Google Professional Cloud Network Engineer Question 338
Select 3Google Cloud PlatformYour organization has deployed a Cloud Next Generation Firewall (NGFW) for a project on Google Cloud. To secure the application, you are required to configure NGFW rules to block traffic from specific IP ranges and allow traffic only to a specific port (TCP 443) for your web application. Which of the following considerations should you keep in mind while configuring the rules?
- A
Prioritize more specific rules above less specific rules when defining NGFW policies.
- B
Ensure that the default 'allow-all' rule is set to the highest priority in the rule hierarchy.
- C
Use Service Accounts as principals when defining service-based rules for better control.
- D
Test the rules by using Firewall Insights to ensure the configurations are not overly permissive or restrictive.
- E
Rely solely on ingress rules for securing traffic, as NGFW does not support egress filtering.
Show answer and explanation
Correct answers: A, C, D
Explanation
When configuring Cloud NGFW rules, it's important to prioritize specific rules, leverage Service Accounts for granular control, and validate configurations using tools like Firewall Insights. Default 'allow-all' rules should not take precedence, and both ingress and egress rules must be considered for comprehensive security.
- A. Correct.
This is correct. NGFW rules are evaluated in order of priority, and more specific rules should take precedence over less specific ones to ensure proper enforcement.
- B. Incorrect.
This is incorrect. The default 'allow-all' rule is not intended to be prioritized higher; it serves as a fallback and should ideally be replaced or overridden by more specific rules.
- C. Correct.
This is correct. Using Service Accounts as principals provides better granularity and control over traffic rules when combined with NGFW.
- D. Correct.
This is correct. Firewall Insights is a valuable tool for testing and validating firewall configurations to ensure they meet the intended security goals without being too open or restrictive.
- E. Incorrect.
This is incorrect. NGFW supports both ingress and egress filtering, and relying solely on ingress filtering would leave potential gaps in securing outbound traffic.