The Google Cloud Certified - Professional Cloud Security Engineer (Professional-Cloud-Security-Engineer)

To handle significant traffic spikes and potentially malicious IPs, you can use Google Cloud Armor to configure rate-based bans. This approach allows you to automatically ban clients that exceed a predefined request rate, protecting your application from potential denial-of-service attacks.

Access Google Cloud Console: Log in to your Google Cloud Console.

Navigate to Google Cloud Armor: Go to the " Security " section and select " Google Cloud Armor " .

Create Security Policy: Create a new security policy or edit an existing one. Add a new rule to the policy.

Configure Rate-Based Ban: Set the action to rate_based_ban. Define the rate limit (e.g., requests per second) and set the ban_duration_sec parameter to the desired time interval.

Apply the Policy: Apply the security policy to your backend service or load balancer.

Monitor and Adjust: Monitor the traffic patterns and adjust the rate limits and ban durations as necessary to balance security and availability.

Use the org policy constraint " Google Cloud Platform - Resource Location Restriction " on your Google Cloud organization node: This organizational policy constraint allows you to restrict the locations where your resources can be created. By setting this constraint to allow only Europe regions, you can ensure compliance with GDPR and other regional regulations.

Implementation: To implement this, you need to configure the organization policy with the constraint constraints/gcp.resourceLocations. You can specify allowed regions such as europe-west1 and europe-west4 to ensure resources are only created in these locations.

References

Resource Location Restriction documentation

GDPR compliance on Google Cloud

This option directly addresses the needs of the business user who must access curated reports. By creating curated tables in a separate dataset, you can control access to specific data. Assigning the roles/bigquery.dataViewer role allows the business user to view the data in BigQuery.

To ensure end-user access is only allowed if the traffic originates from a specific known good CIDR and to utilize GCP ' s native SYN flood protection, you can use the following product:

VPC Firewall Rules: By configuring VPC firewall rules, you can control traffic to and from your instances based on IP address, protocol, and port. You can set rules to only allow traffic from a specific CIDR block, ensuring that only authorized traffic can reach your application.

Additionally, Google Cloud Platform provides built-in protections against SYN flood attacks, which are a type of DDoS attack. These protections are part of the underlying infrastructure and do not require additional configuration.

Using VPC firewall rules will help you comply with the internal requirement of allowing access only from a specific CIDR and provide the necessary SYN flood DDoS protection.

References

Google Cloud VPC Firewall Rules

Google Cloud DDoS Protection

" The service evaluates all changes and remote access attempts to detect runtime attacks in near-real time. " : https://cloud.google.com/security-command-center/docs/concepts-container-threat-detection-overview This has nothing to do with KNOWN security Vulns in images

To remove personally identifiable information (PII) from files older than 12 months and archive the anonymized files for retention purposes, you can use Google Cloud Data Loss Prevention (DLP).

Create a Cloud DLP Inspection Job:

Go to the Cloud DLP section in the Google Cloud Console.

Create an inspection job that scans files in your Cloud Storage bucket for PII.

Configure the job to only target files that are older than 12 months.

Configure De-identification:

In the inspection job settings, configure de-identification actions to remove or obfuscate PII in the files.

Specify the transformation techniques appropriate for your data, such as masking or tokenization.

Archive Anonymized Files:

Set up the job to move the de-identified files to another Cloud Storage bucket designated for archival.

Ensure this bucket has the appropriate retention policies and access controls in place.

Delete Original Files:

After de-identification and archiving, configure the job to delete the original files from the source bucket.

This approach ensures that PII is effectively removed from old files and that the anonymized data is securely archived, maintaining compliance with data retention and privacy policies.

Cloud Data Loss Prevention Documentation

Setting Up DLP Jobs

Cloud Storage Documentation

Admin activity logs are always created to log entries for API calls or other actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions.

To ensure that payment information is encrypted between the customer’s browser and Google Cloud Platform during checkout, the company should configure an SSL certificate on an L7 (Layer 7) Load Balancer. Here’s why this is the best solution:

SSL/TLS Termination: An L7 Load Balancer can handle SSL/TLS termination, which means it can decrypt HTTPS traffic, offloading the work from the backend servers. This is essential for handling encrypted connections securely.

HTTPS Configuration: By configuring an SSL certificate, the load balancer ensures that all traffic between the customer’s browser and the application is encrypted using HTTPS.

Security Best Practices: Using an L7 Load Balancer with an SSL certificate aligns with best practices for securing web applications, particularly for e-commerce sites handling sensitive payment information.

Managed Certificates: Google Cloud offers managed SSL certificates, which simplifies the process of obtaining, deploying, and renewing SSL certificates.

Implementation Steps:

Obtain an SSL certificate.

Configure the L7 Load Balancer in the GCP Console.

Associate the SSL certificate with the load balancer.

Ensure that the backend services are configured to handle HTTPS traffic.

Google Cloud Load Balancing Documentation

Setting up HTTPS Load Balancing

The problem requires restricting the types of Google Cloud services that can be deployed within specific folders to enforce compliance, without affecting other parts of the resource hierarchy, using the most efficient and simple method.

Organization Policies: Organization policies allow you to define centralized, programmatic controls over your Google Cloud resources. They apply hierarchically, meaning a policy set on a folder applies to all projects and resources within that folder and its descendants.

Restrict Resource Service Usage Constraint: This specific organization policy constraint is designed precisely for controlling which Google Cloud services can be used (and thus deployed/created resources for) within a given part of the resource hierarchy. It supports both allowlists and denylists of service API identifiers.

Extract Reference: " The Restrict Resource Service Usage constraint controls the runtime access to all in-scope resources. " and " This constraint can be used in two mutually exclusive ways: Denylist - resources of any service that isn ' t denied are allowed. Allowlist - resources of any service that isn ' t allowed are denied. " (Google Cloud Documentation: " Restricting resource usage | Resource Manager Documentation " - https://cloud.google.com/resource-manager/docs/organization-policy/restricting-resources)

Folder-Level Application: Applying this organization policy at the folder level directly meets the requirement of applying restrictions " only to the designated folders without affecting other parts of the resource hierarchy. " This is more efficient and simpler than applying a global policy with numerous exceptions.

Let ' s evaluate the other options:

B. Implement IAM conditions on service account creation within each folder: IAM conditions control permissions for who can do what. While they can be used for very fine-grained access control, they are not designed to restrict the types of services that can be deployed directly. Controlling service account creation doesn ' t prevent a user with appropriate permissions from deploying other resources.

C. Create a global organization policy... and apply exceptions: While technically possible, this is less efficient and simple if the goal is to only restrict specific folders. Managing exceptions for the entire rest of the organization would be more complex than simply applying the policy directly where it ' s needed.

D. Configure VPC Service Controls perimeters around each folder: VPC Service Controls primarily prevent data exfiltration and restrict API access at a network perimeter level. They are not designed to restrict which types of Google Cloud services can be deployed within a project or folder; rather, they control how allowed services interact with each other and with external endpoints.

Therefore, creating an organization policy with the " Restrict Resource Service Usage " constraint at the folder level is the most efficient, simple, and direct method to achieve the stated goal.