PCSE Configuring Network Security Practice Test 13 — 15 Questions

Question 1

A security engineer is designing a Shared VPC where a central host project provides subnets to multiple service projects. The requirement is that each service project's VMs can reach only the resources in their own project, and no service project may open firewall rules that affect the host project's network. What should the engineer configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use VPC firewall rules with target service accounts combined with IAM and network tags scoped per service project, and do not grant service projects firewall administration on the host project.. Shared VPC centralizes network administration in the host project, so firewall rules must be authored there and scoped using target service accounts or tags. Withholding firewall administration from service projects ensures they cannot change shared network policy, while per-project service accounts let the host team write rules that isolate each service project's workloads from the others.

Answer

Create a separate VPC network in each service project and peer them all to the host project's network with custom route import/export.

Answer

Configure an organization policy constraint to disable firewall rule creation in all service projects.

Answer

Grant each service project's administrators the compute.securityAdmin role on the host project so they can manage firewall rules.

Question 2

A company uses a Shared VPC where the host project contains subnets shared with multiple service projects. A security engineer must ensure that a specific service project's VM instances can only initiate connections to on-premises resources over Cloud VPN, and cannot reach other service projects' VMs. Which configuration should the engineer implement?

Accepted Answer

Create a firewall rule in the host project with an egress allow for the on-premises destination range, and an egress deny for the other service projects' subnet ranges. Apply the rules using target service accounts that correspond to the VMs in the specific service project.. In a Shared VPC, the host project owns the network and firewall rules. To restrict a specific service project's VMs, the engineer must create egress rules in the host project, targeting those VMs via service accounts. An allow rule for the on-premises range and a deny rule for other service projects' subnets ensures the VMs can only reach on-premises. Ingress rules, service project rules, or VPC Service Controls do not achieve this.

Answer

Use VPC Service Controls to create a perimeter around the service project and add an access level that allows only the on-premises IP range, thereby preventing access to other service projects.

Answer

Create a firewall rule in each service project that allows egress to on-premises and denies egress to other service projects' subnets, and apply the rules to all instances in those projects.

Answer

Create a firewall rule in the host project that allows ingress from the on-premises range to the service project's VMs, and a rule that denies ingress from other service projects' subnets.

Question 3

A security engineer is setting up a VPC network in Google Cloud. The engineer wants to ensure that instances in a private subnet can initiate outbound connections to the internet for software updates, but the instances should not be directly reachable from the internet. Which configuration should the engineer use?

Accepted Answer

Create a Cloud NAT gateway in the VPC and configure the instances without external IP addresses.. Cloud NAT provides outbound internet access for instances without external IP addresses by performing source NAT. This allows instances to initiate connections for updates while remaining unreachable from the internet. Assigning external IPs exposes instances despite firewall rules. Cloud VPN and load balancers do not provide the required outbound NAT functionality.

Answer

Configure an HTTP(S) load balancer with a backend service that includes the instances, and use it for outbound traffic.

Answer

Create a Cloud VPN tunnel to a third-party provider and route all internet traffic through it.

Answer

Assign external IP addresses to the instances and create firewall rules to block all ingress traffic from the internet.

Question 4

A security engineer is configuring a VPC Service Controls perimeter to protect a Cloud Storage bucket. The perimeter includes a project that hosts a Compute Engine instance. The instance needs to access the bucket using its service account. The engineer wants to ensure that the instance's requests to the bucket do not leave the perimeter and are not blocked. What should the engineer do?

Accepted Answer

Ensure the instance's service account has the necessary IAM role on the bucket, and that the instance's project is inside the perimeter.. When both the caller and the protected resource are inside the same VPC Service Controls perimeter, the request is considered internal and is allowed as long as the caller has the necessary IAM permissions. Therefore, the engineer must ensure the instance's project is within the perimeter and the service account has the appropriate IAM role on the bucket. No ingress or egress rules are needed for internal access.

Answer

Create an ingress rule in the perimeter to allow the instance's IP address to access the bucket.

Answer

Add the instance's service account to the perimeter's access level with the 'Cloud Storage API' permission.

Answer

Configure the instance to use Private Google Access and add the bucket to the perimeter's egress rule.

Question 5

A company has a VPC Service Controls perimeter that protects a Cloud Storage bucket. They need to allow a specific on-premises application to access the bucket using a service account, but only when the request originates from a specific corporate IP range. The on-premises application authenticates with a service account key. Which configuration should the security engineer implement?

Accepted Answer

Create an ingress rule in the perimeter that allows the service account and includes the corporate IP range as a source.. VPC Service Controls ingress rules allow external identities to access protected resources. The rule must specify the service account as the identity and include the corporate IP range as a source. This ensures the on-premises application can access the bucket only from the specified network, meeting both identity and location requirements.

Answer

Add the corporate IP range to the bucket's IAM policy as a condition, and grant the service account the Storage Object Viewer role.

