PCSE Configuring Network Security Practice Test 2 — 15 Questions

Question 1

A security engineer needs to detect and alert on network-based threats such as malware and command-and-control traffic within their Google Cloud VPC. They want a managed service that provides deep packet inspection and integrates with their existing security operations. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with VPC packet mirroring and provides threat severity levels. Cloud Armor protects web applications at the edge. VPC Service Controls restrict data access. Cloud NGFW (next-generation firewall) is not a Google Cloud managed service; Google offers Cloud Firewall (which is not NGFW).

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Cloud NGFW

Question 2

An organization uses VPC Service Controls with a service perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises service account to write data to a Cloud Storage bucket inside the perimeter. The on-premises network connects via Cloud VPN. What must be configured in the perimeter?

Accepted Answer

An ingress rule that specifies the on-premises service account and the Cloud VPN network as sources. VPC Service Controls ingress rules explicitly define which identities and networks may enter a perimeter to access protected services. Because the on-premises service account connects through Cloud VPN, the ingress rule must name that service account as the identity source and the Cloud VPN network as the network source, which is precisely what option A describes.

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage bucket

Answer

An egress rule that allows the service account to exit the perimeter

Answer

An access level that includes the on-premises IP range

Question 3

A company needs to enforce that all incoming traffic to their HTTPS load balancer must use TLS 1.2 or higher. Which SSL policy setting should they configure on the target HTTPS proxy?

Accepted Answer

Set the minimum TLS version to 1.2 and cipher profile to MODERN. SSL policies allow you to set the minimum TLS version. To require TLS 1.2 or higher, set the minimum TLS version to 1.2. The cipher profile can be set to MODERN or RESTRICTED, but the key is the minimum TLS version.

Answer

Set the minimum TLS version to 1.3 only

Answer

Set the minimum TLS version to 1.0 and cipher profile to RESTRICTED

Answer

Use a self-managed certificate with TLS 1.2 enforcement

Question 4

A company is implementing VPC Service Controls to protect a project that contains Cloud Storage and BigQuery. They want to allow a specific on-premises service account to read data from Cloud Storage and write to BigQuery. The on-premises network connects via Cloud VPN. Which TWO components must be configured in the service perimeter? (Choose two.)

Accepted Answer

An ingress rule that allows the on-premises service account to access Cloud Storage and BigQuery. To allow external access, you need an ingress rule that specifies the source (on-premises service account and the Cloud VPN network) and the allowed services (Cloud Storage and BigQuery). An access level can be used to define the IP range, but the ingress rule is the primary mechanism. Adding the service to the perimeter is already done; you don't need to add it again. An egress rule is not needed for inbound access.

Answer

Add Cloud Storage and BigQuery to the list of restricted services in the perimeter (they already are)

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage and BigQuery APIs

Answer

An egress rule that allows the on-premises service account to leave the perimeter

Question 5

A company is deploying a new internal application on Google Cloud. They want to ensure that VM instances in a specific subnet can only communicate with each other and with a load balancer that fronts the application. They also want to allow SSH access from a bastion host. Which TWO firewall rules should they create? (Choose two.)

Accepted Answer

An ingress rule that allows all traffic from the subnet to the instances (target tags or service account). To restrict communication to only internal subnet traffic and the load balancer, you need an ingress rule that allows traffic from the subnet (source) to all instances (target). To allow SSH from the bastion, you need an ingress rule allowing TCP port 22 from the bastion host (using its service account or tags). Egress rules are not needed because the default allow egress is not restrictive; but if you want to block other egress, you would need a deny egress rule, but the question asks for rules to allow, not block.

Answer

An egress rule that blocks all traffic except to the load balancer and subnet

Answer

An egress rule that allows all traffic to the load balancer's frontend IP

Answer

An ingress rule that allows HTTP traffic from the load balancer to the instances

Question 6

An organization needs to block all inbound SSH traffic (port 22) to a set of VM instances that have a common tag 'ssh-restricted'. They want to deny this traffic at the VPC firewall level. Which firewall rule configuration should they use?

Accepted Answer

Deny rule: direction INGRESS, protocol tcp, port 22, target tag 'ssh-restricted'. To block inbound SSH traffic to VMs with a specific tag, you need an ingress deny rule targeting that tag on TCP port 22. Google Cloud VPC firewall rules can target instances by network tags, and a deny rule with the specified tag will prevent SSH access to those instances. This directly meets the requirement.

Answer

Allow rule: direction EGRESS, protocol tcp, port 22, target tag 'ssh-restricted'

Answer

Deny rule: direction INGRESS, protocol tcp, port 22, target service account 'ssh-restricted'

Answer

Allow rule: direction INGRESS, protocol tcp, port 22, source tag 'ssh-restricted'

Question 7

A company uses hierarchical firewall policies at the organization level to enforce a baseline deny-all rule. A project administrator wants to create a firewall rule that allows HTTP traffic to a specific VM. Which statement is correct?

Accepted Answer

The project administrator cannot allow HTTP because the hierarchical policy denies all traffic.. Hierarchical firewall policies applied at the organization level are evaluated before VPC-level firewall rules, and a deny rule in the hierarchical policy cannot be overridden by a project-level rule. Since the baseline deny-all is enforced at the organization level, the project administrator cannot create a VPC firewall rule that allows HTTP — the hierarchical deny takes precedence. This is the intended design of Google Cloud's hierarchical firewall policies: they enforce organizational guardrails that projects cannot bypass.

Answer

The project administrator can modify the hierarchical policy to allow HTTP.

Answer

The project administrator can create a VPC firewall rule to allow HTTP, and it will work if the policy is not enforced.

Answer

The project administrator can create a VPC firewall rule with higher priority to override the policy.

