You are migrating a three-tier application architecture from on-premises to Google Cloud. As a first step in the migration, you want to create a new Virtual Private Cloud (VPC) with an external…

Question

Options

• ACreate a Google Cloud Armor policy, and apply it to a backend service that uses an unmanaged
• BCreate a hierarchical firewall ruleset, and apply it to the VPC's parent organization resource node.
• CCreate a Google Cloud Armor policy, and apply it to a backend service that uses an internet
• DCreate a VPC firewall ruleset, and apply it to all instances in unmanaged instance groups.

• A
  13% (3)
• B
  9% (2)
• C
  74% (17)
• D
  4% (1)

Explanation

Google Cloud Armor provides WAF capabilities (including XSS protection) by attaching security policies to backend services of an HTTP(S) Load Balancer. Because the presentation tier runs on on-premises resources (not GCP VMs), the load balancer backend must use an Internet Network Endpoint Group (NEG), which is specifically designed to represent endpoints outside of Google Cloud. Option A is wrong because unmanaged instance groups contain GCP VM instances, not on-premises servers. Option B is wrong because hierarchical firewall rulesets operate at the network layer and do not provide WAF or XSS filtering capabilities. Option D is wrong because VPC firewall rules also lack WAF/XSS capabilities and apply only to GCP instances.

No community discussion yet for this question.