Securing communications and establishing boundary protection — PCSE Practice Quiz

Question 1

A media company serves static video thumbnails through a global external Application Load Balancer with Cloud CDN enabled. Their security team wants to filter requests based on source IP address and geographic region BEFORE any content is served from the CDN cache, so that malicious or out-of-region requests never reach cached or backend content. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Attach a Cloud Armor edge security policy to the backend service, using rules that match on source IP and region expressions

Answer

Attach a standard Cloud Armor backend security policy to the backend service and enable rate-based ban rules

Answer

Configure a Cloud Armor security policy on the URL map with a preconfigured WAF rule set

Answer

Apply VPC firewall rules that deny traffic from disallowed geographic IP ranges before it reaches the load balancer

Question 2

A retail company exposes a public web application through an external HTTP(S) load balancer. Recently, the application was targeted by SQL injection attempts and a volumetric flood of malicious requests from a handful of specific IP ranges. The security team wants to block the known bad IP ranges, mitigate common OWASP Top 10 attacks like SQL injection, and rate-limit abusive clients — all without modifying application code. Which approach should they implement?

Accepted Answer

Attach a Google Cloud Armor security policy to the load balancer backend service with deny rules for the IP ranges, preconfigured WAF rules for SQLi, and a rate-based ban rule.

Answer

Configure VPC firewall rules to deny the malicious IP ranges and enable Cloud NAT logging to detect SQL injection patterns.

Answer

Deploy Secure Web Proxy in front of the load balancer to filter inbound SQL injection traffic and enforce per-client rate limits.

Answer

Enable VPC Service Controls around the project and add the malicious IP ranges to an access level ingress deny list.

Question 3

A retail company exposes a public web application behind a global external Application Load Balancer. The security team must ensure that only traffic originating from the corporate offices' well-known egress IP ranges can reach the application, while all other public traffic is blocked at the network edge before hitting the backends. The list of corporate IP ranges is large and changes periodically as new offices open. Which approach best meets these requirements while minimizing maintenance overhead?

Accepted Answer

Attach a Cloud Armor security policy to the load balancer backend service with a default rule that denies traffic and a higher-priority allow rule that matches the corporate ranges using an address group referenced in the rule expression.

Answer

Create VPC ingress firewall rules on the backend instances that allow the corporate source ranges and deny 0.0.0.0/0, relying on the firewall to filter external client traffic.

Answer

Configure the load balancer's frontend forwarding rule to accept connections only from the corporate CIDR ranges specified directly in the forwarding rule configuration.

Answer

Enable Cloud NAT with a restricted set of external IPs and route all inbound application traffic through it so only corporate ranges are translated.

Question 4

A retail company runs a public API behind a global external Application Load Balancer. During flash sales, a small number of client IPs generate a massive volume of legitimate-looking requests that overwhelm backends, but the company does not want to fully block these clients — only slow them down when they exceed a fair usage threshold. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Create a Cloud Armor security policy rule with action 'throttle' using rate-based ban keyed on the client IP, setting a request threshold and enforcement interval.

Answer

Create a Cloud Armor security policy rule with action 'deny(429)' matching all requests from the source region.

Answer

Enable Cloud Armor adaptive protection and rely on its automatic Layer 7 DDoS mitigation to drop excess traffic.

Answer

Configure a Cloud CDN cache policy to serve cached responses so the backends never receive the excess requests.

Question 5

A security operations team at a financial services company needs to investigate a suspected data exfiltration incident. Several private VMs in a subnet use Cloud NAT for outbound internet access to reach a partner API. The team needs to determine exactly which destination IP addresses and ports the VMs connected to during a specific time window, and whether any connections were dropped due to NAT port exhaustion. Currently no NAT observability is configured. What should the team enable to obtain this evidence with the least operational overhead?

Accepted Answer

Enable Cloud NAT logging on the NAT gateway with the filter set to log both translations and errors, then query the logs in Cloud Logging.

Answer

Enable VPC Flow Logs on the subnet and correlate the internal source IPs with the NAT external IP manually to identify destinations.

Answer

Deploy a packet mirroring policy on the subnet and forward captured traffic to a collector instance for full packet analysis.

Answer

Enable Firewall Rules Logging on the egress allow rule and inspect the connection tuples for the affected VMs.

Question 6

A financial services company runs a fleet of 200 backend VMs (no external IPs) in a single subnet. These VMs make a very high volume of outbound API calls to a small number of external partner endpoints. Operations reports intermittent connection failures, and Cloud NAT logs show numerous 'OUT_OF_RESOURCES' drop entries for allocation, even though CPU and network throughput are well within limits. The team needs to resolve the failures without adding public IPs to the VMs. What is the most effective action?

Accepted Answer

Increase the minimum ports per VM instance allocation on the Cloud NAT gateway (and consider enabling dynamic port allocation) so more source ports are available for connections to the same destination.

Answer

Assign ephemeral external IP addresses to the backend VMs so they can bypass the NAT gateway for outbound traffic.

Answer

Lower the TCP established idle timeout to 30 seconds so ports are recycled, and leave the default 64 ports per VM unchanged.

Answer

Replace Cloud NAT with a Secure Web Proxy to handle all outbound partner API traffic and rely on its connection pooling.

Question 7

A financial services company runs a fleet of backend processing VMs in a private subnet within a Shared VPC. Organization policy prohibits assigning external IP addresses to these VMs. However, the VMs must periodically download OS security patches and pull dependencies from public package repositories on the internet. Inbound connections from the internet to these VMs must remain impossible. What should the security engineer configure to meet these requirements?

Accepted Answer

Deploy Cloud NAT for the subnet's region and configure it to provide outbound-only internet access for the private VMs

Answer

Assign ephemeral external IP addresses to the VMs and create an egress firewall rule allowing traffic to package repositories

Answer

Create a Private Service Connect endpoint that forwards VM traffic to public package repositories

Answer

Configure Cloud VPN to route VM internet-bound traffic through an on-premises proxy with a public IP

Question 8

A financial services company runs a fleet of backend processing VMs in a private subnet with no external IP addresses. These VMs must call a third-party payment partner's REST API over the public internet. The partner requires that all inbound traffic originate from a small, fixed set of source IP addresses that the company must register on the partner's allowlist. The security team also needs to guarantee the egress source addresses do not change over time. How should you configure egress connectivity?

Accepted Answer

Deploy Cloud NAT configured with manually reserved static external IP addresses, and register those reserved IPs on the partner's allowlist.

Answer

Assign ephemeral external IP addresses to each VM and provide the partner with the current set of assigned IPs.

Answer

Deploy Cloud NAT with automatic NAT IP address allocation so Google Cloud scales the addresses as traffic grows, then register the allocated pool with the partner.

Answer

Route egress through a Secure Web Proxy instance and register the proxy's dynamically assigned IP with the partner.

Question 9

A financial services company exposes a partner-facing API through a global external Application Load Balancer. Regulatory requirements mandate that only clients presenting a valid X.509 certificate issued by the company's internal certificate authority may establish a connection to the load balancer. The security team must reject any client that does not present a trusted certificate at the TLS layer, before the request reaches the backend. Which approach meets this requirement?

Accepted Answer

Configure mutual TLS (mTLS) on the load balancer by creating a TrustConfig in Certificate Manager referencing the CA's trust anchor, then attach a server TLS policy that enforces client certificate validation.

Answer

Deploy a Cloud Armor security policy with a rule that inspects the client certificate header and denies requests lacking a valid certificate fingerprint.

Answer

Enable Google-managed SSL certificates on the load balancer frontend and require clients to trust the Google CA chain for the handshake.

Answer

Configure an SSL policy with a minimum TLS version of 1.3 and the RESTRICTED profile so that only clients with valid certificates can negotiate the handshake.

Question 10

A financial services company exposes a public web application through a global external Application Load Balancer. A compliance audit requires that the load balancer reject any client connections negotiating TLS versions below 1.2 and disable known-weak cipher suites, while still allowing modern browsers to connect. The security engineer must enforce this at the load balancer's frontend without modifying backend servers. What should the engineer do?

Accepted Answer

Create an SSL policy with profile set to MODERN or RESTRICTED and a minimum TLS version of 1.2, then attach it to the load balancer's target HTTPS proxy.

Answer

Configure a Cloud Armor security policy with a rule that inspects the TLS handshake and blocks requests using TLS 1.0 or 1.1.

Answer

Enable a firewall rule on the load balancer's forwarding rule that denies traffic on port 443 from clients using legacy cipher suites.

Answer

Install a custom TLS configuration on each backend instance and set the backend service protocol to HTTPS so weak ciphers are rejected end to end.

