Overview
Security has its own section in the current guide. Cloud Armor work includes edge and backend security policies, preconfigured WAF rules for SQL injection, cross-site scripting and remote file inclusion, advanced DDoS protection and Adaptive Protection, rate limiting, bot management and Google Threat Intelligence. Cloud NGFW topics cover firewall strategy, hierarchical policy evaluation, rules for GKE and load balancers, layer 7 inspection in the Enterprise tier, migration from VPC firewall rules, rule logging and micro-segmentation with secure tags and service accounts.
Egress control covers Cloud NAT address and port allocation and Secure Web Proxy. The last objective is self-managed appliances: routing inter-VPC traffic through multi-NIC VMs, internal load balancers and policy-based routes for appliance high availability, out-of-band Network Security Integration and Packet Mirroring to your own collectors.
How it's tested
Security questions describe a threat or policy requirement, such as SQL injection attempts, a request flood, an organization-wide deny rule or a mandate to inspect egress, and ask which control and which placement satisfy it. Placement matters as much as product choice.
-
Place the control
You decide whether a requirement belongs at the edge with Cloud Armor, inside the VPC with Cloud NGFW, or on egress with NAT or Secure Web Proxy.
-
Evaluate the rules
You work out which hierarchical, network or VPC firewall rule applies first and what action results.
-
Insert an appliance
You route traffic through multi-NIC appliances with internal load balancer next hops or policy-based routes, or mirror it out of band.
The security team must block SSH from the internet to every VM in the organization, and project owners must not be able to override it. A rule in each VPC could be changed by project admins. A hierarchical firewall policy at the organization node with a deny action is evaluated first and cannot be overridden by lower-level rules, so it meets the requirement.
Objectives 4
Official objectives from the Google Cloud outline, in outline order.
6.1 Configuring Google Cloud Armor policiesEdge and backend policies, WAF rules, DDoS and Adaptive Protection, rate limiting, bot management and threat intelligence.
- What it means
- This objective covers protecting internet-facing applications with Cloud Armor: backend and edge security policies, preconfigured WAF rules, advanced DDoS protection and Adaptive Protection, rate limiting, bot management and Google Threat Intelligence feeds.
- What to understand
- Backend security policies attach to backend services of external Application Load Balancers and some proxy load balancers and filter requests before they reach backends. Edge security policies apply in front of Cloud CDN caches and backend buckets. Network edge security policies protect passthrough Network Load Balancers and VMs with public IPs when advanced network DDoS protection is enabled. Rules are evaluated by priority, lowest number first, and preview mode logs matches without enforcing them. Rate limiting can throttle or temporarily ban clients. Adaptive Protection uses machine learning to detect layer 7 attacks and suggest rules.
- How it shows up
- Expect requests to stop a web attack type, slow abusive clients or protect cached content.
- Common confusion
- Edge policies protect cached content; backend policies protect requests forwarded to backends.
6.2 Configuring and managing NGFW policies and VPC firewall rulesFirewall strategy, policy evaluation, GKE and load balancer support, layer 7 inspection, migration, criteria, logging, segmentation and tiers.
- What it means
- This objective covers designing and running Cloud NGFW: choosing VPC rules, firewall policies or third-party appliances, evaluating hierarchical policies, supporting GKE and load balancers, creating and fixing rules, layer 7 inspection, migrating legacy VPC rules to policies, rule criteria and logging, micro-segmentation, and the Essentials, Standard and Enterprise tiers.
- What to understand
- Hierarchical firewall policies at the organization and folder levels are evaluated first, then VPC firewall rules and global and regional network firewall policies, and finally the implied allow-egress and deny-ingress rules. A goto_next action passes evaluation down a level. Secure tags are IAM-controlled and work across peered networks, unlike network tags. Standard tier adds FQDN and geolocation objects and threat intelligence lists; Enterprise adds intrusion prevention and TLS inspection through firewall endpoints. A migration tool converts VPC rules into a network firewall policy.
