Cloud Digital Leader Google Cloud Products and Services Practice Question
A company runs a global web application hosted on Compute Engine behind a Cloud Load Balancer. They want to protect against DDoS attacks and filter incoming traffic based on IP reputation and geolocation. Which Google Cloud service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Armor is a web application firewall (WAF) and DDoS protection service that integrates with Cloud Load Balancing. It allows IP allow/deny lists, rate limiting, and predefined rules to block traffic based on geo-location and threat intelligence. VPC firewall rules operate at the network level but cannot inspect application-layer traffic or use IP reputation. Cloud CDN caches content but does not filter traffic. Cloud NAT provides outbound connectivity only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud CDN
Why it's wrong here
Cloud CDN caches static responses at edge locations to accelerate content delivery and reduce latency, but it does not inspect incoming requests for security threats. When integrated with the load balancer, Cloud CDN can work alongside Cloud Armor, but by itself it offers no WAF capabilities, no IP reputation filtering, and no geo-based access controls, so it cannot satisfy the requirement to filter malicious traffic.
- ✗
Cloud NAT
Why it's wrong here
Cloud NAT translates internal VM source IPs to an external IP for outbound connections, allowing instances without external IPs to reach the internet. It is exclusively an outbound forwarding capability—it does not inspect or filter inbound traffic arriving at the application load balancer, and it provides no layer-7 security features such as DDoS protection, WAF rules, IP deny lists, or geo-filtering. Therefore, it cannot block malicious requests or enforce location-based access policies.
- ✓
Cloud Armor
Why this is correct
Cloud Armor is a managed edge security service that works directly with external HTTP(S) load balancers to protect applications from DDoS attacks and web-based threats. It provides a customizable Web Application Firewall (WAF) with OWASP Top 10 rules, IP allow/deny lists, rate limiting, IP reputation filters, and geography-based access control, making it the appropriate choice for blocking malicious traffic and enforcing regional access policies on a global web application.
- ✗
VPC firewall rules
Why it's wrong here
VPC firewall rules operate at layer 3/4 of the network stack, filtering traffic based on source and destination IP ranges, protocols, and ports. They cannot inspect HTTP payloads, identify application-layer attacks, or apply geo-IP or IP-reputation filters; they also lack the ability to block specific high-risk IP addresses from certain regions or enforce WAF signatures. For a global application requiring security filtering beyond basic network access control, VPC firewall rules are insufficient.
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
Key term
DDoS
A DDoS (Distributed Denial-of-Service) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple compromised systems.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.