How should I use these Configuring network security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Configuring network security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Configuring network security domain.

PCSE · topic practice

Configuring network security practice questions

Practise Google Professional Cloud Security Engineer Configuring network security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Configuring network security

Practice 10 questions Browse domain →

What the exam tests

What to know about Configuring network security

Configuring network security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Configuring network security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Configuring network security questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Review the full subnetting walkthrough →

Your organization has a VPC with several subnets hosting Compute Engine instances. You need to allow SSH access (port 22) to instances in the 'management' subnet from the internet, but only from the office's static IP range (203.0.113.0/24). All other ingress traffic to that subnet should be blocked. Which firewall rule configuration should you create?

Trap 1: Create an ingress rule with target tag 'management', source IP…

Allows SSH from all sources, not just office.

Trap 2: Create an ingress rule with target tag 'management', source IP…

Denies SSH from office, opposite of requirement.

Trap 3: Create an ingress rule with target tag 'management', source IP…

Allows all traffic from office, not just SSH.

Study all Configuring network security common traps →

A
Create an ingress rule with target tag 'management', source IP range 0.0.0.0/0, protocol tcp:22, action allow
Why wrong: Allows SSH from all sources, not just office.
B
Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action deny
Why wrong: Denies SSH from office, opposite of requirement.
C
Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action allow
Correct: Targets the subnet's instances via tag, allows SSH only from office IP.
D
Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol all, action allow
Why wrong: Allows all traffic from office, not just SSH.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full VPN explanation →

Your company is deploying a web application on Google Kubernetes Engine (GKE) with an Internal Load Balancer (ILB) as the ingress. The application must only be accessible from within the same VPC and from an on-premises network connected via Cloud VPN. The on-premises network uses IP range 10.0.0.0/8. You have already created the ILB with a backend service. What is the most secure way to restrict access to the ILB?

Trap 1: Configure a VPC firewall rule to deny all ingress traffic to the…

Firewall rules apply to instances, not to forwarding rules directly. ILB traffic passes through firewall rules applied to the backend instances, but the ILB itself is not subject to firewall rules.

Trap 2: Use GKE Network Policy to restrict ingress traffic to the…

GKE Network Policy controls pod-to-pod traffic but does not restrict traffic entering the cluster through the ILB, which arrives at the node and is then routed to the pod.

Trap 3: Use Cloud Armor to create a security policy that allows traffic…

Cloud Armor is not supported for Internal Load Balancers; it only works with external load balancers.

Study all Configuring network security common traps →

A
Configure a VPC firewall rule to deny all ingress traffic to the ILB's forwarding rule IP address, and then create a higher-priority allow rule for the VPC and on-premises ranges
Why wrong: Firewall rules apply to instances, not to forwarding rules directly. ILB traffic passes through firewall rules applied to the backend instances, but the ILB itself is not subject to firewall rules.
B
Configure the backend service's firewall rules to only allow traffic from the ILB's health check ranges and from the VPC and on-premises source ranges
Correct: Firewall rules on the backend instances allow traffic from the ILB's health check probes and from permitted source ranges, ensuring only desired traffic reaches the application.
C
Use GKE Network Policy to restrict ingress traffic to the application pods from the VPC and on-premises ranges
Why wrong: GKE Network Policy controls pod-to-pod traffic but does not restrict traffic entering the cluster through the ILB, which arrives at the node and is then routed to the pod.
D
Use Cloud Armor to create a security policy that allows traffic only from the VPC and on-premises ranges, and attach it to the ILB
Why wrong: Cloud Armor is not supported for Internal Load Balancers; it only works with external load balancers.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Configuring network security explanation →

You have a Compute Engine VM that hosts a custom application. The VM has a tag 'app-server' and is in a VPC network with the following firewall rules (priority order from lowest to highest):

Rule 1: Priority 1000, direction INGRESS, source 0.0.0.0/0, target tag 'app-server', protocol tcp:80, action allow Rule 2: Priority 500, direction INGRESS, source 10.0.0.0/8, target tag 'app-server', protocol tcp:80, action deny Rule 3: Priority 2000, direction INGRESS, source 192.168.0.0/16, target tag 'app-server', protocol tcp:80, action allow

A user from IP 10.0.0.5 tries to access the application on port 80. Will the request be allowed or denied?

Trap 1: Denied, because Rule 3 has a higher priority number and denies…

Rule 3 allows traffic, and its source range does not include 10.0.0.5. It does not affect this request.

Trap 2: Allowed, because Rule 1 has a lower priority number and allows all…

Rule 1 has priority 1000, which is higher than Rule 2 (500). Rule 2 is evaluated first and denies the traffic.

Trap 3: Allowed, because Rule 3 has a higher priority number and allows…

Rule 3 has priority 2000, which is lower priority (higher number) than Rule 2. Since Rule 2 matches, it applies and denies.

Study all Configuring network security common traps →

A
Denied, because Rule 2 has a lower priority number and explicitly denies traffic from 10.0.0.0/8
Correct: Rule 2 has priority 500, which is evaluated before Rule 1 (1000) and Rule 3 (2000). Since it matches, the deny action is applied.
B
Denied, because Rule 3 has a higher priority number and denies traffic from 192.168.0.0/16
Why wrong: Rule 3 allows traffic, and its source range does not include 10.0.0.5. It does not affect this request.
C
Allowed, because Rule 1 has a lower priority number and allows all traffic
Why wrong: Rule 1 has priority 1000, which is higher than Rule 2 (500). Rule 2 is evaluated first and denies the traffic.
D
Allowed, because Rule 3 has a higher priority number and allows traffic from 192.168.0.0/16
Why wrong: Rule 3 has priority 2000, which is lower priority (higher number) than Rule 2. Since Rule 2 matches, it applies and denies.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full NAT/PAT explanation →

Your organization uses Shared VPC with a host project and several service projects. You need to ensure that all egress traffic from Compute Engine instances in a service project is routed through a centralized Cloud NAT in the host project. What is the required configuration?

Trap 1: Create a firewall rule in the host project that denies all egress…

Firewall rules cannot force traffic through NAT; they only allow/deny. NAT is configured on Cloud Router.

Trap 2: Set the instances to use a custom route with next-hop as the Cloud…

Cloud NAT is not a next-hop; it's a function of Cloud Router. Custom routes cannot point to a NAT IP.

Trap 3: Configure a Cloud NAT in each service project and associate it with…

This would create separate NATs, not centralized. The goal is a single NAT in the host project.

Study all Configuring network security common traps →

A
Create a firewall rule in the host project that denies all egress traffic except to the Cloud NAT IP
Why wrong: Firewall rules cannot force traffic through NAT; they only allow/deny. NAT is configured on Cloud Router.
B
Set the instances to use a custom route with next-hop as the Cloud NAT IP address
Why wrong: Cloud NAT is not a next-hop; it's a function of Cloud Router. Custom routes cannot point to a NAT IP.
C
Configure a Cloud NAT on the Cloud Router in the host project for the subnet that is shared with the service project
Correct: In Shared VPC, the host project owns the subnets. Cloud NAT on the host project's router for those subnets will handle egress for all instances in those subnets, including those from service projects.
D
Configure a Cloud NAT in each service project and associate it with the subnet that the instances use
Why wrong: This would create separate NATs, not centralized. The goal is a single NAT in the host project.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full NAT/PAT explanation →

You are designing a multi-tier application with a frontend and backend. The frontend instances are in subnet A (10.0.1.0/24), and the backend instances are in subnet B (10.0.2.0/24). Both subnets are in the same VPC. You want to allow the frontend to communicate with the backend on TCP port 8080, but the backend must not be able to initiate connections to the frontend. Additionally, the backend must be able to send patches to the internet. Which set of firewall rules should you implement?

Trap 1: Ingress rule on frontend: allow tcp:8080 from backend's service…

Ingress on frontend would allow backend to connect to frontend, which violates the requirement. Also, using service accounts is more complex but not incorrect per se, but the direction is wrong.

Trap 2: Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule…

Ingress rule on frontend would allow backend to initiate to frontend, which is not allowed. The requirement is backend cannot initiate to frontend.

Trap 3: Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule…

Egress rule on frontend is not needed. The rule should allow backend to access internet, not frontend.

