75 of 110 questions · Page 1/2 · Pcse Network Security topic · Answers revealed
An organization wants to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can reach it, without using public IP addresses. Which solution should they implement?
Private Google Access enables VMs with internal IPs to reach Google APIs and services without internet, using the VPC network.
A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)
Required for the policy to take effect.
Why this answer
Cloud Armor provides preconfigured WAF rules (OWASP ModSecurity CRS) for XSS, SQLi, LFI, etc. It also supports custom rules for allowlisting IPs. The correct features are: using preconfigured rule sets for OWASP CRS, creating custom rules with IP allowlisting, and then applying the policy to the load balancer.
The question asks for three, so the answers are the OWASP CRS rule set, custom rules, and security policy attachment.
A company's security policy requires that all traffic to a Google Cloud load balancer use TLS 1.2 or higher and only accept strong ciphers. They want to enforce this using a Google Cloud resource. Which resource should they configure?
SSL policies define allowed TLS versions and cipher suites for load balancers.
Why this answer
SSL policies on HTTPS load balancers allow you to specify the minimum TLS version and cipher profile (e.g., RESTRICTED for strong ciphers). This enforces encryption requirements at the load balancer level.
A company wants to enforce that all VPC firewall rules in an organization must be centrally managed and cannot be overridden by lower-level projects. Which approach should they use?
Hierarchical firewall policies can be applied at the org level and are inherited by all folders and projects; they can be set to not be overridden.
Why this answer
Hierarchical firewall policies are applied at the organization, folder, or project level and are inherited downward. They can be set to have higher priority than network firewall rules, and lower-level rules cannot override them if the policy is set accordingly.
A company uses Cloud Armor security policies to protect their HTTP load balancer. They need to block requests from a specific geographic region (country X) and also limit requests from any IP to 1000 requests per second. They also want to use preconfigured rules for SQL injection prevention. What is the correct way to combine these requirements in a single security policy?
This is the correct approach: separate rules for different actions, with priorities ensuring evaluation order.
Why this answer
Cloud Armor rules are evaluated in order of priority (lowest number first). Preconfigured rules (like SQLi) have a priority of 1000 by default. Geographic and rate limiting rules can be added with custom priorities.
The rule order matters: typically, you want to block/rate-limit before applying WAF rules to reduce processing. However, the question is about combining them correctly: all rule types can coexist in a single policy. The key is that each rule type has its own configuration; you can't set rate limiting in the same rule as geo-blocking; they must be separate rules.
An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?
Hierarchical firewall policies apply across projects and cannot be overridden, ensuring baseline enforcement.
Why this answer
Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.
A security engineer needs to restrict access to a Cloud Storage bucket so that only a specific set of Compute Engine instances can read objects. The instances are in the same project and VPC network. The engineer wants to use VPC firewall rules for this purpose. Which two configurations are REQUIRED? (Choose two.)
Allows the instances to reach Cloud Storage.
Why this answer
VPC firewall rules control network traffic to/from instances, but they cannot directly restrict access to Cloud Storage APIs. However, they can restrict which instances can reach the external IP of Cloud Storage. To achieve the goal, the engineer must allow egress traffic from the instances to the Cloud Storage IP ranges and deny all other egress.
But more importantly, access to Cloud Storage is controlled by IAM, not firewall rules. However, the question specifically asks about VPC firewall rules. The typical approach is to use Private Google Access and firewall rules to restrict egress to Google API IPs.
The correct answers are: allow egress to the Google API IP ranges (which include Cloud Storage) and deny all other egress. But the question might also consider using service accounts and firewall rule targets. Firewall rules can target service accounts, but that does not restrict access to Cloud Storage itself.
The most direct answer is that to limit which instances can access Cloud Storage, you can create an egress rule that allows traffic to the Cloud Storage IP ranges only from instances with a specific service account or tag, and then deny all other egress. But the question asks for two configurations. The most reasonable answers: (1) Create an egress allow rule for the Cloud Storage IP ranges with a target tag or service account that matches the instances. (2) Create a deny all egress rule with lower priority.
However, since Cloud Storage uses Google APIs, the IP ranges are from the published list. The correct choices are likely: A and D.
A security engineer needs to detect and alert on network-based threats such as malware and command-and-control traffic within their Google Cloud VPC. They want a managed service that provides deep packet inspection and integrates with their existing security operations. Which service should they use?
Cloud IDS provides managed threat detection using deep packet inspection.
Why this answer
Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with VPC packet mirroring and provides threat severity levels. Cloud Armor protects web applications at the edge.
VPC Service Controls restrict data access. Cloud NGFW (next-generation firewall) is not a Google Cloud managed service; Google offers Cloud Firewall (which is not NGFW).
A company uses VPC Service Controls in dry-run mode to test a new service perimeter that includes BigQuery. They want to monitor any violations without actually blocking access. Where can they view the logs of these dry-run violations?
Correct: VPC Service Controls violations in dry-run mode are logged to Cloud Logging and can be viewed using the appropriate filter.
Why this answer
When VPC Service Controls is in dry-run mode, violations are logged to Cloud Logging but access is not blocked. The logs can be viewed in the Logs Explorer using the filter for VPC Service Controls policy violations.
A company is deploying a new internal application on Google Cloud. They want to ensure that VM instances in a specific subnet can only communicate with each other and with a load balancer that fronts the application. They also want to allow SSH access from a bastion host. Which TWO firewall rules should they create? (Choose two.)
This allows internal communication within the subnet.
Why this answer
To restrict communication to only internal subnet traffic and the load balancer, you need an ingress rule that allows traffic from the subnet (source) to all instances (target). To allow SSH from the bastion, you need an ingress rule allowing TCP port 22 from the bastion host (using its service account or tags). Egress rules are not needed because the default allow egress is not restrictive; but if you want to block other egress, you would need a deny egress rule, but the question asks for rules to allow, not block.
A company wants to use Private Service Connect to publish a managed service (e.g., a custom application) so that consumers can access it privately within Google Cloud. Which THREE resources are involved in this setup?
The consumer creates a PSC endpoint to connect to the service.
Why this answer
Private Service Connect involves creating a service attachment on the producer side (the managed service), which is then accessible via a PSC endpoint in the consumer's VPC. DNS configuration is needed to resolve the endpoint's IP address. IAM roles control who can create endpoints.
This rule allows inbound traffic to 'app-server' instances from 'web-server' instances on port 8080.
Why this answer
Create an ingress rule targeting 'app-server' that allows tcp:8080 from source tag 'web-server'. Tags are used for both source and target to control traffic between instance groups.
A lower-level hierarchical policy with higher priority (lower number) can override a higher-level policy rule.
Why this answer
Hierarchical firewall policies cannot be overridden at lower levels; they are always evaluated first. Since the org-level policy denies all internet ingress, the only way to allow HTTP is to create a hierarchical policy at a lower level (folder or project) that allows it, but those are also part of the hierarchy and are evaluated after org-level. Actually, hierarchical policies can be overridden by a lower-level policy with a higher priority, but the org-level policy has no higher priority? In GCP, hierarchical firewall policies are evaluated in order of precedence: organization > folder > project.
A policy at a lower level can override a higher-level policy if it has a higher priority (lower number) and is an allow rule. So the project team can create a project-level hierarchical policy with a higher priority (e.g., 100) allowing HTTP from 0.0.0.0/0, which will override the org-level deny (priority 1000).
A company wants to detect and block SQL injection attacks targeting their web application hosted on Compute Engine behind a Cloud Load Balancer. Which TWO steps should they take? (Choose TWO.)
Adaptive Protection uses ML to detect attacks including SQLi.
Removing the default route prevents direct internet egress.
Why this answer
To force traffic through Cloud NAT, you need to remove the default route (0.0.0.0/0), create a route that only allows traffic to the NAT gateway's IP range (or use a more specific route), and then add a deny egress rule for all other internet traffic.
A web application behind an HTTPS load balancer is experiencing a high volume of malicious requests with SQL injection patterns. The security team wants to block these requests with minimal latency impact. Which Cloud Armor feature should they use?
The CRS includes rules to detect and block SQL injection, XSS, and other web attacks.
Why this answer
Cloud Armor provides preconfigured WAF rules, including the OWASP ModSecurity Core Rule Set (CRS), which includes SQL injection detection rules. Enabling this set blocks SQL injection attempts.
A security team is configuring Cloud Armor to protect a web application. They need to block requests that contain SQL injection patterns, block requests from a known malicious IP list, and limit requests from any single IP to 2000 requests per minute. Which THREE actions must they take? (Choose three.)
You can use a deny list rule to block specific IP addresses.
Why this answer
To implement these requirements, you need to enable the preconfigured SQL injection rule set, create a custom rule with an IP allow/deny list for the malicious IPs, and create a rate limiting rule. Cloud Armor does not have a built-in list of malicious IPs; you must provide the list. The rate limiting is configured as a separate rule with action 'rateBasedThrottle'.
A security team needs to inspect all egress traffic from Compute Engine instances for malware using a third-party security appliance. They want to deploy the appliance in a separate VPC and route all egress traffic through it. Which THREE components are required? (Choose 3)
Required for traffic to cross VPCs if appliance is in a separate VPC.
Why this answer
Use a custom route to direct default egress traffic to the appliance, which is an internal load balancer (ILB) forwarding to the appliance instances. The appliance must be deployed in a different VPC, and VPC peering or Network Connectivity Center connects the VPCs. However, the simplest is to use an ILB in the same VPC as the instances, but the requirement says separate VPC.
So use VPC peering. The three required: custom route for default route (0.0.0.0/0) with next hop to ILB, an internal load balancer forwarding traffic to the appliance, and VPC peering (or VPN) to connect the VPCs. Alternatively, if using the same VPC, peering not needed.
But given separate VPC, peering is needed.
An engineer needs to allow a specific service account from another project to access a Cloud Storage bucket in the current project. The engineer wants to use the principle of least privilege. Which IAM role should be granted directly on the bucket to the service account?
Provides read-only access to objects, which is least privilege for reading.
Why this answer
Grant the predefined role `roles/storage.objectViewer` to the service account. This role provides read-only access to objects in the bucket.
An engineer needs to block a specific IP address from accessing an HTTPS load balancer. Which Cloud Armor rule should be used?
Custom rules can block specific IPs using 'src_ip_ranges'.
Why this answer
Cloud Armor custom rules allow IP allow/deny lists. A deny rule with the specific IP address will block traffic.
This rule allows HTTP traffic to VMs with the specified service account, which is the recommended approach.
Why this answer
Using a service account as the target (serviceAccount = web-sa@...) is the recommended approach for security, as it is more dynamic and less error-prone than using network tags. The rule allows ingress traffic from any source (0.0.0.0/0) on TCP port 80 to VMs with that service account.
A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?
VPC Service Controls enforces perimeters around Google Cloud APIs to control data access.
Why this answer
VPC Service Controls allows you to define a service perimeter that restricts access to Google Cloud APIs (like Cloud Storage) to only resources from authorized VPCs, preventing data exfiltration.
A company wants to detect and alert on potential network threats, such as malware and command-and-control traffic, within their VPC. They need a managed service that integrates with packet mirroring. Which Google Cloud service should they use?
Cloud IDS provides managed threat detection using packet mirroring.
Why this answer
Cloud IDS (Intrusion Detection System) is a managed network threat detection service that uses packet mirroring to inspect traffic for threats. It is powered by Palo Alto Networks.
A security engineer is designing a VPC Service Controls perimeter to protect sensitive BigQuery data. They need to allow a specific on-premises application (source IP range 203.0.113.0/24) to query BigQuery, and also allow a managed instance group in another project (project 'analytics') to export data from BigQuery to Cloud Storage. Which THREE configurations are required? (Choose three.)
The managed instance group's project must be within the perimeter to access BigQuery.
Why this answer
To allow on-premises access, an ingress rule with the source IP range is needed. To allow the managed instance group in another project, that project must be added to the perimeter (as a project within the perimeter) and an ingress rule for the service account or VPC of that project must be created. Also, the managed instance group will need an egress rule to allow access to Cloud Storage from within the perimeter.
So ingress rule for on-premises, adding the analytics project to the perimeter, and an egress rule for Cloud Storage are required.
A company is using Cloud Armor with adaptive protection enabled. They notice that adaptive protection has generated a rule that is blocking some legitimate traffic. What should they do to minimize false positives while still benefiting from adaptive protection?
A higher-priority allow rule can override the adaptive protection rule for specific traffic.
Why this answer
Adaptive protection works by learning traffic patterns and generating rules. The best practice is to initially set the adaptive protection rule to 'throttle' or 'log' mode (or use a low priority) to monitor its impact. Alternatively, you can override the rule with a higher-priority allow rule for known good traffic.
