Google Professional Cloud Security Engineer Question 211
Select 2Google Cloud PlatformYour organization has deployed a web application on Google Cloud and wants to protect it against SQL injection and cross-site scripting (XSS) attacks. As a Professional Cloud Security Engineer, you need to configure a solution that provides this protection at the edge of Google’s network. Which actions should you take to implement this protection using Google Cloud Armor?
- A
Create a Google Cloud Armor security policy and apply a preconfigured WAF rule set to detect and block SQL injection and XSS attacks.
- B
Enable the Web Security Scanner in Google Cloud Armor to scan for vulnerabilities in the web application.
- C
Attach the Google Cloud Armor security policy to the backend service of the application.
- D
Configure a custom security policy in Google Cloud Armor using IP-based allowlists to block traffic from suspicious IP ranges.
- E
Use the Google Cloud Armor Adaptive Protection feature to detect and mitigate layer 7 DDoS attacks.
Show answer and explanation
Correct answers: A, C
Explanation
To protect a web application against SQL injection and XSS attacks using Google Cloud Armor, you need to create a security policy and apply preconfigured WAF rule sets designed to detect and block these types of attacks. This policy must be attached to the application's backend service to enforce the protection. Other features like IP-based allowlists and Adaptive Protection serve different purposes and are not directly relevant to SQL injection or XSS mitigation.
- A. Correct.
Correct: Google Cloud Armor provides preconfigured WAF rule sets that can detect and block common web application vulnerabilities, including SQL injection and XSS. You need to create and apply these rule sets to the security policy.
- B. Incorrect.
Incorrect: Web Security Scanner is a separate tool in Google Cloud that helps identify vulnerabilities in web applications, but it is not part of Google Cloud Armor and does not provide runtime protection against attacks.
- C. Correct.
Correct: Once you create a Google Cloud Armor security policy, you must attach it to a backend service to enforce the rules and protect your application.
- D. Incorrect.
Incorrect: IP-based allowlists can block traffic from specific ranges but do not provide protection against SQL injection or XSS attacks. Custom policies are not required for this use case when preconfigured WAF rule sets are available.
- E. Incorrect.
Incorrect: Adaptive Protection in Google Cloud Armor is useful for detecting and mitigating layer 7 DDoS attacks, but it does not specifically target SQL injection or XSS attacks.