Google Cloud Professional Cloud Network Engineer — Question 62

Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that the caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it as a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost.
Which two steps should you take? (Choose two.)

Answer options

• A. Use Cloud Armor to blacklist the attacker's IP addresses.
• B. Increase the maximum autoscaling backend to accommodate the severe bursty traffic.
• C. Create a global HTTP(s) load balancer and move your application backend to this load balancer.
• D. Shut down the entire application in GCP for a few hours. The attack will stop when the application is offline.
• E. SSH into the backend compute engine instances, and view the auth logs and syslogs to further understand the nature of the attack.

Correct answer: A, C

Explanation

Option A is correct because using Cloud Armor to blacklist the attacker's IP addresses can help mitigate the impact of the DDOS attack by blocking unwanted traffic. Option C is also correct as moving to a global HTTP(s) load balancer can provide improved scalability and better manage incoming traffic. The other options are ineffective; increasing the autoscaling backend (B) may not address the attack, shutting down the application (D) is not a viable solution for maintaining service, and SSH-ing into instances (E) wouldn't help restore access quickly.