PCSE Configuring Network Security Practice Test 4 — 15 Questions

Question 1

A security team is configuring Cloud Armor to protect a web application. They need to block requests that contain SQL injection patterns, block requests from a known malicious IP list, and limit requests from any single IP to 2000 requests per minute. Which THREE actions must they take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom rule with a deny action for the malicious IP list using a CEL expression. To implement these requirements, you need to enable the preconfigured SQL injection rule set, create a custom rule with an IP allow/deny list for the malicious IPs, and create a rate limiting rule. Cloud Armor does not have a built-in list of malicious IPs; you must provide the list. The rate limiting is configured as a separate rule with action 'rateBasedThrottle'.

Answer

Create a single rule that combines SQLi detection, IP blocking, and rate limiting using CEL

Answer

Enable Cloud Armor Managed Protection Plus for automatic IP reputation

Question 2

A company is deploying a new internal application on Google Cloud. They want to ensure that VM instances in a specific subnet can only communicate with each other and with a load balancer that fronts the application. They also want to allow SSH access from a bastion host. Which TWO firewall rules should they create? (Choose two.)

Accepted Answer

An ingress rule that allows all traffic from the subnet to the instances (target tags or service account). To restrict communication to only internal subnet traffic and the load balancer, you need an ingress rule that allows traffic from the subnet (source) to all instances (target). To allow SSH from the bastion, you need an ingress rule allowing TCP port 22 from the bastion host (using its service account or tags). Egress rules are not needed because the default allow egress is not restrictive; but if you want to block other egress, you would need a deny egress rule, but the question asks for rules to allow, not block.

Answer

An egress rule that blocks all traffic except to the load balancer and subnet

Answer

An egress rule that allows all traffic to the load balancer's frontend IP

Answer

An ingress rule that allows HTTP traffic from the load balancer to the instances

Question 3

A security engineer wants to restrict access to a Cloud Storage bucket so that only requests originating from within a specific VPC network can access the bucket. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define a service perimeter that restricts access to Google Cloud services (including Cloud Storage) based on the originating VPC network and identity.

Answer

Identity-Aware Proxy (IAP)

Answer

Firewall rules

Answer

Cloud Armor

Question 4

An organization needs to block all inbound SSH traffic (port 22) to a set of VM instances that have a common tag 'ssh-restricted'. They want to deny this traffic at the VPC firewall level. Which firewall rule configuration should they use?

Accepted Answer

Deny rule: direction INGRESS, protocol tcp, port 22, target tag 'ssh-restricted'. To block SSH, a deny rule with direction INGRESS, protocol tcp, port 22, and target tag 'ssh-restricted' is needed.

Answer

Allow rule: direction EGRESS, protocol tcp, port 22, target tag 'ssh-restricted'

Answer

Deny rule: direction INGRESS, protocol tcp, port 22, target service account 'ssh-restricted'

Answer

Allow rule: direction INGRESS, protocol tcp, port 22, source tag 'ssh-restricted'

Question 5

A company wants to use Cloud Armor Managed Protection Plus to protect their HTTP(S) load balancer from DDoS attacks. They need to automatically block traffic from IP addresses that exhibit anomalous behavior based on machine learning. Which Cloud Armor feature should they enable?

Accepted Answer

Adaptive Protection. Adaptive Protection uses ML to detect anomalous traffic and suggests rules to block it. Managed Protection Plus includes adaptive protection.

Answer

Custom rules with CEL

Answer

Pre-configured WAF rules

Answer

Rate limiting

Question 6

An engineer needs to ensure that only VMs with a specific service account (sa-prod@project.iam.gserviceaccount.com) can access a Cloud Spanner instance. They want to control this at the network level, not using IAM. Which VPC firewall rule configuration should they use?

Accepted Answer

Egress rule with target service account 'sa-prod'. Firewall rules can target service accounts for egress rules. Since the VMs initiate connections to Spanner, an egress rule with target service account is appropriate.

Answer

Egress rule with source service account 'sa-prod'

Answer

Ingress rule with target service account 'sa-prod'

Answer

Ingress rule with source tag 'sa-prod'

Question 7

A company uses hierarchical firewall policies at the organization level to enforce a baseline deny-all rule. A project administrator wants to create a firewall rule that allows HTTP traffic to a specific VM. Which statement is correct?

