Configuring, implementing and managing a cloud network security solution — PCNE Practice Quiz

Question 1

A retail company runs a public storefront behind a global external Application Load Balancer with a Cloud Armor security policy attached to the backend service. During a flash sale, the site experiences a sudden surge of HTTP requests that appear to originate from thousands of distinct IP addresses with subtly varied request patterns, overwhelming the backends. The security team cannot manually author rate-limit or IP-deny rules fast enough to keep pace with the shifting attack signatures. Which Cloud Armor capability should they enable to automatically detect and generate a suggested mitigation rule for this Layer 7 volumetric attack?

Accepted Answer

Enable Adaptive Protection on the Cloud Armor security policy so it baselines normal traffic and auto-generates a suggested rule to mitigate the anomalous Layer 7 attack.

Answer

Configure a preconfigured WAF rule using the OWASP ModSecurity Core Rule Set (CRS) to block the SQL injection signatures in the requests.

Answer

Attach a rate-limiting throttle rule keyed on a single named IP address list containing the known attacker ranges.

Answer

Enable edge security policies with a country-based geo-match deny rule to block the source region generating the traffic.

Question 2

Your company serves static assets from a Cloud Storage backend bucket behind a global external Application Load Balancer with Cloud CDN enabled. Security wants to block requests from a list of known malicious IP ranges as early as possible—ideally at Google's edge and even for cached content served by CDN—before those requests reach the backend bucket or consume cache resources. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Attach an edge security policy to the backend bucket with deny rules matching the malicious IP ranges

Answer

Attach a backend security policy to the backend bucket with deny rules matching the malicious IP ranges

Answer

Configure a hierarchical firewall policy at the organization level to deny the malicious IP ranges

Answer

Add a VPC network firewall rule denying the malicious IP ranges on the load balancer's forwarding rule

Question 3

Your security team wants to allow a large SaaS partner's published IP ranges to reach your global external Application Load Balancer while blocking all other source IPs. The partner distributes their egress ranges as a curated list that Google maintains and updates automatically. You must implement this in a Cloud Armor security policy with minimal ongoing maintenance and without exceeding rule limits from listing hundreds of individual CIDRs. Which approach should you use?

Accepted Answer

Create a Cloud Armor security-policy rule whose match expression references the partner named IP address list (address-group / named IP list), set the rule action to allow, and add a default deny rule at the lowest priority.

Answer

Add every partner CIDR block as separate allow rules in the Cloud Armor policy and rely on rule priority to deny remaining traffic.

Answer

Configure a VPC firewall rule with the partner CIDRs as source ranges and attach it to the load balancer backend instances.

Answer

Enable Cloud Armor Adaptive Protection so it automatically learns and allowlists the partner's traffic patterns.

Question 4

A retail company runs a public web application behind a global external Application Load Balancer, protected by a Cloud Armor security policy. The security team enables the preconfigured SQL injection (sqli-v33-stable) WAF rule at its default sensitivity. Immediately, legitimate users report that they can no longer submit product reviews containing text like "O'Brien's shop is great", and logs show these requests are being blocked by the sqli rule. The team must keep strong SQLi protection but stop blocking valid review submissions. What is the most appropriate action?

Accepted Answer

Lower the preconfigured sqli rule sensitivity level and/or exclude the specific request field (the review body) from inspection using the rule's opt-out expression, then retest.

Answer

Delete the sqli-v33-stable rule entirely and rely on Adaptive Protection to detect any injection attempts automatically.

Answer

Add a higher-priority allow rule that matches all requests to the review submission URL path, bypassing WAF evaluation for that path.

Answer

Switch the security policy to preview (dry-run) mode so the sqli rule logs matches but never blocks any traffic.

Question 5

You manage a Google Cloud Armor security policy attached to a global external Application Load Balancer serving a production e-commerce site. Your security team wants to introduce a new WAF rule that blocks requests matching a broad regular expression, but they are concerned it may inadvertently block legitimate customer traffic. They need to evaluate the real-world impact of the rule against live production traffic before it actually starts denying any requests. What should you configure?

