Google Professional Cloud Network Engineer Question 606
Select 3Google Cloud PlatformYou are designing a network architecture in Google Cloud for a financial services application that processes sensitive customer data. A key requirement is to inspect network traffic to detect threats and prevent malicious activity. Which configurations should you implement to enable network packet inspection while ensuring scalability and compliance?
- A
Deploy Google Cloud Armor to inspect incoming HTTP(S) traffic at the edge.
- B
Enable VPC Service Controls to restrict data exfiltration from specific services.
- C
Deploy a third-party network appliance on Compute Engine for deep packet inspection.
- D
Configure a packet mirroring policy to send traffic copies to a security analysis tool.
- E
Enable Firewall Rules with the 'deny' action to block all unused ports.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the requirement for network packet inspection, you need to use tools and configurations that analyze the contents of network packets for threats. Google Cloud Armor inspects HTTP(S) traffic at the edge for Layer 7 security, while third-party network appliances can provide deep packet inspection for more comprehensive threat detection. Packet mirroring enables traffic analysis by sending packet copies to inspection tools. VPC Service Controls and firewall rules are essential for security but do not directly handle packet inspection.
- A. Correct.
Google Cloud Armor provides protection at the edge and can inspect incoming HTTP(S) traffic for threats. However, it is specifically for Layer 7 traffic and does not perform deep packet inspection on non-HTTP(S) traffic.
- B. Incorrect.
VPC Service Controls enhance data security by restricting data exfiltration but do not directly perform network packet inspection.
- C. Correct.
Deploying a third-party network appliance on Compute Engine can enable deep packet inspection for all types of network traffic, including non-HTTP(S) traffic, but requires proper configuration for scalability.
- D. Correct.
Packet mirroring enables you to copy traffic to a security analysis tool, which can then inspect the packet contents for threats. It is a key method for network packet inspection in Google Cloud.
- E. Incorrect.
Firewall rules are used to allow or block traffic based on defined rules but do not perform packet inspection or threat detection.