Question

A media company serves static video thumbnails through a global external Application Load Balancer with Cloud CDN enabled. Their security team wants to filter requests based on source IP address and geographic region BEFORE any content is served from the CDN cache, so that malicious or out-of-region requests never reach cached or backend content. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Attach a Cloud Armor edge security policy to the backend service, using rules that match on source IP and region expressions

Answer

Attach a standard Cloud Armor backend security policy to the backend service and enable rate-based ban rules

Answer

Configure a Cloud Armor security policy on the URL map with a preconfigured WAF rule set

Answer

Apply VPC firewall rules that deny traffic from disallowed geographic IP ranges before it reaches the load balancer