Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise IoT telemetry platform ingests high-volume device metrics through an External Application Load Balancer into BigQuery and Cloud Storage. The security team mandates two specific security controls: first, protection against Layer 7 HTTP flood denial-of-service (DDoS) attacks at the network edge; second, prevention of unauthorized data movement to external storage locations by internal users who hold legitimate IAM access to the dataset. Which TWO security controls should you implement to satisfy these requirements? (Select TWO)

  1. Attach a Google Cloud Armor security policy with rate-limiting rules to the External Application Load Balancer backend service.Answer
  2. Configure a VPC Service Controls service perimeter around the BigQuery and Cloud Storage resources.Answer
  3. C
    Grant primitive IAM Viewer roles to administrators and enforce IAM Deny policies on storage object export APIs.
  4. D
    Establish VPC Network Peering to a centralized transit VPC and rely on transitive routing to inspect API traffic sent to external Google Cloud projects.

Answer

The architect must configure a Google Cloud Armor security policy with rate limiting attached to the Load Balancer backend service, and establish a VPC Service Controls service perimeter enclosing the BigQuery and Cloud Storage resources.
Attaching a Google Cloud Armor security policy with rate limiting to the load balancer backend service effectively mitigates Layer 7 HTTP flood attacks at the edge. Additionally, placing BigQuery and Cloud Storage inside a VPC Service Controls perimeter blocks unauthorized data movement to external GCP projects or buckets, mitigating exfiltration risks from credentialed users.

Step-by-Step Solution

1
Address Layer 7 edge DDoS attack mitigation
Google Cloud Armor security policies with rate-limiting rules are attached to backend services of External Application Load Balancers, filtering malicious traffic at Google's network edge.
Cloud Armor protects infrastructure from application-layer DDoS attacks and rate-limits excess traffic prior to backend processing.
2
Address data exfiltration prevention for internal IAM users
Define a VPC Service Controls perimeter around sensitive GCP services (BigQuery and Cloud Storage).
VPC Service Controls restricts communication with Google Cloud APIs across perimeter boundaries, preventing data exfiltration to unauthorized GCP locations even if users have valid IAM permissions.

Key Concept

Combining Google Cloud Armor for edge application security with VPC Service Controls for data exfiltration prevention.
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic