Restricting Internal App Access to a Known-Good CIDR

PCSE By islever Editorial Last updated

Designing and configuring perimeter security. Configuring boundary segmentation.

Short answer

B Apply VPC Firewall Rules permitting only the known-good source CIDR, relying on Google's native network-level SYN flood protection for the internal web tiers.

Question

A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer's internal compliance requirements dictate that end-
user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only
have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?
  1. Cloud Armor
  2. VPC Firewall Rules Correct Answer
  3. Cloud Identity and Access Management
  4. Cloud CDN

Key Takeaways

The trap is over-selecting Cloud Armor: the question deliberately accepts minimal SYN-flood-only protection and demands a CIDR-based source filter, which points to VPC firewall enforcement instead of a managed WAF.

This PCSE question tests how to allow only a specific source CIDR for an internal 3-tier GCP application while accepting basic native SYN-flood mitigation. The correct choice is VPC Firewall Rules (B), because Cloud Armor, IAM and Cloud CDN do not match the stated scope.

Common mistake: Choosing A, Cloud Armor, because it is GCP's DDoS/WAF product — but it adds layer-7 protection the customer did not ask for, requires a compatible load balancer, and is not needed when a CIDR allow-list plus Google's native network protection suffices.

Expert Analysis

The qualifiers decide this question. The prompt is built around three restraints: an internal application, access limited to one known-good CIDR, and a customer who explicitly accepts having nothing beyond basic SYN-flood handling and wants "GCP's native" protection. Each restraint eliminates an option.

"Only have SYN flood DDoS protection" rules out A. Cloud Armor is a managed WAF and adaptive DDoS service: it brings L7 rules, bot management, preconfigured rule sets, rate limiting and adaptive protection — far more than the customer asked for, at additional cost, and it must be attached to an external HTTP(S)/SSL/TCP proxy load balancer or a regional internal Application Load Balancer. Choosing Cloud Armor means buying capability the compliance statement says is unnecessary, and it does not by itself enforce "traffic must originate from this CIDR" as a hard network boundary.

"Specific known good CIDR" is a source-address allow rule, which is exactly B's job. VPC firewall rules (including hierarchical firewall policies) filter on source IP ranges and are enforced by Google's Andromeda virtualization fabric on every packet, regardless of which subnet the workload sits in. Google's own DDoS-protection guidance describes the network fabric and Google Front End/proxy load-balancing infrastructure as absorbing L4 attacks such as SYN floods, IP fragment floods and port exhaustion — this is the "native" protection being referenced, and it requires no extra product purchase.

C is identity, not network filtering. IAM decides which principal may call an API or manage a resource; it never inspects packet source addresses or mitigates floods, so it cannot satisfy a CIDR-based traffic rule.

D is a caching/edge product. Cloud CDN only accelerates content served through supported load balancers, is not available for internal-only applications, and performs no source-CIDR enforcement or SYN-flood mitigation.

So B is the only option that satisfies both stated constraints with the minimum scope the customer accepted.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question states the customer 'accepts the risk' or wants only a minimal capability, it is signalling the simplest, lowest-cost control, not the full-featured security product. Eliminate options that add unrequested features or require infrastructure the scenario never mentions (such as an external load balancer for Cloud Armor or CDN). Then match the literal requirement — source-CIDR filtering is a firewall function; identity checks are IAM; caching is CDN.

Frequently Asked Questions

Can Cloud Armor restrict access to a single CIDR range?

Cloud Armor security policies can express allow/deny rules on source IP ranges, but they must be attached to a supported external or regional internal Application Load Balancer and add WAF and adaptive DDoS capabilities beyond a plain CIDR allow-list.

Where does Google's native SYN flood protection come from?

It comes from Google's own network fabric and, for proxy load balancers, the Google Front End infrastructure, which absorbs L4 attacks such as SYN floods, fragment floods and port exhaustion without any customer-side product configuration.

Why can't Cloud IAM enforce a CIDR allow-list?

IAM evaluates identity and permissions for API and resource operations; it never inspects packet source addresses, so it cannot express a network rule such as 'only traffic from 203.0.113.0/24 is permitted'.

More PCSE FAQ →

Community Votes

B
86%
A
14%

86% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 42 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 42

  1. Jeanphi72 👍 4 Answered B
    See here: https://cloud.google.com/files/GCPDDoSprotection-04122016.pdf DDoS Protection by enabling Proxy-based Load Balancing ○ When you enable HTTP(S) Load Balancing or SSL proxy Load Balancing, Google infrastructure mitigates and absorbs many Layer 4 and below attacks, such as SYN floods, IP fragment floods, port exhaustion, etc. ○ If you have HTTP(S) Load Balancing with instances in multiple regions, you are able to disperse your attack across instances around the globe.
  2. alilikpo 👍 4 Answered B
    While Cloud Armor offers advanced DDoS protection, it's not the most suitable choice for restricting access based on known good CIDRs in this scenario. Cloud Armor excels at mitigating volumetric DDoS attacks like SYN floods, but its access control mechanisms aren't specifically designed for CIDR-based whitelisting.
  3. shetniel 👍 4
    It is an internal web application and they need to allow access only for user traffic originated from a specific CIDR. They are fine with just default SYN flood protection. This can very well be handled by a VPC firewall rule.
  4. ppandher 👍 4
    Can Cloud Armor be used for INTERNAL Applications ? I think - NO, as it is used for External attacks- so Answer should be - B VPC Firewall Rules. Verified from ChatGPT3.5
  5. dar10 👍 4
    Cloud Armor is not available for Internal HTTP(S) load balancers. I'd vote for B. https://cloud.google.com/load-balancing/docs/features#security
Show 25 more comments
  1. ThisisJohn 👍 3 Answered A
    If there were at least a L4 load balancer in the picture, I'd vote for B, since then the LB would take care of "GCP's native SYN flood protection", also considering that "The customer accepts the risk that their application will only have SYN flood DDoS protection.". With cloud armor I guess they get more protection that required on the question, but it seems to be the only entry that fulfills the requirements
  2. n2183712847 👍 2 Answered B
    B. is the correct answer. The prompt specifically mentions the customer "accepts the risk that their application will only have SYN flood DDoS protection" and wants to use "GCP's native SYN flood protection" for an internal web application. VPC Firewall Rules inherently provide SYN flood protection at the network level as part of Google Cloud's underlying network infrastructure, protecting against this specific type of DDoS attack without needing a more advanced WAF like Cloud Armor (which provides broader DDoS protection and L7 features). The firewall rules can also restrict access to the "specific known good CIDR."
  3. MaggieLi2022 👍 2 Answered A
    GCP doesn't have a native VPC firewall for SYN flood protection; that function is handled by Cloud Armor, which is a separate, edge-based service for DDoS mitigation. Cloud Armor uses security policies to protect external HTTP(S), SSL proxy, and TCP proxy load balancers, and it applies these policies at the edge of Google's network before traffic reaches your VPC.
  4. 3d9563b 👍 2 Answered B
    VPC Firewall Rules will allow you to control access based on CIDR ranges, ensuring that only traffic from the specified IP addresses is permitted. Additionally, GCP provides built-in SYN flood protection as part of its infrastructure. This solution aligns with both the internal compliance requirements and the acceptance of the risk regarding SYN flood attacks.
  5. The_Snobby 👍 2 Answered B
    C and D are wrong. So its A or B. standard DDoS is fullfilled for both, but for A you need a load-balancer and it costs additional. In the question it is only 3-tier, which does not need a loadbalancer and it is specifically mentioned that the do not need the advanced secxurity, which would come with cloud armor at additional costs. That only leaves B.
  6. alestrix 👍 2 Answered B
    For CIDR check the firewall is sufficient and SYN flood protection is already given by the regular load balancer in front of the service. Armor gives much more than just SYN flood protection and given the statement "their application will only have SYN flood DDoS protection" this is another vote against Armor.
  7. juanmacoellocloudsecarch 👍 2 Answered A
    This question is asking us about "Web application" ... You have to think directly in the WAF ... So first thing is Cloud Amor... If you keep reading this talk aboyt SYN, That's a TCP Protocol from L4 and VPC Frules are L3 (IP not transport layer)... A.
  8. civilizador 👍 2
    The question clearly indicates that request should be allowed only if originating from a specific CIDR so the answer is a firewall rules
  9. minostrozaml2 👍 2
    Took the tesk today, only 5 question from this dump, the rest are new questions.
  10. charlesdeng 👍 2 Answered B
    For internal web application, it shall be used by VPC Firewall Rules
  11. ArizonaClassics 👍 2
    A is perfect!
  12. BPzen 👍 1 Answered A
    Cloud Armor: This service is specifically designed for web application and API protection. It allows you to configure rules based on IP addresses (CIDR ranges), and it includes built-in DDoS protection, including SYN flood protection. This directly addresses the customer's requirements. Here's why the other options are not the best fit: B. VPC Firewall Rules: These are primarily for controlling traffic within your VPC network. While you can restrict traffic based on IP addresses, they don't offer the advanced DDoS protection capabilities of Cloud Armor.
  13. civilizador 👍 1
    https://cloud.google.com/files/GCPDDoSprotection-04122016.pdf It doesn't say a word about cloud Armor in the context of DDoS attacks because it is not the main feature of Cloud Armor. In the DDoS mitigation best practices only mentioned Load Balancer, Firewall rules and CDN. So I don't know if it is either Firewall rules or CDN. Most likely Firewall rules since CDN doesn't directly prevent the attack more like distributes it through multiple global endpoints. Little bit tricky question.
  14. zanhsieh 👍 1 Answered A
    I will still stick with A since Cloud Armor supports regional internal application load balancer: https://cloud.google.com/load-balancing/docs/l7-internal#backend-features https://cloud.google.com/load-balancing/docs/l7-internal/int-https-lb-tf-examples Also the question does not ask for cross region, Cloud Armor should be an easier and safer bet.
  15. AxwayMen 👍 1 Answered B
    The correct answer is B. VPC Firewall Rules. Because: They allow you to restrict access by CIDR. Built-in (native) SYN flood protection is part of GCP and does not require a separate product. The question is not about advanced DDoS protection, but only about the basic protection that GCP provides “out of the box.”
  16. rwintrob 👍 1 Answered A
    Answer is A, Cloud Armor is Google Cloud's native web application firewall (WAF) and DDoS protection service. It is designed to protect applications and services from a wide range of threats, including SYN flood DDoS attacks and IP-based access control.
  17. Loved 👍 1
    You're right, but you want to enable only traffic from specific CIDR, and Cloud Armor is the most efficient option as you can use it with LB (with firewall rules you have to define at least one rule for each VPC)
  18. dblasi 👍 1 Answered A
    The answer is A B is wrong While VPC firewalls can filter traffic based on IP CIDR ranges, they do not offer a specialized, managed service for DDoS protection like SYN flood mitigation.
  19. Bharathy 👍 1
    Cloud Armour supports ip range (CIDR) and also custom types can be defined using Armour Rule Language termed as CEL ( Common Expression Language ). Option A is correct
  20. zzaric 👍 1
    Internal LB will be used just for the backends, even not mentioned, the end-users will hit first the external LB - that works with CA - so the right answer is A
  21. ppandey96 👍 1 Answered A
    https://cloud.google.com/blog/products/identity-security/how-google-cloud-blocked-largest-layer-7-ddos-attack-at-46-million-rps
  22. hammer88 👍 1 Answered B
    Cannot be A because question says Internal application while Cloud Armor is only on external perimeter
  23. gcpengineer 👍 1
    the External Load Balancer (LB) does not provide built-in protection against SYN flood DDoS attacks
  24. MohitA 👍 1
    A , you can specify allowed CIDR range of IP allowed
  25. mildi 👍 1
    Answer A if no Load balancer used

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide