Task 2.1: Configuring network topologies.

• ADedicated Interconnect connections with MACsec for Cloud Interconnect enabled

  Correct

  Dedicated Interconnect provides 10, 100 or 400 Gbps private circuits to Google, and MACsec encrypts the traffic between the on-premises router and Google's edge.

• BHA VPN tunnels over the internet to a Cloud Router in the video ingestion VPC

  Incorrect

  HA VPN is encrypted, but each tunnel carries roughly 1 to 3 Gbps over the internet, which limits bulk video ingestion.

• CA Partner Interconnect VLAN attachment of 50 Mbps through a provider

  Incorrect

  A 50 Mbps attachment is far too small for large volumes of video.

• DCross-Cloud Interconnect between the data center and Google Cloud

  Incorrect

  Cross-Cloud Interconnect does not terminate in an on-premises data center, so it cannot carry this ingestion traffic.

For high-throughput hybrid links from a supported colocation facility, Dedicated Interconnect is the performance choice, and MACsec adds link-layer encryption so the private circuit also meets the security requirement.

• AA hierarchical firewall policy associated with the organization node

  Correct

  Hierarchical firewall policies apply to every VPC network under the organization or folder and are evaluated before rules that project owners control.

• BCloud NGFW Enterprise intrusion prevention through a firewall endpoint

  Correct

  The intrusion detection and prevention service inspects workload traffic for intrusions, malware, spyware and command-and-control attacks and can block them.

• CVPC firewall rules with priority 0 created in every project

  Incorrect

  Project-level rules can be changed or deleted by project owners, so they cannot enforce an organization-wide block.

• DA Cloud Armor security policy attached to each backend service

  Incorrect

  Cloud Armor filters traffic arriving at load balancers and similar edge points, not traffic between workloads or egress.

• EVPC Flow Logs enabled on every subnet and exported to BigQuery

  Incorrect

  Flow logs record samples of traffic for analysis; they do not block anything.

Hierarchical firewall policies are how a central team enforces network rules across many projects, and Cloud NGFW's intrusion prevention adds threat inspection that plain allow and deny rules cannot provide.

• AAn HA VPN gateway with tunnels from both of its interfaces to the peer devices

  Correct

  HA VPN reaches the 99.99% SLA only in topologies where both gateway interfaces have tunnels to the peer gateways.

• BA Classic VPN gateway with two tunnels to the same on-premises device

  Incorrect

  Classic VPN offers a 99.9% SLA, and it does not support two tunnels from one gateway to the same peer.

• CStatic routes to each on-premises subnet configured on both tunnels

  Incorrect

  Static routing is a Classic VPN option; HA VPN uses BGP.

• DOne tunnel from interface 0 to the first on-premises VPN device

  Incorrect

  A single tunnel leaves one gateway interface unused, which does not meet the 99.99% topology.

• EDynamic routing with BGP sessions on a Cloud Router for each tunnel

  Correct

  HA VPN supports only dynamic routing, so each tunnel needs a BGP session on Cloud Router.

HA VPN's 99.99% SLA depends on the topology: two gateway interfaces, tunnels from both, and BGP over Cloud Router so routes fail over automatically.

• ACross-Cloud Interconnect between Google Cloud and the other cloud provider

  Correct

  Cross-Cloud Interconnect provisions dedicated physical connections between Google's network and another cloud provider's network.

• BHA VPN tunnels over the internet between gateways in the two clouds

  Incorrect

  HA VPN works between clouds, but it runs over the internet with per-tunnel bandwidth limits rather than dedicated capacity.

• CVPC Network Peering between the Google Cloud VPC and the other cloud's network

  Incorrect

  VPC Network Peering connects Google Cloud VPC networks only; it cannot peer with another provider's network.

• DDedicated Interconnect with circuits ending in the company's own racks

  Incorrect

  Dedicated Interconnect links Google to your own equipment, which is the router build-out the company wants to avoid.

Multicloud connectivity with dedicated bandwidth and no customer-run routing hardware is what Cross-Cloud Interconnect provides.

• ANetwork firewall policy rules that use FQDN objects for each partner

  Incorrect

  FQDN objects match domain names; they cannot tell one URL path on a domain from another.

• BSecure Web Proxy with URL lists in its policy for the approved paths

  Correct

  Secure Web Proxy is an explicit egress proxy for HTTP and HTTPS whose policies can reference URL lists, and it logs the traffic it handles.

• CA Cloud NAT gateway with logging turned on for the workloads' subnet

  Incorrect

  Cloud NAT translates addresses for outbound traffic; it does not filter requests by URL.

• DA Cloud Armor security policy attached to the partners' backend service

  Incorrect

  Cloud Armor protects inbound traffic to your own load balancers, not outbound calls to other sites.

Security protection for egress can work at different layers. Filtering by URL path needs an application-layer proxy, which is what Secure Web Proxy provides.

• AVPC firewall rules that deny the attackers' source IP ranges on the backends

  Incorrect

  Behind a proxy load balancer the backends see Google's proxies, and IP rules cannot inspect request contents.

• BIdentity-Aware Proxy on the backend service in front of the application

  Incorrect

  IAP requires users to sign in, which does not suit a public application and is not a WAF.

• CHierarchical firewall policies that block TCP port 80 on the backends

  Incorrect

  Port-level rules do not look inside HTTP requests and would also block legitimate traffic.

• DA Cloud Armor policy with preconfigured WAF rules and Adaptive Protection

  Correct

  Preconfigured WAF rules block attacks such as SQL injection, and Adaptive Protection detects and alerts on layer 7 DDoS such as HTTP floods.

Web application protection belongs at the load balancer edge. Cloud Armor combines WAF signatures with ML-based Adaptive Protection for layer 7 attacks.