The recommended approach is to use the rule in preview or monitoring mode before enforcing.
A company uses VPC Service Controls to protect a project containing BigQuery datasets. They have an ingress rule that allows traffic from an on-premises network via a Cloud VPN tunnel. The on-premises IP range is 10.0.0.0/8. However, users on-premises are still getting access denied errors when querying BigQuery. The VPC Service Controls perimeter is in dry-run mode. What is the most likely cause?
The ingress rule must specify both the source network (on-prem IP range) and the identities (users or service accounts) to allow access. If identities are missing, access is denied by IAM, not VPC SC.
Why this answer
In dry-run mode, VPC Service Controls logs violations but does not enforce them. The access denied errors are likely caused by something else, such as IAM permissions or a missing identity in the ingress rule. Dry-run mode only logs, it does not block or allow access.
If the ingress rule is correctly configured, access should be allowed in dry-run mode. But the error persists, so the issue is not VPC Service Controls enforcement.
Service accounts are IAM-controlled and tied to VM identity, making them more secure.
Why this answer
Service account targets are preferred because they are more secure. Tags can be added or removed by anyone with compute.instances.setTags permission, while service accounts are managed centrally with IAM. Using service accounts ensures that the firewall rule applies based on the identity of the VM, which is harder to spoof.
A company is designing a secure multi-tenant environment in Google Cloud. Each tenant has its own VPC network and resources. The security team wants to centrally enforce a rule that denies all egress traffic to the internet from tenant VPCs, except for traffic to specific trusted IP ranges for software updates. They also want to ensure that tenant admins cannot override this rule. Which two actions should they take? (Choose two.)
Hierarchical policies apply to all projects below and cannot be overridden by VPC firewall rules.
Why this answer
Hierarchical firewall policies are inherited and cannot be overridden at lower levels. They can be used to enforce mandatory rules. The organization can create a hierarchical firewall policy at the organization or folder level that denies all egress to 0.0.0.0/0 except for the trusted IP ranges.
Additionally, to prevent tenant admins from overriding, they should not grant them the compute.firewallPolicies.update permission or similar. The correct choices are: create a hierarchical firewall policy and restrict permissions to modify firewall policies.
A company wants to protect a web application hosted on Google Cloud from common web attacks like SQL injection and cross-site scripting (XSS). They have deployed a global external HTTPS load balancer. Which TWO services or configurations should they use?
Cloud Armor includes preconfigured rules for SQLi, XSS, etc.
Why this answer
Cloud Armor provides WAF capabilities with preconfigured rules for OWASP Top 10 threats, including SQLi and XSS. Additionally, using an HTTPS load balancer ensures encrypted traffic. For this question, the correct answers are Cloud Armor and enabling HTTPS (which is already done).
But since the load balancer is already HTTPS, the focus is on Cloud Armor. The other options: Cloud IDS is for network threat detection, not WAF; VPC Service Controls is for API access control; SSL policy is for TLS settings.
A security engineer wants to restrict access to a Cloud Storage bucket so that only requests originating from within a specific VPC network can access the bucket. Which Google Cloud service should they use?
VPC Service Controls use service perimeters to restrict access to Google Cloud services based on context like VPC network.
Why this answer
VPC Service Controls allow you to define a service perimeter that restricts access to Google Cloud services (including Cloud Storage) based on the originating VPC network and identity.
A security engineer is configuring a VPC Service Controls perimeter to protect a Cloud Storage bucket. They want to allow a specific on-premises network (IP range 203.0.113.0/24) to access the bucket, while still blocking other external networks. Which TWO components must they configure? (Choose TWO.)
Ingress rules allow specified access levels to cross the perimeter.
Why this answer
You need an access level (based on IP) to define the allowed IPs, and an ingress rule to allow traffic from that access level into the perimeter.
Private Google Access enables the VPC (and on-premises via VPN) to use the PSC endpoints.
Why this answer
Private Service Connect provides private IP endpoints for Google APIs in a VPC. Private Google Access enables VMs in the VPC to use those endpoints. For on-premises, Cloud VPN provides connectivity to the VPC.
However, Private Google Access is required for on-premises to reach the endpoints via the VPN. So the two correct answers are Private Service Connect and Private Google Access.
