Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise cloud architect is designing a multi-layered security model for a multi-tenant SaaS application hosted on Google Cloud. Match each network security and perimeter requirement on the left with the most appropriate Google Cloud security mechanism on the right.

  • Protect web applications behind an HTTP(S) Load Balancer against Layer 7 attacks such as SQL injection (SQLi) and Cross-Site Scripting (XSS).Cloud Armor WAF Security Policies
  • Prevent authorized internal users from exfiltrating sensitive BigQuery data to unauthorized external Google Cloud storage locations or projects.VPC Service Controls Service Perimeters
  • Enforce organization-wide firewall rules across multiple VPC networks using dynamic resource metadata rather than IP subnet ranges.Hierarchical Firewall Policies with Secure Tags
  • Provide secure, private cross-tenant API access between VPCs without establishing full network layer IP routability or transitive peering.Private Service Connect (PSC)

Answer

Layer 7 web attack mitigation matches Cloud Armor WAF Security Policies; BigQuery data exfiltration prevention matches VPC Service Controls Service Perimeters; Organization-wide policy enforcement via dynamic metadata matches Hierarchical Firewall Policies with Secure Tags; Private cross-VPC API access without transitive peering matches Private Service Connect (PSC).
Each security requirement aligns directly with standard Google Cloud perimeter defense products: Cloud Armor handles edge Layer 7 protection, VPC Service Controls restrict managed API data movement, Hierarchical Firewalls with Secure Tags manage organization-wide network policy based on tags, and Private Service Connect facilitates isolated cross-VPC service access.

Step-by-Step Solution

1
Analyze requirement 1 (Layer 7 web protection against SQLi/XSS at load balancer)
Identify Cloud Armor as the perimeter WAF tool designed specifically for Google Cloud external HTTP(S) Load Balancing.
Cloud Armor evaluates inbound traffic at the edge before reaching backend compute resources.
2
Analyze requirement 2 (Preventing data exfiltration from Google APIs like BigQuery)
Identify VPC Service Controls as the mechanism to build perimeters around GCP managed services.
IAM rules control who can access resources, but VPC Service Controls define where data can be accessed from and transferred to.
3
Analyze requirement 3 (Enforcing organization-level firewalls using metadata instead of IPs)
Identify Hierarchical Firewall Policies combined with Secure Tags.
Hierarchical rules apply top-down from organization/folder levels, while Secure Tags provide access control evaluation based on identity/metadata tags rather than IP addresses.
4
Analyze requirement 4 (Private microservice consumption across VPC boundaries without peering)
Identify Private Service Connect (PSC).
PSC uses producer-consumer endpoint mapping to allow private connection across administrative boundaries without establishing full VPC network peering.

Key Concept

Google Cloud Perimeter Security and Network Controls (Cloud Armor, VPC Service Controls, Hierarchical Firewalls, Private Service Connect)
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic