PCSE Configuring Network Security Practice Test 5 — 15 Questions

Question 1

A security engineer wants to restrict access to Cloud Storage buckets such that only workloads running on Compute Engine VMs in a specific VPC can read data. The VMs are managed by multiple GKE clusters and autoscaling instance groups. Which approach BEST enforces this restriction?

Accepted Answer

Create a VPC Service Controls service perimeter with an ingress rule that allows access from the VPC network.. Use VPC Service Controls to create a service perimeter around the Cloud Storage API, with an ingress rule allowing requests from the specific VPC (using VPC network source) and VMs using the appropriate service accounts. VPC Service Controls prevent data exfiltration by restricting access to Google-managed services from outside the perimeter.

Answer

Configure a Cloud Armor security policy to block requests to Cloud Storage from non-VPC IPs.

Answer

Create a firewall rule that denies all egress traffic from the VPC to Cloud Storage IP ranges except through a proxy VM.

Answer

Use IAM conditions on the Cloud Storage bucket to restrict access based on VPC network tags.

Question 2

An organization wants to enforce that all Compute Engine instances in a project have a specific tag (e.g., 'env=prod') before they can be created. Which approach should be used?

Accepted Answer

Use an organization policy with a list constraint to require a specific tag on Compute Engine instances.. Use Organization Policy with a constraint that requires tags on resources. The constraint `compute.requireOsLogin` is not related. Resource Manager tags can be enforced via Organization Policy using the `constraints/tags` constraint.

Answer

Create a Cloud Audit Logs sink and trigger a Cloud Function to delete instances without the tag.

Answer

Use a hierarchical firewall policy with a tag condition.

Answer

Create an organization policy with constraint `compute.requireOsLogin` set to true.

Question 3

An organization wants to allow only specific trusted IP ranges to access a web application behind a Cloud Load Balancer. Which Cloud Armor feature should be used?

Accepted Answer

Custom rules with source IP allow/deny lists. Cloud Armor allows IP allow/deny lists using custom rules. Use a security policy with a rule that allows traffic from specified IP ranges and denies all other traffic.

Answer

Preconfigured rules for OWASP ModSecurity CRS

Answer

Geolocation-based access control

Answer

Adaptive protection

Question 4

A company is deploying an internal service on GKE that needs to be accessible privately from on-premises data centers over a VPN connection. The service should not be exposed to the internet. Which connectivity solution is MOST appropriate?

Accepted Answer

Private Service Connect with an internal load balancer. Private Service Connect (PSC) allows publishing services using internal IP addresses that are accessible via VPC peering or VPN. The service can be exposed as an internal load balancer and attached to a PSC service attachment. On-premises can reach it via the VPN tunnel to the VPC.

Answer

Expose the service via an external load balancer with Cloud Armor IP allowlisting

Answer

Cloud NAT with firewall rules to allow on-premises IPs

Answer

VPC peering between the GKE VPC and on-premises

Question 5

An organization has a security policy that requires TLS 1.2 or higher for all HTTPS traffic to their external HTTP(S) load balancer. They also need to disable weak cipher suites. Which configuration should be applied?

Accepted Answer

Set the SSL policy on the target HTTPS proxy with minimum TLS version 1.2 and a MODERN or RESTRICTED cipher profile.. SSL policies on the target HTTPS proxy allow setting minimum TLS version and cipher profile. Set the minimum TLS version to 1.2 and choose the MODERN or RESTRICTED profile to disable weak ciphers.

Answer

Configure the SSL policy on the load balancer's backend bucket.

Answer

Use Cloud Armor WAF rules to block TLS 1.0/1.1 traffic.

Answer

Set the SSL policy on the target HTTPS proxy with minimum TLS version 1.2 and a compatible profile.

Question 6

An engineer needs to allow a specific service account from another project to access a Cloud Storage bucket in the current project. The engineer wants to use the principle of least privilege. Which IAM role should be granted directly on the bucket to the service account?

Accepted Answer

roles/storage.objectViewer on the bucket. Grant the predefined role `roles/storage.objectViewer` to the service account. This role provides read-only access to objects in the bucket.

Answer

roles/storage.legacyBucketReader on the bucket

Answer

roles/storage.objectAdmin on the bucket

Answer

roles/storage.admin on the project

Question 7

Which GCP service provides managed intrusion detection by analyzing mirrored network traffic and using threat signatures from Palo Alto Networks?

Accepted Answer

Cloud IDS. Cloud IDS is a managed intrusion detection service that uses packet mirroring to inspect traffic and applies Palo Alto Networks threat signatures.

Answer

Security Command Center

Answer

Chronicle

Answer

Cloud Armor

Question 8

A company wants to enforce that no Compute Engine firewall rule in any project under an organization can have a source range of 0.0.0.0/0 for RDP (port 3389). Which approach should be used?