You are designing a VPC Service Controls perimeter to protect a project containing BigQuery datasets accessible from a data analytics VPC. You need to allow a specific set of on-premises users (identified by IP range 203.0.113.0/24) to query BigQuery from outside the perimeter, but block all other external access. What is the correct configuration?
This correctly uses an access level for IP restriction and an ingress rule to allow that access level into the perimeter.
Why this answer
VPC Service Controls uses access levels for IP-based restrictions. To allow external access from a specific IP range, you create an access level that includes that IP range, then define an ingress rule in the service perimeter that grants access to that access level. Dry-run mode is for testing, not production enforcement.
A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?
Creating a new certificate and updating the proxy is the correct procedure and avoids downtime.
Why this answer
To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.
An organization uses SSL policies for their HTTPS load balancer. They need to allow TLS 1.2 and 1.3 only, and use the most secure cipher profile available. Which SSL policy configuration should they choose?
RESTRICTED enforces the strongest ciphers with TLS 1.2+.
Why this answer
The 'RESTRICTED' cipher profile enforces strong ciphers (TLS 1.2+), while 'MODERN' allows TLS 1.2 and 1.3 with good security. However, 'RESTRICTED' is the most secure profile that supports TLS 1.2 and 1.3.
An organization wants to provide private, on-premises access to Google Cloud APIs (e.g., Cloud Storage, BigQuery) without traversing the public internet. They have a Direct Connect link to Google Cloud. Which solution should they implement?
Private Service Connect enables private endpoints to Google APIs using internal IP addresses.
Why this answer
Private Service Connect allows you to create private endpoints to access Google APIs (like googleapis.com) using internal IP addresses, without going over the internet. It works with Direct Connect or VPN. VPC Service Controls restrict access but do not provide private connectivity.
Cloud NAT provides outbound internet access, not private API access. Private Google Access enables on-premises access to Google APIs via on-premises DNS, but it still uses public IPs unless combined with Private Service Connect.
A security engineer wants to allow egress traffic from Compute Engine instances to the internet only for updates to a specific set of packages. All other egress must be denied. Which VPC firewall rule configuration should the engineer use?
Correct: The allow rule matches the specific destinations, and the deny all rule with lower priority (higher number) catches everything else. Because VPC firewall rules are evaluated from highest to lowest priority, the allow rule first permits the desired traffic, then the deny rule blocks the rest.
Why this answer
VPC firewall rules are stateful, so allowing egress for specific destinations (e.g., package repositories) automatically allows return traffic. Deny rules should be used to block all other egress. The correct approach is an egress allow rule for the specific destinations and a lower-priority egress deny rule for all other traffic.
A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?
An ingress rule with an IP-based access level allows traffic from that IP to cross the perimeter.
Why this answer
VPC Service Controls access levels can define IP-based conditions. By creating an ingress rule that allows traffic from the specified IP address to access the BigQuery API, the external application can be authorized.
A company has a VPC Service Controls perimeter that includes BigQuery and Cloud Storage. They need to allow a specific on-premises application (with a static IP) to access a BigQuery dataset within the perimeter. Which configuration should they use?
Correct: An access level can be defined using the IP address, and an ingress rule allows that access level to cross the perimeter.
Why this answer
VPC Service Controls allows ingress rules to permit traffic from specific identities or IP ranges into the perimeter. They need to create an ingress rule that allows the on-premises IP to access BigQuery.
An organization has a security policy that requires TLS 1.2 or higher for all HTTPS traffic to their external HTTP(S) load balancer. They also need to disable weak cipher suites. Which configuration should be applied?
This ensures only strong ciphers are allowed with TLS 1.2+.
An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only requests originating from a specific VPC network are allowed. Which Google Cloud service should they use?
VPC Service Controls create a perimeter around Google Cloud APIs, restricting access based on network and identity.
Why this answer
VPC Service Controls allow you to define a service perimeter around a set of Google Cloud APIs, restricting access to only those identities and networks you specify. This is the correct service for this requirement. Firewall rules control network traffic to VM instances, not API access.
Cloud Armor protects against web attacks. Private Service Connect provides private connectivity to Google APIs but does not restrict access.
An organization has a hub-and-spoke VPC setup with Shared VPC. The security team wants to enforce a rule that all egress traffic from any project in the organization must pass through a central inspection appliance in the hub VPC. Which firewall configuration approach meets this requirement?
Correct: By configuring a default route (0.0.0.0/0) with the inspection appliance as next hop, all egress traffic is forced through it. Firewall rules can then allow only traffic that matches this path.
Why this answer
Hierarchical firewall policies apply to the entire organization, folder, or project and cannot be overridden by VPC firewall rules. They can be used to enforce mandatory inspection. However, they cannot specify next-hop appliances.
To force traffic through an inspection appliance, you need to use a combination of routes and firewall rules. The correct approach is to set up a default route pointing to the inspection appliance as next hop, and use firewall rules to block direct egress unless it goes through the appliance.
Private Service Connect endpoints in a VPC provide private IP access to Google APIs, and can be reached from on-premises via Cloud VPN or Interconnect.
A security team needs to apply a security policy that blocks requests to their HTTP load balancer from a specific geographic region (e.g., Country A). Which Cloud Armor feature should they use?
Custom rules using CEL can match on geographic attributes like origin.region_code.
Why this answer
Cloud Armor supports geolocation-based blocking using custom rules with geographic origin matching (e.g., origin.region_code).
An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?
Managed certificates require DNS records to prove domain ownership; incorrect records prevent renewal.
Why this answer
Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.
A company wants to enforce that traffic between two projects in the same organization must go through a central inspection VPC. They need a firewall rule that denies all traffic between the projects except through the inspection VPC. Which type of firewall rule should they use?
Hierarchical policies can enforce rules across projects and cannot be overridden, ensuring central inspection.
Why this answer
Hierarchical firewall policies are applied at the folder or organization level and can enforce rules across projects. They are inherited and cannot be overridden by lower-level rules, making them suitable for central enforcement.
A security engineer is designing a network security architecture for a multi-project environment. They need to enforce a baseline set of firewall rules across all projects in the organization, but allow individual project teams to add their own specific rules. Which TWO components should they use?
Project teams can add their own rules using VPC firewall rules (or project-level hierarchical policies).
Why this answer
Hierarchical firewall policies can be applied at the organization level to enforce baseline rules. These policies are inherited by all projects. Individual project teams can then create their own VPC firewall rules (or project-level hierarchical policies) that are evaluated after the org-level policies, allowing them to add specific rules without overriding the baseline.
An organization wants to allow only specific trusted IP ranges to access a web application behind a Cloud Load Balancer. Which Cloud Armor feature should be used?
Cloud Armor custom rules can match on source IP ranges and allow or deny traffic accordingly.
Why this answer
Cloud Armor allows IP allow/deny lists using custom rules. Use a security policy with a rule that allows traffic from specified IP ranges and denies all other traffic.
An organization has multiple VPC networks in different projects. They need to centrally manage firewall rules that apply to all VPCs in the organization and ensure that project owners cannot override them. Which solution should they use?
Hierarchical policies are inherited and cannot be overridden by lower-level rules.
Why this answer
Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks. They cannot be overridden by lower-level firewall rules. This is the correct solution for centralized, unoverrideable rules.
Network firewall policies are scoped to a single VPC network.
A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)
The policy takes effect when attached to the proxy.
Why this answer
To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.
Which VPC firewall rule target type is recommended for security because it can be dynamically applied to instances based on their service account?
Service accounts are dynamic and align with identity-based security.
Why this answer
Service account targets allow rules to be applied based on the instance's service account, enabling dynamic and scalable security policies compared to static network tags.
A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They do not want to manually manage certificate files. Which approach should they use?
Google-managed certificates handle provisioning and renewal automatically.
Why this answer
Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for load balancers. No manual file uploads are needed.
A security engineer needs to monitor network traffic for potential threats in a VPC. They want to inspect all traffic for malware signatures and alert on high-severity threats. The solution should be natively integrated with GCP. Which service should they use?
Cloud IDS provides network threat detection using Palo Alto Networks and monitors all VPC traffic.
Why this answer
Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect traffic for malware and other threats. It integrates with packet mirroring in GCP.
An organization wants to use VPC Service Controls to protect BigQuery data. They need to allow a group of data analysts to access BigQuery from outside the perimeter (e.g., from their laptops) while maintaining the perimeter for all other users. Which TWO configurations are necessary?
Access levels are used in ingress rules to specify who is allowed to cross the perimeter.
Why this answer
To allow specific users to access a service from outside the perimeter, you must create an access level that identifies those users (e.g., by IP range or device) and then create an ingress rule that permits traffic from that access level to BigQuery. The access level can be based on user identity (e.g., via BeyondCorp) or IP ranges.
A security team wants to block all incoming traffic from a specific country to their web application behind a global HTTPS load balancer. They also need to allow traffic from all other countries. Which Cloud Armor feature should be used?
Cloud Armor custom rules can use the origin.region_code field to match the source country.
Why this answer
Cloud Armor supports geo-based access control. By creating a custom rule that uses a GeoIP match condition to deny traffic from the specific country, all other traffic is allowed by default (or via another rule).
A company wants to use Cloud IDS to detect threats in their VPC. They have created a Cloud IDS endpoint and need to configure packet mirroring. Which TWO resources must be in place for packet mirroring to work? (Choose TWO.)
The IDS endpoint is in the collector network.
Why this answer
Packet mirroring requires a Collector VPC (where the IDS endpoint resides) and a mirrored VPC (where source VMs are). The source VMs must be tagged.
A company wants to restrict access to Cloud Storage buckets so that only resources in a specific VPC network can reach them, and data cannot be exfiltrated to other networks. Which Google Cloud service should they use?
Correct: VPC Service Controls create a service perimeter that isolates Google Cloud services and prevents data exfiltration.
Why this answer
VPC Service Controls allows creating service perimeters that protect Google Cloud services (including Cloud Storage) by restricting access from outside the perimeter. Resources inside the perimeter can access the protected services, but data cannot be exfiltrated to external networks.
A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?
Hierarchical firewall policies are applied at the organization or folder level, inherited, and cannot be overridden.
Why this answer
Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network.
VPC firewall rules are per project and can be overridden.
A company uses Cloud Armor Managed Protection Plus to protect their applications. They want to automatically block IP addresses that are identified as malicious by adaptive protection. How should they configure this?
Correct: Adaptive protection has an auto-deploy option that automatically creates deny rules for identified malicious IPs.
Why this answer
Cloud Armor adaptive protection uses machine learning to detect DDoS attacks. It can automatically create deny rules for malicious IPs if configured to do so. The setting is in the security policy's adaptive protection configuration.
An organization uses VPC Service Controls with a service perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises service account to write data to a Cloud Storage bucket inside the perimeter. The on-premises network connects via Cloud VPN. What must be configured in the perimeter?
Ingress rules allow external identities and networks to access resources inside the perimeter.
Why this answer
To allow an on-premises service account to access resources inside a service perimeter, you need an ingress rule that specifies the source (the on-premises identities and network) and the target resources (the Cloud Storage bucket). The source must include both the identity (service account) and the network (VPC or IP range).
An organization uses VPC Service Controls in dry-run mode for a project containing Google Cloud Storage. They notice that BigQuery jobs are being logged as violations. How should they interpret this?
Dry-run logs violations without enforcement.
Why this answer
In dry-run mode, VPC Service Controls logs violations without enforcement, allowing administrators to review and adjust perimeters before enabling enforcement.
A security team wants to detect and block network-based threats such as malware and command-and-control traffic within their VPC. They need a managed service that provides deep packet inspection. Which Google Cloud service should they use?
Correct: Cloud IDS provides managed network threat detection and can block threats.
Why this answer
Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with packet mirroring to analyze traffic.
Hierarchical policies are mandatory and override lower-level rules.
Why this answer
Hierarchical firewall policies are inherited and cannot be overridden by lower-level rules. The deny-all rule from the policy takes precedence over any VPC firewall rule that would allow traffic.
Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?
Adaptive Protection uses ML to detect anomalies.
Why this answer
Cloud Armor Adaptive Protection uses ML-based DDoS detection to automatically learn normal traffic patterns and alert or mitigate attacks.
A company is implementing VPC Service Controls to protect a project that contains Cloud Storage and BigQuery. They want to allow a specific on-premises service account to read data from Cloud Storage and write to BigQuery. The on-premises network connects via Cloud VPN. Which TWO components must be configured in the service perimeter? (Choose two.)
Ingress rules allow external identities to access resources inside the perimeter.
Why this answer
To allow external access, you need an ingress rule that specifies the source (on-premises service account and the Cloud VPN network) and the allowed services (Cloud Storage and BigQuery). An access level can be used to define the IP range, but the ingress rule is the primary mechanism. Adding the service to the perimeter is already done; you don't need to add it again.