Study all Configuring network security common traps →

A
Ingress rule on frontend: allow tcp:8080 from backend's service account; Egress rule on backend: allow all to internet
Why wrong: Ingress on frontend would allow backend to connect to frontend, which violates the requirement. Also, using service accounts is more complex but not incorrect per se, but the direction is wrong.
B
Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on backend: allow all to internet
Correct: Ingress on backend allows frontend-initiated traffic only. Egress on backend allows backend to reach internet for patches. No rule allows backend to initiate to frontend.
C
Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule on backend: allow all to internet
Why wrong: Ingress rule on frontend would allow backend to initiate to frontend, which is not allowed. The requirement is backend cannot initiate to frontend.
D
Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on frontend: deny all to internet
Why wrong: Egress rule on frontend is not needed. The rule should allow backend to access internet, not frontend.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Configuring network security explanation →

You are a security engineer for a company that runs a critical application on Google Cloud. You need to implement defense in depth for network security. Which TWO of the following are effective network security controls that you should implement?

Trap 1: OS-level host-based firewalls on each VM

While important, host-based firewalls are compute instance security, not a network-level control.

Trap 2: IAM roles to control who can create Compute Engine instances

IAM is an identity and access management control, not a network security control.

Trap 3: Workload Identity Federation to allow workloads to authenticate to…

This is an identity and access management feature, not a network security control.

Study all Configuring network security common traps →

A
OS-level host-based firewalls on each VM
Why wrong: While important, host-based firewalls are compute instance security, not a network-level control.
B
VPC firewall rules to restrict traffic between subnets
VPC firewall rules are a fundamental network security control to filter traffic.
C
IAM roles to control who can create Compute Engine instances
Why wrong: IAM is an identity and access management control, not a network security control.
D
Workload Identity Federation to allow workloads to authenticate to Google APIs
Why wrong: This is an identity and access management feature, not a network security control.
E
Cloud Armor to protect against DDoS and web application attacks
Cloud Armor is a network security service that provides WAF and DDoS protection at the edge.

Full breakdown with real-world context →

Question 7hardmulti select

Review the full subnetting walkthrough →

Your company has a VPC with multiple subnets. You have deployed a set of Compute Engine instances that must communicate with each other over TCP port 4444. The instances are tagged with 'app-tier'. You need to ensure that only these instances can communicate on this port. Which THREE of the following steps are necessary to achieve this?

Trap 1: Remove the default allow egress rule that allows all outbound…

Removing the default egress rule would block all outbound traffic, which could break other communications. The specific egress rule will take precedence due to higher priority if needed, but actually the default egress rule allows all, and our specific rule allows additional traffic; it doesn't conflict. We don't need to remove it.

Trap 2: Create a VPC firewall rule to deny all egress traffic from the VPC

This would block all outbound traffic, including necessary communications. The default allow egress rule can remain; we just need to ensure specific allow rules for the required traffic.

Study all Configuring network security common traps →

A
Remove the default allow egress rule that allows all outbound traffic
Why wrong: Removing the default egress rule would block all outbound traffic, which could break other communications. The specific egress rule will take precedence due to higher priority if needed, but actually the default egress rule allows all, and our specific rule allows additional traffic; it doesn't conflict. We don't need to remove it.
B
Create an egress firewall rule that allows TCP 4444 from target tag 'app-tier' to source tag 'app-tier'
This rule allows outbound traffic on port 4444 from instances with the tag 'app-tier' to instances with the same tag.
C
Create a VPC firewall rule to deny all egress traffic from the VPC
Why wrong: This would block all outbound traffic, including necessary communications. The default allow egress rule can remain; we just need to ensure specific allow rules for the required traffic.
D
Create an ingress firewall rule that allows TCP 4444 from source tag 'app-tier' to target tag 'app-tier'
This rule allows inbound traffic on port 4444 between instances with the tag 'app-tier'.
E
Apply the 'app-tier' tag to all instances that need to communicate
Tags are used to select instances for firewall rules. Without the tag, the rules won't apply.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full NAT/PAT explanation →

You are designing network security for a multi-region GKE cluster with Pods that need to communicate across regions over a private network. The cluster uses VPC-native mode. Which Google Cloud networking feature should you use to ensure low-latency and secure inter-region Pod-to-Pod communication without traversing the public internet?

Trap 1: Cloud VPN with dynamic routing

Cloud VPN uses the public internet and adds latency.

Trap 2: Private Service Connect

Used for accessing Google APIs privately, not for inter-region Pod communication.

Trap 3: VPC Flow Logs

Used for monitoring network flows, not connectivity.

Study all Configuring network security common traps →

A
Cloud VPN with dynamic routing
Why wrong: Cloud VPN uses the public internet and adds latency.
B
Private Service Connect
Why wrong: Used for accessing Google APIs privately, not for inter-region Pod communication.
C
VPC Flow Logs
Why wrong: Used for monitoring network flows, not connectivity.
D
Cloud Interconnect
Provides dedicated, low-latency, private connectivity between VPC networks across regions.

Full breakdown with real-world context →

Question 9easymultiple choice

Review the full routing breakdown →

Your organization requires that all egress traffic from a VPC network be inspected by a third-party security appliance before leaving the network. The appliance is deployed in a separate VPC. What is the most scalable and maintainable way to route traffic through the appliance?

Trap 1: Use Cloud Interconnect to connect the two VPCs and configure BGP to…

Overkill and expensive; not needed for within the same region.

Trap 2: Use Private Google Access to route traffic through the appliance.

Private Google Access is for accessing Google APIs privately, not for general egress inspection.

Trap 3: Deploy the appliance in a separate VPC and use VPC Network Peering…

This works but requires careful route management and is less scalable than a centralized appliance.

Study all Configuring network security common traps →

A
Use Cloud Interconnect to connect the two VPCs and configure BGP to advertise a default route from the appliance VPC.
Why wrong: Overkill and expensive; not needed for within the same region.
B
Use Private Google Access to route traffic through the appliance.
Why wrong: Private Google Access is for accessing Google APIs privately, not for general egress inspection.
C
Deploy the appliance in a separate VPC and create a route with next hop as the appliance's internal IP, and tag the VMs that need inspection.
This is the recommended pattern: use instance-level routes with next hop to the appliance.
D
Deploy the appliance in a separate VPC and use VPC Network Peering with route export/import to redirect traffic.
Why wrong: This works but requires careful route management and is less scalable than a centralized appliance.

Full breakdown with real-world context →

Question 10mediummultiple choice

Review the full subnetting walkthrough →

A security engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but in different subnets. Both instances have internal IPs and are in the same region. The firewall rules allow ingress from 10.0.0.0/8. However, traffic is failing. What is the most likely cause?

Trap 1: The instances are using external IPs and the source IP is being…

Internal IPs are used, so NAT is not involved.

Trap 2: The VPC has dynamic routing mode set to global, causing routing…

Global routing mode does not affect intra-region traffic.

Trap 3: There is a firewall rule with a lower priority that denies egress…

By default egress is allowed; a deny rule would need to be explicitly created.

Study all Configuring network security common traps →

A
The instances are using external IPs and the source IP is being NATed.
Why wrong: Internal IPs are used, so NAT is not involved.
B
The VPC has dynamic routing mode set to global, causing routing conflicts.
Why wrong: Global routing mode does not affect intra-region traffic.
C
The ingress firewall rule is applied to a network tag that is not assigned to the destination instances.
Firewall rules are applied to instances via tags or service accounts; missing tag would block traffic.
D
There is a firewall rule with a lower priority that denies egress traffic between subnets.
Why wrong: By default egress is allowed; a deny rule would need to be explicitly created.

Full breakdown with real-world context →

Question 11mediummulti select

Read the full Configuring network security explanation →

Which TWO options are valid methods to secure data in transit between an on-premises data center and a Google Cloud VPC?

Trap 1: Private Google Access

Provides private access to Google APIs, not a general hybrid connectivity method.

Trap 2: VPC Network Peering

Does not encrypt traffic; relies on the underlying network.

Trap 3: Internal HTTPS Load Balancing

For load balancing within VPC, not for hybrid connectivity.

