Google Professional Cloud Network Engineer Question 465
Select 2Google Cloud PlatformYour organization has deployed a Google Cloud HTTP(S) Load Balancer to distribute traffic to a group of backend services. To enhance security, the team has decided to enforce security policies that restrict traffic to specific IP addresses and ensure only HTTPS traffic reaches the backends. What steps should you take to achieve this?
- A
Attach a Google Cloud Armor security policy to the backend service.
- B
Apply a firewall rule to the backend instances allowing only HTTPS traffic.
- C
Enable Google Cloud Armor on the load balancer's frontend configuration.
- D
Create a Google Cloud Armor security policy to restrict traffic to the backend service by IP address.
- E
Set up SSL policies on the backend service to enforce HTTPS traffic.
Show answer and explanation
Correct answers: A, D
Explanation
To secure backend services of a Google Cloud HTTP(S) Load Balancer, you can attach a Google Cloud Armor security policy, which allows you to define rules such as IP restrictions. This is done at the backend service level, and it ensures that only allowed traffic reaches the backends. Firewall rules and SSL policies serve different purposes and cannot achieve the same result in this context.
- A. Correct.
Correct: Attaching a Google Cloud Armor security policy to the backend service allows you to enforce traffic restrictions such as IP allowlists or deny lists.
- B. Incorrect.
Incorrect: Firewall rules are applied at the VM or network level, not directly to the backend service. They cannot enforce load balancer-specific security policies.
- C. Incorrect.
Incorrect: Google Cloud Armor is not enabled directly on the load balancer's frontend configuration. It is specifically attached to backend services.
- D. Correct.
Correct: Creating a Google Cloud Armor security policy lets you define and enforce rules such as IP-based restrictions for traffic targeting backend services.
- E. Incorrect.
Incorrect: SSL policies are used to enforce specific SSL/TLS configurations for the frontend of the load balancer, not backend access or IP restrictions.