PCSE Configuring Network Security Practice Test 6 — 15 Questions

Question 1

A security engineer is configuring a Private Service Connect (PSC) endpoint to access a published service in another VPC. The service is exposed via an internal TCP proxy load balancer. The engineer needs to ensure that only specific consumer VMs can access the service, and that traffic does not leave the Google Cloud network. What should the engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a PSC endpoint in a dedicated subnet, and apply a firewall rule that allows ingress to the endpoint only from the specific consumer VMs' network tags.. To restrict access to a PSC endpoint to specific VMs, the endpoint should be placed in a dedicated subnet. Firewall rules can then be applied to that subnet, allowing ingress only from the specific VMs' network tags. This ensures that only those VMs can reach the endpoint, and all traffic remains within Google Cloud. This approach provides granular control and meets the security requirement.

Answer

Use VPC Service Controls to create a perimeter around the consumer VMs and the PSC endpoint to restrict access.

Answer

Create a PSC endpoint in the consumer VPC and configure a firewall rule to allow traffic from the consumer VMs to the endpoint's IP address.

Answer

Configure the PSC endpoint with a consumer accept list that includes only the specific consumer VMs' IP addresses.

Question 2

A security engineer is configuring Cloud NAT for a VPC to allow instances without external IP addresses to access the internet. The engineer must ensure that only specific instances can use Cloud NAT, and that the NAT IP addresses are static and reserved. Which two configurations should the engineer implement? (Choose two.)

Accepted Answer

Create a Cloud NAT gateway and specify a list of instances or a specific subnet as the source, ensuring only those instances can use NAT.. To allow only specific instances to use Cloud NAT, the engineer can create a NAT gateway with a custom list of instances or associate it with a dedicated subnet containing only those instances. To ensure static, reserved IP addresses for outbound traffic, the engineer must reserve external IP addresses and assign them to the NAT gateway. Firewall rules and Private Google Access do not fulfill these specific NAT requirements.

Answer

Create a Cloud NAT gateway in the region and associate it with the subnet containing the instances.

Answer

Enable Private Google Access on the subnet to allow instances to reach Google APIs without external IPs.

Answer

Create a firewall rule allowing egress from the instances to 0.0.0.0/0 on all protocols.

Question 3

A security engineer is setting up a Shared VPC in Google Cloud. The host project contains the shared VPC network, and several service projects contain resources that need to communicate with each other. The engineer needs to ensure that only specific service projects can use certain subnets in the shared VPC. What should the engineer do?

Accepted Answer

In the host project, use the Shared VPC Admin role to share specific subnets with the desired service projects.. In a Shared VPC, the host project administrator can share specific subnets with service projects. This is done by granting the Compute Network User role on the subnet to the service project's service accounts or by using the Shared VPC Admin role to associate the subnet with the service project. This ensures that only the intended service projects can use those subnets.

Answer

In the host project, create a firewall rule that allows traffic only from the specific service projects' service accounts.

Answer

Grant the service projects' service accounts the Compute Network User role on the host project, and use IAM conditions to restrict access to specific subnets.

Answer

Create a separate VPC network in each service project and use VPC Network Peering to connect them to the shared VPC.

Question 4

A security engineer needs to provide outbound internet access to a private Compute Engine VM that has no external IP address. The VM must initiate connections to external web services, but the VPC must not have a default route to the internet gateway. Which configuration should the engineer implement?

Accepted Answer

Create a Cloud NAT gateway in the VM's region and configure the VM's subnet as a NAT source.. Cloud NAT is the Google Cloud service designed to allow VMs without external IP addresses to initiate outbound connections to the internet. It works at the regional level and is configured with a Cloud Router and subnet associations. The other options either provide only Google API access, require an external IP, or do not work without one.

Answer

Assign an external IP address to the VM and create a firewall rule allowing egress to the internet.

Answer

Configure a custom static route with next hop as the default internet gateway and set the VM's network tag.

Answer

Enable Private Google Access on the VM's subnet to allow access to external web services.

Question 5

A company uses a Shared VPC where the host project contains a subnet with secondary IP ranges for GKE pods and services. A security engineer needs to create a firewall rule that allows ingress to the GKE pods from a specific on-premises CIDR range. The rule must apply only to the GKE pods and not to other VMs in the same subnet. What should the engineer do?

Accepted Answer

Create a firewall rule in the host project with the target as the GKE pod secondary IP range and the source as the on-premises CIDR.. Firewall rules in a Shared VPC are always created in the host project. GKE pods use secondary IP ranges, which can be specified as targets in firewall rules. This allows granular control to permit on-premises traffic only to the pod IP range, not to other VMs. The other options either target the wrong scope or are created in the wrong project.

Answer

Create a firewall rule in the host project with the target as all instances in the subnet and the source as the on-premises CIDR.

Answer

Create a firewall rule in the service project with the target as the GKE pod secondary IP range and the source as the on-premises CIDR.

Answer

Create a firewall rule in the host project with the target as the GKE node service account and the source as the on-premises CIDR.

Question 6

A security engineer is configuring Cloud IDS to monitor traffic for a VPC network. They need to ensure that Cloud IDS can inspect traffic between on-premises and Google Cloud, as well as between VMs within the same VPC. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Create a packet mirroring policy that includes the Cloud IDS endpoint as the collector and specifies the instances or subnets to monitor.. Cloud IDS requires an endpoint in the VPC and a packet mirroring policy to copy traffic to that endpoint. The endpoint performs deep packet inspection. Firewall rules and Private Google Access are not needed for Cloud IDS to function. Third-party appliances are not part of the Cloud IDS service.

Answer

Configure a VPC firewall rule to allow traffic to the Cloud IDS endpoint IP address on the required ports.

Answer

Enable Private Google Access on the subnet where the Cloud IDS endpoint is deployed.

Answer

Deploy a third-party firewall appliance and configure Cloud IDS to forward traffic to it.

Question 7

A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?

Accepted Answer

VPC Service Controls. VPC Service Controls create a security perimeter around Google Cloud services, including Cloud Storage, so that only resources inside the specified VPC (or allowed projects) can access the APIs. It enforces context-aware access at the API layer, preventing data exfiltration even if IAM permissions are granted. This directly satisfies the requirement to restrict Cloud Storage access to a specific VPC.

Answer

Firewall Rules

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 8

An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.. Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.

Answer

Create a VPC firewall rule at the organization level to deny all egress, then allow egress for the specific tag.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Configure Cloud Armor with a deny-all egress rule and an exception for the tag.

Question 9

A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?

Accepted Answer

Add the external IP to an access level and configure an ingress rule in the service perimeter.. VPC Service Controls access levels can define IP-based conditions. By creating an ingress rule that allows traffic from the specified IP address to access the BigQuery API, the external application can be authorized.

Answer

Whitelist the external IP in the BigQuery dataset's IAM policy.

Answer

Create a Cloud VPN tunnel between the on-premises network and the VPC, and add the tunnel to the service perimeter.

Answer

Use Private Google Access on the VPC to allow on-premises traffic.

Question 10

An engineer needs to block a specific IP address from accessing an HTTPS load balancer. Which Cloud Armor rule should be used?

Accepted Answer

A custom rule with a 'deny' action and the IP address in the 'src_ip_ranges' field. Cloud Armor custom rules allow IP allow/deny lists. A deny rule with the specific IP address will block traffic.

Answer

A VPC firewall rule with a deny ingress for that IP

Answer

A Cloud Armor rate limiting rule

Answer

A preconfigured rule from the OWASP ModSecurity CRS

Question 11

A company wants internal VMs to access Google APIs (e.g., Cloud Storage, BigQuery) without traversing the internet. What is the simplest configuration?

Accepted Answer

Enable Private Google Access on the subnet where the VMs reside.. Private Google Access allows VMs without external IPs to reach Google APIs and services (Cloud Storage, BigQuery, etc.) using internal IP addresses, keeping traffic off the public internet. Enabling it on the subnet is the simplest configuration and requires no NAT or proxy.

Answer

Assign external IPs to all VMs and use VPC firewall rules to restrict egress.

Answer

Use Cloud NAT to route traffic to Google APIs.

Answer

Set up Private Service Connect to googleapis.com.

Question 12

An organization uses VPC Service Controls in dry-run mode for a project containing Google Cloud Storage. They notice that BigQuery jobs are being logged as violations. How should they interpret this?

Accepted Answer

The perimeters are logging potential violations; no action has been taken yet.. In dry-run mode, VPC Service Controls logs violations without enforcement, allowing administrators to review and adjust perimeters before enabling enforcement.

Answer

The dry-run mode is not supported for Cloud Storage projects.

Answer

The perimeters are not configured correctly because BigQuery should not be affected.

Answer

The perimeters are working correctly and BigQuery access is blocked.

Question 13

Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML-based DDoS detection to automatically learn normal traffic patterns and alert or mitigate attacks.

Answer

Preconfigured WAF rules

Answer

Rate limiting

Answer

Custom rules

Question 14

A service provider wants to expose an internal service to external consumers in a controlled manner, without giving them direct access to the VPC. Which Google Cloud service should be used?

Accepted Answer

Private Service Connect. Private Service Connect lets a service provider expose a service to consumers via a private endpoint in the consumer's VPC, without VPC peering or direct VPC access. It is designed exactly for controlled, one-way service exposure across projects and organizations.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

VPC Peering

Question 15

An organization wants to implement a zero-trust network security model for their Google Cloud environment. Which TWO practices should they adopt? (Choose TWO.)

Accepted Answer

Implement VPC Service Controls to create perimeters around sensitive APIs.. Option A is correct because VPC Service Controls let you define a service perimeter around sensitive Google Cloud APIs (such as Cloud Storage or BigQuery), which enforces context-aware access and prevents data exfiltration even if credentials are compromised—a core zero-trust principle of never trusting the network by default. Option B is correct because using service account targets in firewall rules binds access control to a workload's verified identity rather than to mutable network tags, aligning with zero trust's identity-centric enforcement model. Option C is not correct because Private Google Access only allows VMs without external IPs to reach Google APIs, which is a connectivity feature, not a zero-trust access-control practice. Option D is not correct because network tags are mutable metadata that any user with compute.instances.setTags can change, making them a weak, non-identity-based grouping mechanism unsuitable for zero trust. Option E is not correct because allowing all outbound traffic and relying on intrusion detection violates zero trust's least-privilege and explicit-verification principles.

Answer

Enable Private Google Access for all subnets.

Answer

Use network tags to group VMs for firewall rules.

Answer

Allow all outbound traffic and rely on intrusion detection.