Google Professional Cloud Network Engineer Question 452
Select 3Google Cloud PlatformYour company hosts a web application on Google Cloud behind a Global HTTP(S) Load Balancer. Recently, you have noticed a spike in malicious traffic, including SQL injection attempts and requests from suspicious IP ranges. To mitigate these threats, you need to configure Google Cloud Armor policies. Which steps should you take to address the issue?
- A
Create a Google Cloud Armor security policy and add a predefined rule to block SQL injection attempts.
- B
Attach the Google Cloud Armor policy to the backend service of the load balancer.
- C
Configure rate limiting in the Google Cloud Armor policy to restrict the number of requests per second from specific IP ranges.
- D
Create a firewall rule to block traffic from the suspicious IP ranges.
- E
Enable Cloud Armor’s adaptive protection feature to automatically block malicious traffic.
Show answer and explanation
Correct answers: A, B, C
Explanation
To mitigate malicious traffic using Google Cloud Armor, you need to create and configure a security policy with predefined rules to block SQL injection attempts. Attaching the policy to the backend service ensures it is applied to incoming traffic. Additionally, rate limiting can be used to restrict requests from specific IP ranges. While adaptive protection and firewall rules have their use cases, they are not directly relevant to this scenario.
- A. Correct.
This is correct because Google Cloud Armor includes predefined rules for mitigating common web application vulnerabilities, such as SQL injection attempts.
- B. Correct.
This is correct because Google Cloud Armor policies need to be attached to the backend service of the load balancer to take effect.
- C. Correct.
This is correct because rate limiting is an effective way to restrict the impact of excessive traffic from specific IP ranges.
- D. Incorrect.
This is incorrect because Google Cloud Firewall rules are not part of Google Cloud Armor and are not designed to block application-layer threats like SQL injection. Instead, they manage network-layer access.
- E. Incorrect.
This is incorrect because adaptive protection in Google Cloud Armor primarily helps with detecting and mitigating Layer 7 DDoS attacks, not SQL injection or request filtering based on IP ranges.