Cloud Armor for DDoS and WAF in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a Cloud Armor security policy.

GCP

gcloud compute security-policies create [1] --description="Block bad traffic"

Drag options to blanks, or click blank then click option'

Ainstance-group

Bfirewall-rule

Cnetwork-route

Dmy-security-policy

Attempts:

3 left

💡 Hint

Common Mistakes

Using instance group or firewall rule names instead of a security policy name.

Confusing network routes with security policies.

The command creates a Cloud Armor security policy named my-security-policy.

2fill in blank

medium

Complete the code to add a rule to block traffic from a specific IP address.

GCP

gcloud compute security-policies rules create 100 --security-policy [1] --expression="origin.ip == '203.0.113.1'" --action=deny-403

Drag options to blanks, or click blank then click option'

Amy-security-policy

Bmy-instance

Cdefault-firewall

Dnetwork-policy

Attempts:

3 left

💡 Hint

Common Mistakes

Using instance or firewall names instead of the security policy name.

Confusing network policies with Cloud Armor policies.

The rule is added to the Cloud Armor security policy named my-security-policy.

3fill in blank

hard

Fix the error in the command to apply the security policy to a backend service.

GCP

gcloud compute backend-services update [1] --security-policy my-security-policy --global

Drag options to blanks, or click blank then click option'

Amy-instance

Bmy-backend-service

Cmy-firewall

Dmy-network

Attempts:

3 left

💡 Hint

Common Mistakes

Using instance or firewall names instead of backend service names.

Confusing network names with backend services.

The backend service named my-backend-service is the correct target for applying the security policy.

4fill in blank

hard

Fill both blanks to create a rule that allows traffic only from a specific country.

GCP

gcloud compute security-policies rules create 200 --security-policy [1] --expression="origin.region_code == '[2]'" --action=allow

Drag options to blanks, or click blank then click option'

Amy-security-policy

BUS

CEU

Ddefault-policy

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect policy names or invalid region codes.

Confusing region codes with IP addresses.

The rule allows traffic only from the country with region code US in the security policy my-security-policy.

5fill in blank

hard

Fill all three blanks to create a rule that blocks SQL injection attempts.

GCP

gcloud compute security-policies rules create 300 --security-policy [1] --expression="evaluatePreconfiguredExpr('[2]')" --action=[3]

Drag options to blanks, or click blank then click option'

Amy-security-policy

Bsqli-v33-stable

Cdeny-403

Dallow

Attempts:

3 left

💡 Hint

Common Mistakes

Using allow action instead of deny for blocking attacks.

Using incorrect preconfigured expression names.

This rule uses the preconfigured SQL injection expression sqli-v33-stable to block attacks by returning a 403 error in the my-security-policy.