You are implementing a new web application on Google Cloud that will be accessed from your on-premises network. To provide protection from threats like malware, you must implement transport layer…

Question

Options

• AConfigure Secure Web Proxy. Offload the TLS traffic in the load balancer, inspect the traffic, and
• BConfigure an internal proxy load balancer. Offload the TLS traffic in the load balancer inspect, the
• CConfigure a hierarchical firewall policy. Enable TLS interception by using Cloud Next Generation
• DConfigure a VPC firewall rule. Enable TLS interception by using Cloud Next Generation Firewall

• A
  73% (29)
• B
  15% (6)
• C
  8% (3)
• D
  5% (2)

Explanation

Secure Web Proxy (SWP) is Google Cloud's purpose-built service for inline TLS inspection - it acts as an explicit proxy that intercepts HTTPS traffic, decrypts it, inspects for threats like malware, and re-encrypts before forwarding to your application, making it the correct fit for this scenario.

Option B is wrong because an internal proxy load balancer can terminate TLS (decrypt traffic) but has no threat inspection capability - it's a traffic distribution tool, not a security inspection tool.

Option C is wrong because hierarchical firewall policies are organizational-level constructs for applying consistent allow/deny rules across your resource hierarchy; they don't provide TLS interception or malware scanning, even when combined with Cloud NGFW.

Option D is wrong because classic VPC firewall rules operate at Layer 3/4 (IP/port) and are entirely stateless with respect to application-layer content - TLS inspection is not a feature they support at all.

Memory tip: Think "Proxy = Interception." Only a proxy service sits inline in the traffic path and can decrypt, inspect, and re-encrypt - a firewall policy or load balancer alone cannot. When the exam says "TLS interception," look for the word proxy, and in GCP that means Secure Web Proxy.

No community discussion yet for this question.