Google Associate Cloud EngineerDeploying and implementing a cloud solutionHard
A security team needs to ensure that all network traffic leaving their Google Cloud VPC network to the internet is inspected by a third-party firewall appliance. This appliance is deployed as a set of Compute Engine VMs. How can they route all outbound internet traffic through these firewall instances?
- AConfigure external IP addresses on the firewall VMs and set them as the default gateway.
- BUse custom static routes with a next hop pointing to the firewall instance's internal IP.
- CImplement a Shared VPC and configure firewall rules in the host project.
- DDeploy a Global External HTTP(S) Load Balancer in front of the firewall VMs.
Show answer & explanationAnswer & explanation
Correct answer: B. Use custom static routes with a next hop pointing to the firewall instance's internal IP.
Custom static routes allow you to specify a next hop for specific traffic. By setting a default route (0.0.0.0/0) with the next hop as the internal IP of the firewall instance, all outbound internet traffic will be directed through the firewall VMs for inspection.
Why the other options are wrong
- A. Setting firewall VMs as the default gateway is not a standard or scalable method in GCP VPC routing and would disrupt connectivity.
- C. Shared VPC is for sharing networks, not for forcing all egress traffic through specific instances. Firewall rules control ingress/egress, but don't redirect traffic through an appliance.
- D. A Global External HTTP(S) Load Balancer is for inbound web traffic distribution, not for routing all outbound internet traffic through internal firewall VMs.
Google Cloud Custom Static Routes
User-defined routes in a Google Cloud VPC network that specify how traffic should be forwarded, often used to direct traffic through network virtual appliances.
- Overrides default routes for specific destinations.
- Can specify a next hop as a VM instance, VPN tunnel, or internal IP.
- Essential for implementing network security patterns like centralized egress inspection.
Memory trick: Custom Routes 'route' traffic through 'custom' appliances.