PCSE Configuring Network Security Practice Test 12 — 15 Questions

Question 1

A company runs a Shared VPC host project with several service projects. Security requires that all egress traffic from service project workloads to external IP addresses be inspected by a centralized third-party appliance before leaving the VPC. The appliance is deployed in the host project and must see traffic from all service projects. Which approach should the security engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Policy-based routes in the host project to send traffic from service project subnets to the appliance's next-hop instance.. Policy-based routes in the Shared VPC host project can match traffic by source or destination and set an instance as the next hop, which centralizes egress inspection through the appliance. This works across all service projects because they share the host project's VPC network, and it avoids duplicating configuration or relying on passive logging.

Answer

Deploy Cloud NAT in each service project and configure logging to send traffic to the appliance for analysis.

Answer

Configure a VPC firewall egress rule in each service project that redirects traffic to the appliance's internal IP address.

Answer

Create a custom static route in each service project with the appliance as the next hop and a default destination.

Question 2

A security engineer is configuring Identity-Aware Proxy (IAP) to protect an internal web application running on a Compute Engine instance group. The application should only be accessible to users in the 'security-team@example.com' Google Group, and only from company-managed devices. The engineer has already set up the IAP-secured resource and granted the group the 'IAP-secured Web App User' role. What additional configuration is required to enforce the device policy?

Accepted Answer

Create an access level in Access Context Manager that requires the device to be company-managed, and apply it to the IAP-secured resource via a context-aware access policy.. To enforce device policy with IAP, you must define an access level in Access Context Manager that includes device conditions (such as company-managed device) and then apply that access level to the IAP-secured resource. IAM roles alone only control user authorization; they do not evaluate device posture. Context-aware access bridges identity and device context.

Answer

Enable Cloud Identity Device Policy and sync device inventory to IAP automatically.

Answer

Configure a VPC firewall rule that allows traffic only from the IP addresses of company-managed devices.

Answer

Add the Google Group to an IAM policy with the 'IAP-secured Web App User' role and enable 'Require device approval' in the IAP settings.

Question 3

A security engineer is configuring a Shared VPC in Google Cloud. The host project contains a VPC network with subnets, and several service projects are attached. The engineer needs to allow a specific service project's resources to communicate with on-premises systems over a Cloud VPN tunnel that terminates in the host project. The engineer has already created the VPN tunnel and added the on-premises routes to the host project's VPC. However, resources in the service project cannot reach the on-premises network. What is the most likely cause?

Accepted Answer

The service project's resources are not using the Shared VPC network, and instead are using their own default network.. In a Shared VPC, service project resources must be created in a subnet of the host project's shared VPC. If they are instead using the service project's own default network, they will not have access to the VPN tunnel or the routes in the host project's VPC. The engineer should verify that the service project's instances are configured to use the shared subnet and that firewall rules in the host project allow the necessary traffic.

Answer

The Cloud VPN tunnel is not configured with dynamic routing, so it cannot advertise routes to the service project.

Answer

The firewall rules in the host project do not allow ingress from the on-premises IP range to the service project's resources.

Answer

The service project's resources do not have external IP addresses, so they cannot route traffic to the VPN tunnel.

Question 4

A security engineer must ensure that all egress traffic from a Compute Engine instance is inspected by a third-party firewall appliance before reaching the internet, and that the instance cannot bypass the appliance. The instance and appliance are in the same VPC. What should they configure?

Accepted Answer

Create a custom static route with the appliance as the next hop for 0.0.0.0/0, and remove or lower the priority of the default internet gateway route.. Forcing egress through a third-party appliance requires a custom static route for 0.0.0.0/0 with the appliance as the next hop, and ensuring the default internet gateway route is not used. This prevents bypass because the VPC route table determines the path. Firewall rules and Private Google Access do not redirect traffic, and changing the instance default gateway is ineffective.

Answer

Enable Private Google Access on the subnet and configure the appliance as a proxy for all egress.

Answer

Set the instance's default gateway to the appliance's IP address and disable the instance's external IP.

Answer

Use a VPC firewall rule to redirect traffic to the appliance using a target service account.

Question 5

A company has a VPC Service Controls perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises application to access these services using a dedicated Interconnect connection. The on-premises application uses a service account. What should they configure to allow access while maintaining the perimeter?

Accepted Answer

Create an access level that includes the on-premises network's source IP range, and add it to the perimeter's ingress policy.. VPC Service Controls perimeters restrict access to services based on identity and context. To allow on-premises access, create an access level that includes the on-premises IP range and add it to the perimeter's ingress policy. The service account used by the application must also have IAM permissions. This maintains the perimeter while permitting legitimate traffic.

Answer

Configure a Cloud VPN tunnel and add the tunnel's IP to the perimeter's allowed list.

Answer

Use VPC peering between the on-premises network and the VPC, and add the peering to the perimeter.

Answer

Add the on-premises CIDR range to the perimeter's allowed ingress rules.

Question 6

A security engineer is configuring Cloud VPN to connect an on-premises network to a Google Cloud VPC. The on-premises VPN gateway supports only IKEv2 and requires a route-based VPN. The engineer must ensure that traffic from on-premises can reach specific VM instances in the VPC, and that the VPN tunnel is highly available. Which configuration should the engineer use?

Accepted Answer

Create an HA VPN with two tunnels, each terminating on a different interface of the HA VPN gateway, and configure BGP on both tunnels.. HA VPN supports IKEv2 and dynamic routing with BGP, and provides high availability when configured with two tunnels on different interfaces. This meets the on-premises gateway's requirement for IKEv2 and route-based VPN, and ensures redundancy. Classic VPN is legacy and does not offer the same level of HA. The correct configuration is HA VPN with two tunnels and BGP.

Answer

Create a Classic VPN with a single tunnel using IKEv2 and dynamic routing (BGP).

Answer

Create an HA VPN with a single tunnel and configure static routing.

Answer

Create a Classic VPN with two tunnels using IKEv1 and policy-based routing.

Question 7

A company needs to allow its on-premises data center to reach internal Compute Engine instances over a private connection. They have set up Cloud Interconnect and want to ensure that traffic from the on-premises CIDR 10.10.0.0/16 can reach VMs in a subnet 10.0.1.0/24 on TCP port 443, but no other on-premises traffic should be allowed. They also want to avoid exposing the VMs to the internet. What should they do?

Accepted Answer

Create an ingress firewall rule allowing tcp:443 from 10.10.0.0/16 to the VMs, and ensure the VMs have no external IP addresses.. The requirement is to allow only 10.10.0.0/16 to reach VMs on TCP 443 privately and avoid internet exposure. An ingress firewall rule scoped to that CIDR and port, combined with no external IPs, achieves this. The implied deny-all blocks other sources. Cloud Interconnect provides private routing, but firewall rules enforce the source restriction.

Answer

Create an egress firewall rule allowing tcp:443 to 10.10.0.0/16, and assign external IP addresses to the VMs for management.

Answer

Create an ingress firewall rule allowing tcp:443 from 0.0.0.0/0 to the VMs, and rely on Cloud Interconnect routing to restrict access to on-premises only.

Answer

Create a VPC firewall rule with direction INGRESS, action ALLOW, source 10.10.0.0/16, target tag 'web', protocol tcp:443, and assign public IP addresses to the VMs so that on-premises can reach them over the internet.

Question 8

A company has a Shared VPC setup where the host project contains a VPC network, and service projects contain VM instances. A security engineer needs to create a firewall rule in the host project that allows SSH access from a specific CIDR range to all VM instances in the service projects. The engineer wants to ensure that the rule applies only to instances with a specific network tag. What should the engineer do?

Accepted Answer

Create the firewall rule in the host project with the target tag and source CIDR range.. In a Shared VPC, the host project owns the VPC network and its firewall rules. Service projects use the network but cannot define their own firewall rules for it. Therefore, the rule must be created in the host project. Using a target tag ensures it applies only to instances with that tag, and the source CIDR range restricts access to the specified range.

