What's changed: Created Professional Cloud Security Engineer Chapter 2 (Domain 2 "Boundary protection": Cloud NGFW/L7 inspection, Identity-Aware Proxy, load balancers, Certificate Authority Service, Cloud Armor, Secure Web Proxy, Cloud DNS security (DNSSEC), API restriction; VPC/peering/Shared VPC/firewall security, N-tier isolation, VPC Service Controls; private connectivity = HA VPN/Cloud Interconnect/Private Google Access (incl. on-prem)/restricted Google access/Private Service Connect/Cloud NAT).
2.1Perimeter security and edge defense
Understand network perimeter controls (Cloud NGFW rules/policies, Identity-Aware Proxy [IAP], load balancers, Certificate Authority Service), Cloud NGFW application-layer (L7) inspection, private/public IP, web application firewall (Google Cloud Armor), Secure Web Proxy, Cloud DNS security settings, and continually monitoring/restricting configured APIs.
Build boundary defense in layers across the "public edge (internet side)" and "access control to apps." Stack WAF, IAP, and firewalls to minimize the exposed surface.
2.1.1Edge defense and app access control
Protect public web in front of an external load balancer with Google Cloud Armor (WAF—SQLi/XSS, DDoS, rate limiting). Make app access Identity-Aware Proxy (IAP)-based "access by identity + context," exposing internal apps zero-trust-style without a VPN. Control in-VPC traffic with Cloud NGFW rules/policies, enabling Enterprise-tier L7 (application-layer) inspection when needed. Control egress destinations by URL/SNI with Secure Web Proxy, and issue/manage internal TLS certificates with Certificate Authority Service (CAS). Map "public-web WAF = Cloud Armor," "identity-based app exposure = IAP," and "internal CA = Certificate Authority Service."
2.1.2DNS security and API restriction
Protect name resolution with Cloud DNS security settings: DNSSEC (anti-tampering of responses) and DNS server policies. Distinguish private/public IP so internal resources avoid needless public IPs. To shrink the attack surface, continually monitor/restrict the APIs in use (org-policy API restrictions, VPC Service Controls perimeters, disabling unused APIs). Map "anti-tamper DNS = DNSSEC" and "shrink attack surface = remove unused APIs/public IPs."
Common: requirement → means. E.g., "expose internal apps identity-based without a VPN" = Identity-Aware Proxy; "protect public web from WAF/DDoS" = Cloud Armor; "allowlist egress by URL/SNI" = Secure Web Proxy; "issue/manage internal TLS certs" = Certificate Authority Service; "L7 intrusion inspection" = Cloud NGFW Enterprise L7 inspection; "anti-tamper DNS" = DNSSEC.
Watch the mix-ups: (1) IAP (identity+context app exposure) vs Cloud Armor (L7 WAF/DDoS) play different roles—use both. (2) Secure Web Proxy (URL/SNI egress control) vs Cloud NAT (general egress) differ in purpose. (3) L7 inspection requires the Cloud NGFW Enterprise tier.
2.1.3Section summary
- Public web = Cloud Armor (WAF/DDoS); identity-based internal app exposure = Identity-Aware Proxy
- Internal CA = Certificate Authority Service; URL/SNI egress = Secure Web Proxy; L7 inspection = Cloud NGFW Enterprise
- Anti-tamper DNS = DNSSEC; shrink attack surface = remove unused APIs/public IPs
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To control/expose access to an internal web app by user identity and context without a VPN, which is best?
Q2. To protect a public HTTPS app from SQL injection and DDoS, which is best?
Q3. To run a private CA and issue/manage TLS certificates internally, which is best?
Q4. To make public-zone DNS responses verifiable against tampering (cache poisoning) via signatures, which Cloud DNS setting?
Q5. To restrict a VM's egress to only allowed URLs/SNIs, which is best?