A retailer runs a customer storefront behind a global external HTTPS load balancer and is being hit by large volumetric floods of junk requests that slow the site for real shoppers. Which service should be attached to the backend to absorb and filter this traffic at the edge?
Show answer and explanation
Answer: C
Cloud Armor security policies attach to backend services of global external Application Load Balancers. They provide network-edge DDoS mitigation for volumetric attacks and WAF rules, including preconfigured rules for common web attacks, plus IP and geographic allow or deny lists. Logging sinks only export logs, Cloud NAT handles outbound connections for instances without public IPs, and Cloud Interconnect provides dedicated private connectivity from on-premises networks.
Why the other options are wrong
- A. Log sinks route log entries to destinations such as BigQuery or Pub/Sub for analysis. They record the flood after it happens and do nothing to block or absorb the traffic while the storefront is serving users.
- B. Cloud NAT lets instances without public IPs reach the internet outbound. It does not accept or filter inbound requests, so it offers no protection for incoming floods aimed at the storefront.
- D. Cloud Interconnect provides dedicated private links between on-premises networks and Google Cloud. It concerns connectivity from corporate sites, not defending a public web application from internet traffic.