PCSE Configuring Network Security Practice Test 7 — 15 Questions

Question 1

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only resources within a specific VPC network can call these APIs, and no traffic from other VPCs or on-premises networks is allowed. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that restrict access to Google Cloud APIs based on the requesting network's context. This prevents data exfiltration and ensures only resources in the specified VPC can access the APIs.

Answer

Firewall Rules

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 2

A security engineer needs to configure firewall rules to allow traffic from a set of compute instances to a set of backend instances. The engineer wants to use a method that is more secure and scalable than using network tags. Which approach should they use?

Accepted Answer

Use firewall rules with source service accounts and target service accounts. Service accounts as firewall rule targets are preferred over network tags because they are immutable, tied to the identity of the instance, and reduce dependency on tag management. This approach is more secure and scalable.

Answer

Use hierarchical firewall policies

Answer

Use firewall rules with source tags and target tags

Answer

Use network firewall policies

Question 3

A company wants to allow users from a specific on-premises IP range to access a service deployed on Google Cloud, but only if the user's device is compliant with corporate security policies (e.g., has antivirus enabled). Which combination of services can achieve this?

Accepted Answer

VPC Service Controls with an access level that includes IP and device conditions. VPC Service Controls access levels can combine IP-based conditions with device-based conditions (e.g., using BeyondCorp Enterprise). This allows restricting access to a service perimeter based on both the user's IP and device compliance.

Answer

Firewall rules with source ranges and service accounts

Answer

Cloud Armor with geo-based access control

Answer

Cloud IDS with threat detection

Question 4

A company has set up a VPC Service Controls perimeter that includes Cloud Storage. They want to allow a specific on-premises server to copy data to a Cloud Storage bucket inside the perimeter. The on-premises server uses an external IP address. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter that allows the on-premises IP range. In VPC Service Controls, ingress rules allow traffic from outside the perimeter to access resources inside. To allow an on-premises server with an external IP, an ingress rule from all identities (or the specific identity) using the source IP range of the on-premises server must be configured. This allows the server to cross the perimeter.

Answer

Configure a firewall rule allowing traffic from the on-premises IP to Cloud Storage

Answer

Add the on-premises server's IP to the access level of the perimeter

Answer

Create an egress rule in the service perimeter that allows the on-premises IP range

Question 5

A company wants to use a Google Cloud load balancer with an SSL certificate that is automatically provisioned and renewed. Which type of certificate should they use?

Accepted Answer

Google-managed certificate. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for use with load balancers. This is the simplest option for automatic management.

Answer

Certificate Manager with a self-managed certificate

Answer

Certificate Authority Service

Answer

Self-managed certificate

Question 6

A security engineer needs to block traffic to a set of VMs from specific IP addresses and also apply rate limiting for HTTP traffic. The VMs are behind a global external HTTPS load balancer. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor security policies can be attached to load balancers to provide WAF capabilities, including IP allow/deny lists and rate limiting. This is the appropriate service for this scenario.

Answer

Cloud IDS

Answer

VPC firewall rules

Answer

Network firewall policies

Question 7

A company wants to provide private connectivity from its on-premises network to Google Cloud APIs (e.g., BigQuery, Cloud Storage) without traversing the public internet. They have an existing Dedicated Interconnect connection. Which solution should they use?

Accepted Answer

Private Service Connect. Private Service Connect (PSC) allows private access to Google APIs via private endpoints using internal IP addresses. With Dedicated Interconnect, on-premises traffic can reach these endpoints without going over the internet.

Answer

Cloud NAT

Answer

Cloud VPN with VPC peering

Answer

VPC Service Controls

Question 8

An organization has a hierarchical firewall policy at the organization level that denies all ingress traffic from the internet. A project team needs to allow HTTP traffic from the internet to a specific VM. How should they achieve this?

Accepted Answer

Create a project-level hierarchical firewall policy with a rule allowing HTTP from 0.0.0.0/0 and a lower priority number than the org-level deny. Hierarchical firewall policies cannot be overridden at lower levels; they are always evaluated first. Since the org-level policy denies all internet ingress, the only way to allow HTTP is to create a hierarchical policy at a lower level (folder or project) that allows it, but those are also part of the hierarchy and are evaluated after org-level. Actually, hierarchical policies can be overridden by a lower-level policy with a higher priority, but the org-level policy has no higher priority? In GCP, hierarchical firewall policies are evaluated in order of precedence: organization > folder > project. A policy at a lower level can override a higher-level policy if it has a higher priority (lower number) and is an allow rule. So the project team can create a project-level hierarchical policy with a higher priority (e.g., 100) allowing HTTP from 0.0.0.0/0, which will override the org-level deny (priority 1000).

