Professional Cloud Network EngineerDemo

By Google · Question Mode

QuestionQ287

Configuring, implementing and managing a cloud network security solution

Your organization has a subset of applications across multiple regions that need internet access. You must control application internet access to URLs, including hostnames and paths. The compute instances running these applications have an associated secure tag. What should you do?

  • A Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match a service account.
  • B Deploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall policy rules to filter outgoing traffic to specific domains from machines that match the secure tag.
  • C Deploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
  • D Deploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow access from machines that match the secure tag to the URLs defined in a URL list.
Explanation

Secure Web Proxy enforces outbound web-access policies using URL lists that can match hosts, full URLs, and URL patterns, and its policy rules can match a workload’s secure tag. Enabling global access on one Secure Web Proxy allows clients in any Google Cloud region to use that proxy while preserving tag-based identity attributes for policy enforcement. Cloud NAT and FQDN firewall objects do not provide URL-path filtering.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!