CLOUD-DIGITAL-LEADER · Question #81
You are working with a government agency. A web application serves users of the country. It al- lows citizens to receive certain services in providing their national identity. Citizens have com…
The correct answer is B. Setup Cloud Armor and add the malicious IPs to the deny list. Cloud Armor is Google Cloud's DDoS protection and web application firewall (WAF) service, purpose-built for exactly this scenario. It operates at the edge of Google's network (Google's global load balancer layer), blocking malicious traffic before it reaches your backend…
Question
You are working with a government agency. A web application serves users of the country. It al- lows citizens to receive certain services in providing their national identity. Citizens have com- plained that they are seeing delays in web page loading compared to before. On investigating, they are seeing a lot of spurious traffic coming in from a few IPs which they have identified as for- eign. What should they do?
Options
- ASetup Firewall rules to deny access to the malicious IPs.
- BSetup Cloud Armor and add the malicious IPs to the deny list.
- CSetup Firewall rules to allow access only to the IPs from within the country.
- DSetup Cloud NAT and remove all the internal IPs and replace it with a single public IP.
How the community answered
(21 responses)- A5% (1)
- B71% (15)
- C14% (3)
- D10% (2)
Explanation
Cloud Armor is Google Cloud's DDoS protection and web application firewall (WAF) service, purpose-built for exactly this scenario. It operates at the edge of Google's network (Google's global load balancer layer), blocking malicious traffic before it reaches your backend infrastructure, which is why it eliminates the spurious traffic causing page load delays. You can add specific IP addresses or CIDR ranges to a deny list. Firewall rules (A and C) operate at the VM/VPC level - the traffic has already consumed network resources and reached your infrastructure before being dropped, so they would not eliminate the performance degradation. Firewall rules also can't be applied at the load balancer edge. Cloud NAT (D) manages outbound traffic, not inbound, and is irrelevant to this problem.
Topics
Community Discussion
No community discussion yet for this question.