Google Professional Cloud Security Engineer Question 189
Select 3Google Cloud PlatformYou are tasked with designing the perimeter security for a Google Cloud project that hosts a web application. The application must be publicly accessible, but you need to restrict access to administrative endpoints so that only your company's on-premises network can access them. Additionally, you want to prevent common web-based attacks such as SQL injection. Which combination of perimeter security settings should you configure to meet these requirements?
- A
Use Google Cloud Armor to create a security policy that blocks SQL injection patterns.
- B
Set up a VPC Service Control perimeter to restrict access to the administrative endpoints.
- C
Configure a Cloud Load Balancer with a URL map to route administrative traffic to private backends accessible only through an internal IP range.
- D
Create firewall rules to allow traffic from your on-premises network and block all other traffic to the administrative endpoints.
- E
Enable Identity-Aware Proxy (IAP) for the web application to secure all traffic, including public and administrative endpoints.
Show answer and explanation
Correct answers: A, C, D
Explanation
To design perimeter security for this scenario, you need to implement solutions that protect the web application from external threats and restrict access to sensitive administrative endpoints. Google Cloud Armor provides protection against common web attacks like SQL injection, while a Cloud Load Balancer with a URL map can route administrative traffic securely to internal backends. Firewall rules ensure that only your on-premises network can access administrative endpoints, providing an additional layer of security. VPC Service Controls and Identity-Aware Proxy are not suitable solutions for this specific perimeter security use case.
- A. Correct.
Correct: Google Cloud Armor can protect your application from common web-based attacks, such as SQL injection, through customizable security policies.
- B. Incorrect.
Incorrect: VPC Service Controls are used to secure access to Google Cloud services like Storage or BigQuery, not to manage perimeter security for endpoints.
- C. Correct.
Correct: A Cloud Load Balancer with a URL map can help in routing administrative traffic to a private backend, ensuring that sensitive endpoints are not publicly exposed.
- D. Correct.
Correct: Firewall rules can be used to restrict access to the administrative endpoints by allowing traffic only from your on-premises network.
- E. Incorrect.
Incorrect: Identity-Aware Proxy (IAP) is designed to secure application access by authenticating users but is not specifically a perimeter security solution for restricting network-level access to endpoints.