Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise financial organization hosts a public-facing Web API on Google Cloud backed by internal Compute Engine instances storing sensitive customer records. The security engineering team mandates that the architecture must mitigate Layer 7 application attacks (such as SQL injection and rate flooding) at the network edge, while simultaneously establishing a strict perimeter boundary around the internal Google Cloud project resources to prevent data exfiltration to unauthorized storage destinations. Which TWO security controls should the cloud architect implement to fulfill these requirements?

  1. Configure Google Cloud Armor security policies with preconfigured WAF rules and attach them to the External HTTP(S) Load Balancer target backend services.Answer
  2. Establish a VPC Service Controls perimeter around the project holding internal resources, configuring explicit ingress and egress rules for allowed service communication.Answer
  3. C
    Grant primitive IAM Owner roles to application service accounts so that internal resources automatically bypass external network security checks.
  4. D
    Establish VPC Network Peering between the application VPC and an external partner VPC, relying on transitive peering to route all untrusted inbound traffic through the partner's security stack.

Answer

To protect public endpoints against Layer 7 attacks and enforce data exfiltration boundaries around internal project resources, the architecture must combine Google Cloud Armor security policies on the External HTTP(S) Load Balancer with a VPC Service Controls perimeter around the internal GCP services.
Google Cloud Armor provides edge security against application-layer attacks by applying WAF rules and rate-limiting policies directly at the load balancer level. Meanwhile, VPC Service Controls creates a cryptographically enforced perimeter around Google Cloud projects and services, isolating internal data resources to prevent exfiltration across service boundaries.

Step-by-Step Solution

1
Identify edge security controls required for Layer 7 web threat mitigation.
Select Google Cloud Armor security policies attached to the External HTTP(S) Load Balancer.
Cloud Armor provides Web Application Firewall (WAF) capabilities, rate limiting, and DDoS protection at the Google network edge.
2
Identify perimeter controls required to prevent data exfiltration from internal GCP resources.
Select VPC Service Controls around the target project containing internal compute and storage resources.
VPC Service Controls isolates GCP resources inside a defined perimeter, blocking network-level exfiltration to unauthorized external buckets or services.

Key Concept

Defense-in-depth perimeter security integrating Google Cloud Armor for edge WAF/DDoS defense and VPC Service Controls for data exfiltration isolation.
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic