Google Professional Cloud Network Engineer Question 737
Select 4Google Cloud PlatformYour organization has deployed a Cloud NGFW (Next-Generation Firewall) on Google Cloud to secure internet-facing applications. A user reports they are unable to access a specific web application hosted on one of your VM instances, despite the firewall rule allowing HTTP/HTTPS traffic. Upon reviewing the firewall logs, you notice that traffic to the application is being blocked by a specific rule. What steps should you take to troubleshoot and resolve the issue?
- A
Verify the priority order of the NGFW rules to ensure no higher-priority rule is unintentionally blocking the traffic.
- B
Check the logging configuration of the NGFW to confirm if detailed logging is enabled for the rule in question.
- C
Modify the NGFW rule to allow all traffic to the application without specifying any particular source or protocols.
- D
Inspect the VM instance's network tags and ensure they match the NGFW rule's target configuration.
- E
Review the NGFW's application-layer inspection logs to identify if the traffic is being flagged as malicious.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To troubleshoot Cloud NGFW issues, you should ensure that rule priorities, network tags, and logging configurations are correctly set up. Additionally, application-layer inspection logs can provide valuable insights into why traffic is being flagged. Avoid making overly permissive changes, such as allowing all traffic, as it compromises security.
- A. Correct.
Correct. NGFW rules are applied in priority order, so a higher-priority rule could block traffic even if a lower-priority rule allows it.
- B. Correct.
Correct. Detailed logging can provide insights into why a specific rule is blocking traffic, including any misconfigurations.
- C. Incorrect.
Incorrect. Allowing all traffic would compromise security and is not a recommended practice for resolving such issues.
- D. Correct.
Correct. Misconfigured network tags on the VM instance could cause the NGFW rule to not apply correctly.
- E. Correct.
Correct. Application-level inspection could block traffic if it detects malicious patterns, even if the rule technically allows the traffic.