Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A financial enterprise is designing a network architecture on Google Cloud to adhere to strict regulatory compliance standards for sensitive data workloads. The organization must meet the following security requirements:
Which combination of Google Cloud architectural controls should the enterprise implement?
This option configures a dry-run VPC Service Controls perimeter, sets up Private Service Connect (PSC) for external SaaS APIs, configures Cloud Armor in preview mode, and disables VM serial port access.
ADVANCED_PREVIEW) only evaluates and logs traffic without blocking malicious requests or unauthorized CIDRs.The scenario required auditing existing application traffic and testing firewall and perimeter rules in a staging environment prior to production enforcement.
This option relies on a centralized Network Virtual Appliance (NVA) acting as a NAT gateway, uses private.googleapis.com for API routing, attempts to attach Cloud Armor policies directly to VM instances, and provisions a public bastion host VM for administrative jump-box access.
private.googleapis.com VIP supports many Google APIs but does not enforce the restricted VIP boundaries required by VPC Service Controls best practices; restricted.googleapis.com is mandatory to guarantee that only VPC-SC-supported APIs are reachable.The workload did not require Google-managed API exfiltration boundaries (VPC Service Controls) and required third-party stateful firewall appliance inspection for generic internet egress.
This architecture combines VPC Service Controls, Private Google Access via the restricted.googleapis.com virtual IP (VIP) address range, Google Cloud Armor edge security policies on an external Application Load Balancer, and Identity-Aware Proxy (IAP) TCP forwarding to form a layered defense-in-depth perimeter for regulatory compliance.
*.googleapis.com DNS zone to restricted.googleapis.com (which resolves to 199.36.153.4/30) ensures that internal VMs communicate with supported Google APIs across private routes and blocks access to unmanaged public services.35.191.0.0/16, 130.211.0.0/22).22 using Google-managed authentication without external IP addresses.This approach aligns with Google Cloud security best practices by implementing segmentation across all four critical planes: data API boundaries, private egress routing, public ingress edge inspection, and identity-aware management channels.
This option enforces the compute.skipDefaultNetworkCreation organization policy, routes Google API egress through Cloud NAT, applies a hierarchical firewall policy allowing universal internet SSH ingress (0.0.0.0/0), and attempts to attach Cloud Armor edge security policies to an internal load balancer.
22 to 0.0.0.0/0 in a hierarchical firewall rule directly violates regulatory baselines by exposing internal workloads to brute-force attempts from the entire internet.restricted.googleapis.com.compute.skipDefaultNetworkCreation is a best-practice control to prevent default network sprawl, but it does not configure network security controls on custom VPCs.35.235.240.0/20 for IAP).The primary goal was merely enforcing baseline organization constraints for project creation without requiring perimeter security, private API routing, or secure edge web filtering.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated