PCSE Configuring Network Security Practice Test 11 — 15 Questions

Question 1

A security engineer is configuring a VPC Service Controls perimeter to protect a sensitive BigQuery dataset. They need to allow a specific on-premises application to access the dataset using a VPN connection. The on-premises application uses a service account to authenticate. What should they do to allow this access while keeping the perimeter secure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an access level that includes the on-premises IP range and the service account's identity, then add it to the perimeter.. To grant on-premises access to a protected BigQuery dataset, you must create an access level that combines the on-premises IP range and the service account. This access level is then added to the perimeter. This ensures that only requests originating from that network and using that service account are permitted, while all other access is denied. This approach maintains the security posture of the perimeter.

Answer

Configure a private Google access route from the on-premises network to the BigQuery API and add the service account to the perimeter's allowed identities.

Answer

Add the on-premises network's IP range to the perimeter's allowed list using an access level.

Answer

Disable VPC Service Controls for the BigQuery API and rely on IAM permissions for access control.

Question 2

A security engineer needs to allow SSH access to a Compute Engine instance from a specific on-premises IP range (203.0.113.0/24) only when the user's device is compliant with corporate policy. The company uses BeyondCorp Enterprise and has an Identity-Aware Proxy (IAP) setup. The engineer wants to enforce device compliance without exposing the instance to the internet. What should the engineer do?

Accepted Answer

Configure IAP TCP forwarding for SSH, and create a firewall rule allowing SSH from the IAP IP range 35.235.240.0/20. Then, set up an access level in BeyondCorp Enterprise requiring device compliance and apply it to the IAP-protected resource.. IAP TCP forwarding enables secure SSH access without public IPs. Firewall rules restrict traffic to IAP's IP range. BeyondCorp Enterprise access levels enforce context-aware policies, including device compliance. By applying an access level that requires device compliance and optionally restricts source IP to the on-premises range, the engineer ensures only compliant devices can connect via IAP.

Answer

Create a firewall rule allowing SSH from 203.0.113.0/24 and enable OS Login with two-factor authentication.

Answer

Use Cloud VPN to connect the on-premises network to the VPC, and create a firewall rule allowing SSH from 203.0.113.0/24. Then, enable VPC Service Controls to enforce device compliance.

Answer

Deploy a bastion host with a public IP, restrict SSH to the bastion's IP, and use Cloud Identity-Aware Proxy to authenticate users. Configure the bastion to check device compliance via a startup script.

Question 3

A security team needs to inspect outbound traffic from a VPC to detect and block malicious domains before it leaves the Google Cloud network. They want to enforce the policy centrally and avoid managing individual instance firewalls. Which Google Cloud service should they use?

Accepted Answer

Secure Web Proxy. Secure Web Proxy is designed to inspect and control outbound web traffic centrally. It supports domain and URL filtering, enabling the team to block malicious destinations while avoiding distributed firewall management. Cloud IDS only detects, Cloud Armor only protects inbound load balancer traffic, and VPC firewall rules cannot match FQDNs. Thus, Secure Web Proxy is the correct service for enforcing egress domain policies.

Answer

VPC firewall rules with FQDN objects

Answer

Cloud IDS

Answer

Cloud Armor security policies

Question 4

A company is deploying a web application on Compute Engine instances behind an external HTTP(S) load balancer. They want to protect the application from common web attacks such as SQL injection and cross-site scripting, and also mitigate denial-of-service attacks. They need to implement a solution that allows granular control based on request attributes. Which two Google Cloud services should they use? (Choose two.)

Accepted Answer

Google Cloud Armor Adaptive Protection to detect and mitigate application-layer DDoS attacks.. Cloud Armor security policies with preconfigured WAF rules protect against SQL injection and XSS, while Adaptive Protection adds machine learning-based DDoS mitigation. Together, they provide the required application-layer security and granular control. VPC firewall rules, IAP, and Cloud CDN do not offer the necessary WAF or DDoS capabilities for this scenario.

