What's changed: Created Professional Cloud Network Engineer Chapter 6 (Domain 6 "Network security": Google Cloud Armor = edge/backend policies/WAF (SQLi/XSS/RFI)/advanced DDoS and Adaptive Protection/rate limiting/bot management/Threat Intelligence; Cloud NGFW/VPC firewall = strategy/hierarchical/effective policy/L7 inspection (Enterprise)/migration/rule criteria (priority/protocol/direction/source-destination)/logging/micro-segmentation (secure tags/SA/network tags)/tiers (Essentials/Standard/Enterprise); public Cloud NAT (auto-manual IP/static-dynamic ports); Secure Web Proxy; self-managed NVA (multi-NIC/internal LB next hop/policy-based routes)/out-of-band Network Security Integration/Packet Mirroring).
6.1Cloud Armor and Cloud NGFW / VPC firewall
Understand Google Cloud Armor policies (edge/backend security policies, WAF (SQLi/XSS/RFI), advanced network DDoS and Adaptive Protection, rate limiting, bot management, Threat Intelligence) and Cloud NGFW/VPC firewall rules (firewall strategy, hierarchical firewall, effective policy, L7 inspection (NGFW Enterprise), migration from VPC rules, rule criteria (priority/protocol/direction/source/destination), firewall logging, micro-segmentation, NGFW tiers (Essentials/Standard/Enterprise)).
Configure network security on two fronts: the "edge" (public boundary) and "inside" (in-VPC traffic). Cloud Armor handles the edge; Cloud NGFW/VPC firewall handles the inside.
6.1.1Google Cloud Armor
Google Cloud Armor applies security policies in front of an external Application LB. Distinguish edge security policies (before CDN/cache) from backend security policies (per backend service). Block known attacks with WAF rules (preconfigured rules for SQL injection, cross-site scripting, remote file inclusion, etc.), and prepare for large-scale attacks with advanced network DDoS protection and Adaptive Protection (ML-learned anomalies with suggested mitigations). Strengthen rules with rate limiting (per-source flow control), bot management (reCAPTCHA integration), and Threat Intelligence (known malicious IPs/Tor, etc.). Map "protect public web from WAF/DDoS = Cloud Armor."
6.1.2Cloud NGFW and VPC firewall
Control internal traffic with VPC firewall rules and Cloud NGFW policies. Combine hierarchical firewall policies (inherited by org/folder) with regional/global/network policies, mindful of the effective policy (the final result after priority evaluation). Define rule criteria by priority, protocol/port, direction (ingress/egress), and source/destination, and minimize "who can talk to whom" via micro-segmentation using secure tags, service accounts, and network tags instead of IPs. For L7 intrusion prevention, enable layer-7 inspection with NGFW Enterprise. Tiers are Essentials, Standard, and Enterprise—choose by feature need. You can also migrate from VPC rules to Cloud NGFW policies.
Common: requirement → means. E.g., "protect public web from SQLi/XSS" = Cloud Armor WAF preconfigured rules; "limit flow per source" = rate limiting; "ML-based DDoS mitigation suggestions" = Adaptive Protection; "firewall inherited org-wide" = hierarchical firewall policy; "control by identity not IP" = micro-segmentation with secure tags/service accounts; "L7 intrusion prevention" = NGFW Enterprise L7 inspection.
Watch the mix-ups: (1) Cloud Armor (edge/L7, public boundary) vs VPC firewall/NGFW (in-VPC traffic) are different layers. (2) Effective policy is decided by priority—mind overlapping hierarchical/network policies. (3) L7 inspection requires the NGFW Enterprise tier (not Essentials/Standard).
6.1.3Section summary
- Edge = Cloud Armor (WAF/DDoS/Adaptive Protection/rate limiting/bot/Threat Intelligence)
- Inside = VPC firewall/Cloud NGFW; hierarchical + effective policy; micro-segment by tags/SAs not IPs
- L7 inspection = NGFW Enterprise tier; choose Essentials/Standard/Enterprise by feature need
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To protect a public web app behind an external Application LB from SQL injection and cross-site scripting, which is best?
Q2. To implement firewalls inherited org-wide and applied consistently across folders/projects, which is best?
Q3. To minimize east-west traffic based on workload identity (tags/service accounts) instead of IPs, which approach?
Q4. To enable L7 (application-layer) intrusion-prevention inspection with Cloud NGFW, which tier is required?
Q5. To throttle requests when a source IP exceeds a threshold, mitigating L7 DDoS/brute force, which Cloud Armor feature?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.