PCSE Configuring Network Security Practice Test 9 — 15 Questions

Question 1

An engineer needs to allow HTTP traffic from instances tagged 'web-server' to instances tagged 'app-server' on port 8080 within the same VPC. Which firewall rule should be created?

Accepted Answer

Ingress rule for 'app-server' with source tag 'web-server' allowing tcp:8080. Create an ingress rule targeting 'app-server' that allows tcp:8080 from source tag 'web-server'. Tags are used for both source and target to control traffic between instance groups.

Answer

Egress rule from 'web-server' to 'app-server' allowing tcp:8080

Answer

Ingress rule for 'web-server' with source tag 'app-server' allowing tcp:8080

Answer

Egress rule for 'app-server' with destination tag 'web-server' allowing tcp:8080

Question 2

Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?

Accepted Answer

Adaptive Protection. Adaptive Protection is the Cloud Armor capability that applies machine learning to model normal traffic to a backend service and detect deviations indicative of Layer 7 DDoS attacks. It then suggests or enforces rules to block the anomalous sources. This is the only Cloud Armor feature explicitly built on ML for DDoS detection.

Answer

Security policies

Answer

Rate limiting

Answer

Preconfigured WAF rules

Question 3

An organization uses Certificate Manager to provision SSL certificates for multiple domains across several load balancers. They want to automate certificate renewal. Which type of certificate should be used?

Accepted Answer

Google-managed certificates with DNS authorization. Google-managed certificates with DNS authorization are automatically provisioned, renewed, and rotated by Google when the domain's DNS records are configured with the required CNAME or A records. This eliminates manual renewal overhead and is the recommended approach for automating certificate lifecycle management across multiple load balancers.

Answer

Wildcard certificates purchased from a third-party CA

Answer

Self-managed certificates uploaded as PEM files

Answer

Certificates from a private CA

Question 4

A company wants to prevent data exfiltration by restricting access to Google APIs from only authorized VPC networks. They also need to allow a specific on-premises IP range to access BigQuery. Which TWO services should be used together? (Choose 2)

Accepted Answer

Access levels (IP-based). VPC Service Controls (E) is the service designed to define a service perimeter around Google Cloud services such as BigQuery, preventing data exfiltration by restricting access to only authorized VPC networks and projects. Access levels (B) are the mechanism used within VPC Service Controls to define IP-based conditions, so a specific on-premises IP range can be allowed to reach BigQuery inside the perimeter. Together, VPC Service Controls enforces the perimeter while the IP-based access level grants the on-premises range the required access. Cloud Armor (A) is an edge WAF/DDoS protection for HTTP(S) load balancers and does not govern API access to BigQuery. Hierarchical firewall policy (C) filters network traffic at the VPC level but cannot restrict Google API access or data exfiltration. Private Service Connect (D) provides private connectivity to services but does not enforce access restrictions or IP-based authorization for BigQuery.

Answer

Cloud Armor

Answer

Hierarchical firewall policy

Answer

Private Service Connect

Question 5

A company wants to restrict access to Cloud Storage buckets so that only resources in a specific VPC network can reach them, and data cannot be exfiltrated to other networks. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls creates a security perimeter around Google Cloud services like Cloud Storage, enforcing that access is only allowed from within the defined perimeter (e.g., a specific VPC network). It prevents data exfiltration by blocking access from outside the perimeter, even if IAM permissions would otherwise allow it. This directly addresses the requirement to restrict access to only resources in a specific VPC network and prevent data movement to other networks.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Armor

Answer

VPC Firewall Rules

Question 6

An organization has a hub-and-spoke VPC setup with Shared VPC. The security team wants to enforce a rule that all egress traffic from any project in the organization must pass through a central inspection appliance in the hub VPC. Which firewall configuration approach meets this requirement?

Accepted Answer

Set up a default route in each spoke VPC that sends egress traffic to the inspection appliance in the hub, and use firewall rules to allow only that traffic.. The correct approach is to set up a default route in each spoke VPC that sends egress traffic to the inspection appliance in the hub, and use firewall rules to allow only that traffic. This ensures all egress traffic is forced through the central inspection appliance, meeting the security requirement.

Answer

Use VPC firewall rules with a deny-all egress rule, then allow egress only from instances running in the hub VPC.

Answer

Configure private Google Access and VPC Service Controls to restrict egress.

Answer

Create a hierarchical firewall policy that denies all egress traffic unless it has a specific tag.

Question 7

A company wants to expose an internal web service running on a private GKE cluster to other services within the same VPC network using a private IP address. They do not want to use a public load balancer. Which Google Cloud service should they use?

Accepted Answer

Internal load balancer. An Internal Load Balancer in Google Cloud provides a private IP address within the VPC and distributes traffic to backend services like those running on a private GKE cluster. It is the correct choice for exposing an internal service to other services in the same VPC without using a public load balancer.

Answer

Cloud NAT

Answer

Private Service Connect

Answer

Cloud VPN

Question 8

A security engineer needs to block traffic from all IP addresses in a specific geographic region from reaching an HTTPS load-balanced application. The application uses Cloud Load Balancing with an external HTTPS load balancer. Which approach should the engineer use?

Accepted Answer

Create a Cloud Armor security policy with a geo-based deny rule and attach it to the load balancer.. Cloud Armor security policies can be attached to external HTTPS load balancers to filter traffic based on geolocation. The engineer can create a Cloud Armor security policy with a rule that uses the geo-tag to deny traffic from the specified region.

Answer

Create a VPC firewall rule that denies ingress from the region's IP ranges.

Answer

Use Identity-Aware Proxy (IAP) to block access based on the user's location.

Answer

Configure a Cloud CDN policy to block traffic from certain regions.

