Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise cloud architect is establishing a defense-in-depth perimeter security baseline for a financial enterprise migrating to Google Cloud. Match each security requirement to its corresponding GCP perimeter control mechanism.

  • Mitigate Layer 7 web application attacks (such as SQL injection and Cross-Site Scripting) and apply rate limiting at the external HTTP(S) Load Balancer edge.Cloud Armor security policies with preconfigured WAF rulesets attached to backend services.
  • Prevent authorized internal identities from copying sensitive BigQuery datasets to unauthorized external Google Cloud storage locations.VPC Service Controls service perimeter enclosing Google Cloud API endpoints and using restricted VIP routing.
  • Enforce mandatory, non-overrideable network access rules globally across all projects in the organization hierarchy using fine-grained resource tagging.Hierarchical Firewall Policies combined with secure tags evaluated at the organization or folder level.
  • Provide secure, private endpoint connectivity to Google APIs and third-party SaaS services from an isolated VPC without exposing public IPs or requiring transitive VPC peering.Private Service Connect (PSC) consumer endpoints allocating internal IP addresses within the local VPC.

Answer

The correct alignment pairs each specific security requirement with its dedicated Google Cloud perimeter mechanism: Layer 7 WAF edge defense maps to Cloud Armor; API-level data exfiltration prevention maps to VPC Service Controls; mandatory organization-wide rule enforcement with secure tags maps to Hierarchical Firewall Policies; and private service consumption without transitive peering maps to Private Service Connect.
Each requirement targets a distinct security layer in Google Cloud: Cloud Armor inspects HTTP(S) traffic at Layer 7 for WAF and rate limiting; VPC Service Controls prevents exfiltration across Google API boundaries by controlling network context; Hierarchical Firewall Policies enforce global security baselines with secure tags across project hierarchies; and Private Service Connect establishes private, local VPC endpoints for services without public internet or transitive peering.

Step-by-Step Solution

1
Analyze the request for Layer 7 web attack mitigation and rate limiting at the load balancer.
Identify Cloud Armor as the native GCP WAF solution integrated with Google Cloud External HTTP(S) Load Balancing.
Cloud Armor inspects incoming HTTP(S) requests against OWASP preconfigured rules before traffic reaches compute backends.
2
Analyze the requirement to block data exfiltration from managed services like BigQuery.
Identify VPC Service Controls as the security perimeter mechanism governing Google API boundaries.
IAM controls WHO can access data, but VPC Service Controls restricts WHERE data can be read from or written to, neutralizing exfiltration risks.
3
Analyze the need for organization-wide mandatory firewall rules using tag-based control.
Identify Hierarchical Firewall Policies paired with secure tags.
Hierarchical policies are enforced at the organization or folder level and cannot be overridden by project-level firewall rules.
4
Analyze the requirement for private connectivity to managed services without public IPs or transitive VPC peering.
Identify Private Service Connect (PSC).
PSC project endpoints instantiate private IP addresses inside the consumer VPC to access published services or Google APIs.

Key Concept

Multi-layered GCP network perimeter defense integrating WAF, API Service Perimeters, Hierarchical Firewalls, and Private Endpoint Routing.
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic