Google Professional Cloud Security Engineer Question 213
Select 3Google Cloud PlatformYou are tasked with protecting a web application hosted on Google Cloud from malicious traffic and attacks such as SQL injection and cross-site scripting (XSS). You decide to use Google Cloud Armor to configure a Web Application Firewall (WAF). Which of the following actions should you take to achieve this goal?
- A
Enable preconfigured WAF rules in Google Cloud Armor based on OWASP security best practices.
- B
Set up a Cloud Armor policy to block all incoming traffic and manually whitelist allowed IP addresses.
- C
Configure custom rules in Google Cloud Armor to detect and block specific attack patterns.
- D
Enable Cloud Armor adaptive protection to defend against Layer 7 DDoS attacks.
- E
Deploy a private IP address for the web application to hide it from public access.
Show answer and explanation
Correct answers: A, C, D
Explanation
To protect a web application from SQL injection, XSS, and other attacks, you should leverage Google Cloud Armor's WAF features. Enabling preconfigured WAF rules provides immediate protection based on industry best practices. Custom rules allow for additional flexibility to address specific threats. Enabling adaptive protection defends against DDoS attacks, ensuring the availability and performance of your application. Blocking all traffic or using a private IP address are impractical or irrelevant for securing a publicly accessible web application.
- A. Correct.
Enabling preconfigured WAF rules in Google Cloud Armor is a best practice to protect web applications against common vulnerabilities such as SQL injection and XSS. These rules are based on OWASP guidelines and provide baseline security.
- B. Incorrect.
Blocking all incoming traffic and manually whitelisting IP addresses is overly restrictive and not practical for most web applications. This approach will likely disrupt legitimate user access.
- C. Correct.
Custom rules allow you to tailor protection to your specific needs, such as blocking unique attack patterns or behaviors not covered by preconfigured rules. This enhances the security of your application.
- D. Correct.
Cloud Armor's adaptive protection is specifically designed to defend against Layer 7 DDoS attacks, which can overwhelm your web applications. While this feature is not directly related to SQL injection or XSS, it is essential for overall web application security.
- E. Incorrect.
Deploying a private IP address is not a relevant solution for protecting a public-facing web application. Google Cloud Armor operates at the edge to protect publicly accessible endpoints.