Google Professional Cloud Network Engineer Question 570
Select 3Google Cloud PlatformYour company hosts a web application in Google Cloud that requires internet access to fetch updates from a third-party service. To meet security and compliance requirements, you must ensure that all egress internet traffic is inspected, controlled, and logged for monitoring purposes. Which combination of configurations should you implement?
- A
Configure a Cloud NAT gateway for the instances in your VPC to allow outbound internet access.
- B
Set up a VPC Service Controls perimeter to restrict egress traffic to only approved services.
- C
Deploy a third-party firewall appliance in a custom subnet to inspect and control egress traffic.
- D
Use Private Google Access to route egress traffic through Google’s backbone network.
- E
Enable VPC Flow Logs on the subnets to monitor egress traffic.
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure and monitor internet egress traffic, you need to configure Cloud NAT to allow instances without external IPs to access the internet securely, deploy a firewall appliance to inspect and control the traffic, and enable VPC Flow Logs for monitoring and auditing purposes. While Private Google Access and VPC Service Controls have their use cases, they do not address the specific requirements for securing and monitoring general internet egress traffic.
- A. Correct.
Configuring a Cloud NAT gateway ensures that instances without external IP addresses can access the internet for outbound traffic, which is a foundational step for secure egress traffic.
- B. Incorrect.
VPC Service Controls are used to protect access to Google-managed services and do not provide the capability to restrict or monitor general internet egress traffic.
- C. Correct.
Using a third-party firewall appliance allows for inspection and control of egress traffic, meeting the requirements for security and compliance.
- D. Incorrect.
Private Google Access is used to enable private access to Google APIs and services, not for general internet egress traffic.
- E. Correct.
Enabling VPC Flow Logs provides monitoring and logging of network traffic, which is essential for auditing and compliance.