A media streaming enterprise hosts public microservices on Google Cloud behind an External HTTP(S) Load Balancer, while storing sensitive user telemetry in BigQuery and Cloud Storage. The security team requires mitigating Layer 7 application attacks and SQL injection attempts at the edge, while also preventing authorized internal data analysts from exfiltrating sensitive telemetry data to external GCP resources. Which TWO architectural controls should the Cloud Architect implement to satisfy these security requirements? (Select TWO.)
- Configure Cloud Armor security policies with preconfigured WAF rules and rate limiting on the External HTTP(S) Load Balancer backend service.Cevap
- Establish a VPC Service Controls perimeter encompassing the GCP projects hosting BigQuery and Cloud Storage telemetry datasets.Cevap
- CSet up VPC Network Peering between internal VPCs and external partner VPCs to enforce transitive network firewall rules across all intermediate networks.
- DGrant IAM Editor primitive roles to analyst service accounts while relying exclusively on IAM policy bindings to prevent external bucket data copies.
Cevap
Configure Cloud Armor security policies on the External HTTP(S) Load Balancer backend service to block Layer 7 attacks, and establish a VPC Service Controls perimeter around BigQuery and Cloud Storage projects to prevent data exfiltration.
To defend against Layer 7 application threats and rate-limit ingress traffic, Cloud Armor security policies must be attached to the External HTTP(S) Load Balancer. To prevent data exfiltration by authorized identities accessing sensitive managed services (BigQuery and Cloud Storage), VPC Service Controls must be deployed around the hosting projects to restrict data movement across perimeter boundaries.
Adım Adım Çözüm
Anahtar Kavram
Perimeter defense combining Cloud Armor for Layer 7 web security and VPC Service Controls for exfiltration prevention