A security engineer is setting up a new Google Cloud project. They need to ensure that all firewall rules created within this project are automatically analyzed against an organizational security policy that prohibits specific egress ports (e.g., port 25). They also want to identify any existing firewall rules that violate this policy and get recommendations for remediation. Which Google Cloud service combination should they use?
- ASecurity Health Analytics (SHA) with custom modules.
- BCloud Audit Logs exported to BigQuery for SQL analysis.
- CPolicy Intelligence with Firewall Insights and Policy Troubleshooter.
- DCloud Monitoring with custom metrics and alerts.
Show answer & explanationAnswer & explanation
Correct answer: C. Policy Intelligence with Firewall Insights and Policy Troubleshooter.
Policy Intelligence, specifically Firewall Insights, provides a deep understanding of firewall rule behavior and identifies shadowed or unused rules. When combined with Policy Troubleshooter and potentially custom organizational policies, it can analyze existing and new firewall rules against desired security policies and provide recommendations.
Why the other options are wrong
- A. Security Health Analytics (SHA) focuses on general resource misconfigurations, but Policy Intelligence is specifically designed for firewall policy analysis and recommendations.
- B. While logs provide data, Policy Intelligence offers a managed service for proactive analysis and recommendations without manual SQL queries.
- D. Cloud Monitoring is for operational metrics and alerts, not for analyzing firewall rule effectiveness against security policies.
Policy Intelligence for Firewall Analysis
A suite of Google Cloud tools (including Firewall Insights, Policy Troubleshooter, and Policy Analyzer) that helps understand, analyze, and optimize IAM policies and firewall rules, identifying misconfigurations and providing recommendations.
- Analyzes firewall rules for shadowed, unused, or overly permissive rules.
- Helps understand the impact of firewall rules on network traffic.
- Provides recommendations for policy optimization.
- Assists in identifying and troubleshooting policy violations.
Memory trick: Policy Intelligence is your 'firewall policy guru', giving 'insights' and 'troubleshooting' advice.