Google Professional Cloud Security Engineer Question 201
Select 3Google Cloud PlatformYou are a Cloud Security Engineer tasked with configuring application layer (Layer 7) inspection for a web application hosted on Google Cloud. The application is fronted by a Cloud Load Balancer, and you want to ensure that only legitimate HTTP traffic is allowed while blocking unauthorized or malicious traffic. Which steps should you take to implement this using Cloud NGFW?
- A
Deploy the Cloud NGFW in your Virtual Private Cloud (VPC) and configure it as an ingress firewall to inspect traffic.
- B
Enable Layer 7 inspection within the Cloud Load Balancer by enabling HTTP-specific rules.
- C
Create a security policy in the Cloud NGFW that includes an application filter to allow HTTP traffic and block unwanted applications.
- D
Attach the Cloud NGFW to the backend instances of the load balancer to inspect application traffic.
- E
Integrate Cloud NGFW with the Cloud Load Balancer by using a Service Attachment to route traffic through the firewall.
Show answer and explanation
Correct answers: A, C, E
Explanation
To enable application layer (Layer 7) inspection for traffic routed through a Cloud Load Balancer, you need to deploy the Cloud NGFW in your VPC and integrate it with the Load Balancer using a Service Attachment. This setup routes traffic through the NGFW for inspection. Additionally, you must create appropriate security policies in the NGFW, such as application filters, to inspect and control Layer 7 traffic (e.g., HTTP). Simply relying on the Cloud Load Balancer or attaching the NGFW to backend instances is not sufficient for this use case.
- A. Correct.
Correct: Deploying the Cloud NGFW in your VPC and configuring it as an ingress firewall is a necessary step to enable application layer inspection for incoming traffic.
- B. Incorrect.
Incorrect: While Cloud Load Balancers handle Layer 4/7 traffic, they do not provide in-depth application layer firewall capabilities. This feature must be configured on the Cloud NGFW.
- C. Correct.
Correct: Application filters in the Cloud NGFW are essential to allow specific types of Layer 7 traffic (e.g., HTTP) and block other unwanted or malicious traffic.
- D. Incorrect.
Incorrect: Cloud NGFW cannot be directly attached to backend instances. Instead, the traffic needs to be routed through the firewall before reaching the backend.
- E. Correct.
Correct: Integrating Cloud NGFW with the Cloud Load Balancer using a Service Attachment allows traffic to flow through the firewall for inspection before reaching the backend.