PCSE Configuring Network Security Practice Test 7 — 15 Questions

Question 1

An organization uses VPC Service Controls to protect BigQuery datasets. They need to allow a specific on-premises application, which uses a static IP address, to query a BigQuery dataset inside the service perimeter. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an ingress rule in the service perimeter with the on-premises IP as the source. VPC Service Controls allow ingress rules to permit traffic from specific IP ranges into a perimeter. By creating an ingress rule that allows the on-premises IP and specifies the BigQuery API, the on-premises application can access the dataset.

Answer

Create a Cloud Armor rule to allow the on-premises IP

Answer

Use Private Google Access for the on-premises network

Answer

Add the on-premises IP to an access level and create an egress rule

Question 2

A web application behind an HTTPS load balancer is experiencing a high volume of malicious requests with SQL injection patterns. The security team wants to block these requests with minimal latency impact. Which Cloud Armor feature should they use?

Accepted Answer

Preconfigured WAF rules (OWASP ModSecurity CRS). Cloud Armor's preconfigured WAF rules are based on the OWASP ModSecurity Core Rule Set and are designed to detect and block common web attacks like SQL injection and XSS with minimal configuration and low latency. They run at the edge on the load balancer, so malicious requests are dropped before reaching the backend. This directly addresses the requirement to block SQL injection with minimal latency impact.

Answer

Rate limiting per IP

Answer

Custom rules with CEL expressions

Answer

Adaptive Protection

Question 3

An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?

Accepted Answer

The DNS CNAME record for domain validation is misconfigured or missing. Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.

Answer

The load balancer's frontend IP address has changed

Answer

The certificate has reached its maximum validity period

Answer

The load balancer's SSL policy requires a minimum TLS version that the managed certificate does not support

Question 4

A security engineer needs to monitor network traffic for potential threats in a VPC. They want to inspect all traffic for malware signatures and alert on high-severity threats. The solution should be natively integrated with GCP. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS is Google Cloud's native intrusion detection service that inspects VPC traffic for malware, spyware, and command-and-control signatures, and generates alerts in Security Command Center. It is purpose-built for the requirement to inspect all traffic for malware signatures and alert on high-severity threats with native GCP integration.

Answer

VPC Flow Logs

Answer

Security Command Center

Answer

Cloud Armor

Question 5

A company wants to enforce that traffic between two projects in the same organization must go through a central inspection VPC. They need a firewall rule that denies all traffic between the projects except through the inspection VPC. Which type of firewall rule should they use?

Accepted Answer

Hierarchical firewall policy at the folder level. A hierarchical firewall policy applied at the folder level lets an organization enforce rules that cascade to all projects beneath it, so a deny rule between the two projects (with an allow for traffic routed via the inspection VPC) is applied uniformly without per-project configuration drift. This is the intended GCP mechanism for org-wide network security guardrails.

Answer

Cloud IDS

Answer

VPC Service Controls

Answer

Network firewall rules in each project

Question 6

A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?

Accepted Answer

Create a new SSL certificate resource with the new certificate and key, then update the target HTTPS proxy to use it. To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.

Answer

Use gcloud compute ssl-certificates update to replace the certificate

Answer

Update the existing SSL certificate resource with the new certificate and key

Answer

Delete the existing certificate and upload the new one with the same name

Question 7

A security team wants to block all incoming traffic from a specific country to their web application behind a global HTTPS load balancer. They also need to allow traffic from all other countries. Which Cloud Armor feature should be used?

Accepted Answer

Custom rule with geo-based condition. Cloud Armor custom rules support geo-based conditions using the origin.ip or, more precisely, the 'origin.region_code' expression, which maps to ISO 3166-1 alpha-2 country codes. A custom rule with a geo-based condition and a deny action (priority lower than the allow-all rule) blocks traffic from the specified country while allowing all others. This is the standard Cloud Armor pattern for country-level filtering on a global external HTTPS load balancer.

Answer

Rate limiting

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Question 8

A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)

Accepted Answer

Attach the SSL policy to the target HTTPS proxy. To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.

Answer

Enable Cloud Armor WAF rules

Answer

Set the SSL policy to COMPATIBLE profile

Answer

Use a Google-managed SSL certificate

Question 9

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only requests originating from a specific VPC network are allowed. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls creates a service perimeter around Google Cloud APIs (BigQuery, Cloud Storage, etc.) and enforces that requests to those APIs originate from within authorized VPC networks, projects, or identities. It is the only service in the list designed specifically to restrict API access based on VPC network origin.

Answer

Private Service Connect

Answer

VPC firewall rules

Answer

Cloud Armor

Question 10

A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?

Accepted Answer

Hierarchical firewall policies. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network. VPC firewall rules are per project and can be overridden.

Answer

VPC firewall rules

Answer

Network firewall policies

Answer

Cloud Armor security policies

Question 11

An engineer wants to allow egress traffic from a group of VM instances with a specific service account to a set of IP addresses. They need to choose between using tags or service accounts as targets in a VPC firewall rule. Which approach is recommended for better security and why?

Accepted Answer

Use service accounts because they are managed by IAM and provide a stronger identity-based security model.. Service account targets are preferred because they are more secure. Tags can be added or removed by anyone with compute.instances.setTags permission, while service accounts are managed centrally with IAM. Using service accounts ensures that the firewall rule applies based on the identity of the VM, which is harder to spoof.

Answer

Use tags because they are easier to manage and provide the same level of security as service accounts.

Answer

Use target tags with a network tag that is automatically assigned by a management tool.

Answer

Either is acceptable; Google recommends using tags for simplicity.

Question 12

An organization wants to provide private, on-premises access to Google Cloud APIs (e.g., Cloud Storage, BigQuery) without traversing the public internet. They have a Direct Connect link to Google Cloud. Which solution should they implement?

Accepted Answer

Private Service Connect. Private Service Connect allows you to create private endpoints to access Google APIs (like googleapis.com) using internal IP addresses, without going over the internet. It works with Direct Connect or VPN. VPC Service Controls restrict access but do not provide private connectivity. Cloud NAT provides outbound internet access, not private API access. Private Google Access enables on-premises access to Google APIs via on-premises DNS, but it still uses public IPs unless combined with Private Service Connect.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Private Google Access

Question 13

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They want Google to manage the certificate lifecycle. Which certificate type should they use?

Accepted Answer

Google-managed certificate. Google-managed certificates are provisioned, deployed, and renewed automatically by Google for use with external HTTPS load balancers. Google handles the entire lifecycle including renewal, which is exactly what the company wants.

Answer

Self-managed certificate

Answer

Upload a certificate via the Cloud Load Balancing UI

Answer

Certificate Manager with a self-managed certificate

Question 14

A company is using Cloud Armor with adaptive protection enabled. They notice that adaptive protection has generated a rule that is blocking some legitimate traffic. What should they do to minimize false positives while still benefiting from adaptive protection?

Accepted Answer

Add a higher-priority allow rule for the legitimate traffic. To minimize false positives while still benefiting from adaptive protection, the best approach is to add a higher-priority allow rule for the legitimate traffic. This ensures that the legitimate traffic is not blocked by the adaptive protection rule, while the adaptive protection continues to protect against actual attacks.

Answer

Disable adaptive protection immediately

Answer

Increase the sensitivity threshold of adaptive protection

Answer

Change the adaptive protection rule action to 'throttle'

Question 15

An organization has multiple VPC networks in different projects. They need to centrally manage firewall rules that apply to all VPCs in the organization and ensure that project owners cannot override them. Which solution should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks. They cannot be overridden by lower-level firewall rules. This is the correct solution for centralized, unoverrideable rules. Network firewall policies are scoped to a single VPC network.

Answer

Create a network firewall policy and attach it to each VPC network

Answer

Use Cloud Armor security policies with the load balancers

Answer

Use VPC firewall rules with tags applied to all VMs across projects