GCP Professional Cloud Security Engineer Practice Question

Your company runs several internal microservices in multiple GCP regions on a Shared VPC. Security policy requires that every outbound TLS connection those services initiate to the public internet be decrypted and inspected so malware uploads can be blocked based on application-layer signatures. The team does not want to deploy or manage host-based or explicit web proxies, and the solution must scale automatically in every current and future region. TLS decryption keys should be generated and rotated automatically by Google Cloud, without any customer-hosted key infrastructure. Which approach best meets these requirements?

Create an organization-level global network firewall policy, add an egress rule that uses a Cloud NGFW TLS inspection policy with Google-managed keys, enable the built-in intrusion-prevention service in blocking mode, and attach the policy to all Shared VPC networks.
Reroute all outbound traffic through an external HTTP(S) load balancer that terminates TLS with Google-managed certificates and apply a Cloud Armor web-application-firewall policy to block malicious uploads.
Enable Private Google Access and Cloud NAT, then add VPC firewall egress rules that deny connections to known malicious IP addresses based on threat-intelligence lists while allowing other destinations.
Deploy Secure Web Proxy in explicit mode, distribute a PAC file to every VM so egress traffic is forwarded through the proxy, and configure TLS interception using certificates issued by Certificate Authority Service.

Report Issue

Answer Description

A global Cloud NGFW network firewall policy can be attached to the Shared VPC so that enforcement happens directly on every VM's virtual NIC in all regions, eliminating the need for per-host proxies. An egress rule in the policy can reference a TLS inspection policy that uses the Google-managed subordinate CA automatically generated and rotated by Cloud NGFW to decrypt, inspect, and then re-encrypt outbound TLS traffic. Enabling the integrated intrusion-prevention service in blocking mode allows the firewall to drop malicious payloads detected at layer 7. Other options either require host-level proxy configuration (Secure Web Proxy), provide inspection only for traffic routed through a load balancer, or operate only at layers 3/4 without payload inspection (VPC firewall with Cloud NAT).

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.