2.1 Designing and Configuring Perimeter Security PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company has deployed Cloud NGFW with layer 7 inspection enabled on its VPC firewall rules. The security team wants to block requests to a specific URL path (e.g., /admin) from the internet, but allow all other traffic. They also want to log blocked requests for auditing. What should the security engineer configure?

   • AConfigure the load balancer's URL map to route /admin to a 404 page.
   • BUse Google Cloud Armor to create a rule that blocks the /admin path and attach it to the backend service.
   • CCreate a Cloud NGFW rule with a layer 7 filter that matches the URL path /admin and set the action to deny, with logging enabled on the rule.
   • DSet up Secure Web Proxy to filter outbound traffic and block /admin requests.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has an internal web application hosted on a Compute Engine VM that only has a private IP address. The VM is in a VPC with no public IPs and no VPN connection. Remote employees need to access the application from their laptops using their corporate Google accounts. What should the security engineer configure to provide secure access?

   • ACreate a Cloud VPN tunnel to the employees' home networks and configure the VM to only accept traffic from the VPN subnet.
   • BAssign a public IP address to the VM and create a firewall rule allowing HTTPS from the employees' IP ranges.
   • CAttach a Cloud NAT gateway to the VPC and configure IAP on the VM's firewall rules.
   • DDeploy Identity-Aware Proxy (IAP) and grant the employees the IAP-secured Tunnel User role, then use the IAP tunnel to reach the VM.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company runs an internal API that is only accessible within its VPC. The API uses mutual TLS (mTLS) for authentication between services. The company wants to issue and manage the client and server certificates internally, with the ability to revoke compromised certificates quickly. What should the security engineer use?

   • ACertificate Authority Service to create a private CA and issue certificates for the services, with certificate revocation lists enabled.
   • BGoogle Cloud Armor to generate and manage certificates for the API.
   • CUse a self-signed certificate on each service and distribute them manually.
   • DConfigure the load balancer to use Google-managed SSL certificates for the internal API.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company runs a public web application on Google Cloud behind an HTTPS load balancer. Security analysts report that attackers are sending requests with malicious SQL patterns in the URL query string and JSON payloads. The company wants to block these requests at the edge before they reach the backend, without modifying the application code. What should the security engineer configure?

   • AEnable Cloud NGFW layer 7 inspection on the VPC firewall rules that apply to the backend instances.
   • BSet up Identity-Aware Proxy (IAP) on the load balancer to require Google accounts for all requests.
   • CConfigure an SSL policy on the load balancer to require TLS 1.3 and disable weak ciphers.
   • DAttach a Google Cloud Armor security policy to the backend service with preconfigured rules for SQL injection (SQLi) and cross-site scripting (XSS).
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is migrating a legacy application to Google Cloud. The application currently uses public IP addresses for inter-service communication. The security team wants to minimize the attack surface by using private IP addresses for internal communication, while still allowing the application to access the internet for updates. What should the security engineer implement?

   • AKeep public IP addresses on all VMs and rely on firewall rules to restrict inbound traffic.
   • BConfigure a load balancer with a public IP and route all internal traffic through it.
   • CAssign private IP addresses to all VMs, use Cloud NAT for outbound internet access, and configure firewall rules to allow only necessary internal traffic.
   • DUse a VPN to connect all VMs and assign public IPs only to the VPN gateway.
   Reveal Solution Discussion Select an answer first