Answer

Cloud Identity-Aware Proxy (IAP) to enforce access control.

Answer

VPC firewall rules to block malicious IP addresses.

Answer

Cloud CDN to cache content and absorb attack traffic.

Question 5

A company is deploying a VPC Service Controls perimeter to protect sensitive data in BigQuery and Cloud Storage. They need to allow a specific on-premises application to access these services through a Cloud VPN tunnel. The application runs on a server with IP 198.51.100.10. Which two configurations are required to permit this access while maintaining the perimeter? (Choose two.)

Accepted Answer

Add an ingress rule to the perimeter that allows the on-premises IP range to access BigQuery and Cloud Storage.. To allow an on-premises application through a VPC Service Controls perimeter, you must define an access level with the on-premises IP range and add an ingress rule that permits that access level to reach the protected services. These two configurations work together to authorize the specific external source while keeping the perimeter intact.

Answer

Set up a Cloud NAT gateway to translate the on-premises IP to a private IP.

Answer

Enable Private Google Access on the subnet used by the Cloud VPN tunnel.

Answer

Configure a VPC firewall rule to allow traffic from 198.51.100.0/24 to the Google APIs.

Question 6

A security engineer needs to ensure that all traffic between two subnets in the same VPC network is logged for auditing purposes. They want to capture details such as source and destination IP addresses, ports, and protocol. What should they enable?

Accepted Answer

VPC Flow Logs on the subnets.. VPC Flow Logs provide detailed records of network flows within a subnet, including source and destination IPs, ports, and protocol. Enabling them on both subnets ensures all traffic between them is logged. Other options like Cloud Audit Logs, Firewall Rules Logging, and Packet Mirroring do not provide comprehensive subnet-level traffic logging for auditing.

Answer

Cloud Audit Logs for the VPC network.

Answer

Firewall Rules Logging on the applicable firewall rules.

Answer

Packet Mirroring on the instances in both subnets.

Question 7

A security engineer needs to ensure that all outbound traffic from a Compute Engine instance to the internet goes through a specific set of IP addresses for auditing. The instance is in a subnet with no external IP addresses. What should the engineer configure?

Accepted Answer

Cloud NAT with a reserved external IP address.. Cloud NAT provides outbound internet access for instances without external IPs. By reserving a static external IP for the NAT gateway, all outbound traffic will originate from that IP, satisfying the auditing requirement. This is a managed service that scales automatically and avoids exposing the instance.

Answer

Assign a static external IP to the instance.

Answer

Enable Private Google Access on the subnet.

Answer

Configure a HTTP(S) proxy on a separate instance and route traffic through it.

Question 8

A security engineer must ensure that only the production service account can access a Compute Engine VM's SSH port (22) from a specific subnet, while all other traffic is blocked. The VM's VPC has several subnets and firewall rules. Which approach should the engineer use to meet this requirement with least privilege?

Accepted Answer

Create a firewall rule with direction INGRESS, action allow, source service account set to the production service account, target tags set to the VM's network tag, and protocol/port tcp:22.. The correct answer uses a VPC firewall rule with a service account as the source and a target tag to scope the rule to the specific VM. This enforces least privilege by allowing only the production service account to reach TCP port 22. Other options either broaden access to a subnet or the internet, or use the wrong direction, failing the requirement.

Answer

Create a firewall rule with direction INGRESS, action allow, source ranges set to 0.0.0.0/0, target tags set to the VM's network tag, and protocol/port tcp:22, then rely on OS login to restrict access.

Answer

Create a firewall rule with direction EGRESS, action allow, destination service account set to the production service account, target tags set to the VM's network tag, and protocol/port tcp:22.

Answer

Create a firewall rule with direction INGRESS, action allow, source ranges set to the subnet CIDR, target tags set to the VM's network tag, and protocol/port tcp:22.

