PCSE Configuring Network Security Practice Test 3 — 15 Questions

Question 1

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only requests originating from a specific VPC network are allowed. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define a service perimeter around a set of Google Cloud APIs, restricting access to only those identities and networks you specify. This is the correct service for this requirement. Firewall rules control network traffic to VM instances, not API access. Cloud Armor protects against web attacks. Private Service Connect provides private connectivity to Google APIs but does not restrict access.

Answer

Private Service Connect

Answer

VPC firewall rules

Answer

Cloud Armor

Question 2

A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?

Accepted Answer

Hierarchical firewall policies. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network. VPC firewall rules are per project and can be overridden.

Answer

VPC firewall rules

Answer

Network firewall policies

Answer

Cloud Armor security policies

Question 3

An engineer wants to allow egress traffic from a group of VM instances with a specific service account to a set of IP addresses. They need to choose between using tags or service accounts as targets in a VPC firewall rule. Which approach is recommended for better security and why?

Accepted Answer

Use service accounts because they are managed by IAM and provide a stronger identity-based security model.. Service account targets are preferred because they are more secure. Tags can be added or removed by anyone with compute.instances.setTags permission, while service accounts are managed centrally with IAM. Using service accounts ensures that the firewall rule applies based on the identity of the VM, which is harder to spoof.

Answer

Use tags because they are easier to manage and provide the same level of security as service accounts.

Answer

Use target tags with a network tag that is automatically assigned by a management tool.

Answer

Either is acceptable; Google recommends using tags for simplicity.

Question 4

A company uses VPC Service Controls to protect a project containing BigQuery datasets. They have an ingress rule that allows traffic from an on-premises network via a Cloud VPN tunnel. The on-premises IP range is 10.0.0.0/8. However, users on-premises are still getting access denied errors when querying BigQuery. The VPC Service Controls perimeter is in dry-run mode. What is the most likely cause?

Accepted Answer

The ingress rule does not include the on-premises user identities or service accounts.. In dry-run mode, VPC Service Controls logs violations but does not enforce them. The access denied errors are likely caused by something else, such as IAM permissions or a missing identity in the ingress rule. Dry-run mode only logs, it does not block or allow access. If the ingress rule is correctly configured, access should be allowed in dry-run mode. But the error persists, so the issue is not VPC Service Controls enforcement.

Answer

The perimeter is in dry-run mode, which blocks all traffic until the rule is finalized.

Answer

The dry-run mode only applies to egress rules, not ingress.

Answer

Cloud VPN is not a supported access method for VPC Service Controls.

Question 5

An organization wants to provide private, on-premises access to Google Cloud APIs (e.g., Cloud Storage, BigQuery) without traversing the public internet. They have a Direct Connect link to Google Cloud. Which solution should they implement?

Accepted Answer

Private Service Connect. Private Service Connect allows you to create private endpoints to access Google APIs (like googleapis.com) using internal IP addresses, without going over the internet. It works with Direct Connect or VPN. VPC Service Controls restrict access but do not provide private connectivity. Cloud NAT provides outbound internet access, not private API access. Private Google Access enables on-premises access to Google APIs via on-premises DNS, but it still uses public IPs unless combined with Private Service Connect.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Private Google Access

Question 6

A company uses Cloud Armor security policies to protect their HTTP load balancer. They need to block requests from a specific geographic region (country X) and also limit requests from any IP to 1000 requests per second. They also want to use preconfigured rules for SQL injection prevention. What is the correct way to combine these requirements in a single security policy?

Accepted Answer

Create separate rules: one for geo-blocking with priority 500, one for rate limiting with priority 600, and enable preconfigured SQLi rules at priority 1000. Order them appropriately.. Cloud Armor rules are evaluated in order of priority (lowest number first). Preconfigured rules (like SQLi) have a priority of 1000 by default. Geographic and rate limiting rules can be added with custom priorities. The rule order matters: typically, you want to block/rate-limit before applying WAF rules to reduce processing. However, the question is about combining them correctly: all rule types can coexist in a single policy. The key is that each rule type has its own configuration; you can't set rate limiting in the same rule as geo-blocking; they must be separate rules.

Answer

Create a single custom rule with both geo-blocking and rate limiting conditions using CEL expressions, and enable preconfigured SQLi rules.

Answer

Use Cloud Armor Managed Protection Plus, which automatically includes geo-blocking and rate limiting.

Answer

Enable SQLi preconfigured rules only; geo-blocking and rate limiting are not supported in Cloud Armor.

Question 7

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They want Google to manage the certificate lifecycle. Which certificate type should they use?

Accepted Answer

Google-managed certificate. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google. They are the correct choice for automatic lifecycle management. Self-managed certificates require the user to upload the certificate and renew it manually. Certificate Manager is a service for managing certificates but does not automate renewal unless using Google-managed certificates.

Answer

Self-managed certificate

Answer

Upload a certificate via the Cloud Load Balancing UI

Answer

Certificate Manager with a self-managed certificate

Question 8

A security engineer needs to detect and alert on network-based threats such as malware and command-and-control traffic within their Google Cloud VPC. They want a managed service that provides deep packet inspection and integrates with their existing security operations. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with VPC packet mirroring and provides threat severity levels. Cloud Armor protects web applications at the edge. VPC Service Controls restrict data access. Cloud NGFW (next-generation firewall) is not a Google Cloud managed service; Google offers Cloud Firewall (which is not NGFW).

