Cloud Armor, DDoS Protection, and Web Security

When you put an application on the internet, you are hanging a sign that says 'open for business.' That sign attracts legitimate customers, but it also attracts attackers. Google Cloud provides three distinct services to defend that door.

Cloud Armor is a security service that sits in front of your application and filters all incoming traffic before it reaches your servers. It is like a security checkpoint at an airport. Every request (an HTTP request is just a message from a browser saying 'please send me this page') is inspected. Cloud Armor can block traffic based on the IP address of the sender, the country the request came from (geolocation), or specific patterns in the request body or headers (HTTP headers are metadata like 'what browser are you using'). It also includes a Web Application Firewall (WAF), which is a pre-configured set of rules that block common web attacks like SQL injection (where an attacker tries to type SQL database commands into a form field to steal data) and cross-site scripting (XSS) (where an attacker embeds malicious scripts into a web page that other visitors will run).

DDoS Protection in Google Cloud is a separate but related capability. A DDoS attack is when an attacker uses thousands of compromised computers (a botnet) to send an overwhelming amount of traffic to your site, like 100,000 people trying to push through a single door at the same time. The goal is to make your server so busy it cannot respond to real users, causing a denial of service. Google Cloud's DDoS Protection uses the scale of Google's own network — which has massive bandwidth — to detect and absorb these floods. It identifies abnormal traffic patterns (like a sudden spike from one region) and drops the malicious traffic before it reaches your Cloud Load Balancer (a load balancer is a device that distributes incoming traffic across multiple servers so no single server gets overloaded). Google offers two tiers: standard DDoS protection (included free with Cloud Armor) and Google Cloud Armor Managed Protection Plus, which costs extra and provides faster detection and more aggressive mitigation.

Web Security Scanner is a different tool entirely. It does not block traffic. Instead, it is a vulnerability scanner that you run against your own application to find security holes. It crawls your public URLs (Uniform Resource Locators — web addresses) and tries to find issues like mixed content (loading secure and non-secure elements on the same page), outdated libraries (old code that has known bugs), or cross-site scripting vulnerabilities. It is automated: you set it to run on a schedule, and it emails you a report of what it found.

The three services work together. Cloud Armor protects the perimeter in real time. DDoS Protection handles massive floods. Web Security Scanner finds the bugs in your code before attackers do. For the PCSE exam, you must know exactly when to use each one, and which features are paid vs free.

Imagine you work for a company called ShopFast, an online retailer that sells electronics. You have a web application hosted on Google Kubernetes Engine (GKE) — which is a service that runs your application in containers (lightweight packages of code). Your application is behind a global HTTPS Load Balancer (which sends users to the closest data centre for faster loading).

Your first task is to protect ShopFast from a known botnet that scrapes product prices every hour. You log into the Google Cloud Console and navigate to Network Security then Cloud Armor. You create a new security policy called 'block-scrapers'. In that policy, you add a rule: 'Deny traffic from source IP addresses in the list of known scrapers'. You also add a rate-limiting rule: any single IP address that makes more than 100 requests per minute is automatically blocked for 10 minutes. This stops aggressive bots without affecting real customers.

Next, you enable Google Cloud Armor Managed Protection Plus because ShopFast expects a huge sale day. The sale goes live, and within two minutes, a DDoS attack hits: 10,000 fake requests per second from a botnet in Asia. Google's edge network — the points where Google connects to the internet worldwide — detects this anomaly and drops 99% of the traffic before it reaches your load balancer. Your site stays up. You get an alert from Cloud Monitoring (a service that tracks metrics and sends notifications) that an attack was mitigated. You check the logs in Cloud Logging (a central place to store and analyse logs) to see the attack pattern. The following week, you run Web Security Scanner. You schedule it to scan the public URLs of ShopFast every Monday. The scanner finds that your search page has an XSS vulnerability: the search term is reflected directly in the page without being sanitised (cleaned of dangerous code). An attacker could send a link to a customer that steals their session cookie. You get the report, fix the code, and rescan to confirm the vulnerability is gone.

Finally, you review the access logs from Cloud Armor. You see that someone in a blocked IP range tried to access your admin login page five times in one minute. That is an attacker probing your defences. The rule caught it. You write a note for the audit: 'Cloud Armor block rule prevented brute-force attempt on admin endpoint'. That proof is required for compliance certifications like PCI DSS (Payment Card Industry Data Security Standard).