Your internet-facing TCP service is experiencing a large volumetric SYN flood. Which mitigation approach is the most appropriate first step on Google Cloud?
Choose an answer
Tap an option to check your answer.
Correct answer: Front the service with Google’s external HTTP(S) load balancer (Google Front End) so traffic is absorbed at the edge, and use Cloud Armor for L7 protection.
Why this is the answer
The external HTTP(S) load balancer (Google Front End) is Google's globally distributed edge network that inherently absorbs large volumetric attacks, including SYN floods, before they reach your backend instances. This provides a robust first line of defense. Integrating Cloud Armor with the external HTTP(S) load balancer further enhances protection by allowing you to configure Layer 7 (L7) security policies to filter malicious traffic based on various attributes. Attaching Cloud Armor only to the instance group is insufficient as the SYN flood would still overwhelm the instances directly. Switching to an internal load balancer would make the service inaccessible from the internet. Cloud NAT is for outbound connections and does not filter inbound SYN packets.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed