An enterprise runs containerized microservices on Google Kubernetes Engine (GKE) in Google Cloud. The security team needs to enforce egress boundary protection that moves beyond basic Layer 4 port and protocol rules. The security architecture must meet the following requirements: Inspect and control outbound egress traffic based on Layer 7 application attributes and cryptographic service identities. Prevent workload containers from directly reaching external public endpoints or bypassing application-layer inspection. Maintain strong separation of duties between application developers and network security administrators. Which architecture should the security engineer implement to meet these requirements?

Deploy egress gateways on a dedicated gateway node pool with taints, configure mesh Layer 7 authorization policies, and apply restrictive VPC egress firewall rules to workload nodes.: ### What the dedicated egress gateway architecture is This architecture combines **Cloud Service Mesh** application-layer controls with **Google Cloud VPC perimeter security** to establish a defense-in-depth egress boundary. Workload identities are established using mutual TLS (mTLS) and X.509 certificates, while outbound traffic is routed through managed **egress gateways** deployed on a dedicated GKE node pool. The gateway nodes are isolated using Kubernetes **taints and tolerations** to prevent standard application workloads from co-locating on them. ### How it meets the requirements - **Layer 7 application inspection**: Cloud Service Mesh authorization policies and service entries evaluate Layer 7 application attributes (such as HTTP host headers, request methods, paths, and workload identities) before granting outbound connectivity. - **Prevents inspection bypass**: Restrictive **VPC egress firewall rules** are assigned to the default application nodes, blocking them from sending traffic directly to external internet destinations. Only the dedicated egress gateway nodes (identified by their distinct node service account) are allowed outbound egress on ports 80 and 443. - **Separation of duties**: Network and security administrators manage the egress gateway definitions, service entries, and authorization policies within a dedicated administrative namespace (`istio-egress`), while application teams deploy workloads in separate application namespaces. ### Key advantages and capabilities - **Defense-in-depth boundary**: Enforces security at both the transport layer (VPC firewall) and the application layer (mesh authorization policies). - **Cryptographic workload identity**: Authenticates applications using managed certificates rather than ephemeral pod IP addresses. - **Node pool isolation**: Ensures non-gateway pods cannot compromise or bypass egress filtering on hardened gateway nodes. ### Why this is optimal This solution ensures workloads cannot bypass mesh proxies via raw sockets or altered `iptables` rules because the underlying VPC firewall drops all direct external egress from standard workload nodes.

Gke Layer7 Egress Boundary Protection | Professional Cloud Security Engineer

Gke Layer7 Egress Boundary Protection

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise runs containerized microservices on Google Kubernetes Engine (GKE) in Google Cloud. The security team needs to enforce egress boundary protection that moves beyond basic Layer 4 port and protocol rules.

The security architecture must meet the following requirements:

Inspect and control outbound egress traffic based on Layer 7 application attributes and cryptographic service identities.
Prevent workload containers from directly reaching external public endpoints or bypassing application-layer inspection.
Maintain strong separation of duties between application developers and network security administrators.

Which architecture should the security engineer implement to meet these requirements?

Deploy egress gateways on a dedicated gateway node pool with taints, configure mesh Layer 7 authorization policies, and apply restrictive VPC egress firewall rules to workload nodes.

Apply Kubernetes Network Policies to all workload namespaces to evaluate Layer 7 HTTP request headers and restrict outbound connections to external domain names.

Configure standard VPC egress firewall rules targeting application node network tags to allow outbound TCP ports 80 and 443, and inspect HTTP headers directly within the VPC firewall rules.

Rely entirely on sidecar proxy injection within workload pods to capture traffic and block external egress without configuring node-level VPC egress firewall rules.

Professional Cloud Security Engineer

Gke Layer7 Egress Boundary Protection

Related questions