Google Professional Cloud Security Engineer Question 214
Select 3Google Cloud PlatformYou are tasked with protecting a public-facing web application hosted on Google Cloud from common web-based attacks, such as SQL injection and cross-site scripting (XSS). Which steps should you take to configure Google Cloud Armor to secure the application?
- A
Create a security policy in Google Cloud Armor and attach it to the backend service of your application.
- B
Enable Google Cloud Armor's preconfigured WAF rules to mitigate common web application vulnerabilities.
- C
Configure a custom IP denylist in Google Cloud Armor to block all traffic from outside your region.
- D
Set up a Google Cloud Armor rate-based rule to mitigate DDoS attacks by limiting requests from individual IP addresses.
- E
Install a third-party web application firewall on the Compute Engine instances hosting your application.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure a web application using Google Cloud Armor, you must create and attach a security policy to the backend service to enforce the desired security rules. Utilizing preconfigured WAF rules helps mitigate common vulnerabilities such as SQL injection and XSS. Additionally, setting up rate-based rules can protect against DDoS attacks by restricting excessive requests from individual IPs. These steps ensure robust protection while leveraging Google Cloud services effectively. Using a third-party WAF or overly restrictive denylist configurations is unnecessary or counterproductive when Google Cloud Armor is properly configured.
- A. Correct.
Correct. Creating a security policy in Google Cloud Armor and attaching it to the backend service is necessary to apply WAF rules and other security settings to your application.
- B. Correct.
Correct. Google Cloud Armor provides preconfigured WAF rules, such as OWASP ModSecurity Core Rule Set, to protect against common vulnerabilities like SQL injection and XSS.
- C. Incorrect.
Incorrect. While an IP denylist can be useful in certain scenarios, blocking all traffic from outside your region is not a recommended approach for securing a web application and could lead to service denial for valid users.
- D. Correct.
Correct. Setting up a rate-based rule in Google Cloud Armor is an effective way to mitigate DDoS attacks by limiting the number of requests from a single IP address.
- E. Incorrect.
Incorrect. Installing a third-party WAF on Compute Engine instances is not necessary when using Google Cloud Armor, as it provides built-in web application protection.