Google Professional Cloud Network Engineer Exam - Topic 2 Question 87 Discussion

Actual exam question for Google's Professional Cloud Network Engineer exam

Question #: 87
Topic #: 2

[All Professional Cloud Network Engineer Questions]

Your organization has a new security policy that requires you to monitor all egress traffic payloads from your virtual machines in region us-west2. You deployed an intrusion detection system (IDS) virtual appliance in the same region to meet the new policy. You now need to integrate the IDS into the environment to monitor all egress traffic payloads from us-west2. What should you do?

AEnable firewall logging, and forward all filtered egress firewall logs to the IDS.

BEnable VPC Flow Logs. Create a sink in Cloud Logging to send filtered egress VPC Flow Logs to the IDS.

CCreate an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

DCreate an internal HTTP(S) load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

Show Suggested Answer

Suggested Answer: D

Understanding VPC Flow Logs:

VPC Flow Logs is a feature that captures information about the IP traffic going to and from network interfaces in a VPC. It helps in monitoring and analyzing network traffic, ensuring security, and optimizing network performance.

Current Configuration:

According to the diagram, VPC Flow Logs is already configured for Subnet-1 in the host VPC. This means that traffic information for Subnet-1 is being captured and logged.

Requirement for Subnet-2:

The goal is to monitor flow logs for Subnet-2, which is in the service project VPC.

Correct Configuration for Subnet-2:

To monitor the flow logs for Subnet-2, you need to configure VPC Flow Logs within the service project VPC where Subnet-2 resides. This is because VPC Flow Logs must be configured in the same project and VPC where the subnet is located.

Implementation Steps:

Go to the Google Cloud Console.

Navigate to the service project where Subnet-2 is located.

Select the VPC network containing Subnet-2.

Enable VPC Flow Logs for Subnet-2 by editing the subnet settings and enabling the flow logs option.

Cost and Performance Considerations:

Enabling VPC Flow Logs may incur additional costs based on the volume of data logged. Ensure to review and understand the pricing implications.

Analyze and manage the data collected to avoid unnecessary logging and costs.

Google Cloud VPC Flow Logs Documentation

Configuring VPC Flow Logs

Shared VPC Overview

By configuring VPC Flow Logs in the service project VPC for Subnet-2, you ensure that traffic data is correctly captured and monitored, adhering to Google Cloud's best practices.

by Scarlet at Jul 10, 2024, 11:55 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Network Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Donette

3 months ago

Option A is too basic, we need something more robust!

upvoted 0 times

...

Gaston

4 months ago

Wait, can we really trust the IDS to catch everything?

upvoted 0 times

...

Marsha

4 months ago

Just a heads up, isn't option D a bit overkill for this?

upvoted 0 times

...

Lauran

4 months ago

I disagree, option C seems more effective for packet mirroring.

upvoted 0 times

...

Detra

4 months ago

I think option B is the best choice for monitoring egress traffic.

upvoted 0 times

...

Cletus

5 months ago

I’m leaning towards option C with the internal TCP/UDP load balancer, but I’m a bit confused about how that interacts with the IDS setup.

upvoted 0 times

...

Nathalie

5 months ago

I feel like the packet mirroring options could be effective, but I can't recall the difference between TCP/UDP and HTTP(S) load balancers in this context.

upvoted 0 times

...

Skye

5 months ago

I think VPC Flow Logs might be the right choice here, especially since we practiced a similar question about logging egress traffic last week.

upvoted 0 times

...

Lottie

5 months ago

I remember we discussed the importance of monitoring egress traffic, but I'm not sure if enabling firewall logging is enough for the IDS integration.

upvoted 0 times

...

Jin

5 months ago

This is a great question that tests our understanding of cloud networking and security best practices. I'm confident I can work through this step-by-step and identify the most appropriate solution.

upvoted 0 times

...

Leontine

5 months ago

I'm feeling a bit lost on this one. There are a lot of networking concepts and technologies involved that I'm not super familiar with. I'll need to take my time and really think through each option carefully.

upvoted 0 times

...

Mollie

5 months ago

Hmm, I'm a bit unsure about this one. Monitoring egress traffic payloads is a new concept for me. I'll need to review the details of the different options to see which one best meets the requirements.

upvoted 0 times

...

Heidy

5 months ago

This seems like a straightforward networking and security question. I'll carefully read through the options and think about the best way to integrate the IDS with the existing environment.

upvoted 0 times

...

Nichelle

5 months ago

Okay, I've got this. The key is to find a way to send the relevant traffic data from the VMs to the IDS. I think option B, using VPC Flow Logs, is the way to go here.

upvoted 0 times

...

Dino

5 months ago

I feel pretty confident about this one. The key is to follow the model code and apply it to the new data set. As long as I'm careful with the variable names and data set references, I think I can nail this question.

upvoted 0 times

...

Felix

6 months ago

I think the key here is to consolidate all the package feeds into a single feed. The question mentions the need to support both public and authenticated feeds, so I'm guessing the answer is going to involve some kind of universal package management solution.

upvoted 0 times

...

Aaron

10 months ago

I'm gonna have to go with C on this one. Packet Mirroring with an internal TCP/UDP load balancer? That's like the security equivalent of a Ferrari - fast, sleek, and sure to turn heads. Plus, it'll give you the ultimate egress traffic visibility.

upvoted 0 times

Herminia

9 months ago

Definitely! It's all about that ultimate egress traffic visibility.

upvoted 0 times

...

Arthur

9 months ago

That sounds like a solid choice. The Ferrari of security solutions, huh?

upvoted 0 times

...

Helga

9 months ago

C) Create an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

upvoted 0 times

...

Lawana

10 months ago

Hmm, let me think. Firewall logs, VPC Flow Logs, load balancers... Decisions, decisions. I guess I'll have to go with B. It's the most straightforward option, and who doesn't love a good Cloud Logging sink?

upvoted 0 times

Meghan

10 months ago

User 3: Definitely, B is the best choice for integrating the IDS to monitor egress traffic payloads.

upvoted 0 times

...

Fidelia

10 months ago

User 2: Agreed, VPC Flow Logs with a Cloud Logging sink seems like the most straightforward option.

upvoted 0 times

...

Theron

10 months ago

User 1: I think B is the way to go. Cloud Logging sink sounds like a solid choice.

upvoted 0 times

...

Marquetta

10 months ago

This is a tricky one, but I think I'd have to go with D. An internal HTTP(S) load balancer for Packet Mirroring? That's the kind of creative thinking that'll really impress the examiners. Plus, it's probably the most fun option to implement.

upvoted 0 times

...

Glen

11 months ago

As a seasoned security professional, I'd have to say option C is the way to go. Packet Mirroring with an internal TCP/UDP load balancer - it's the most comprehensive solution, and you can't beat that level of visibility.

upvoted 0 times

Mica

10 months ago

I think I'll go with option C as well, thanks for the recommendation!

upvoted 0 times

...

Azzie

10 months ago

Definitely, it's important to have a comprehensive solution in place to meet the new security policy requirements.

upvoted 0 times

...

Clarinda

10 months ago

That makes sense, the level of visibility provided by Packet Mirroring is crucial for security monitoring.

upvoted 0 times

...

Elroy

10 months ago

I agree, option C with Packet Mirroring using an internal TCP/UDP load balancer is the best choice for monitoring egress traffic.

upvoted 0 times

...

Kasandra

11 months ago

Ah, the classic 'monitor all egress traffic' dilemma. I'd go with B - VPC Flow Logs are the way to go. Cheaper than setting up a fancy load balancer, and who needs more firewall logs anyway?

upvoted 0 times

...