Google Professional Cloud Security Engineer Question 192
Select 3Google Cloud PlatformYour company runs a web application on Google Cloud that is accessed by both internal employees and external customers. Internal employees access the application through a secure VPN, while external customers use the public internet. To ensure the security of the application, you need to configure network perimeter controls that:
- Restrict access to the internal application to only employees authenticated via the VPN.
- Allow external customers to securely access the public-facing application.
- Ensure that all traffic to the application is encrypted. Which combination of Google Cloud services and configurations will best meet these requirements?
- A
Use Identity-Aware Proxy (IAP) to restrict access to the internal application for employees using VPN authentication.
- B
Configure a Cloud Load Balancer with an SSL certificate to serve HTTPS traffic for the public-facing application.
- C
Use Cloud Next Generation Firewall (Cloud NGFW) rules to block all public internet traffic to the internal application.
- D
Enable Certificate Authority Service to issue client certificates for VPN authentication.
- E
Configure a Cloud Load Balancer to enforce TLS for internal employee traffic over the VPN.
Show answer and explanation
Correct answers: A, B, C
Explanation
The combination of Identity-Aware Proxy (IAP), Cloud Load Balancer with SSL, and Cloud NGFW rules ensures that the internal application is restricted to employees using the VPN, the public-facing application is securely accessible to external customers, and all traffic is encrypted. IAP enforces identity-based access control, while the Cloud Load Balancer ensures HTTPS encryption for public traffic. Cloud NGFW rules block unauthorized access to the internal application from the public internet. Certificate Authority Service and TLS enforcement on the Load Balancer are not directly applicable to this scenario.
- A. Correct.
This is correct because Identity-Aware Proxy (IAP) allows you to restrict access to internal applications by enforcing identity-based access control. However, VPN authentication is handled separately and not directly by IAP.
- B. Correct.
This is correct because configuring a Cloud Load Balancer with an SSL certificate ensures that the public-facing application serves encrypted HTTPS traffic, meeting the encryption requirements.
- C. Correct.
This is correct because Cloud NGFW rules can be used to block public internet access to the internal application, ensuring it is only accessible via the secure VPN.
- D. Incorrect.
This is incorrect because Certificate Authority Service is typically used for issuing and managing server or client certificates, but VPN authentication does not necessarily require certificates issued via this service.
- E. Incorrect.
This is incorrect because TLS encryption for VPN traffic is typically handled by the VPN solution itself, not by the Cloud Load Balancer.