Question 11

A financial services company runs workloads across 40 projects in three folders (prod, staging, dev) under a single organization. The security team must enforce a non-overridable rule that blocks all inbound RDP (TCP 3389) from the public internet across every current and future project, while still allowing individual project owners to define their own application-specific firewall rules for other ports. What is the most effective way to implement this?

Accepted Answer

Create a hierarchical firewall policy at the organization level with a deny rule for TCP 3389 from 0.0.0.0/0 and action 'goto_next' disabled, then associate it with the organization node.

Answer

Add a high-priority deny VPC firewall rule for TCP 3389 in each project's VPC and use an organization policy to prevent project owners from editing it.

Answer

Configure a Cloud Armor security policy that denies TCP 3389 and attach it to the external load balancer in every project.

Answer

Create a firewall rule in the Shared VPC host project denying TCP 3389 so that all service projects inherit the block.

Question 12

A financial services company is migrating to Google Cloud and needs a dedicated, high-bandwidth (10 Gbps) connection between their on-premises data center and their VPC. A compliance requirement mandates that all traffic traversing the connection between on-premises and Google Cloud must be encrypted in transit. The company wants the lowest-latency dedicated option while still meeting the encryption requirement. Which approach should they implement?

Accepted Answer

Provision Dedicated Interconnect and run HA VPN over the Interconnect connection using MACsec or IPsec to encrypt traffic

Answer

Provision Dedicated Interconnect alone, since traffic over a private physical circuit is inherently encrypted by Google

Answer

Use HA VPN over the public internet, which provides IPsec encryption and comparable bandwidth to Dedicated Interconnect

Answer

Use Partner Interconnect with Private Google Access enabled to encrypt all traffic to Google APIs

Question 13

A financial services company runs an internal HTTP(S) API on Compute Engine instances in a producer VPC. Multiple consumer teams in separate VPCs, plus an on-premises data center connected via Cloud Interconnect, need to reach this API. Security requires that all traffic stay on Google's private network with no exposure to the internet, and that the producer team explicitly control which consumer projects can connect. Which approach best meets these requirements?

Accepted Answer

Publish the internal API behind an internal load balancer as a Private Service Connect service attachment with an explicit consumer accept list, and have each consumer create a PSC endpoint; on-premises reaches the endpoint over the existing Interconnect.

Answer

Assign external IP addresses to the backend instances and restrict access using Cloud Armor security policies scoped to the consumer and on-premises IP ranges.

Answer

Create VPC Network Peering between the producer VPC and every consumer VPC, and advertise the load balancer route to on-premises via Cloud Router.

Answer

Configure Private Google Access on all consumer subnets and expose the API through a Cloud NAT gateway shared across the projects.

Question 14

A financial services company runs several internal microservices in a Shared VPC. They want internal clients within the VPC to reach these microservices through a single internal IP address, with requests routed to different backend service groups based on the URL path (e.g., /payments, /accounts). Traffic must never traverse the public internet, and the solution must support HTTP-based Layer 7 path matching. Which load balancing configuration should the security engineer recommend?

Accepted Answer

Deploy an internal Application Load Balancer (regional internal HTTP(S) load balancer) with a URL map that routes paths to different backend services.

Answer

Deploy an internal passthrough Network Load Balancer with multiple backend services and forwarding rules per path.

Answer

Deploy a global external Application Load Balancer restricted with Cloud Armor and firewall rules to only accept internal ranges.

Answer

Deploy a proxy Network Load Balancer (internal TCP proxy) with a single backend service and rely on the microservices to route internally.

Question 15

A security engineer deploys an internal Application Load Balancer in front of a managed instance group of backend VMs in a custom-mode VPC. The backends have no external IPs. After deployment, all backends show as UNHEALTHY in the load balancer, and internal clients cannot reach the service. The default 'deny all ingress' behavior applies because no ingress allow rules exist for these VMs. Which action correctly restores health checks and traffic flow while following least-privilege principles?

Accepted Answer

Create an ingress allow firewall rule permitting traffic from the Google health check source ranges 130.211.0.0/22 and 35.191.0.0/16 to the backend VMs on the application ports, targeted by network tag or service account.

Answer

Assign external IP addresses to the backend VMs so Google health check probes can reach them over the internet.

Answer

Create an ingress allow firewall rule permitting 0.0.0.0/0 on all ports to the backend VMs to ensure both clients and probes can connect.

Answer

Enable Private Google Access on the backend subnet so the health check probes are routed privately to the instances.

