6.1 Configuring Google Cloud Armor Policies. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   Your application is behind an external Application Load Balancer. You have a Cloud Armor policy with preconfigured WAF rules for SQLi and XSS. You also have a bot management rule that challenges requests from suspicious IPs. You notice that some legitimate users are being challenged and blocked. You want to reduce false positives while maintaining security. What should you do?

   • AAdjust the bot management rule to use a reCAPTCHA challenge instead of a JavaScript challenge.
   • BIncrease the sensitivity of the WAF rules to catch more attacks.
   • CRemove the bot management rule and rely only on the WAF rules.
   • DDisable the preconfigured WAF rules and use only custom rules.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your e-commerce site is being flooded with requests from automated scripts that are adding items to shopping carts. You want to allow legitimate users to continue shopping while mitigating the bot traffic. You have identified that the bot traffic does not execute JavaScript. What should you configure in your Cloud Armor policy?

   • AA WAF rule that blocks requests with a suspicious user-agent string.
   • BA bot management rule that serves a JavaScript challenge to requests that match the bot's characteristics.
   • CA rate limiting rule that blocks any IP that makes more than 10 requests per minute.
   • DA rule that denies all traffic from IP addresses in the same country as the bot.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your organization is preparing for a large marketing event and expects a significant increase in traffic to its public web application. The security team is concerned about potential volumetric DDoS attacks. You need to ensure that the application is protected against such attacks. What should you configure?

   • ACreate a Cloud Armor policy with a rule that denies all traffic from suspicious countries.
   • BEnable Google Cloud Armor Managed Protection Plus and attach a Cloud Armor policy with Adaptive Protection enabled to the backend service.
   • CConfigure a firewall rule to allow only traffic from known good IP addresses.
   • DSet up a Cloud VPN to route all traffic through a third-party DDoS protection service.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   Your web application is experiencing a high volume of requests that contain patterns resembling SQL injection attempts. You have already enabled the preconfigured SQL injection (SQLi) WAF rules in your Cloud Armor policy. However, you notice that some SQLi attempts are still reaching your backend. What should you do to improve protection?

   • AIncrease the rate limit for the affected IP addresses.
   • BMove the Cloud Armor policy from the backend service to the edge.
   • CCreate a custom WAF rule with a higher priority that uses a regex to match the specific attack pattern.
   • DDisable the preconfigured SQLi rules and rely on the default deny rule.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In a Cloud Armor rate limiting rule, what does the 'enforceOnKey' parameter typically specify?

   • AThe time interval for the rate limit
   • BThe HTTP method to which the rule applies
   • CThe action to take when the limit is exceeded
   • DThe attribute used to group requests, such as IP address or a custom header
   Reveal Solution Discussion Select an answer first