Google Professional Cloud Network Engineer Question 620
Single answerGoogle Cloud PlatformYour organization has recently deployed Cloud NGFW by Palo Alto Networks on Google Cloud to enhance the security of your applications. The security team requires Layer 7 packet inspection to analyze application-level traffic for threats. Which configuration step is necessary to enable Layer 7 packet inspection in Cloud NGFW?
- A
Create and attach a custom URL Filtering Profile to the policy in Cloud NGFW.
- B
Enable App-ID in the Cloud NGFW security policy rules.
- C
Activate VPC Flow Logs in the associated VPC network.
- D
Deploy a separate Layer 7 load balancer in front of Cloud NGFW.
Show answer and explanation
Correct answer: B
Explanation
To enable Layer 7 packet inspection in Cloud NGFW, you need to use App-ID, which is a built-in feature of Palo Alto Networks' technology. App-ID allows the firewall to analyze application-level traffic and enforce policies based on the application rather than just port or protocol. Other steps, such as enabling VPC Flow Logs or deploying additional components, are unrelated to configuring Layer 7 inspection in this context.
- A. Incorrect.
Creating and attaching a custom URL Filtering Profile is useful for managing web traffic based on URLs, but it does not enable Layer 7 packet inspection. This feature focuses on filtering URLs, not analyzing application-level data.
- B. Correct.
Enabling App-ID in the Cloud NGFW security policy rules is the correct step, as App-ID is a key feature in Palo Alto Networks’ technology that identifies and inspects application-layer traffic for threats.
- C. Incorrect.
Activating VPC Flow Logs provides insights into network traffic metadata at Layer 3 and Layer 4, but it does not enable Layer 7 packet inspection.
- D. Incorrect.
Deploying a separate Layer 7 load balancer is unnecessary for enabling Layer 7 packet inspection in Cloud NGFW, as the firewall natively supports this capability using App-ID.