Accepted Answer

Add the rule with the '--preview' flag enabled so matches are logged in Cloud Logging without enforcing the deny action.

Answer

Add the rule with action 'deny(403)' but set the rule to a lower priority than the default rule so it is never evaluated first.

Answer

Deploy the rule in a separate Cloud Armor edge security policy and monitor Adaptive Protection alerts before promoting it.

Answer

Enable Cloud Armor rate limiting in 'throttle' mode so the rule only restricts a percentage of matching requests during testing.

Question 6

An e-commerce company runs a public web application behind a global external Application Load Balancer protected by Google Cloud Armor. During flash sales, individual clients sometimes send bursts of requests to the /api/checkout path, degrading the backend for everyone. The security team wants to allow legitimate traffic to continue but automatically throttle any single client IP that exceeds 100 requests per minute to that path, without permanently blocking the client. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Create a throttle rule with rate_limit_options specifying a count of 100 per 60-second interval and enforce_on_key set to IP, matching requests to /api/checkout.

Answer

Create a rate-based ban rule with action 'deny(429)' that permanently blocks clients exceeding the threshold.

Answer

Enable Adaptive Protection on the security policy so it automatically learns and mitigates the traffic burst.

Answer

Configure Cloud NAT with a reduced minimum ports-per-VM setting to limit the number of concurrent client connections.

Question 7

Your company runs a fleet of Compute Engine VMs without external IP addresses in a subnet that uses Cloud NAT for internet egress. A SaaS partner requires that all outbound requests to their API originate from a small, fixed set of source IP addresses that you must provide to them for allowlisting. Currently the Cloud NAT gateway is configured with automatic NAT IP address allocation. What should you do to meet the partner's requirement while continuing to allow egress?

Accepted Answer

Reconfigure the Cloud NAT gateway to use manual NAT IP address allocation with reserved static external IP addresses, then share those addresses with the partner.

Answer

Assign ephemeral external IP addresses directly to each VM and remove the Cloud NAT gateway so traffic egresses with predictable addresses.

Answer

Keep automatic NAT IP allocation and enable Dynamic Port Allocation so the same IP addresses are always reused for the partner's traffic.

Answer

Create an egress VPC firewall rule that rewrites the source IP of outbound packets to a fixed address before they leave the gateway.

Question 8

A financial services company runs Compute Engine VMs with no external IP addresses in a private subnet. The security team requires two things for internet egress: (1) all outbound HTTP/HTTPS traffic must be restricted to an approved list of FQDNs (e.g., only *.partnerbank.com and api.provider.net), and (2) any non-HTTP(S) egress that is still permitted must be source-NATed through a predictable set of static IP addresses so partners can allowlist them. What should you deploy to meet BOTH requirements with the least operational overhead?

Accepted Answer

Deploy Secure Web Proxy with a URL/FQDN allowlist policy for HTTP/HTTPS egress, and configure Cloud NAT with manually assigned static external IP addresses for the remaining permitted egress traffic.

Answer

Configure Cloud NAT with automatic IP allocation and add hierarchical firewall rules that match destination FQDNs to filter HTTP/HTTPS egress.

Answer

Deploy a self-managed NGINX proxy appliance with IP forwarding as the only egress path and rely on Cloud Armor named IP lists to restrict destinations.

Answer

Use VPC Service Controls perimeters to restrict egress to approved FQDNs and enable Private Google Access so VMs reach the internet through Google's front end.

Question 9

A large enterprise organizes its Google Cloud resources with an organization node, a 'security-controls' folder, and multiple team folders beneath it. The central security team defines a hierarchical firewall policy attached at the organization level that must enforce a mandatory deny on all inbound RDP (TCP 3389) from the internet, while allowing individual application teams to define their own rules for other traffic in their project-level network firewall policies. However, for a specific range of trusted corporate egress IPs, the security team wants lower-level policies and rules to be able to make the final allow/deny decision for RDP rather than having it blocked at the org level. Which configuration correctly meets these requirements?

