You are deploying an external HTTP(S) load balancer that forwards to on-prem presentation-tier servers. To block malicious IPs and mitigate XSS at the edge before resources are consumed, what should you configure?

The correct option leverages Google Cloud Armor for DDoS and XSS protection at the edge, which is precisely its purpose. Applying it to a backend service that uses an internet network endpoint group (NEG) allows the load balancer to forward traffic to on-premise servers while Cloud Armor inspects requests before they reach your infrastructure. Incorrect options: Applying Cloud Armor to a backend service with an unmanaged instance group is incorrect because the servers are on-prem, not in Google Cloud. Hierarchical firewall rulesets are for network-level traffic filtering within Google Cloud, not for application-layer attacks like XSS or for traffic destined for on-prem resources. VPC firewall rulesets are also for network-level filtering within a VPC and cannot mitigate XSS attacks at the application layer or protect on-premise resources directly at the edge.