Professional Cloud Network EngineerDemo

By Google · Question Mode

QuestionQ310

Configuring, implementing and managing a cloud network security solution

You are monitoring a fleet of production VMs that process sensitive user data. Your security team requires a complete copy of all inbound and outbound network traffic from these VMs for deep packet inspection by a third-party Intrusion Detection System (IDS). The IDS appliances run in a managed instance group (MIG) and are served by an internal passthrough Network Load Balancer. You need to configure a monitoring solution that adds no latency to the production traffic path. What should you do?

  • A Deploy a Cloud IDS endpoint in the production VPC, and configure the endpoint to inspect traffic from the specified VMs.
  • B Configure VPC Flow Logs for the production subnet, set the sampling rate to maximum, and stream the logs to the IDS appliances for analysis.
  • C Configure a Cloud Private NAT gateway for the production VMs, and route all egress traffic through the gateway to the IDS appliances.
  • D Create a Packet Mirroring policy that selects the production VMs as mirrored sources and sets the internal passthrough Network Load Balancer as the collector destination.
Explanation

Google Cloud Packet Mirroring clones the traffic of selected VM instances, including packet payloads and headers, and forwards the copies to a collector destination for out-of-band inspection. An internal passthrough Network Load Balancer backed by an instance group is the supported collector destination, allowing the IDS appliances to receive mirrored ingress and egress traffic without routing production traffic through them.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!