Study all Configuring network security common traps →

A
Private Google Access
Why wrong: Provides private access to Google APIs, not a general hybrid connectivity method.
B
Dedicated Interconnect with MACsec
Provides encryption at Layer 2 for dedicated connections.
C
Cloud VPN with IPsec
Provides encrypted tunnel over the internet.
D
VPC Network Peering
Why wrong: Does not encrypt traffic; relies on the underlying network.
E
Internal HTTPS Load Balancing
Why wrong: For load balancing within VPC, not for hybrid connectivity.

Full breakdown with real-world context →

Question 12hardmulti select

Read the full Configuring network security explanation →

Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?

Trap 1: A log sink to export logs to BigQuery

Optional, not required for enabling flow logs.

Trap 2: A metadata server to store logs

Logs are stored in Cloud Logging, not metadata server.

Study all Configuring network security common traps →

A
Enable VPC Flow Logs on the subnet
Flow logs are enabled per subnet.
B
The VM's service account must have the compute.instances.get permission
Required to retrieve logs for the instance.
C
A log sink to export logs to BigQuery
Why wrong: Optional, not required for enabling flow logs.
D
A VM with a network interface in the subnet
Traffic to/from that interface is logged.
E
A metadata server to store logs
Why wrong: Logs are stored in Cloud Logging, not metadata server.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full Configuring network security explanation →

Your organization wants to ensure that no Compute Engine instance can have a public IP address. What is the best way to enforce this policy?

Trap 1: Use Cloud Audit Logs to monitor and alert on instances with public…

Detective, not preventive.

Trap 2: Use a firewall rule that blocks traffic from 0.0.0.0/0

Does not prevent assigning a public IP.

Trap 3: Use a Service Perimeter from VPC Service Controls

Controls data exfiltration, not VM public IP.

Study all Configuring network security common traps →

A
Use Cloud Audit Logs to monitor and alert on instances with public IPs
Why wrong: Detective, not preventive.
B
Use an Organization Policy with the constraint `compute.vmExternalIpAccess`
Prevents creation of VMs with external IPs.
C
Use a firewall rule that blocks traffic from 0.0.0.0/0
Why wrong: Does not prevent assigning a public IP.
D
Use a Service Perimeter from VPC Service Controls
Why wrong: Controls data exfiltration, not VM public IP.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full Configuring network security explanation →

A company is using a Shared VPC in Google Cloud with multiple service projects. The security team wants to restrict egress traffic from a specific service project to only allowed external IP addresses. The network project hosts the VPC. What is the best approach?

Trap 1: Use Private Google Access to restrict egress.

Private Google Access is for access to Google APIs, not general egress.

Trap 2: Use VPC Service Controls to restrict egress.

VPC Service Controls prevent data exfiltration to Google services, not external IPs.

Trap 3: Create a firewall rule in the service project's VPC that denies…

Service projects do not have their own VPC in Shared VPC; they use the host's VPC.

Study all Configuring network security common traps →

A
Use Private Google Access to restrict egress.
Why wrong: Private Google Access is for access to Google APIs, not general egress.
B
Use VPC Service Controls to restrict egress.
Why wrong: VPC Service Controls prevent data exfiltration to Google services, not external IPs.
C
Create a firewall rule in the service project's VPC that denies egress.
Why wrong: Service projects do not have their own VPC in Shared VPC; they use the host's VPC.
D
Create a firewall rule in the host project that denies egress to all destinations except the allowed IPs, and apply it to the service project's VMs via service accounts.
Firewall rules in host project can target service projects VMs by service account.

Full breakdown with real-world context →

Question 15hardmultiple choice

Open the full BGP breakdown →

Your organization has a hybrid network with an on-premises data center connected to Google Cloud via a Dedicated Interconnect. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) and Google Cloud VPC has a subnet in 10.1.0.0/16. You've configured a Cloud Router with BGP to exchange routes. Recently, you set up a new VPC with a subnet in 10.2.0.0/16 and peered it with the first VPC using VPC Network Peering. You notice that on-premises traffic destined to 10.2.0.0/16 is being dropped. You verify that the firewall rules allow the traffic and that BGP routes for 10.2.0.0/16 are not advertised on-premises. What should you do to enable connectivity from on-premises to the new VPC?

Trap 1: Set up a Cloud VPN tunnel between the new VPC and on-premises.

A VPN is not needed; the issue is route advertisement, not connectivity method.

Trap 2: Add a firewall rule in the new VPC allowing all traffic from…

Firewall rules are not the issue; the problem is routing.

Trap 3: Create a Shared VPC and attach the new VPC as a service project.

Shared VPC doesn't automatically advertise routes to on-premises via Interconnect.

Study all Configuring network security common traps →

A
Set up a Cloud VPN tunnel between the new VPC and on-premises.
Why wrong: A VPN is not needed; the issue is route advertisement, not connectivity method.
B
Configure the Cloud Router to advertise the 10.2.0.0/16 range via custom route advertisement.
Custom route advertisements on Cloud Router propagate the peering range to on-premises.
C
Add a firewall rule in the new VPC allowing all traffic from 10.0.0.0/8.
Why wrong: Firewall rules are not the issue; the problem is routing.
D
Create a Shared VPC and attach the new VPC as a service project.
Why wrong: Shared VPC doesn't automatically advertise routes to on-premises via Interconnect.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full DNS explanation →

You are a security engineer for a financial services company that processes sensitive customer data. Your architecture includes two VPCs: 'data-vpc' (10.1.0.0/16) containing BigQuery datasets and Cloud Storage buckets, and 'app-vpc' (10.2.0.0/16) containing Compute Engine instances running a customer-facing application. The application needs to read from BigQuery and write to Cloud Storage. You have configured VPC Network Peering between the VPCs. Additionally, you have set up Private Google Access on all subnets in 'data-vpc' and 'app-vpc'. The application instances cannot connect to BigQuery or Cloud Storage. You have verified that firewall rules allow egress traffic to the Google APIs IP range (199.36.153.4/30) and that DNS resolution works correctly. What is the most likely cause of the connectivity failure?

Trap 1: VPC Network Peering does not support Private Google Access.

Private Google Access works over VPC Peering if the subnet has a route to the internet.

Trap 2: Cloud NAT is not configured for 'app-vpc'.

Cloud NAT is not required for Private Google Access; it's for connections to the internet without external IPs.

Trap 3: Firewall rules are blocking traffic to the Google APIs IP range.

Firewall rules were verified to allow egress to 199.36.153.4/30.

Study all Configuring network security common traps →

A
VPC Network Peering does not support Private Google Access.
Why wrong: Private Google Access works over VPC Peering if the subnet has a route to the internet.
B
Cloud NAT is not configured for 'app-vpc'.
Why wrong: Cloud NAT is not required for Private Google Access; it's for connections to the internet without external IPs.
C
The 'app-vpc' subnets do not have a default route (0.0.0.0/0) to the internet gateway.
Private Google Access requires a default route for traffic to be sent to the internet gateway.
D
Firewall rules are blocking traffic to the Google APIs IP range.
Why wrong: Firewall rules were verified to allow egress to 199.36.153.4/30.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full NAT/PAT explanation →

A company is deploying a multi-tier application on Google Cloud. The web tier must be accessible from the internet, while the application and database tiers must only be accessible from the web tier. The security team wants to use VPC firewall rules and Cloud NAT for outbound internet access from private instances. Which architecture meets these requirements with the least operational overhead?

Trap 1: Use a single subnet for all tiers

Assigning public IPs to app/db is insecure, and a proxy VM adds complexity.

Trap 2: Create separate VPCs for each tier

Multiple VPCs increase complexity and management overhead.

Trap 3: Place all tiers in the same VPC

Assigning public IPs to web tier is correct, but app/db tiers should not have public IPs; Cloud NAT is for outbound, not inbound.

Study all Configuring network security common traps →

A
Use a single subnet for all tiers. Assign public IPs to all instances. Use firewall rules to restrict access between tiers. Use a proxy VM for outbound internet from app/db tiers.
Why wrong: Assigning public IPs to app/db is insecure, and a proxy VM adds complexity.
B
Create separate VPCs for each tier. Use VPC peering to connect them. Use firewall rules to allow traffic. Use a bastion host for SSH access to app/db tiers.
Why wrong: Multiple VPCs increase complexity and management overhead.
C
Place all tiers in the same VPC. Use firewall rules to restrict access. Assign public IPs to web tier instances and private IPs to app/db tiers. Configure Cloud NAT for app/db tiers.
Why wrong: Assigning public IPs to web tier is correct, but app/db tiers should not have public IPs; Cloud NAT is for outbound, not inbound.
D
Place web tier in a public subnet with public IPs. Place app/db tiers in private subnets with no public IPs. Use firewall rules to allow traffic from web to app, and app to db. Configure Cloud NAT for private subnets.
This uses public subnets for web, private subnets for app/db, firewall rules for least privilege, and Cloud NAT for outbound access.

