An enterprise is deploying a mission-critical web application on Google Kubernetes Engine (GKE) and Compute Engine virtual machines behind a global external Application Load Balancer. The organization requires a multi-layered network security design that satisfies the following requirements: Mitigate distributed denial-of-service (DDoS) attacks and block OWASP Top 10 web application vulnerabilities (such as SQL injection and Cross-Site Scripting) at Google Cloud's network edge before requests enter the VPC network. Perform deep packet inspection on traffic traversing the Virtual Private Cloud (VPC) network to detect and alert on malware, network intrusions, and lateral movement. Which combination of Google Cloud security services and configurations should you deploy?

Attach a Google Cloud Armor security policy with preconfigured WAF rules to the external Application Load Balancer backend service, and configure Cloud NGFW intrusion detection/threat prevention with security profiles applied to firewall policy rules in the VPC network.: What the solution is Google Cloud Armor is an edge-based Web Application Firewall (WAF) and DDoS mitigation service integrated directly into Google Cloud's external load-balancing infrastructure. Cloud Next Generation Firewall (Cloud NGFW) with intrusion detection and threat prevention capabilities provides managed Layer 7 deep packet inspection inside the Virtual Private Cloud (VPC) network. How it meets the requirements Edge DDoS & WAF Protection: Applying a Google Cloud Armor security policy with preconfigured expression sets (such as OWASP Top 10 CRS rules for SQL injection and cross-site scripting) to the external Application Load Balancer backend service inspects and filters incoming HTTP(S) traffic at Google's global edge before it reaches internal VPC resources. Deep Packet Inspection in VPC: Configuring Cloud NGFW threat prevention security profiles and attaching a security profile group to network firewall policy rules enables Layer 7 deep packet inspection to detect vulnerabilities, malware signatures, and lateral movement across internal network traffic. Key advantages and capabilities Google Edge Filtering: Stops volumetric DDoS floods and malicious Layer 7 web payloads without consuming VPC compute or ingress bandwidth. Preconfigured Rule Sets: Employs managed WAF signatures for rapid protection against SQLi, XSS, RFI, and LFI. In-Depth Threat Detection: Inspects network payloads across Layer 4 through Layer 7 inside the VPC without requiring complex third-party appliance scaling. Unified Architecture: Integrates seamlessly with Cloud Load Balancing, VPC firewall policies, and Security Operations. Why this is optimal This architecture establishes true defense-in-depth by pairing edge-based Layer 7 filtering via Google Cloud Armor with in-VPC packet inspection via Cloud NGFW threat prevention profiles.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Armor Cloud Ids Multi Layer Security

Section: Security protection (e.g. intrusion protection, access control, and firewalls)

An enterprise is deploying a mission-critical web application on Google Kubernetes Engine (GKE) and Compute Engine virtual machines behind a global external Application Load Balancer. The organization requires a multi-layered network security design that satisfies the following requirements:

Mitigate distributed denial-of-service (DDoS) attacks and block OWASP Top 10 web application vulnerabilities (such as SQL injection and Cross-Site Scripting) at Google Cloud's network edge before requests enter the VPC network.
Perform deep packet inspection on traffic traversing the Virtual Private Cloud (VPC) network to detect and alert on malware, network intrusions, and lateral movement.

Which combination of Google Cloud security services and configurations should you deploy?

Configure standard VPC firewall ingress deny rules matching malicious source IP ranges on the backend instances, and enable VPC Flow Logs with Cloud Logging alert policies for deep packet inspection.

Deploy Identity-Aware Proxy (IAP) on the external Application Load Balancer for OWASP filtering, and apply Cloud Armor security policies directly to the internal VPC subnets for intrusion detection.

Attach a Google Cloud Armor security policy with preconfigured WAF rules to the external Application Load Balancer backend service, and configure Cloud NGFW intrusion detection/threat prevention with security profiles applied to firewall policy rules in the VPC network.

Enable Cloud NAT on the VPC network for DDoS mitigation, and configure Packet Mirroring to forward mirrored traffic to Cloud Key Management Service (Cloud KMS) for deep packet inspection.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Armor Cloud Ids Multi Layer Security

Section: Security protection (e.g. intrusion protection, access control, and firewalls)

Mitigate distributed denial-of-service (DDoS) attacks and block OWASP Top 10 web application vulnerabilities (such as SQL injection and Cross-Site Scripting) at Google Cloud's network edge before requests enter the VPC network.
Perform deep packet inspection on traffic traversing the Virtual Private Cloud (VPC) network to detect and alert on malware, network intrusions, and lateral movement.

Which combination of Google Cloud security services and configurations should you deploy?

Configure standard VPC firewall ingress deny rules matching malicious source IP ranges on the backend instances, and enable VPC Flow Logs with Cloud Logging alert policies for deep packet inspection.

Deploy Identity-Aware Proxy (IAP) on the external Application Load Balancer for OWASP filtering, and apply Cloud Armor security policies directly to the internal VPC subnets for intrusion detection.

Enable Cloud NAT on the VPC network for DDoS mitigation, and configure Packet Mirroring to forward mirrored traffic to Cloud Key Management Service (Cloud KMS) for deep packet inspection.

Explanations

What the solution is

Google Cloud Armor is an edge-based Web Application Firewall (WAF) and DDoS mitigation service integrated directly into Google Cloud's external load-balancing infrastructure. Cloud Next Generation Firewall (Cloud NGFW) with intrusion detection and threat prevention capabilities provides managed Layer 7 deep packet inspection inside the Virtual Private Cloud (VPC) network.

How it meets the requirements

Edge DDoS & WAF Protection: Applying a Google Cloud Armor security policy with preconfigured expression sets (such as OWASP Top 10 CRS rules for SQL injection and cross-site scripting) to the external Application Load Balancer backend service inspects and filters incoming HTTP(S) traffic at Google's global edge before it reaches internal VPC resources.
Deep Packet Inspection in VPC: Configuring Cloud NGFW threat prevention security profiles and attaching a security profile group to network firewall policy rules enables Layer 7 deep packet inspection to detect vulnerabilities, malware signatures, and lateral movement across internal network traffic.

Key advantages and capabilities

Google Edge Filtering: Stops volumetric DDoS floods and malicious Layer 7 web payloads without consuming VPC compute or ingress bandwidth.
Preconfigured Rule Sets: Employs managed WAF signatures for rapid protection against SQLi, XSS, RFI, and LFI.
In-Depth Threat Detection: Inspects network payloads across Layer 4 through Layer 7 inside the VPC without requiring complex third-party appliance scaling.
Unified Architecture: Integrates seamlessly with Cloud Load Balancing, VPC firewall policies, and Security Operations.

Why this is optimal

This architecture establishes true defense-in-depth by pairing edge-based Layer 7 filtering via Google Cloud Armor with in-VPC packet inspection via Cloud NGFW threat prevention profiles.

View source documentation

Professional Cloud Architect

Cloud Armor Cloud Ids Multi Layer Security

Professional Cloud Architect

Cloud Armor Cloud Ids Multi Layer Security

What the solution is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions