PCSE Configuring Network Security — 50 Questions

Question 1

A security engineer wants to apply a baseline set of firewall rules that apply to all new and existing VMs in an organization, and these rules must not be overridden by project-level rules. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a hierarchical firewall policy at the organization level.. Hierarchical firewall policies are enforced at the organization or folder level and cannot be overridden at lower levels, ensuring baseline rules are always applied.

Answer

Create a VPC firewall rule with priority 0.

Answer

Use Cloud IDS to monitor and block traffic.

Answer

Create a firewall rule in each project and enforce via policy library.

Question 2

A company wants to enable private connectivity from its on-premises network to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs. They have a Cloud VPN connection to a VPC. Which TWO services or configurations are required? (Choose two.)

Accepted Answer

Private Google Access. Private Service Connect allows you to create private IP endpoints for Google APIs in your VPC, making them accessible via internal IPs. Private Google Access must be enabled on the subnet where the endpoints are attached to allow the endpoint's traffic to be properly routed and to enable DNS resolution of Google API hostnames to the private IPs within the VPC. On-premises traffic from Cloud VPN can then reach these private IPs directly. Therefore, both services are required to achieve private connectivity without public IPs.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

VPC Service Controls

Question 3

A security engineer needs to detect and alert on network-based threats such as malware and command-and-control traffic within their Google Cloud VPC. They want a managed service that provides deep packet inspection and integrates with their existing security operations. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with VPC packet mirroring and provides threat severity levels. Cloud Armor protects web applications at the edge. VPC Service Controls restrict data access. Cloud NGFW (next-generation firewall) is not a Google Cloud managed service; Google offers Cloud Firewall (which is not NGFW).

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Cloud NGFW

Question 4

Your organization wants to enforce that all VMs in a project can only communicate with a specific Cloud Storage bucket, and no other external IP addresses. You need to configure firewall rules to achieve this. Which approach should you take?

Accepted Answer

Use VPC Service Controls to create a service perimeter that restricts access to Cloud Storage, and configure the VMs to use Private Google Access. To enforce that VMs can only communicate with a specific Cloud Storage bucket, firewall rules alone are insufficient because they cannot restrict traffic to a specific bucket. VPC Service Controls can create a service perimeter that restricts access to only the allowed Cloud Storage bucket, and Private Google Access ensures that VMs using internal IPs can reach Google APIs (including Cloud Storage) through the private Google network, not the internet. This combination provides the required restriction.

Answer

Create a deny-all egress firewall rule with priority 65535 and target tags 'storage-only', then create a higher-priority allow rule for traffic to 0.0.0.0/0 with destination tags 'storage-only'

Answer

Create a firewall rule that allows egress to the private IP ranges used by Cloud Storage (e.g., 199.36.153.4/30) and target the VMs using service accounts, then add a lower-priority deny-all egress rule

Answer

Create a network firewall policy that allows egress to the Cloud Storage API endpoint (storage.googleapis.com) and attach it to the VPC

Question 5

You are designing a private connectivity solution for a Google Cloud project that needs to access Google APIs (e.g., Cloud Storage) without traversing the public internet. The VPC has on-premises connectivity via Cloud VPN. Which THREE steps are required to achieve private, on-premises to Google API access? (Choose 3)

Accepted Answer

Create a Private Service Connect endpoint for Google APIs (e.g., storage.googleapis.com) in the VPC. For on-premises to Google APIs access via Cloud VPN, you must create a Private Service Connect endpoint (B) to provide a private IP for Google APIs. Configure firewall rules (C) to allow traffic from the VPN gateway to the PSC endpoint's IP. Use Cloud Router to advertise the PSC endpoint's IP range to on-premises via BGP (E), so on-premises routes traffic to the VPC instead of the public internet. Private Google Access (D) is for VM instances in the VPC, not for traffic from VPN, and is unnecessary. A NAT gateway (A) is for outbound traffic from VMs without external IPs, not for private API access from on-premises.

Answer

Set up a NAT gateway in the VPC for on-premises traffic

Answer

Enable Private Google Access on the subnet that hosts the VPN gateway

Question 6

A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?

Accepted Answer

VPC Service Controls. VPC Service Controls allows you to define a service perimeter that restricts access to Google Cloud APIs (like Cloud Storage) to only resources from authorized VPCs, preventing data exfiltration.

Answer

Firewall Rules

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 7

An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.. Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.

Answer

Create a VPC firewall rule at the organization level to deny all egress, then allow egress for the specific tag.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Configure Cloud Armor with a deny-all egress rule and an exception for the tag.

Question 8

A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?

Accepted Answer

Add the external IP to an access level and configure an ingress rule in the service perimeter.. VPC Service Controls access levels can define IP-based conditions. By creating an ingress rule that allows traffic from the specified IP address to access the BigQuery API, the external application can be authorized.

Answer

Whitelist the external IP in the BigQuery dataset's IAM policy.

Answer

Create a Cloud VPN tunnel between the on-premises network and the VPC, and add the tunnel to the service perimeter.

Answer

Use Private Google Access on the VPC to allow on-premises traffic.

Question 9

A DevOps team wants to automatically provision and renew SSL certificates for a global HTTPS load balancer. Which certificate management option should be used?

Accepted Answer

Use Certificate Manager with a DNS authorization to create a Google-managed certificate.. Google-managed SSL certificates automatically provision and renew certificates for domains hosted on Google Cloud, ideal for load balancers without manual intervention.

Answer

Create a Google-managed certificate directly on the load balancer and configure a cron job to check renewal.

Answer

Use a third-party CA and upload the certificate with a longer validity.

Answer

Upload a self-managed certificate and configure a cron job to renew it.

Question 10

An engineer needs to block a specific IP address from accessing an HTTPS load balancer. Which Cloud Armor rule should be used?

Accepted Answer

A custom rule with a 'deny' action and the IP address in the 'src_ip_ranges' field. Cloud Armor custom rules allow IP allow/deny lists. A deny rule with the specific IP address will block traffic.

Answer

A VPC firewall rule with a deny ingress for that IP

Answer

A Cloud Armor rate limiting rule

Answer

A preconfigured rule from the OWASP ModSecurity CRS

Question 11

A company wants internal VMs to access Google APIs (e.g., Cloud Storage, BigQuery) without traversing the internet. What is the simplest configuration?

Accepted Answer

Enable Private Google Access on the subnet where the VMs reside.. Private Google Access enables VMs with only internal IPs to reach Google APIs via the Google Cloud private network, without needing external IPs or internet access.

Answer

Assign external IPs to all VMs and use VPC firewall rules to restrict egress.

Answer

Use Cloud NAT to route traffic to Google APIs.

Answer

Set up Private Service Connect to googleapis.com.

Question 12

An organization uses VPC Service Controls in dry-run mode for a project containing Google Cloud Storage. They notice that BigQuery jobs are being logged as violations. How should they interpret this?

Accepted Answer

The perimeters are logging potential violations; no action has been taken yet.. In dry-run mode, VPC Service Controls logs violations without enforcement, allowing administrators to review and adjust perimeters before enabling enforcement.

Answer

The dry-run mode is not supported for Cloud Storage projects.

Answer

The perimeters are not configured correctly because BigQuery should not be affected.

Answer

The perimeters are working correctly and BigQuery access is blocked.

Question 13

Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML-based DDoS detection to automatically learn normal traffic patterns and alert or mitigate attacks.

Answer

Preconfigured WAF rules

Answer

Rate limiting

Answer

Custom rules

Question 14

A service provider wants to expose an internal service to external consumers in a controlled manner, without giving them direct access to the VPC. Which Google Cloud service should be used?

Accepted Answer

Private Service Connect. Private Service Connect allows service providers to publish their services via PSC endpoints, which consumers can access privately from their own VPCs without traversing the internet.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

VPC Peering

Question 15

An organization uses SSL policies for their HTTPS load balancer. They need to allow TLS 1.2 and 1.3 only, and use the most secure cipher profile available. Which SSL policy configuration should they choose?

Accepted Answer

minTlsVersion: 1.2, profile: RESTRICTED. The 'RESTRICTED' cipher profile enforces strong ciphers (TLS 1.2+), while 'MODERN' allows TLS 1.2 and 1.3 with good security. However, 'RESTRICTED' is the most secure profile that supports TLS 1.2 and 1.3.

Answer

minTlsVersion: 1.2, profile: MODERN

Answer

minTlsVersion: 1.2, profile: COMPATIBLE

Answer

minTlsVersion: 1.3, profile: CUSTOM

Question 16

Which VPC firewall rule target type is recommended for security because it can be dynamically applied to instances based on their service account?

Accepted Answer

Service accounts. Service account targets allow rules to be applied based on the instance's service account, enabling dynamic and scalable security policies compared to static network tags.

Answer

Instance names

Answer

Subnets

Answer