Google ACE Practice Question: A public API receives global traffic but has been…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  VPC firewall rules with deny rules for known attacker IPs

  Why it's wrong here

  VPC firewall rules are static network filters that allow or deny traffic based on source IP, destination IP, protocol, and port; they cannot parse HTTP headers or body content to detect SQL injection. IP-based deny lists are ineffective against distributed DDoS, as attackers can spoof IPs or launch from thousands of unique sources, and overly strict rules can block legitimate users. Firewall rules lack the L7 intelligence and scaling needed for modern web application protection.

• ✗

  Cloud NAT to hide backend IP addresses

  Why it's wrong here

  Cloud NAT only manages outbound connectivity from private VMs to the internet; it does not provide inbound protection for a public-facing load balancer. It neither inspects HTTP payloads for SQL injection nor absorbs large volumetric attacks. Hiding backend IPs behind a load balancer and NAT does not shield the public front-end from DDoS or L7 attacks, since the load balancer itself remains publicly reachable.

• ✓

  Cloud Armor security policies on the load balancer

  Why this is correct

  Cloud Armor security policies attached to the external HTTP(S) load balancer deliver both volumetric DDoS mitigation at Google's global edge and layer 7 WAF rules, including preconfigured OWASP rules that detect and block SQLi payloads. Because it operates at the edge and inspects traffic before it reaches backends, it can filter attack traffic close to the source while allowing legitimate requests. This single service directly addresses both the DDoS flood and the SQL injection attempts described in the scenario.

• ✗

  Identity-Aware Proxy (IAP) to require authentication before accessing the API

  Why it's wrong here

  Identity-Aware Proxy (IAP) enforces fine-grained, identity-based access control by requiring users to authenticate and pass context checks before reaching an application. It does not inspect request bodies or query strings for SQL injection patterns, nor does it have infrastructure to survive or filter distributed denial-of-service floods. IAP is a gate for who can access, not a filter for what content is malicious, so it leaves the API unprotected from both volumetric DDoS and SQLi.

Go deeper

Related to this question