PCSE Configuring Network Security Practice Test 3 — 15 Questions

Question 1

A security team wants to block all incoming traffic from a specific country to their web application behind a global HTTPS load balancer. They also need to allow traffic from all other countries. Which Cloud Armor feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Custom rule with geo-based condition. Cloud Armor supports geo-based access control. By creating a custom rule that uses a GeoIP match condition to deny traffic from the specific country, all other traffic is allowed by default (or via another rule).

Answer

Rate limiting

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Question 2

A security engineer is designing a VPC Service Controls perimeter to protect sensitive BigQuery data. They need to allow a specific on-premises application (source IP range 203.0.113.0/24) to query BigQuery, and also allow a managed instance group in another project (project 'analytics') to export data from BigQuery to Cloud Storage. Which THREE configurations are required? (Choose three.)

Accepted Answer

Add the analytics project to the service perimeter. To allow on-premises access, an ingress rule with the source IP range is needed. To allow the managed instance group in another project, that project must be added to the perimeter (as a project within the perimeter) and an ingress rule for the service account or VPC of that project must be created. Also, the managed instance group will need an egress rule to allow access to Cloud Storage from within the perimeter. So ingress rule for on-premises, adding the analytics project to the perimeter, and an egress rule for Cloud Storage are required.

Answer

Configure Cloud Armor to allow the on-premises IP

Answer

Create an ingress rule to allow the service account of the managed instance group

Question 3

A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)

Accepted Answer

Attach the SSL policy to the target HTTPS proxy. To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.

Answer

Enable Cloud Armor WAF rules

Answer

Set the SSL policy to COMPATIBLE profile

Answer

Use a Google-managed SSL certificate

Question 4

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only requests originating from a specific VPC network are allowed. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define a service perimeter around a set of Google Cloud APIs, restricting access to only those identities and networks you specify. This is the correct service for this requirement. Firewall rules control network traffic to VM instances, not API access. Cloud Armor protects against web attacks. Private Service Connect provides private connectivity to Google APIs but does not restrict access.

Answer

Private Service Connect

Answer

VPC firewall rules

Answer

Cloud Armor

Question 5

A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?

Accepted Answer

Hierarchical firewall policies. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network. VPC firewall rules are per project and can be overridden.

Answer

VPC firewall rules

Answer

Network firewall policies

Answer

Cloud Armor security policies

Question 6

An engineer wants to allow egress traffic from a group of VM instances with a specific service account to a set of IP addresses. They need to choose between using tags or service accounts as targets in a VPC firewall rule. Which approach is recommended for better security and why?

Accepted Answer

Use service accounts because they are managed by IAM and provide a stronger identity-based security model.. Service account targets are preferred because they are more secure. Tags can be added or removed by anyone with compute.instances.setTags permission, while service accounts are managed centrally with IAM. Using service accounts ensures that the firewall rule applies based on the identity of the VM, which is harder to spoof.

Answer

Use tags because they are easier to manage and provide the same level of security as service accounts.

Answer

Use target tags with a network tag that is automatically assigned by a management tool.

Answer

Either is acceptable; Google recommends using tags for simplicity.

Question 7

A company uses VPC Service Controls to protect a project containing BigQuery datasets. They have an ingress rule that allows traffic from an on-premises network via a Cloud VPN tunnel. The on-premises IP range is 10.0.0.0/8. However, users on-premises are still getting access denied errors when querying BigQuery. The VPC Service Controls perimeter is in dry-run mode. What is the most likely cause?

Accepted Answer

Cloud VPN is not a supported access method for VPC Service Controls.. In dry-run mode, VPC Service Controls logs violations but does not enforce them, so a missing identity in the ingress rule would not cause access denied errors. The most likely cause is that Cloud VPN is not a supported access method for VPC Service Controls; on-premises traffic via VPN must use a different mechanism such as Private Google Access or Cloud Interconnect. Therefore, even if the ingress rule is correctly configured, the traffic from the VPN tunnel is not recognized by the perimeter, leading to denial.

Answer

The perimeter is in dry-run mode, which blocks all traffic until the rule is finalized.

Answer

The ingress rule does not include the on-premises user identities or service accounts.

Answer

The dry-run mode only applies to egress rules, not ingress.

Question 8

An organization wants to provide private, on-premises access to Google Cloud APIs (e.g., Cloud Storage, BigQuery) without traversing the public internet. They have a Direct Connect link to Google Cloud. Which solution should they implement?

Accepted Answer

Private Service Connect. Private Service Connect allows you to create private endpoints to access Google APIs (like googleapis.com) using internal IP addresses, without going over the internet. It works with Direct Connect or VPN. VPC Service Controls restrict access but do not provide private connectivity. Cloud NAT provides outbound internet access, not private API access. Private Google Access enables on-premises access to Google APIs via on-premises DNS, but it still uses public IPs unless combined with Private Service Connect.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Private Google Access

Question 9

A company uses Cloud Armor security policies to protect their HTTP load balancer. They need to block requests from a specific geographic region (country X) and also limit requests from any IP to 1000 requests per second. They also want to use preconfigured rules for SQL injection prevention. What is the correct way to combine these requirements in a single security policy?

