How to Configure IPS Inspection for VMs on Cloud NGFW?

PCNE By islever Editorial Last updated Aug 29, 2026

Short answer

D Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the apply_security_profile_group action.

Question

You are configuring the intrusion prevention service (IPS) feature on Cloud Next Generation Firewall Enterprise. You deployed your firewall endpoints and you need to inspect the traffic of the VMs. What should you do?

Configure Packet Mirroring to match the source/destination IP addresses of the VMs.
Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the goto_next action.
Configure a firewall rule to match the hostnames of the VMs, and use the apply_security_profile_group action.
Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the apply_security_profile_group action. Correct Answer

Key Takeaways

This question tests your understanding of how Cloud NGFW intercepts traffic for deep packet inspection, with the common trap being confusion between packet mirroring, routing actions, and security profile application mechanisms.

To enable Intrusion Prevention System (IPS) inspection on Cloud Next Generation Firewall Enterprise, you must associate security profiles with firewall rules using the apply_security_profile_group action. The certification community overwhelmingly agrees that matching traffic by source and destination IP addresses while applying the security profile group is the correct configuration method.

Common mistake: Option C is frequently chosen because administrators often prefer managing resources by hostname; however, Cloud NGFW firewall rules require IP-based matching for traffic redirection to the security profile group, making hostname matching unsupported for this interception workflow.

Expert Analysis

Why the Answer Is Correct

Cloud NGFW Enterprise uses firewall rules to direct traffic to security endpoints for inspection. By configuring a rule that matches the VMs' source and destination IP addresses and applying the apply_security_profile_group action, traffic is seamlessly redirected to the deployed NGFW endpoints. The security profiles attached to this group contain the IPS signatures and Layer 7 inspection policies required to analyze and block threats.

Why the Other Options Are Wrong

Packet mirroring duplicates traffic for passive analysis but does not integrate with the Cloud NGFW enforcement point for active prevention. The goto_next action simply continues policy evaluation without redirecting traffic to a security service. Option C incorrectly suggests matching by hostname, as Cloud NGFW firewall rules require IP-based matching for traffic redirection to the security profile group.

Community Comment Notes

Highly voted community explanations confirm that apply_security_profile_group is the definitive mechanism for triggering NGFW inspection [Comment 2]. One candidate notes that while hostname management is intuitive, the underlying firewall policy strictly requires IP matching for proper traffic steering [Comment 3]. Another expert clarification emphasizes that security profiles define generic L7 structures used by endpoints to scan intercepted traffic based on configured threat severity levels [Comment 1].

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always map the exam's requested security function directly to the Cloud NGFW architectural component responsible for it, which is the security profile group applied via firewall rules. Memorize the exact action names like apply_security_profile_group as they frequently serve as the primary differentiator in scenario-based questions.

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

b0b25 👍 4 Answered D

continued --- > The NGFW endpoint inspects the traffic using the security profiles and applies actions such as blocking, alerting, or allowing based on configured threat severity levels.
b0b25 👍 3 Answered D

When a firewall rule is configured with apply_security_profile_group, matched traffic is redirected to the Cloud NGFW endpoint along with the specified security profile group D is right
RKS_2021 👍 1 Answered D

D is correct. Security profiles help you define Layer 7 inspection policy for your Google Cloud resources. They are generic policy structures that are used by firewall endpoints to scan intercepted traffic to provide application Layer services, such as intrusion prevention.
rich_maverick 👍 1 Answered C

First, let me say that D is acceptable. But, I would typically want to manage resources by their hostname and not their IP addresses. D may be right. Just wanted to make the case for C. If someone can point out why I'm wrong, I would appreciate it.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide