Google Professional Cloud Security Engineer Question 210
Select 3Google Cloud PlatformYou are tasked with securing a web application hosted on Google Cloud. Your organization wants to protect the application from common web-based attacks, such as SQL injection and cross-site scripting (XSS), while also allowing only traffic from specific geographic regions. Which steps should you take to meet these requirements?
- A
Enable Google Cloud Armor and apply a preconfigured WAF ruleset to filter common web application vulnerabilities.
- B
Create a custom security policy in Google Cloud Armor and define rules to allow or block traffic based on geographic location.
- C
Enable the default VPC firewall rules to inspect and protect against web application vulnerabilities.
- D
Enable logging in Google Cloud Armor to monitor and analyze blocked and allowed traffic patterns.
- E
Use Identity-Aware Proxy (IAP) to restrict access to authenticated users only, instead of using Google Cloud Armor.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure a web application hosted on Google Cloud, enabling Google Cloud Armor with preconfigured WAF rulesets provides protection against web application vulnerabilities like SQL injection and XSS. Creating custom security policies in Google Cloud Armor enables fine-grained control, such as geographic traffic restrictions. Logging helps monitor traffic patterns, allowing for continuous improvement of security policies. VPC firewall rules and IAP serve other purposes but do not address the requirements in this scenario.
- A. Correct.
Correct. Enabling Google Cloud Armor and applying preconfigured WAF rulesets helps protect against common web application vulnerabilities like SQL injection and XSS.
- B. Correct.
Correct. Custom security policies in Google Cloud Armor allow you to define rules for allowing or blocking traffic based on geographic location, meeting the requirement to restrict traffic by region.
- C. Incorrect.
Incorrect. VPC firewall rules are used for network-level traffic filtering and do not provide web application-level protection against vulnerabilities like SQL injection or XSS.
- D. Correct.
Correct. Enabling logging in Google Cloud Armor provides insights into traffic patterns, which is valuable for monitoring and refining security policies.
- E. Incorrect.
Incorrect. While Identity-Aware Proxy (IAP) is useful for authentication-based access control, it does not replace the functionality of Google Cloud Armor for protecting against web application attacks or managing geographic-based restrictions.