Google Professional Cloud Security Engineer Question 187
Select 2Google Cloud PlatformYour organization hosts a web application on Google Cloud, and you are tasked with designing perimeter security to protect it. The application is exposed through a public IP address and must be accessible only to specific trusted IP ranges. Which combination of Google Cloud services and configurations will best meet this requirement?
- A
Use a Google Cloud Armor security policy to allow traffic only from trusted IP ranges.
- B
Configure a firewall rule in the Virtual Private Cloud (VPC) network to deny all incoming traffic except from trusted IP ranges.
- C
Set up Identity-Aware Proxy (IAP) to restrict access based on user identity.
- D
Use a Cloud Load Balancer to block traffic from all IPs except the trusted IP ranges.
- E
Enable Private Google Access to restrict access to internal Google APIs.
Show answer and explanation
Correct answers: A, B
Explanation
To design perimeter security for a public-facing application on Google Cloud and restrict access to specific trusted IP ranges, you need to use a combination of Google Cloud Armor and VPC firewall rules. Google Cloud Armor allows for advanced security policy configurations, while VPC firewall rules provide network-level control. These combined approaches ensure that both application-level and network-level threats are mitigated. Other options such as IAP, Cloud Load Balancer, and Private Google Access do not meet the requirements for IP-based perimeter security.
- A. Correct.
Google Cloud Armor allows you to define security policies that can filter traffic based on IP ranges, geographical locations, and layer 7 parameters. This is an effective way to implement perimeter security for public-facing applications.
- B. Correct.
VPC firewall rules are a fundamental way to control traffic at the network level. By creating a rule to deny all incoming traffic except from trusted IP ranges, you establish a strong perimeter defense.
- C. Incorrect.
Identity-Aware Proxy (IAP) is useful for application-level access control based on user identity but does not control access based on IP ranges, making it unsuitable for this use case.
- D. Incorrect.
Cloud Load Balancers do not natively offer IP filtering. Instead, IP filtering should be implemented via Google Cloud Armor or VPC firewall rules.
- E. Incorrect.
Private Google Access is used to enable internal access to Google APIs for VMs that don’t have external IP addresses. It does not help in securing public-facing applications.