Google Professional Cloud Security Engineer Question 218
Select 2Google Cloud PlatformYour organization wants to deploy a secure web proxy on Google Cloud to filter and inspect outbound traffic from VM instances to the internet. The organization requires the solution to enforce security policies, log requests, and prevent unauthorized traffic. Which of the following steps should you take to implement this solution securely and effectively?
- A
Configure Cloud NAT for the VM instances and enable logging for traffic inspection.
- B
Deploy a third-party web proxy solution from the Google Cloud Marketplace and configure it to intercept and filter HTTP(S) traffic.
- C
Use VPC Service Controls to enforce network-level segmentation for the web proxy.
- D
Route VM instance outbound traffic through a firewall rule that forwards it to the web proxy.
- E
Enable Private Google Access to restrict internet access while using the web proxy.
Show answer and explanation
Correct answers: B, D
Explanation
To deploy a secure web proxy on Google Cloud, you need to use a solution that can inspect and filter outbound traffic from VM instances. A third-party web proxy from the Google Cloud Marketplace provides the required functionality to enforce security policies and log traffic. Routing VM traffic to the proxy via a firewall rule ensures all traffic is properly intercepted for inspection. Other options, such as Cloud NAT or Private Google Access, do not provide the required traffic inspection capabilities for this use case.
- A. Incorrect.
Cloud NAT allows outbound traffic without requiring external IPs but does not provide filtering or inspection capabilities needed for a secure web proxy.
- B. Correct.
Deploying a third-party web proxy from the Google Cloud Marketplace is a valid approach for implementing a secure web proxy. These solutions are designed to inspect, filter, and log traffic effectively.
- C. Incorrect.
VPC Service Controls help with securing data at the service layer but are not directly related to routing and filtering outbound traffic through a web proxy.
- D. Correct.
Routing outbound traffic from VM instances through a web proxy using a firewall rule is a key step to ensure all traffic is inspected and filtered by the proxy.
- E. Incorrect.
Enabling Private Google Access restricts VMs to access Google APIs without an external IP but does not affect web proxy functionality for outbound internet traffic.