Google Professional Cloud Security Engineer Question 212
Select 4Google Cloud PlatformYou are tasked with securing a public-facing web application hosted on Google Cloud. The application has been experiencing a high volume of malicious traffic, including SQL injection attempts and distributed denial-of-service (DDoS) attacks. You want to protect the application using Google Cloud Armor. Which steps are necessary to configure Google Cloud Armor to mitigate these threats?
- A
Create a security policy in Google Cloud Armor and attach it to the backend service of the web application.
- B
Set up a preconfigured WAF rule in Google Cloud Armor to block SQL injection attempts.
- C
Configure rate-based rules in Google Cloud Armor to limit the number of requests from a single IP address.
- D
Enable Google Cloud Armor adaptive protection to automatically detect and mitigate DDoS attacks.
- E
Add a firewall rule in the VPC network to block all incoming traffic except for trusted IPs.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
Google Cloud Armor is specifically designed to protect web applications from threats such as SQL injection and DDoS attacks. To secure the application, you need to create and attach a security policy, enable preconfigured WAF rules, configure rate-based rules, and leverage adaptive protection. While VPC firewall rules are part of the overall security strategy, they address network-layer security rather than application-layer threats, which is the focus of Google Cloud Armor.
- A. Correct.
Correct. A security policy in Google Cloud Armor is required to define and enforce rules for incoming traffic. It must be attached to the backend service of the web application to take effect.
- B. Correct.
Correct. Google Cloud Armor provides preconfigured WAF rules that can block common threats like SQL injection. Enabling these rules helps protect against malicious requests.
- C. Correct.
Correct. Rate-based rules in Google Cloud Armor allow you to limit the number of requests from a single client IP, which is effective for mitigating DDoS attacks.
- D. Correct.
Correct. Google Cloud Armor’s adaptive protection can detect and mitigate DDoS attacks automatically by analyzing traffic patterns in real-time.
- E. Incorrect.
Incorrect. While VPC firewall rules are useful for managing network-level access, they are not part of Google Cloud Armor’s functionality and are not sufficient to handle application-layer threats like SQL injection or DDoS attacks.