Google Professional Cloud Security Engineer Question 199
Select 3Google Cloud PlatformYour organization has deployed a set of web applications hosted on Google Cloud. To enhance security, you need to configure application layer (Layer 7) inspection using Cloud NGFW to block malicious traffic such as SQL injection and cross-site scripting (XSS) attacks. Which steps should you take to implement this solution correctly?
- A
Configure a security policy in Cloud NGFW with predefined application signatures and threat prevention profiles enabled.
- B
Deploy Cloud Armor in front of the Cloud NGFW to handle application layer inspection.
- C
Define Layer 7 policies in Cloud NGFW to inspect HTTP and HTTPS traffic and enable threat logging.
- D
Attach the Cloud NGFW to the appropriate VPC network as a gateway for traffic routing.
- E
Enable private Google Access to ensure Cloud NGFW can inspect traffic from other Google Cloud services.
Show answer and explanation
Correct answers: A, C, D
Explanation
To set up application layer (Layer 7) inspection on Cloud NGFW, you need to configure security policies with predefined application signatures and threat prevention profiles, define Layer 7 policies for HTTP/HTTPS traffic, and attach the Cloud NGFW to the relevant VPC network for traffic routing. These steps ensure that malicious traffic, such as SQL injection or XSS attacks, is effectively detected and mitigated. Cloud Armor and private Google Access serve other purposes and are not required for this Layer 7 inspection setup.
- A. Correct.
Correct: Configuring a security policy and enabling predefined application signatures and threat prevention profiles in Cloud NGFW is essential for application layer (Layer 7) inspection to detect and block malicious traffic such as SQL injection or XSS.
- B. Incorrect.
Incorrect: While Cloud Armor is useful for DDoS protection and adding custom security rules, it is not required to handle Layer 7 inspection when using Cloud NGFW.
- C. Correct.
Correct: Defining Layer 7 policies to inspect HTTP/HTTPS traffic and enabling threat logging ensures that malicious payloads can be detected and logged for analysis.
- D. Correct.
Correct: Attaching the Cloud NGFW to the appropriate VPC network ensures that traffic flows through the firewall for inspection.
- E. Incorrect.
Incorrect: Enabling private Google Access is not directly related to configuring Layer 7 inspection on Cloud NGFW. It is used for accessing Google services privately, not for traffic inspection.