Google Professional Cloud Network Engineer Question 453
Single answerGoogle Cloud PlatformYour organization recently experienced a DDoS attack that targeted your application hosted on Google Cloud. To mitigate future threats, you are asked to configure Google Cloud Armor policies to ensure that only traffic from specific IP addresses is allowed while blocking all other traffic. Which approach should you take to configure this policy?
- A
Create a Google Cloud Armor security policy with a rule that allows traffic from the specified IP addresses and set the default action to 'deny'.
- B
Create a Google Cloud Armor security policy with a rule that denies traffic from all IP addresses and set the default action to 'allow'.
- C
Use Google Cloud Armor's preconfigured WAF (Web Application Firewall) rules to allow traffic only from specific IP addresses.
- D
Configure a Google Cloud Armor security policy to rely on rate-based rules to throttle traffic based on IP address.
Show answer and explanation
Correct answer: A
Explanation
To restrict application access to specific IP addresses while blocking all other traffic, you should create a Google Cloud Armor security policy with a rule that explicitly allows the desired IP addresses and set the default action to 'deny'. This ensures that only traffic from the allowed IPs is permitted, fulfilling the requirement to mitigate unauthorized access in future attacks.
- A. Correct.
This is the correct approach. By creating a rule that explicitly allows traffic from the specified IP addresses and setting the default action to 'deny', all other traffic will be blocked, which effectively mitigates unauthorized access.
- B. Incorrect.
This is incorrect because denying traffic from all IP addresses and allowing traffic by default would contradict the goal of restricting access to only specific IP addresses.
- C. Incorrect.
This is incorrect because preconfigured WAF rules in Google Cloud Armor are not designed to filter traffic based on specific IP addresses; they are primarily used for common attack patterns like SQL injection or cross-site scripting.
- D. Incorrect.
This is incorrect because rate-based rules are designed to throttle excessive traffic but do not inherently restrict access based on IP addresses. They are not suitable for this use case.