Google Professional Cloud Network Engineer Question 483
Select 2Google Cloud PlatformYou are a Cloud Network Engineer configuring Adaptive Protection for a Google Cloud Armor security policy. Your goal is to protect your application from Layer 7 (HTTP-based) attacks while minimizing false positives. Which two steps must you take to successfully enable and configure Adaptive Protection?
- A
Attach the security policy with Adaptive Protection enabled to a backend service.
- B
Enable Adaptive Protection in the security policy and configure a notification mechanism, such as Pub/Sub.
- C
Configure custom rules to manually block suspicious traffic instead of using Adaptive Protection.
- D
Ensure that your backend service is fronted by a Google Cloud Load Balancer.
- E
Enable Adaptive Protection to operate in 'deny' mode immediately after deployment.
Show answer and explanation
Correct answers: A, D
Explanation
To configure Adaptive Protection effectively, you must enable it in the security policy and ensure the backend service is fronted by a Google Cloud Load Balancer, as Adaptive Protection relies on Layer 7 traffic analysis. Additionally, setting up a notification mechanism like Pub/Sub ensures you can monitor detected anomalies. Custom rules and immediate 'deny' mode are unnecessary or counterproductive for Adaptive Protection's automated and learning-based functionality.
- A. Correct.
Correct: Adaptive Protection must be attached to a backend service via a security policy to monitor and mitigate traffic effectively.
- B. Incorrect.
Correct: Enabling Adaptive Protection and configuring a notification mechanism ensures you are informed about detected anomalies and attacks.
- C. Incorrect.
Incorrect: Custom rules are not mandatory for Adaptive Protection. This feature automatically detects and mitigates threats using machine learning.
- D. Correct.
Correct: Adaptive Protection requires traffic to pass through a Google Cloud Load Balancer to analyze and profile Layer 7 behavior.
- E. Incorrect.
Incorrect: Adaptive Protection begins in 'alert' mode to observe traffic patterns and refine its detection model. Enabling 'deny' mode immediately is not recommended.