Google Professional Cloud Network Engineer Question 608
Select 3Google Cloud PlatformYou are tasked with configuring network packet inspection on a Google Cloud environment for an e-commerce application to meet compliance requirements. The application processes sensitive financial data, and you need to ensure that all ingress traffic to your backend services is inspected for malicious activity. Which of the following configurations should you implement?
- A
Deploy a Google Cloud Armor security policy to inspect and filter HTTP(S) traffic based on preconfigured rules.
- B
Use VPC Service Controls to define service perimeters and restrict access to sensitive resources.
- C
Configure a Cloud IDS (Intrusion Detection System) deployment to monitor network traffic for potential threats.
- D
Enable Firewall Rules in the VPC to block suspicious IPs and allow only trusted sources.
- E
Leverage Packet Mirroring to copy traffic to a third-party threat analysis tool for deeper inspection.
Show answer and explanation
Correct answers: A, C, E
Explanation
To configure network packet inspection for compliance, you need to ensure traffic to your backend services is analyzed for malicious activity. Google Cloud Armor provides HTTP(S) traffic inspection, Cloud IDS detects threats in network traffic, and Packet Mirroring enables integration with third-party tools for deeper inspection. Together, these configurations provide a comprehensive solution for inspecting and securing network packets.
- A. Correct.
Google Cloud Armor can provide HTTP(S) traffic inspection and filtering, which is critical for protecting backend services from malicious requests. It is a key component of network packet inspection for web traffic.
- B. Incorrect.
VPC Service Controls enhance access security but are not directly used for inspecting network packets or detecting malicious activity. They are more focused on preventing unauthorized access to GCP services.
- C. Correct.
Cloud IDS is specifically designed to monitor network traffic for suspicious activity, such as malware or intrusions, making it essential for compliance and security monitoring.
- D. Incorrect.
Firewall Rules in the VPC are used for basic traffic filtering, like allowing or denying traffic based on IP addresses or protocols. While important, they do not perform deep packet inspection or identify threats.
- E. Correct.
Packet Mirroring allows you to mirror traffic to an external analysis tool. This is useful for in-depth inspections and compliance requirements, especially when integrated with third-party threat detection systems.