PCSE Configuring Network Security Practice Test 4 — 15 Questions

Question 1

A company has a VPC with several subnets. They want to allow SSH access to all instances in a specific subnet from a corporate IP range, but only during business hours. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a firewall rule with a source IP range and target tags, and use a schedule to allow traffic only during business hours.. VPC firewall rules can include a schedule that defines when the rule is active. By combining a source IP range, target tags, and a business-hours schedule, the company can allow SSH only during desired times. Other options either do not support time-based restrictions or are intended for different purposes, making the scheduled firewall rule the most efficient and native solution.

Answer

Use Identity-Aware Proxy (IAP) to tunnel SSH connections and rely on IAP access levels to enforce time-based access.

Answer

Configure a Cloud NAT rule to allow SSH traffic only from the corporate IP range during business hours.

Answer

Set up a VPN tunnel between the corporate network and the VPC, and use VPN firewall rules to restrict SSH access.

Question 2

A security engineer is deploying a three-tier application in a single Google Cloud VPC. The web tier runs in an unmanaged instance group, the app tier in a managed instance group, and the database tier on Compute Engine. The engineer must ensure that only the app tier can initiate connections to the database tier on TCP port 5432, while the web tier can reach the app tier on TCP port 8080. The database tier must not initiate outbound connections to any internal subnet. Which configuration should the engineer use?

Accepted Answer

Create two ingress firewall rules with target tags or service accounts, and rely on the implied egress allow for return traffic.. The correct configuration uses ingress firewall rules with service accounts or target tags to restrict traffic between tiers. Because Google Cloud VPC firewall rules are stateful, return traffic is automatically allowed, so no explicit egress rule is needed. The database tier will not initiate outbound connections because there is no egress rule permitting it, and the implied egress allow is overridden by the lack of a matching egress rule for new connections. This meets all requirements.

Answer

Create a hierarchical firewall policy at the organization level with rules that allow TCP 5432 and 8080 between all instances, and attach it to the VPC.

Answer

Create a single ingress firewall rule allowing TCP 5432 and 8080 from the entire VPC subnet range, and use IAM to restrict access.

Answer

Create two ingress firewall rules and one egress firewall rule with a deny-all action on the database tier.

Question 3

A security engineer needs to ensure that all egress traffic from a subnet in a Shared VPC is inspected by a third-party appliance before reaching the internet. The service project's VMs must not be able to bypass the inspection. What should the engineer configure?

Accepted Answer

Use a next-hop ILB with a custom route for 0.0.0.0/0, and set the appliance as the next hop. Then create a firewall rule to allow traffic from the appliance.. Forced egress inspection requires overriding the default route. A custom route for 0.0.0.0/0 with the next hop as the appliance ensures all outbound traffic is directed to it. The appliance must then be able to forward traffic, which requires a firewall rule allowing traffic from the appliance. This combination prevents bypass and ensures inspection.

Answer

Create a VPC firewall rule that denies all egress traffic except to the appliance's IP address.

Answer

Configure a custom route in the Shared VPC host project that sends 0.0.0.0/0 to the appliance's next hop, and apply a firewall rule to allow traffic from the appliance.

Answer

Deploy the appliance as an internal TCP/UDP load balancer and set the default route next hop to the load balancer's forwarding rule.

Question 4

A security engineer is configuring a shared VPC in Google Cloud. The host project contains the VPC network, and service projects contain the resources. The engineer needs to ensure that a firewall rule created in the host project applies to all service projects, but also needs to allow service project administrators to create their own firewall rules that only affect their own projects. What should they configure?

Accepted Answer

Create the firewall rule in the host project and grant service project administrators the compute.securityAdmin role on their respective service projects.. In a shared VPC, firewall rules are created in the host project and apply to all service projects. To allow service project administrators to create firewall rules that only affect their own projects, they need the compute.securityAdmin role on their service project. This role permits them to manage firewall rules that apply to their project's resources without affecting other service projects. Granting roles on the host project would be overly permissive.

Answer

Create the firewall rule in the host project and grant service project administrators the compute.securityAdmin role on the host project.

Answer

Create the firewall rule in each service project and grant service project administrators the compute.securityAdmin role on their own projects.

Answer

Create the firewall rule in the host project and grant service project administrators the compute.networkAdmin role on the host project.

