Examkin

Soru

Zorluk: Çok zorNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise financial institution processes sensitive transactional data on Google Cloud using BigQuery and Google Kubernetes Engine (GKE). The security architecture requires that external web traffic be protected against application-layer DDoS attacks and SQL injection, while internal analyst workloads must be strictly prevented from exfiltrating data to external Google Cloud Storage buckets or unauthorized GCP organizations, even if an analyst possesses legitimate IAM read permissions. Additionally, on-premises systems access GCP resources via Dedicated Interconnect. Which TWO architectural security controls must you implement to satisfy these compliance and perimeter security requirements? (Select TWO.)

  1. Configure Cloud Armor security policies with WAF rules and rate limiting, attaching them to the Backend Services of the Global External HTTP(S) Load Balancers.Cevap
  2. B
    Establish VPC Network Peering between all spoke VPCs and a central hub VPC to enable transitive routing of on-premises traffic to all backend services without dedicated Interconnect attachments per VPC.
  3. Establish a VPC Service Controls service perimeter enclosing the BigQuery and Storage resources, defining access levels and explicit ingress/egress policies for authorized access.Cevap
  4. D
    Grant IAM Storage Object Viewer and BigQuery Data Viewer roles to analysts while relying on Identity-Aware Proxy (IAP) context-aware access to prevent data copy operations to external buckets.

Cevap

To meet both perimeter security and data exfiltration prevention requirements, you must deploy Cloud Armor security policies attached to HTTP(S) load balancer backend services for Layer 7 protection, and configure a VPC Service Controls perimeter around sensitive APIs like BigQuery and Cloud Storage.
Cloud Armor security policies protect public-facing applications at the GCP edge against Layer 7 DDoS and exploit attempts, while VPC Service Controls isolate Google API services (BigQuery, Cloud Storage) within a logical perimeter to prevent authorized credentials from exfiltrating data out of the organization.

Adım Adım Çözüm

1
Identify the ingress edge security requirements against Layer 7 attacks and DDoS.
Determine that Cloud Armor security policies integrated with Global External HTTP(S) Load Balancing provide edge filtering, rate limiting, and WAF protection.
Cloud Armor is Google Cloud's dedicated defense mechanism against web application attacks and volumetric/L7 DDoS.
2
Identify the perimeter exfiltration defense requirements for sensitive data APIs.
Determine that VPC Service Controls must be configured to wrap Google Cloud Storage and BigQuery APIs inside a service perimeter.
IAM permissions authenticate users but cannot prevent a compromised or malicious identity from copying data from authorized buckets to external, non-controlled GCP buckets.
3
Evaluate network transitivity and routing misconceptions.
Reject VPC Network Peering as a transitive connectivity hub for on-premises Interconnect traffic.
GCP VPC Peering strictly prohibits transitive routing between non-directly peered networks.

Anahtar Kavram

Perimeter Defense using Cloud Armor for Layer 7 Edge Protection and VPC Service Controls for Data Exfiltration Prevention
Bu soruyu puanla

Konular

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

Bu konudan daha fazla soru