Question 9

A security engineer manages a Shared VPC in Google Cloud. A team in a service project runs a three-tier web application on Compute Engine. The security team requires that instances in the web tier can receive HTTP/HTTPS traffic from the internet, but the database tier must only accept connections from the web tier on TCP port 5432. All instances are in the same Shared VPC network, and each tier is identified by a network tag. Which configuration should the engineer implement to meet these requirements?

Accepted Answer

Create two ingress firewall rules: one allowing tcp:80,443 from 0.0.0.0/0 to the web tier tag, and one allowing tcp:5432 from the web tier tag to the database tier tag. No egress rules are needed.. VPC firewall rules are stateful, so return traffic for allowed connections is automatically permitted. To let the web tier receive internet traffic, an ingress rule allowing tcp:80,443 from 0.0.0.0/0 to the web tier tag is needed. To restrict database access, an ingress rule allowing tcp:5432 only from the web tier tag to the database tier tag is needed. Egress rules are unnecessary because the database tier does not initiate outbound connections.

Answer

Create two egress firewall rules: one allowing tcp:80,443 from the web tier tag to 0.0.0.0/0, and one allowing tcp:5432 from the database tier tag to the web tier tag. No ingress rules are needed.

Answer

Create a hierarchical firewall policy at the organization level that allows tcp:80,443 and tcp:5432, and apply it to the Shared VPC host project. Use IAM to restrict which service accounts can connect to the database.

Answer

Create a single ingress firewall rule allowing tcp:80,443,5432 from 0.0.0.0/0 to all instances in the Shared VPC, and rely on network tags to limit access.

Question 10

A company uses Shared VPC. The host project contains a subnet in us-central1. A service project has a VM that needs to reach an on-premises database via Cloud VPN. The security engineer must ensure that the VM's traffic to the on-premises CIDR is allowed and that return traffic is permitted. Which firewall rule should be created in the host project?

Accepted Answer

An EGRESS rule allowing traffic from the VM's service account to the on-premises CIDR, with target service account set to the VM's service account.. In a Shared VPC, firewall rules are defined in the host project and apply to the shared VPC network. The VM in the service project needs to initiate connections to on-premises, so an egress rule targeting the VM's service account and allowing the on-premises CIDR is required. Because firewall rules are stateful, return traffic is automatically allowed, so no ingress rule is needed.

Answer

An EGRESS rule allowing traffic from the VM's service account to 0.0.0.0/0, with target service account set to the VM's service account.

Answer

An INGRESS rule allowing traffic from the on-premises CIDR to the subnet's primary IP range, with target tags set to the VM's network tag.

Answer

An INGRESS rule allowing traffic from the on-premises CIDR to the VM's service account, with target service account set to the VM's service account.

Question 11

A company uses Cloud VPN to connect its on-premises network to a Google Cloud VPC. The security team wants to ensure that all traffic from on-premises to Google Cloud is encrypted and that the on-premises router can dynamically learn routes from the VPC. They also want to minimize configuration overhead. Which Cloud VPN configuration should they use?

Accepted Answer

HA VPN with Cloud Router using BGP, with two tunnels to two different Google edge availability domains.. HA VPN with Cloud Router using BGP and two tunnels to two different Google edge availability domains provides encrypted traffic, dynamic route exchange, high availability, and minimal configuration overhead. Classic VPN lacks dynamic routing, and a single tunnel does not provide the required redundancy. Partner Interconnect is not a VPN and does not encrypt traffic by default.

Answer

HA VPN with Cloud Router using BGP, but with only one tunnel to a single Google edge availability domain.

Answer

Partner Interconnect with a 10-Gbps attachment and BGP routing.

Answer

Classic VPN with static routing, using a single tunnel and manually configured routes.

Question 12

A security engineer must allow SSH access to a set of Compute Engine VMs from a fixed set of corporate office public IP addresses. The VMs have no external IP addresses and are in a single VPC network. The engineer wants a reusable, centrally managed rule that is applied to all current and future VMs in the network. What should the engineer do?

