Google Professional Cloud Network Engineer Question 464
Select 3Google Cloud PlatformYou are tasked with securing a web application hosted on Google Cloud that is vulnerable to SQL injection and cross-site scripting (XSS) attacks. You decide to implement a Web Application Firewall (WAF) using Google Cloud Armor. Which steps should you take to effectively mitigate these vulnerabilities?
- A
Create a Google Cloud Armor security policy and enable preconfigured WAF rules for SQL injection and XSS.
- B
Assign the Google Cloud Armor security policy to your backend service.
- C
Manually write custom WAF rules to identify SQL injection patterns and upload them to Google Cloud Armor.
- D
Enable Google Cloud Armor Adaptive Protection to automatically detect and block SQL injection and XSS attacks.
- E
Verify that the WAF rules are applied correctly by testing the application with SQL injection and XSS payloads.
Show answer and explanation
Correct answers: A, B, E
Explanation
To mitigate SQL injection and XSS vulnerabilities using Google Cloud Armor, you should enable the preconfigured WAF rules for these attack types, associate the security policy with your backend service, and validate the implementation by testing the application with attack payloads. These steps ensure that the application is protected against these common web application vulnerabilities without requiring manual rule configuration.
- A. Correct.
Correct. Google Cloud Armor provides preconfigured WAF rules for common attack types like SQL injection and XSS, which should be enabled as part of the security policy.
- B. Correct.
Correct. Associating the security policy with the backend service ensures that the WAF rules are applied to the traffic destined for your application.
- C. Incorrect.
Incorrect. While it is possible to write custom WAF rules, Google Cloud Armor already provides preconfigured rules for common vulnerabilities like SQL injection and XSS, which are easier to implement and maintain.
- D. Incorrect.
Incorrect. Google Cloud Armor Adaptive Protection is designed to protect against Layer 7 DDoS attacks and traffic anomalies but does not specifically target SQL injection or XSS.
- E. Correct.
Correct. Testing the application with known attack payloads ensures that the WAF rules are functioning as expected and mitigating the vulnerabilities effectively.