Answer

Add a VPC firewall rule allowing HTTP from 0.0.0.0/0

Answer

Remove the VM from the organization hierarchy

Answer

Use Cloud Armor to allow the traffic

Question 9

A company wants to detect and alert on potential network threats, such as malware and command-and-control traffic, within their VPC. They need a managed service that integrates with packet mirroring. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed network threat detection service that uses packet mirroring to inspect traffic for threats. It is powered by Palo Alto Networks.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 10

A company's security policy requires that all traffic to a Google Cloud load balancer use TLS 1.2 or higher and only accept strong ciphers. They want to enforce this using a Google Cloud resource. Which resource should they configure?

Accepted Answer

SSL policy. SSL policies on HTTPS load balancers allow you to specify the minimum TLS version and cipher profile (e.g., RESTRICTED for strong ciphers). This enforces encryption requirements at the load balancer level.

Answer

Cloud Armor security policy

Answer

Network firewall rule

Answer

SSL certificate

Question 11

A company wants to protect a web application hosted on Google Cloud from common web attacks like SQL injection and cross-site scripting (XSS). They have deployed a global external HTTPS load balancer. Which TWO services or configurations should they use?

Accepted Answer

Cloud Armor security policy with OWASP ModSecurity CRS rule set. Cloud Armor provides WAF capabilities with preconfigured rules for OWASP Top 10 threats, including SQLi and XSS. Additionally, using an HTTPS load balancer ensures encrypted traffic. For this question, the correct answers are Cloud Armor and enabling HTTPS (which is already done). But since the load balancer is already HTTPS, the focus is on Cloud Armor. The other options: Cloud IDS is for network threat detection, not WAF; VPC Service Controls is for API access control; SSL policy is for TLS settings.

Answer

SSL policy with RESTRICTED profile

Answer

VPC Service Controls

Answer

Cloud IDS

Question 12

An organization wants to use VPC Service Controls to protect BigQuery data. They need to allow a group of data analysts to access BigQuery from outside the perimeter (e.g., from their laptops) while maintaining the perimeter for all other users. Which TWO configurations are necessary?

Accepted Answer

Define an access level that includes the analysts' identities or IPs. To allow specific users to access a service from outside the perimeter, you must create an access level that identifies those users (e.g., by IP range or device) and then create an ingress rule that permits traffic from that access level to BigQuery. The access level can be based on user identity (e.g., via BeyondCorp) or IP ranges.

Answer

Create an egress rule in the service perimeter that allows the analysts to leave the perimeter

Answer

Assign the analysts the roles/bigquery.user role

Answer

Enable dry-run mode on the perimeter

Question 13

A company wants to deploy a web application with a global load balancer and needs to configure SSL/TLS termination. They want to use a certificate from their own CA and have the ability to manage multiple certificates for different domains. Which THREE steps should they take?

Accepted Answer

Ensure the certificate chain includes intermediate CA certificates. To use self-managed certificates with a load balancer, you can upload the PEM file directly to the load balancer, or use Certificate Manager to manage multiple certificates. The steps: create a Certificate Manager certificate resource with your PEM, map it to the load balancer target, and ensure the certificate is properly uploaded. Self-managed certificates require manual renewal, so you need to monitor expiration.

Answer

Set up a Cloud DNS zone with DNSSEC

Answer

Use a Google-managed certificate for automatic renewal

Question 14

A security engineer is designing a network security architecture for a multi-project environment. They need to enforce a baseline set of firewall rules across all projects in the organization, but allow individual project teams to add their own specific rules. Which TWO components should they use?

Accepted Answer

Project-level VPC firewall rules. Hierarchical firewall policies can be applied at the organization level to enforce baseline rules. These policies are inherited by all projects. Individual project teams can then create their own VPC firewall rules (or project-level hierarchical policies) that are evaluated after the org-level policies, allowing them to add specific rules without overriding the baseline.

Answer

Network firewall policy

Answer

Shared VPC

Answer

Cloud Armor security policy

Question 15

A company wants to use Private Service Connect to publish a managed service (e.g., a custom application) so that consumers can access it privately within Google Cloud. Which THREE resources are involved in this setup?

Accepted Answer

PSC endpoint (forwarding rule). Private Service Connect involves creating a service attachment on the producer side (the managed service), which is then accessible via a PSC endpoint in the consumer's VPC. DNS configuration is needed to resolve the endpoint's IP address. IAM roles control who can create endpoints.

Answer

Cloud NAT gateway

Answer

VPC peering