Google Professional Cloud Network Engineer Question 479
Select 3Google Cloud PlatformYour organization has deployed applications in multiple Google Cloud regions to serve global users. You are tasked with configuring network edge security to ensure that requests from specific IP ranges are blocked before they reach your backend services. Additionally, you need to protect the applications from DDoS attacks while minimizing latency for users. What steps should you take to achieve these requirements?
- A
Configure Google Cloud Armor security policies to block traffic from specific IP ranges and attach the policy to your backend services.
- B
Enable Cloud CDN to cache responses and improve latency for users while reducing backend load.
- C
Use VPC Service Controls to define service perimeter policies for blocking traffic from specific IP ranges.
- D
Enable DDoS protection by configuring Google Cloud Armor standard policies.
- E
Set up Firewall Rules in each VPC to block traffic from specific IP ranges.
Show answer and explanation
Correct answers: A, B, D
Explanation
To achieve the requirements, you need to configure Google Cloud Armor for both blocking IP ranges and enabling DDoS protection. Additionally, enabling Cloud CDN helps reduce latency for global users. VPC Service Controls and Firewall Rules are not suitable for this use case as they do not operate at the network edge or provide the required protection mechanisms.
- A. Correct.
Google Cloud Armor allows you to define security policies, such as blocking traffic from specific IP ranges, and attach them to backend services. This is the correct approach for controlling edge security at the network level.
- B. Correct.
Cloud CDN helps improve performance for global users by caching responses closer to users, which reduces latency. While not directly related to security, this aligns with the requirement to minimize latency.
- C. Incorrect.
VPC Service Controls are used to secure access to Google Cloud services, not for blocking traffic based on IP ranges. This option is irrelevant to the scenario.
- D. Correct.
Google Cloud Armor provides built-in DDoS protection capabilities, which help protect applications from volumetric attacks, meeting the requirement to defend against DDoS attacks.
- E. Incorrect.
Firewall Rules in VPCs operate at the instance level, not at the network edge. They are not suitable for blocking traffic before it reaches backend services.