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Cloud NGFW

Question 9

An organization uses VPC Service Controls with a service perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises service account to write data to a Cloud Storage bucket inside the perimeter. The on-premises network connects via Cloud VPN. What must be configured in the perimeter?

Accepted Answer

An ingress rule that specifies the on-premises service account and the Cloud VPN network as sources. To allow an on-premises service account to access resources inside a service perimeter, you need an ingress rule that specifies the source (the on-premises identities and network) and the target resources (the Cloud Storage bucket). The source must include both the identity (service account) and the network (VPC or IP range).

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage bucket

Answer

An egress rule that allows the service account to exit the perimeter

Answer

An access level that includes the on-premises IP range

Question 10

A company needs to enforce that all incoming traffic to their HTTPS load balancer must use TLS 1.2 or higher. Which SSL policy setting should they configure on the target HTTPS proxy?

Accepted Answer

Set the minimum TLS version to 1.2 and cipher profile to MODERN. SSL policies allow you to set the minimum TLS version. To require TLS 1.2 or higher, set the minimum TLS version to 1.2. The cipher profile can be set to MODERN or RESTRICTED, but the key is the minimum TLS version.

Answer

Set the minimum TLS version to 1.3 only

Answer

Set the minimum TLS version to 1.0 and cipher profile to RESTRICTED

Answer

Use a self-managed certificate with TLS 1.2 enforcement

Question 11

A company is using Cloud Armor with adaptive protection enabled. They notice that adaptive protection has generated a rule that is blocking some legitimate traffic. What should they do to minimize false positives while still benefiting from adaptive protection?

Accepted Answer

Add a higher-priority allow rule for the legitimate traffic. Adaptive protection works by learning traffic patterns and generating rules. The best practice is to initially set the adaptive protection rule to 'throttle' or 'log' mode (or use a low priority) to monitor its impact. Alternatively, you can override the rule with a higher-priority allow rule for known good traffic. The recommended approach is to use the rule in preview or monitoring mode before enforcing.

Answer

Disable adaptive protection immediately

Answer

Increase the sensitivity threshold of adaptive protection

Answer

Change the adaptive protection rule action to 'throttle'

Question 12

An organization has multiple VPC networks in different projects. They need to centrally manage firewall rules that apply to all VPCs in the organization and ensure that project owners cannot override them. Which solution should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks. They cannot be overridden by lower-level firewall rules. This is the correct solution for centralized, unoverrideable rules. Network firewall policies are scoped to a single VPC network.

Answer

Create a network firewall policy and attach it to each VPC network

Answer

Use Cloud Armor security policies with the load balancers

Answer

Use VPC firewall rules with tags applied to all VMs across projects

Question 13

A company is implementing VPC Service Controls to protect a project that contains Cloud Storage and BigQuery. They want to allow a specific on-premises service account to read data from Cloud Storage and write to BigQuery. The on-premises network connects via Cloud VPN. Which TWO components must be configured in the service perimeter? (Choose two.)

Accepted Answer

An ingress rule that allows the on-premises service account to access Cloud Storage and BigQuery. To allow external access, you need an ingress rule that specifies the source (on-premises service account and the Cloud VPN network) and the allowed services (Cloud Storage and BigQuery). An access level can be used to define the IP range, but the ingress rule is the primary mechanism. Adding the service to the perimeter is already done; you don't need to add it again. An egress rule is not needed for inbound access.

Answer

Add Cloud Storage and BigQuery to the list of restricted services in the perimeter (they already are)

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage and BigQuery APIs

Answer

An egress rule that allows the on-premises service account to leave the perimeter

Question 14

A security team is configuring Cloud Armor to protect a web application. They need to block requests that contain SQL injection patterns, block requests from a known malicious IP list, and limit requests from any single IP to 2000 requests per minute. Which THREE actions must they take? (Choose three.)

Accepted Answer

Create a custom rule with a deny action for the malicious IP list using a CEL expression. To implement these requirements, you need to enable the preconfigured SQL injection rule set, create a custom rule with an IP allow/deny list for the malicious IPs, and create a rate limiting rule. Cloud Armor does not have a built-in list of malicious IPs; you must provide the list. The rate limiting is configured as a separate rule with action 'rateBasedThrottle'.

Answer

Create a single rule that combines SQLi detection, IP blocking, and rate limiting using CEL

Answer

Enable Cloud Armor Managed Protection Plus for automatic IP reputation

Question 15

A company is deploying a new internal application on Google Cloud. They want to ensure that VM instances in a specific subnet can only communicate with each other and with a load balancer that fronts the application. They also want to allow SSH access from a bastion host. Which TWO firewall rules should they create? (Choose two.)

Accepted Answer

An ingress rule that allows all traffic from the subnet to the instances (target tags or service account). To restrict communication to only internal subnet traffic and the load balancer, you need an ingress rule that allows traffic from the subnet (source) to all instances (target). To allow SSH from the bastion, you need an ingress rule allowing TCP port 22 from the bastion host (using its service account or tags). Egress rules are not needed because the default allow egress is not restrictive; but if you want to block other egress, you would need a deny egress rule, but the question asks for rules to allow, not block.

Answer

An egress rule that blocks all traffic except to the load balancer and subnet

Answer

An egress rule that allows all traffic to the load balancer's frontend IP

Answer

An ingress rule that allows HTTP traffic from the load balancer to the instances