Google Professional Cloud Network Engineer Question 605
Select 2Google Cloud PlatformYou are designing a network architecture for a financial application hosted on Google Cloud. The application requires real-time packet inspection to identify and block malicious traffic between internal services. Which of the following configurations can enable network packet inspection in this scenario?
- A
Deploy a Cloud IDS and configure it to monitor traffic between subnets.
- B
Enable VPC Flow Logs and use them for real-time packet inspection.
- C
Implement firewall rules to allow only specific IP ranges.
- D
Use a third-party virtual appliance to perform deep packet inspection.
- E
Configure Google Cloud Armor policies to inspect and block malicious traffic.
Show answer and explanation
Correct answers: A, D
Explanation
To enable network packet inspection, Cloud IDS or third-party virtual appliances are effective options. Cloud IDS is a managed service provided by Google Cloud, making it easier to integrate and deploy. Alternatively, a third-party virtual appliance can be used for custom deep packet inspection requirements. Other options like VPC Flow Logs, firewall rules, and Google Cloud Armor do not provide the functionality required for real-time packet inspection.
- A. Correct.
Cloud IDS provides network packet inspection capabilities by analyzing traffic for malicious patterns, making it suitable for this use case.
- B. Incorrect.
VPC Flow Logs provide metadata about network traffic but do not perform real-time packet inspection. They are useful for logging and analysis but not for detecting malicious traffic in real-time.
- C. Incorrect.
Firewall rules control access based on IP ranges, ports, and protocols, but they do not perform deep packet inspection.
- D. Correct.
Third-party virtual appliances can be deployed on Google Cloud to perform deep packet inspection, as they are specifically designed for this purpose.
- E. Incorrect.
Google Cloud Armor is designed for protecting web applications from external threats (e.g., DDoS, SQL injection) and does not provide internal packet inspection for traffic between services.