Question 9

A company wants to use a Google-managed SSL certificate for their external HTTPS load balancer. Which step is required to provision the certificate?

Accepted Answer

Create a DNS record for the domain that resolves to the load balancer's IP address.. Google-managed SSL certificates are provisioned by creating a certificate resource and then pointing a DNS record (A/AAAA) for the domain to the load balancer's IP address. Google validates domain ownership via the DNS record and provisions the certificate automatically once the domain resolves to the load balancer.

Answer

Install the certificate on each backend instance.

Answer

Submit a Certificate Signing Request (CSR) to Google.

Answer

Upload the private key and certificate in PEM format.

Question 10

A company uses Cloud Armor Managed Protection Plus to protect their applications. They want to automatically block IP addresses that are identified as malicious by adaptive protection. How should they configure this?

Accepted Answer

Enable 'auto-deploy' in the adaptive protection configuration.. Cloud Armor Adaptive Protection, when part of Managed Protection Plus, can be configured with 'auto-deploy' so that when it detects an anomalous Layer 7 attack (e.g., a sudden spike from a set of IPs), it automatically creates and attaches a pre-configured WAF rule to the target backend service. This removes the need for manual triage and shrinks the response window from minutes to seconds. The auto-deploy option is the only mechanism that natively blocks adaptive-protection-identified IPs without human intervention.

Answer

Manually review adaptive protection alerts and create deny rules.

Answer

Use the 'rate limiting' rule to block high-traffic IPs.

Answer

Set up a Cloud Function to parse logs and create rules via API.

Question 11

An organization needs to enforce a TLS minimum version of 1.2 for all traffic to their HTTPS load balancers. They have multiple load balancers serving different domains. Which Google Cloud feature should they use?

Accepted Answer

Create an SSL policy with TLS 1.2 as the minimum version and attach it to the target HTTPS proxy.. In Google Cloud, an SSL policy defines the minimum TLS version and the allowed cipher suites. It is attached to a target HTTPS proxy (or target SSL proxy), which is the component that terminates TLS for external HTTPS load balancers. Creating an SSL policy with TLS 1.2 as the minimum and attaching it to each target HTTPS proxy enforces the requirement across all load balancers serving the domains.

Answer

Use a global network endpoint group (NEG) with an SSL policy.

Answer

Create a Cloud Armor security policy with a rule to block TLS 1.0 and 1.1.

Answer

Configure the backend instances to reject TLS 1.0 and 1.1 connections.

Question 12

A security team wants to detect and block network-based threats such as malware and command-and-control traffic within their VPC. They need a managed service that provides deep packet inspection. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with packet mirroring to analyze traffic.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 13

A company has a VPC Service Controls perimeter that includes BigQuery and Cloud Storage. They need to allow a specific on-premises application (with a static IP) to access a BigQuery dataset within the perimeter. Which configuration should they use?

Accepted Answer

Add the on-premises IP to an access level and create an ingress rule in the service perimeter.. VPC Service Controls perimeters block access from outside the perimeter unless an explicit ingress rule is configured. To allow a specific on-premises application with a static IP, you must create an access level that includes that IP and then add an ingress rule to the service perimeter that permits access from that access level to the BigQuery resources. This is the only supported mechanism for granting external access into a VPC SC perimeter.

Answer

Create a VPC firewall rule allowing ingress from the on-premises IP to the BigQuery API.

Answer

Exempt the on-premises service account from the perimeter.

Answer

Use Private Google Access from the on-premises network.

Question 14

A company uses Cloud Armor to protect a web application. They want to block requests that contain SQL injection patterns based on the OWASP ModSecurity Core Rule Set. Which preconfigured rule set should they enable?

Accepted Answer

OWASP ModSecurity CRS. Google Cloud Armor provides a preconfigured WAF rule set called 'OWASP ModSecurity Core Rule Set' (CRS) that includes rules to detect and block SQL injection, cross-site scripting, and other OWASP Top 10 attacks. Enabling this rule set applies the ModSecurity CRS signatures to incoming requests, satisfying the requirement to block SQL injection patterns based on OWASP CRS.

Answer

Custom rules using CEL expression

Answer

Google Cloud Armor Managed Rules (SQL Injection)

Answer

Rate limiting rules

Question 15

A company is designing a secure multi-tenant environment in Google Cloud. Each tenant has its own VPC network and resources. The security team wants to centrally enforce a rule that denies all egress traffic to the internet from tenant VPCs, except for traffic to specific trusted IP ranges for software updates. They also want to ensure that tenant admins cannot override this rule. Which two actions should they take? (Choose two.)

Accepted Answer

Create a hierarchical firewall policy at the folder level that denies egress to 0.0.0.0/0 except for the trusted IP ranges.. Option A is correct because a hierarchical firewall policy attached at the folder level is inherited by all tenant projects beneath that folder, allowing the security team to centrally enforce a deny-egress rule to 0.0.0.0/0 with exceptions for the trusted update IP ranges, and hierarchical policies take precedence over lower-level rules. Option B is correct because hierarchical firewall policies are governed by IAM permissions such as compute.firewallPolicies.create, update, and delete at the organization or folder level; withholding these from tenant admins ensures they cannot modify or override the centrally enforced policy. Option C is incorrect because granting compute.securityAdmin would give tenant admins the ability to manage security policies, undermining the goal of preventing them from overriding the rule. Option D is incorrect because VPC Service Controls create service perimeters to restrict data access and exfiltration for supported APIs, not to deny general internet egress traffic. Option E is incorrect because individual VPC firewall rules in each tenant project could be modified by tenant admins and do not provide the centralized, non-overridable enforcement required.

Answer

Grant tenant admins the compute.securityAdmin role to manage firewall rules.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Create a VPC firewall rule in each tenant project to deny egress traffic.