Accepted Answer

Create a firewall rule in the VPC network with direction INGRESS, action allow, target tags matching the VMs, source IPv4 ranges set to the office IPs, and protocol tcp:22.. VPC firewall rules are stateful, distributed, and centrally managed at the network level, making them the right tool for granting SSH from known source addresses. An ingress rule with the office CIDR ranges, tcp:22, and target tags applies to all current and future tagged VMs, meeting the reuse requirement. Proxy-based controls such as Cloud Armor do not apply to direct VM SSH traffic.

Answer

Create a VPC firewall rule with direction EGRESS, action allow, destination ranges set to the office IPs, and protocol tcp:22.

Answer

Create a Cloud Armor security policy with an allow rule for the office IPs and attach it to the VPC network.

Answer

Create a hierarchical firewall policy at the organization level with an allow rule for tcp:22 from the office IPs.

Question 13

A security engineer is deploying a three-tier web application in a single Google Cloud VPC. The database tier must accept connections only from the application tier on TCP port 5432, and the application tier must accept HTTPS traffic only from the web tier. No other internal traffic should reach these tiers. The engineer wants the rules to remain effective even if new VM instances are added to each tier. What should the engineer do?

Accepted Answer

Create firewall rules that use target service accounts and source service accounts for each tier.. Firewall rules that reference target service accounts and source service accounts enforce access based on workload identity, so newly created instances using the correct service account are covered automatically. This avoids the operational burden and risk of tag or IP-based rules and directly implements least privilege between the web, application, and database tiers.

Answer

Create a single firewall rule allowing all internal traffic and rely on OS-level iptables for tier isolation.

Answer

Create hierarchical firewall policies at the organization level that allow all ingress on ports 443 and 5432.

Answer

Create firewall rules that use target tags and source IP ranges for each tier's subnet.

Question 14

A company uses Shared VPC. The host project contains a subnet with secondary IP ranges for GKE pods and services. A security engineer must ensure that pods in the service project can only reach a specific on-premises CIDR through a Cloud VPN tunnel, and that all other egress is blocked. What should they do?

Accepted Answer

Create a VPC firewall egress rule in the host project that allows traffic from the pod secondary range to the on-premises CIDR, and a lower-priority deny-all egress rule.. Firewall rules in a Shared VPC must be created in the host project, and they can use the pod secondary range as a source. By allowing only the on-premises CIDR and adding a lower-priority deny-all egress rule, you restrict pod egress as required. Service projects cannot manage these rules, and Cloud Router or VPC Service Controls do not provide the needed egress filtering.

Answer

Configure a Cloud Router custom route advertisement that only advertises the on-premises CIDR to the pods, and rely on the default deny egress rule.

Answer

Use VPC Service Controls to create a perimeter around the GKE cluster and add an access level for the on-premises CIDR.

Answer

Create a VPC firewall egress rule in each service project that allows traffic from the pod secondary range to the on-premises CIDR, and a deny-all egress rule.

Question 15

A security engineer is configuring a Shared VPC in Google Cloud. The host project contains a subnet named 'prod-subnet' in us-central1 with secondary ranges for GKE pods and services. A service project needs to deploy a GKE cluster that uses this subnet. The engineer must ensure that the GKE cluster's pods can communicate with each other and with services, but no other service project should be able to use this subnet. What should the engineer do?

Accepted Answer

Grant the service project's GKE service account the 'Compute Network User' role on the specific subnet 'prod-subnet' in the host project.. In a Shared VPC, the host project owns the network, and service projects can use subnets if granted the Compute Network User role on those subnets. To restrict usage to a specific subnet, the role must be granted on that subnet, not the host project. This allows the GKE cluster to use the subnet's primary and secondary ranges while preventing other service projects from using it.

Answer

Share the subnet with the service project by using the 'gcloud compute networks subnets update' command with the --shared flag.

Answer

Grant the service project's GKE service account the 'Compute Network User' role on the host project.

Answer

Create a firewall rule in the host project that allows traffic from the service project's GKE pods to the subnet.