MENU
Your organization's security team recently discovered that there is a high risk of malicious activities originating from some of your VMs connected to the internet. These malicious activities are currently undetected when TLS communication is used. You must ensure that encrypted traffic to the internet is inspected. What should you do?
Suggested Answer: B
Get Premium Professional Cloud Network Engineer Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Cloud NGFW Enterprise provides TLS inspection to detect and manage threats within encrypted traffic. Configuring firewall rules for TLS inspection enables granular monitoring and filtering, ensuring secure internet traffic.
34 comments · newest first
VE
Veda
11 months ago
C is interesting, but managing agents on every VM sounds like a hassle.
CA
Catalina
11 months ago
D could work, but I’m not sure about the effectiveness of VPC Flow Logs.
AN
Annette
11 months ago
Wait, can we really intercept TLS traffic like that? Seems risky.
CO
Colette
11 months ago
I think A is a better choice for TLS inspection.
SH
Shalon
12 months ago
Option B sounds solid for inspecting egress traffic.
JE
Jesusa
12 months ago
I vaguely recall that VPC Flow Logs can help with monitoring, but I'm not confident about how effective they are for real-time inspection.
RI
Rikki
1 year ago
I feel like configuring a TLS agent on each VM could be overkill. Wouldn't that complicate things too much?
ER
Erinn
1 year ago
I think using Cloud NGFW Enterprise with the tls-inspect flag sounds familiar. We practiced a similar question about inspecting encrypted traffic last week.
YA
Yasuko
1 year ago
I remember discussing TLS inspection in class, but I'm not sure if Cloud Armor is the right choice here. It seems more focused on DDoS protection.
TA
Tarra
1 year ago
Option D looks interesting, using Cloud NGFW Essentials and VPC Flow Logs. I wonder if that would be a more cost-effective solution compared to the Enterprise version. I'll make sure to weigh the pros and cons of each approach.
MA
Margurite
1 year ago
I feel pretty confident about this one. The key is to ensure that the encrypted traffic is inspected, so I'm leaning towards option C - configuring a TLS agent on each VM to intercept the traffic before it reaches the internet.
KA
Kathrine
1 year ago
Hmm, I'm a bit confused about the different options here. Do we really need to use Cloud NGFW Enterprise, or would the Essentials version work as well? I'll need to read through the options more carefully.
MI
Mica
1 year ago
This seems like a straightforward question about inspecting encrypted traffic. I think I'll go with option B - using Cloud NGFW Enterprise and creating a firewall rule with the tls-inspect flag.
SO
Sonia
2 years ago
I'm not sure, but B sounds like it might be the most practical and efficient solution here. Cloud NGFW Enterprise seems like the way to go.
PE
Penney
2 years ago
D) Use Cloud NGFW Essentials. Create a firewall rule for egress traffic and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.
MO
Mozell
2 years ago
C) Configure a TLS agent on every VM to intercept TLS traffic before it reaches the internet. Configure Sensitive Data Protection to analyze and allow/deny the content.
IS
Isreal
2 years ago
B) Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the tls-inspect flag and associate the firewall rules with the VMs.
LE
Lezlie
2 years ago
A) Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.
SU
Susana
2 years ago
Haha, D is the funniest option! Analyzing VPC Flow Logs for TLS traffic? That's like trying to find a needle in a haystack!
RU
Ruthann
2 years ago
I think C is the way to go. Intercepting the TLS traffic at the VM level and analyzing the content is a more comprehensive approach.
LE
Leslie
2 years ago
I think option B might be more efficient in terms of managing the traffic flow and inspection process.
TO
Tomoko
2 years ago
I agree, option C seems like a thorough solution to tackle the malicious activities.
LA
Lavera
2 years ago
B is the way to go! Cloud NGFW Enterprise is the best option to inspect the encrypted traffic and protect against those malicious activities.
LO
Lore
2 years ago
D) Use Cloud NGFW Essentials. Create a firewall rule for egress traffic and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.
VE
Venita
2 years ago
D) Use Cloud NGFW Essentials. Create a firewall rule for egress traffic and enable VPC Flow Logs with the TLS inspect option. Analyze the output logs content and block the outputs that have malicious activities.
JU
Juliana
2 years ago
B is the way to go! Cloud NGFW Enterprise is the best option to inspect the encrypted traffic and protect against those malicious activities.
CH
Christiane
2 years ago
B) Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the tls-inspect flag and associate the firewall rules with the VMs.
SE
Serina
2 years ago
A) Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.
RE
Reid
2 years ago
B) Agreed! Cloud NGFW Enterprise provides the necessary tools to inspect encrypted traffic and prevent malicious activities.
CH
Charlette
2 years ago
A) Enable Cloud Armor TLS inspection policy, and associate the policy with the backend VMs.
LA
Lacey
2 years ago
B) Use Cloud NGFW Enterprise. Create a firewall rule for egress traffic with the tls-inspect flag and associate the firewall rules with the VMs.
WI
Wilburn
2 years ago
I'm not sure about option B. I think option D could also work well by enabling VPC Flow Logs with the TLS inspect option to analyze and block malicious activities.
TR
Trina
2 years ago
I agree with Brendan. Option B seems like the most effective way to inspect encrypted traffic to the internet and prevent malicious activities.
BR
Brendan
2 years ago
I think option B sounds like a good solution. Using Cloud NGFW Enterprise with a firewall rule for egress traffic seems like a solid plan.