Question 16

A financial services company runs on-premises servers connected to a Google Cloud VPC through a Dedicated Interconnect. These servers must call Cloud Storage and BigQuery APIs, but corporate security policy forbids any traffic to Google APIs from traversing the public internet, and the on-premises hosts have no external IPs. DNS resolution for googleapis.com currently returns public IP addresses. What should the security engineer configure to meet these requirements?

Accepted Answer

Enable Private Google Access for on-premises hosts by creating Cloud DNS response policies (or private zones) that resolve *.googleapis.com to the restricted.googleapis.com VIP range (199.36.153.4/30) and add routes over the Interconnect toward that range.

Answer

Assign external IP addresses to the on-premises servers and rely on Cloud Armor to restrict which Google API endpoints they can reach.

Answer

Enable Private Google Access on the subnets where the on-premises hosts reside, since Private Google Access automatically applies to any host reachable over the Interconnect.

Answer

Deploy Cloud NAT in the VPC and route on-premises API traffic through it so the servers reach googleapis.com public endpoints via a shared egress IP.

Question 17

A financial services company runs Compute Engine instances in a VPC with no external IP addresses and an organization policy that blocks external IPs. The instances must reach Google APIs such as Cloud Storage and BigQuery, but the security team requires that traffic use a private internal IP endpoint that they fully control and can reference in firewall rules and DNS, rather than the default public API domains. They also want to avoid routing this traffic over the internet or through Cloud NAT. Which approach meets these requirements?

Accepted Answer

Create a Private Service Connect endpoint for Google APIs with a consumer internal IP address, and configure DNS so API requests resolve to that endpoint

Answer

Enable Private Google Access on the subnet so instances can reach the default Google API public IP ranges without external addresses

Answer

Deploy Cloud NAT and restrict egress firewall rules to only Google's published API IP ranges

Answer

Configure a VPC Service Controls perimeter around the project to force API traffic onto internal IP addresses

Question 18

A SaaS provider hosts a multi-tenant analytics application behind an internal load balancer in their own VPC. Your company wants to consume this service from your VPC without exposing traffic to the public internet, without overlapping RFC 1918 ranges between the two VPCs, and without requiring VPC peering that would expose your entire network to the provider. Which solution should you implement?

Accepted Answer

Create a Private Service Connect endpoint in your VPC that targets the service attachment the provider published from their internal load balancer.

Answer

Establish VPC Network Peering between your VPC and the provider's VPC and add firewall rules to restrict traffic to the load balancer IP.

Answer

Configure a Cloud VPN tunnel between your VPC and the provider's VPC and advertise only the load balancer subnet via Cloud Router.

Answer

Use Private Service Connect for Google APIs with a private.googleapis.com endpoint to reach the provider's service.

Question 19

A SaaS provider (the producer) runs a managed data-processing service in their own VPC. For certain workloads, the producer's service instances must initiate outbound connections into a customer's (consumer's) VPC to reach an on-prem database exposed through the consumer network — while keeping the traffic on Google's backbone and avoiding VPC Peering, which would create IP overlap and full route exchange. The producer wants a network interface that lets their instances originate traffic into the consumer VPC with controlled, one-directional reachability. Which Private Service Connect construct should the producer use?

Accepted Answer

A Private Service Connect interface attached to the producer instances, connecting to a network attachment in the consumer VPC

Answer

A Private Service Connect endpoint (forwarding rule) in the consumer VPC pointing at a Google API bundle

Answer

A Private Service Connect endpoint in the producer VPC referencing a service attachment published by the consumer

Answer

VPC Network Peering between the producer and consumer VPCs with custom route exchange disabled

Question 20

Your company operates a SaaS analytics platform in a producer VPC. A regulated banking customer wants private, one-way connectivity from their consumer VPC to your service without traversing the public internet, and they must not be able to initiate connections to any other resources in your VPC. You need to publish the service so that only this specific customer's project can create a connection endpoint, and connection requests from any other project must be rejected. Which configuration should you implement on the producer side?

Accepted Answer

Create a Private Service Connect service attachment backed by an internal load balancer, set connection preference to ACCEPT_MANUAL, and add the customer's project to the accept list.

Answer

Create a Private Service Connect service attachment with connection preference ACCEPT_AUTOMATIC so approved customers can connect without manual review.

Answer

Establish VPC Network Peering between the producer and consumer VPCs and use firewall rules to restrict the customer's access to only the load balancer.

Answer

Deploy a Cloud VPN tunnel between the two VPCs and advertise only the load balancer subnet via custom route advertisements.

More PCSE practice