Examkin

Soru

Zorluk: OrtaNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An automotive telemetry company ingests real-time vehicle diagnostics through an application running on Google Cloud and stores aggregated analytics inside BigQuery. The architecture team must enforce strict perimeter security to satisfy two mandatory requirements:
1. Incoming HTTP(S) traffic from public vehicles must be inspected and filtered at the network edge against Layer 7 web application attacks and SQL injection attempts.
2. Internal service accounts and authorized developers must be restricted from copying or exfiltrating sensitive BigQuery datasets to unauthorized external Cloud Storage buckets, even if they hold valid IAM read permissions.

Which TWO security controls should you implement to meet these requirements?

  1. Configure a Google Cloud Armor security policy containing preconfigured WAF rules and attach it to the backend service of the Global External HTTP(S) Load Balancer.Cevap
  2. Create a VPC Service Controls service perimeter surrounding the project hosting BigQuery and configure restricted Google API access to block unauthorized data exfiltration.Cevap
  3. C
    Rely exclusively on fine-grained IAM roles and Cloud Audit Logs on BigQuery datasets to restrict and monitor unauthorized dataset export commands.
  4. D
    Establish VPC Network Peering between your internal VPC and external partner networks to filter and transitively route data egress traffic through a centralized firewall.

Cevap

Implement a Google Cloud Armor security policy attached to the Global External HTTP(S) Load Balancer backend service, and define a VPC Service Controls perimeter enclosing the BigQuery project.
Combining Google Cloud Armor at the HTTP(S) load balancer edge with a VPC Service Controls perimeter around sensitive BigQuery workloads provides defense-in-depth: Cloud Armor mitigates web application attacks and SQL injections from incoming public traffic, while VPC Service Controls establishes a isolation boundary that blocks unauthorized data transfers to external Cloud Storage buckets, even by identities with valid IAM roles.

Adım Adım Çözüm

1
Address Layer 7 edge protection requirements for public HTTP(S) ingress.
Attach Cloud Armor security policies with WAF rule sets to the Global External Load Balancer backends to block SQL injection and OWASP Top 10 threats at the network edge.
Cloud Armor inspects incoming web traffic before it reaches the backend compute workload.
2
Address data exfiltration prevention requirements for internal BigQuery data access.
Enclose the project containing BigQuery within a VPC Service Controls service perimeter.
VPC Service Controls restricts communication with Google APIs to trusted network boundaries, preventing authorized identities from copying data to resources outside the perimeter.

Anahtar Kavram

Perimeter defense combining Cloud Armor for Layer 7 edge security and VPC Service Controls for data exfiltration prevention
Bu soruyu puanla

Konular

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

Bu konudan daha fazla soru