Examkin

Question

Difficulty: EasyNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An organization hosts a public web application behind an External HTTP(S) Load Balancer on Google Cloud and needs to enhance its security posture. The architecture requirements mandate defending the application against Layer 7 web attacks (such as SQL injection) and ensuring that sensitive backend data cannot be exfiltrated to external Google Cloud projects, even by authenticated users. Which TWO Google Cloud security controls should you implement? (Select TWO)

  1. Attach Cloud Armor security policies to the External HTTP(S) Load Balancer backend service.Answer
  2. Configure a VPC Service Controls service perimeter around the projects hosting the backend storage resources.Answer
  3. C
    Establish VPC Network Peering between your VPC and an external partner VPC to enable transitive packet inspection.
  4. D
    Assign the IAM primitive Owner role to backend service accounts to override perimeter firewall restrictions.

Answer

Attaching Cloud Armor security policies to the External HTTP(S) Load Balancer backend service and configuring a VPC Service Controls service perimeter around backend projects.
Cloud Armor security policies protect web applications against Layer 7 attacks such as SQL injection by filtering HTTP(S) traffic at the edge load balancer. Additionally, VPC Service Controls restricts communication between GCP services across perimeter boundaries, preventing data exfiltration to unauthorized projects.

Step-by-Step Solution

1
Identify the protection mechanism required for Layer 7 web application attacks at the ingress edge.
Google Cloud Armor security policies attach directly to backend services of External HTTP(S) Load Balancers to filter traffic and block threats like SQL injection.
Cloud Armor inspects incoming web traffic at the network edge before it reaches application instances.
2
Identify the perimeter security mechanism required to prevent data exfiltration across project boundaries.
VPC Service Controls defines a perimeter isolating Google Cloud APIs and storage services, blocking data transfers to unauthorized projects outside the perimeter.
IAM permissions alone cannot prevent an authorized user from copying data to an external bucket; VPC Service Controls enforces network-level boundary restrictions.

Key Concept

Combining Cloud Armor for edge WAF protection with VPC Service Controls for data exfiltration prevention.
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic