Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An online payment processing company processes financial transactions on Google Kubernetes Engine (GKE) clusters and stores audit records in BigQuery datasets. The architecture uses an External HTTP(S) Load Balancer to ingress public API traffic. Security requirements mandate that: 1) Web Application Firewall (WAF) rules must filter out Layer 7 SQL injection threats before traffic reaches backend services, and 2) Authorized internal workloads must be restricted from copying sensitive audit data to external, non-company Cloud Storage buckets. Which TWO security controls should you implement to satisfy these requirements?

  1. Attach a Cloud Armor security policy containing preconfigured SQL injection WAF rules to the Load Balancer backend service.Answer
  2. Configure a VPC Service Controls service perimeter around the projects hosting BigQuery and Cloud Storage.Answer
  3. C
    Rely exclusively on granular Identity and Access Management (IAM) permissions on the storage resources to prevent data exfiltration to external buckets.
  4. D
    Configure VPC Network Peering between internal VPC networks to transitively inspect and block outbound traffic through a central third-party firewall appliance.

Answer

To meet both requirements, you must attach a Cloud Armor security policy with preconfigured SQL injection WAF rules to the Load Balancer backend service, and configure a VPC Service Controls perimeter around the BigQuery and Cloud Storage projects.
Attaching a Cloud Armor security policy to the External HTTP(S) Load Balancer backend service provides edge-level inspection and mitigation against Layer 7 exploits like SQL injection. Simultaneously, enforcing a VPC Service Controls perimeter around projects containing BigQuery and Cloud Storage isolates Google Cloud managed API access, blocking authorized identities from exfiltrating sensitive dataset contents to unauthorized external storage destinations.

Step-by-Step Solution

1
Identify the mechanism required to block Layer 7 web attacks at the network edge.
Cloud Armor security policies with preconfigured WAF rules (such as SQLi protection) attach directly to the backend services of External HTTP(S) Load Balancers.
Cloud Armor inspects incoming HTTP/HTTPS traffic at the edge of Google's network before it hits application backends.
2
Identify the mechanism required to prevent data exfiltration from Google Cloud managed services.
VPC Service Controls define network perimeters around API endpoints for services like BigQuery and Cloud Storage.
VPC Service Controls restrict communication to and from managed services, preventing authorized credentials from writing data to resources located outside the perimeter.

Key Concept

Combining Cloud Armor for Layer 7 edge security and VPC Service Controls for perimeter data exfiltration prevention.
Estimated Time:1m 30s
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic