Google Professional Cloud Network Engineer Question 478
Select 3Google Cloud PlatformA multinational company has deployed a global application using Google Cloud's Load Balancer to serve traffic from multiple regions. They want to enhance edge security by restricting access to their application to specific countries and blocking certain IP ranges known for malicious activity. Which combination of steps should you take to implement this requirement?
- A
Create a Google Cloud Armor security policy and configure rules to allow traffic only from the required countries.
- B
Apply the Google Cloud Armor security policy to the Load Balancer's backend service.
- C
Use a VPC firewall rule to deny traffic from the suspicious IP ranges.
- D
Create a Google Cloud Armor security policy and configure rules to block traffic from the suspicious IP ranges.
- E
Apply the Google Cloud Armor security policy to the Load Balancer's frontend configuration.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enhance edge security for the application, Google Cloud Armor is the appropriate tool for restricting access based on geographic locations and blocking specific IP ranges. Configuring the security policy with the required rules and attaching it to the Load Balancer's backend service ensures that only permitted traffic reaches the application. VPC firewall rules, while useful for internal network security, are not designed for edge-level security use cases.
- A. Correct.
Correct. Google Cloud Armor security policies can be used to allow or deny traffic based on geographic locations, making this step crucial for restricting access to specific countries.
- B. Correct.
Correct. To enforce a Google Cloud Armor security policy, it must be attached to the backend service of a Load Balancer.
- C. Incorrect.
Incorrect. VPC firewall rules operate at the network level and are not suitable for implementing edge security policies based on IP ranges or geographic restrictions.
- D. Correct.
Correct. Google Cloud Armor security policies are appropriate for blocking traffic from specific IP ranges known for malicious activity.
- E. Incorrect.
Incorrect. Google Cloud Armor security policies are applied to backend services, not the frontend configuration of a Load Balancer.