Securing communications and establishing boundary protection · Topic 2 of 4

Cloud Armor, Secure Web Proxy, Cloud DNS Security and API Restriction

Protect apps with Cloud Armor WAF rules, filter egress with Secure Web Proxy, secure Cloud DNS with DNSSEC, and monitor and restrict Google APIs.

5 min

In a nutshell

Cloud Armor sits on the load balancer: WAF rules, geo and IP rules, rate limits, bot control.
Test Cloud Armor rules in preview mode; Adaptive Protection detects layer 7 DDoS.
Secure Web Proxy is explicit egress filtering by host and URL; Cloud NAT is not a filter.

What it is

Four controls finish the perimeter. Google Cloud Armor filters inbound web traffic at the load balancer.

Secure Web Proxy controls outbound web traffic from your workloads. Cloud DNS security settings protect name resolution, and API restrictions limit which Google services a project can use at all.

How it works

Google Cloud Armor

Cloud Armor security policies attach to backend services of external Application Load Balancers (and some other load balancers). Rules are evaluated in priority order, lowest number first, and each has a match and an action.

Rule type	Example	Purpose
IP and geography	`origin.region_code == 'KP'`	Block regions or address ranges
Preconfigured WAF	`evaluatePreconfiguredWaf('sqli-v33-stable')`	OWASP Top 10 style attacks, based on the OWASP ModSecurity Core Rule Set
Rate limiting	`throttle` or `rate_based_ban` actions	Limit requests per client key such as IP
Bot management	reCAPTCHA integration	Challenge or block automated clients
Custom expressions	Match headers, paths or query strings	App-specific rules

gcloud compute security-policies create shop-waf \
  --description="WAF for shop frontend"

gcloud compute security-policies rules create 1000 \
  --security-policy=shop-waf \
  --expression="evaluatePreconfiguredWaf('sqli-v33-stable')" \
  --action=deny-403

gcloud compute backend-services update shop-backend \
  --security-policy=shop-waf --global

Use preview mode on new rules first: matches are logged but not enforced. Adaptive Protection uses machine learning to detect layer 7 DDoS attacks and suggest rules.

Edge security policies filter requests before Cloud CDN serves cached content. Cloud Armor Enterprise is a paid subscription (Paygo or Annual) that adds features such as Google Threat Intelligence, named IP address lists and Adaptive Protection; DDoS response team support and DDoS bill protection come only with the Annual plan.

Secure Web Proxy

Secure Web Proxy is a managed, explicit forward proxy for workloads' outbound HTTP and HTTPS traffic. Workloads send traffic to the proxy's address; the proxy allows only what its policy permits.

Element	Role
Gateway	The regional proxy instance, which needs a proxy-only subnet
Policy and rules	Allow or deny by destination host, URL lists, source identity such as service account or secure tag
TLS inspection	Optional; uses a CA from Certificate Authority Service so rules can match full URLs
Logging	Each request is logged to Cloud Logging

Choose Secure Web Proxy when workloads must reach only approved internet sites, such as package repositories or partner APIs. Cloud NAT gives outbound reach but no URL filtering.

Cloud DNS security

Setting	Protects against
DNSSEC on public zones	Spoofed or tampered answers; publish the DS record at the registrar
Private zones	Internal names leaking; visible only to authorized VPC networks
Response policies	Users resolving unwanted domains; override or block answers, or point Google API names to restricted VIPs
DNS server policies	Inbound forwarding for on-premises resolvers, alternative name servers, and query logging
IAM on Cloud DNS	Unauthorised record changes; grant DNS Administrator narrowly

gcloud dns managed-zones update example-public-zone --dnssec-state=on

Monitoring and restricting APIs

Every enabled API is attack surface. A security engineer controls which APIs exist in each project and who can call them.

Control	How
Enable only needed APIs	Review with `gcloud services list --enabled`; disable unused ones
Organization-wide service restriction	Organization policy `gcp.restrictServiceUsage` lists services allowed or denied in a subtree
Data exfiltration through APIs	VPC Service Controls restricted services and VPC accessible services
API keys	Restrict each key to specific APIs and to allowed apps, IPs or referrers; rotate and delete unused keys
Monitoring	API metrics in the console, Cloud Monitoring request metrics, Cloud Audit Logs per method
Your own APIs	API Gateway or Apigee for authentication, quotas and threat protection

A worked example

An online shop is hit by SQL injection attempts and a scraping bot, while its VMs download packages from anywhere on the internet. The engineer attaches a Cloud Armor policy with preconfigured SQLi and XSS rules in preview mode, then enforces them after a day of clean logs, and adds a per-IP rate limit.

For egress, Secure Web Proxy allows only the package mirrors and payment provider, and egress firewall rules block direct internet access so traffic must use the proxy. DNSSEC is turned on for the public zone.

How the exam asks about this

"Protect a public web app behind a global load balancer from SQL injection and cross-site scripting." Cloud Armor with preconfigured WAF rules on the backend service.
"VMs may reach only a list of approved external domains over HTTPS." Secure Web Proxy with host-based allow rules.
"Prevent cache poisoning and spoofed answers for the company's public domain." Enable DNSSEC on the Cloud DNS public zone and publish the DS record.

What to remember for the exam

Cloud Armor sits on the load balancer: WAF rules, geo and IP rules, rate limits, bot control.
Test Cloud Armor rules in preview mode; Adaptive Protection detects layer 7 DDoS.
Secure Web Proxy is explicit egress filtering by host and URL; Cloud NAT is not a filter.
DNSSEC for public zones, private zones for internal names, response policies to override answers.
Restrict APIs with gcp.restrictServiceUsage, VPC Service Controls and API key restrictions.

Watch out

Cloud Armor only sees traffic that passes through the load balancer it is attached to. If backends also have external IPs, attackers can bypass it, so remove them or block direct access with firewall rules.

Common mistakes

Using firewall rules to stop SQL injection. Firewall rules see addresses and ports, not HTTP payloads. Use Cloud Armor WAF rules.

Enforcing new WAF rules straight away. False positives can block real customers. Use preview mode, read the logs, then enforce.

Leaving API keys unrestricted. An unrestricted key works for every enabled API from anywhere. Restrict it to one API and to known callers.

Check yourself

Where is a Cloud Armor security policy attached?
To the backend service (or backend bucket for edge policies) of a supported load balancer.
When would you choose Secure Web Proxy over Cloud NAT?
When outbound web traffic must be filtered by destination host or URL, since Cloud NAT only translates addresses.
What does turning on DNSSEC for a public zone require outside Google Cloud?
Publishing the zone's DS record at the domain registrar so resolvers can validate the chain.

Topic 2 of 4 in Securing communications and establishing boundary protection

Test yourself on Securing communications and establishing boundary protection

The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.