Google Professional Cloud Network Engineer Question 472
Select 2Google Cloud PlatformYour company has deployed a web application on Google Cloud using a global external HTTP(S) load balancer. Recently, the application has been experiencing Distributed Denial of Service (DDoS) attacks, causing disruptions in service. As a Professional Cloud Network Engineer, how can you configure advanced DDoS protection for the application using Google Cloud's built-in tools?
- A
Enable Cloud Armor and configure security policies to filter malicious traffic.
- B
Use the Identity-Aware Proxy (IAP) to restrict access to the application.
- C
Set up rate limiting rules in Cloud Armor to mitigate high request rates from specific IPs.
- D
Configure a private Google Kubernetes Engine (GKE) cluster for the backend to isolate it from public internet traffic.
- E
Enable the 'DDoS Protection' toggle in the load balancer settings.
Show answer and explanation
Correct answers: A, C
Explanation
Google Cloud provides advanced DDoS protection capabilities through services such as Cloud Armor. By enabling Cloud Armor and configuring security policies, you can filter malicious traffic and protect against L3 and L7 DDoS attacks. Additionally, rate limiting rules in Cloud Armor help mitigate high request rates from specific IPs, which are common in volumetric DDoS attacks. These tools work in conjunction with the global HTTP(S) load balancer to ensure the availability and security of your application.
- A. Correct.
Correct: Cloud Armor is a key Google Cloud service for DDoS protection. It allows you to create security policies for filtering malicious traffic, effectively mitigating L3 and L7 DDoS attacks.
- B. Incorrect.
Incorrect: Identity-Aware Proxy (IAP) is primarily used for authentication and controlling access to applications rather than mitigating DDoS attacks.
- C. Correct.
Correct: Rate limiting rules in Cloud Armor can help mitigate volumetric DDoS attacks by restricting the number of requests from specific IP addresses or ranges.
- D. Incorrect.
Incorrect: Configuring a private GKE cluster improves security by isolating workloads, but it does not specifically address DDoS protection for the public-facing web application.
- E. Incorrect.
Incorrect: There is no 'DDoS Protection' toggle in the load balancer settings. DDoS protection must be explicitly configured using tools like Cloud Armor.