Accepted Answer

The project administrator cannot allow HTTP because the hierarchical policy denies all traffic.. Hierarchical firewall policies are inherited and cannot be overridden by lower-level rules. The deny-all rule from the policy takes precedence over any VPC firewall rule that would allow traffic.

Answer

The project administrator can modify the hierarchical policy to allow HTTP.

Answer

The project administrator can create a VPC firewall rule to allow HTTP, and it will work if the policy is not enforced.

Answer

The project administrator can create a VPC firewall rule with higher priority to override the policy.

Question 8

A financial services company must ensure that all data egress from a VPC to BigQuery goes through a Private Service Connect endpoint for private access. They have set up the PSC endpoint and configured DNS. However, connections from VMs are still using the public internet. What is the most likely cause?

Accepted Answer

Private Google Access is disabled on the subnet.. For private access to Google APIs via PSC, the VPC must have Private Google Access enabled on the subnet. Without it, VMs will use the default public route.

Answer

The VPC has a default route to the internet via NAT.

Answer

The DNS record for bigquery.googleapis.com points to the public IP.

Answer

The PSC endpoint is not associated with a forwarding rule.

Question 9

An organization wants to use Cloud IDS to detect network threats within their VPC. They have enabled the Cloud IDS endpoint and configured packet mirroring. Which of the following is required for the packet mirroring policy to work?

Accepted Answer

VMs must be tagged with 'cloud-ids-packet-mirroring'.. Packet mirroring requires that the source VMs have the cloud-ids-packet-mirroring tag. The mirrored traffic is sent to the IDS endpoint via an internal load balancer.

Answer

The IDS endpoint must be in the same zone as the VMs.

Answer

VPC firewall rules must allow traffic to the IDS endpoint.

Answer

All VMs must have an external IP address.

Question 10

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They do not want to manually manage certificate files. Which approach should they use?

Accepted Answer

Create a Google-managed SSL certificate resource.. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for load balancers. No manual file uploads are needed.

Answer

Upload a self-managed certificate in PEM format.

Answer

Configure SSL policies to enforce TLS version.

Answer

Use Certificate Manager with a DNS-authorized certificate.

Question 11

A security team needs to apply a security policy that blocks requests to their HTTP load balancer from a specific geographic region (e.g., Country A). Which Cloud Armor feature should they use?

Accepted Answer

Custom rules with CEL expressions. Cloud Armor supports geolocation-based blocking using custom rules with geographic origin matching (e.g., origin.region_code).

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Answer

Rate limiting

Question 12

An organization uses VPC Service Controls to protect BigQuery. They want to test a new access level that allows access only from a specific IP range before enforcing it. Which mode should they use?

Accepted Answer

Dry-run mode. Dry-run mode allows testing perimeters without enforcement, logging violations for review.

Answer

Audit mode

Answer

Enforced mode

Answer

Preview mode

Question 13

A company has multiple VPCs in different projects that need to privately connect to a common internal service (e.g., a managed database) running in a central project. They want to expose this service via Private Service Connect. Which type of PSC endpoint should the consumer VPCs create?

Accepted Answer

Consumer endpoint (forwarding rule with PSC backend). Consumers create Private Service Connect endpoints (forwarding rules with PSC backends) to connect to a published service. The producer publishes the service via a service attachment.

Answer

Cloud NAT gateway

Answer

VPN tunnel

Answer

Producer endpoint (service attachment)

Question 14

A DevOps engineer wants to use Cloud Armor to block common web application attacks like SQL injection and cross-site scripting. Which feature should they enable?

Accepted Answer

Preconfigured rules (OWASP CRS). Cloud Armor's preconfigured WAF rules include the OWASP ModSecurity Core Rule Set, which detects SQLi, XSS, and other attacks.

Answer

Rate limiting

Answer

Custom rules with IP allow/deny

Answer

Adaptive Protection

Question 15

A security engineer is configuring a VPC Service Controls perimeter to protect a Cloud Storage bucket. They want to allow a specific on-premises network (IP range 203.0.113.0/24) to access the bucket, while still blocking other external networks. Which TWO components must they configure? (Choose TWO.)

Accepted Answer

Ingress rule that permits the access level. You need an access level (based on IP) to define the allowed IPs, and an ingress rule to allow traffic from that access level into the perimeter.

Answer

Cloud Armor security policy

Answer

Service perimeter in enforced mode

Answer

Egress rule to allow traffic to the on-premises network