Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Gauge your current knowledge
Gauge your current knowledge
Network Security and Perimeter Defense involves creating multiple layers of protection to secure cloud resources from unauthorized access. A primary goal is to mitigate external threats like Distributed Denial-of-Service (DDoS) attacks while ensuring only authorized users can access data. This is achieved by combining edge security, service boundaries, and identity-based access controls to protect the entire cloud environment.
Google Cloud Armor acts as a web application firewall (WAF) that protects applications at the edge of the network. It uses security policies to filter traffic based on IP addresses or geography to block attacks like SQL injection. These policies are attached to External Application Load Balancers to stop unwelcome traffic before it enters your network. Adaptive Protection uses machine learning to detect and alert on suspected Layer 7 attacks. Preconfigured WAF Rules are ready-to-use rules based on industry standards to stop common web threats.
VPC Service Controls allow architects to define a service perimeter, which is a virtual security boundary around Google Cloud resources. This tool is essential for preventing data exfiltration by blocking communication between services inside the perimeter and entities outside of it. You can also use ingress and egress rules to allow specific, secure data exchanges across these boundaries. Enforced mode actively blocks any requests that violate the security policy. Dry run mode logs potential violations for testing without actually denying access.
Identity-Aware Proxy (IAP) manages secure access to applications and VMs by verifying a user's identity and context. Instead of relying on traditional VPNs, IAP uses context-aware access to evaluate factors like device security posture and location before granting entry. For administrative tasks, IAP TCP forwarding allows for secure SSH and RDP connections to virtual machines without needing public IP addresses. This ensures that only authorized users with verified devices can reach sensitive backend resources.
Effective network defense requires integrating these tools with Cloud Load Balancing and VPC Firewalls. Load balancers serve as the attachment point for Cloud Armor and IAP, while firewalls provide more granular control at the virtual machine level. By using hierarchical firewall policies, organizations can enforce consistent security rules across all projects. This multi-layered approach ensures that the cloud infrastructure remains secure and compliant with business requirements.
Identity and Access Management (IAM) is a framework that allows administrators to manage who can do what on specific resources. In Google Cloud, principals like user accounts or service accounts are granted roles, which are collections of permissions. It is essential to understand that permissions are not granted directly to users but are bundled into roles for better management.
Implementing the principle of least privilege ensures that users and applications have only the minimum permissions necessary to perform their tasks. To achieve this, architects should avoid basic roles like Editor or Owner and instead use more specific options:
Using dedicated service accounts for different environments helps isolate permissions and reduces the risk of unauthorized access.
Resource governance involves enforcing organizational policies across the entire Google Cloud resource hierarchy. This structure includes the organization, folders, and projects, where resources inherit the security policies of their parent containers. Architects use these levels to maintain administrative control and ensure that security settings are consistent across the entire company.
For highly sensitive information, fine-grained access control can be managed through policy tags and data classification. Services like Data Catalog allow you to tag data assets, while BigQuery uses these tags to restrict access to specific columns. This approach ensures that only authorized personnel can view sensitive personal information, even if they have general access to the database.
Maintaining a secure environment requires regular auditing and the use of troubleshooting tools. The IAM Recommender helps identify overly permissive roles by analyzing actual permission usage and suggesting more restrictive alternatives. Additionally, the Policy Troubleshooter allows administrators to debug access issues by checking why a specific principal was granted or denied a permission.
When performing an Application Migration, architects must choose a strategy that maintains Data Protection. Whether using a lift and shift method or database modernization, securing the data transfer is essential to prevent unauthorized access. This ensures that the move to a target cloud does not compromise business requirements. Common migration strategies include:
To protect sensitive information during these moves, organizations use Customer-Managed Encryption Keys (CMEK). CMEK gives the user full control over their encryption keys, ensuring that only authorized services can decrypt the data. This is vital for minimal downtime migrations, where data is constantly synchronized between clouds and requires continuous protection.
Another key strategy involves using Cloud Data Loss Prevention (DLP) to manage sensitive content. Cloud DLP is a service that helps identify and redact sensitive information like personal IDs before they are stored in the new environment. This ensures that the organization remains compliant with security standards and organizational policies during the migration process.
Disaster Recovery models must also include robust encryption to protect data during a regional outage. In a hot standby model, a transactionally synchronized database ensures that data is encrypted and updated simultaneously in multiple locations. This provides immediate availability and consistency if the primary region fails. Readiness models for recovery include:
StudyCerts
StudyCerts