How should I use these Implementing network security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Implementing network security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Implementing network security domain.

PCNE · topic practice

Implementing network security practice questions

Practise Google Professional Cloud Network Engineer Implementing network security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Implementing network security

Practice 10 questions Browse domain →

What the exam tests

What to know about Implementing network security

Implementing network security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Implementing network security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Implementing network security questions

20 questions · select your answer, then reveal the explanation

Question 1hardmulti select

Read the full NAT/PAT explanation →

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Trap 1: Ensure the VMs have a default route (0.0.0.0/0) with next hop set…

Incorrect. The default route (0.0.0.0/0) must point to the internet gateway, not to the Cloud NAT gateway's subnet. Cloud NAT does not require a route to the NAT subnet.

Trap 2: Configure IAM conditions on the Cloud NAT resource to restrict…

Incorrect. Cloud NAT does not use IAM conditions to restrict which VMs can use it; it relies on subnet or tag associations.

Study all Implementing network security common traps →

A
Ensure the VMs have a default route (0.0.0.0/0) with next hop set to the Cloud NAT gateway's subnet
Why wrong: Incorrect. The default route (0.0.0.0/0) must point to the internet gateway, not to the Cloud NAT gateway's subnet. Cloud NAT does not require a route to the NAT subnet.
B
Configure IAM conditions on the Cloud NAT resource to restrict which VMs can use it
Why wrong: Incorrect. Cloud NAT does not use IAM conditions to restrict which VMs can use it; it relies on subnet or tag associations.
C
Enable VPC Flow Logs on the subnet to monitor which NAT IPs are used
Correct. Enabling VPC Flow Logs on the subnet allows you to monitor and audit which NAT IPs are used by the VMs.
D
Create a separate Cloud NAT gateway with the desired IPs and associate it with the VMs via a subnet or tags
Correct. Creating a separate Cloud NAT gateway with the desired IPs and associating it with the VMs (via subnet or tags) ensures they use specific IPs.
E
Configure VPC firewall rules to allow egress from the VMs to the internet
Correct. Without a firewall rule allowing egress to the internet, outbound traffic from the VMs would be blocked, and NAT would not function.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Implementing network security explanation →

An organization uses VPC Service Controls to protect Google Cloud APIs. They need to allow a specific service account in a peripheral project to access a managed service in a protected service perimeter. What should they configure?

Trap 1: IAM conditions on the service account.

IAM conditions are not used for VPC SC perimeters.

Trap 2: Access levels in VPC Service Controls.

Access levels apply to user identities, not service accounts.

Trap 3: Private Google Access.

Private Google Access is for on-premises access to Google APIs, not for VPC SC.

Study all Implementing network security common traps →

A
IAM conditions on the service account.
Why wrong: IAM conditions are not used for VPC SC perimeters.
B
Access levels in VPC Service Controls.
Why wrong: Access levels apply to user identities, not service accounts.
C
Private Google Access.
Why wrong: Private Google Access is for on-premises access to Google APIs, not for VPC SC.
D
Ingress and egress rules in the perimeter.
Ingress/egress rules grant access to specific service accounts from outside the perimeter.

Full breakdown with real-world context →

Question 3mediummulti select

Read the full NAT/PAT explanation →

Which TWO of the following are benefits of using Cloud NAT?

Trap 1: Allows instances to receive incoming connections from the internet.

Incorrect: Cloud NAT is outbound-only; it does not allow incoming connections from the internet. For inbound access, a load balancer or other service is needed.

Trap 2: Provides static external IP for outbound traffic.

Incorrect: By default, Cloud NAT uses ephemeral external IPs. While it can be configured with static IPs via Cloud Router, this is not an automatic benefit.

Trap 3: Integrates with IAP for SSH access.

Incorrect: Cloud NAT does not integrate with IAP for SSH access. IAP is a separate service for controlling access to VM instances via SSH or RDP.

Study all Implementing network security common traps →

A
Enables instances without public IPs to access the internet.
Correct: Cloud NAT allows private instances without public IPs to initiate outbound connections to the internet. This is a primary benefit.
B
Automatically scales with the number of instances.
Correct: Cloud NAT gateways are managed by Google and scale automatically based on traffic, eliminating the need for manual provisioning.
C
Allows instances to receive incoming connections from the internet.
Why wrong: Incorrect: Cloud NAT is outbound-only; it does not allow incoming connections from the internet. For inbound access, a load balancer or other service is needed.
D
Provides static external IP for outbound traffic.
Why wrong: Incorrect: By default, Cloud NAT uses ephemeral external IPs. While it can be configured with static IPs via Cloud Router, this is not an automatic benefit.
E
Integrates with IAP for SSH access.
Why wrong: Incorrect: Cloud NAT does not integrate with IAP for SSH access. IAP is a separate service for controlling access to VM instances via SSH or RDP.

Full breakdown with real-world context →

Question 4easymultiple choice

Review the full subnetting walkthrough →

A company wants to restrict SSH access to a VM instance to only a specific subnet (10.0.1.0/24) and allow all traffic from the health check ranges (130.211.0.0/22 and 35.191.0.0/16) for load balancing. Which firewall rule configuration should be used for the SSH rule?

Trap 1: Create a rule allowing SSH from 0.0.0.0/0 and apply a tag to the VM.

This allows SSH from anywhere, which is not secure.

Trap 2: Create a rule allowing SSH from 10.0.1.0/24 and another rule…

Health check ranges do not need SSH; they use HTTP/HTTPS.

Trap 3: Create a rule allowing SSH only from health check ranges and deny…

This would block SSH from the subnet.

Study all Implementing network security common traps →

A
Create a rule allowing SSH from 0.0.0.0/0 and apply a tag to the VM.
Why wrong: This allows SSH from anywhere, which is not secure.
B
Create a rule allowing SSH from 10.0.1.0/24 and another rule allowing SSH from health check ranges.
Why wrong: Health check ranges do not need SSH; they use HTTP/HTTPS.
C
Create a rule with source ranges 10.0.1.0/24, 130.211.0.0/22, 35.191.0.0/16, protocol tcp:22, and target tag 'ssh-allowed'.
This rule correctly restricts SSH to the subnet and health check ranges.
D
Create a rule allowing SSH only from health check ranges and deny all other traffic.
Why wrong: This would block SSH from the subnet.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full NAT/PAT explanation →

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

Trap 1: The VM is in a different zone than the Cloud NAT gateway

Cloud NAT is regional and works for all zones within that region.

Trap 2: The VPC firewall rules are blocking outbound traffic from the VM to…

Firewall rules do not affect NAT translation; they control traffic flow.

Trap 3: Cloud Router is misconfigured and not advertising the Cloud NAT IP

Cloud Router is used for BGP, not for NAT translation.

Study all Implementing network security common traps →

A
The VM is in a different zone than the Cloud NAT gateway
Why wrong: Cloud NAT is regional and works for all zones within that region.
B
The VPC firewall rules are blocking outbound traffic from the VM to the Cloud NAT IP
Why wrong: Firewall rules do not affect NAT translation; they control traffic flow.
C
Cloud Router is misconfigured and not advertising the Cloud NAT IP
Why wrong: Cloud Router is used for BGP, not for NAT translation.
D
The VM has a custom route that does not use the default route through Cloud NAT
Traffic must match the default route to be source NATed by Cloud NAT.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Implementing network security explanation →

An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?

Trap 1: Enable Cloud NAT and configure a firewall rule to allow egress to…

Cloud NAT provides internet access, but for Google APIs Private Google Access is sufficient and more secure.

Trap 2: Configure a Service Directory endpoint and attach an IAM policy to…

Service Directory is not used for network access control to Cloud Storage.

Trap 3: Create a firewall rule allowing egress to the…

Firewall rule alone does not restrict access to a specific VPC; VPC Service Controls is needed.

Study all Implementing network security common traps →

A
Enable Cloud NAT and configure a firewall rule to allow egress to 0.0.0.0/0
Why wrong: Cloud NAT provides internet access, but for Google APIs Private Google Access is sufficient and more secure.
B
Configure a Service Directory endpoint and attach an IAM policy to the bucket allowing access only from that endpoint
Why wrong: Service Directory is not used for network access control to Cloud Storage.
C
Create a firewall rule allowing egress to the storage.googleapis.com service IP range and enable VPC flow logs
Why wrong: Firewall rule alone does not restrict access to a specific VPC; VPC Service Controls is needed.
D
Enable Private Google Access on the subnet and create a VPC Service Controls perimeter that includes the bucket project
Private Google Access enables internal IP access to Google APIs, and VPC Service Controls restricts access to the perimeter.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full VPN explanation →

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

Trap 1: Check the VM's OS firewall to see if it is blocking incoming traffic

The VM’s OS firewall operates at the host level, filtering traffic after it has already been decapsulated from the VPN tunnel and routed to the VM’s network interface. Since the tunnel is established but traffic fails to reach the VM, the issue likely lies in the cloud routing path—such as misconfigured GCP VPC firewall rules, incorrect static routes, or a missing dynamic route advertisement—which prevents packets from even arriving at the VM’s OS. This option is tempting because OS firewalls are a common cause of inbound traffic blocks in on-premises environments, and it would be the correct first check if the tunnel were confirmed to deliver packets to the VM’s internal IP but the application still did not respond.

Trap 2: Verify that the VPN tunnel is using the correct pre-shared key

If the tunnel is established, the PSK is correct.

Trap 3: Review Cloud Armor security policies that may be blocking the…

Cloud Armor applies to load-balanced traffic, not direct VPN traffic.

Study all Implementing network security common traps →

A
Check VPC firewall rules to ensure ingress traffic from the on-premises subnet is allowed to the VM
Firewall rules must allow traffic from the on-premises IP range to the VM's target tags or service account.
B
Check the VM's OS firewall to see if it is blocking incoming traffic
Why wrong: The VM’s OS firewall operates at the host level, filtering traffic after it has already been decapsulated from the VPN tunnel and routed to the VM’s network interface. Since the tunnel is established but traffic fails to reach the VM, the issue likely lies in the cloud routing path—such as misconfigured GCP VPC firewall rules, incorrect static routes, or a missing dynamic route advertisement—which prevents packets from even arriving at the VM’s OS. This option is tempting because OS firewalls are a common cause of inbound traffic blocks in on-premises environments, and it would be the correct first check if the tunnel were confirmed to deliver packets to the VM’s internal IP but the application still did not respond.
C
Verify that the VPN tunnel is using the correct pre-shared key
Why wrong: If the tunnel is established, the PSK is correct.
D
Review Cloud Armor security policies that may be blocking the traffic
Why wrong: Cloud Armor applies to load-balanced traffic, not direct VPN traffic.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Implementing network security explanation →

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

Trap 1: Deploy the Cloud SQL Auth Proxy on each VM and configure IAM…

This is secure but requires application configuration and is not a network-level solution.

Trap 2: Use Shared VPC and assign the specific VMs to a subnet with a…

Shared VPC does not provide per-VM isolation; any VM in the subnet could use that range.

Trap 3: Configure firewall rules in the hub project to allow traffic only…

VM internal IPs can change, and managing firewall rules for individual IPs is not scalable.

Study all Implementing network security common traps →

A
Deploy the Cloud SQL Auth Proxy on each VM and configure IAM permissions for each VM's service account
Why wrong: This is secure but requires application configuration and is not a network-level solution.
B
Use Shared VPC and assign the specific VMs to a subnet with a dedicated secondary IP range, then restrict database access to that range
Why wrong: Shared VPC does not provide per-VM isolation; any VM in the subnet could use that range.
C
Use Private Service Connect to publish the database as a managed service and create a Private Service Connect endpoint in the spoke VPC with IAM permissions for the specific VM service accounts
Private Service Connect provides per-service account authorization and network isolation.
D
Configure firewall rules in the hub project to allow traffic only from the specific VM internal IPs
Why wrong: VM internal IPs can change, and managing firewall rules for individual IPs is not scalable.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Implementing network security explanation →

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

Trap 1: Remove the deny rule for that region and rely on other security…

This would remove protection for that region entirely.

Trap 2: Remove all rules and add a single allow rule for the legitimate…

This would remove all other security rules.

Trap 3: Reorder the rules so that the deny rule is at the bottom of the list

Reordering does not change priority; only the priority number matters.

Study all Implementing network security common traps →

A
Remove the deny rule for that region and rely on other security measures
Why wrong: This would remove protection for that region entirely.
B
Add a new allow rule for that region with a lower priority number than the deny rule
Lower priority number means higher precedence, so the allow rule will be evaluated first.
C
Remove all rules and add a single allow rule for the legitimate region
Why wrong: This would remove all other security rules.
D
Reorder the rules so that the deny rule is at the bottom of the list
Why wrong: Reordering does not change priority; only the priority number matters.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Implementing network security explanation →

A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)

Trap 1: Create a firewall rule in the client VPC allowing egress to the…

Firewall rules are not managed by VPC Service Controls; they are separate.

Trap 2: Configure an IAM condition on the service account's roles to…

IAM conditions can be used but are not required; the perimeter itself restricts access.

Trap 3: Enable Private Google Access on the subnet where the service…

Private Google Access enables internal IP access to Google APIs but is not required for VPC Service Controls.

Study all Implementing network security common traps →

A
Add the project containing the service account to the VPC Service Controls perimeter
Accessible resources are limited to perimeters that include the client project.
B
Create a firewall rule in the client VPC allowing egress to the BigQuery API
Why wrong: Firewall rules are not managed by VPC Service Controls; they are separate.
C
Configure an IAM condition on the service account's roles to restrict access to the perimeter
Why wrong: IAM conditions can be used but are not required; the perimeter itself restricts access.
D
Grant the appropriate IAM roles (e.g., BigQuery Data Viewer) to the service account on the BigQuery dataset
Even with perimeter, the service account still needs IAM permissions to access the dataset.
E
Enable Private Google Access on the subnet where the service account's VMs are located
Why wrong: Private Google Access enables internal IP access to Google APIs but is not required for VPC Service Controls.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Implementing network security explanation →

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

Network Topology

Trap 1: The firewall rule allow-ssh is for the wrong network

The rule is for my-vpc, which matches the VM's VPC.

Trap 2: The firewall rule allow-ssh is disabled

The output shows DISABLED: False, meaning the rule is enabled.

Trap 3: The VM's external IP (34.67.89.10) is blocked by Cloud NAT

Cloud NAT is for outbound traffic, not inbound.

Study all Implementing network security common traps →

A
The firewall rule allow-ssh is missing a source IP range or has a source IP range that does not include the user's IP
If the rule does not specify sourceRanges, it defaults to 0.0.0.0/0, but if it was created with an incorrect source range, traffic from 203.0.113.5 would be blocked. The exhibit does not show sourceRanges, but a common misconfiguration is to set sourceRanges to an internal range.
B
The firewall rule allow-ssh is for the wrong network
Why wrong: The rule is for my-vpc, which matches the VM's VPC.
C
The firewall rule allow-ssh is disabled
Why wrong: The output shows DISABLED: False, meaning the rule is enabled.
D
The VM's external IP (34.67.89.10) is blocked by Cloud NAT
Why wrong: Cloud NAT is for outbound traffic, not inbound.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Implementing network security explanation →

Refer to the exhibit. A project has the IAM policy shown. Alice is trying to delete a VPC firewall rule but receives a permission error. What is the most likely reason?

Exhibit

{
  "bindings": [
    {
      "role": "roles/compute.securityAdmin",
      "members": [
        "user:alice@example.com"
      ]
    },
    {
      "role": "roles/compute.networkAdmin",
      "members": [
        "user:bob@example.com"
      ]
    }
  ]
}

Trap 1: The IAM policy has a condition that denies deletion after business…

The policy shown does not include any conditions.

Trap 2: An organization policy prevents deletion of firewall rules in this…

No evidence of an org policy in the exhibit.

Trap 3: Bob has the role roles/compute.networkAdmin, which does not include…

But Alice is the one trying to delete, not Bob.

Study all Implementing network security common traps →

A
Alice has the role roles/compute.securityAdmin, which should allow deletion; perhaps the rule is managed by another service
roles/compute.securityAdmin includes firewall rule deletion. If Alice still gets an error, it might be due to hierarchical policies or the rule being managed by another service like Firewall Insights.
B
The IAM policy has a condition that denies deletion after business hours
Why wrong: The policy shown does not include any conditions.
C
An organization policy prevents deletion of firewall rules in this project
Why wrong: No evidence of an org policy in the exhibit.
D
Bob has the role roles/compute.networkAdmin, which does not include permissions to delete firewall rules
Why wrong: But Alice is the one trying to delete, not Bob.

Full breakdown with real-world context →

Question 13hardmultiple choice

Review the full routing breakdown →

A company is designing a hub-and-spoke VPC architecture in Google Cloud. The hub VPC hosts a set of shared services, including a third-party firewall appliance (NGFW) in a managed instance group behind a TCP load balancer. Spoke VPCs need to send traffic to the hub's internal TCP load balancer IP (10.0.0.10) for inspection. The firewall appliance inspects traffic and forwards it to the final destination. The network team notices that traffic from one spoke to the load balancer is being dropped. They have verified that VPC peering is established, routes are propagated, and firewall rules allow the traffic. What is the most likely cause of the dropped traffic?

Trap 1: The spoke VPC's subnet routes are not advertised to the hub VPC via…

Incorrect. The stem states that routes are propagated, so the spoke subnet routes should be advertised to the hub. If they were not, it would contradict the verification. Moreover, the problem is with traffic to the load balancer, not return traffic.

Trap 2: The spoke VPC does not have a route to the hub's internal load…

Incorrect. The stem states that routes are propagated, meaning the spoke VPC should have a route to the hub's ILB IP via VPC peering.

Trap 3: The hub VPC uses Cloud NAT, which is not compatible with VPC…

Incorrect. Cloud NAT is used for outbound internet access and does not affect VPC peering or internal load balancing. It is compatible with VPC peering.

Study all Implementing network security common traps →

A
The spoke VPC's subnet routes are not advertised to the hub VPC via VPC peering.
Why wrong: Incorrect. The stem states that routes are propagated, so the spoke subnet routes should be advertised to the hub. If they were not, it would contradict the verification. Moreover, the problem is with traffic to the load balancer, not return traffic.
B
The spoke VPC does not have a route to the hub's internal load balancer IP via the peering connection.
Why wrong: Incorrect. The stem states that routes are propagated, meaning the spoke VPC should have a route to the hub's ILB IP via VPC peering.
C
The internal TCP load balancer's forwarding rule is misconfigured, pointing to the wrong target.
Correct. If the forwarding rule on the internal TCP load balancer points to the wrong target (e.g., a different instance group or an unresponsive backend), traffic will be dropped even though routing and firewall rules are correct.
D
The hub VPC uses Cloud NAT, which is not compatible with VPC peering.
Why wrong: Incorrect. Cloud NAT is used for outbound internet access and does not affect VPC peering or internal load balancing. It is compatible with VPC peering.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full Implementing network security explanation →

A company uses Identity-Aware Proxy (IAP) to secure access to a group of Compute Engine instances running a web application. The instances have no external IP addresses and are accessed via IAP TCP forwarding. Recently, the security team discovered that some users can access the instances directly via SSH from other instances within the same VPC, bypassing IAP. What is the most effective way to ensure all SSH access goes through IAP?

Trap 1: Assign a service account to each instance with the IAP-secured…

The IAP-secured Tunnel User role is granted to users, not instances.

Trap 2: Remove SSH keys from the instances and use OS Login.

OS Login still allows SSH access from within the VPC if firewall rules permit.

Trap 3: Create a new firewall rule that allows SSH only from the IAP IP…

Deleting the existing rule is not necessary; modifying it or adding a higher-priority deny rule is sufficient.

Study all Implementing network security common traps →

A
Modify the VPC firewall rule to deny ingress traffic on TCP port 22 from all sources except the IAP IP range (35.235.240.0/20).
This ensures only IAP can initiate SSH connections.
B
Assign a service account to each instance with the IAP-secured Tunnel User role.
Why wrong: The IAP-secured Tunnel User role is granted to users, not instances.
C
Remove SSH keys from the instances and use OS Login.
Why wrong: OS Login still allows SSH access from within the VPC if firewall rules permit.
D
Create a new firewall rule that allows SSH only from the IAP IP range and delete the existing SSH rule.
Why wrong: Deleting the existing rule is not necessary; modifying it or adding a higher-priority deny rule is sufficient.

Full breakdown with real-world context →

Question 15mediummulti select

Read the full NAT/PAT explanation →

A company is designing a secure multi-VPC architecture in Google Cloud. They have three VPCs: Production, Staging, and Shared Services. The Shared Services VPC hosts a Cloud NAT for outbound internet access and a set of managed instance groups. The Production and Staging VPCs are peered to the Shared Services VPC. The company wants to ensure that: (1) instances in Staging cannot initiate connections to instances in Production, (2) instances in Production cannot initiate connections to instances in Staging, (3) all VPCs can communicate with Shared Services, and (4) traffic between VPCs must be inspected by a firewall appliance in Shared Services. Which TWO actions should the company take?

Trap 1: Delete the VPC peering connection between the Staging and…

Deleting a peering connection that does not exist (the spokes are not directly peered) is irrelevant and does not satisfy any requirement.

