Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ303

Securing communications and establishing boundary protection

A customer must deploy a 3-tier internal web application on Google Cloud Platform (GCP). The customer’s internal compliance requirements require that end-user access be permitted only when traffic appears to originate from a particular known-good CIDR. The customer accepts the risk that the application will have only SYN-flood DDoS protection. They want to use GCP’s native SYN-flood protection.

Which product should be used to satisfy these requirements?

  • A Cloud Armor
  • B VPC Firewall Rules
  • C Cloud Identity and Access Management
  • D Cloud CDN
Explanation

The application is internal (a 3-tier internal web app), so Cloud Armor — which attaches to external/global HTTP(S) load balancers at the Google Front End — does not apply here. VPC Firewall Rules restrict ingress to the known-good source CIDR at L3/L4, and Google's network infrastructure provides built-in (native) SYN-flood protection for traffic governed by firewall rules, which is exactly the limited protection the customer accepts. Cloud Armor (A) would add L7 WAF/DDoS capability but requires an external load balancer and exceeds the stated requirement.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!