- How it shows up
- Questions test evaluation order, the tier needed for a feature, and target selection by tag or service account.
- Common confusion
- Network tags can be changed by anyone who can edit a VM; secure tags require IAM permission to bind.
6.3 Configuring and securing internet egress traffic using Public Cloud NAT and Secure Web ProxyNAT IP allocation, port allocation and Secure Web Proxy.
- What it means
- This objective covers giving private VMs controlled internet access: allocating Public Cloud NAT IP addresses automatically or manually, choosing static or dynamic port allocation, and deploying Secure Web Proxy to filter web egress.
- What to understand
- Cloud NAT is a regional, software-defined service configured on a Cloud Router; it needs no gateway VMs. Manual NAT IPs are used when partners allowlist fixed addresses. Static port allocation gives each VM a fixed minimum number of ports, while dynamic port allocation lets busy VMs take more ports up to a maximum. Port exhaustion appears as dropped connections. Secure Web Proxy is a managed proxy that enforces policies on HTTP and HTTPS egress using URL lists, secure tags or service accounts, and can inspect TLS.
- How it shows up
- Look for allowlisting needs, connection-heavy workloads or requirements to filter by URL.
- Common confusion
- Cloud NAT translates addresses but does not filter by URL; Secure Web Proxy enforces URL policies.
6.4 Configuring self-managed network virtual appliance and Packet MirroringMulti-NIC appliances, ILB next hops, policy-based routes, out-of-band integration and Packet Mirroring.
- What it means
- This objective covers inserting third-party security appliances: routing and inspecting traffic between VPCs through multi-NIC VMs, using internal load balancers as next hops for highly available appliances, defining policy-based routes for them, planning out-of-band Network Security Integration, and mirroring packets to self-managed collectors.
- What to understand
- Each NIC on a multi-NIC VM attaches to a different VPC, NICs are defined at creation, and IP forwarding must be enabled for the VM to route traffic. Placing appliances behind an internal passthrough Network Load Balancer and using it as a route next hop provides failover and symmetric hashing. Policy-based routes can steer selected flows to that load balancer. Network Security Integration out-of-band mode mirrors traffic to partner security tools without placing them in the path. Packet Mirroring sends copies to a collector group behind an internal load balancer in the same region.
- How it shows up
- Expect a third-party firewall requirement where you choose in-line routing or out-of-band mirroring.
- Common confusion
- In-line appliances can block traffic; out-of-band mirroring only observes copies.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Cloud Armor backend security policy
Layer 7 filtering for load balancer backend services.
- Remember
- Lowest priority number evaluates first.
- Tested as
- Web attack protection.
- Trap
- Attaching it to an internal load balancer.
-
Preconfigured WAF rules
Rule sets based on the OWASP Core Rule Set.
- Remember
- Tune sensitivity to reduce false positives.
- Tested as
- SQLi and XSS blocking.
- Trap
- Enforcing without preview first.
-
Adaptive Protection
Machine learning detection of layer 7 DDoS attacks.
- Remember
- Suggests rules to deploy.
- Tested as
- Volumetric HTTP floods.
- Trap
- Expecting it to block automatically by default.
-
Rate limiting
Throttle or rate-based ban per client key.
- Remember
- Keys include IP, header or region.
- Tested as
- Abusive clients.
- Trap
- Using a deny rule that blocks legitimate users too.
-
Hierarchical firewall policy
Firewall rules at organization or folder level.
- Remember
- Evaluated before VPC-level rules.
- Tested as
- Organization-wide mandates.
- Trap
- Relying on project-level rules for central control.
-
goto_next
Action that defers a decision to the next level.
- Remember
- Lets lower levels decide.
- Tested as
- Delegated control.
- Trap
- Confusing it with allow.
-
Secure tags
IAM-governed tags used as firewall targets and sources.
- Remember
- Work across peered VPCs.
