How to Configure IPS Inspection for VMs on Cloud NGFW?

You are configuring the intrusion prevention service (IPS) feature on Cloud Next Generation Firewall Enterprise. You deployed your firewall endpoints and you need to inspect the traffic of the VMs. What should you do?

  1. Configure Packet Mirroring to match the source/destination IP addresses of the VMs.
  2. Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the goto_next action.
  3. Configure a firewall rule to match the hostnames of the VMs, and use the apply_security_profile_group action.
  4. Configure a firewall rule to match the source/destination IP addresses of the VMs, and use the apply_security_profile_group action. Source Reference Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your understanding of how Cloud NGFW intercepts traffic for deep packet inspection, with the common trap being confusion between packet mirroring, routing actions, and security profile application mechanisms.

To enable Intrusion Prevention System (IPS) inspection on Cloud Next Generation Firewall Enterprise, you must associate security profiles with firewall rules using the apply_security_profile_group action. The certification community overwhelmingly agrees that matching traffic by source and destination IP addresses while applying the security profile group is the correct configuration method.

Option C is frequently chosen because administrators often prefer managing resources by hostname; however, Cloud NGFW firewall rules require IP-based matching for traffic redirection to the security profile group, making hostname matching unsupported for this interception workflow.

Community Discussion (4 comments)

rich_maverick 👍 1 Selected: C
First, let me say that D is acceptable. But, I would typically want to manage resources by their hostname and not their IP addresses. D may be right. Just wanted to make the case for C. If someone can point out why I'm wrong, I would appreciate it.
RKS_2021 👍 1 Selected: D
D is correct. Security profiles help you define Layer 7 inspection policy for your Google Cloud resources. They are generic policy structures that are used by firewall endpoints to scan intercepted traffic to provide application Layer services, such as intrusion prevention.
b0b25 👍 4 Selected: D
continued --- > The NGFW endpoint inspects the traffic using the security profiles and applies actions such as blocking, alerting, or allowing based on configured threat severity levels.
b0b25 👍 3 Selected: D
When a firewall rule is configured with apply_security_profile_group, matched traffic is redirected to the Cloud NGFW endpoint along with the specified security profile group D is right

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Cloud NGFW Enterprise uses firewall rules to direct traffic to security endpoints for inspection. By configuring a rule that matches the VMs' source and destination IP addresses and applying the apply_security_profile_group action, traffic is seamlessly redirected to the deployed NGFW endpoints. The security profiles attached to this group contain the IPS signatures and Layer 7 inspection policies required to analyze and block threats.

Why the Other Options Are Wrong

Packet mirroring duplicates traffic for passive analysis but does not integrate with the Cloud NGFW enforcement point for active prevention. The goto_next action simply continues policy evaluation without redirecting traffic to a security service. Option C incorrectly suggests matching by hostname, as Cloud NGFW firewall rules require IP-based matching for traffic redirection to the security profile group.

Community Comment Notes

Highly voted community explanations confirm that apply_security_profile_group is the definitive mechanism for triggering NGFW inspection [Comment 2]. One candidate notes that while hostname management is intuitive, the underlying firewall policy strictly requires IP matching for proper traffic steering [Comment 3]. Another expert clarification emphasizes that security profiles define generic L7 structures used by endpoints to scan intercepted traffic based on configured threat severity levels [Comment 1].

Official Reference

Exam Strategy

Always map the exam's requested security function directly to the Cloud NGFW architectural component responsible for it, which is the security profile group applied via firewall rules. Memorize the exact action names like apply_security_profile_group as they frequently serve as the primary differentiator in scenario-based questions.

Related Analysis

You have provisioned a Cloud Interconnect connection with a

S-Grade

You have the networking configuration shown in the diagram.

S-Grade

You are troubleshooting an application in your organization'

A-Grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide