An enterprise organization is designing a zero-trust network perimeter architecture for sensitive backend workloads hosted on Google Cloud Compute Engine instances across multiple VPC networks. The security engineering team has established the following technical requirements: Automatically block all inbound and outbound traffic associated with known malicious IP addresses and Tor exit nodes without maintaining static IP lists. Intercept and perform deep Layer 7 Intrusion Prevention System (IPS) inspection on encrypted TLS egress traffic to protect against malware, spyware, and command-and-control communication. Provide secure administrative SSH access to the instances without assigning external IP addresses or operating dedicated bastion hosts, while enforcing identity- and context-based access policies. Which combination of actions should the security team implement?

Configure hierarchical or global network firewall policy rules using Google Threat Intelligence lists with a deny action; configure a regional CA pool in Certificate Authority Service, a TLS inspection policy, and global network firewall policy rules using the apply_security_profile_group action with --tls-inspect; and enable IAP TCP forwarding while configuring an ingress firewall rule allowing TCP port 22 from 35.235.240.0/20.: ### What Cloud NGFW Enterprise, TLS Inspection, and IAP Provide This solution implements a defense-in-depth, zero-trust network perimeter by combining **Cloud Next Generation Firewall (NGFW)** threat feeds and Layer 7 deep packet inspection with **Identity-Aware Proxy (IAP)** context-aware access controls. ### How it meets the requirements: - **Automated Threat Intelligence**: Google Threat Intelligence lists (such as `iplist-tor-exit-nodes` and `iplist-known-malicious-ips`) can be referenced directly inside hierarchical or global network firewall policies with a `deny` action. These feeds dynamically update to block malicious traffic without requiring manual IP range maintenance. - **Encrypted L7 IPS Inspection**: Cloud NGFW Enterprise integrates with **Certificate Authority Service (CAS)** to dynamically generate intermediate certificates, enabling Transport Layer Security (TLS) decryption. Creating a TLS inspection policy and attaching it to global firewall policy rules using the `apply_security_profile_group` action and `--tls-inspect` flag allows firewall endpoints to inspect decrypted session payloads for vulnerabilities, malware, and spyware signatures. - **Zero-Trust Administrative Access**: IAP TCP forwarding enables secure tunneling to private Compute Engine VMs over SSH (TCP port 22) without requiring public IP addresses. Traffic originating from IAP is routed through the well-known Google netblock `35.235.240.0/20`, allowing strict ingress firewall rules paired with IAM and context-aware access evaluation. ### Key advantages: - **Dynamic updates**: Threat intelligence feeds are maintained directly by Google, eliminating manual rule drift. - **Hardware-backed trust**: CAS CA pools provide root or subordinate certificate issuing authority backed by Hardware Security Modules (HSMs). - **Centralized governance**: Hierarchical and global network firewall policies enforce mandatory security guardrails across organizational folders and projects.

Cloud Ngfw Ips Iap Zero Trust Architecture | Professional Cloud Security Engineer

Cloud Ngfw Ips Iap Zero Trust Architecture

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is designing a zero-trust network perimeter architecture for sensitive backend workloads hosted on Google Cloud Compute Engine instances across multiple VPC networks. The security engineering team has established the following technical requirements:

Automatically block all inbound and outbound traffic associated with known malicious IP addresses and Tor exit nodes without maintaining static IP lists.
Intercept and perform deep Layer 7 Intrusion Prevention System (IPS) inspection on encrypted TLS egress traffic to protect against malware, spyware, and command-and-control communication.
Provide secure administrative SSH access to the instances without assigning external IP addresses or operating dedicated bastion hosts, while enforcing identity- and context-based access policies.

Which combination of actions should the security team implement?

Deploy Cloud NAT gateways across all subnets to intercept encrypted egress TLS traffic; attach preconfigured WAF rules in Cloud Armor to the gateways; and configure global network firewall rules permitting SSH ingress from Cloud NAT external IP addresses.

Configure hierarchical or global network firewall policy rules using Google Threat Intelligence lists with a deny action; configure a regional CA pool in Certificate Authority Service, a TLS inspection policy, and global network firewall policy rules using the apply_security_profile_group action with --tls-inspect; and enable IAP TCP forwarding while configuring an ingress firewall rule allowing TCP port 22 from 35.235.240.0/20.

Configure classic VPC firewall rules referencing Google Threat Intelligence lists; deploy an out-of-band Packet Mirroring policy to forward traffic to third-party virtual appliances; and allow ingress TCP port 22 from 0.0.0.0/0 on an external passthrough Network Load Balancer.

Configure regional network firewall policy rules using the apply_security_profile_group action for TLS inspection; attach Cloud Armor security policies directly to backend VM interfaces; and create an ingress firewall rule allowing TCP port 22 from 169.254.169.254/32.

Professional Cloud Security Engineer

Cloud Ngfw Ips Iap Zero Trust Architecture

Related questions