Question

Your company serves static assets from a Cloud Storage backend bucket behind a global external Application Load Balancer with Cloud CDN enabled. Security wants to block requests from a list of known malicious IP ranges as early as possible—ideally at Google's edge and even for cached content served by CDN—before those requests reach the backend bucket or consume cache resources. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Attach an edge security policy to the backend bucket with deny rules matching the malicious IP ranges

Answer

Attach a backend security policy to the backend bucket with deny rules matching the malicious IP ranges

Answer

Configure a hierarchical firewall policy at the organization level to deny the malicious IP ranges

Answer

Add a VPC network firewall rule denying the malicious IP ranges on the load balancer's forwarding rule