Google Professional Cloud Network Engineer Question 624
Select 3Google Cloud PlatformYour organization is deploying Cloud NGFW to secure traffic in Google Cloud. To enable Layer 7 packet inspection for application-level traffic filtering, what steps must you take to correctly configure the Cloud NGFW?
- A
Ensure that a proper URL Filtering profile is assigned to the security policy.
- B
Enable a Threat Prevention profile in the Cloud NGFW configuration.
- C
Configure a network tag and associate it with the Cloud NGFW instance.
- D
Deploy the Cloud NGFW by setting up a firewall policy and attaching it to a VPC network.
- E
Enable HTTPS decryption to inspect encrypted traffic.
Show answer and explanation
Correct answers: A, B, E
Explanation
To enable Layer 7 packet inspection in Cloud NGFW, it's essential to configure features like URL Filtering and Threat Prevention profiles that operate at the application layer. Additionally, enabling HTTPS decryption allows the NGFW to inspect encrypted traffic, ensuring comprehensive monitoring. Network tags and general firewall policy attachments, while necessary for deployment, do not specifically activate Layer 7 inspection capabilities.
- A. Correct.
Correct: URL Filtering is crucial for application-level traffic filtering in Layer 7 inspection. It allows you to define rules for web traffic based on application and website URLs.
- B. Correct.
Correct: Threat Prevention profiles enable detection and prevention of malicious activities, which is an essential part of Layer 7 packet inspection.
- C. Incorrect.
Incorrect: Configuring a network tag is not directly related to enabling Layer 7 packet inspection. Network tags are used to manage traffic routing and firewall rules but not for application-level filtering.
- D. Incorrect.
Incorrect: While deploying the Cloud NGFW with a firewall policy is necessary for its operation, it does not specifically enable Layer 7 packet inspection.
- E. Correct.
Correct: HTTPS decryption is required to inspect encrypted traffic effectively at Layer 7, ensuring that application-level threats are detected.