Trap 2: Configure static routes in each spoke VPC with a next hop to the…

Static routes with a next hop to the firewall appliance's internal IP are invalid in the spoke VPCs because the IP belongs to a different VPC; the next hop must be a local resource or a VPN tunnel.

Trap 3: Remove the default route (0.0.0.0/0) from the spoke VPCs to prevent…

Removing the default route would disrupt internet access, not enforce inter-VPC traffic inspection.

Study all Implementing network security common traps →

A
Delete the VPC peering connection between the Staging and Production VPCs.
Why wrong: Deleting a peering connection that does not exist (the spokes are not directly peered) is irrelevant and does not satisfy any requirement.
B
Set up a Cloud VPN between each spoke VPC and the Shared Services VPC to enable transitive routing.
Cloud VPN between spoke and hub VPCs enables transitive routing, allowing the hub to forward traffic between spokes and route through a firewall appliance.
C
Configure static routes in each spoke VPC with a next hop to the firewall appliance's internal IP for the destination VPC's subnet ranges.
Why wrong: Static routes with a next hop to the firewall appliance's internal IP are invalid in the spoke VPCs because the IP belongs to a different VPC; the next hop must be a local resource or a VPN tunnel.
D
Remove the default route (0.0.0.0/0) from the spoke VPCs to prevent direct internet access.
Why wrong: Removing the default route would disrupt internet access, not enforce inter-VPC traffic inspection.
E
Enable the export of custom routes from the Shared Services VPC to the peered VPCs.
Why wrong: Exporting custom routes from the hub to the spokes does not create transitive routing; it only shares routes but does not allow forwarding between peered networks.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full NAT/PAT explanation →

A financial services company is deploying a new payment processing application in Google Cloud. The architecture consists of: a VPC named 'payment-vpc' with subnet 'payment-subnet' (10.1.0.0/16), a managed instance group (MIG) of backend servers in payment-subnet, an internal TCP load balancer (ILB) with IP 10.1.0.10 distributing traffic to the MIG, and a Cloud NAT for outbound internet access. The application must communicate with an external payment gateway over TLS. The security policy requires that all outbound traffic from the backend servers to the internet must egress through a single, centralized Cloud NAT instance to allow traffic inspection. To meet this requirement, the network team has configured: a Cloud Router, a Cloud NAT gateway named 'payment-nat' in payment-vpc, and a default route (0.0.0.0/0, next hop: default internet gateway) in payment-vpc. They have also configured VPC firewall rules to allow outbound HTTPS traffic. During testing, the backend servers cannot connect to the external payment gateway. The team has verified that the Cloud NAT is properly configured and that the VPC firewall rules allow egress traffic. What is the most likely cause of the connectivity failure?

Trap 1: The VPC firewall rules are blocking outbound HTTPS traffic from the…

The team has verified firewall rules allow egress traffic.

Trap 2: The Cloud NAT gateway is not in the same region as the backend…

Cloud NAT is regional and can be used by instances in any zone in that region; the region is likely correct.

Trap 3: The Cloud Router's BGP ASN is not properly configured.

BGP ASN is used for dynamic routing with on-premises networks; not required for Cloud NAT.

Study all Implementing network security common traps →

A
The VPC firewall rules are blocking outbound HTTPS traffic from the backend servers.
Why wrong: The team has verified firewall rules allow egress traffic.
B
The default route (0.0.0.0/0) with next hop 'default internet gateway' preempts the Cloud NAT route.
The default route sends traffic directly to the internet, bypassing Cloud NAT. Cloud NAT requires that the default route have a higher priority (lower number) than the automatically created route for Cloud NAT, or the default route must be removed.
C
The Cloud NAT gateway is not in the same region as the backend servers.
Why wrong: Cloud NAT is regional and can be used by instances in any zone in that region; the region is likely correct.
D
The Cloud Router's BGP ASN is not properly configured.
Why wrong: BGP ASN is used for dynamic routing with on-premises networks; not required for Cloud NAT.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full Implementing network security explanation →

A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?

Trap 1: Create an ingress firewall rule allowing all traffic from 0.0.0.0/0…

This would allow traffic from any source, not just the load balancer, exposing the instances.

Trap 2: Create an ingress firewall rule that denies all traffic except from…

The load balancer's frontend IP is a virtual IP and does not appear as the source IP in packets reaching the backend; this would not work.

