Google Professional Cloud Security Engineer Question 191
Select 3Google Cloud PlatformYour organization is deploying a web application on Google Cloud and needs to ensure that the application is protected from unauthorized access and DDoS attacks. You are tasked with designing a perimeter security strategy. Which of the following configurations should you implement to ensure the security of the application?
- A
Configure Cloud Armor to create policies that block traffic from known malicious IP addresses.
- B
Set up a network firewall rule to allow all traffic to the application for flexibility.
- C
Use Identity-Aware Proxy (IAP) to control user access to the application.
- D
Implement HTTPS load balancing with SSL certificates to encrypt traffic.
- E
Disable logging on the load balancer to reduce storage costs.
Show answer and explanation
Correct answers: A, C, D
Explanation
To design effective perimeter security, you must ensure that the application is protected from threats such as unauthorized access and DDoS attacks. Cloud Armor is key for mitigating DDoS and blocking malicious traffic, while Identity-Aware Proxy enforces user authentication. HTTPS load balancing encrypts traffic, ensuring secure communication. Allowing all traffic or disabling logging would compromise the security and monitoring capabilities of the application.
- A. Correct.
Correct: Cloud Armor provides protection against DDoS attacks and allows you to define rules that block traffic from malicious IPs, which is essential for perimeter security.
- B. Incorrect.
Incorrect: Allowing all traffic to the application is a poor security practice and directly contradicts the principles of perimeter security.
- C. Correct.
Correct: Identity-Aware Proxy (IAP) adds an additional layer of security by requiring user authentication before accessing the application, enhancing access control.
- D. Correct.
Correct: HTTPS load balancing ensures traffic is encrypted in transit, protecting sensitive data and securing the communication channel.
- E. Incorrect.
Incorrect: Disabling logging on the load balancer prevents you from monitoring and diagnosing issues, which is critical for security and compliance.