- Tested as
- Micro-segmentation.
- Trap
- Using network tags when tamper resistance matters.
-
Cloud NGFW Enterprise
Tier with intrusion prevention and TLS inspection.
- Remember
- Uses zonal firewall endpoints.
- Tested as
- Layer 7 threat inspection.
- Trap
- Expecting IPS in the Essentials tier.
-
Implied rules
Allow all egress and deny all ingress by default.
- Remember
- Lowest precedence; cannot be removed.
- Tested as
- Default behavior questions.
- Trap
- Forgetting egress is open by default.
-
Cloud NAT port allocation
Static minimum ports or dynamic allocation per VM.
- Remember
- Dynamic allocation helps bursty workloads.
- Tested as
- Connection drops.
- Trap
- Adding NAT gateways instead of ports.
-
Secure Web Proxy
Managed proxy that applies policy to web egress.
- Remember
- URL lists and TLS inspection.
- Tested as
- Egress filtering.
- Trap
- Expecting Cloud NAT to filter URLs.
-
ILB as next hop
Internal passthrough load balancer used as a route target.
- Remember
- Gives appliance high availability.
- Tested as
- NVA designs.
- Trap
- Routing to a single appliance VM.
-
Multi-NIC appliance
VM with interfaces in several VPCs.
- Remember
- Requires IP forwarding; NICs fixed at creation.
- Tested as
- Inter-VPC inspection.
- Trap
- Adding NICs to a running VM.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Where to apply each security control
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Cloud Armor | Edge and layer 7 protection for external load balancers. | Stops web attacks before backends. | Not used for VM-to-VM traffic. |
| Cloud NGFW policies and VPC rules | Distributed firewall on each VM interface. | Controls traffic inside and into the VPC. | Cannot see HTTP payload without Enterprise inspection. |
| Secure Web Proxy | Policy proxy for outbound web traffic. | URL-level egress control. | Not a replacement for inbound protection. |
| Third-party NVA | Self-managed appliance in the traffic path. | Vendor feature sets and existing tooling. | You manage scaling and high availability. |
Cloud NGFW tiers
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Essentials | Stateful rules with tags and service accounts. | Core firewalling. | No FQDN or geolocation objects. |
| Standard | Adds FQDN, geolocation and threat intelligence objects. | Smarter source and destination matching. | Still no intrusion prevention. |
| Enterprise | Adds IPS and TLS inspection. | Layer 7 threat detection. | Requires firewall endpoints and extra cost. |
Firewall targeting methods
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Network tags | Strings on VM instances. | Simple but editable by instance admins. | Not usable across peered networks. |
| Service accounts | Identity attached to VMs. | Tied to IAM and harder to change. | Cannot mix with tags in one rule. |
| Secure tags | Resource Manager tags bound with IAM. | Central control and peering support. | Supported in firewall policies, not legacy VPC rules. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Firewall rule for web attacks
- What candidates pick
- Block a malicious pattern with a VPC firewall rule.
- Why it looks right
- Firewalls are the classic security answer.
- Why it's wrong
- VPC rules match addresses, ports and protocols; Cloud Armor WAF rules inspect HTTP request content.
Clue to watch for Attack described in terms of request parameters or headers.
-
Project rule for org policy
- What candidates pick
- Ask every project to add a deny rule.
- Why it looks right
- It achieves the same blocking.
- Why it's wrong
- Project owners could remove those rules; a hierarchical policy at the organization or folder enforces centrally.
Clue to watch for Rules that lower-level admins must not override.
-
IPS in the wrong tier
- What candidates pick
- Enable intrusion prevention with Cloud NGFW Standard.
- Why it looks right
- Standard sounds sufficient.
- Why it's wrong
- Intrusion prevention and TLS inspection require the Enterprise tier with firewall endpoints.
Clue to watch for Signature-based threat detection is required.
-
NAT as egress filter
- What candidates pick
- Use Cloud NAT to restrict outbound sites.