Accepted Answer

Create an org-level hierarchical policy with a 'deny' rule for TCP 3389 from 0.0.0.0/0, plus a higher-priority 'goto_next' rule for TCP 3389 from the trusted corporate IP range.

Answer

Create an org-level hierarchical policy with an 'allow' rule for TCP 3389 from the trusted corporate IP range, and rely on VPC implied rules to deny all other RDP.

Answer

Create the deny rule for TCP 3389 only in each project's network firewall policy, since hierarchical policies cannot use the 'goto_next' action.

Answer

Attach the hierarchical policy to the 'security-controls' folder with a single 'deny' rule for TCP 3389, which automatically exempts the trusted IP range through evaluation order.

Question 10

A financial services company uses a Google Cloud organization with three folders: 'prod', 'dev', and 'shared-services'. The central security team must enforce a non-overridable rule that blocks all inbound RDP (TCP 3389) traffic to every VPC in the organization, while allowing individual project teams to still define their own additional allow/deny rules for other ports. The security team also wants a separate rule in the 'dev' folder that permits SSH (TCP 22) from the corporate CIDR range, but this rule should be evaluatable by lower-level project rules if they choose to override. Which design meets these requirements?

Accepted Answer

Create an organization-level hierarchical firewall policy with a 'deny' rule for TCP 3389 using the 'goto_next' action disabled, and a folder-level hierarchical firewall policy on 'dev' with a rule for TCP 22 that uses the 'goto_next' action so evaluation is delegated to (and thus overridable by) lower-level policies.

Answer

Create VPC firewall rules in every project to deny TCP 3389 and rely on project owners to keep them in sync; add an allow rule for TCP 22 in each 'dev' project.

Answer

Create an organization-level hierarchical firewall policy with an 'allow' rule for TCP 3389 and a folder-level policy on 'dev' that denies TCP 22, both using 'goto_next' so projects can override them.

Answer

Create a single VPC-level firewall policy in the Shared VPC host project that denies TCP 3389 for all attached service projects and allows TCP 22 in the 'dev' subnet ranges.

Question 11

Your team applies a global network firewall policy to a VPC. The policy contains two rules: rule at priority 1000 denies all egress to 203.0.113.0/24 on TCP 443, and rule at priority 500 allows egress to 203.0.113.10/32 on TCP 443. A VM in the VPC attempts an HTTPS connection to 203.0.113.10. In addition, an implied allow-egress and implied deny-ingress exist at the VPC level. What is the outcome of the VM's connection, and why?

Accepted Answer

The connection is allowed because the rule at priority 500 is evaluated before the priority 1000 deny rule.

Answer

The connection is denied because the more specific /32 rule is always overridden by the broader /24 deny rule.

Answer

The connection is denied because network firewall policy rules are evaluated from highest numeric priority to lowest.

Answer

The connection is allowed only if the priority 500 rule also has a target tag matching the VM.

Question 12

A security engineer manages a global network firewall policy in a Shared VPC host project. Application VMs in multiple service projects need a rule that allows TCP 8443 traffic only between VMs that share a common workload identity, regardless of their IP addresses, which change frequently due to autoscaling. The engineer wants the rule to remain valid even if VMs are recreated with new IPs, and to work across the VPC network. Which approach should the engineer use to define the source and target in the network firewall policy rule?

Accepted Answer

Use secure tags (resource manager tags bound to the VM instances) as both the source and target in the firewall policy rule.

Answer

Use network tags on the VM instances as both the source and target in the firewall policy rule.

Answer

Create named IP lists in Cloud Armor referencing the VM IPs and reference them in the firewall policy rule.

