Google Professional Cloud Network Engineer Question 454
Select 3Google Cloud PlatformYou are tasked with implementing a Google Cloud Armor policy for a web application running on Google Cloud to protect it from DDoS attacks while allowing access only from a specific country. Additionally, you need to ensure that requests from a particular IP address range are blocked entirely. How should you configure your Google Cloud Armor policy?
- A
Create a rule to allow traffic only from the desired country using a geographic match condition.
- B
Create a rule to block traffic from the specific IP address range using an IP address match condition.
- C
Set the default action of the policy to 'allow' to ensure legitimate traffic is not accidentally blocked.
- D
Set the default action of the policy to 'deny' to block all traffic by default.
- E
Apply the policy to the backend service of the web application.
Show answer and explanation
Correct answers: A, B, E
Explanation
To protect the web application from DDoS attacks and enforce access controls, you need to configure specific rules in the Google Cloud Armor policy. The geographic match condition allows traffic only from the desired country, while the IP address match condition blocks traffic from the restricted IP range. Finally, applying the policy to the backend service ensures the rules are enforced. The default action of the policy should be carefully chosen, but in this scenario, it is not needed because explicit rules handle the required configurations.
- A. Correct.
This is correct. A geographic match condition can be used in a Google Cloud Armor rule to allow traffic only from a specific country.
- B. Correct.
This is correct. Using an IP address match condition, you can block traffic from a specific IP address range in a Google Cloud Armor rule.
- C. Incorrect.
This is incorrect. Setting the default action to 'allow' may result in undesired traffic being allowed if specific rules are not matched.
- D. Incorrect.
This is incorrect. Setting the default action to 'deny' will block all traffic unless explicitly allowed, which could disrupt legitimate access.
- E. Correct.
This is correct. A Google Cloud Armor policy must be applied to a backend service to enforce the rules defined in the policy.