Google Exam Professional Cloud Network Engineer Topic 2 Question 87 Discussion

Actual exam question for Google's Professional Cloud Network Engineer exam

Question #: 87
Topic #: 2

[All Professional Cloud Network Engineer Questions]

Your organization has a new security policy that requires you to monitor all egress traffic payloads from your virtual machines in region us-west2. You deployed an intrusion detection system (IDS) virtual appliance in the same region to meet the new policy. You now need to integrate the IDS into the environment to monitor all egress traffic payloads from us-west2. What should you do?

AEnable firewall logging, and forward all filtered egress firewall logs to the IDS.

BEnable VPC Flow Logs. Create a sink in Cloud Logging to send filtered egress VPC Flow Logs to the IDS.

CCreate an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

DCreate an internal HTTP(S) load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

Show Suggested Answer

Suggested Answer: D

Understanding VPC Flow Logs:

VPC Flow Logs is a feature that captures information about the IP traffic going to and from network interfaces in a VPC. It helps in monitoring and analyzing network traffic, ensuring security, and optimizing network performance.

Current Configuration:

According to the diagram, VPC Flow Logs is already configured for Subnet-1 in the host VPC. This means that traffic information for Subnet-1 is being captured and logged.

Requirement for Subnet-2:

The goal is to monitor flow logs for Subnet-2, which is in the service project VPC.

Correct Configuration for Subnet-2:

To monitor the flow logs for Subnet-2, you need to configure VPC Flow Logs within the service project VPC where Subnet-2 resides. This is because VPC Flow Logs must be configured in the same project and VPC where the subnet is located.

Implementation Steps:

Go to the Google Cloud Console.

Navigate to the service project where Subnet-2 is located.

Select the VPC network containing Subnet-2.

Enable VPC Flow Logs for Subnet-2 by editing the subnet settings and enabling the flow logs option.

Cost and Performance Considerations:

Enabling VPC Flow Logs may incur additional costs based on the volume of data logged. Ensure to review and understand the pricing implications.

Analyze and manage the data collected to avoid unnecessary logging and costs.

Google Cloud VPC Flow Logs Documentation

Configuring VPC Flow Logs

Shared VPC Overview

By configuring VPC Flow Logs in the service project VPC for Subnet-2, you ensure that traffic data is correctly captured and monitored, adhering to Google Cloud's best practices.

by Scarlet at Jul 10, 2024, 11:55 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Network Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Aaron

1 months ago

I'm gonna have to go with C on this one. Packet Mirroring with an internal TCP/UDP load balancer? That's like the security equivalent of a Ferrari - fast, sleek, and sure to turn heads. Plus, it'll give you the ultimate egress traffic visibility.

upvoted 0 times

Arthur

10 days ago

That sounds like a solid choice. The Ferrari of security solutions, huh?

upvoted 0 times

...

Helga

12 days ago

C) Create an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

upvoted 0 times

...

Lawana

1 months ago

Hmm, let me think. Firewall logs, VPC Flow Logs, load balancers... Decisions, decisions. I guess I'll have to go with B. It's the most straightforward option, and who doesn't love a good Cloud Logging sink?

upvoted 0 times

Meghan

25 days ago

User 3: Definitely, B is the best choice for integrating the IDS to monitor egress traffic payloads.

upvoted 0 times

...

Fidelia

1 months ago

User 2: Agreed, VPC Flow Logs with a Cloud Logging sink seems like the most straightforward option.

upvoted 0 times

...

Theron

1 months ago

User 1: I think B is the way to go. Cloud Logging sink sounds like a solid choice.

upvoted 0 times

...

Marquetta

1 months ago

This is a tricky one, but I think I'd have to go with D. An internal HTTP(S) load balancer for Packet Mirroring? That's the kind of creative thinking that'll really impress the examiners. Plus, it's probably the most fun option to implement.

upvoted 0 times

...

Glen

2 months ago

As a seasoned security professional, I'd have to say option C is the way to go. Packet Mirroring with an internal TCP/UDP load balancer - it's the most comprehensive solution, and you can't beat that level of visibility.

upvoted 0 times

Mica

24 days ago

I think I'll go with option C as well, thanks for the recommendation!

upvoted 0 times

...

Azzie

28 days ago

Definitely, it's important to have a comprehensive solution in place to meet the new security policy requirements.

upvoted 0 times

...

Clarinda

1 months ago

That makes sense, the level of visibility provided by Packet Mirroring is crucial for security monitoring.

upvoted 0 times

...

Elroy

1 months ago

I agree, option C with Packet Mirroring using an internal TCP/UDP load balancer is the best choice for monitoring egress traffic.

upvoted 0 times

...

Kasandra

2 months ago

Ah, the classic 'monitor all egress traffic' dilemma. I'd go with B - VPC Flow Logs are the way to go. Cheaper than setting up a fancy load balancer, and who needs more firewall logs anyway?

upvoted 0 times

...