A security architect is configuring perimeter controls for an enterprise application on Google Cloud. The application backend stores sensitive analytical data that must be guarded against unauthorized data exfiltration, while the public endpoint requires protection against Layer 7 distributed denial-of-service (DDoS) attacks. Which TWO security controls should you implement to satisfy these requirements?
- Attach a Google Cloud Armor security policy to the External HTTP(S) Load Balancer backend service.Answer
- Configure a VPC Service Controls perimeter around the project resources containing sensitive data.Answer
- CGrant primitive Editor roles to service accounts to dynamically manage network perimeter rules across projects.
- DEstablish transitive VPC Network Peering across all VPC networks to automatically route and inspect perimeter traffic through a central hub.
Answer
To protect against Layer 7 DDoS attacks and prevent data exfiltration, you should attach Google Cloud Armor security policies to the External HTTP(S) Load Balancer backend service and establish a VPC Service Controls perimeter around sensitive GCP resources.
Google Cloud Armor provides edge security filtering and DDoS mitigation for HTTP(S) load-balanced endpoints. VPC Service Controls establishes security perimeters around GCP APIs to block unauthorized external data movement and exfiltration.
Step-by-Step Solution
Key Concept
Perimeter defense combining Google Cloud Armor edge filtering and VPC Service Controls boundaries.