Google Professional Cloud Developer Question 96
Select 3Google Cloud PlatformYour organization has deployed a web application on Google Cloud using Compute Engine instances behind a load balancer. The application stores sensitive customer data and must comply with strict security regulations. You are tasked with protecting the application from unauthorized access and regularly identifying vulnerabilities. Which of the following solutions should you implement to meet these requirements?
- A
Enable Identity-Aware Proxy (IAP) to restrict access to authorized users only.
- B
Use Web Security Scanner to regularly scan your application for vulnerabilities.
- C
Set up a firewall rule to block all incoming traffic to the application.
- D
Enable Cloud Armor to protect against Distributed Denial of Service (DDoS) and web application attacks.
- E
Configure a Cloud Function to monitor traffic and block suspicious requests.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure a web application on Google Cloud, you should use a combination of tools and services designed to restrict access, detect vulnerabilities, and protect against attacks. Identity-Aware Proxy (IAP) ensures only authorized users can access the application, Web Security Scanner identifies vulnerabilities in the code and application, and Cloud Armor protects against DDoS and web application attacks. Together, these solutions provide comprehensive security for your application.
- A. Correct.
Enabling Identity-Aware Proxy (IAP) ensures that only authenticated and authorized users can access the application. This is a fundamental security mechanism for protecting sensitive data.
- B. Correct.
Web Security Scanner is a managed service that can identify common vulnerabilities, such as cross-site scripting (XSS) and outdated libraries, in your web application, helping you proactively address security issues.
- C. Incorrect.
Blocking all incoming traffic with a firewall rule would make the application inaccessible to legitimate users, which does not meet the business requirements.
- D. Correct.
Cloud Armor provides protection against DDoS attacks and web application exploits, which is essential for maintaining application availability and security.
- E. Incorrect.
While a Cloud Function could theoretically monitor traffic, it is not a recommended or scalable solution for protecting web applications. Managed services like IAP, Web Security Scanner, and Cloud Armor are more appropriate and effective.