Cloud Digital Leader Google Cloud Products and Services Practice Question
A company runs a containerized microservices application on Google Kubernetes Engine (GKE). They want to expose a set of services externally with a single IP address, implement SSL termination, and protect against DDoS attacks. Which THREE Google Cloud services should they use together?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Load Balancing provides a single anycast IP and SSL termination. Cloud CDN accelerates content delivery and can be integrated with the load balancer. Cloud Armor provides DDoS protection and WAF capabilities. Cloud NAT is for outbound internet access, Cloud VPN for site-to-site VPN, and Cloud Interconnect for dedicated connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Armor
Why this is correct
Cloud Armor is Google Cloud's distributed denial-of-service (DDoS) protection and web application firewall (WAF) service. It attaches to an HTTP(S) Load Balancer and filters incoming traffic based on preconfigured or custom rules, mitigating OWASP Top 10 threats, IP-based blocklists, and rate-limiting before requests hit backend services. This makes it the decisive security layer for a containerized microservices application exposed to the internet, blocking malicious traffic at the edge.
- ✗
Cloud NAT
Why it's wrong here
Cloud NAT enables private VMs and GKE nodes without external IP addresses to initiate outbound connections to the internet, translating source IP addresses. However, it cannot accept inbound connections from the internet, so it is strictly an egress mechanism. Cloud NAT provides no security filtering or WAF capabilities, making it wholly unsuited for exposing or protecting a public-facing microservices application.
- ✓
Cloud Load Balancing
Why this is correct
Cloud Load Balancing, specifically the HTTP(S) Load Balancer, provides a single global anycast IP address, terminates SSL/TLS, and distributes traffic across backend instances or GKE pods. It is the standard external entry point for a containerized architecture and is required before services like Cloud Armor or Cloud CDN can be applied. While it offers incidental benefits like connection draining and health checks, it does not provide DDoS or L7 security filtering on its own, so it is correct as a foundational but incomplete solution.
- ✗
Cloud VPN
Why it's wrong here
Cloud VPN creates an IPsec tunnel between your on-premises network and a Google Cloud VPC, enabling private, encrypted site-to-site communication. It is not designed for internet-facing traffic and cannot accept inbound public connections, nor does it inspect HTTP payloads or provide WAF protections. Thus, Cloud VPN is irrelevant for exposing a microservices application to external clients or securing it from web-based attacks.
- ✓
Cloud CDN
Why this is correct
Cloud CDN, enabled on an HTTP(S) Load Balancer, caches content at Google's global edge locations, reducing latency for users and offloading requests from backend services. While this greatly improves performance and availability, it is a caching layer, not a security control. Cloud CDN relies on Cloud Armor to enforce access policies and attack mitigation, so it is a complementary service for a production microservices deployment but not the primary security defense.
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
GKE
GKE is Google's managed Kubernetes service that automates deploying, scaling, and managing containerized applications in the cloud.
Key term
WAF
A Web Application Firewall (WAF) is a security tool that filters, monitors, and blocks HTTP traffic to and from a web application to protect it from common attacks.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.