Google Professional Cloud Security Engineer Question 190
Select 2Google Cloud PlatformYour organization has a hybrid cloud setup and wants to implement perimeter security to protect workloads hosted on Google Cloud. The security team wants to restrict access to services from specific IP ranges while ensuring that only authorized traffic can pass through to the resources. Which of the following configurations would best address this requirement?
- A
Configure a VPC firewall rule to allow ingress traffic only from the specific IP ranges.
- B
Set up a Google Cloud Armor policy to block traffic from unauthorized IP ranges.
- C
Enable Private Google Access to restrict access to Google services from the public internet.
- D
Use Cloud NAT to control inbound traffic and restrict access to internal services.
- E
Implement Identity-Aware Proxy (IAP) to enforce identity-based access to your applications.
Show answer and explanation
Correct answers: A, B
Explanation
To design perimeter security in Google Cloud, VPC firewall rules and Google Cloud Armor are critical tools. VPC firewall rules allow you to restrict ingress traffic based on IP ranges, while Google Cloud Armor policies enhance security by enabling you to block unauthorized traffic and mitigate attacks. Other options, like Private Google Access, Cloud NAT, and IAP, serve different purposes and do not directly address the specific need for IP-based perimeter security.
- A. Correct.
VPC firewall rules are a core component of perimeter security in Google Cloud. By allowing ingress traffic only from specific IP ranges, you can restrict access to your workloads to authorized sources.
- B. Correct.
Google Cloud Armor is designed to protect against unauthorized access and mitigate DDoS attacks. By creating a Cloud Armor policy, you can block traffic originating from IP ranges that are not authorized.
- C. Incorrect.
Private Google Access is used to allow VM instances to access Google APIs and services without using public IP addresses. While it enhances security, it does not restrict access based on IP ranges.
- D. Incorrect.
Cloud NAT is used for managing outbound traffic from instances without external IPs, not for controlling inbound traffic or restricting access to internal services.
- E. Incorrect.
Identity-Aware Proxy (IAP) is used to enforce identity-based access control for web applications, but it does not restrict IP-based access at the network perimeter.