Google Professional Cloud Network Engineer Question 469
Select 2Google Cloud PlatformYou are deploying a global application using Google Cloud's HTTP(S) Load Balancer, and you want to restrict access to specific backend services based on IP ranges. Which of the following steps are required to attach a security policy to the load balancer backends?
- A
Create a backend service and associate it with an existing security policy.
- B
Configure a Cloud Armor security policy with the desired IP allowlist or denylist.
- C
Attach the security policy to the frontend of the load balancer.
- D
Apply the security policy to the backend service associated with the load balancer.
- E
Enable firewall rules on the Compute Engine instances serving as backends.
Show answer and explanation
Correct answers: B, D
Explanation
To attach a security policy to load balancer backends, you must configure a Cloud Armor security policy with the desired rules and then apply it to the backend service associated with the load balancer. This ensures that the backend service is protected by the defined access restrictions. Frontend or firewall configuration is not part of this specific process.
- A. Incorrect.
Creating a backend service is necessary for the load balancer, but associating a security policy directly at this step is not how Cloud Armor policies are applied.
- B. Correct.
This is correct. Configuring a Cloud Armor security policy is required to define the IP allowlist or denylist rules for restricting access.
- C. Incorrect.
Security policies in Google Cloud are applied to backend services, not to the frontend of the load balancer.
- D. Correct.
This is correct. To enforce the security policy, it must be explicitly applied to the backend service associated with the load balancer.
- E. Incorrect.
Firewall rules are a separate consideration and are not required to implement a Cloud Armor security policy. They function at a different layer of the network stack.