Google Professional Cloud Security Engineer Question 196
Select 2Google Cloud PlatformYour organization hosts a web application on Google Cloud that needs to be accessible to users worldwide. The application must only allow access to authenticated users, and you must ensure that unauthorized traffic is blocked at the network perimeter. Additionally, encrypted communication is mandatory. Which combination of Google Cloud services should you configure to meet these requirements?
- A
Cloud Load Balancer with an HTTPS frontend and SSL certificate from Certificate Authority Service
- B
Cloud Next Generation Firewall (Cloud NGFW) rules to allow only traffic from specific IP ranges
- C
Identity-Aware Proxy (IAP) to enforce authentication for application access
- D
Cloud Storage bucket configured with public permissions to serve the application
- E
Cloud VPN to encrypt all traffic between users and the application
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirements, you need to combine services that provide encrypted communication and enforce authentication. A Cloud Load Balancer with an HTTPS frontend ensures secure communication using SSL/TLS, while Identity-Aware Proxy (IAP) enforces user authentication before allowing access to the application. Other options either don't meet the authentication requirement or are irrelevant to the scenario.
- A. Correct.
This is correct. A Cloud Load Balancer with an HTTPS frontend ensures encrypted communication using SSL/TLS certificates, which can be managed via Certificate Authority Service.
- B. Incorrect.
This is incorrect. While Cloud NGFW rules are useful for managing network security, they don't enforce user authentication, which is a key requirement in this scenario.
- C. Correct.
This is correct. Identity-Aware Proxy (IAP) enforces authentication and ensures that only authorized users can access the application.
- D. Incorrect.
This is incorrect. Configuring a Cloud Storage bucket with public permissions would expose the application to unauthorized users, violating the security requirements.
- E. Incorrect.
This is incorrect. Cloud VPN is used to create secure connections between networks, but it does not authenticate users or block unauthorized traffic at the network perimeter.