, profile: CUSTOM

Question 12

Which VPC firewall rule target type is recommended for security because it can be dynamically applied to instances based on their service account?

Accepted Answer

Service accounts. Service account targets allow rules to be applied based on the instance's service account, enabling dynamic and scalable security policies compared to static network tags.

Answer

Instance names

Answer

Subnets

Answer

Tags

Question 13

A company wants to detect and block SQL injection attacks targeting their web application hosted on Compute Engine behind a Cloud Load Balancer. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Enable Cloud Armor adaptive protection to detect and block suspicious patterns.. Cloud Armor preconfigured rules (like OWASP ModSecurity CRS) can detect SQLi, and enabling adaptive protection provides ML-based anomaly detection. Cloud IDS is for network-level threats, not WAF; VPC firewall rules don't inspect application payloads.

Answer

Deploy Cloud IDS in the VPC to inspect packets for SQLi patterns.

Answer

Configure VPC firewall rules to deny traffic on port 443.

Answer

Use VPC Service Controls to restrict access to the backend instances.

Question 14

A financial services company must ensure that all data in Cloud Storage remains within a specific region and that no data can be accessed from outside the corporate network. They also need to allow a partner organization to access a specific bucket. Which THREE Google Cloud services or features should be combined to meet these requirements? (Choose THREE.)

Accepted Answer

Private Service Connect. VPC Service Controls restricts data access to authorized VPCs/environments. Access levels can enforce IP-based restrictions (corporate network). Private Service Connect can allow the partner to access the bucket privately via PSC endpoints without traversing the internet.

Answer

Cloud IDS

Answer

Cloud Armor security policies

Question 15

An organization wants to implement a zero-trust network security model for their Google Cloud environment. Which TWO practices should they adopt? (Choose TWO.)

Accepted Answer

Implement VPC Service Controls to create perimeters around sensitive APIs.. Using service account targets for firewall rules aligns with identity-based security (zero-trust). VPC Service Controls restrict access to APIs based on identity and context, reducing reliance on network perimeter.

Answer

Enable Private Google Access for all subnets.

Answer

Use network tags to group VMs for firewall rules.

Answer

Allow all outbound traffic and rely on intrusion detection.

Question 16

An organization wants to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can reach it, without using public IP addresses. Which solution should they implement?

Accepted Answer

Private Google Access. Private Google Access allows on-premises hosts or VM instances using internal IPs to reach Google APIs and services (like Cloud Storage) by routing traffic through the VPC network, without requiring public IPs.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud VPN

Question 17

A security engineer needs to allow HTTP (port 80) traffic from all VMs in the production environment to a specific set of VMs running a web server. The web server VMs are identified by a service account 'web-sa@...'. Which firewall rule configuration should the engineer create?

Accepted Answer

Ingress rule: source = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80. Using a service account as the target (serviceAccount = web-sa@...) is the recommended approach for security, as it is more dynamic and less error-prone than using network tags. The rule allows ingress traffic from any source (0.0.0.0/0) on TCP port 80 to VMs with that service account.

Answer

Egress rule: destination = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], deny tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], allow tcp:80

Question 18

A company wants to enforce that all VPC firewall rules in an organization must be centrally managed and cannot be overridden by lower-level projects. Which approach should they use?

Accepted Answer

Use a hierarchical firewall policy at the organization node. Hierarchical firewall policies are applied at the organization, folder, or project level and are inherited downward. They can be set to have higher priority than network firewall rules, and lower-level rules cannot override them if the policy is set accordingly.

Answer

Create network firewall rules at the organization level

Answer

Configure VPC Service Controls with a perimeter

Answer

Enable Organizational Policy constraints

Question 19

An organization uses VPC Service Controls to protect BigQuery datasets. They need to allow a specific on-premises application, which uses a static IP address, to query a BigQuery dataset inside the service perimeter. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter with the on-premises IP as the source. VPC Service Controls allow ingress rules to permit traffic from specific IP ranges into a perimeter. By creating an ingress rule that allows the on-premises IP and specifies the BigQuery API, the on-premises application can access the dataset.

Answer

Create a Cloud Armor rule to allow the on-premises IP

Answer

Use Private Google Access for the on-premises network

Answer

Add the on-premises IP to an access level and create an egress rule

Question 20

A company wants to provide private connectivity from its VPC to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs or NAT. The solution must also support on-premises connectivity via Cloud VPN. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect enables private connectivity to Google APIs via internal IPs. It supports both VPC and on-premises (via Cloud VPN or Interconnect) access to Google APIs without traversing the internet.

Answer

Private Google Access

Answer

Cloud NAT

Answer

Cloud VPN