Google Professional Cloud Network Engineer Question 573
Select 2Google Cloud PlatformYour organization has deployed multiple workloads in Google Cloud, and you need to configure secure and cost-effective internet egress traffic for these workloads. The solution should ensure that all internet-bound traffic is inspected for compliance and security policies. Which combination of actions should you take?
- A
Use a Cloud NAT gateway to manage internet egress traffic and avoid public IPs on VMs.
- B
Configure a VPC Service Control perimeter to restrict internet egress traffic.
- C
Set up a Cloud Armor policy and apply it to egress traffic for inspection.
- D
Deploy a third-party virtual appliance in a dedicated subnet to handle egress traffic inspection.
- E
Create a Private Google Access configuration to route all egress traffic through Google APIs.
Show answer and explanation
Correct answers: A, D
Explanation
To secure and manage internet egress traffic, you should use a Cloud NAT gateway to avoid exposing internal resources to the public internet while enabling egress connectivity. Additionally, deploying a third-party virtual appliance provides the capability to inspect and enforce compliance on egress traffic. These two combined actions effectively address the security and compliance requirements for internet-bound traffic.
- A. Correct.
Using a Cloud NAT gateway is a best practice to manage internet egress traffic from private instances without assigning them public IP addresses. However, Cloud NAT does not inspect traffic but can work in combination with other tools for security purposes.
- B. Incorrect.
VPC Service Controls provide additional security for data exfiltration and access control but are not designed to directly configure or inspect internet egress traffic.
- C. Incorrect.
Cloud Armor policies are used for protecting applications from DDoS and web-based threats. They do not apply to egress traffic as they are designed for ingress traffic.
- D. Correct.
Deploying a third-party virtual appliance in a dedicated subnet is a valid approach to inspect and manage egress traffic for compliance and security policies. These appliances often provide advanced security features for traffic inspection.
- E. Incorrect.
Private Google Access is used to allow private instances to access Google APIs and services without using public IPs, but it does not control or inspect all internet egress traffic.