Examkin

Question

Difficulty: EasyNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

Match each Google Cloud perimeter security mechanism to the specific security threat or operational requirement it primarily addresses.

  • VPC Service ControlsPreventing data exfiltration by creating security perimeters around Google Cloud managed services and APIs.
  • Cloud ArmorMitigating Layer 7 web application attacks (e.g., SQLi, XSS) and applying IP rate-limiting at the edge load balancer.
  • Hierarchical Firewall PoliciesEnforcing consistent baseline network firewall rules across all projects within an entire organization or folder hierarchy.
  • Private Service ConnectConnecting to services across different VPC networks privately using endpoint IP addresses without VPC peering.

Answer

VPC Service Controls matches with preventing data exfiltration around Google Cloud APIs; Cloud Armor matches with Layer 7 protection and rate-limiting at the edge; Hierarchical Firewall Policies matches with enforcing baseline rules across the organization hierarchy; and Private Service Connect matches with private cross-VPC service access without VPC Peering.
Each feature aligns directly with its primary architecture purpose: VPC Service Controls safeguards API data boundaries against exfiltration; Cloud Armor provides WAF and edge filter capabilities; Hierarchical Firewall Policies enforce network security rules across the enterprise resource hierarchy; and Private Service Connect offers secure private access to services in separate VPCs.

Step-by-Step Solution

1
Identify the primary perimeter controls for Google Cloud APIs and data protection.
Recognize that VPC Service Controls creates perimeter boundaries to mitigate data exfiltration risks.
VPC Service Controls specifically secures Google Cloud API communications, preventing unauthorized copies or access from outside defined perimeters.
2
Identify the primary edge web application security service.
Match Cloud Armor to Layer 7 protection and edge rate limiting.
Cloud Armor protects web applications attached to Google Cloud load balancers against common web attacks and DDoS.
3
Identify organization-wide network governance tools.
Match Hierarchical Firewall Policies to organization-level rule enforcement.
Hierarchical policies are inherited at the Organization and Folder levels to enforce security guardrails top-down.
4
Identify modern cross-VPC private connectivity options.
Match Private Service Connect to private service consumption without VPC Peering.
Private Service Connect uses endpoints in the consumer VPC to reach producer services privately without needing complex VPC Peering topologies.

Key Concept

GCP Network Security and Perimeter Controls
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic