An enterprise security architect is designing a defense-in-depth network architecture across a multi-project Google Cloud deployment. Match each Google Cloud network security control on the left to its primary architectural use case on the right.
- VPC Service Controls PerimeterDefine security boundaries around Google Cloud managed services to prevent unauthorized data exfiltration and restricted API access.
- Cloud Armor Security PolicyMitigate Layer 7 web application vulnerabilities such as SQL Injection and rate-limit unwanted traffic at the external load balancer edge.
- Hierarchical Firewall Policy with Secure TagsEnforce top-down network traffic rules across all projects within an organization or folder using fine-grained resource tagging.
- Private Service Connect EndpointConsume producer services or Google APIs privately inside a consumer VPC without establishing transitive VPC peering connectivity.
Cevap
VPC Service Controls Perimeter maps to defining security boundaries to prevent data exfiltration; Cloud Armor Security Policy maps to mitigating Layer 7 web application vulnerabilities at the edge; Hierarchical Firewall Policy with Secure Tags maps to enforcing top-down network rules using resource tagging; Private Service Connect Endpoint maps to consuming services privately without VPC peering.
Each Google Cloud network security tool addresses a distinct operational layer in the defense-in-depth model: VPC Service Controls secures GCP service API boundaries to prevent data exfiltration; Cloud Armor provides edge L7 WAF protection; Hierarchical Firewall Policies enforce centralized organization-wide L3/L4 rules using Secure Tags; and Private Service Connect provides isolated private endpoint access to services without requiring VPC Peering connections.
Adım Adım Çözüm
Anahtar Kavram
Google Cloud Perimeter Security & Network Controls Selection
Tahmini Süre:1m 30s