Answer

Create an egress rule in the perimeter that allows the service account to access the bucket from the corporate IP range.

Answer

Add an access level that includes the corporate IP range, and add the service account to the perimeter's allowed identities.

Question 6

A security engineer is configuring firewall rules for a VPC that hosts production workloads. The team wants to reduce the attack surface by ensuring that only explicitly required traffic is allowed, and they want to verify the effective rules after changes. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Use Firewall Rules Logging on the rules that allow traffic, and review the logs to confirm which sources are actually connecting.. Least privilege in VPC firewall design comes from narrow source and target scoping, and verification comes from logging and reviewing actual matches. Together these actions reduce exposure and provide evidence that only required traffic is permitted. Relying on the implied deny, disabling egress rules, or using a single broad rule does not achieve the stated security objective.

Answer

Rely on the implied deny ingress rule to block all traffic that is not explicitly allowed.

Answer

Disable all egress rules and rely on the implied allow egress behavior to permit outbound traffic.

Answer

Create a single rule with a large source range and apply it to all instances to simplify management.

Question 7

A company runs a web application on Compute Engine behind an external HTTP(S) load balancer. The security team must inspect incoming traffic for known malicious source IPs and rate-limit abusive clients, while keeping the backend VMs hidden from direct internet access. Which combination should the engineer implement?

Accepted Answer

Attach a Cloud Armor security policy to the load balancer's backend service with rules for the malicious IP ranges and a rate-based ban rule, and ensure the backend VMs have no external IP addresses.. Cloud Armor security policies are enforced at external HTTP(S) load balancer backend services, where rules can allow or deny based on source IP and apply rate-based bans to abusive clients. Removing external IPs from the backend VMs ensures traffic can only enter through the load balancer, so the policy is consistently applied and direct internet access to the VMs is blocked.

Answer

Attach a Cloud Armor security policy to the VPC network and add deny rules for the malicious IP ranges.

Answer

Enable Cloud CDN on the backend service and configure a Google Cloud Armor edge security policy on the load balancer's target proxy.

Answer

Create VPC firewall rules that deny traffic from the malicious IP ranges and rely on the load balancer's health checks to rate-limit clients.

Question 8

A security engineer needs to ensure that all egress traffic from a VPC to external destinations is inspected by a third-party next-generation firewall appliance running on Compute Engine, while allowing Google API traffic to bypass the appliance. The VMs currently have external IP addresses. What should the engineer implement?

Accepted Answer

Create a custom route with the appliance as the next hop for 0.0.0.0/0, remove external IPs from the VMs, and configure the appliance to forward permitted traffic, using Private Google Access for the Google API bypass.. Steering egress through an appliance requires the VMs to route outbound traffic via a next-hop appliance, which works reliably only when external IPs are removed so the default route is used. Pointing the 0.0.0.0/0 route at the appliance sends traffic through it for inspection, while Private Google Access provides the intended bypass for Google APIs without exposing the VMs to the internet.

Answer

Deploy a Cloud NAT gateway and configure the appliance to receive mirrored traffic from the NAT gateway.

Answer

Enable VPC Flow Logs on all subnets and create log-based alerts for egress to unknown destinations.

Answer

Configure a VPC firewall rule that redirects egress traffic to the appliance using target service accounts.

Question 9

A company needs to connect its on-premises network to a Google Cloud VPC. The security team requires that traffic be encrypted and that the connection support dynamic routing via BGP. They also want a solution that can be set up quickly without ordering a dedicated physical circuit. What should they use?

Accepted Answer

HA VPN with Cloud Router and two tunnels to the on-premises VPN gateway.. HA VPN uses IPsec over the internet, so no physical circuit is needed, and it can be deployed in minutes. Cloud Router enables BGP for dynamic route exchange. With two tunnels, it provides high availability. This combination satisfies encryption, dynamic routing, and rapid setup without dedicated circuits.

Answer

HA VPN over Cloud Interconnect with a VLAN attachment.

Answer

Partner Interconnect with a 1-Gbps attachment and Cloud Router.

Answer

Dedicated Interconnect with a 10-Gbps circuit and Cloud Router.

Question 10

A security engineer needs to inspect outbound traffic from a VPC for intrusion attempts and malware, and to block connections to known malicious destinations. The team wants to use a managed Google Cloud service that can be attached to the VPC and does not require deploying third-party virtual appliances. Which service should the engineer use?

Accepted Answer

Cloud NGFW. Cloud NGFW is the managed next-generation firewall that attaches to a VPC and provides intrusion prevention and threat prevention, allowing the team to inspect egress and block malicious destinations without deploying appliances. Cloud IDS only detects, Cloud Armor protects inbound load-balanced services, and Secure Web Proxy handles explicit proxy policy rather than full network threat inspection.

