Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise runs a global e-commerce platform behind a Global external Application Load Balancer with Cloud CDN enabled on its primary backend service. The security team needs to deploy a Google Cloud Armor security policy containing pre-configured WAF rules (such as SQL injection and Cross-Site Scripting mitigation) to protect dynamic endpoints.
To ensure operational readiness without risking disruption to legitimate customer transactions, the team has the following requirements:
Which combination of actions should the security team implement?
Attach the Cloud Armor security policy to the backend service, enable preview mode on the rules within the policy, and configure the backend service logging sample rate to 1.0 (100%).
Attach the Cloud Armor security policy to the backend service with active deny rules, disable backend service logging to conserve quota, and monitor dropped requests exclusively using Cloud Monitoring metric alerts.
Attach the Cloud Armor security policy as an edge security policy to the load balancer's frontend forwarding rule, set rule actions to deny, and enable logging on the target HTTPS proxy.
Attach the Cloud Armor security policy to the VPC firewall policies associated with the backend VM instances, enable dry-run mode on the firewall rules, and collect VPC Flow Logs.
Attach the Cloud Armor security policy to the backend service, enable preview mode on the rules within the policy, and configure the backend service logging sample rate to 1.0 (100%).
This solution pairs Google Cloud Armor backend security policies with preview mode and comprehensive Cloud Logging configuration on the Global external Application Load Balancer's backend service. Cloud Armor backend policies protect backend services and inspect dynamic traffic or cache misses when Cloud CDN is enabled.
StudyCerts
StudyCerts--preview or setting the rule to preview) instructs Cloud Armor to evaluate live incoming traffic against the WAF rules, determine matching criteria, and log what the enforcement action would have been (e.g., DENY) without actually blocking or dropping legitimate user requests.logConfig.sampleRate to 1.0 (100%) on the backend service ensures that telemetry for every single evaluated request is recorded in Cloud Logging, enabling security analysts to query fields like jsonPayload.previewSecurityPolicy to tune rule sensitivity before switching to active enforcement.Attaching Cloud Armor to the backend service with full log sampling (sampleRate: 1.0) and preview mode provides an end-to-end, non-disruptive workflow for validating WAF security rules against real-world traffic patterns before activating blocking controls.
Attach the Cloud Armor security policy to the backend service with active deny rules, disable backend service logging to conserve quota, and monitor dropped requests exclusively using Cloud Monitoring metric alerts.
Attach the Cloud Armor security policy as an edge security policy to the load balancer's frontend forwarding rule, set rule actions to deny, and enable logging on the target HTTPS proxy.
Attach the Cloud Armor security policy to the VPC firewall policies associated with the backend VM instances, enable dry-run mode on the firewall rules, and collect VPC Flow Logs.