GCP Professional Cloud Security Engineer Practice Question

Your company's compliance team requires that all VM instances inside the prod-vpc are allowed to initiate outbound connections only to a short list of corporate SaaS providers whose hostnames may resolve to changing public IP addresses. You are using regional Cloud Next Generation Firewall because classic VPC firewall rules cannot express domain objects. Which configuration will most effectively enforce this requirement while minimizing operational effort when the SaaS providers rotate their IP ranges?

Publish the list of approved SaaS domains in an Organization-level hierarchical firewall policy so that all VPC networks inherit the same egress restriction.
Configure a Cloud NAT gateway for prod-vpc and restrict its allocated external IP addresses to the SaaS providers' address ranges.
Add egress VPC firewall rules in prod-vpc that specify the current public IP ranges of each SaaS provider and update them whenever the providers change their addresses.
Create a regional network firewall policy with egress rules that use FQDN objects for the approved SaaS hostnames, then attach the policy to the prod-vpc network.

Report Issue

Answer Description

Cloud Next Generation Firewall allows the use of Fully Qualified Domain Name (FQDN) objects in egress firewall policy rules. By creating a regional network firewall policy that contains egress rules referencing the approved domains (for example, *.workday.com and api.service-now.com) and applying that policy to the prod-vpc network, Google Cloud automatically resolves the domains and refreshes the address list. You do not need to maintain IP allow-lists manually, and you avoid the wide blast-radius of hierarchical policies that would affect other VPCs. Standard VPC firewall rules and Cloud NAT do not understand FQDN objects and therefore cannot meet the requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.