Task 2.1: Designing and configuring perimeter security.

• AA Cloud Armor backend security policy with the preconfigured sqli rule and a rate-based throttle rule

  Correct

  Cloud Armor policies run at the edge on the load balancer's backend service; preconfigured WAF rules detect SQL injection and a throttle rule limits each client to a set rate.

• BCloud NGFW Enterprise intrusion prevention rules on the backend VMs' VPC network, with a threat prevention profile

  Incorrect

  Intrusion prevention inspects traffic inside the VPC network, after the load balancer; it cannot rate-limit each internet client because the backends see the proxy's addresses.

• CIdentity-Aware Proxy on the backend service, with access limited to users who have signed in with a Google account

  Incorrect

  IAP authenticates every user, which the requirement rules out for a public application, and it has no SQL injection rules.

• DA Secure Web Proxy in front of the backends, with a policy that drops requests containing SQL keywords

  Incorrect

  Secure Web Proxy is not a reverse proxy for internet clients reaching the application.

Google Cloud Armor attaches security policies to the backend services of external Application Load Balancers and enforces them at Google's edge. The preconfigured WAF rules cover OWASP Top 10 attacks such as SQL injection, and rate limiting rules can throttle or ban clients that exceed a rate, keyed for example on the client IP address.

• ACloud NAT for the VMs' subnet, with an ingress firewall rule for the administrators' home IP addresses on port 22

  Incorrect

  Cloud NAT handles outbound connections only; it never lets internet clients connect in to VMs.

• BPrivate Google Access on the VMs' subnet, so that SSH sessions travel over Google's private network

  Incorrect

  Private Google Access lets VMs reach Google APIs; it gives administrators no path to the VMs.

• CAn HA VPN tunnel from each administrator's home router to the VPC network, with SSH keys in project metadata

  Incorrect

  Per-home VPN tunnels are impractical, and project-wide SSH keys are not tied to the administrators' Google identities.

• DIAP TCP forwarding, a firewall rule allowing 35.235.240.0/20 on port 22, and the IAP-secured Tunnel User role

  Correct

  IAP TCP forwarding tunnels SSH through IAP, which checks the user's IAM role; the VMs only need to accept port 22 from IAP's range.

Identity-Aware Proxy TCP forwarding wraps SSH or RDP in HTTPS and lets users reach VMs that have no external IP address. Access is controlled by the IAP-secured Tunnel User role, and the VMs' firewall must allow ingress from 35.235.240.0/20, the range IAP uses for forwarding.

• AA zonal firewall endpoint, linked to the VPC by an endpoint association

  Correct

  Cloud NGFW Enterprise inspects traffic in zonal firewall endpoints, and an association links an endpoint to the VPC network in that zone.

• BFirewall Insights for the firewall rules that apply to the VMs

  Incorrect

  Firewall Insights analyzes how firewall rules are used, such as shadowed or unused rules; it does not inspect packets for threats.

• CVPC Flow Logs with metadata on every subnet, exported to Google Security Operations

  Incorrect

  Flow logs record connection metadata after the fact and carry no payload to match against threat signatures.

• DA firewall policy rule that applies a security profile group

  Correct

  Traffic is sent to the endpoint by a rule whose action applies a security profile group; the threat prevention profile decides which threats are blocked.

• EA Cloud Armor security policy with Adaptive Protection on the VMs' instance group

  Incorrect

  Cloud Armor protects traffic arriving through supported load balancers and edge paths, not VM-to-VM traffic inside a network.

The intrusion detection and prevention service of Cloud NGFW Enterprise runs in Google-managed zonal firewall endpoints. After an endpoint is associated with a VPC network, a network or hierarchical firewall policy rule with the apply_security_profile_group action sends matching traffic for inspection, and the threat prevention profile in the group sets the response to each detected threat.

• AMove the records into a private zone that only the bank's VPC networks can query

  Incorrect

  A private zone is invisible to internet resolvers, so customers could no longer resolve the domain at all.

• BTurn on DNSSEC for the managed zone and publish its DS record at the domain's registrar

  Correct

  DNSSEC signs the zone's records, and the DS record in the parent zone completes the chain of trust that validating resolvers check.

• CAdd a DNS response policy that answers queries for the domain from a local data rule

  Incorrect

  Response policies change answers for queries from the bank's own VPC networks; they do nothing for resolvers on the internet.