Trap 3: Create an ingress firewall rule allowing traffic from the health…

This approach is not recommended because the load balancer's source IP ranges can vary and are not guaranteed; using service account filters is more reliable.

Study all Implementing network security common traps →

A
Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).
This ensures that only traffic from the load balancer's health check probes and the load balancer itself (via service account) reaches the backend instances.
B
Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.
Why wrong: This would allow traffic from any source, not just the load balancer, exposing the instances.
C
Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.
Why wrong: The load balancer's frontend IP is a virtual IP and does not appear as the source IP in packets reaching the backend; this would not work.
D
Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.
Why wrong: This approach is not recommended because the load balancer's source IP ranges can vary and are not guaranteed; using service account filters is more reliable.

Full breakdown with real-world context →

Question 18hardmulti select

Read the full Implementing network security explanation →

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

Trap 1: Configure firewall rules with stateful packet inspection disabled…

Firewall rules are stateful by default; disabling stateful inspection would break return traffic and is not a security best practice.

Trap 2: Use VPC Network Peering to isolate the sensitive workloads from…

VPC peering is for connectivity, not security isolation; it does not provide access controls.

Trap 3: Create a Cloud NAT gateway to filter inbound traffic from the…

Cloud NAT is used for outbound traffic from instances without external IPs, not for inbound filtering.

Study all Implementing network security common traps →

A
Enable Private Google Access on subnets that host instances without external IP addresses.
This allows instances to access Google APIs over the internal network, reducing exposure to the internet.
B
Configure firewall rules with stateful packet inspection disabled to maximize throughput.
Why wrong: Firewall rules are stateful by default; disabling stateful inspection would break return traffic and is not a security best practice.
C
Use VPC Service Controls to create a perimeter around the sensitive data stored in Cloud Storage and BigQuery.
VPC Service Controls help prevent data exfiltration by controlling access to Google Cloud services.
D
Use VPC Network Peering to isolate the sensitive workloads from other projects.
Why wrong: VPC peering is for connectivity, not security isolation; it does not provide access controls.
E
Create a Cloud NAT gateway to filter inbound traffic from the internet.
Why wrong: Cloud NAT is used for outbound traffic from instances without external IPs, not for inbound filtering.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full Implementing network security explanation →

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Grant IAM permissions to service project admins, create host…

This is incorrect because IAM permissions cannot be granted before the host project and service projects are set up; the host project must exist first.

Trap 2: Attach service projects to host project, create host project and…

This is incorrect because the host project must be created and Shared VPC enabled before service projects can be attached.

Trap 3: Create service projects first, then create host project and enable…

This is incorrect because service projects are created independently but must be attached to a host project that already exists and has Shared VPC enabled; creating them first does not affect order but the host project setup must precede attachment.

Study all Implementing network security common traps →

A
Create host project and enable Shared VPC, attach service projects to host project, grant IAM permissions to service project admins, service project admins create resources using shared subnets.
This is the correct order because Shared VPC must be enabled on the host project first, then service projects are attached, followed by IAM grants to allow service project admins to use the shared subnets, after which they can create resources.
B
Grant IAM permissions to service project admins, create host project and enable Shared VPC, attach service projects to host project, service project admins create resources.
Why wrong: This is incorrect because IAM permissions cannot be granted before the host project and service projects are set up; the host project must exist first.
C
Attach service projects to host project, create host project and enable Shared VPC, grant IAM permissions, service project admins create resources.
Why wrong: This is incorrect because the host project must be created and Shared VPC enabled before service projects can be attached.
D
Create service projects first, then create host project and enable Shared VPC, attach service projects, grant IAM permissions.
Why wrong: This is incorrect because service projects are created independently but must be attached to a host project that already exists and has Shared VPC enabled; creating them first does not affect order but the host project setup must precede attachment.

Full breakdown with real-world context →

Question 20mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Establish a VPN connection first, then configure BGP, then create a…

This is incorrect because the VPN connection requires an existing VPC to terminate; creating the VPC after VPN is not possible.

Trap 2: Configure BGP first, then create a new VPC, then establish VPN,…

This is incorrect because BGP routing requires network connectivity (such as VPN) to be in place first; otherwise BGP sessions cannot be established.

Trap 3: Create a new VPC, then set up VPC peering, then establish VPN, then…

This is incorrect because VPC peering is typically used to connect VPCs after network connectivity is established; peering before VPN and BGP is out of order and may not be functional.

