PCSE Configuring Network Security Practice Test 6 — 15 Questions

Question 1

A security engineer wants to allow egress traffic from Compute Engine instances to the internet only for updates to a specific set of packages. All other egress must be denied. Which VPC firewall rule configuration should the engineer use?

Accepted Answer

Create an egress allow rule for the specific package sources and a deny all egress rule with lower priority (higher number).. VPC firewall rules are stateful, so allowing egress for specific destinations (e.g., package repositories) automatically allows return traffic. Deny rules should be used to block all other egress. The correct approach is an egress allow rule for the specific destinations and a lower-priority egress deny rule for all other traffic.

Answer

Create an egress deny rule for all traffic and then a higher-priority allow rule for the package sources.

Answer

Create an ingress allow rule for the package sources and a deny all egress rule with higher priority.

Answer

Use Cloud NAT to force all egress through a single IP and then restrict with a firewall rule.

Question 2

A company wants to restrict access to Cloud Storage buckets so that only resources in a specific VPC network can reach them, and data cannot be exfiltrated to other networks. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allows creating service perimeters that protect Google Cloud services (including Cloud Storage) by restricting access from outside the perimeter. Resources inside the perimeter can access the protected services, but data cannot be exfiltrated to external networks.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Armor

Answer

VPC Firewall Rules

Question 3

A company uses VPC Service Controls in dry-run mode to test a new service perimeter that includes BigQuery. They want to monitor any violations without actually blocking access. Where can they view the logs of these dry-run violations?

Accepted Answer

Cloud Logging with the filter `policy_violations`. When VPC Service Controls is in dry-run mode, violations are logged to Cloud Logging but access is not blocked. The logs can be viewed in the Logs Explorer using the filter for VPC Service Controls policy violations.

Answer

Cloud Monitoring dashboards

Answer

VPC Flow Logs

Answer

Access Transparency logs

Question 4

An organization has a hub-and-spoke VPC setup with Shared VPC. The security team wants to enforce a rule that all egress traffic from any project in the organization must pass through a central inspection appliance in the hub VPC. Which firewall configuration approach meets this requirement?

Accepted Answer

Set up a default route in each spoke VPC that sends egress traffic to the inspection appliance in the hub, and use firewall rules to allow only that traffic.. Hierarchical firewall policies apply to the entire organization, folder, or project and cannot be overridden by VPC firewall rules. They can be used to enforce mandatory inspection. However, they cannot specify next-hop appliances. To force traffic through an inspection appliance, you need to use a combination of routes and firewall rules. The correct approach is to set up a default route pointing to the inspection appliance as next hop, and use firewall rules to block direct egress unless it goes through the appliance.

Answer

Use VPC firewall rules with a deny-all egress rule, then allow egress only from instances running in the hub VPC.

Answer

Configure private Google Access and VPC Service Controls to restrict egress.

Answer

Create a hierarchical firewall policy that denies all egress traffic unless it has a specific tag.

Question 5

A company wants to expose an internal web service running on a private GKE cluster to other services within the same VPC network using a private IP address. They do not want to use a public load balancer. Which Google Cloud service should they use?

Accepted Answer

Private Service Connect. Private Service Connect allows publishing services using internal IP addresses. It can be used to create a private endpoint for GKE services, accessible only within the VPC network via a Private Service Connect endpoint.

Answer

Cloud NAT

Answer

Cloud VPN

Answer

Internal load balancer

Question 6

A security engineer needs to block traffic from all IP addresses in a specific geographic region from reaching an HTTPS load-balanced application. The application uses Cloud Load Balancing with an external HTTPS load balancer. Which approach should the engineer use?

Accepted Answer

Create a Cloud Armor security policy with a geo-based deny rule and attach it to the load balancer.. Cloud Armor security policies can be attached to external HTTPS load balancers to filter traffic based on geolocation. The engineer can create a Cloud Armor security policy with a rule that uses the geo-tag to deny traffic from the specified region.

Answer

Create a VPC firewall rule that denies ingress from the region's IP ranges.

Answer

Use Identity-Aware Proxy (IAP) to block access based on the user's location.

Answer

Configure a Cloud CDN policy to block traffic from certain regions.

Question 7

A company wants to use a Google-managed SSL certificate for their external HTTPS load balancer. Which step is required to provision the certificate?

Accepted Answer

Create a DNS record for the domain that resolves to the load balancer's IP address.. Google-managed SSL certificates require domain ownership verification. You must create a DNS record (CNAME or A record) that points to the load balancer's IP address or a specific verification record. The certificate is automatically provisioned and renewed.

Answer

Install the certificate on each backend instance.

Answer

Submit a Certificate Signing Request (CSR) to Google.

Answer

Upload the private key and certificate in PEM format.

Question 8

A company uses Cloud Armor Managed Protection Plus to protect their applications. They want to automatically block IP addresses that are identified as malicious by adaptive protection. How should they configure this?

Accepted Answer

Enable 'auto-deploy' in the adaptive protection configuration.. Cloud Armor adaptive protection uses machine learning to detect DDoS attacks. It can automatically create deny rules for malicious IPs if configured to do so. The setting is in the security policy's adaptive protection configuration.

Answer

Manually review adaptive protection alerts and create deny rules.

Answer

Use the 'rate limiting' rule to block high-traffic IPs.

Answer

Set up a Cloud Function to parse logs and create rules via API.

Question 9

An organization needs to enforce a TLS minimum version of 1.2 for all traffic to their HTTPS load balancers. They have multiple load balancers serving different domains. Which Google Cloud feature should they use?

