How should I use these Configuring Network Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Configuring Network Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Configuring Network Security domain.

PCSE · topic practice

Configuring Network Security practice questions

Practise Google Professional Cloud Security Engineer Configuring Network Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Configuring Network Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Configuring Network Security

Configuring Network Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Configuring Network Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Configuring Network Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Configuring Network Security explanation →

A security engineer wants to apply a baseline set of firewall rules that apply to all new and existing VMs in an organization, and these rules must not be overridden by project-level rules. Which approach should be used?

Trap 1: Create a VPC firewall rule with priority 0.

This is incorrect. Even though priority 0 is the highest possible priority within VPC firewall rules, hierarchical firewall policies at the organization or folder level take precedence over any VPC firewall rule. Therefore, a VPC firewall rule with priority 0 can still be overridden by a hierarchical policy, failing the requirement that baseline rules must not be overridden by project-level rules.

Trap 2: Use Cloud IDS to monitor and block traffic.

Cloud IDS is for threat detection, not rule enforcement.

Trap 3: Create a firewall rule in each project and enforce via policy…

Project-level rules can be overridden or misconfigured.

Study all Configuring Network Security common traps →

A
Create a VPC firewall rule with priority 0.
Why wrong: This is incorrect. Even though priority 0 is the highest possible priority within VPC firewall rules, hierarchical firewall policies at the organization or folder level take precedence over any VPC firewall rule. Therefore, a VPC firewall rule with priority 0 can still be overridden by a hierarchical policy, failing the requirement that baseline rules must not be overridden by project-level rules.
B
Use Cloud IDS to monitor and block traffic.
Why wrong: Cloud IDS is for threat detection, not rule enforcement.
C
Create a firewall rule in each project and enforce via policy library.
Why wrong: Project-level rules can be overridden or misconfigured.
D
Use a hierarchical firewall policy at the organization level.
Hierarchical policies cannot be overridden, enforcing baseline rules.

Configuring Network Security practice questions

What to know about Configuring Network Security

Common Configuring Network Security exam traps

Configuring Network Security questions

A security engineer wants to apply a baseline set of firewall rules that apply to all new and existing VMs in an organization, and these rules must not be overridden by project-level rules. Which approach should be used?

A company wants to enable private connectivity from its on-premises network to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs. They have a Cloud VPN connection to a VPC. Which TWO services or configurations are required? (Choose two.)

Your organization wants to enforce that all VMs in a project can only communicate with a specific Cloud Storage bucket, and no other external IP addresses. You need to configure firewall rules to achieve this. Which approach should you take?

A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?

An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?

A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?

A DevOps team wants to automatically provision and renew SSL certificates for a global HTTPS load balancer. Which certificate management option should be used?

An engineer needs to block a specific IP address from accessing an HTTPS load balancer. Which Cloud Armor rule should be used?

A company wants internal VMs to access Google APIs (e.g., Cloud Storage, BigQuery) without traversing the internet. What is the simplest configuration?

An organization uses VPC Service Controls in dry-run mode for a project containing Google Cloud Storage. They notice that BigQuery jobs are being logged as violations. How should they interpret this?

Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?

A service provider wants to expose an internal service to external consumers in a controlled manner, without giving them direct access to the VPC. Which Google Cloud service should be used?

An organization uses SSL policies for their HTTPS load balancer. They need to allow TLS 1.2 and 1.3 only, and use the most secure cipher profile available. Which SSL policy configuration should they choose?

Which VPC firewall rule target type is recommended for security because it can be dynamically applied to instances based on their service account?

A company wants to detect and block SQL injection attacks targeting their web application hosted on Compute Engine behind a Cloud Load Balancer. Which TWO steps should they take? (Choose TWO.)

An organization wants to implement a zero-trust network security model for their Google Cloud environment. Which TWO practices should they adopt? (Choose TWO.)

An organization wants to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can reach it, without using public IP addresses. Which solution should they implement?

Track your progress over time

Start a Configuring Network Security only practice session

Related PCSE topic practice pages

Configuring Access Within a Cloud Solution Environment practice questions

Ensuring Data Protection practice questions

Managing Operations in a Cloud Solution Environment practice questions

Configuring Network Security practice questions

Supporting Compliance Requirements practice questions

PCSE fundamentals practice questions

PCSE scenario practice questions

PCSE troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid