Your organization has a subset of applications in multiple regions that require internet access. You need to control internet access from applications to URLs, including hostnames and paths. The…

Question

Options

• ADeploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall
• BDeploy a Cloud NAT gateway. Use fully qualified domain name (FQDN) objects in the firewall
• CDeploy a single Secure Web Proxy instance with global access enabled. Apply a Secure Web
• DDeploy a Secure Web Proxy instance in each region. Apply a Secure Web Proxy policy to allow

• A
  5% (2)
• B
  3% (1)
• C
  10% (4)
• D
  83% (33)

Explanation

Secure Web Proxy (SWP) is the GCP service designed specifically for egress web traffic filtering by full URL including hostnames and URL paths - capabilities that Cloud NAT and VPC firewall FQDN objects do not provide (FQDN objects match hostnames only, not paths). Because SWP is a regional service, it must be deployed in each region where the workloads reside. SWP policies can target instances using secure tags, matching the requirement. Option C suggests a single instance with global access enabled, but SWP does not support a single global instance serving multiple regions. Option D is the architecturally correct, regionally distributed approach.

No community discussion yet for this question.