Google Professional Cloud Security Engineer Question 220
Select 2Google Cloud PlatformYou are tasked with deploying a secure web proxy in your organization to inspect and control outbound web traffic from workloads running in Google Cloud. The proxy must enforce SSL/TLS decryption for monitoring purposes while ensuring compliance with your organization's security and data protection policies. Which of the following steps are necessary to deploy and secure the web proxy effectively?
- A
Configure the web proxy to intercept and decrypt SSL/TLS traffic using a custom CA certificate.
- B
Set up private Google Access to ensure workloads can reach Google APIs without the proxy.
- C
Use a Google-managed SSL certificate to secure communication between workloads and the proxy.
- D
Configure firewall rules to restrict egress traffic from workloads to only route through the proxy.
- E
Implement Identity-Aware Proxy (IAP) to control access to the web proxy.
Show answer and explanation
Correct answers: A, D
Explanation
Deploying a secure web proxy involves intercepting and decrypting SSL/TLS traffic to inspect outbound communications. To achieve this, a custom CA certificate must be configured for the proxy to handle secure traffic properly. Additionally, firewall rules should be set up to ensure that all egress traffic from workloads is routed through the proxy, enforcing security policies. Other options, such as private Google Access, Google-managed SSL certificates, or IAP, are not directly relevant to this specific requirement.
- A. Correct.
Correct: A custom CA certificate is required for the web proxy to decrypt and inspect SSL/TLS traffic. This ensures that the proxy can properly intercept and analyze secure communications.
- B. Incorrect.
Incorrect: While private Google Access is useful for accessing Google APIs, it is unrelated to deploying a secure web proxy for monitoring outbound traffic.
- C. Incorrect.
Incorrect: A Google-managed SSL certificate is not applicable in this scenario. The proxy requires a custom CA certificate for SSL/TLS decryption, not a Google-managed certificate.
- D. Correct.
Correct: Configuring firewall rules ensures that workloads can only send outbound traffic through the proxy, enforcing traffic inspection and monitoring.
- E. Incorrect.
Incorrect: Identity-Aware Proxy (IAP) is used to control access to web applications and is not relevant to securing outbound traffic through a web proxy.