Google Professional Cloud Network Engineer Question 475
Select 2Google Cloud PlatformYou are tasked with configuring edge security policies for an application hosted on Google Cloud that serves traffic globally. The application uses a Google Cloud HTTP(S) Load Balancer to distribute traffic. For compliance reasons, you need to restrict access to the application based on specific IP address ranges and enforce HTTPS connections. Which steps should you take to meet these requirements?
- A
Create a Google Cloud Armor security policy and attach it to the HTTP(S) Load Balancer.
- B
Configure a firewall rule to allow traffic only from the specific IP ranges.
- C
Enable SSL policies on the HTTP(S) Load Balancer to enforce HTTPS.
- D
Use Identity-Aware Proxy (IAP) to restrict access based on IP address ranges.
- E
Create a custom VPC and route all traffic through a Cloud VPN to filter IP ranges.
Show answer and explanation
Correct answers: A, C
Explanation
To configure edge security policies, you can use Google Cloud Armor to restrict access based on IP ranges and attach the policy to the HTTP(S) Load Balancer. Additionally, enabling SSL policies on the load balancer ensures that only secure HTTPS connections are allowed. These configurations ensure compliance and provide robust security at the network edge.
- A. Correct.
Correct: Google Cloud Armor allows you to define security policies, including IP-based restrictions, which can be attached to an HTTP(S) Load Balancer.
- B. Incorrect.
Incorrect: Firewall rules are applied at the VPC network level, not directly on the HTTP(S) Load Balancer. They are not suitable for edge security policies.
- C. Correct.
Correct: SSL policies on the HTTP(S) Load Balancer ensure that only HTTPS traffic is allowed, meeting the requirement to enforce secure connections.
- D. Incorrect.
Incorrect: Identity-Aware Proxy (IAP) is used for user authentication and authorization, not for IP-based restrictions.
- E. Incorrect.
Incorrect: Routing traffic through a Cloud VPN is unnecessary and overly complex for this scenario. It does not directly provide edge security for the HTTP(S) Load Balancer.