Create a GKE private cluster with a private endpoint for the control plane. Configure
VPC Networking Peering export/import routes and custom route advertisements on the
Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.

Create a GKE private cluster with a public endpoint for the control plane. Configure VPC
Networking Peering export/import routes and custom route advertisements on the Cloud
Routers.

Create a GKE private cluster with a private endpoint for the control plane. Configure
authorized networks to specify the desired on-premises subnets.

Create a GKE public cluster. Configure authorized networks to specify the desired onpremises
subnets.

Peer the two VPCs, and use the default configuration for the Cloud Routers.

Peer the two VPCs, and use Cloud Router’s custom route advertisements to announce
the peered VPC network ranges to the on-premises locations.

Peer the two VPCs. Configure VPC Network Peering to export custom routes from Sales
and import custom routes on Finance's VPC network. Use Cloud Router’s custom route
advertisements to announce a default route to the on-premises locations.

Peer the two VPCs. Configure VPC Network Peering to export custom routes from Sales
and import custom routes on Finance's VPC network. Use Cloud Router’s custom route
advertisements to announce the peered VPC network ranges to the on-premises locations.

Create and associate a firewall policy with the Dev folder with a rule to open port 8080.
Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.

Create a Shared VPC for the Dev projects and a Shared VPC for the Prod projects.
Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall
rule to deny traffic to port 8080 in the Shared VPC for Prod. Deploy VMs to those Shared
VPCs.

In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all
VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.

Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev
VMs and deny traffic to port 8080 on the Prod VMs.

Create a VPC firewall rule in each VPC to block traffic from any source, with priority 0.

Create a VPC firewall rule in each VPC to block traffic from any source, with priority
1000.

Create two hierarchical firewall policies per department's folder with two rules in each: a
high-priority rule that matches traffic from the private CIDRs assigned to the respective
VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any
other source.

Create two hierarchical firewall policies per department's folder with two rules in each: a
high-priority rule that matches traffic from the private CIDRs assigned to the respective
VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from
any other source.

Use Cloud Armor to blacklist the attacker’s IP addresses

Increase the maximum autoscaling backend to accommodate the severe bursty traffic

Create a global HTTP(s) load balancer and move your application backend to this load
balancer.

Shut down the entire application in GCP for a few hours. The attack will stop when the
application is offline

SSH into the backend compute engine instances, and view the auth logs and syslogs to
further understand the nature of the attack.

HTTP(S) load balancer

Network load balancer

Internal load balancer

TCP/SSL proxy load balancer

Configure VPC peering in a full mesh.

Alter the routing table to resolve the asymmetric route

Create network tags to allow connectivity between all three VPCs.

Delete the legacy network and recreate it to allow transitive peering.

Keep the existing Dedicated interconnect. Deploy a VLAN attachment to a Cloud Router
in us-west2, and use VPC global routing to access workloads in us-east4 and us-central1.

Keep the existing Dedicated Interconnect. Deploy a VLAN attachment to a Cloud Router
in us-east4, and deploy another VLAN attachment to a Cloud Router in us-central1.

Order a new Dedicated Interconnect for a colocation facility closest to us-east4, and use
VPC global routing to access workloads in us-central1.

Order a new Dedicated Interconnect for a colocation facility closest to us-central1, and
use VPC global routing to access workloads in us-east4.