Google Professional Cloud Security Engineer Question 186
Select 2Google Cloud PlatformYou are designing the perimeter security for an application hosted on Google Cloud. The application requires that only HTTPS traffic from a specific set of IP ranges is allowed, and all other traffic should be denied. Additionally, the solution should provide protection against common web-based attacks, such as cross-site scripting (XSS) and SQL injection. Which combination of solutions should you implement to meet these requirements?
- A
Configure a Google Cloud Armor security policy with rules to allow traffic only from the specified IP ranges and deny all other traffic.
- B
Enable the Web Application Firewall (WAF) rules in Google Cloud Armor to protect against XSS and SQL injection attacks.
- C
Set up a firewall rule in Google Cloud to allow HTTPS traffic from the specified IP ranges and deny all other traffic.
- D
Deploy a third-party WAF appliance on a Compute Engine instance to protect against XSS and SQL injection attacks.
- E
Use Cloud Load Balancing to restrict traffic to only HTTPS without additional configurations.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of allowing HTTPS traffic only from specific IP ranges and protecting against common web-based attacks, Google Cloud Armor provides a comprehensive solution. Configuring a security policy in Google Cloud Armor allows control over incoming traffic based on IP ranges, and enabling WAF rules protects the application against vulnerabilities like XSS and SQL injection. While firewall rules and load balancers can handle specific parts of the requirement, they do not provide complete coverage, making Google Cloud Armor the best choice.
- A. Correct.
Correct: Google Cloud Armor security policies allow you to create rules to restrict traffic based on IP ranges, ensuring only the specified IPs can access the application. This fulfills the requirement to allow traffic from specific IP ranges.
- B. Correct.
Correct: Enabling WAF rules in Google Cloud Armor helps protect against common web-based attacks like XSS and SQL injection, addressing the application's security needs.
- C. Incorrect.
Incorrect: While Google Cloud firewall rules can restrict traffic based on IP ranges, they cannot protect against web application attacks like XSS or SQL injection. This solution only partially meets the requirements.
- D. Incorrect.
Incorrect: Deploying a third-party WAF appliance may work, but it introduces additional complexity, cost, and maintenance overhead compared to Google Cloud's native solution. Native tools like Google Cloud Armor are more suitable in this case.
- E. Incorrect.
Incorrect: While Cloud Load Balancing can handle HTTPS traffic, it cannot restrict access to specific IP ranges or protect against web-based attacks without additional configurations like using Google Cloud Armor.