nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #282

Your organization hosts a sensitive web application in Google Cloud. To protect the web application, you've set up a virtual private cloud (VPC) with dedicated subnets for the application's frontend…

The correct answer is A. Configure Cloud Firewall to permit allow-listed traffic only, deploy Google Cloud Armor with. To protect a sensitive web application, implement a multi-layered security approach using Cloud Firewall for traffic restriction, Google Cloud Armor for web-based attack protection, and Cloud IDS for internal traffic monitoring.

Submitted by noor.lb· Apr 18, 2026Configuring network security

Question

Your organization hosts a sensitive web application in Google Cloud. To protect the web application, you've set up a virtual private cloud (VPC) with dedicated subnets for the application's frontend and backend components. You must implement security controls to restrict incoming traffic, protect against web-based attacks, and monitor internal traffic. What should you do?

Options

  • AConfigure Cloud Firewall to permit allow-listed traffic only, deploy Google Cloud Armor with
  • BConfigure Google Cloud Armor to allow incoming connections, configure DNS Security
  • CConfigure Cloud Intrusion Detection System (Cloud IDS) to monitor incoming connections, deploy
  • DConfigure Cloud DNS to secure incoming traffic, deploy Cloud Intrusion Detection System (Cloud

How the community answered

(53 responses)
  • A
    77% (41)
  • B
    6% (3)
  • C
    4% (2)
  • D
    13% (7)

Why each option

To protect a sensitive web application, implement a multi-layered security approach using Cloud Firewall for traffic restriction, Google Cloud Armor for web-based attack protection, and Cloud IDS for internal traffic monitoring.

AConfigure Cloud Firewall to permit allow-listed traffic only, deploy Google Cloud Armor withCorrect

Cloud Firewall allows for filtering and permitting only allow-listed traffic, addressing the need to restrict incoming connections. Google Cloud Armor, with its Web Application Firewall (WAF) capabilities, specifically protects against web-based attacks. Cloud Intrusion Detection System (Cloud IDS) is designed to monitor internal traffic for threats, fulfilling all stated security requirements.

BConfigure Google Cloud Armor to allow incoming connections, configure DNS Security

DNS Security and Cloud DNS are primarily for name resolution and DNS-level protection, not comprehensive web application attack protection or general traffic restriction like WAFs and firewalls.

CConfigure Cloud Intrusion Detection System (Cloud IDS) to monitor incoming connections, deploy

Cloud CDN is a content delivery network service, not a security control for web-based attacks or a general traffic monitoring solution.

DConfigure Cloud DNS to secure incoming traffic, deploy Cloud Intrusion Detection System (Cloud

Cloud DNS does not secure incoming traffic in the manner of a firewall or WAF, and Identity-Aware Proxy (IAP) is for authenticated access to applications, not broad protection against public web attacks.

Concept tested: Multi-layered web application security

Source: https://cloud.google.com/architecture/identity/network-security-service-overview

Topics

#Network Security#Cloud Firewall#Cloud Armor#WAF

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice