How to Implement TLS Interception for On-Premise Traffic in GCP

PCSE By islever Editorial Last updated

Short answer

C Configure a hierarchical firewall policy and enable TLS interception using Cloud Next Generation Firewall (NGFW) Enterprise.

Question

You are implementing a new web application on Google Cloud that will be accessed from your on-premises network. To provide protection from threats like malware, you must implement transport layer security (TLS) interception for incoming traffic to your application. What should you do?
  1. Configure Secure Web Proxy. Offload the TLS traffic in the load balancer, inspect the traffic, and forward the traffic to the web application.
  2. Configure an internal proxy load balancer. Offload the TLS traffic in the load balancer inspect, the traffic and forward the traffic to the web application.
  3. Configure a hierarchical firewall policy. Enable TLS interception by using Cloud Next Generation Firewall (NGFW) Enterprise. Correct Answer
  4. Configure a VPC firewall rule. Enable TLS interception by using Cloud Next Generation Firewall (NGFW) Enterprise.

Key Takeaways

Tests knowledge of Cloud NGFW Enterprise capabilities and the distinction between VPC firewall rules and hierarchical firewall policies for TLS inspection.

This question tests the correct architecture for enabling TLS inspection on inbound traffic to a Google Cloud web application. The page establishes that Cloud NGFW Enterprise requires a hierarchical firewall policy to configure decryption and threat inspection.

Common mistake: Many candidates choose Secure Web Proxy or standard VPC firewall rules, confusing outbound proxy architectures with inbound NGFW policy enforcement.

Expert Analysis

Why the Answer Is Correct

Cloud Next Generation Firewall (NGFW) Enterprise is the only GCP service that supports deep packet inspection and TLS decryption at scale. However, these advanced security features cannot be applied directly to legacy VPC firewall rules. Instead, you must attach the configuration to a hierarchical firewall policy, which acts as the mandatory policy container for NGFW capabilities. This architecture ensures that decrypted traffic is inspected against threat signatures before reaching the target workload.

Why the Other Options Are Wrong

Option A incorrectly combines Secure Web Proxy with load balancer offloading; Secure Web Proxy is optimized for outbound internet traffic inspection, not inbound on-premises application traffic. Option B describes a generic internal proxy load balancer, which lacks the integrated NGFW threat intelligence and centralized policy management required for enterprise-grade malware protection. Option D fails because standard VPC firewall rules are legacy constructs that do not support the NGFW policy engine needed to enable TLS interception.

Community Comment Notes

The voting community was split between options A and C, with several users highlighting the official documentation link regarding NGFW TLS inspection capabilities. As one commenter noted, "you cannot enable TLS inspection for a simple firewall rule," emphasizing the strict requirement for a hierarchical policy container. Others pointed out that Secure Web Proxy is primarily designed for outbound egress traffic, confirming why option C remains the architecturally sound choice for inbound protection.

Official Reference

https://cloud.google.com/firewall/docs/about-tls-inspection

This link opens the official vendor documentation in a new tab.

Exam Strategy

When configuring advanced security features like TLS inspection in Cloud NGFW, always look for 'firewall policy' rather than 'VPC firewall rule'. Remember that the NGFW Enterprise tier is mandatory for deep packet inspection and traffic decryption.

Frequently Asked Questions

Why can't I enable TLS inspection on a standard VPC firewall rule?

VPC firewall rules are legacy constructs that lack the policy container needed for NGFW features. TLS inspection requires a hierarchical or global firewall policy attached to a resource node.

Is Secure Web Proxy suitable for inbound on-premises traffic?

No. Secure Web Proxy is optimized for outbound internet traffic inspection. Inbound application traffic should use Cloud NGFW policies for centralized decryption and threat prevention.

More PCSE FAQ →

Community Votes

A
40%
C
40%
D
20%

40% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. BB_norway 👍 3 Answered D
    With the Enterprise tier we can intercept TLS traffic
  2. Popa 👍 2 Answered A
    Here’s why: Secure Web Proxy is specifically designed to provide advanced security measures, including TLS interception. It allows you to offload the TLS traffic from the load balancer, inspect it for threats, and then forward it to your web application. This method ensures that incoming traffic is thoroughly inspected for malware and other threats before reaching your application, providing a secure environment.
  3. ABotha 👍 2
    B is correct. Secure Web Proxy is typically used for external traffic, not internal traffic from an on-premises network.
  4. MoAk 👍 2 Answered C
    https://cloud.google.com/firewall/docs/about-tls-inspection
  5. YourFriendlyNeighborhoodSpider 👍 1 Answered C
    Google Cloud's Cloud Next Generation Firewall (NGFW) Enterprise includes TLS inspection capabilities, which allow you to decrypt and inspect encrypted traffic for threats before it reaches your web application. This is essential for protecting against malware and other threats embedded in encrypted traffic. A hierarchical firewall policy allows you to enforce firewall rules at the organization or folder level, ensuring consistent security policies across multiple projects. Why Not the Other Options? A. Secure Web Proxy + Load Balancer Google Cloud does not offer a native Secure Web Proxy with TLS interception for incoming traffic. Load balancers in Google Cloud do not provide deep TLS interception for security inspection.
Show 7 more comments
  1. BPzen 👍 1 Answered C
    Why C is Correct: Hierarchical Firewall Policy: A hierarchical firewall policy allows you to enforce consistent firewall rules across an organization, folders, or projects. Configuring TLS interception within this policy ensures that all relevant traffic passing through the policy can be decrypted, inspected, and then forwarded. A. Configure Secure Web Proxy. Offload the TLS traffic in the load balancer, inspect the traffic, and forward the traffic to the web application. Secure Web Proxy is not designed to handle incoming traffic for web applications in Google Cloud; it is typically used for outbound traffic filtering. This approach would not address the requirement to protect incoming traffic with TLS interception.
  2. KLei 👍 1 Answered A
    Secure Web Proxy: This setup allows you to intercept and inspect TLS traffic securely. By configuring a Secure Web Proxy, you can manage incoming traffic more effectively and implement security measures against threats. TLS Offloading at the Load Balancer: By offloading TLS traffic at the load balancer, you can decrypt and inspect the traffic before forwarding it to your web application.
  3. Pime13 👍 1 Answered A
    https://cloud.google.com/secure-web-proxy/docs/tls-inspection-overview Secure Web Proxy provides a TLS inspection service that allows you to intercept, inspect, and enforce security policies on TLS traffic. This approach ensures that incoming traffic is thoroughly inspected for threats before reaching your application.
  4. Zek 👍 1 Answered C
    https://cloud.google.com/firewall/docs/about-firewalls Cloud NGFW implements network and hierarchical firewall policies that can be attached to a resource hierarchy node. These policies provide a consistent firewall experience across the Google Cloud resource hierarchy.
  5. JohnDohertyDoe 👍 1 Answered C
    C is the right answer, you cannot enable TLS inspection for a simple firewall rule. You would need to add it to a Hierarchical Policy or a Global Firewall policy.
  6. yokoyan 👍 2 Answered A
    I think it's A.
  7. junb 👍 1
    C is Correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

How to Manage Corporate and Public User Identities in Google Cloud?

S-grade

← Back to PCSE Study Guide