Protect a global HTTP(S) load-balanced Compute Engine application from DDoS and layer 7 attacks. What do you configure?

Google Cloud Armor is specifically designed to protect HTTP(S) Load Balancers from DDoS and layer 7 attacks. By creating a security policy and attaching it to the backend service, you can define rules to filter malicious traffic based on IP addresses, geographical locations, and various layer 7 attributes. VPC Service Controls enhance data exfiltration protection and are not primarily for DDoS or layer 7 attack mitigation on public-facing applications. VPC firewall rules operate at layer 3/4 and are less effective against layer 7 attacks, and placing them directly on instances leaves the load balancer vulnerable. Hierarchical firewall rules are for network-level traffic filtering, not application-layer attack protection.