Cloud Armor for DDoS and WAF in GCP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Google Cloud Armor?

Google Cloud Armor is a security service that protects your applications from attacks like DDoS and helps control who can access your services by using rules called policies.

beginner

How does Cloud Armor help protect against DDoS attacks?

Cloud Armor blocks large amounts of unwanted traffic by filtering requests based on rules, stopping attacks before they reach your application.

beginner

What is a WAF in the context of Cloud Armor?

WAF stands for Web Application Firewall. In Cloud Armor, it means rules that protect your web apps from harmful requests like SQL injection or cross-site scripting.

intermediate

What are security policies in Cloud Armor?

Security policies are sets of rules you create to allow or block traffic based on IP addresses, geographic locations, or request properties.

intermediate

Why is it important to use both DDoS protection and WAF rules together?

Using both helps stop large traffic floods (DDoS) and also blocks harmful requests that try to exploit your app, giving stronger overall protection.

What type of attacks does Cloud Armor primarily protect against?

A Phishing attacks

B Distributed Denial of Service (DDoS) attacks

C Malware infections

D Password guessing attacks

Cloud Armor is designed to protect against DDoS attacks by filtering and blocking unwanted traffic.

What does WAF stand for in Cloud Armor?

A Wireless Application Firewall

B Wide Access Filter

C Web Access Framework

D Web Application Firewall

WAF means Web Application Firewall, which protects web apps from harmful requests.

Which of the following can you use in Cloud Armor security policies to block traffic?

A IP addresses and geographic locations

B User passwords

C Email addresses

D Browser history

Cloud Armor policies use IP addresses and geographic locations to allow or block traffic.

What happens if you do NOT use Cloud Armor for your web app?

A Your app will automatically be protected by Google

B Your app will run faster

C Your app may be vulnerable to DDoS and harmful web attacks

D Your app will not be accessible

Without Cloud Armor, your app can be exposed to attacks that disrupt service or exploit vulnerabilities.

Cloud Armor's WAF rules help protect against which of these?

A SQL injection and cross-site scripting

B Hardware failures

C Network cable cuts

D Power outages

WAF rules block harmful web requests like SQL injection and cross-site scripting attacks.

Explain how Google Cloud Armor protects a web application from DDoS attacks and harmful web requests.

Think about how rules can stop bad traffic before it reaches your app.

Describe what security policies in Cloud Armor are and how they help control access to your services.

Imagine setting house rules for who can enter and who cannot.

Practice

1. What is the main purpose of Google Cloud Armor in protecting your applications?

easy

A. To block bad traffic and protect against attacks like DDoS

B. To store application data securely

C. To manage user authentication and login

D. To monitor application performance metrics

Solution

1. Step 1: Understand Cloud Armor's role

   Cloud Armor is designed to protect applications from harmful traffic and attacks such as Distributed Denial of Service (DDoS).

2. Step 2: Compare options

   Options B, C, and D describe other services like storage, authentication, and monitoring, which are not Cloud Armor's main function.

3. Final Answer:

   To block bad traffic and protect against attacks like DDoS -> Option A

4. Quick Check:

   Cloud Armor protects apps from bad traffic = A [OK]

Hint: Cloud Armor blocks bad traffic and DDoS attacks [OK]

Common Mistakes:

• Confusing Cloud Armor with storage or authentication services
• Thinking Cloud Armor monitors performance instead of security

2. Which of the following is the correct way to create a Cloud Armor security policy using gcloud CLI?

easy

A. gcloud compute security-policies create my-policy --description="Protect app"

B. gcloud compute firewall-rules create my-policy --description="Protect app"

C. gcloud compute instances create my-policy --description="Protect app"

D. gcloud compute networks create my-policy --description="Protect app"

Solution

1. Step 1: Identify correct gcloud command for Cloud Armor policy

   The command to create a Cloud Armor security policy is under 'compute security-policies create'.

2. Step 2: Eliminate incorrect commands

   Firewall rules, instances, and networks are different resources and use different commands.

3. Final Answer:

   gcloud compute security-policies create my-policy --description="Protect app" -> Option A

4. Quick Check:

   Security policy creation uses 'compute security-policies create' = B [OK]

Hint: Cloud Armor policies use 'compute security-policies create' command [OK]

Common Mistakes:

• Using firewall or instance commands instead of security-policies
• Confusing network creation with security policy creation

3. Given this Cloud Armor rule snippet, what action will be taken for requests from IP 203.0.113.5?

{
  "expression": "origin.ip == '203.0.113.5'",
  "action": "deny(403)"
}

medium

A. Requests from 203.0.113.5 will be allowed

B. Requests from 203.0.113.5 will be denied with HTTP 403

C. Requests from all IPs except 203.0.113.5 will be denied

D. Requests from 203.0.113.5 will be redirected

Solution

1. Step 1: Analyze the rule expression and action

   The rule matches requests where the IP is exactly '203.0.113.5' and denies them with HTTP status 403.

2. Step 2: Understand the effect on matching IP

   Requests from 203.0.113.5 will be blocked and receive a 403 Forbidden response.

3. Final Answer:

   Requests from 203.0.113.5 will be denied with HTTP 403 -> Option B

4. Quick Check:

   IP match with deny(403) means block = D [OK]

Hint: deny(403) blocks matching IPs with forbidden response [OK]

Common Mistakes:

• Thinking deny means allow
• Confusing deny with redirect or allow
• Assuming rule applies to all IPs

4. You created a Cloud Armor security policy but it is not blocking malicious traffic as expected. What is a common mistake to check?

medium

A. The Cloud Armor API is enabled in the project

B. The policy rules have correct IP addresses

C. The firewall rules allow all traffic

D. The security policy is not attached to the backend service or load balancer

Solution

1. Step 1: Verify policy attachment

   Cloud Armor policies must be attached to backend services or load balancers to take effect.

2. Step 2: Check other factors

   While correct IPs and API enablement matter, the main reason for no blocking is often missing attachment.

3. Final Answer:

   The security policy is not attached to the backend service or load balancer -> Option D

4. Quick Check:

   Policy must be attached to work = C [OK]

Hint: Attach policy to backend service or load balancer to activate [OK]

Common Mistakes:

• Forgetting to attach policy to backend service
• Assuming policy works without attachment
• Ignoring API enablement or rule correctness

5. You want to protect your web app from both DDoS attacks and common web exploits. Which combination of Cloud Armor features should you use?

hard

A. Use Cloud Armor only for DDoS, and rely on firewall rules for web exploits

B. Only create IP-based allow/block rules without WAF

C. Create IP-based allow/block rules and enable the preconfigured WAF rules

D. Use Cloud Armor to monitor traffic but not block anything

Solution

1. Step 1: Understand protection needs

   DDoS protection requires blocking bad IPs; web exploits need WAF rules to detect attacks like SQL injection.

2. Step 2: Combine IP rules and WAF

   Cloud Armor supports both IP-based rules and preconfigured WAF rules to cover these threats together.

3. Final Answer:

   Create IP-based allow/block rules and enable the preconfigured WAF rules -> Option C

4. Quick Check:

   Use IP rules + WAF for full protection = A [OK]

Hint: Combine IP rules with WAF for best protection [OK]

Common Mistakes:

• Using only IP rules without WAF for web exploits
• Relying on firewall rules instead of Cloud Armor WAF
• Not enabling blocking, only monitoring