Cloud Digital Leader Google Cloud Products and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud DNS

  Why it's wrong here

  Cloud DNS is a managed authoritative DNS service that translates human-readable domain names into IP addresses. It operates at the DNS layer and is entirely unaware of HTTP request content, so it cannot inspect for SQL injection or XSS patterns. While DNS can influence traffic routing via latency-based policies, it neither caches web content nor enforces security rules, making it irrelevant to the attack described.

• ✓

  Cloud Armor

  Why this is correct

  Cloud Armor is Google Cloud's web application firewall (WAF) that provides configurable security policies for HTTP(S) load balancing. It includes pre-configured rules from the ModSecurity Core Rule Set to block SQL injection, cross-site scripting, and other OWASP Top 10 threats. Cloud Armor also supports IP allow/deny lists, geo-based access controls, and rate limiting, making it the precise service to protect a web application from the stated attacks.

• ✗

  Cloud NAT

  Why it's wrong here

  Cloud NAT provides outbound internet connectivity to private VM instances that lack external IP addresses, while blocking unsolicited inbound connections. It operates at the network layer and has no visibility into application-layer payloads, so it cannot identify malicious HTTP requests like SQLi or XSS. Additionally, Cloud NAT does not cache any content, so it serves a completely different purpose than a WAF or CDN.

• ✓

  Cloud CDN

  Why this is correct

  Cloud CDN uses Google's global edge network to cache static and dynamic content closer to users, reducing latency and backend load. While it can improve performance and help absorb some volumetric DDoS attacks, its core function is content caching, not security inspection. Cloud CDN cannot examine incoming request bodies for SQL injection or XSS signatures, as that requires a dedicated WAF service like Cloud Armor.

• ✗

  Cloud Load Balancing

  Why it's wrong here

  Cloud Load Balancing distributes incoming traffic across multiple backends to achieve scalability and high availability, supporting both L3/L4 and L7 (HTTP/S) modes. However, its role is traffic routing, not security enforcement; it does not inspect request payloads for malicious patterns. Load balancing also does not cache content, so it fails to address either the performance or the WAF security requirements of the scenario.

Go deeper

Related to this question