Google Professional Cloud Network Engineer Question 470
Select 3Google Cloud PlatformYour organization hosts a critical web application on Google Cloud and is concerned about potential Distributed Denial of Service (DDoS) attacks. You have been tasked with implementing a solution to mitigate large-scale DDoS attacks while ensuring minimal latency for legitimate traffic. Which of the following configurations should you implement to achieve these objectives?
- A
Configure Cloud Armor security policies to block traffic from known malicious IP addresses and rate-limit excessive requests.
- B
Enable HTTP(S) Load Balancing with Cloud CDN to globally distribute and cache content closer to users.
- C
Deploy Virtual Private Cloud (VPC) Service Controls to restrict access to the backend services by IP ranges.
- D
Set up a custom static route in the VPC to redirect all incoming traffic to a backend firewall rule for analysis.
- E
Enable Google Cloud's DDoS protection features by using a Cloud Load Balancer with backend services.
Show answer and explanation
Correct answers: A, B, E
Explanation
To mitigate DDoS attacks effectively in Google Cloud, you should use a combination of Cloud Armor for advanced traffic filtering, HTTP(S) Load Balancer with Cloud CDN for global distribution and caching, and Google Cloud's built-in DDoS protection enabled through a Cloud Load Balancer. These configurations ensure that malicious traffic is blocked while legitimate traffic is served with minimal latency.
- A. Correct.
Cloud Armor provides protection against DDoS attacks by allowing you to block traffic from malicious IP addresses and rate-limit excessive requests. This is a core part of DDoS mitigation.
- B. Correct.
HTTP(S) Load Balancing with Cloud CDN not only distributes traffic globally but also caches content closer to users, reducing the load on backend services during high traffic surges and mitigating DDoS effects.
- C. Incorrect.
VPC Service Controls enhance security for data access but do not provide specific protection against DDoS attacks. This option is not relevant for the given scenario.
- D. Incorrect.
Custom static routes and backend firewall rules are not effective for DDoS mitigation. They don’t provide distributed protection or handle traffic at scale.
- E. Correct.
Google Cloud's DDoS protection features are automatically enabled when using a Cloud Load Balancer with backend services, providing scalable and automated defense against large-scale DDoS attacks.