PCSE Configuring Network Security Practice Test 6 — 15 Questions

Question 1

A security team needs to inspect all egress traffic from Compute Engine instances for malware using a third-party security appliance. They want to deploy the appliance in a separate VPC and route all egress traffic through it. Which THREE components are required? (Choose 3)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC peering between the application VPC and the appliance VPC. Use a custom route to direct default egress traffic to the appliance, which is an internal load balancer (ILB) forwarding to the appliance instances. The appliance must be deployed in a different VPC, and VPC peering or Network Connectivity Center connects the VPCs. However, the simplest is to use an ILB in the same VPC as the instances, but the requirement says separate VPC. So use VPC peering. The three required: custom route for default route (0.0.0.0/0) with next hop to ILB, an internal load balancer forwarding traffic to the appliance, and VPC peering (or VPN) to connect the VPCs. Alternatively, if using the same VPC, peering not needed. But given separate VPC, peering is needed.

Answer

Cloud VPN tunnel between VPCs

Answer

Cloud NAT gateway

Question 2

An organization wants to enforce that all Compute Engine instances have Confidential Computing enabled for sensitive workloads. Which TWO steps should be taken? (Choose 2)

Accepted Answer

Select machine series that support AMD Secure Encrypted Virtualization (SEV).. To enforce Confidential Computing, use an organization policy constraint to require the feature. Additionally, instance templates can be configured with Confidential Computing, but the enforcement is via policy. Also, ensuring the VM images support SEV is important. However, the key steps: 1) Set organization policy to require `compute.requireConfidentialComputing` (or similar) and 2) Use machine series that support Confidential Computing (e.g., N2D). But the question asks for two steps. The options: creating a constraint and using appropriate machine types.

Answer

Enable VPC Flow Logs for all subnets.

Answer

Use Cloud IDS to detect non-confidential instances.

Answer

Use a hierarchical firewall policy to block non-confidential instances.

Question 3

A security engineer wants to allow egress traffic from Compute Engine instances to the internet only for updates to a specific set of packages. All other egress must be denied. Which VPC firewall rule configuration should the engineer use?

Accepted Answer

Create an egress allow rule for the specific package sources and a deny all egress rule with lower priority (higher number).. VPC firewall rules are stateful, so allowing egress for specific destinations (e.g., package repositories) automatically allows return traffic. Deny rules should be used to block all other egress. The correct approach is an egress allow rule for the specific destinations and a lower-priority egress deny rule for all other traffic.

Answer

Create an egress deny rule for all traffic and then a higher-priority allow rule for the package sources.

Answer

Create an ingress allow rule for the package sources and a deny all egress rule with higher priority.

Answer

Use Cloud NAT to force all egress through a single IP and then restrict with a firewall rule.

Question 4

A company wants to restrict access to Cloud Storage buckets so that only resources in a specific VPC network can reach them, and data cannot be exfiltrated to other networks. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allows creating service perimeters that protect Google Cloud services (including Cloud Storage) by restricting access from outside the perimeter. Resources inside the perimeter can access the protected services, but data cannot be exfiltrated to external networks.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Armor

Answer

VPC Firewall Rules

Question 5

A company uses VPC Service Controls in dry-run mode to test a new service perimeter that includes BigQuery. They want to monitor any violations without actually blocking access. Where can they view the logs of these dry-run violations?

Accepted Answer

Cloud Logging with the filter `policy_violations`. When VPC Service Controls is in dry-run mode, violations are logged to Cloud Logging but access is not blocked. The logs can be viewed in the Logs Explorer using the filter for VPC Service Controls policy violations.

Answer

Cloud Monitoring dashboards

Answer

VPC Flow Logs

Answer

Access Transparency logs

Question 6

An organization has a hub-and-spoke VPC setup with Shared VPC. The security team wants to enforce a rule that all egress traffic from any project in the organization must pass through a central inspection appliance in the hub VPC. Which firewall configuration approach meets this requirement?

Accepted Answer

Set up a default route in each spoke VPC that sends egress traffic to the inspection appliance in the hub, and use firewall rules to allow only that traffic.. Hierarchical firewall policies apply to the entire organization, folder, or project and cannot be overridden by VPC firewall rules. They can be used to enforce mandatory inspection. However, they cannot specify next-hop appliances. To force traffic through an inspection appliance, you need to use a combination of routes and firewall rules. The correct approach is to set up a default route pointing to the inspection appliance as next hop, and use firewall rules to block direct egress unless it goes through the appliance.

Answer

Use VPC firewall rules with a deny-all egress rule, then allow egress only from instances running in the hub VPC.

Answer

Configure private Google Access and VPC Service Controls to restrict egress.

Answer

Create a hierarchical firewall policy that denies all egress traffic unless it has a specific tag.

Question 7

A company wants to expose an internal web service running on a private GKE cluster to other services within the same VPC network using a private IP address. They do not want to use a public load balancer. Which Google Cloud service should they use?

Accepted Answer

Internal load balancer. To expose a GKE service within the same VPC using a private IP, an Internal load balancer (ILB) is the appropriate choice. It provides a private IP address accessible from within the VPC, without a public endpoint. Private Service Connect is designed for publishing services to other VPCs or on-premises, not for same-VPC exposure.

Answer

Cloud NAT

Answer

Private Service Connect

Answer

Cloud VPN

Question 8

A security engineer needs to block traffic from all IP addresses in a specific geographic region from reaching an HTTPS load-balanced application. The application uses Cloud Load Balancing with an external HTTPS load balancer. Which approach should the engineer use?

Accepted Answer

Create a Cloud Armor security policy with a geo-based deny rule and attach it to the load balancer.. Cloud Armor security policies can be attached to external HTTPS load balancers to filter traffic based on geolocation. The engineer can create a Cloud Armor security policy with a rule that uses the geo-tag to deny traffic from the specified region.

Answer

Create a VPC firewall rule that denies ingress from the region's IP ranges.

Answer

Use Identity-Aware Proxy (IAP) to block access based on the user's location.

Answer

Configure a Cloud CDN policy to block traffic from certain regions.

Question 9

A company wants to use a Google-managed SSL certificate for their external HTTPS load balancer. Which step is required to provision the certificate?

Accepted Answer

Create a DNS record for the domain that resolves to the load balancer's IP address.. Google-managed SSL certificates require domain ownership verification. You must create a DNS record (CNAME or A record) that points to the load balancer's IP address or a specific verification record. The certificate is automatically provisioned and renewed.

Answer

Install the certificate on each backend instance.

Answer

Submit a Certificate Signing Request (CSR) to Google.

Answer

Upload the private key and certificate in PEM format.

Question 10

A company uses Cloud Armor Managed Protection Plus to protect their applications. They want to automatically block IP addresses that are identified as malicious by adaptive protection. How should they configure this?

Accepted Answer

Enable 'auto-deploy' in the adaptive protection configuration.. Cloud Armor adaptive protection uses machine learning to detect DDoS attacks. It can automatically create deny rules for malicious IPs if configured to do so. The setting is in the security policy's adaptive protection configuration.

Answer

Manually review adaptive protection alerts and create deny rules.

Answer

Use the 'rate limiting' rule to block high-traffic IPs.

Answer

Set up a Cloud Function to parse logs and create rules via API.

Question 11

An organization needs to enforce a TLS minimum version of 1.2 for all traffic to their HTTPS load balancers. They have multiple load balancers serving different domains. Which Google Cloud feature should they use?

Accepted Answer

Create an SSL policy with TLS 1.2 as the minimum version and attach it to the target HTTPS proxy.. SSL policies allow you to configure the minimum TLS version and cipher suites for HTTPS load balancers. You can create an SSL policy with TLS 1.2 as the minimum and attach it to the target HTTPS proxy of each load balancer.

Answer

Use a global network endpoint group (NEG) with an SSL policy.

Answer

Create a Cloud Armor security policy with a rule to block TLS 1.0 and 1.1.

Answer

Configure the backend instances to reject TLS 1.0 and 1.1 connections.

Question 12

A security team wants to detect and block network-based threats such as malware and command-and-control traffic within their VPC. They need a managed service that provides deep packet inspection. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with packet mirroring to analyze traffic.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 13

A company has a VPC Service Controls perimeter that includes BigQuery and Cloud Storage. They need to allow a specific on-premises application (with a static IP) to access a BigQuery dataset within the perimeter. Which configuration should they use?

Accepted Answer

Add the on-premises IP to an access level and create an ingress rule in the service perimeter.. VPC Service Controls allows ingress rules to permit traffic from specific identities or IP ranges into the perimeter. They need to create an ingress rule that allows the on-premises IP to access BigQuery.

Answer

Create a VPC firewall rule allowing ingress from the on-premises IP to the BigQuery API.

Answer

Exempt the on-premises service account from the perimeter.

Answer

Use Private Google Access from the on-premises network.

Question 14

A company uses Cloud Armor to protect a web application. They want to block requests that contain SQL injection patterns based on the OWASP ModSecurity Core Rule Set. Which preconfigured rule set should they enable?

Accepted Answer

OWASP ModSecurity CRS. Cloud Armor provides preconfigured WAF rules based on the OWASP ModSecurity CRS. To block SQL injection, the rule set 'owasp-crs' with the specific paranoia level can be used, or the 'sqli' rule set if available. The correct answer is the OWASP ModSecurity CRS rule set that includes SQL injection detection.

Answer

Custom rules using CEL expression

Answer

Google Cloud Armor Managed Rules (SQL Injection)

Answer

Rate limiting rules

Question 15

A security engineer needs to restrict access to a Cloud Storage bucket so that only a specific set of Compute Engine instances can read objects. The instances are in the same project and VPC network. The engineer wants to use VPC firewall rules for this purpose. Which two configurations are REQUIRED? (Choose two.)

Accepted Answer

Create an egress allow rule for the IP ranges of Cloud Storage (Google API IPs) and apply it to the target instances.. VPC firewall rules control network traffic to/from instances, but they cannot directly restrict access to Cloud Storage APIs. However, they can restrict which instances can reach the external IP of Cloud Storage. To achieve the goal, the engineer must allow egress traffic from the instances to the Cloud Storage IP ranges and deny all other egress. But more importantly, access to Cloud Storage is controlled by IAM, not firewall rules. However, the question specifically asks about VPC firewall rules. The typical approach is to use Private Google Access and firewall rules to restrict egress to Google API IPs. The correct answers are: allow egress to the Google API IP ranges (which include Cloud Storage) and deny all other egress. But the question might also consider using service accounts and firewall rule targets. Firewall rules can target service accounts, but that does not restrict access to Cloud Storage itself. The most direct answer is that to limit which instances can access Cloud Storage, you can create an egress rule that allows traffic to the Cloud Storage IP ranges only from instances with a specific service account or tag, and then deny all other egress. But the question asks for two configurations. The most reasonable answers: (1) Create an egress allow rule for the Cloud Storage IP ranges with a target tag or service account that matches the instances. (2) Create a deny all egress rule with lower priority. However, since Cloud Storage uses Google APIs, the IP ranges are from the published list. The correct choices are likely: A and D.

Answer

Enable Private Google Access on the subnet where the instances reside.

Answer

Assign a Cloud IAM role to the instances' service account to allow read access to the bucket.

Answer

Create an ingress allow rule from Cloud Storage IP ranges to the instances.