Google Professional Cloud Network Engineer Question 450
Select 3Google Cloud PlatformYou are a network engineer tasked with protecting a public-facing web application hosted on Google Cloud against a series of DDoS attacks and malicious traffic. You decide to configure a Google Cloud Armor policy. Which of the following steps must you take to properly implement and enforce the security policy?
- A
Create a security policy in Google Cloud Armor and define the necessary rules.
- B
Associate the security policy with the backend service of the application.
- C
Enable logging for the security policy to monitor incoming traffic.
- D
Deploy the security policy directly to the VM instances hosting the application.
- E
Set the default action of the security policy to 'deny' to block any traffic not explicitly allowed.
Show answer and explanation
Correct answers: A, B, C
Explanation
To effectively configure Google Cloud Armor policies, you must first create a security policy and define rules that specify how traffic should be handled. The policy must then be associated with the backend service (e.g., a load balancer) that handles the application's traffic. Additionally, enabling logging helps monitor the policy's performance and analyze traffic patterns. Policies are enforced at the load balancer level and not directly on VM instances. Setting the default action to 'deny' can lead to unintended traffic disruptions and is not a recommended practice without thorough testing.
- A. Correct.
Creating a security policy and defining rules is essential to specify how traffic is allowed or denied. This is the first step in configuring Google Cloud Armor policies.
- B. Correct.
The security policy must be associated with the backend service (e.g., load balancer) to enforce the rules for the application traffic.
- C. Correct.
Enabling logging is a recommended best practice to monitor traffic and analyze how the policy is performing, although it does not directly affect enforcement.
- D. Incorrect.
Google Cloud Armor policies are applied at the load balancer level, not directly to VM instances. This option is incorrect.
- E. Incorrect.
Setting the default action to 'deny' is not recommended as it may unintentionally block legitimate traffic. The default action is typically set to 'allow' to avoid disrupting service.