An egress rule is not needed for inbound access.
A company wants to prevent data exfiltration by restricting access to Google APIs from only authorized VPC networks. They also need to allow a specific on-premises IP range to access BigQuery. Which TWO services should be used together? (Choose 2)
Access levels define conditions (like IP ranges) to allow access into the perimeter.
Why this answer
VPC Service Controls create a service perimeter around Google APIs, and an access level (IP-based) can be used to allow the on-premises IP range into the perimeter.
A company is deploying an internal service on GKE that needs to be accessible privately from on-premises data centers over a VPN connection. The service should not be exposed to the internet. Which connectivity solution is MOST appropriate?
PSC enables private connectivity; internal load balancer keeps traffic within the VPC and on-premises via VPN.
Why this answer
Private Service Connect (PSC) allows publishing services using internal IP addresses that are accessible via VPC peering or VPN. The service can be exposed as an internal load balancer and attached to a PSC service attachment. On-premises can reach it via the VPN tunnel to the VPC.
An organization wants to use Cloud IDS to detect network threats within their VPC. They have enabled the Cloud IDS endpoint and configured packet mirroring. Which of the following is required for the packet mirroring policy to work?
This tag is used to select which VMs have their traffic mirrored.
Why this answer
Packet mirroring requires that the source VMs have the cloud-ids-packet-mirroring tag. The mirrored traffic is sent to the IDS endpoint via an internal load balancer.
A company uses Cloud Armor to protect a web application. They want to block requests that contain SQL injection patterns based on the OWASP ModSecurity Core Rule Set. Which preconfigured rule set should they enable?
Correct: The OWASP CRS includes rules for SQL injection, XSS, etc.
Why this answer
Cloud Armor provides preconfigured WAF rules based on the OWASP ModSecurity CRS. To block SQL injection, the rule set 'owasp-crs' with the specific paranoia level can be used, or the 'sqli' rule set if available. The correct answer is the OWASP ModSecurity CRS rule set that includes SQL injection detection.
A company wants to deploy a web application with a global load balancer and needs to configure SSL/TLS termination. They want to use a certificate from their own CA and have the ability to manage multiple certificates for different domains. Which THREE steps should they take?
For self-managed certificates, the full chain (leaf, intermediates) must be uploaded for the load balancer to trust the certificate.
Why this answer
To use self-managed certificates with a load balancer, you can upload the PEM file directly to the load balancer, or use Certificate Manager to manage multiple certificates. The steps: create a Certificate Manager certificate resource with your PEM, map it to the load balancer target, and ensure the certificate is properly uploaded. Self-managed certificates require manual renewal, so you need to monitor expiration.
A company wants to enforce that no Compute Engine firewall rule in any project under an organization can have a source range of 0.0.0.0/0 for RDP (port 3389). Which approach should be used?
Hierarchical firewall policies are enforced across all VPCs under the organization and cannot be overridden.
Why this answer
Use a hierarchical firewall policy at the organization level that denies ingress traffic on port 3389 from any source (0.0.0.0/0). Hierarchical policies are inherited and cannot be overridden by lower-level firewall rules.
Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?
Adaptive Protection uses ML for DDoS detection.
Why this answer
Cloud Armor Adaptive Protection uses ML to model normal traffic and detect anomalous patterns indicative of DDoS attacks.
An organization uses VPC Service Controls to protect BigQuery. They want to test a new access level that allows access only from a specific IP range before enforcing it. Which mode should they use?
Dry-run mode logs violations but does not block them.
Why this answer
Dry-run mode allows testing perimeters without enforcement, logging violations for review.
Correct: SSL policies define TLS profiles and can enforce minimum TLS version.
Why this answer
SSL policies allow you to configure the minimum TLS version and cipher suites for HTTPS load balancers. You can create an SSL policy with TLS 1.2 as the minimum and attach it to the target HTTPS proxy of each load balancer.
A service provider wants to expose an internal service to external consumers in a controlled manner, without giving them direct access to the VPC. Which Google Cloud service should be used?
PSC enables publishing services with private connectivity.
Why this answer
Private Service Connect allows service providers to publish their services via PSC endpoints, which consumers can access privately from their own VPCs without traversing the internet.
Ready to test yourself?
Try a timed practice session using only Pcse Network Security questions.