Google Professional Cloud Network Engineer Question 477
Select 2Google Cloud PlatformYour company has deployed a web application on Google Cloud using a regional backend service with HTTPS load balancing. To ensure only traffic from specific IP ranges can reach your application, you need to configure security controls at the network edge. Which steps should you take to implement this requirement?
- A
Create a Google Cloud Armor security policy and associate it with the load balancer backend service.
- B
Configure a Cloud Firewall rule to allow traffic only from the specified IP ranges to the load balancer’s IP address.
- C
Enable Identity-Aware Proxy (IAP) on your load balancer to restrict traffic by IP address.
- D
Create a custom network route to direct traffic from the specified IP ranges to the backend service.
- E
Add the specified IP ranges as a condition in the Google Cloud Armor policy.
Show answer and explanation
Correct answers: A, E
Explanation
To implement edge-level security for IP-based filtering in Google Cloud, Google Cloud Armor is the correct solution. By creating a security policy and associating it with the load balancer backend service, you can enforce IP-based access control. Adding the specified IP ranges as a condition in the policy ensures that only traffic from those ranges reaches the backend, effectively meeting the requirement.
- A. Correct.
Correct: Google Cloud Armor allows you to create security policies that can filter traffic based on IP ranges, geolocation, and other attributes. Associating it with the load balancer backend service enables edge-level filtering.
- B. Incorrect.
Incorrect: While Cloud Firewall rules can restrict traffic to VM instances, they do not directly apply to traffic reaching the load balancer. The appropriate solution for edge-level filtering is Google Cloud Armor.
- C. Incorrect.
Incorrect: Identity-Aware Proxy (IAP) is used to enable user-level access control but does not provide IP-based filtering.
- D. Incorrect.
Incorrect: Network routes are used for directing traffic between subnets or networks within Google Cloud but are unrelated to edge-level security or IP filtering.
- E. Correct.
Correct: Adding the specified IP ranges as a condition in the Google Cloud Armor policy ensures that only traffic from those IP addresses is allowed to reach the backend service.