Google Professional Cloud Security Engineer Question 202
Select 3Google Cloud PlatformYour organization is deploying a web application to Google Cloud using Compute Engine instances behind a load balancer. To ensure proper security, you are tasked with setting up application layer (Layer 7) inspection to detect and prevent malicious web requests, such as SQL injection and cross-site scripting (XSS). You decide to use Cloud NGFW. Which steps should you take to configure application layer inspection correctly?
- A
Enable Cloud NGFW and configure a Layer 7 rule to inspect HTTP/HTTPS traffic.
- B
Integrate Cloud NAT with Cloud NGFW for outgoing traffic inspection.
- C
Attach the Cloud NGFW policy to the VPC network where the Compute Engine instances are deployed.
- D
Configure a URL filtering profile in Cloud NGFW to block access to malicious or suspicious domains.
- E
Enable SSL decryption on Cloud NGFW to inspect encrypted HTTPS traffic.
Show answer and explanation
Correct answers: A, C, E
Explanation
To set up application layer (Layer 7) inspection using Cloud NGFW, you need to configure Layer 7 rules to inspect HTTP/HTTPS traffic, attach the NGFW policy to the relevant VPC network, and enable SSL decryption to inspect encrypted traffic. These steps ensure that malicious payloads embedded in HTTP or HTTPS requests, such as SQL injection or XSS, can be detected and mitigated. Other features, such as URL filtering, may complement the solution but are not sufficient for full Layer 7 inspection.
- A. Correct.
Correct. Cloud NGFW supports Layer 7 inspection rules, which are necessary to analyze and filter HTTP/HTTPS traffic for threats like SQL injection and XSS.
- B. Incorrect.
Incorrect. While Cloud NAT can be used for outgoing traffic, it is not directly related to setting up Layer 7 inspection on Cloud NGFW.
- C. Correct.
Correct. Attaching the Cloud NGFW policy to the correct VPC network is essential to ensure traffic flows through the firewall for inspection.
- D. Incorrect.
Incorrect. URL filtering profiles are useful for blocking specific domains but are not sufficient by themselves to configure Layer 7 inspection for web application security.
- E. Correct.
Correct. SSL decryption is necessary for Cloud NGFW to inspect encrypted HTTPS traffic at Layer 7, as encrypted traffic must be decrypted for inspection.