PROFESSIONAL-CLOUD-ARCHITECT · Question #298
You are designing the network architecture for a public-facing, containerized web application deployed on Cloud Run. All incoming traffic must be inspected by a Cloud Armor web application firewall…
The correct answer is C. Set the Cloud Run ingress to Allow internal traffic and Cloud Load Balancing, and use a. Setting Cloud Run ingress to “Allow internal traffic and Cloud Load Balancing” ensures the service only accepts traffic coming from Cloud Load Balancing and not from the public internet via the default *.run.app URL. Using a serverless NEG as the backend of the Application Load…
Question
Options
- AEnable Identity-Aware Proxy (IAP) directly on the Cloud Run service to intercept and validate all
- BCreate a DNS entry to route traffic to Cloud Armor. Configure Cloud Armor to deny traffic from
- CSet the Cloud Run ingress to Allow internal traffic and Cloud Load Balancing, and use a
- DConfigure a VPC firewall rule with a high priority to deny all traffic that does not originate from the
How the community answered
(36 responses)- A8% (3)
- B6% (2)
- C67% (24)
- D19% (7)
Explanation
Setting Cloud Run ingress to “Allow internal traffic and Cloud Load Balancing” ensures the service only accepts traffic coming from Cloud Load Balancing and not from the public internet via the default *.run.app URL. Using a serverless NEG as the backend of the Application Load Balancer (where the Cloud Armor WAF policy is attached) guarantees that all public requests are first inspected by Cloud Armor before being forwarded to Cloud Run, while blocking any direct public access to the Cloud Run service.
Topics
Community Discussion
No community discussion yet for this question.