PCSE Configuring Network Security Practice Test 4 — 15 Questions

Question 1

A security engineer wants to restrict access to a Cloud Storage bucket so that only requests originating from within a specific VPC network can access the bucket. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define a service perimeter that restricts access to Google Cloud services (including Cloud Storage) based on the originating VPC network and identity.

Answer

Identity-Aware Proxy (IAP)

Answer

Firewall rules

Answer

Cloud Armor

Question 2

An organization needs to block all inbound SSH traffic (port 22) to a set of VM instances that have a common tag 'ssh-restricted'. They want to deny this traffic at the VPC firewall level. Which firewall rule configuration should they use?

Accepted Answer

Deny rule: direction INGRESS, protocol tcp, port 22, target tag 'ssh-restricted'. To block SSH, a deny rule with direction INGRESS, protocol tcp, port 22, and target tag 'ssh-restricted' is needed.

Answer

Allow rule: direction EGRESS, protocol tcp, port 22, target tag 'ssh-restricted'

Answer

Deny rule: direction INGRESS, protocol tcp, port 22, target service account 'ssh-restricted'

Answer

Allow rule: direction INGRESS, protocol tcp, port 22, source tag 'ssh-restricted'

Question 3

A company wants to use Cloud Armor Managed Protection Plus to protect their HTTP(S) load balancer from DDoS attacks. They need to automatically block traffic from IP addresses that exhibit anomalous behavior based on machine learning. Which Cloud Armor feature should they enable?

Accepted Answer

Adaptive Protection. Adaptive Protection uses ML to detect anomalous traffic and suggests rules to block it. Managed Protection Plus includes adaptive protection.

Answer

Custom rules with CEL

Answer

Pre-configured WAF rules

Answer

Rate limiting

Question 4

An engineer needs to ensure that only VMs with a specific service account (sa-prod@project.iam.gserviceaccount.com) can access a Cloud Spanner instance. They want to control this at the network level, not using IAM. Which VPC firewall rule configuration should they use?

Accepted Answer

Egress rule with target service account 'sa-prod'. Firewall rules can target service accounts for egress rules. Since the VMs initiate connections to Spanner, an egress rule with target service account is appropriate.

Answer

Egress rule with source service account 'sa-prod'

Answer

Ingress rule with target service account 'sa-prod'

Answer

Ingress rule with source tag 'sa-prod'

Question 5

A company uses hierarchical firewall policies at the organization level to enforce a baseline deny-all rule. A project administrator wants to create a firewall rule that allows HTTP traffic to a specific VM. Which statement is correct?

Accepted Answer

The project administrator cannot allow HTTP because the hierarchical policy denies all traffic.. Hierarchical firewall policies are inherited and cannot be overridden by lower-level rules. The deny-all rule from the policy takes precedence over any VPC firewall rule that would allow traffic.

Answer

The project administrator can modify the hierarchical policy to allow HTTP.

Answer

The project administrator can create a VPC firewall rule to allow HTTP, and it will work if the policy is not enforced.

Answer

The project administrator can create a VPC firewall rule with higher priority to override the policy.

Question 6

A financial services company must ensure that all data egress from a VPC to BigQuery goes through a Private Service Connect endpoint for private access. They have set up the PSC endpoint and configured DNS. However, connections from VMs are still using the public internet. What is the most likely cause?

Accepted Answer

Private Google Access is disabled on the subnet.. For private access to Google APIs via PSC, the VPC must have Private Google Access enabled on the subnet. Without it, VMs will use the default public route.

Answer

The VPC has a default route to the internet via NAT.

Answer

The DNS record for bigquery.googleapis.com points to the public IP.

Answer

The PSC endpoint is not associated with a forwarding rule.

Question 7

An organization wants to use Cloud IDS to detect network threats within their VPC. They have enabled the Cloud IDS endpoint and configured packet mirroring. Which of the following is required for the packet mirroring policy to work?

Accepted Answer

VMs must be tagged with 'cloud-ids-packet-mirroring'.. Packet mirroring requires that the source VMs have the cloud-ids-packet-mirroring tag. The mirrored traffic is sent to the IDS endpoint via an internal load balancer.

