6.1 Configuring Google Cloud Armor Policies. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   Your application is behind an external Application Load Balancer. You have a Cloud Armor backend security policy attached to the backend service. You need to block requests that contain a specific cross-site scripting (XSS) payload that is not covered by the preconfigured rules. What should you do?

   • ACreate a new backend security policy and attach it to the load balancer's URL map.
   • BEnable Adaptive Protection to automatically detect and block the XSS payload.
   • CAdd a custom rule to the existing backend security policy with a higher priority than the preconfigured rules.
   • DModify the preconfigured XSS rules to include the specific payload.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A Cloud Armor rule is configured to allow a maximum of 100 requests per minute from a single IP address. What is this type of rule called?

   • AA WAF rule
   • BA rate limiting rule
   • CA bot management rule
   • DAn Adaptive Protection rule
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which Cloud Armor feature automatically learns normal traffic patterns and can generate alerts or enforce mitigation for suspected volumetric DDoS attacks?

   • AGoogle Threat Intelligence
   • BRate limiting
   • CPreconfigured WAF rules
   • DAdaptive Protection
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   Your company is running a critical application that must remain available during a DDoS attack. You have Cloud Armor Managed Protection Plus enabled. You are concerned about the cost of the additional resources that might be used during an attack. What should you do to balance availability and cost?

   • AUse Google Threat Intelligence to block traffic from known malicious IPs.
   • BSet up autoscaling on the backend instances to handle the increased traffic.
   • CCreate a rate limiting rule that aggressively blocks traffic from any IP that exceeds a low threshold.
   • DEnable Adaptive Protection and configure it to automatically apply the recommended mitigation rules.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   Your application is experiencing a sudden spike in traffic that you suspect is a DDoS attack. You have Cloud Armor Managed Protection Plus enabled. You want to automatically mitigate the attack without manual intervention. What should you ensure is configured?

   • AA WAF rule is configured to block common DDoS attack signatures.
   • BA rate limiting rule is configured to block all traffic that exceeds a certain threshold.
   • CThe load balancer is configured to scale automatically to absorb the attack.
   • DAdaptive Protection is enabled on the Cloud Armor policy attached to the backend service.
   Reveal Solution Discussion Select an answer first