Google Professional Cloud Security Engineer Question 200
Select 3Google Cloud PlatformYour organization is deploying Cloud NGFW for application layer (Layer 7) inspection to filter traffic based on HTTP and HTTPS protocols. As the Cloud Security Engineer, you need to ensure that Cloud NGFW properly inspects this traffic while adhering to compliance requirements. Which steps should you take to enable application layer inspection?
- A
Configure Cloud NGFW to use URL Filtering profiles to block or allow specific websites.
- B
Enable SSL decryption for inspecting encrypted HTTPS traffic.
- C
Create a custom Layer 7 policy rule to inspect application-specific traffic.
- D
Disable Stateful Inspection to enhance Layer 7 performance.
- E
Integrate Cloud NGFW with VPC Service Controls for additional application layer security.
Show answer and explanation
Correct answers: A, B, C
Explanation
To set up application layer (Layer 7) inspection on Cloud NGFW, you must configure features like URL Filtering, SSL decryption, and custom Layer 7 policy rules to inspect and control traffic effectively. These steps ensure that HTTP and HTTPS traffic is properly analyzed while maintaining compliance. Disabling Stateful Inspection or relying solely on VPC Service Controls does not contribute to application layer inspection capabilities.
- A. Correct.
Correct. URL Filtering profiles are essential for inspecting and controlling access to specific websites, which is a key part of application layer inspection.
- B. Correct.
Correct. SSL decryption enables Cloud NGFW to inspect encrypted HTTPS traffic, a critical function for comprehensive Layer 7 security.
- C. Correct.
Correct. Creating a custom Layer 7 policy rule allows you to define application-specific traffic patterns for inspection.
- D. Incorrect.
Incorrect. Disabling Stateful Inspection reduces security capabilities and is not recommended for application layer inspection.
- E. Incorrect.
Incorrect. While integrating with VPC Service Controls enhances perimeter security, it is not directly related to enabling application layer inspection on Cloud NGFW.