PCSE Configuring Network Security Practice Test 7 — 15 Questions

Question 1

A company is designing a secure multi-tenant environment in Google Cloud. Each tenant has its own VPC network and resources. The security team wants to centrally enforce a rule that denies all egress traffic to the internet from tenant VPCs, except for traffic to specific trusted IP ranges for software updates. They also want to ensure that tenant admins cannot override this rule. Which two actions should they take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a hierarchical firewall policy at the folder level that denies egress to 0.0.0.0/0 except for the trusted IP ranges.. Hierarchical firewall policies are inherited and cannot be overridden at lower levels. They can be used to enforce mandatory rules. The organization can create a hierarchical firewall policy at the organization or folder level that denies all egress to 0.0.0.0/0 except for the trusted IP ranges. Additionally, to prevent tenant admins from overriding, they should not grant them the compute.firewallPolicies.update permission or similar. The correct choices are: create a hierarchical firewall policy and restrict permissions to modify firewall policies.

Answer

Grant tenant admins the compute.securityAdmin role to manage firewall rules.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Create a VPC firewall rule in each tenant project to deny egress traffic.

Question 2

A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)

Accepted Answer

Attach the Cloud Armor security policy to the backend service or load balancer.. Cloud Armor provides preconfigured WAF rules (OWASP ModSecurity CRS) for XSS, SQLi, LFI, etc. It also supports custom rules for allowlisting IPs. The correct features are: using preconfigured rule sets for OWASP CRS, creating custom rules with IP allowlisting, and then applying the policy to the load balancer. The question asks for three, so the answers are the OWASP CRS rule set, custom rules, and security policy attachment.

Answer

Configure IAP to restrict access to the application.

Answer

Use Cloud CDN to cache static content.

Question 3

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only resources within a specific VPC network can call these APIs, and no traffic from other VPCs or on-premises networks is allowed. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that restrict access to Google Cloud APIs based on the requesting network's context. This prevents data exfiltration and ensures only resources in the specified VPC can access the APIs.

Answer

Firewall Rules

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 4

A security engineer needs to configure firewall rules to allow traffic from a set of compute instances to a set of backend instances. The engineer wants to use a method that is more secure and scalable than using network tags. Which approach should they use?

Accepted Answer

Use firewall rules with source service accounts and target service accounts. Service accounts as firewall rule targets are preferred over network tags because they are immutable, tied to the identity of the instance, and reduce dependency on tag management. This approach is more secure and scalable.

Answer

Use hierarchical firewall policies

Answer

Use firewall rules with source tags and target tags

Answer

Use network firewall policies

Question 5

A company wants to allow users from a specific on-premises IP range to access a service deployed on Google Cloud, but only if the user's device is compliant with corporate security policies (e.g., has antivirus enabled). Which combination of services can achieve this?

Accepted Answer

VPC Service Controls with an access level that includes IP and device conditions. VPC Service Controls access levels can combine IP-based conditions with device-based conditions (e.g., using BeyondCorp Enterprise). This allows restricting access to a service perimeter based on both the user's IP and device compliance.

Answer

Firewall rules with source ranges and service accounts

Answer

Cloud Armor with geo-based access control

Answer

Cloud IDS with threat detection

Question 6

A company has set up a VPC Service Controls perimeter that includes Cloud Storage. They want to allow a specific on-premises server to copy data to a Cloud Storage bucket inside the perimeter. The on-premises server uses an external IP address. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter that allows the on-premises IP range. In VPC Service Controls, ingress rules allow traffic from outside the perimeter to access resources inside. To allow an on-premises server with an external IP, an ingress rule from all identities (or the specific identity) using the source IP range of the on-premises server must be configured. This allows the server to cross the perimeter.

Answer

Configure a firewall rule allowing traffic from the on-premises IP to Cloud Storage

Answer

Add the on-premises server's IP to the access level of the perimeter

Answer

Create an egress rule in the service perimeter that allows the on-premises IP range

Question 7

A company wants to use a Google Cloud load balancer with an SSL certificate that is automatically provisioned and renewed. Which type of certificate should they use?

Accepted Answer

Google-managed certificate. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for use with load balancers. This is the simplest option for automatic management.

Answer

Certificate Manager with a self-managed certificate

Answer

Certificate Authority Service

Answer

Self-managed certificate

Question 8

A security engineer needs to block traffic to a set of VMs from specific IP addresses and also apply rate limiting for HTTP traffic. The VMs are behind a global external HTTPS load balancer. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor security policies can be attached to load balancers to provide WAF capabilities, including IP allow/deny lists and rate limiting. This is the appropriate service for this scenario.

Answer

Cloud IDS

Answer

VPC firewall rules

Answer

Network firewall policies

Question 9

A company wants to provide private connectivity from its on-premises network to Google Cloud APIs (e.g., BigQuery, Cloud Storage) without traversing the public internet. They have an existing Dedicated Interconnect connection. Which solution should they use?