Answer

The IDS endpoint must be in the same zone as the VMs.

Answer

VPC firewall rules must allow traffic to the IDS endpoint.

Answer

All VMs must have an external IP address.

Question 8

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They do not want to manually manage certificate files. Which approach should they use?

Accepted Answer

Create a Google-managed SSL certificate resource.. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for load balancers. No manual file uploads are needed.

Answer

Upload a self-managed certificate in PEM format.

Answer

Configure SSL policies to enforce TLS version.

Answer

Use Certificate Manager with a DNS-authorized certificate.

Question 9

A security team needs to apply a security policy that blocks requests to their HTTP load balancer from a specific geographic region (e.g., Country A). Which Cloud Armor feature should they use?

Accepted Answer

Custom rules with CEL expressions. Cloud Armor supports geolocation-based blocking using custom rules with geographic origin matching (e.g., origin.region_code).

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Answer

Rate limiting

Question 10

An organization uses VPC Service Controls to protect BigQuery. They want to test a new access level that allows access only from a specific IP range before enforcing it. Which mode should they use?

Accepted Answer

Dry-run mode. Dry-run mode allows testing perimeters without enforcement, logging violations for review.

Answer

Audit mode

Answer

Enforced mode

Answer

Preview mode

Question 11

A company has multiple VPCs in different projects that need to privately connect to a common internal service (e.g., a managed database) running in a central project. They want to expose this service via Private Service Connect. Which type of PSC endpoint should the consumer VPCs create?

Accepted Answer

Consumer endpoint (forwarding rule with PSC backend). Consumers create Private Service Connect endpoints (forwarding rules with PSC backends) to connect to a published service. The producer publishes the service via a service attachment.

Answer

Cloud NAT gateway

Answer

VPN tunnel

Answer

Producer endpoint (service attachment)

Question 12

A DevOps engineer wants to use Cloud Armor to block common web application attacks like SQL injection and cross-site scripting. Which feature should they enable?

Accepted Answer

Preconfigured rules (OWASP CRS). Cloud Armor's preconfigured WAF rules include the OWASP ModSecurity Core Rule Set, which detects SQLi, XSS, and other attacks.

Answer

Rate limiting

Answer

Custom rules with IP allow/deny

Answer

Adaptive Protection

Question 13

A security engineer is configuring a VPC Service Controls perimeter to protect a Cloud Storage bucket. They want to allow a specific on-premises network (IP range 203.0.113.0/24) to access the bucket, while still blocking other external networks. Which TWO components must they configure? (Choose TWO.)

Accepted Answer

Ingress rule that permits the access level. You need an access level (based on IP) to define the allowed IPs, and an ingress rule to allow traffic from that access level into the perimeter.

Answer

Cloud Armor security policy

Answer

Service perimeter in enforced mode

Answer

Egress rule to allow traffic to the on-premises network

Question 14

An organization wants to enforce that all egress traffic from a VPC to the internet must go through a Cloud NAT gateway for logging and IP management. They also need to block all other direct outbound traffic. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Delete the default route (0.0.0.0/0) from the VPC. To force traffic through Cloud NAT, you need to remove the default route (0.0.0.0/0), create a route that only allows traffic to the NAT gateway's IP range (or use a more specific route), and then add a deny egress rule for all other internet traffic.

Answer

Enable Private Google Access on the subnet

Answer

Add a firewall rule to allow egress to 0.0.0.0/0

Question 15

A company wants to use Cloud IDS to detect threats in their VPC. They have created a Cloud IDS endpoint and need to configure packet mirroring. Which TWO resources must be in place for packet mirroring to work? (Choose TWO.)

Accepted Answer

A Collector VPC network with the IDS endpoint. Packet mirroring requires a Collector VPC (where the IDS endpoint resides) and a mirrored VPC (where source VMs are). The source VMs must be tagged.

Answer

Public IP addresses on the source VMs

Answer

Cloud NAT on the mirrored VPC

Answer

A VPN tunnel between the collector and mirrored VPCs