GCP Security · Domain 2
Securing Communications and Establishing Boundary Protection
About 22% of the exam
Firewall evaluation order
- Hierarchical policy
- Network policy
- Per-network rules
- Implied rules
- Hierarchical policy
- evaluated at organization and folder
- Network policy
- attached to one or more networks
- Per-network rules
- the older rules on the network
- Priority
- lowest number wins within a level
- Go to next
- delegates the decision downward
- Targets
- network tags or service accounts
- Direction
- ingress and egress evaluated separately
- Implied rules
- allow egress, deny ingress
Hierarchical policies decide first, then network policies, then the per-network rules, and inside each level the lowest number wins
Firewall policy features
- Rules grouped into a reusable policy
- One policy attached to several networks
- Service account targets beat network tags
- Address groups referenced from rules
- Per rule logging for troubleshooting
- Ordered evaluation makes intent explicit
Service perimeters
- A perimeter around service resources
- Stops exfiltration using stolen credentials
- Applies even to valid identities
- Projects join a service perimeter
- Bridges connect two perimeters carefully
- Dry run mode shows would-be violations
Perimeter rules
- Ingress rules name identity and source
- Egress rules name identity and destination
- A source can be a project
- Cross-project pipelines need explicit rules
- Keep the key project inside it
- Violations appear in the audit logs
Access levels
- Conditions on address, device and identity
- Basic levels combine simple conditions
- Custom levels use an expression language
- Referenced by perimeters and conditions
- Device posture requires managed endpoints
- One level reused across many policies
Cloud Armor
Policies
- Attached to backend services
- Edge policies protect cached content
- Preview mode observes without enforcing
Rules
- Preconfigured rules for common exploits
- Sensitivity tunes coverage against noise
- Custom rules match request attributes
- Region matching for geographic blocks
Protection
- Rate limiting with a chosen response
- Adaptive protection detects application floods
- Auto deploy suggested mitigation rules
Load balancing and transport
- The global balancer terminates and hides backends
- Certificate manager renews at scale
- Domain authorization through naming records
- Backends reachable only through the balancer
- Health checks decide backend membership
- Encryption in transit by default externally
Identity aware proxy
- Authenticates before traffic reaches the application
- Removes the need for a public address
- Tunneling reaches administrative sessions inward
- A signed header proves the request came through
- Validate the signature and the audience
- Works with context aware access levels
Private connectivity
- Private access
- reach services without external addresses
- Private Service Connect
- a private endpoint for a service
- Service networking
- peered range for managed services
- Private cluster
- control plane without public reachability
- Secure web proxy
- policy on outbound web traffic
- Address translation
- outbound only, with logging
- Alias ranges
- pod addresses from the network
- Naming zones
- resolve service names privately
Hybrid connectivity
- Highly available tunnels
- encrypted over the public internet
- Dedicated interconnect
- private circuit into the network
- Partner interconnect
- circuit through a service provider
- Router
- exchanges routes dynamically
- Forwarding policy
- name resolution across the boundary
- Shared network
- one host project, several services
- Peering
- not transitive between networks
- Connectivity test
- verifies a path end to end
Application edge services
- A gateway enforces authentication and quotas
- Developer applications tie usage to credentials
- Token validation policies check the caller
- Bot scoring returns a risk value
- A scanner probes deployed web applications
- The contract is defined before enforcement
Boundary mistakes
- Allow rule sitting at a lower number
- Perimeter blocking a legitimate pipeline
- Key project left outside the perimeter
- Header trusted without verifying the signature
- Preview rules never promoted to enforcing
- Backends reachable directly, bypassing the balancer
Rapid recall: pick the control
- Exfiltration by valid credentials
- a service perimeter
- Web exploits at the edge
- a Cloud Armor policy
- Admin access without public addresses
- identity aware tunneling
- Block unapproved outbound sites
- the secure web proxy
- Private path to a service
- Private Service Connect
- Consistent rules across networks
- a network firewall policy
- Device posture in the decision
- an access level
- Prove a path is allowed
- a connectivity test
Reference strip: firewall, perimeter, edge, private paths, application
Firewall
- Hierarchical, then network, then rules
- Lowest priority wins per level
- Targets by service account
- Per rule logging
Perimeter
- Service perimeters around projects
- Ingress and egress rules
- Access levels as conditions
- Dry run before enforcement
Edge
- Armor policies on backend services
- Preconfigured and custom rules
- Rate limiting and adaptive protection
- Preview before enforcing
Private paths
- Private access for services
- Private endpoints for producers
- Private clusters and naming zones
- Translation for outbound only
Application
- Authenticating proxy in front
- Signed header verified downstream
- Gateway with credentials and quotas
- Scanner against deployed applications
Quick exam traps
- Trap: A service perimeter is unnecessary once identity access is tight
- Trap: The highest priority number wins in a firewall rule set
- Trap: A signed proxy header can be trusted without validating it
- Trap: Network tags are as reliable a target as service accounts
- Trap: Preview mode in Cloud Armor blocks the matching request
- Trap: Private access gives the platform resource a private address
- Trap: Network peering is transitive across a chain of networks
cybercertprep.com · original revision sheet written from the public body of knowledge