Google Professional Cloud Network Engineer Question 621
Select 4Google Cloud PlatformYour organization is deploying a Cloud NGFW (Next Generation Firewall) in Google Cloud to enhance security by enabling Layer 7 packet inspection. What steps must you take to successfully enable Layer 7 packet inspection and ensure traffic is inspected properly?
- A
Create a Cloud NGFW instance and configure Application Control policies for Layer 7 inspection.
- B
Ensure that the Cloud NGFW instance is attached to the appropriate VPC network.
- C
Set up a custom static route to direct relevant traffic through the Cloud NGFW.
- D
Enable Layer 7 inspection by turning on the 'Advanced Network Features' setting in the VPC.
- E
Associate the Cloud NGFW instance with a security policy that includes URL filtering.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To enable Layer 7 packet inspection using Cloud NGFW, you need to configure the NGFW with appropriate Application Control and URL filtering policies, attach it to the VPC network, and set up a route to ensure traffic flows through the firewall. The 'Advanced Network Features' setting is not a requirement for this functionality. These configurations allow the Cloud NGFW to inspect traffic at the application layer and enforce security controls effectively.
- A. Correct.
Correct: Application Control policies are required to inspect Layer 7 traffic and enforce rules based on application signatures.
- B. Correct.
Correct: The Cloud NGFW must be attached to the appropriate VPC network to inspect traffic within that network.
- C. Correct.
Correct: A static route is necessary to direct traffic to the Cloud NGFW for inspection.
- D. Incorrect.
Incorrect: There is no 'Advanced Network Features' setting in the VPC that enables Layer 7 inspection. Layer 7 inspection is configured via the Cloud NGFW policies.
- E. Correct.
Correct: URL filtering is a Layer 7 feature and must be included in the security policy for Layer 7 packet inspection.