Answer

Use service accounts as the source and a CIDR range covering the subnet as the target in the firewall policy rule.

Question 13

A security engineer is building a global network firewall policy for a VPC. They create a rule at priority 1000 that allows TCP 443 ingress to instances whose target is the service account 'web-sa@project.iam.gserviceaccount.com'. Separately, another engineer creates a rule at priority 900 that denies all ingress to instances with the secure tag 'quarantine'. An instance is running with the service account 'web-sa' AND has the secure tag 'quarantine' applied. Incoming HTTPS traffic to this instance is being dropped. What is the correct explanation?

Accepted Answer

The deny rule at priority 900 is evaluated before the allow rule at priority 1000, so the quarantine deny takes effect and traffic is dropped.

Answer

Rules targeting service accounts always take precedence over rules targeting secure tags regardless of priority, so the allow rule should win and traffic should pass.

Answer

You cannot mix service-account-targeted rules and secure-tag-targeted rules in the same network firewall policy, so the policy is invalid and all traffic is dropped.

Answer

The implied allow-ingress rule overrides both explicit rules, so the drop must be caused by a missing route rather than firewall configuration.

Question 14

Your company must route all east-west traffic between two application VPCs (VPC-A and VPC-B) through a self-managed firewall virtual appliance running on a Compute Engine VM for deep packet inspection. The appliance VM has two network interfaces: nic0 in VPC-A and nic1 in VPC-B. During testing, traffic reaches the appliance VM but the appliance cannot forward packets destined to the other VPC's subnets, and the packets are dropped. What must you configure to enable the appliance to forward traffic between the two VPCs?

Accepted Answer

Enable IP forwarding (canIpForward) on the appliance VM and create custom static routes in each VPC pointing to the appropriate appliance interface as the next hop.

Answer

Enable VPC Network Peering between VPC-A and VPC-B so subnet routes are automatically exchanged through the appliance.

Answer

Add both VPC networks to the same subnet and assign the appliance VM an alias IP range spanning both subnets.

Answer

Configure a Cloud NAT gateway on the appliance VM's subnet so it can translate and forward inter-VPC traffic.

Question 15

A security team deploys a self-managed third-party IDS as a collector behind an internal passthrough load balancer and configures a Packet Mirroring policy to mirror all ingress and egress traffic from a set of production VMs. After deployment, the IDS reports that it can see the packets but cannot inspect the application-layer payloads of most HTTPS sessions to detect threats. The team asks how to enable deep payload inspection of this encrypted traffic. What is the correct guidance?

Accepted Answer

Packet Mirroring copies packets as-is, so TLS-encrypted payloads remain encrypted; you must terminate/decrypt TLS elsewhere (e.g., at a load balancer or proxy) or perform inspection where plaintext is available.

Answer

Enable the 'decrypt-mirrored-traffic' flag on the Packet Mirroring policy so Google decrypts the payload before forwarding copies to the collector.

Answer

Increase the mirrored packet sampling rate to 100% so the IDS receives complete TLS session keys along with the packets.

Answer

Attach a Cloud Armor edge security policy to the mirrored subnet to strip TLS encryption before packets reach the collector.

Question 16

A security team at a financial services company needs to inspect east-west traffic between production application VMs using a third-party intrusion detection system (IDS). The IDS runs on a fleet of self-managed VM appliances that must scale horizontally. Traffic from mirrored production instances must be delivered to these appliances without dropping packets during appliance autoscaling events, and the collector must be reachable from the mirrored sources within the same region. How should the security team configure the Packet Mirroring collector destination?

Accepted Answer

Configure the Packet Mirroring policy to send mirrored traffic to an internal passthrough Network Load Balancer that fronts the managed instance group of IDS appliances, with the forwarding rule marked for Packet Mirroring.

Answer

Configure the Packet Mirroring policy to send mirrored traffic directly to the primary internal IP of each IDS appliance VM listed as individual collector targets.

