Google ACE Practice Question: Which GCP service protects internet-facing…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Firewall (VPC firewall rules)

  Why it's wrong here

  VPC firewall rules are a stateful, distributed firewall that enforce allow/deny decisions at Layers 3 and 4 (IP addresses, ports, and protocols) and can use network tags for granular VM-level control. However, they never inspect the actual HTTP request payload, so they cannot detect application-layer attack patterns such as SQLi or XSS. A VPC firewall rule might allow TCP/443 to reach your backend, but it would still happily forward a request containing 'OR 1=1' in a query parameter.

• ✓

  Cloud Armor WAF with preconfigured OWASP Core Rule Set

  Why this is correct

  Cloud Armor WAF with the preconfigured OWASP Core Rule Set is the correct choice because it performs deep, content-aware inspection of each HTTP request at the Google Cloud load balancer edge. Its rules are based on the OWASP ModSecurity Core Rule Set, which includes signatures and heuristics specifically designed to detect SQL injection, cross-site scripting, and other Top-10 web application attacks. When a request matches a malicious pattern, Cloud Armor can deny it before it ever reaches your backend instances, giving you runtime protection rather than just a report or a network-level filter.

• ✗

  Security Command Center's Web Security Scanner

  Why it's wrong here

  Security Command Center's Web Security Scanner is a vulnerability assessment tool that periodically crawls your web application and attempts to discover known security weaknesses, such as cross-site scripting or mixed content. It does not sit in the request path and cannot block malicious traffic in real time; instead, it generates findings and reports that you can triage in Security Command Center. Running the scanner helps you find and fix vulnerabilities, but it provides no inline runtime protection against an attacker actively sending SQLi or XSS payloads.

• ✗

  Cloud Identity-Aware Proxy (IAP)

  Why it's wrong here

  Cloud Identity-Aware Proxy (IAP) acts as an identity and access management gate: it intercepts requests and enforces authentication and authorization based on Google accounts, OAuth scopes, and context-aware access policies. It verifies that the caller is a valid identity and applies IAM roles to decide whether the request should reach the application, but it does not parse or evaluate the HTTP body or parameters for attack signatures. IAP can stop unauthorized users, but it will happily let an authenticated attacker send a SQLi payload through, because it has no web application firewall functionality.

Go deeper

Related to this question