Answer

Create the firewall rule in the host project with a source service account and target tag.

Answer

Create the firewall rule in each service project with the target tag and source CIDR range.

Answer

Create the firewall rule in the host project with a target service account instead of a tag.

Question 9

A security engineer needs to allow outbound SSH (TCP port 22) from a subnet's Compute Engine instances to a specific external IP range, while denying all other outbound internet traffic. The VPC has a default route to the default internet gateway. Which firewall rule configuration should the engineer use?

Accepted Answer

Create an egress firewall rule with priority 1000, action allow, destination ranges set to the external IP range, and protocol/port tcp:22. Add a lower-priority (higher number) egress rule with action deny, destination 0.0.0.0/0, and protocol all.. Egress firewall rules govern outbound traffic from VM instances. To permit SSH only to a specific external IP range and block all other outbound traffic, the engineer must create an allow egress rule for TCP 22 to that range with a higher priority, and a deny egress rule for all protocols to 0.0.0.0/0 with a lower priority. Ingress rules and hierarchical policies do not fulfill this specific requirement.

Answer

Create an ingress firewall rule with priority 1000, action allow, source ranges set to the external IP range, and protocol/port tcp:22. Add an ingress rule with action deny, source 0.0.0.0/0, protocol all.

Answer

Create an egress firewall rule with priority 1000, action deny, destination ranges set to the external IP range, and protocol/port tcp:22. Add a higher-priority egress rule with action allow, destination 0.0.0.0/0, protocol all.

Answer

Create a hierarchical firewall policy at the organization level with an egress rule allowing tcp:22 to the external range, and rely on the default VPC firewall rules to deny all other egress traffic.

Question 10

A security engineer needs to provide a group of contractors with access to a web application running on a private Compute Engine instance. The contractors connect from various locations on the internet, and the company does not want to expose the application's private IP address or manage a VPN for them. The application uses HTTPS on port 443. What should the engineer implement?

Accepted Answer

Set up Identity-Aware Proxy (IAP) with a global external Application Load Balancer and grant the contractors the IAP-secured Web App User role.. Identity-Aware Proxy combined with a global external Application Load Balancer provides HTTPS access to private backends without exposing instance IPs or requiring a VPN. Contractors authenticate with their identity, and IAM roles determine authorization. This centralizes access control and eliminates the need to manage network-level connectivity for each contractor.

Answer

Configure an external TCP proxy Network Load Balancer with a backend service pointing to the instance group.

Answer

Use Cloud VPN with a third-party client and provide each contractor with a certificate to connect.

Answer

Assign external IP addresses to the instances and create firewall rules allowing the contractors' IP ranges on port 443.

Question 11

A company has a VPC with two subnets in different regions. They want to ensure that a specific set of Compute Engine instances can only send traffic to the internet through a Cloud NAT gateway, and that no instance can receive unsolicited inbound traffic from the internet. They have already configured Cloud NAT on a Cloud Router in the region of the instances. Which additional configuration is needed to prevent unsolicited inbound traffic?

Accepted Answer

Ensure that no INGRESS ALLOW firewall rules exist for the instances, relying on the implied deny-all ingress rule.. Cloud NAT provides outbound internet access for instances without external IPs and statefully allows return traffic. Unsolicited inbound traffic is blocked by the implied deny-all ingress rule unless an INGRESS ALLOW rule explicitly permits it. Therefore, ensuring no INGRESS ALLOW rules target the instances is sufficient to prevent unsolicited inbound traffic.

Answer

Assign external IP addresses to the instances and create a firewall rule to block all inbound traffic.

Answer

Configure Cloud NAT to not allow inbound connections by setting the 'inbound' flag to false.

Answer

Create an INGRESS DENY rule with priority 1000 targeting the instances and source 0.0.0.0/0.

