Google Professional Cloud Network Engineer Question 623
Select 3Google Cloud PlatformYou are working as a Cloud Network Engineer for a company that uses Google Cloud. The company has deployed a Cloud NGFW (Next-Generation Firewall) to inspect traffic for security threats. One of the business requirements is to enable Layer 7 packet inspection to identify specific application-level traffic patterns. What steps should you take to configure Layer 7 packet inspection in Cloud NGFW?
- A
Enable Application Control policies in the Cloud NGFW.
- B
Configure a custom Layer 7 policy within Google Kubernetes Engine (GKE) clusters.
- C
Create Security Profiles in the Cloud NGFW and associate them with the appropriate rules.
- D
Ensure that the Cloud NGFW's associated firewall rule allows traffic to pass through for Layer 7 analysis.
- E
Deploy an external proxy to inspect Layer 7 traffic before routing it to the Cloud NGFW.
Show answer and explanation
Correct answers: A, C, D
Explanation
To enable Layer 7 packet inspection in Cloud NGFW, you must configure Application Control policies and Security Profiles, which are directly responsible for analyzing application-level traffic patterns. Additionally, the firewall rule must allow traffic to pass through so that the NGFW can inspect it. External proxies or unrelated configurations, such as GKE Layer 7 policies, are not part of this process.
- A. Correct.
Correct: Enabling Application Control policies in Cloud NGFW allows the firewall to perform Layer 7 traffic inspection by recognizing and controlling application-level traffic patterns.
- B. Incorrect.
Incorrect: While GKE supports Layer 7 load balancing, this step is not related to enabling Layer 7 packet inspection in Cloud NGFW. This is outside the scope of the firewall configuration.
- C. Correct.
Correct: Creating Security Profiles in Cloud NGFW is essential for defining how specific traffic should be inspected and handled, including for Layer 7 inspection.
- D. Correct.
Correct: For Layer 7 inspection to work, the underlying firewall rule in Cloud NGFW must allow traffic to reach the firewall for analysis.
- E. Incorrect.
Incorrect: Deploying an external proxy is not required for enabling Layer 7 packet inspection in Cloud NGFW, as the firewall itself is capable of handling the inspection.