Answer

Cloud Armor

Answer

Cloud IDS

Answer

Secure Web Proxy

Question 11

A retail company exposes an internal API on a global external Application Load Balancer. The security team must ensure that only clients presenting a valid client certificate issued by the company's internal CA can reach the backend, while still allowing unauthenticated health checks from Google's load balancer infrastructure. They configure a server TLS policy and a target HTTPS proxy. What must they also configure to enforce mutual TLS correctly?

Accepted Answer

Create a trust store by importing the internal CA certificate into a Certificate Manager trust config, then attach it to the target HTTPS proxy. Enforcing mutual TLS on the global external Application Load Balancer requires two distinct elements: a server TLS policy and target proxy configuration for the server side, and a Certificate Manager trust config that stores the CA certificates used to authenticate clients. Attaching that trust config to the target HTTPS proxy makes the load balancer request and verify client certificates during the handshake. Health checks from Google's infrastructure are handled separately and are not blocked by client certificate validation.

Answer

Enable client certificate validation by setting the proxy's sslPolicy to a policy that includes the client CA in its allowed cipher suites

Answer

Add the internal CA certificate as an additional certificate on the target HTTPS proxy alongside the server certificate

Answer

Configure a backend service with a custom request header containing the client certificate thumbprint, validated by the backend application

Question 12

A company has a web application behind an external HTTP(S) load balancer. The security team wants to block traffic from a specific list of IP addresses known to be malicious. They also want to log all requests that match the rule. What should they do?

Accepted Answer

Create a Cloud Armor security policy with a rule that has a deny action for the IP addresses, and attach it to the backend service. Enable logging on the rule.. To block specific IP addresses at the load balancer, a Cloud Armor security policy with a deny rule is needed. Attaching the policy to the backend service enforces it. Enabling logging on the rule ensures all matching requests are logged.

Answer

Configure a Cloud Armor security policy with a rule that has an allow action for the IP addresses, and attach it to the backend service.

Answer

Use Cloud Identity-Aware Proxy (IAP) to restrict access to the application based on IP addresses.

Answer

Create a firewall rule to deny traffic from the IP addresses to the load balancer's IP address.

Question 13

A financial services company must log all denied connections to its production VPC, which contains hundreds of VM instances and several firewall rules. The security team needs visibility into which denied flows target which instances, without capturing every allowed flow and generating excessive log volume. What should they do?

Accepted Answer

Enable Firewall Rules Logging on the firewall rules that deny traffic, and view the logs in Cloud Logging. Firewall Rules Logging is the mechanism that records connections matched by a specific firewall rule, including the rule name, the action taken, and the involved instances. Enabling it selectively on the rules that deny traffic produces exactly the denied-flow records needed, with rule-level attribution, while avoiding the cost and volume of logging every allowed connection. VPC Flow Logs and Packet Mirroring capture broader traffic and cannot identify the responsible firewall rule.

Answer

Enable Packet Mirroring on the production VPC to copy all traffic to a collection instance running an IDS

Answer

Enable VPC Flow Logs on every subnet in the production VPC with a sampling rate of 1.0

Answer

Configure a Cloud Logging sink that filters for firewall rule matches and export the results to BigQuery for analysis

Question 14

A security engineer needs to ensure that all traffic between two VPC networks in different projects is encrypted and authenticated. The networks are connected via VPC Network Peering. What should the engineer do?

Accepted Answer

No additional configuration is needed; VPC Network Peering traffic is encrypted and authenticated by Google's infrastructure.. VPC Network Peering traffic traverses Google's private network and is automatically encrypted and authenticated. No additional configuration is needed. This built-in security ensures that data in transit between peered VPCs is protected. The other options either provide no encryption or are not supported.

Answer

Use IPsec tunnels over the peering connection to encrypt traffic.

Answer

Configure a VPN tunnel between the two VPC networks using Cloud VPN.

Answer

Enable VPC Flow Logs on both networks to monitor and encrypt traffic.

Question 15

A media company runs a Shared VPC where the host project contains all subnets and the service projects contain the workloads. A security engineer in a service project needs to create a firewall rule that allows SSH from a bastion subnet in the host project to instances in that service project only. The engineer has the compute.securityAdmin role on the service project. What is the correct approach?

Accepted Answer

Ask a host project administrator with the compute.securityAdmin role to create the firewall rule in the host project, scoped by target tags or service accounts used by the service project instances. In a Shared VPC, the host project owns the VPC network and its firewall rules, so rules must be created there by an identity holding compute.securityAdmin or compute.networkAdmin on the host project. The narrow allow is achieved by specifying the bastion subnet's source range and targeting only the service project instances via network tags or service accounts. Service project roles cannot create host project firewall rules, and broadening the source to the internet is unacceptable.

Answer

Create the firewall rule in the service project, selecting the host project's bastion subnet as the source

Answer

Grant the service project engineer compute.networkAdmin on the host project so they can create the rule themselves

Answer

Create the rule in the host project using a source of 0.0.0.0/0 and rely on IAM to restrict who can actually connect via SSH