Google Professional Cloud Network Engineer Question 460
Select 2Google Cloud PlatformYou are tasked with securing a web application hosted on Google Cloud Platform using Cloud Armor. The application is vulnerable to common web exploits such as SQL injection and cross-site scripting (XSS). Which steps should you take to ensure these vulnerabilities are mitigated?
- A
Create a Cloud Armor security policy and enable preconfigured WAF rules for SQL injection and XSS.
- B
Set up a firewall rule in the VPC network to block traffic from untrusted IP addresses.
- C
Enable Cloud Armor adaptive protection to detect and mitigate layer 7 DDoS attacks.
- D
Add a custom rule in Cloud Armor to inspect and block requests containing suspicious patterns in the URL.
- E
Enable the 'Default Deny All' rule in Cloud Armor to block all incoming requests by default.
Show answer and explanation
Correct answers: A, D
Explanation
To secure the web application against SQL injection and XSS vulnerabilities, you should use the preconfigured WAF rules in Cloud Armor, as they are designed to address these specific threats. Additionally, creating custom rules to identify and block suspicious patterns further enhances the application's security. VPC firewall rules and DDoS protection features address different aspects of security and are not directly applicable to mitigating SQL injection and XSS.
- A. Correct.
Correct. Cloud Armor provides preconfigured WAF rules that specifically target SQL injection and cross-site scripting. Enabling these rules is an effective way to mitigate these vulnerabilities.
- B. Incorrect.
Incorrect. While VPC firewall rules offer network-level protection, they do not provide application-layer protection against specific web exploits like SQL injection and XSS.
- C. Incorrect.
Incorrect. Adaptive protection in Cloud Armor is designed for DDoS mitigation, not for addressing specific web vulnerabilities like SQL injection or XSS.
- D. Correct.
Correct. Adding a custom rule in Cloud Armor allows you to define additional protections by blocking requests with suspicious patterns, complementing the preconfigured WAF rules.
- E. Incorrect.
Incorrect. A 'Default Deny All' rule would block all incoming requests, including legitimate traffic, and is not a practical solution for securing the application.