Question 5

A security engineer is configuring a VPC Service Controls perimeter for a project containing a Cloud Storage bucket. The perimeter has an access level that allows users from the corporate network (IP 192.0.2.0/24). However, users are reporting that they cannot access the bucket from the corporate network when using the Cloud Storage API. The engineer verifies that the VPN tunnel is up and the users' IPs are within the allowed range. What is the most likely cause?

Accepted Answer

The Cloud Storage API requests from the corporate network are being sent through the VPN, but the source IP seen by VPC Service Controls is the VPN gateway's external IP, not the user's IP.. VPC Service Controls evaluates the source IP of API requests as seen by Google Cloud. When traffic traverses a Cloud VPN tunnel, the source IP is the VPN gateway's IP, not the original user's IP. Thus, an access level based on the corporate IP range will not match. To fix this, the access level should include the VPN gateway's external IP or use a different method such as identity-based access levels.

Answer

The access level is not applied to the perimeter.

Answer

The access level requires device compliance, which the users' devices do not meet.

Answer

The perimeter is in dry-run mode.

Question 6

A security engineer has deployed a web application on a Compute Engine instance group behind an external HTTP(S) load balancer. The application must be reachable from the internet, but the engineer wants to ensure that only traffic from the load balancer's backend service can reach the instances. The engineer has created a firewall rule that allows ingress from the load balancer's health check ranges (130.211.0.0/22 and 35.191.0.0/16) on port 80, but the instances are still directly reachable from the internet. What should the engineer do to restrict access to only the load balancer?

Accepted Answer

Create a firewall rule that allows ingress from the load balancer's IP ranges on port 80 and set the target to the instance group, then remove any firewall rules that allow ingress from 0.0.0.0/0.. The instances are directly reachable because a firewall rule allowing ingress from 0.0.0.0/0 likely exists. To restrict access to only the load balancer, the engineer must ensure that the only ingress rule targeting the instances allows traffic from the load balancer's health check and proxy ranges, and remove or override any rule that permits broader access. This maintains external availability through the load balancer while blocking direct internet access.

Answer

Use an internal load balancer instead of an external load balancer, and configure the instances to only accept traffic from the internal load balancer's IP range.

Answer

Configure the instances to have no external IP addresses and place them behind a Cloud NAT gateway, then create a firewall rule that allows ingress from the load balancer's IP ranges.

Answer

Create a firewall rule that denies all ingress traffic on port 80, and then create a higher priority rule that allows ingress from the load balancer's IP ranges.

Question 7

A company runs a three-tier web application on Compute Engine. The web tier is in subnet web-subnet (10.0.1.0/24) and the database tier is in db-subnet (10.0.2.0/24). A security engineer must ensure that the database VMs accept TCP 3306 connections only from the web tier, and that no other VM in the VPC, including future subnets, can reach the database on that port. What should the engineer do?

Accepted Answer

Create an ingress firewall rule with action allow, target tags db-tag, source ranges 10.0.1.0/24, and protocol/port tcp:3306. Apply tag db-tag to database VMs.. An ingress rule with a narrow source CIDR and a target tag enforces least privilege at the network layer. Scoping the source to the web subnet means only web-tier addresses can open TCP 3306, while the target tag limits which instances the rule applies to. Broader ranges, reversed service-account direction, or egress rules do not meet the stated requirement.

Answer

Create an ingress firewall rule with action allow, target service accounts web-sa, source service accounts db-sa, and protocol/port tcp:3306. Assign db-sa to database VMs.

Answer

Create an ingress firewall rule with action allow, target tags db-tag, source ranges 10.0.0.0/16, and protocol/port tcp:3306. Apply tag db-tag to database VMs.

Answer

Create an egress firewall rule with action deny, target tags db-tag, destination ranges 0.0.0.0/0, and protocol/port tcp:3306. Apply tag db-tag to database VMs.

Question 8

A security engineer needs to restrict which Google Cloud APIs can be reached from a subnet, and also block traffic to specific external IP addresses, all from a single centralized policy that is evaluated before firewall rules. What should they configure?

Accepted Answer

Hierarchical firewall policy with egress rules that use the Google APIs service and destination IP ranges. Hierarchical firewall policies are the centralized, pre-evaluated mechanism that can allow traffic to Google APIs by service and deny other destinations. They are attached at organization or folder level and take precedence over VPC firewall rules, which makes them suitable for enforcing a consistent egress policy across projects. Other options either lack API service matching or do not control external IP destinations.

Answer

VPC firewall rules with a deny-all egress rule and a higher-priority allow rule for the Google APIs

Answer

Cloud NGFW Essentials policy with rules that match the Google API service and external IP ranges

Answer

VPC Service Controls perimeter with an access level that lists the allowed APIs and external IPs

Question 9

A company uses Cloud VPN with dynamic routing (BGP) to connect its on-premises network to a VPC. The security team wants to ensure that only specific on-premises subnets (192.168.10.0/24 and 192.168.20.0/24) can reach resources in the VPC, and that no other routes from on-premises are accepted. They also want to prevent the VPC from advertising its subnets to on-premises. Which two actions should they take? (Choose two.)

Accepted Answer

Configure a custom route export policy on the Cloud Router to deny all VPC subnets from being advertised to on-premises.. To control which routes are accepted from on-premises, you configure a route import policy on the Cloud Router that allows only the desired prefixes. To prevent the VPC from advertising its subnets to on-premises, you configure a route export policy that denies all VPC subnets. These two policies together enforce the required routing restrictions without affecting BGP session establishment.

Answer

Set the advertised route priority on the Cloud Router to a higher value to prevent advertisement of VPC subnets.

Answer

Enable 'Global Dynamic Routing' on the Cloud Router so that routes are learned from all regions.

Answer

Configure a custom route export policy on the Cloud Router to advertise only specific VPC subnets to on-premises.

Question 10

A security engineer needs to ensure that all traffic between two projects in the same organization is encrypted and authenticated, and that only specific instances can communicate. They want to avoid managing individual firewall rules for each instance. What should they use?

Accepted Answer

Anthos Service Mesh with mutual TLS. Anthos Service Mesh with mutual TLS provides strong identity-based authentication and encryption for service-to-service communication. It abstracts away individual firewall rules by using service identities and policies. Other options either lack encryption/authentication or require manual firewall management. Therefore, Anthos Service Mesh is the correct solution for secure, selective communication between projects.

Answer

Cloud VPN with HA VPN

Answer

VPC Network Peering with firewall rules

Answer

Shared VPC with IAM policies

Question 11

A security engineer is configuring a Shared VPC in Google Cloud. The host project contains a subnet in us-central1 with secondary ranges for pods and services. A service project runs a GKE cluster that uses this subnet. The engineer must ensure that pods in the service project can communicate with each other and with the control plane, but pods must not be able to reach the internet directly. Which configuration should the engineer implement?

Accepted Answer

Create a firewall rule in the host project that allows ingress from the pod secondary range to the pod secondary range, and do not configure any Cloud NAT or external IPs for the pods.. In a Shared VPC, firewall rules are managed in the host project and apply to the shared subnet. Allowing ingress from the pod secondary range to itself enables pod-to-pod traffic. To prevent internet access, no Cloud NAT should be configured, and pods should not have external IPs. This ensures that pods can communicate internally but cannot initiate connections to the internet, satisfying the requirement.

Answer

Create a firewall rule in the host project that allows ingress from the pod secondary range to the pod secondary range, and configure a Cloud NAT in the host project with a deny-all egress rule for the pod range.

Answer

Create a firewall rule in the host project that allows ingress from the pod secondary range to the pod secondary range, and create a Cloud NAT in the service project for egress.

Answer

Create a firewall rule in the service project that allows ingress from the pod secondary range to the pod secondary range, and assign external IPs to the nodes.

Question 12

A security engineer is configuring firewall rules for a VPC that has both frontend and backend subnets. The frontend subnet hosts web servers, and the backend subnet hosts database servers. The engineer wants to allow only the web servers to connect to the databases on TCP port 3306, and wants the rule to apply regardless of the source IP addresses assigned to the web servers. Which approach should the engineer use?

Accepted Answer

Create an ingress firewall rule with a source service account and a target service account.. The requirement is to allow only web servers to connect to databases regardless of source IP addresses. Using service accounts for both source and target provides identity-based control that is independent of IP addresses. This is the recommended practice for dynamic environments where IP addresses may change. The other options either rely on IP ranges or mix tags and service accounts, which do not fully meet the requirement.

Answer

Create an ingress firewall rule with a source IP range and a target tag.

Answer

Create an ingress firewall rule with a source service account and a target network tag.

Answer

Create an ingress firewall rule with a source IP range and a target service account.

Question 13

A company runs a three-tier web application on Compute Engine. The security team wants to ensure that only the backend VMs in a specific instance group can accept connections on TCP port 8080 from the frontend VMs in another instance group, and that no other VM in the VPC can reach that port. They also need to log all denied connection attempts for auditing. What should they do?

Accepted Answer

Create a VPC firewall rule with direction INGRESS, action ALLOW, target service account of the backend VMs, source service account of the frontend VMs, protocol tcp:8080, and enable firewall rule logging. Also create a lower-priority rule with action DENY for tcp:8080 from 0.0.0.0/0, and enable logging on the deny rule.. The requirement is to allow only frontend VMs to reach backend VMs on TCP 8080 and to log denied attempts. Using service accounts as source and target in an ingress allow rule provides identity-based least privilege. A lower-priority deny rule with logging captures all other attempts, because the implied deny-all rule does not log. Tags and subnet CIDRs are less precise and do not satisfy the logging requirement.

Answer

Create a VPC firewall rule with direction INGRESS, action ALLOW, target tag 'backend', source IP range of the frontend subnet, protocol tcp:8080, and enable firewall rule logging. Then create a firewall rule with action DENY for tcp:8080 from 0.0.0.0/0 and enable logging.

Answer

Create a VPC firewall rule with direction INGRESS, action ALLOW, target tag 'backend', source tag 'frontend', protocol tcp:8080, and enable firewall rule logging. Rely on the implied deny-all ingress rule to block other traffic and enable logging on the implied rule.

Answer

Create a VPC firewall rule with direction EGRESS, action ALLOW, target service account of the frontend VMs, destination service account of the backend VMs, protocol tcp:8080, and enable firewall rule logging. This allows the frontend to initiate connections and logs all attempts.

Question 14

A security engineer wants to restrict access to a Compute Engine VM so that only SSH from a specific CIDR range 203.0.113.0/24 is allowed, and all other ingress traffic is denied. What should the engineer do?

Accepted Answer

Create an ingress firewall rule allowing tcp:22 from 203.0.113.0/24, and create a lower-priority ingress firewall rule denying all traffic.. Firewall rules in Google Cloud are evaluated by priority, with lower numbers taking precedence. To allow SSH from a specific CIDR and deny all else, create an allow rule for tcp:22 from 203.0.113.0/24 with a lower priority number, and a deny rule for all ingress with a higher priority number. This ensures only the desired traffic is permitted.

Answer

Configure the VM's network interface to have no external IP, and use Identity-Aware Proxy (IAP) for TCP forwarding.

Answer

Use an organization policy to restrict SSH access to the VM's external IP address.

Answer

Create an ingress firewall rule denying all traffic, and create a higher-priority ingress firewall rule allowing tcp:22 from 203.0.113.0/24.

Question 15

A security engineer must allow a partner organization's on-premises application to connect to a service in a Google Cloud VPC over a dedicated, private connection. The partner uses a different Autonomous System Number and manages its own edge router. The engineer wants BGP route exchange with the partner and the ability to control which Google Cloud routes are advertised. Which connectivity option should the engineer choose?

Accepted Answer

Dedicated Interconnect with a VLAN attachment configured for the partner's Cloud Router, using BGP and custom route advertisements.. A dedicated private circuit into Google's network with a VLAN attachment and Cloud Router is the correct design for an external partner that owns its edge router and ASN. BGP sessions exchange routes, and custom route advertisements let the engineer decide which VPC subnets are visible to the partner, giving explicit control over advertised reachability.

Answer

A VPC peering connection between the Google Cloud VPC and the partner's VPC, with BGP route exchange over the peering link.

Answer

A HA VPN gateway with two interfaces and BGP sessions to the partner's router, using custom route advertisements.

Answer

Partner Interconnect with a VLAN attachment configured for the partner's Cloud Router, using BGP and custom route advertisements.