A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer’s internal compliance requirements dictate…

VPC Firewall Rules are the most direct and appropriate solution. They are a fundamental, native GCP security feature for controlling network traffic to and from VM instances based on IP CIDR ranges, protocols, and ports. This directly satisfies the requirement to allow traffic only from a specific CIDR. Google Cloud's infrastructure provides built-in, always-on protection against network-layer attacks like SYN floods for all services, which meets the customer's accepted risk profile without requiring additional products.

A. Cloud Armor provides advanced DDoS and WAF protection, which is more than the customer wants. It's typically for external load balancers, not internal applications as specified.
C. Cloud IAM manages user and service permissions to access GCP resources (authentication/authorization), not network traffic filtering based on IP addresses.
D. Cloud CDN is a content delivery network for caching and accelerating content delivery for public applications, which is not relevant for an internal application.

1. Google Cloud Documentation

"VPC firewall rules overview". It states

"VPC firewall rules let you allow or deny traffic to and from your virtual machine (VM) instances... Each firewall rule is defined with... a source for ingress rules... as a range of IP addresses."

2. Google Cloud Documentation

"Google Cloud infrastructure security design overview"

Whitepaper

PDF

Page 23

Section: "Denial of service (DoS) protection". It states

"Google’s backbone network has a great deal of capacity... Google has multi-tier

multi-layer DoS protections that further reduce the risk of any DoS impact... For example

we filter against SYN floods".