Question 12

A company wants to protect its external HTTP(S) load balancer from volumetric DDoS attacks and application-layer attacks. They need to use Google Cloud's advanced DDoS protection and WAF capabilities. Which service should they enable?

Accepted Answer

Cloud Armor with Managed Protection Plus. Cloud Armor with Managed Protection Plus offers advanced DDoS protection and WAF features specifically for external HTTP(S) load balancers. It includes adaptive protection, which detects and mitigates attacks, and it provides WAF rules for application-layer threats. Other options either lack the necessary security features or are not designed for this purpose. Thus, Cloud Armor with Managed Protection Plus is the correct choice.

Answer

Cloud IDS

Answer

VPC firewall rules with hierarchical policies

Answer

Cloud CDN

Question 13

A company wants to control which Google Cloud services its employees can access from corporate-managed devices on the corporate network. The security team wants to enforce that only approved services are reachable, and they want the policy to apply to all users on the network without installing software on each device. Which Google Cloud feature should they use?

Accepted Answer

Secure Web Proxy with a policy that allows only the approved service domains.. Secure Web Proxy is an explicit forward proxy that enforces egress policy based on destination, so it can restrict users on a network to only approved services. It requires no agent on each device, and policy is centralized. Perimeter, DNS, and load balancer controls address different layers and do not provide the required outbound allowlist.

Answer

VPC Service Controls perimeter around the projects that host the approved services.

Answer

Cloud DNS private zones with conditional forwarding for the approved services.

Answer

Cloud Armor security policy attached to an external HTTP(S) load balancer.

Question 14

A security engineer needs to allow SSH access to a Compute Engine VM running in a VPC, but only from a specific bastion host in the same VPC. The bastion host has IP address 10.0.1.5. The VM is in subnet 10.0.2.0/24. The engineer wants to minimize the attack surface and ensure that only the bastion can initiate SSH connections to the VM. Which firewall rule should the engineer create?

Accepted Answer

Create an ingress rule with action allow, direction INGRESS, source ranges 10.0.1.5/32, target tags ['vm-ssh'], and protocol tcp:22.. To restrict SSH access to only the bastion host, the firewall rule must specify the bastion's IP address as the source and target the VM using a network tag or service account. The rule should allow only TCP port 22. Using a /32 source range ensures only that single IP can connect, aligning with the principle of least privilege.

Answer

Create an ingress rule with action allow, direction INGRESS, source ranges 10.0.2.0/24, target tags ['vm-ssh'], and protocol tcp:22.

Answer

Create an ingress rule with action allow, direction INGRESS, source ranges 10.0.0.0/16, target tags ['vm-ssh'], and protocol tcp:22.

Answer

Create an ingress rule with action allow, direction INGRESS, source service accounts ['bastion@project.iam.gserviceaccount.com'], target service accounts ['vm@project.iam.gserviceaccount.com'], and protocol tcp:22.

Question 15

A security engineer is configuring Cloud Armor security policies for an external HTTP(S) load balancer. They need to protect against application-layer attacks and also ensure that only requests from specific countries are allowed. (Choose two.)

Accepted Answer

Create a Cloud Armor security policy with a rule that uses the preconfigured expression evaluatePreconfiguredWaf('sqli-v33-stable') to block SQL injection attempts.. Cloud Armor preconfigured WAF rules such as sqli-v33-stable protect against SQL injection, and geo-based rules using origin.region_code allow or deny traffic by country. Combining an allow rule for the desired country with a default deny rule and a WAF rule meets both requirements. Adaptive protection and user-agent matching do not provide the needed protections.

Answer

Use Cloud Armor's adaptive protection to automatically enable SQL injection protection and geo-based restrictions.

Answer

Create a Cloud Armor security policy with a rule that uses the expression origin.region_code == 'US' to deny requests from the United States.

Answer

Configure a Cloud Armor security policy with a rule that uses the expression request.headers['user-agent'].contains('sqlmap') to block SQL injection tools.