Google Professional Cloud Network Engineer Question 377
Select 2Google Cloud PlatformYour organization has deployed several applications in Google Cloud and wants to utilize the Intrusion Prevention Service (IPS) to enhance network security. The security team requires that all HTTP traffic between an internal application and external users be inspected for known threats. You are tasked with configuring IPS for this use case. What steps should you take to ensure this traffic is inspected by the IPS?
- A
Enable the Intrusion Detection System (IDS) in the same VPC network where the application is deployed.
- B
Create a Google Cloud firewall rule to allow HTTP traffic and apply an IPS policy to it.
- C
Deploy a Cloud Armor security policy and enable IPS inspection.
- D
Enable IPS in the network security settings of your Virtual Private Cloud (VPC) and attach it to the relevant firewall rule.
- E
Configure a Gateway Security Policy to enable IPS for HTTP traffic targeting the application.
Show answer and explanation
Correct answers: D, E
Explanation
To configure the Intrusion Prevention Service (IPS) for HTTP traffic in Google Cloud, you must enable it within the network security settings of the VPC and attach it to the appropriate firewall rules. Additionally, Gateway Security Policies can be used to define and enforce IPS configurations for specific traffic flows. IDS, firewall rules, or Cloud Armor alone do not provide the required IPS functionality.
- A. Incorrect.
Incorrect. The Intrusion Detection System (IDS) is a monitoring-only service and does not actively block threats like IPS does.
- B. Incorrect.
Incorrect. While firewall rules are essential for controlling traffic, IPS policies are not applied directly to firewall rules.
- C. Incorrect.
Incorrect. Cloud Armor is used for application-layer protection and does not integrate with the Intrusion Prevention Service (IPS).
- D. Correct.
Correct. IPS must be enabled in the VPC network's security settings, and it requires attachment to the relevant firewall rule to inspect traffic.
- E. Correct.
Correct. Gateway Security Policies are used to configure advanced security settings like IPS for specific traffic flows, such as HTTP traffic targeting an application.