PCSE Configuring Network Security Practice Test 2 — 15 Questions

Question 1

An organization wants to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can reach it, without using public IP addresses. Which solution should they implement?

Accepted Answer

Private Google Access. Private Google Access allows on-premises hosts or VM instances using internal IPs to reach Google APIs and services (like Cloud Storage) by routing traffic through the VPC network, without requiring public IPs.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud VPN

Question 2

A security engineer needs to allow HTTP (port 80) traffic from all VMs in the production environment to a specific set of VMs running a web server. The web server VMs are identified by a service account 'web-sa@...'. Which firewall rule configuration should the engineer create?

Accepted Answer

Ingress rule: source = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80. Using a service account as the target (serviceAccount = web-sa@...) is the recommended approach for security, as it is more dynamic and less error-prone than using network tags. The rule allows ingress traffic from any source (0.0.0.0/0) on TCP port 80 to VMs with that service account.

Answer

Egress rule: destination = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], deny tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], allow tcp:80

Question 3

A company wants to enforce that all VPC firewall rules in an organization must be centrally managed and cannot be overridden by lower-level projects. Which approach should they use?

Accepted Answer

Use a hierarchical firewall policy at the organization node. Hierarchical firewall policies are applied at the organization, folder, or project level and are inherited downward. They can be set to have higher priority than network firewall rules, and lower-level rules cannot override them if the policy is set accordingly.

Answer

Create network firewall rules at the organization level

Answer

Configure VPC Service Controls with a perimeter

Answer

Enable Organizational Policy constraints

Question 4

An organization uses VPC Service Controls to protect BigQuery datasets. They need to allow a specific on-premises application, which uses a static IP address, to query a BigQuery dataset inside the service perimeter. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter with the on-premises IP as the source. VPC Service Controls allow ingress rules to permit traffic from specific IP ranges into a perimeter. By creating an ingress rule that allows the on-premises IP and specifies the BigQuery API, the on-premises application can access the dataset.

Answer

Create a Cloud Armor rule to allow the on-premises IP

Answer

Use Private Google Access for the on-premises network

Answer

Add the on-premises IP to an access level and create an egress rule

Question 5

A company wants to provide private connectivity from its VPC to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs or NAT. The solution must also support on-premises connectivity via Cloud VPN. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect enables private connectivity to Google APIs via internal IPs. It supports both VPC and on-premises (via Cloud VPN or Interconnect) access to Google APIs without traversing the internet.

Answer

Private Google Access

Answer

Cloud NAT

Answer

Cloud VPN

Question 6

A web application behind an HTTPS load balancer is experiencing a high volume of malicious requests with SQL injection patterns. The security team wants to block these requests with minimal latency impact. Which Cloud Armor feature should they use?

Accepted Answer

Preconfigured WAF rules (OWASP ModSecurity CRS). Cloud Armor provides preconfigured WAF rules, including the OWASP ModSecurity Core Rule Set (CRS), which includes SQL injection detection rules. Enabling this set blocks SQL injection attempts.

Answer

Rate limiting per IP

Answer

Custom rules with CEL expressions

Answer

Adaptive Protection

Question 7

An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?

Accepted Answer

The DNS CNAME record for domain validation is misconfigured or missing. Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.

Answer

The load balancer's frontend IP address has changed

Answer

The certificate has reached its maximum validity period

Answer

The load balancer's SSL policy requires a minimum TLS version that the managed certificate does not support

Question 8

A security engineer needs to monitor network traffic for potential threats in a VPC. They want to inspect all traffic for malware signatures and alert on high-severity threats. The solution should be natively integrated with GCP. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect traffic for malware and other threats. It integrates with packet mirroring in GCP.

Answer

VPC Flow Logs

Answer

Security Command Center

Answer

Cloud Armor

Question 9

A company wants to enforce that traffic between two projects in the same organization must go through a central inspection VPC. They need a firewall rule that denies all traffic between the projects except through the inspection VPC. Which type of firewall rule should they use?

Accepted Answer

Hierarchical firewall policy at the folder level. Hierarchical firewall policies are applied at the folder or organization level and can enforce rules across projects. They are inherited and cannot be overridden by lower-level rules, making them suitable for central enforcement.

Answer

Cloud IDS

Answer

VPC Service Controls

Answer

Network firewall rules in each project

Question 10

An organization needs to restrict access to Cloud Storage buckets so that only requests from a specific range of IP addresses (e.g., corporate VPN) are allowed. They also want to block all other IPs. Which combination of services should they use?

Accepted Answer

VPC Service Controls with an IP-based access level. VPC Service Controls create a service perimeter that, combined with an access level based on IP addresses, can restrict access to Google Cloud services such as Cloud Storage to only those IPs. The access level defines the allowed IP ranges.

Answer

IAM conditions with source IP

Answer

Firewall rules with source IP

Answer

Cloud Armor with IP allow list

Question 11

A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?

Accepted Answer

Create a new SSL certificate resource with the new certificate and key, then update the target HTTPS proxy to use it. To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.

Answer

Use gcloud compute ssl-certificates update to replace the certificate

Answer

Update the existing SSL certificate resource with the new certificate and key

Answer

Delete the existing certificate and upload the new one with the same name

Question 12

A security team wants to block all incoming traffic from a specific country to their web application behind a global HTTPS load balancer. They also need to allow traffic from all other countries. Which Cloud Armor feature should be used?

Accepted Answer

Custom rule with geo-based condition. Cloud Armor supports geo-based access control. By creating a custom rule that uses a GeoIP match condition to deny traffic from the specific country, all other traffic is allowed by default (or via another rule).

Answer

Rate limiting

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Question 13

A company wants to enable private connectivity from its on-premises network to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs. They have a Cloud VPN connection to a VPC. Which TWO services or configurations are required? (Choose two.)

Accepted Answer

Private Google Access. Private Service Connect provides private IP endpoints for Google APIs in a VPC. Private Google Access enables VMs in the VPC to use those endpoints. For on-premises, Cloud VPN provides connectivity to the VPC. However, Private Google Access is required for on-premises to reach the endpoints via the VPN. So the two correct answers are Private Service Connect and Private Google Access.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

VPC Service Controls

Question 14

A security engineer is designing a VPC Service Controls perimeter to protect sensitive BigQuery data. They need to allow a specific on-premises application (source IP range 203.0.113.0/24) to query BigQuery, and also allow a managed instance group in another project (project 'analytics') to export data from BigQuery to Cloud Storage. Which THREE configurations are required? (Choose three.)

Accepted Answer

Add the analytics project to the service perimeter. To allow on-premises access, an ingress rule with the source IP range is needed. To allow the managed instance group in another project, that project must be added to the perimeter (as a project within the perimeter) and an ingress rule for the service account or VPC of that project must be created. Also, the managed instance group will need an egress rule to allow access to Cloud Storage from within the perimeter. So ingress rule for on-premises, adding the analytics project to the perimeter, and an egress rule for Cloud Storage are required.

Answer

Configure Cloud Armor to allow the on-premises IP

Answer

Create an ingress rule to allow the service account of the managed instance group

Question 15

A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)

Accepted Answer

Attach the SSL policy to the target HTTPS proxy. To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.

Answer

Enable Cloud Armor WAF rules

Answer

Set the SSL policy to COMPATIBLE profile

Answer

Use a Google-managed SSL certificate