Accepted Answer

Apply a hierarchical firewall policy at the organization level that denies ingress on port 3389 from 0.0.0.0/0.. Use a hierarchical firewall policy at the organization level that denies ingress traffic on port 3389 from any source (0.0.0.0/0). Hierarchical policies are inherited and cannot be overridden by lower-level firewall rules.

Answer

Create a Cloud IDS rule to block RDP traffic.

Answer

Create a VPC firewall rule with priority 0 to deny RDP from 0.0.0.0/0 in each project.

Answer

Use organization policy with constraint `compute.skipDefaultNetworkCreation` set to true.

Question 9

An engineer needs to allow HTTP traffic from instances tagged 'web-server' to instances tagged 'app-server' on port 8080 within the same VPC. Which firewall rule should be created?

Accepted Answer

Ingress rule for 'app-server' with source tag 'web-server' allowing tcp:8080. Create an ingress rule targeting 'app-server' that allows tcp:8080 from source tag 'web-server'. Tags are used for both source and target to control traffic between instance groups.

Answer

Egress rule from 'web-server' to 'app-server' allowing tcp:8080

Answer

Ingress rule for 'web-server' with source tag 'app-server' allowing tcp:8080

Answer

Egress rule for 'app-server' with destination tag 'web-server' allowing tcp:8080

Question 10

A company uses VPC Service Controls to protect a service perimeter around BigQuery. They need to allow a specific on-premises application (with static IP 203.0.113.10) to query BigQuery tables within the perimeter, while still blocking other internet traffic. Which configuration should be used?

Accepted Answer

Create an ingress rule in the service perimeter with an access level that includes the on-premises IP.. Create an ingress rule in the service perimeter that allows access from the on-premises IP (using access level) to BigQuery. Access levels can be IP-based, so create an access level that includes 203.0.113.10, and use that in the ingress rule.

Answer

Use Cloud Armor to allow the IP.

Answer

Add the on-premises IP to the list of allowed IPs in the VPC firewall rules.

Answer

Set up a VPN connection and include the on-premises VPC in the perimeter.

Question 11

Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML to model normal traffic and detect anomalous patterns indicative of DDoS attacks.

Answer

Security policies

Answer

Rate limiting

Answer

Preconfigured WAF rules

Question 12

An organization uses Certificate Manager to provision SSL certificates for multiple domains across several load balancers. They want to automate certificate renewal. Which type of certificate should be used?

Accepted Answer

Google-managed certificates with DNS authorization. Google-managed certificates automatically provision and renew certificates for domains that are DNS-authorized. Certificate Manager can manage these certificates and map them to load balancer targets.

Answer

Wildcard certificates purchased from a third-party CA

Answer

Self-managed certificates uploaded as PEM files

Answer

Certificates from a private CA

Question 13

A company wants to prevent data exfiltration by restricting access to Google APIs from only authorized VPC networks. They also need to allow a specific on-premises IP range to access BigQuery. Which TWO services should be used together? (Choose 2)

Accepted Answer

Access levels (IP-based). VPC Service Controls create a service perimeter around Google APIs, and an access level (IP-based) can be used to allow the on-premises IP range into the perimeter.

Answer

Cloud Armor

Answer

Hierarchical firewall policy

Answer

Private Service Connect

Question 14

A security team needs to inspect all egress traffic from Compute Engine instances for malware using a third-party security appliance. They want to deploy the appliance in a separate VPC and route all egress traffic through it. Which THREE components are required? (Choose 3)

Accepted Answer

VPC peering between the application VPC and the appliance VPC. Use a custom route to direct default egress traffic to the appliance, which is an internal load balancer (ILB) forwarding to the appliance instances. The appliance must be deployed in a different VPC, and VPC peering or Network Connectivity Center connects the VPCs. However, the simplest is to use an ILB in the same VPC as the instances, but the requirement says separate VPC. So use VPC peering. The three required: custom route for default route (0.0.0.0/0) with next hop to ILB, an internal load balancer forwarding traffic to the appliance, and VPC peering (or VPN) to connect the VPCs. Alternatively, if using the same VPC, peering not needed. But given separate VPC, peering is needed.

Answer

Cloud VPN tunnel between VPCs

Answer

Cloud NAT gateway

Question 15

An organization wants to enforce that all Compute Engine instances have Confidential Computing enabled for sensitive workloads. Which TWO steps should be taken? (Choose 2)

Accepted Answer

Select machine series that support AMD Secure Encrypted Virtualization (SEV).. To enforce Confidential Computing, use an organization policy constraint to require the feature. Additionally, instance templates can be configured with Confidential Computing, but the enforcement is via policy. Also, ensuring the VM images support SEV is important. However, the key steps: 1) Set organization policy to require `compute.requireConfidentialComputing` (or similar) and 2) Use machine series that support Confidential Computing (e.g., N2D). But the question asks for two steps. The options: creating a constraint and using appropriate machine types.

Answer

Enable VPC Flow Logs for all subnets.

Answer

Use Cloud IDS to detect non-confidential instances.

Answer

Use a hierarchical firewall policy to block non-confidential instances.