Accepted Answer

Create separate rules: one for geo-blocking with priority 500, one for rate limiting with priority 600, and enable preconfigured SQLi rules at priority 1000. Order them appropriately.. Cloud Armor rules are evaluated in order of priority (lowest number first). Preconfigured rules (like SQLi) have a priority of 1000 by default. Geographic and rate limiting rules can be added with custom priorities. The rule order matters: typically, you want to block/rate-limit before applying WAF rules to reduce processing. However, the question is about combining them correctly: all rule types can coexist in a single policy. The key is that each rule type has its own configuration; you can't set rate limiting in the same rule as geo-blocking; they must be separate rules.

Answer

Create a single custom rule with both geo-blocking and rate limiting conditions using CEL expressions, and enable preconfigured SQLi rules.

Answer

Use Cloud Armor Managed Protection Plus, which automatically includes geo-blocking and rate limiting.

Answer

Enable SQLi preconfigured rules only; geo-blocking and rate limiting are not supported in Cloud Armor.

Question 10

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They want Google to manage the certificate lifecycle. Which certificate type should they use?

Accepted Answer

Google-managed certificate. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google. They are the correct choice for automatic lifecycle management. Self-managed certificates require the user to upload the certificate and renew it manually. Certificate Manager is a service for managing certificates but does not automate renewal unless using Google-managed certificates.

Answer

Self-managed certificate

Answer

Upload a certificate via the Cloud Load Balancing UI

Answer

Certificate Manager with a self-managed certificate

Question 11

An organization uses VPC Service Controls with a service perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises service account to write data to a Cloud Storage bucket inside the perimeter. The on-premises network connects via Cloud VPN. What must be configured in the perimeter?

Accepted Answer

An ingress rule that specifies the on-premises service account and the Cloud VPN network as sources. To allow an on-premises service account to access resources inside a service perimeter, you need an ingress rule that specifies the source (the on-premises identities and network) and the target resources (the Cloud Storage bucket). The source must include both the identity (service account) and the network (VPC or IP range).

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage bucket

Answer

An egress rule that allows the service account to exit the perimeter

Answer

An access level that includes the on-premises IP range

Question 12

A company needs to enforce that all incoming traffic to their HTTPS load balancer must use TLS 1.2 or higher. Which SSL policy setting should they configure on the target HTTPS proxy?

Accepted Answer

Set the minimum TLS version to 1.2 and cipher profile to MODERN. SSL policies allow you to set the minimum TLS version. To require TLS 1.2 or higher, set the minimum TLS version to 1.2. The cipher profile can be set to MODERN or RESTRICTED, but the key is the minimum TLS version.

Answer

Set the minimum TLS version to 1.3 only

Answer

Set the minimum TLS version to 1.0 and cipher profile to RESTRICTED

Answer

Use a self-managed certificate with TLS 1.2 enforcement

Question 13

A company is using Cloud Armor with adaptive protection enabled. They notice that adaptive protection has generated a rule that is blocking some legitimate traffic. What should they do to minimize false positives while still benefiting from adaptive protection?

Accepted Answer

Add a higher-priority allow rule for the legitimate traffic. Adaptive protection works by learning traffic patterns and generating rules. The best practice is to initially set the adaptive protection rule to 'throttle' or 'log' mode (or use a low priority) to monitor its impact. Alternatively, you can override the rule with a higher-priority allow rule for known good traffic. The recommended approach is to use the rule in preview or monitoring mode before enforcing.

Answer

Disable adaptive protection immediately

Answer

Increase the sensitivity threshold of adaptive protection

Answer

Change the adaptive protection rule action to 'throttle'

Question 14

An organization has multiple VPC networks in different projects. They need to centrally manage firewall rules that apply to all VPCs in the organization and ensure that project owners cannot override them. Which solution should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks. They cannot be overridden by lower-level firewall rules. This is the correct solution for centralized, unoverrideable rules. Network firewall policies are scoped to a single VPC network.

Answer

Create a network firewall policy and attach it to each VPC network

Answer

Use Cloud Armor security policies with the load balancers

Answer

Use VPC firewall rules with tags applied to all VMs across projects

Question 15

A company is implementing VPC Service Controls to protect a project that contains Cloud Storage and BigQuery. They want to allow a specific on-premises service account to read data from Cloud Storage and write to BigQuery. The on-premises network connects via Cloud VPN. Which TWO components must be configured in the service perimeter? (Choose two.)

Accepted Answer

An ingress rule that allows the on-premises service account to access Cloud Storage and BigQuery. To allow external access, you need an ingress rule that specifies the source (on-premises service account and the Cloud VPN network) and the allowed services (Cloud Storage and BigQuery). An access level can be used to define the IP range, but the ingress rule is the primary mechanism. Adding the service to the perimeter is already done; you don't need to add it again. An egress rule is not needed for inbound access.

Answer

Add Cloud Storage and BigQuery to the list of restricted services in the perimeter (they already are)

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage and BigQuery APIs

Answer

An egress rule that allows the on-premises service account to leave the perimeter