- Why it looks right
- NAT controls internet access.
- Why it's wrong
- NAT only translates addresses; URL filtering needs Secure Web Proxy or an egress firewall policy with FQDN objects.
Clue to watch for An allowlist of permitted domains.
-
Ban by IP for floods
- What candidates pick
- Add deny rules for each attacking IP.
- Why it looks right
- Blocking attackers seems direct.
- Why it's wrong
- Distributed attacks rotate addresses; rate limiting and Adaptive Protection respond at scale.
Clue to watch for Requests from thousands of changing sources.
-
Mirroring to block threats
- What candidates pick
- Use Packet Mirroring with an IDS to stop attacks.
- Why it looks right
- Mirroring feeds security tools.
- Why it's wrong
- Mirrored copies are out of band, so the tool can detect but not block; in-line appliances or Cloud NGFW Enterprise can block.
Clue to watch for The requirement says prevent, not detect.
Answer framework
Use these steps to choose and place network security controls in a scenario.
- Identify the traffic direction and layer involved: inbound web requests, east-west traffic between VMs, or outbound internet access.
- Map the requirement to the control: Cloud Armor for web threats, Cloud NGFW for packet rules, Secure Web Proxy or NAT for egress.
- Choose the enforcement level, organization or folder hierarchical policy, network policy or VPC rule, and the target method.
- Check whether the feature needs a specific tier or option, such as NGFW Enterprise, advanced network DDoS protection or manual NAT IPs.
- For third-party tools, decide in-line with load balancer next hops or out of band with mirroring, then enable logging.
Practice question
Want more like this? The GCP PCNE practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start by learning firewall evaluation order thoroughly, because it unlocks many questions. Draw the sequence from organization policy to folder policy to VPC rules and network policies to implied rules, and practice with small puzzles that mix allow, deny and goto_next actions. Add a table of Cloud NGFW tiers and the features each one unlocks.
Then cover Cloud Armor with a lab: put a simple web app behind a global external Application Load Balancer, attach a security policy in preview mode with a preconfigured SQL injection rule, review the logs, then enforce it and add a rate limiting rule. Configure Cloud NAT with manual IP addresses and dynamic port allocation, and read its logs.
Finish by studying appliance patterns from documentation: multi-NIC VMs, internal load balancer next hops, policy-based routes and Packet Mirroring. Practice questions should focus on placing the right control in the right location, and every missed question should be traced back to evaluation order or placement.
FAQ
How much of the GCP PCNE exam is Configuring, implementing and managing a cloud network security solution?
The network security section, Section 6, is weighted at about 13%, the smallest of the six. Expect around 6 to 8 questions by editorial estimate, plus security details inside other sections.
Is Cloud NGFW the same as VPC firewall rules?
Cloud NGFW is the overall firewall service. It includes legacy VPC firewall rules and firewall policies, and its Standard and Enterprise tiers add advanced objects, intrusion prevention and TLS inspection.
Do I need to know Cloud Armor Enterprise pricing?
No. Know which features exist, such as advanced network DDoS protection and threat intelligence, and where each policy type attaches. Fees are not part of the exam objectives.
When should I use Secure Web Proxy instead of Cloud NAT?
Use Secure Web Proxy when outbound web traffic must be filtered or inspected by URL or identity. Cloud NAT only provides address translation for private VMs.
What is Network Security Integration?
It is a Google Cloud capability for integrating third-party security appliances. Its out-of-band mode mirrors traffic to partner tools, and its in-band mode intercepts traffic for inspection.
Can a multi-NIC VM have a NIC added later?
No. Network interfaces are defined when the VM is created, so plan the number of VPCs an appliance must connect before deployment.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 6 knowledge
Check that you can choose between Cloud Armor, Cloud NGFW, Secure Web Proxy and appliances, and predict firewall evaluation.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the GCP PCNE AI tutor Get any concept explained your way