Full breakdown with real-world context →

Question 18mediummulti select

Read the full Configuring network security explanation →

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. The perimeter is defined with the project as a protected project. Which TWO actions are valid to restrict data exfiltration while maintaining necessary access?

Trap 1: Use VPC Service Controls to block access to the Compute Engine…

The metadata server is not a Google-managed API; VPC Service Controls protects Google-managed services.

Trap 2: Create a service perimeter that includes all Google Cloud projects…

Including all projects would not protect the sensitive data specifically and could be overly permissive.

Trap 3: Use VPC Service Controls to restrict access based on network tags…

VPC Service Controls does not support network tags; it uses access levels based on IP, device, or identity.

Study all Configuring network security common traps →

A
Use VPC Service Controls to block access to the Compute Engine metadata server to prevent credential extraction.
Why wrong: The metadata server is not a Google-managed API; VPC Service Controls protects Google-managed services.
B
Configure the service perimeter to allow access from the VPC network where the Compute Engine instances reside using private Google access.
Private Google access allows on-premises or VM instances to access Google APIs within the perimeter.
C
Create an access level that restricts access to only the IP ranges of the corporate network. Apply the access level to the service perimeter.
Access levels can restrict access based on IP ranges, reducing exfiltration risk.
D
Create a service perimeter that includes all Google Cloud projects in the organization to simplify management.
Why wrong: Including all projects would not protect the sensitive data specifically and could be overly permissive.
E
Use VPC Service Controls to restrict access based on network tags on Compute Engine instances.
Why wrong: VPC Service Controls does not support network tags; it uses access levels based on IP, device, or identity.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full Configuring network security explanation →

Drag and drop the steps to configure a VPC Service Controls perimeter in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediumdrag order

Read the full Configuring network security explanation →

Drag and drop the steps to respond to a data breach involving a Cloud Storage bucket in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Configuring network security sessions

Start a Configuring network security only practice session

Every question in these sessions is drawn from the Configuring network security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Configuring network security questions →Mixed PCSE session

Frequently asked questions

What does the PCSE exam test about Configuring network security?: Configuring network security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Configuring network security questions in a focused session?: Yes — the session launcher on this page draws every question from the Configuring network security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCSE topics?: Use the topic links above to move to related areas, or go back to the PCSE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCSE exam covers. They are not copied from any real exam or dump site.

Configuring network security only

10 questions 20 questions 30 questions 50 questions

Mixed PCSE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCSE questions Configuring network security domain overview PCSE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Configuring network security practice questions

What to know about Configuring network security

Common Configuring network security exam traps

Configuring network security questions

Your organization uses Shared VPC with a host project and several service projects. You need to ensure that all egress traffic from Compute Engine instances in a service project is routed through a centralized Cloud NAT in the host project. What is the required configuration?

You are a security engineer for a company that runs a critical application on Google Cloud. You need to implement defense in depth for network security. Which TWO of the following are effective network security controls that you should implement?

Your organization requires that all egress traffic from a VPC network be inspected by a third-party security appliance before leaving the network. The appliance is deployed in a separate VPC. What is the most scalable and maintainable way to route traffic through the appliance?

Which TWO options are valid methods to secure data in transit between an on-premises data center and a Google Cloud VPC?

Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?

Your organization wants to ensure that no Compute Engine instance can have a public IP address. What is the best way to enforce this policy?

A company is using a Shared VPC in Google Cloud with multiple service projects. The security team wants to restrict egress traffic from a specific service project to only allowed external IP addresses. The network project hosts the VPC. What is the best approach?

Drag and drop the steps to configure a VPC Service Controls perimeter in the correct order.

Drag and drop the steps to respond to a data breach involving a Cloud Storage bucket in the correct order.

Track your progress over time

Start a Configuring network security only practice session

Related PCSE topic practice pages