Google Professional Cloud Network Engineer Question 375
Select 2Google Cloud PlatformYour company has deployed a multi-tier application in Google Cloud. The frontend is hosted in a managed instance group behind a global external HTTP(S) Load Balancer, and the backend service is running on a private Google Kubernetes Engine (GKE) cluster. To ensure the application is protected from known vulnerabilities and malicious traffic, you decide to enable Intrusion Prevention Service (IPS) on the network. What steps must you take to correctly configure and apply IPS to protect the application?
- A
Enable Threat Intelligence in the VPC network associated with the application.
- B
Deploy a Security Command Center Premium subscription to utilize IPS capabilities.
- C
Enable Cloud IDS and attach it to the subnets hosting the application.
- D
Configure Cloud IDS signatures to detect and block malicious traffic.
- E
Set up firewall rules in the VPC to allow only traffic inspected by Cloud IDS.
Show answer and explanation
Correct answers: C, D
Explanation
To configure and apply Intrusion Prevention Service (IPS) in Google Cloud, you must enable Cloud IDS, which is Google's managed intrusion detection and prevention service. Cloud IDS must be attached to the appropriate subnets to inspect traffic for threats. Additionally, configuring detection signatures ensures that Cloud IDS can identify and block malicious traffic effectively. This configuration enhances the security of your application by protecting it from known vulnerabilities and threats.
- A. Incorrect.
Threat Intelligence provides insights into risks and threats but does not enable Intrusion Prevention Service (IPS).
- B. Incorrect.
While Security Command Center Premium offers advanced security insights, it is not required to enable IPS functionality.
- C. Correct.
Cloud IDS is the primary service in Google Cloud for Intrusion Detection and Prevention. You must enable it and attach it to the appropriate subnets to inspect network traffic.
- D. Correct.
Configuring Cloud IDS signatures is critical for detecting and blocking malicious traffic. This ensures that IPS can effectively secure your application.
- E. Incorrect.
Firewall rules in VPC are not directly tied to Cloud IDS; they control traffic flows but do not enable IPS functionality.