Google Professional Cloud Security Engineer Question 203
Select 3Google Cloud PlatformYour organization is deploying a mission-critical web application on Google Cloud. As part of the security architecture, you are tasked with setting up application layer (Layer 7) inspection for HTTP and HTTPS traffic using Cloud NGFW to detect and block malicious activities. Which of the following steps should you take to achieve this?
- A
Enable an HTTP/HTTPS-based Layer 7 policy on the Cloud NGFW instance.
- B
Configure URL filtering rules to block access to malicious or restricted sites.
- C
Set up Cloud Armor policies to handle Layer 7 inspection for the application.
- D
Enable the Cloud NGFW Threat Prevention feature to detect and block Layer 7 attacks.
- E
Create and attach a Cloud NAT gateway to the Cloud NGFW instance for Layer 7 inspection.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enable application-layer (Layer 7) inspection on Cloud NGFW, you need to configure HTTP/HTTPS-based Layer 7 policies, URL filtering, and enable the Threat Prevention feature. These configurations ensure that malicious activities at the application layer are detected and blocked. Cloud Armor and Cloud NAT serve different purposes and are not directly related to Layer 7 inspection within Cloud NGFW.
- A. Correct.
Enabling an HTTP/HTTPS-based Layer 7 policy on the Cloud NGFW instance is a required step to inspect and secure traffic at the application layer.
- B. Correct.
Configuring URL filtering rules on the Cloud NGFW helps block access to known malicious sites or restricted domains, enhancing Layer 7 security.
- C. Incorrect.
While Cloud Armor provides DDoS protection and WAF capabilities, it is not used for Layer 7 inspection on Cloud NGFW directly.
- D. Correct.
The Threat Prevention feature on Cloud NGFW is essential for detecting and blocking application-layer attacks, such as SQL injections or cross-site scripting (XSS).
- E. Incorrect.
A Cloud NAT gateway is used for outbound internet access but is not required for application-layer (Layer 7) inspection on Cloud NGFW.