Google Professional Cloud Network Engineer Question 473
Select 2Google Cloud PlatformYour company runs a web application on Google Cloud which has been experiencing frequent DDoS attacks. You are tasked with implementing a solution to protect the application using Google Cloud's advanced network DDoS protection features. Which of the following actions should you take to mitigate these attacks effectively?
- A
Enable Cloud Armor security policies to filter malicious traffic at the edge.
- B
Deploy a Cloud Function to monitor traffic patterns and dynamically block IPs.
- C
Use Global HTTP(S) Load Balancing to distribute traffic and absorb volumetric attacks.
- D
Configure VPC Firewall Rules to block traffic from specific IP ranges.
- E
Enable logging and monitoring in Cloud Logging to analyze attack patterns.
Show answer and explanation
Correct answers: A, C
Explanation
To protect against DDoS attacks, it is essential to leverage Cloud Armor for filtering malicious traffic and use Global HTTP(S) Load Balancing to distribute traffic and absorb high-volume attacks. These tools are specifically designed for handling DDoS threats at a large scale. Other options, such as Cloud Functions or VPC Firewall Rules, are not suitable for real-time DDoS mitigation, and logging is only useful for post-incident analysis.
- A. Correct.
Cloud Armor provides robust DDoS protection by allowing you to configure security policies that filter malicious traffic at the edge, making it a critical part of the solution.
- B. Incorrect.
Although deploying a Cloud Function might allow for traffic monitoring, it is not designed to handle real-time DDoS mitigation and would be ineffective at scale.
- C. Correct.
Global HTTP(S) Load Balancing is a key component of DDoS protection on Google Cloud, as it can distribute traffic across multiple regions and absorb high-traffic attacks.
- D. Incorrect.
VPC Firewall Rules can block traffic from specific IP ranges, but they are not scalable or dynamic enough to handle large-scale DDoS attacks effectively.
- E. Incorrect.
While enabling logging and monitoring is useful for analyzing traffic patterns, it does not actively mitigate DDoS attacks.