Study all Implementing network security common traps →

A
Create a new VPC in Google Cloud, then establish a VPN connection between on-premises and the new VPC, then configure BGP for dynamic routing, then set up VPC peering (if needed), and finally migrate workloads to the new VPC.
This is the correct order because a VPC must exist before you can terminate a VPN on it. After VPN connectivity, BGP enables dynamic routing. VPC peering connects to other VPCs, and workloads are migrated last.
B
Establish a VPN connection first, then configure BGP, then create a new VPC, then set up VPC peering, then migrate workloads.
Why wrong: This is incorrect because the VPN connection requires an existing VPC to terminate; creating the VPC after VPN is not possible.
C
Configure BGP first, then create a new VPC, then establish VPN, then set up VPC peering, then migrate workloads.
Why wrong: This is incorrect because BGP routing requires network connectivity (such as VPN) to be in place first; otherwise BGP sessions cannot be established.
D
Create a new VPC, then set up VPC peering, then establish VPN, then configure BGP, then migrate workloads.
Why wrong: This is incorrect because VPC peering is typically used to connect VPCs after network connectivity is established; peering before VPN and BGP is out of order and may not be functional.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Implementing network security sessions

Start a Implementing network security only practice session

Every question in these sessions is drawn from the Implementing network security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Implementing network security questions →Mixed PCNE session

Frequently asked questions

What does the PCNE exam test about Implementing network security?: Implementing network security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Implementing network security questions in a focused session?: Yes — the session launcher on this page draws every question from the Implementing network security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNE topics?: Use the topic links above to move to related areas, or go back to the PCNE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNE exam covers. They are not copied from any real exam or dump site.

Implementing network security only

10 questions 20 questions 30 questions 50 questions

Mixed PCNE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNE questions Implementing network security domain overview PCNE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Implementing network security practice questions

What to know about Implementing network security

Common Implementing network security exam traps

Implementing network security questions

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

An organization uses VPC Service Controls to protect Google Cloud APIs. They need to allow a specific service account in a peripheral project to access a managed service in a protected service perimeter. What should they configure?

Which TWO of the following are benefits of using Cloud NAT?

A company wants to restrict SSH access to a VM instance to only a specific subnet (10.0.1.0/24) and allow all traffic from the health check ranges (130.211.0.0/22 and 35.191.0.0/16) for load balancing. Which firewall rule configuration should be used for the SSH rule?

A company is using Cloud NAT for internet access from private subnets. Security team notices that traffic from a specific VM is being blocked by external firewalls because the source IP is not the Cloud NAT IP. What is the most likely cause?

An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?

A network engineer is troubleshooting connectivity from an on-premises network to a GCE VM through a VPN tunnel. The tunnel is established, but traffic is not reaching the VM. What should the engineer check first?

A company with a hub-and-spoke VPC topology uses Shared VPC and VPC Network Peering. They want to ensure that only specific VMs in a spoke project can connect to a database instance in the hub project. What is the most secure approach?

A company uses Cloud Armor to protect an HTTPS Load Balancer. They notice that legitimate traffic from a specific geographic region is being blocked. The security policy has a deny rule for that region. What is the correct way to allow traffic from that region while still protecting against attacks?

A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)

Refer to the exhibit. A user cannot SSH into test-vm from their workstation (public IP 203.0.113.5) using the VM's external IP 34.67.89.10. The firewall rule allow-ssh exists. What is the most likely cause?

Refer to the exhibit. A project has the IAM policy shown. Alice is trying to delete a VPC firewall rule but receives a permission error. What is the most likely reason?

Exhibit

A financial services company is migrating sensitive workloads to Google Cloud. They need to implement a defense-in-depth strategy to protect their VPC networks. Which TWO actions should they take to meet their security requirements? (Choose two.)

Drag and drop the steps to set up a shared VPC in Google Cloud into the correct order.

Drag and drop the steps to migrate an on-premises network to Google Cloud using a VPN and VPC peering into the correct order.

Track your progress over time

Start a Implementing network security only practice session

Related PCNE topic practice pages

Configuring Network Services practice questions

Managing, Monitoring, and Optimising Network Operations practice questions

Implementing Hybrid Interconnectivity practice questions

Designing, Planning, and Prototyping a GCP Network practice questions

Implementing VPC Instances practice questions