Google Professional Cloud Network Engineer Question 784
Select 3Google Cloud PlatformYour organization is experiencing issues with specific VMs being unable to connect to required resources. As a Google Cloud Network Engineer, you decide to use Firewall Insights to investigate. Upon reviewing the Firewall Insights reports, you notice some firewall rules have a hit count of 0, while others are flagged as shadowed. What actions should you take to improve the efficiency and security of your firewall configuration?
- A
Remove firewall rules with a hit count of 0 if they are no longer required.
- B
Disable shadowed rules immediately without further analysis since they are redundant.
- C
Investigate why certain rules are shadowed and adjust the rule priority or conditions if necessary.
- D
Keep all firewall rules unchanged to avoid introducing new issues.
- E
Use Firewall Insights to monitor hit counts regularly and identify emerging shadowed rules.
Show answer and explanation
Correct answers: A, C, E
Explanation
Firewall Insights provides valuable analytics, such as hit counts and shadowing detection, which can help you optimize your firewall rules. Removing unused rules (hit count of 0), addressing shadowed rules by adjusting priorities or conditions, and continuously monitoring are key steps to maintaining an efficient and secure network.
- A. Correct.
Firewall rules with a hit count of 0 are likely unused. Removing them can improve configuration clarity and reduce potential attack vectors. However, ensure these rules aren't needed for future or infrequent scenarios before removal.
- B. Incorrect.
Shadowed rules should not be disabled without analysis. They may indicate misconfigurations or unintended rule overlaps that need to be resolved carefully.
- C. Correct.
Shadowed rules occur when a higher-priority rule matches all traffic that would otherwise match a lower-priority rule. Investigating and adjusting these rules ensures the intended configurations are enforced.
- D. Incorrect.
Leaving all firewall rules unchanged is not a best practice, especially when there are clear inefficiencies or issues such as shadowed or unused rules.
- E. Correct.
Regularly monitoring hit counts and shadowed rules helps proactively manage and optimize firewall configurations, ensuring both security and performance.