Google Professional Cloud Network Engineer Question 462
Select 2Google Cloud PlatformYour organization has deployed a web application behind an HTTPS load balancer on Google Cloud. After a recent security audit, it was identified that the application is vulnerable to SQL injection and cross-site scripting (XSS) attacks. As a Cloud Network Engineer, you are tasked with implementing protections against these threats using Google Cloud Armor. What steps should you take to address these vulnerabilities?
- A
Enable the preconfigured WAF rules for SQL injection and cross-site scripting in Google Cloud Armor.
- B
Create custom WAF rules in Google Cloud Armor to block requests containing specific SQL commands or JavaScript code.
- C
Enable the Managed Protection Plus service in Google Cloud Armor to automatically detect and block SQL injection and XSS attacks.
- D
Use Identity-Aware Proxy (IAP) to restrict access to the application and prevent SQL injection and XSS attacks.
- E
Inspect the logs from the HTTPS load balancer to manually identify and block IPs exhibiting suspicious behavior.
Show answer and explanation
Correct answers: A, B
Explanation
To protect your web application from SQL injection and XSS attacks, you should leverage Google Cloud Armor's preconfigured WAF rules for these vulnerabilities, which are specifically designed to detect and block such threats. Additionally, creating custom WAF rules can complement the preconfigured rules by addressing any application-specific patterns. Other options, such as Managed Protection Plus, IAP, or manual log inspection, are either unrelated or insufficient for addressing these types of vulnerabilities.
- A. Correct.
Correct. Google Cloud Armor provides preconfigured WAF rules for SQL injection and XSS that can be enabled to protect your application from these common attacks.
- B. Correct.
Correct. In addition to preconfigured rules, creating custom WAF rules tailored to your application can provide an additional layer of defense for specific patterns or threats not covered by the default rules.
- C. Incorrect.
Incorrect. Managed Protection Plus enhances DDoS protection but does not specifically address SQL injection or XSS vulnerabilities. WAF rules in Google Cloud Armor are the appropriate solution for this scenario.
- D. Incorrect.
Incorrect. Identity-Aware Proxy (IAP) is designed to control access to applications based on identity but does not provide protection against SQL injection or XSS attacks.
- E. Incorrect.
Incorrect. While inspecting logs can help identify suspicious activity, it is not a direct or scalable solution for mitigating SQL injection and XSS attacks. WAF rules are specifically designed for this purpose.