Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A renewable energy utility enterprise is building a smart-grid telemetry platform on Google Cloud. The infrastructure requires a multi-layered perimeter security model to meet strict compliance guidelines. Match each perimeter security requirement on the left with the corresponding Google Cloud security control mechanism on the right that fulfills it.

  • Protect public HTTPS web application endpoints against SQL injection (SQLi), cross-site scripting (XSS), and volumetric Layer 7 denial-of-service attacks.Google Cloud Armor security policies configured with preconfigured WAF rulesets and adaptive rate limiting.
  • Prevent unauthorized data exfiltration from BigQuery and Cloud Storage buckets to external Google Cloud locations, even if IAM service account keys are compromised.VPC Service Controls service perimeter restricting API access context and data egress.
  • Apply organization-wide SSH access rules to VM instances dynamically based on fine-grained resource metadata rather than IP subnet ranges.Hierarchical firewall policies using secure tags attached to target virtual machine instances.
  • Enable workloads in isolated private VPC subnets without external IP addresses to consume Google APIs securely over internal IP endpoints.Private Service Connect (PSC) endpoints for Google APIs.

Answer

1 matches Google Cloud Armor security policies; 2 matches VPC Service Controls service perimeter; 3 matches Hierarchical firewall policies using secure tags; 4 matches Private Service Connect (PSC) endpoints.
Each requirement maps to its specific GCP architectural component: Google Cloud Armor inspects edge HTTP(S) traffic for WAF threats; VPC Service Controls prevents perimeter exfiltration of Google API data; Hierarchical firewall policies with secure tags apply centralized policy based on instance metadata; and Private Service Connect endpoints enable internal IP connectivity to Google APIs.

Step-by-Step Solution

1
Identify protection mechanism for Layer 7 web attacks and DDoS
Google Cloud Armor is Google's edge Web Application Firewall (WAF) and anti-DDoS service.
It handles public HTTPS endpoint protection against XSS, SQLi, and rate limiting.
2
Identify perimeter control for exfiltration prevention across Google Cloud services
VPC Service Controls establishes perimeter boundaries around Google APIs and storage resources.
VPC SC prevents data exfiltration by enforcing authorization at the API perimeter level beyond identity-based IAM controls.
3
Determine organization-level management of instance firewalls via metadata
Hierarchical firewall policies combined with secure tags.
Hierarchical policies enforce top-down rules across the resource hierarchy while secure tags allow rules to target specific instances dynamically.
4
Identify private Google API routing mechanism for internal networks
Private Service Connect (PSC) endpoints for Google APIs.
PSC endpoints map Google APIs to internal IP addresses inside the user's VPC network without requiring public IPs or public internet routing.

Key Concept

Perimeter Security and Access Control Mechanisms in GCP
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic