Google Professional Cloud Network Engineer Exam - Topic 3 Question 34 Discussion

Actual exam question for Google's Professional Cloud Network Engineer exam

Question #: 34
Topic #: 3

[All Professional Cloud Network Engineer Questions]

Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client IP address. You want to identify this actor while minimizing disruption to your legitimate users.

What should you do?

ACreate a Cloud Armor Policy rule that denies traffic and review necessary logs.

BCreate a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.

CCreate a VPC Firewall rule that denies traffic, enable logging and set enforcement to disabled, and review necessary logs.

DCreate a VPC Firewall rule that denies traffic, enable logging and set enforcement to enabled, and review necessary logs.

Show Suggested Answer

Suggested Answer: B

https://cloud.google.com/armor/docs/security-policy-concepts#preview_mode

by Daron at May 08, 2022, 02:36 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Network Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Berry

4 months ago

C seems risky, why would you disable enforcement?

upvoted 0 times

...

Tien

4 months ago

I’m leaning towards A, but B sounds safer.

upvoted 0 times

...

Flo

4 months ago

Wait, can we really trust the logs to identify the actor?

upvoted 0 times

...

Jutta

4 months ago

Definitely agree with B, preview mode is key!

upvoted 0 times

...

Jesus

5 months ago

I think option B is the best choice for minimizing disruption.

upvoted 0 times

...

Refugia

5 months ago

I lean towards option D because it seems like the most straightforward way to block the malicious actor while still keeping an eye on legitimate traffic.

upvoted 0 times

...

Talia

5 months ago

I practiced a similar question where we had to balance security and user experience. I feel like enabling logging is crucial, but I can't recall if it should be with enforcement enabled or disabled.

upvoted 0 times

...

Earleen

5 months ago

I think option B sounds familiar because it mentions preview mode, which lets you test without affecting users. That might be the safer choice.

upvoted 0 times

...

Daren

5 months ago

I remember we discussed using Cloud Armor for protecting against DDoS attacks, but I'm not sure if denying traffic outright is the best first step here.

upvoted 0 times

...

Jaime

5 months ago

This seems like a straightforward question about the impact of leaving a required field blank. I'll carefully read through the options and think about the logical consequences.

upvoted 0 times

...

Lea

5 months ago

I'm a bit confused by this question. What exactly is the difference between the Decoder using the parser to parse traffic and using it to filter data? And how does the Transients setting affect that? I'll need to re-read the question and options carefully to make sure I understand the nuances.

upvoted 0 times

...

Janessa

5 months ago

Hmm, I'm a bit confused. Do I need to calculate compound interest or just look at the total contribution?

upvoted 0 times

...