Google Professional Cloud Network Engineer Question 486
Single answerGoogle Cloud PlatformYour organization hosts a public-facing API on Google Cloud behind a Cloud Load Balancer. Recently, you have noticed a significant increase in traffic that occasionally causes service disruption due to excessive requests from particular IP addresses. You have been tasked with implementing rate limiting to prevent abuse while ensuring legitimate users are not affected. Which solution would be most appropriate to configure rate limiting for your API?
- A
Configure a Google Cloud Armor security policy with rate-based rules to limit requests from specific IP addresses.
- B
Use VPC firewall rules to limit the number of requests from specific IP addresses.
- C
Deploy a Cloud Function to monitor API usage and block IP addresses exceeding a predefined threshold.
- D
Set up a custom rate-limiting mechanism in your API code to block excessive requests.
Show answer and explanation
Correct answer: A
Explanation
Google Cloud Armor is the most effective solution for implementing rate limiting in this scenario. It provides rate-based rules that can be applied to public-facing APIs behind a Cloud Load Balancer. This approach ensures scalability, efficiency, and ease of management compared to other options like VPC firewall rules, Cloud Functions, or custom implementations in API code.
- A. Correct.
This is the correct option. Google Cloud Armor allows you to define security policies with rate-based rules to limit requests from specific IP addresses or based on other attributes. It integrates with Google Cloud Load Balancers, making it suitable for protecting public-facing APIs.
- B. Incorrect.
VPC firewall rules cannot be used for rate limiting. They are designed to allow or deny traffic based on IP ranges, protocols, and ports, but they do not support rate-based filtering.
- C. Incorrect.
While monitoring API usage with a Cloud Function is possible, this approach is not efficient or scalable for managing rate limiting. Cloud Functions are not purpose-built for this use case.
- D. Incorrect.
Implementing rate limiting directly in your API code may work but is not ideal for production-scale traffic. It requires additional development effort and may not be as robust or scalable as using a managed service like Google Cloud Armor.