Accepted Answer

Private Service Connect. Private Service Connect (PSC) allows private access to Google APIs via private endpoints using internal IP addresses. With Dedicated Interconnect, on-premises traffic can reach these endpoints without going over the internet.

Answer

Cloud NAT

Answer

Cloud VPN with VPC peering

Answer

VPC Service Controls

Question 10

An organization has a hierarchical firewall policy at the organization level that denies all ingress traffic from the internet. A project team needs to allow HTTP traffic from the internet to a specific VM. How should they achieve this?

Accepted Answer

Create a project-level hierarchical firewall policy with a rule allowing HTTP from 0.0.0.0/0 and a lower priority number than the org-level deny. Hierarchical firewall policies cannot be overridden at lower levels; they are always evaluated first. Since the org-level policy denies all internet ingress, the only way to allow HTTP is to create a hierarchical policy at a lower level (folder or project) that allows it, but those are also part of the hierarchy and are evaluated after org-level. Actually, hierarchical policies can be overridden by a lower-level policy with a higher priority, but the org-level policy has no higher priority? In GCP, hierarchical firewall policies are evaluated in order of precedence: organization > folder > project. A policy at a lower level can override a higher-level policy if it has a higher priority (lower number) and is an allow rule. So the project team can create a project-level hierarchical policy with a higher priority (e.g., 100) allowing HTTP from 0.0.0.0/0, which will override the org-level deny (priority 1000).

Answer

Add a VPC firewall rule allowing HTTP from 0.0.0.0/0

Answer

Remove the VM from the organization hierarchy

Answer

Use Cloud Armor to allow the traffic

Question 11

A company wants to detect and alert on potential network threats, such as malware and command-and-control traffic, within their VPC. They need a managed service that integrates with packet mirroring. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed network threat detection service that uses packet mirroring to inspect traffic for threats. It is powered by Palo Alto Networks.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 12

A company's security policy requires that all traffic to a Google Cloud load balancer use TLS 1.2 or higher and only accept strong ciphers. They want to enforce this using a Google Cloud resource. Which resource should they configure?

Accepted Answer

SSL policy. SSL policies on HTTPS load balancers allow you to specify the minimum TLS version and cipher profile (e.g., RESTRICTED for strong ciphers). This enforces encryption requirements at the load balancer level.

Answer

Cloud Armor security policy

Answer

Network firewall rule

Answer

SSL certificate

Question 13

A company wants to protect a web application hosted on Google Cloud from common web attacks like SQL injection and cross-site scripting (XSS). They have deployed a global external HTTPS load balancer. Which TWO services or configurations should they use?

Accepted Answer

Cloud Armor security policy with OWASP ModSecurity CRS rule set. Cloud Armor provides WAF capabilities with preconfigured rules for OWASP Top 10 threats, including SQLi and XSS. Additionally, using an HTTPS load balancer ensures encrypted traffic. For this question, the correct answers are Cloud Armor and enabling HTTPS (which is already done). But since the load balancer is already HTTPS, the focus is on Cloud Armor. The other options: Cloud IDS is for network threat detection, not WAF; VPC Service Controls is for API access control; SSL policy is for TLS settings.

Answer

SSL policy with RESTRICTED profile

Answer

VPC Service Controls

Answer

Cloud IDS

Question 14

An organization wants to use VPC Service Controls to protect BigQuery data. They need to allow a group of data analysts to access BigQuery from outside the perimeter (e.g., from their laptops) while maintaining the perimeter for all other users. Which TWO configurations are necessary?

Accepted Answer

Define an access level that includes the analysts' identities or IPs. To allow specific users to access a service from outside the perimeter, you must create an access level that identifies those users (e.g., by IP range or device) and then create an ingress rule that permits traffic from that access level to BigQuery. The access level can be based on user identity (e.g., via BeyondCorp) or IP ranges.

Answer

Create an egress rule in the service perimeter that allows the analysts to leave the perimeter

Answer

Assign the analysts the roles/bigquery.user role

Answer

Enable dry-run mode on the perimeter

Question 15

A company wants to deploy a web application with a global load balancer and needs to configure SSL/TLS termination. They want to use a certificate from their own CA and have the ability to manage multiple certificates for different domains. Which THREE steps should they take?

Accepted Answer

Ensure the certificate chain includes intermediate CA certificates. To use self-managed certificates with a load balancer, you can upload the PEM file directly to the load balancer, or use Certificate Manager to manage multiple certificates. The steps: create a Certificate Manager certificate resource with your PEM, map it to the load balancer target, and ensure the certificate is properly uploaded. Self-managed certificates require manual renewal, so you need to monitor expiration.

Answer

Set up a Cloud DNS zone with DNSSEC

Answer

Use a Google-managed certificate for automatic renewal