• DTurn on Cloud DNS query logging for the zone and alert on unexpected answers

  Incorrect

  Logging records queries that reach Cloud DNS; it cannot stop or reveal a forged answer injected elsewhere on the path.

DNSSEC authenticates DNS responses so that validating resolvers can reject spoofed or altered answers. Cloud DNS can sign a public managed zone, but the chain of trust only works after the zone's DS record is placed in the parent zone through the domain registrar.

• ACloud CDN on the backend service, so that cached responses absorb the attack traffic

  Incorrect

  Caching can absorb some load, but it neither learns normal traffic nor alerts on attacks and suggests rules.

• BAdaptive Protection on the Cloud Armor security policy that already protects the storefront's backend service

  Correct

  Adaptive Protection models normal traffic, alerts on anomalies with attack signatures and suggests a rule; full alerts require Cloud Armor Enterprise.

• CA preconfigured WAF rule set for OWASP Top 10 attacks in the same security policy

  Incorrect

  Preconfigured WAF rules match known attack patterns such as SQL injection; an HTTP flood of ordinary-looking requests does not match them.

• DVPC Flow Logs on the backends' subnets, with an alert on connection counts

  Incorrect

  The backends see connections from the load balancer's proxies, and flow logs do not suggest Cloud Armor rules.

Cloud Armor Adaptive Protection uses machine learning on a security policy's traffic to detect anomalous activity that looks like layer 7 DDoS attacks, and its alerts include attack signatures and a suggested rule. With Cloud Armor Enterprise the full alerts are available; otherwise only a basic alert is sent.

• AAn SSL policy on the target proxy with minimum TLS version 1.2 and the RESTRICTED profile

  Correct

  An SSL policy on the target proxy sets the lowest TLS version and the cipher profile; RESTRICTED keeps only a reduced set of strong ciphers.

• BA Google-managed certificate in place of the self-managed certificate on the target proxy

  Incorrect

  Certificate type does not decide which TLS versions or ciphers clients may negotiate.

• CA Cloud Armor rule that denies requests whose user agent belongs to old browsers

  Incorrect

  Cloud Armor evaluates HTTP requests after the TLS handshake, so weak protocol versions would still be negotiated.

• DThe COMPATIBLE profile with TLS 1.0 as the minimum, which supports the widest set of clients

  Incorrect

  COMPATIBLE with TLS 1.0 is the permissive setting the assessor flagged.

SSL policies control the TLS features that the load balancer negotiates with clients: a minimum TLS version and a profile of COMPATIBLE, MODERN, RESTRICTED or CUSTOM. A policy attached to the target HTTPS proxy removes old protocol versions and weak ciphers for every client.

• AA Certificate Authority Service CA pool in the DevOps tier, sized for high issuance rates

  Incorrect

  The DevOps tier does not support listing, describing or revoking certificates, nor customer-managed CA keys.

• BGoogle-managed certificates in Certificate Manager for each internal hostname

  Incorrect

  Google-managed certificates come from public CAs for public domains; they are not a private CA for internal mTLS.

• CA Certificate Authority Service CA pool in the Enterprise tier, with the CA key in Cloud KMS

  Correct

  The Enterprise tier is for long-lived certificates, supports listing, describing and revoking them, and supports customer-managed CA keys.

• DA self-signed root key in Secret Manager, used by a script that signs each service's certificate

  Incorrect

  A homemade CA keeps a private key as a secret and offers no managed revocation or audit trail.

Certificate Authority Service runs private CAs in two operation tiers. DevOps suits high-volume, short-lived certificates and does not track issued certificates. Enterprise suits lower-volume, long-lived certificates, lets administrators list and revoke them and supports customer-managed CA keys in Cloud KMS.

• ADisable the unapproved APIs in each project and review enabled APIs every month

  Incorrect

  Project owners can enable the APIs again the next day; disabling them is not a guardrail.

• BRemove Service Usage Admin from project owners on every project in the folder

  Incorrect

  Owners hold many permissions, and others could still enable services; it is a fragile, per-project change.

• CRestrict every API key in the folder to the twelve approved services

  Incorrect

  API key restrictions limit what a key can call; they do not stop resources being created through other credentials.

• DThe gcp.restrictServiceUsage constraint on the folder, as an allow list of the twelve services

  Correct

  Restricting service usage with an allow list stops resources of any other service from being created in the folder's projects.

The gcp.restrictServiceUsage constraint controls which Google Cloud services may be used within an organization, folder or project, as an allow list or a deny list. As an organization policy it is set above the projects, so project owners cannot change it.