Accepted Answer

Create an SSL policy with TLS 1.2 as the minimum version and attach it to the target HTTPS proxy.. SSL policies allow you to configure the minimum TLS version and cipher suites for HTTPS load balancers. You can create an SSL policy with TLS 1.2 as the minimum and attach it to the target HTTPS proxy of each load balancer.

Answer

Use a global network endpoint group (NEG) with an SSL policy.

Answer

Create a Cloud Armor security policy with a rule to block TLS 1.0 and 1.1.

Answer

Configure the backend instances to reject TLS 1.0 and 1.1 connections.

Question 10

A security team wants to detect and block network-based threats such as malware and command-and-control traffic within their VPC. They need a managed service that provides deep packet inspection. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with packet mirroring to analyze traffic.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 11

A company has a VPC Service Controls perimeter that includes BigQuery and Cloud Storage. They need to allow a specific on-premises application (with a static IP) to access a BigQuery dataset within the perimeter. Which configuration should they use?

Accepted Answer

Add the on-premises IP to an access level and create an ingress rule in the service perimeter.. VPC Service Controls allows ingress rules to permit traffic from specific identities or IP ranges into the perimeter. They need to create an ingress rule that allows the on-premises IP to access BigQuery.

Answer

Create a VPC firewall rule allowing ingress from the on-premises IP to the BigQuery API.

Answer

Exempt the on-premises service account from the perimeter.

Answer

Use Private Google Access from the on-premises network.

Question 12

A company uses Cloud Armor to protect a web application. They want to block requests that contain SQL injection patterns based on the OWASP ModSecurity Core Rule Set. Which preconfigured rule set should they enable?

Accepted Answer

OWASP ModSecurity CRS. Cloud Armor provides preconfigured WAF rules based on the OWASP ModSecurity CRS. To block SQL injection, the rule set 'owasp-crs' with the specific paranoia level can be used, or the 'sqli' rule set if available. The correct answer is the OWASP ModSecurity CRS rule set that includes SQL injection detection.

Answer

Custom rules using CEL expression

Answer

Google Cloud Armor Managed Rules (SQL Injection)

Answer

Rate limiting rules

Question 13

A security engineer needs to restrict access to a Cloud Storage bucket so that only a specific set of Compute Engine instances can read objects. The instances are in the same project and VPC network. The engineer wants to use VPC firewall rules for this purpose. Which two configurations are REQUIRED? (Choose two.)

Accepted Answer

Create an egress allow rule for the IP ranges of Cloud Storage (Google API IPs) and apply it to the target instances.. VPC firewall rules control network traffic to/from instances, but they cannot directly restrict access to Cloud Storage APIs. However, they can restrict which instances can reach the external IP of Cloud Storage. To achieve the goal, the engineer must allow egress traffic from the instances to the Cloud Storage IP ranges and deny all other egress. But more importantly, access to Cloud Storage is controlled by IAM, not firewall rules. However, the question specifically asks about VPC firewall rules. The typical approach is to use Private Google Access and firewall rules to restrict egress to Google API IPs. The correct answers are: allow egress to the Google API IP ranges (which include Cloud Storage) and deny all other egress. But the question might also consider using service accounts and firewall rule targets. Firewall rules can target service accounts, but that does not restrict access to Cloud Storage itself. The most direct answer is that to limit which instances can access Cloud Storage, you can create an egress rule that allows traffic to the Cloud Storage IP ranges only from instances with a specific service account or tag, and then deny all other egress. But the question asks for two configurations. The most reasonable answers: (1) Create an egress allow rule for the Cloud Storage IP ranges with a target tag or service account that matches the instances. (2) Create a deny all egress rule with lower priority. However, since Cloud Storage uses Google APIs, the IP ranges are from the published list. The correct choices are likely: A and D.

Answer

Enable Private Google Access on the subnet where the instances reside.

Answer

Assign a Cloud IAM role to the instances' service account to allow read access to the bucket.

Answer

Create an ingress allow rule from Cloud Storage IP ranges to the instances.

Question 14

A company is designing a secure multi-tenant environment in Google Cloud. Each tenant has its own VPC network and resources. The security team wants to centrally enforce a rule that denies all egress traffic to the internet from tenant VPCs, except for traffic to specific trusted IP ranges for software updates. They also want to ensure that tenant admins cannot override this rule. Which two actions should they take? (Choose two.)

Accepted Answer

Create a hierarchical firewall policy at the folder level that denies egress to 0.0.0.0/0 except for the trusted IP ranges.. Hierarchical firewall policies are inherited and cannot be overridden at lower levels. They can be used to enforce mandatory rules. The organization can create a hierarchical firewall policy at the organization or folder level that denies all egress to 0.0.0.0/0 except for the trusted IP ranges. Additionally, to prevent tenant admins from overriding, they should not grant them the compute.firewallPolicies.update permission or similar. The correct choices are: create a hierarchical firewall policy and restrict permissions to modify firewall policies.

Answer

Grant tenant admins the compute.securityAdmin role to manage firewall rules.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Create a VPC firewall rule in each tenant project to deny egress traffic.

Question 15

A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)

Accepted Answer

Attach the Cloud Armor security policy to the backend service or load balancer.. Cloud Armor provides preconfigured WAF rules (OWASP ModSecurity CRS) for XSS, SQLi, LFI, etc. It also supports custom rules for allowlisting IPs. The correct features are: using preconfigured rule sets for OWASP CRS, creating custom rules with IP allowlisting, and then applying the policy to the load balancer. The question asks for three, so the answers are the OWASP CRS rule set, custom rules, and security policy attachment.

Answer

Configure IAP to restrict access to the application.

Answer

Use Cloud CDN to cache static content.