PCSE Configuring Network Security Practice Test 2 — 15 Questions

Question 1

Which VPC firewall rule target type is recommended for security because it can be dynamically applied to instances based on their service account?

Accepted Answer

Service accounts. Service account targets allow rules to be applied based on the instance's service account, enabling dynamic and scalable security policies compared to static network tags.

Answer

Instance names

Answer

Subnets

Answer

Tags

Question 2

A company wants to detect and block SQL injection attacks targeting their web application hosted on Compute Engine behind a Cloud Load Balancer. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Enable Cloud Armor adaptive protection to detect and block suspicious patterns.. Cloud Armor preconfigured rules (like OWASP ModSecurity CRS) can detect SQLi, and enabling adaptive protection provides ML-based anomaly detection. Cloud IDS is for network-level threats, not WAF; VPC firewall rules don't inspect application payloads.

Answer

Deploy Cloud IDS in the VPC to inspect packets for SQLi patterns.

Answer

Configure VPC firewall rules to deny traffic on port 443.

Answer

Use VPC Service Controls to restrict access to the backend instances.

Question 3

A financial services company must ensure that all data in Cloud Storage remains within a specific region and that no data can be accessed from outside the corporate network. They also need to allow a partner organization to access a specific bucket. Which THREE Google Cloud services or features should be combined to meet these requirements? (Choose THREE.)

Accepted Answer

Private Service Connect. VPC Service Controls restricts data access to authorized VPCs/environments. Access levels can enforce IP-based restrictions (corporate network). Private Service Connect can allow the partner to access the bucket privately via PSC endpoints without traversing the internet.

Answer

Cloud IDS

Answer

Cloud Armor security policies

Question 4

An organization wants to implement a zero-trust network security model for their Google Cloud environment. Which TWO practices should they adopt? (Choose TWO.)

Accepted Answer

Implement VPC Service Controls to create perimeters around sensitive APIs.. Using service account targets for firewall rules aligns with identity-based security (zero-trust). VPC Service Controls restrict access to APIs based on identity and context, reducing reliance on network perimeter.

Answer

Enable Private Google Access for all subnets.

Answer

Use network tags to group VMs for firewall rules.

Answer

Allow all outbound traffic and rely on intrusion detection.

Question 5

An organization wants to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can reach it, without using public IP addresses. Which solution should they implement?

Accepted Answer

Private Google Access. Private Google Access allows on-premises hosts or VM instances using internal IPs to reach Google APIs and services (like Cloud Storage) by routing traffic through the VPC network, without requiring public IPs.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud VPN

Question 6

A security engineer needs to allow HTTP (port 80) traffic from all VMs in the production environment to a specific set of VMs running a web server. The web server VMs are identified by a service account 'web-sa@...'. Which firewall rule configuration should the engineer create?

Accepted Answer

Ingress rule: source = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80. Using a service account as the target (serviceAccount = web-sa@...) is the recommended approach for security, as it is more dynamic and less error-prone than using network tags. The rule allows ingress traffic from any source (0.0.0.0/0) on TCP port 80 to VMs with that service account.

Answer

Egress rule: destination = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], deny tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], allow tcp:80

Question 7

A company wants to enforce that all VPC firewall rules in an organization must be centrally managed and cannot be overridden by lower-level projects. Which approach should they use?

Accepted Answer

Use a hierarchical firewall policy at the organization node. Hierarchical firewall policies are applied at the organization, folder, or project level and are inherited downward. They can be set to have higher priority than network firewall rules, and lower-level rules cannot override them if the policy is set accordingly.

Answer

Create network firewall rules at the organization level

Answer

Configure VPC Service Controls with a perimeter

Answer

Enable Organizational Policy constraints

Question 8

An organization uses VPC Service Controls to protect BigQuery datasets. They need to allow a specific on-premises application, which uses a static IP address, to query a BigQuery dataset inside the service perimeter. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter with the on-premises IP as the source. VPC Service Controls allow ingress rules to permit traffic from specific IP ranges into a perimeter. By creating an ingress rule that allows the on-premises IP and specifies the BigQuery API, the on-premises application can access the dataset.

Answer

Create a Cloud Armor rule to allow the on-premises IP

Answer

Use Private Google Access for the on-premises network

Answer

Add the on-premises IP to an access level and create an egress rule

Question 9

A company wants to provide private connectivity from its VPC to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs or NAT. The solution must also support on-premises connectivity via Cloud VPN. Which service should they use?

Accepted Answer

Private Service Connect. Private Service Connect enables private connectivity to Google APIs via internal IPs. It supports both VPC and on-premises (via Cloud VPN or Interconnect) access to Google APIs without traversing the internet.

Answer

Private Google Access

Answer

Cloud NAT

Answer

Cloud VPN

Question 10

A web application behind an HTTPS load balancer is experiencing a high volume of malicious requests with SQL injection patterns. The security team wants to block these requests with minimal latency impact. Which Cloud Armor feature should they use?

Accepted Answer

Preconfigured WAF rules (OWASP ModSecurity CRS). Cloud Armor provides preconfigured WAF rules, including the OWASP ModSecurity Core Rule Set (CRS), which includes SQL injection detection rules. Enabling this set blocks SQL injection attempts.

Answer

Rate limiting per IP

Answer

Custom rules with CEL expressions

Answer

Adaptive Protection

Question 11

An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?

Accepted Answer

The DNS CNAME record for domain validation is misconfigured or missing. Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.

Answer

The load balancer's frontend IP address has changed

Answer

The certificate has reached its maximum validity period

Answer

The load balancer's SSL policy requires a minimum TLS version that the managed certificate does not support

Question 12

A security engineer needs to monitor network traffic for potential threats in a VPC. They want to inspect all traffic for malware signatures and alert on high-severity threats. The solution should be natively integrated with GCP. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect traffic for malware and other threats. It integrates with packet mirroring in GCP.

Answer

VPC Flow Logs

Answer

Security Command Center

Answer

Cloud Armor

Question 13

A company wants to enforce that traffic between two projects in the same organization must go through a central inspection VPC. They need a firewall rule that denies all traffic between the projects except through the inspection VPC. Which type of firewall rule should they use?

Accepted Answer

Hierarchical firewall policy at the folder level. Hierarchical firewall policies are applied at the folder or organization level and can enforce rules across projects. They are inherited and cannot be overridden by lower-level rules, making them suitable for central enforcement.

Answer

Cloud IDS

Answer

VPC Service Controls

Answer

Network firewall rules in each project

Question 14

An organization needs to restrict access to Cloud Storage buckets so that only requests from a specific range of IP addresses (e.g., corporate VPN) are allowed. They also want to block all other IPs. Which combination of services should they use?

Accepted Answer

VPC Service Controls with an IP-based access level. VPC Service Controls create a service perimeter that, combined with an access level based on IP addresses, can restrict access to Google Cloud services such as Cloud Storage to only those IPs. The access level defines the allowed IP ranges.

Answer

IAM conditions with source IP

Answer

Firewall rules with source IP

Answer

Cloud Armor with IP allow list

Question 15

A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?

Accepted Answer

Create a new SSL certificate resource with the new certificate and key, then update the target HTTPS proxy to use it. To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.

Answer

Use gcloud compute ssl-certificates update to replace the certificate

Answer

Update the existing SSL certificate resource with the new certificate and key

Answer

Delete the existing certificate and upload the new one with the same name