Google Professional Cloud Network Engineer Question 476
Single answerGoogle Cloud PlatformYour organization hosts a critical web application on Google Cloud. The application is exposed through a global external HTTP(S) Load Balancer, and you need to ensure that only traffic from specific IP ranges (e.g., trusted corporate offices) is allowed to access the application. Which configuration should you implement to meet this requirement?
- A
Create a Cloud Armor security policy and attach it to the HTTP(S) Load Balancer.
- B
Configure a VPC firewall rule to allow ingress traffic only from the trusted IP ranges.
- C
Set up a Private Google Access policy on the application’s subnet.
- D
Use Identity-Aware Proxy (IAP) to restrict access to the web application.
Show answer and explanation
Correct answer: A
Explanation
To restrict access to a web application based on IP ranges, you should use a Cloud Armor security policy. Cloud Armor integrates directly with the global HTTP(S) Load Balancer, allowing you to enforce IP-based allowlists or denylists at the network edge. This is the most appropriate and efficient way to secure your application in this scenario.
- A. Correct.
Correct. Cloud Armor security policies allow you to protect your applications by enabling you to configure allowlists or denylists for specific IP ranges at the edge of the network. Attaching it to the HTTP(S) Load Balancer ensures that only the specified IP ranges are allowed to access the web application.
- B. Incorrect.
Incorrect. VPC firewall rules operate at the network level and cannot directly control access to resources behind the HTTP(S) Load Balancer, which operates at the edge of Google’s network.
- C. Incorrect.
Incorrect. Private Google Access is used to allow instances in a private VPC subnet to access Google APIs and services without a public IP address. This does not address restricting access to the web application.
- D. Incorrect.
Incorrect. Identity-Aware Proxy (IAP) is used for user identity and access management, not IP-based restrictions. While it can enhance security, it is not relevant for restricting access based on specific IP ranges.