6.2 Configuring and Managing NGFW Policies and VPC Firewall Rules. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of enabling VPC firewall rules logging?

   • ATo block malicious traffic automatically.
   • BTo record all network traffic for billing purposes.
   • CTo encrypt traffic between VMs.
   • DTo capture metadata about traffic that matches the firewall rule, such as source and destination IPs and ports.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An organization has a hierarchical firewall rule at the organization level that allows all egress traffic. A folder-level hierarchical firewall rule denies all egress traffic to a specific IP range. What is the effective policy for resources in that folder?

   • AThe effective policy is the union of both rules, so egress to the specific IP range is denied while other egress is allowed.
   • BAll egress traffic is denied because the folder-level rule is more specific.
   • CAll egress traffic is allowed because the organization-level rule has higher precedence.
   • DThe effective policy depends on the priority numbers of the two rules.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   Your organization has a hierarchy with an org-level hierarchical firewall rule that denies all ingress traffic from the internet (priority 100). A project-level hierarchical firewall rule (priority 200) allows ingress from a specific IP range 203.0.113.0/24 on port 443. Additionally, a VPC firewall rule (priority 1000) allows ingress from 0.0.0.0/0 on port 443. A user reports that they cannot reach a VM in the project from an IP in 203.0.113.0/24. What is the most likely reason for the failure?

   • AThe project-level hierarchical rule with priority 200 is evaluated before the org-level rule with priority 100, so the allow rule is applied.
   • BThe org-level hierarchical deny rule with priority 100 is evaluated before the project-level allow rule, and the deny rule takes precedence because it has a lower priority number.
   • CThe VPC firewall rule with priority 1000 overrides the hierarchical deny rule because VPC firewall rules are evaluated first.
   • DThe VPC firewall rule with priority 1000 is evaluated before the hierarchical rules because VPC firewall rules have implicit higher precedence.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When configuring Cloud NGFW policies to support a GKE cluster, which of the following is a critical consideration?

   • ACloud NGFW policies only support ingress traffic, so egress filtering for GKE clusters must be handled by VPC firewall rules.
   • BCloud NGFW policies cannot be applied to GKE clusters because GKE uses its own firewall rules.
   • CCloud NGFW policies must be attached to the VPC that hosts the GKE cluster, and the policy must account for GKE's node and pod IP ranges.
   • DCloud NGFW policies are automatically applied to all GKE clusters in the project without any additional configuration.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are migrating from VPC firewall rules to Cloud NGFW policies. You have hundreds of VPC firewall rules across multiple projects. You need to minimize disruption and ensure that the security intent is preserved. What is the best approach?

   • ACreate a single Cloud NGFW policy that contains all the rules from all VPC firewall rules, and apply it to all projects.
   • BCreate a hierarchical firewall policy at the organization level that contains all the rules, and apply it to all projects.
   • CCreate separate Cloud NGFW policies for each project, and migrate the VPC firewall rules to the corresponding policy.
   • DMigrate the VPC firewall rules to Cloud NGFW policies by converting each rule to a separate policy.
   Reveal Solution Discussion Select an answer first