Answer

Configure the Packet Mirroring policy to send mirrored traffic to an external passthrough Network Load Balancer so the IDS appliances can also receive traffic from other regions.

Answer

Configure the Packet Mirroring policy to send mirrored traffic to an internal Application Load Balancer (Layer 7) fronting the IDS appliance instance group.

Question 17

SecureCorp runs a fleet of web servers in a managed instance group (MIG) that autoscales between 5 and 40 instances. The security team deployed a self-managed IDS appliance behind an internal passthrough load balancer as a collector. They need to mirror traffic from ALL current and future web server instances to the IDS, without editing the packet mirroring policy each time the MIG scales. How should they configure the mirrored source in the packet mirroring policy?

Accepted Answer

Select the entire subnet(s) containing the MIG, or use a shared network tag applied to the instance template, as the mirrored source

Answer

Specify each instance individually as a mirrored source and add a Cloud Function to update the policy on scale events

Answer

Set the internal load balancer fronting the IDS as both the mirrored source and the collector destination

Answer

Enable VPC Flow Logs on the subnet, which automatically forwards mirrored packets to the collector ILB

Question 18

A security team wants to mirror traffic from a specific group of production web servers to a self-managed intrusion detection appliance for deep packet inspection. The web servers all share the network tag 'web-frontend'. The team wants to avoid mirroring traffic from all other VMs in the same subnet to control the volume of mirrored data and analysis costs. When configuring the Packet Mirroring policy, how should they specify which instances are mirrored?

Accepted Answer

Set the mirrored source using the network tag 'web-frontend' in the Packet Mirroring policy so only tagged instances are mirrored

Answer

Mirror the entire subnet containing the web servers, then apply a firewall rule referencing the 'web-frontend' tag to exclude other VMs

Answer

Configure the collector destination as an instance group filtered by the 'web-frontend' tag

Answer

Attach a service account to the web servers and specify that service account as the mirrored source in the policy

Question 19

A financial services company runs application VMs in a VPC with no external IP addresses. Compliance requires that all outbound HTTPS traffic to the internet be inspected and restricted so that VMs can only reach an approved allowlist of external hostnames (for example, *.partner-bank.com and api.marketdata.io). The security team wants a fully managed Google Cloud service that enforces these URL/hostname policies with TLS inspection, rather than deploying and maintaining their own proxy fleet. Which approach should you implement?

Accepted Answer

Deploy Secure Web Proxy (SWP) with a gateway security policy referencing URL lists, and configure the VMs to send egress web traffic through the SWP endpoint.

Answer

Configure Cloud NAT with a specific set of static external IPs and rely on Cloud NAT logging to block unapproved destinations.

Answer

Create a Google Cloud Armor edge security policy with an allowlist of hostnames applied to the VPC egress path.

Answer

Deploy a self-managed third-party proxy appliance in a managed instance group and route egress through it with a custom default route.

Question 20

A financial services company runs application VMs in a private subnet (no external IPs) that must reach a specific list of approved SaaS HTTPS endpoints on the internet. Security requires that egress be filtered by fully-qualified domain name (not just IP), that TLS sessions be intercepted and inspected against the allowlist, and that all egress decisions be centrally logged. The team already uses Cloud NAT for other workloads. Which approach meets these requirements?

Accepted Answer

Deploy Secure Web Proxy (SWP) with a TLS inspection policy and URL/host-based security policy rules, and route the VMs' egress web traffic through the SWP endpoint.

Answer

Configure Cloud NAT with a manual static IP and add VPC firewall egress rules that allow only the approved destination FQDNs.

Answer

Create a Cloud Armor security policy with preconfigured WAF rules and attach it to the VMs to filter outbound HTTPS by hostname.

Answer

Enable Private Google Access on the subnet and use hierarchical firewall policies to allow egress only to the approved SaaS domain names.

More PCNE practice