Question 8

A financial services company must ensure that all data egress from a VPC to BigQuery goes through a Private Service Connect endpoint for private access. They have set up the PSC endpoint and configured DNS. However, connections from VMs are still using the public internet. What is the most likely cause?

Accepted Answer

Private Google Access is disabled on the subnet.. For private access to Google APIs via PSC, the VPC must have Private Google Access enabled on the subnet. Without it, VMs will use the default public route.

Answer

The VPC has a default route to the internet via NAT.

Answer

The DNS record for bigquery.googleapis.com points to the public IP.

Answer

The PSC endpoint is not associated with a forwarding rule.

Question 9

An organization wants to use Cloud IDS to detect network threats within their VPC. They have enabled the Cloud IDS endpoint and configured packet mirroring. Which of the following is required for the packet mirroring policy to work?

Accepted Answer

VMs must be tagged with 'cloud-ids-packet-mirroring'.. Packet mirroring requires that the source VMs have the cloud-ids-packet-mirroring tag. The mirrored traffic is sent to the IDS endpoint via an internal load balancer.

Answer

The IDS endpoint must be in the same zone as the VMs.

Answer

VPC firewall rules must allow traffic to the IDS endpoint.

Answer

All VMs must have an external IP address.

Question 10

An organization wants to enforce that all egress traffic from a VPC to the internet must go through a Cloud NAT gateway for logging and IP management. They also need to block all other direct outbound traffic. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Delete the default route (0.0.0.0/0) from the VPC. To force traffic through Cloud NAT, you need to remove the default route (0.0.0.0/0), create a route that only allows traffic to the NAT gateway's IP range (or use a more specific route), and then add a deny egress rule for all other internet traffic.

Answer

Enable Private Google Access on the subnet

Answer

Add a firewall rule to allow egress to 0.0.0.0/0

Question 11

A security engineer wants to restrict access to Cloud Storage buckets such that only workloads running on Compute Engine VMs in a specific VPC can read data. The VMs are managed by multiple GKE clusters and autoscaling instance groups. Which approach BEST enforces this restriction?

Accepted Answer

Create a VPC Service Controls service perimeter with an ingress rule that allows access from the VPC network.. VPC Service Controls (VPC SC) create a security perimeter around Google Cloud services, including Cloud Storage. By defining a service perimeter and adding an ingress rule that allows access from the specific VPC network, you ensure that only resources within that VPC (like GKE clusters and autoscaling VMs) can access the bucket, even if IAM permissions are granted. This enforces network-level isolation independent of IP addresses or tags, which is critical for dynamic workloads. The ingress rule specifically permits traffic from the VPC, blocking all other sources.

Answer

Configure a Cloud Armor security policy to block requests to Cloud Storage from non-VPC IPs.

Answer

Create a firewall rule that denies all egress traffic from the VPC to Cloud Storage IP ranges except through a proxy VM.

Answer

Use IAM conditions on the Cloud Storage bucket to restrict access based on VPC network tags.

Question 12

A company is deploying an internal service on GKE that needs to be accessible privately from on-premises data centers over a VPN connection. The service should not be exposed to the internet. Which connectivity solution is MOST appropriate?

Accepted Answer

Private Service Connect with an internal load balancer. Private Service Connect (PSC) with an internal load balancer allows the GKE service to be exposed privately to on-premises over VPN without internet exposure. PSC provides a private endpoint that on-premises clients can reach through the VPN, and the internal load balancer keeps the service internal to the VPC.

Answer

Expose the service via an external load balancer with Cloud Armor IP allowlisting

Answer

Cloud NAT with firewall rules to allow on-premises IPs

Answer

VPC peering between the GKE VPC and on-premises

Question 13

An organization has a security policy that requires TLS 1.2 or higher for all HTTPS traffic to their external HTTP(S) load balancer. They also need to disable weak cipher suites. Which configuration should be applied?

Accepted Answer

Set the SSL policy on the target HTTPS proxy with minimum TLS version 1.2 and a MODERN or RESTRICTED cipher profile.. SSL policies on the target HTTPS proxy allow setting minimum TLS version and cipher profile. Set the minimum TLS version to 1.2 and choose the MODERN or RESTRICTED profile to disable weak ciphers.

Answer

Configure the SSL policy on the load balancer's backend bucket.

Answer

Use Cloud Armor WAF rules to block TLS 1.0/1.1 traffic.

Answer

Set the SSL policy on the target HTTPS proxy with minimum TLS version 1.2 and a compatible profile.

Question 14

An engineer needs to allow a specific service account from another project to access a Cloud Storage bucket in the current project. The engineer wants to use the principle of least privilege. Which IAM role should be granted directly on the bucket to the service account?

Accepted Answer

roles/storage.objectViewer on the bucket. Grant the predefined role `roles/storage.objectViewer` to the service account. This role provides read-only access to objects in the bucket.

Answer

roles/storage.legacyBucketReader on the bucket

Answer

roles/storage.objectAdmin on the bucket

Answer

roles/storage.admin on the project

Question 15

A company uses VPC Service Controls to protect a service perimeter around BigQuery. They need to allow a specific on-premises application (with static IP 203.0.113.10) to query BigQuery tables within the perimeter, while still blocking other internet traffic. Which configuration should be used?

Accepted Answer

Create an ingress rule in the service perimeter with an access level that includes the on-premises IP.. VPC Service Controls enforce access at the service perimeter level, independent of VPC firewall rules. To allow a specific on-premises IP to access BigQuery inside the perimeter, you create an ingress rule with an access level that includes that IP. This permits the specified source while continuing to block other internet traffic.

Answer

Use Cloud Armor to allow the IP.

Answer

Add the on-premises IP to the list of allowed IPs in the VPC firewall rules.

Answer

Set up a VPN connection and include the on-premises VPC in the perimeter.