Question

A retail company exposes a public web application through an external HTTP(S) load balancer. Recently, the application was targeted by SQL injection attempts and a volumetric flood of malicious requests from a handful of specific IP ranges. The security team wants to block the known bad IP ranges, mitigate common OWASP Top 10 attacks like SQL injection, and rate-limit abusive clients — all without modifying application code. Which approach should they implement?

Accepted Answer

Attach a Google Cloud Armor security policy to the load balancer backend service with deny rules for the IP ranges, preconfigured WAF rules for SQLi, and a rate-based ban rule.

Answer

Configure VPC firewall rules to deny the malicious IP ranges and enable Cloud NAT logging to detect SQL injection patterns.

Answer

Deploy Secure Web Proxy in front of the load balancer to filter inbound SQL injection traffic and enforce per-client rate limits.

Answer

Enable VPC Service Controls around the project and add the malicious IP ranges to an access level ingress deny list.