PCSE Configuring Network Security Practice Test 5 — 15 Questions

Question 1

An organization wants to enforce that all egress traffic from a VPC to the internet must go through a Cloud NAT gateway for logging and IP management. They also need to block all other direct outbound traffic. Which THREE steps should they take? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delete the default route (0.0.0.0/0) from the VPC. To force traffic through Cloud NAT, you need to remove the default route (0.0.0.0/0), create a route that only allows traffic to the NAT gateway's IP range (or use a more specific route), and then add a deny egress rule for all other internet traffic.

Answer

Enable Private Google Access on the subnet

Answer

Add a firewall rule to allow egress to 0.0.0.0/0

Question 2

A company wants to use Cloud IDS to detect threats in their VPC. They have created a Cloud IDS endpoint and need to configure packet mirroring. Which TWO resources must be in place for packet mirroring to work? (Choose TWO.)

Accepted Answer

A Collector VPC network with the IDS endpoint. Packet mirroring requires a Collector VPC (where the IDS endpoint resides) and a mirrored VPC (where source VMs are). The source VMs must be tagged.

Answer

Public IP addresses on the source VMs

Answer

Cloud NAT on the mirrored VPC

Answer

A VPN tunnel between the collector and mirrored VPCs

Question 3

A security engineer wants to restrict access to Cloud Storage buckets such that only workloads running on Compute Engine VMs in a specific VPC can read data. The VMs are managed by multiple GKE clusters and autoscaling instance groups. Which approach BEST enforces this restriction?

Accepted Answer

Create a VPC Service Controls service perimeter with an ingress rule that allows access from the VPC network.. Use VPC Service Controls to create a service perimeter around the Cloud Storage API, with an ingress rule allowing requests from the specific VPC (using VPC network source) and VMs using the appropriate service accounts. VPC Service Controls prevent data exfiltration by restricting access to Google-managed services from outside the perimeter.

Answer

Configure a Cloud Armor security policy to block requests to Cloud Storage from non-VPC IPs.

Answer

Create a firewall rule that denies all egress traffic from the VPC to Cloud Storage IP ranges except through a proxy VM.

Answer

Use IAM conditions on the Cloud Storage bucket to restrict access based on VPC network tags.

Question 4

An organization wants to enforce that all Compute Engine instances in a project have a specific tag (e.g., 'env=prod') before they can be created. Which approach should be used?

Accepted Answer

Use an organization policy with a list constraint to require a specific tag on Compute Engine instances.. Use Organization Policy with a constraint that requires tags on resources. The constraint `compute.requireOsLogin` is not related. Resource Manager tags can be enforced via Organization Policy using the `constraints/tags` constraint.

Answer

Create a Cloud Audit Logs sink and trigger a Cloud Function to delete instances without the tag.

Answer

Use a hierarchical firewall policy with a tag condition.

Answer

Create an organization policy with constraint `compute.requireOsLogin` set to true.

Question 5

An organization wants to allow only specific trusted IP ranges to access a web application behind a Cloud Load Balancer. Which Cloud Armor feature should be used?

Accepted Answer

Custom rules with source IP allow/deny lists. Cloud Armor allows IP allow/deny lists using custom rules. Use a security policy with a rule that allows traffic from specified IP ranges and denies all other traffic.

Answer

Preconfigured rules for OWASP ModSecurity CRS

Answer

Geolocation-based access control

Answer

Adaptive protection

Question 6

A company is deploying an internal service on GKE that needs to be accessible privately from on-premises data centers over a VPN connection. The service should not be exposed to the internet. Which connectivity solution is MOST appropriate?

Accepted Answer

Private Service Connect with an internal load balancer. Private Service Connect (PSC) allows publishing services using internal IP addresses that are accessible via VPC peering or VPN. The service can be exposed as an internal load balancer and attached to a PSC service attachment. On-premises can reach it via the VPN tunnel to the VPC.

Answer

Expose the service via an external load balancer with Cloud Armor IP allowlisting

Answer

Cloud NAT with firewall rules to allow on-premises IPs

Answer

VPC peering between the GKE VPC and on-premises

Question 7

An organization has a security policy that requires TLS 1.2 or higher for all HTTPS traffic to their external HTTP(S) load balancer. They also need to disable weak cipher suites. Which configuration should be applied?

Accepted Answer

Set the SSL policy on the target HTTPS proxy with minimum TLS version 1.2 and a MODERN or RESTRICTED cipher profile.. SSL policies on the target HTTPS proxy allow setting minimum TLS version and cipher profile. Set the minimum TLS version to 1.2 and choose the MODERN or RESTRICTED profile to disable weak ciphers.

Answer

Configure the SSL policy on the load balancer's backend bucket.

Answer

Use Cloud Armor WAF rules to block TLS 1.0/1.1 traffic.

Answer

Set the SSL policy on the target HTTPS proxy with minimum TLS version 1.2 and a compatible profile.

Question 8

An engineer needs to allow a specific service account from another project to access a Cloud Storage bucket in the current project. The engineer wants to use the principle of least privilege. Which IAM role should be granted directly on the bucket to the service account?

Accepted Answer

roles/storage.objectViewer on the bucket. Grant the predefined role `roles/storage.objectViewer` to the service account. This role provides read-only access to objects in the bucket.

Answer

roles/storage.legacyBucketReader on the bucket

Answer

roles/storage.objectAdmin on the bucket

Answer

roles/storage.admin on the project

Question 9

Which GCP service provides managed intrusion detection by analyzing mirrored network traffic and using threat signatures from Palo Alto Networks?

Accepted Answer

Cloud IDS. Cloud IDS is a managed intrusion detection service that uses packet mirroring to inspect traffic and applies Palo Alto Networks threat signatures.

Answer

Security Command Center

Answer

Chronicle

Answer

Cloud Armor

Question 10

A company wants to enforce that no Compute Engine firewall rule in any project under an organization can have a source range of 0.0.0.0/0 for RDP (port 3389). Which approach should be used?

Accepted Answer

Apply a hierarchical firewall policy at the organization level that denies ingress on port 3389 from 0.0.0.0/0.. Use a hierarchical firewall policy at the organization level that denies ingress traffic on port 3389 from any source (0.0.0.0/0). Hierarchical policies are inherited and cannot be overridden by lower-level firewall rules.

Answer

Create a Cloud IDS rule to block RDP traffic.

Answer

Create a VPC firewall rule with priority 0 to deny RDP from 0.0.0.0/0 in each project.

Answer

Use organization policy with constraint `compute.skipDefaultNetworkCreation` set to true.

Question 11

An engineer needs to allow HTTP traffic from instances tagged 'web-server' to instances tagged 'app-server' on port 8080 within the same VPC. Which firewall rule should be created?

Accepted Answer

Ingress rule for 'app-server' with source tag 'web-server' allowing tcp:8080. Create an ingress rule targeting 'app-server' that allows tcp:8080 from source tag 'web-server'. Tags are used for both source and target to control traffic between instance groups.

Answer

Egress rule from 'web-server' to 'app-server' allowing tcp:8080

Answer

Ingress rule for 'web-server' with source tag 'app-server' allowing tcp:8080

Answer

Egress rule for 'app-server' with destination tag 'web-server' allowing tcp:8080

Question 12

A company uses VPC Service Controls to protect a service perimeter around BigQuery. They need to allow a specific on-premises application (with static IP 203.0.113.10) to query BigQuery tables within the perimeter, while still blocking other internet traffic. Which configuration should be used?

Accepted Answer

Create an ingress rule in the service perimeter with an access level that includes the on-premises IP.. Create an ingress rule in the service perimeter that allows access from the on-premises IP (using access level) to BigQuery. Access levels can be IP-based, so create an access level that includes 203.0.113.10, and use that in the ingress rule.

Answer

Use Cloud Armor to allow the IP.

Answer

Add the on-premises IP to the list of allowed IPs in the VPC firewall rules.

Answer

Set up a VPN connection and include the on-premises VPC in the perimeter.

Question 13

Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML to model normal traffic and detect anomalous patterns indicative of DDoS attacks.

Answer

Security policies

Answer

Rate limiting

Answer

Preconfigured WAF rules

Question 14

An organization uses Certificate Manager to provision SSL certificates for multiple domains across several load balancers. They want to automate certificate renewal. Which type of certificate should be used?

Accepted Answer

Google-managed certificates with DNS authorization. Google-managed certificates automatically provision and renew certificates for domains that are DNS-authorized. Certificate Manager can manage these certificates and map them to load balancer targets.

Answer

Wildcard certificates purchased from a third-party CA

Answer

Self-managed certificates uploaded as PEM files

Answer

Certificates from a private CA

Question 15

A company wants to prevent data exfiltration by restricting access to Google APIs from only authorized VPC networks. They also need to allow a specific on-premises IP range to access BigQuery. Which TWO services should be used together? (Choose 2)

Accepted Answer

Access levels (IP-based). VPC Service Controls create a service perimeter around Google APIs, and an access level (IP-based) can be used to allow the on-premises IP range into the perimeter.

Answer

Cloud Armor

Answer

Hierarchical firewall policy

Answer

Private Service Connect