Google Professional Cloud Security Engineer Question 216
Single answerGoogle Cloud PlatformYour organization wants to deploy a secure web proxy on Google Cloud to ensure web traffic filtering, enforce internet usage policies, and inspect HTTPS traffic. Which approach should you take to deploy a secure web proxy while adhering to security best practices?
- A
Use a third-party web proxy solution deployed on a Google Cloud VM in a secure private subnet.
- B
Leverage Google Cloud Armor to configure web proxy capabilities for HTTPS inspection directly.
- C
Use a managed web proxy solution from the Google Cloud Marketplace and configure it in a shared VPC for centralized management.
- D
Deploy a Cloud Function to act as a custom web proxy and route all internet-bound traffic through it.
Show answer and explanation
Correct answer: A
Explanation
Deploying a secure web proxy involves using a robust solution that can handle traffic filtering, enforce policies, and inspect HTTPS traffic. A third-party web proxy deployed on a Google Cloud VM in a secure private subnet provides the required functionality and ensures security by isolating the proxy from public networks. Other options either lack the required capabilities or do not align with security best practices.
- A. Correct.
This is the correct answer. Deploying a third-party web proxy on a Google Cloud VM ensures that you have full control over traffic filtering and policy enforcement. Placing the proxy in a secure private subnet ensures isolation from public networks, aligning with security best practices.
- B. Incorrect.
Google Cloud Armor is a web application firewall (WAF) for protecting applications from common threats. It does not provide web proxy functionality or HTTPS inspection capabilities.
- C. Incorrect.
While managed solutions from the Google Cloud Marketplace can simplify deployment, configuring it in a shared VPC is not always the best approach for secure web proxy deployment. A shared VPC could expose the proxy to unnecessary risks if not properly isolated.
- D. Incorrect.
Cloud Functions are not designed to handle high-bandwidth traffic or act as a web proxy. This approach would be inefficient and insecure for web traffic filtering and HTTPS inspection.