PCSE Configuring Network Security Practice Test 5 — 15 Questions

Question 1

A security engineer is configuring Cloud Armor security policies for an external HTTP(S) load balancer. They need to block traffic from a specific set of IP addresses and also mitigate a recent spike in HTTP flood attacks. Which two actions should the engineer take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud Armor security policy with a rule that has a deny action and a source IP range matching the specific IP addresses.. To block specific IP addresses, a Cloud Armor security policy rule with a deny action and source IP range match is needed. To mitigate HTTP flood attacks, Adaptive Protection should be enabled on the backend service. Together, these actions address both requirements. VPC firewall rules, rate-based bans, and Cloud CDN do not fulfill the specific needs in this scenario.

Answer

Set up Cloud CDN to cache content and absorb the HTTP flood traffic.

Answer

Configure a VPC firewall rule to deny traffic from the specific IP addresses to the load balancer's IP address.

Answer

Create a Cloud Armor security policy with a rule that has a rate-based ban action for the specific IP addresses.

Question 2

A company wants to give its on-premises data center private connectivity to workloads in a Google Cloud VPC without using the public internet. The security team requires that the connection support redundant BGP sessions and that traffic be encrypted in transit by the solution itself. Which two components should be used? (Choose two.)

Accepted Answer

Cloud VPN with HA VPN gateways and two tunnels to distinct peer IP addresses.. HA VPN with two tunnels to distinct peer addresses provides an SLA-backed, redundant IPsec connection that encrypts traffic in transit, and Cloud Router supplies the BGP sessions and dynamic route exchange required for the on-premises prefixes. Together they deliver private, encrypted, redundant connectivity, whereas Interconnect options lack built-in encryption and single-attachment designs lack redundancy.

Answer

Dedicated Interconnect with two redundant attachments in different edge availability domains.

Answer

A VPC firewall rule allowing UDP 500 and UDP 4500 from the on-premises public IPs.

Answer

Partner Interconnect with a single attachment and no BGP configuration.

Question 3

A security engineer needs to allow a specific on-premises application to access a Cloud Run service that is protected by a VPC Service Controls perimeter. The on-premises application connects to Google Cloud via Cloud VPN. The engineer wants to grant access without exposing the service to the public internet. Which solution should the engineer implement?

Accepted Answer

Configure the Cloud Run service with internal ingress, set up a Private Service Connect endpoint for the service in the VPC, and allow the on-premises network to access the endpoint via Cloud VPN.. To allow on-premises access to a Cloud Run service without public exposure, the service should be configured with internal ingress. A Private Service Connect endpoint in the VPC provides an internal IP that the on-premises network can reach over Cloud VPN. This approach avoids public internet exposure and works with VPC Service Controls. Other options either misuse ingress/egress rules or misunderstand the direction of Serverless VPC Access connectors.

Answer

Create an ingress rule in the VPC Service Controls perimeter that allows the on-premises network's IP range to access the Cloud Run service.

Answer

Configure the Cloud Run service with internal ingress and use a Serverless VPC Access connector to route traffic from the VPC to Cloud Run, then allow the on-premises IP range in the VPC firewall rules.

Answer

Configure the Cloud Run service with internal ingress only, and use a VPC Service Controls egress rule to allow the on-premises application to reach it.

Question 4

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) in us-central1 and subnet-b (10.0.2.0/24) in europe-west1. They have a firewall rule that allows ingress from 10.0.1.0/24 to all instances in the VPC. A security engineer needs to ensure that instances in subnet-b can only receive traffic from subnet-a on TCP port 22, and all other traffic is denied. What should the engineer do?

Accepted Answer

Modify the existing firewall rule to allow ingress from 10.0.1.0/24 to subnet-b on TCP port 22 only, and create a rule with higher priority to deny all other ingress to subnet-b.. To allow only SSH from subnet-a to subnet-b and deny all other ingress, the existing broad allow rule must be narrowed to only permit TCP port 22 to subnet-b. Then, a deny rule with higher priority (lower number) than any allow rules ensures that any traffic not explicitly allowed is blocked. This enforces the principle of least privilege for subnet-b.

Answer

Create a new firewall rule with priority 1000 that denies all ingress to subnet-b, and create a rule with priority 1001 that allows ingress from 10.0.1.0/24 on TCP port 22.

Answer

Create a new firewall rule with priority 1000 that allows ingress from 10.0.1.0/24 to subnet-b on TCP port 22, and create a rule with priority 1001 that denies all ingress to subnet-b.

Answer

Create a new firewall rule with priority 1000 that allows ingress from 10.0.1.0/24 to subnet-b on TCP port 22, and delete the existing rule.

Question 5

A security engineer is configuring Cloud Armor security policies for an external HTTP(S) load balancer. They need to block traffic from a specific set of IP addresses and also mitigate a recent spike in HTTP flood attacks. Which two actions should the engineer take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud Armor security policy with a rule that uses the preconfigured expression 'origin.region_code' to block traffic from specific countries.. To block traffic by country, use the 'origin.region_code' preconfigured expression in a Cloud Armor rule. To mitigate application-layer DDoS, enable Cloud Armor Managed Protection Plus, which provides adaptive protection and advanced DDoS defenses. Together, these actions address the requirements.

Answer

Configure a rate-based ban rule in the Cloud Armor security policy to limit requests per client IP.

Answer

Create a Cloud Armor security policy with a rule that uses the preconfigured expression 'source.ip' to block traffic from specific countries.

Answer

Use Google Cloud Armor's preconfigured WAF rules to block SQL injection and cross-site scripting attacks.

Question 6

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). A security engineer needs to allow HTTP traffic from any VM in subnet-a to any VM in subnet-b, but deny all other traffic between the subnets. Which firewall rule should be created?

Accepted Answer

An INGRESS rule with source range 10.0.1.0/24, target tags applied to VMs in subnet-b, and protocol/port tcp:80.. The correct rule is an ingress rule on subnet-b that allows traffic from subnet-a's CIDR on TCP port 80. This permits HTTP from any VM in subnet-a to VMs in subnet-b that have the target tag, while the implied deny ingress rule blocks all other traffic between subnets. Other options either use the wrong direction, overly broad source range, or incorrect target.

Answer

An EGRESS rule with destination range 10.0.2.0/24, target tags applied to VMs in subnet-a, and protocol/port tcp:80.

Answer

An INGRESS rule with source range 10.0.0.0/16, target tags applied to VMs in subnet-b, and protocol/port tcp:80.

Answer

An INGRESS rule with source range 10.0.1.0/24, target tags applied to VMs in subnet-a, and protocol/port tcp:80.

Question 7

A security engineer is configuring VPC Service Controls to protect a Cloud Storage bucket and a BigQuery dataset. The engineer needs to allow a specific set of on-premises servers to access these services through a VPN connection, while ensuring that the data cannot be exfiltrated to unauthorized projects. The on-premises servers use a dedicated IP range. Which two configurations should the engineer implement? (Choose two.)

Accepted Answer

Create an access level that includes the on-premises IP range and apply it to the perimeter.. To allow on-premises servers to access protected services within a VPC Service Controls perimeter, you must create an access level that includes their IP range and apply it to the perimeter. Additionally, the servers must use the restricted VIP (restricted.googleapis.com) or private.googleapis.com to ensure their requests are evaluated by the perimeter. Ingress rules are not used for IP-based access, and firewall rules alone do not enforce VPC Service Controls.

Answer

Create a firewall rule in the VPC that allows traffic from the on-premises IP range to the restricted VIP.

Answer

Create an ingress rule in the perimeter that allows access from the on-premises IP range to the protected services.

Answer

Configure the VPN tunnel to use a dedicated Cloud Interconnect attachment with a VLAN attachment.

Question 8

A security engineer needs to allow outbound traffic from a VM instance to a specific external IP address on TCP port 443, while denying all other outbound traffic. The VM has an external IP address. The engineer wants to implement this using VPC firewall rules and ensure that the rules are evaluated correctly. What should the engineer do?

Accepted Answer

Create an egress firewall rule with priority 1000 to allow TCP 443 to the specific IP, and a default egress deny rule with priority 65535.. To allow only specific outbound traffic, an egress allow rule with a lower priority number (higher precedence) must be created for the desired traffic. The implied egress deny rule (priority 65535) will then deny all other outbound traffic. If an explicit deny rule is needed, it should have a higher priority number than the allow rule. The correct configuration uses an allow rule with priority 1000 and relies on the implied deny or an explicit deny with a higher number.

Answer

Create an egress firewall rule with priority 1000 to allow TCP 443 to the specific IP, and a default egress allow rule with priority 65535.

Answer

Create an egress firewall rule with priority 65535 to allow TCP 443 to the specific IP, and a default egress deny rule with priority 1000.

Answer

Create an ingress firewall rule with priority 1000 to allow TCP 443 from the specific IP, and a default ingress deny rule with priority 65535.

Question 9

A security engineer is configuring Cloud Armor security policies for an external HTTP(S) load balancer. They need to block traffic from a specific set of IP addresses and also mitigate a recent spike in HTTP flood attacks. Which two actions should the engineer take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Cloud Armor Adaptive Protection to detect and suggest rules for volumetric and application-layer attacks.. Cloud Armor evaluates rules by priority, with lower numbers first. A country-based deny rule must be placed after the partner allow rule so partners are not blocked. Adaptive Protection adds Layer 7 attack detection and suggested mitigations, which addresses the volumetric protection requirement. Together these fulfill the goals without over-blocking legitimate traffic.

Answer

Create a security policy rule that allows partner IP addresses with a higher priority number than the country deny rule.

Answer

Attach the security policy to the backend service and enable Google Cloud Armor Managed Protection Plus for DDoS response.

Answer

Configure a Cloud Armor rule to rate-limit all requests to 10 per minute per IP address globally.

Question 10

A security engineer is configuring a VPC Service Controls perimeter to protect sensitive data in Cloud Storage and BigQuery. They need to allow access from a specific on-premises network while ensuring that data cannot be exfiltrated to unauthorized projects. Which two configurations should they implement? (Choose two.)

Accepted Answer

Define an ingress rule in the perimeter to allow access from the on-premises network to the protected services.. To allow on-premises access to protected services in a VPC Service Controls perimeter, you need an access level that includes the on-premises IP range and an ingress rule that permits that access. Access levels define who can access, and ingress rules define what external sources can reach the protected resources. Together, they enable legitimate access while maintaining the perimeter's security. Other options are either irrelevant or incorrect for on-premises connectivity.

Answer

Configure VPC Network Peering between the on-premises network and the VPC.

Answer

Set up a Cloud NAT gateway to allow outbound traffic from the on-premises network.

Answer

Use Identity-Aware Proxy (IAP) to authenticate on-premises users before they access the services.

Question 11

Your organization runs a three-tier application across two VPC networks, web-vpc (10.0.0.0/24) and app-vpc (10.1.0.0/24), connected by VPC Network Peering. The application team reports that the web tier in web-vpc cannot open a TCP connection to the app tier on port 8443, even though a firewall rule named allow-8443 exists in app-vpc with source range 10.0.0.0/24 and target tag app-server. You verify the app-tier VMs carry the app-server network tag and are listening on 8443. What should you check first?

Accepted Answer

Whether a firewall rule with a lower numeric priority value (higher precedence) in app-vpc denies traffic from 10.0.0.0/24. Firewall rules in a VPC network are evaluated by priority, where the lowest numeric value takes precedence, regardless of whether the rule is allow or deny. A deny rule created earlier with a priority such as 1000 will override an allow rule at priority 1001, even if the allow rule matches perfectly. Because egress is allowed by the implied rule and the peering and tags are already verified, the blocking rule must be a higher-precedence ingress deny in app-vpc.

Answer

Whether the peering connection is in ACTIVE state and the two networks are not using overlapping subnet ranges

Answer

Whether the app-server tag was applied as a network tag or as a service account, since firewall targets only match network tags

Answer

Whether an implied deny rule in web-vpc blocks the egress traffic to 10.1.0.0/24

Question 12

A security engineer needs to allow HTTP and HTTPS traffic from the internet to a set of web servers running on Compute Engine instances. The instances are in a subnet with no external IP addresses, and they are behind an external HTTP(S) load balancer. Which firewall rule should the engineer create?

Accepted Answer

Create an ingress firewall rule allowing tcp:80,443 from the Google Cloud health check source ranges and the load balancer's proxy-only subnet range, applied to the web server instances.. When Compute Engine instances without external IPs are behind an external HTTP(S) load balancer, inbound traffic to the instances comes from the load balancer's proxy-only subnet and from Google Cloud health check ranges. The firewall rule must allow ingress on ports 80 and 443 from those sources. Allowing 0.0.0.0/0 is unnecessary and insecure, while egress rules and private ranges do not match the actual traffic sources.

Answer

Create an ingress firewall rule allowing tcp:80,443 from source range 0.0.0.0/0, applied to the web server instances.

Answer

Create an ingress firewall rule allowing tcp:80,443 from source range 10.0.0.0/8, applied to the web server instances.

Answer

Create an egress firewall rule allowing tcp:80,443 to 0.0.0.0/0, applied to the web server instances.

Question 13

A security engineer is setting up Cloud NAT for a VPC to allow instances without external IP addresses to access the internet. The engineer must ensure that the NAT gateway logs all connections and that the logs are exported to Cloud Logging for auditing. (Choose two.)

Accepted Answer

Enable logging on the Cloud NAT gateway by setting the --log-filter parameter to 'ALL' when creating or updating the NAT gateway.. To log all Cloud NAT connections, the NAT gateway must have logging enabled with a log filter of 'ALL'. This generates logs for all connections. To export these logs for auditing, a log sink must be created in Cloud Logging to route the logs to a destination like Cloud Storage or BigQuery. These two actions together ensure comprehensive logging and export.

Answer

Configure the NAT gateway to use a static external IP address so that logs include the public IP address used for translation.

Answer

Ensure that the Cloud NAT gateway is configured in the same region as the instances that need internet access.

Answer

Grant the Compute Engine service account the 'Logs Writer' role to allow NAT logging to be written to Cloud Logging.

Question 14

A security engineer is configuring Cloud Armor security policies for an external HTTP(S) load balancer. They need to block traffic from a specific set of IP addresses and also mitigate a recent spike in HTTP flood attacks. Which two actions should the engineer take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add preconfigured WAF rules for SQL injection (e.g., sqli-v33-stable) and cross-site scripting (e.g., xss-v33-stable) to the security policy.. To protect against OWASP Top 10 attacks, the engineer must attach a Cloud Armor security policy to the backend service and add preconfigured WAF rules for SQL injection and XSS. These two actions together provide the necessary protection.

Answer

Enable Cloud CDN on the backend service to cache responses and reduce the load on the backend.

Answer

Configure a rate-based ban rule that blocks traffic from IP addresses exceeding a threshold, and set the action to deny(403).

Answer

Create a health check for the backend service to ensure only healthy instances receive traffic.

Question 15

A security engineer is configuring Cloud Armor security policies for an external HTTP(S) load balancer. They need to block traffic from a specific set of IP addresses and also mitigate a recent spike in HTTP flood attacks. Which two actions should the engineer take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Cloud NAT to use a manual IP allocation with specific external IP addresses.. Manual IP allocation with specific external IP addresses provides control and allowlisting capabilities, while enabling logging offers visibility for security and troubleshooting. These two actions align with security best practices for Cloud NAT. Dynamic port allocation with a small range risks port exhaustion, assigning external IPs contradicts the requirement, and an allow-all egress rule is unnecessary and overly permissive.

Answer

Create a firewall rule to allow all egress traffic from the instances to the internet.

Answer

Configure Cloud NAT to use a dynamic port allocation with a small port range to conserve IP addresses.

Answer

Assign external IP addresses to all instances to avoid using Cloud NAT.